Opinion
CRIMINAL ACTION NO. 09-136-JBC.
June 16, 2010
MEMORANDUM OPINION AND ORDER
This matter is before the court on the motion of the defendant, Eric J. Bradley, to suppress all of the evidence obtained from his personal laptop computer. R. 29. For the reasons below, the court will deny the motion.
I. Background
This case arises from an investigation of the trading of child pornography online through Gnutella, a free, internet-based file sharing network. In October 2008, Attorney General Investigator Bell conducted an undercover investigation that targeted internet protocol ("IP") addresses that displayed hash values, commonly described as digital fingerprints, of known or suspected child pornography.
During the course of his investigation, Investigator Bell determined that a specific IP address in Fayette County had been observed displaying file names and hash values consistent with known or suspected child pornography, and that this IP address was assigned to a fire station located at 1098 South Cleveland Road in Lexington, Kentucky. After several unsuccessful attempts to connect to the publicly shared LimeWire folder of that computer, Bell filed an open records request with the Lexington Fire Department in an effort to match the dates he observed the computer running in LimeWire and displaying child pornography to the dates and shifts of any employees assigned to the fire station. He determined that all dates coincided with one specific crew assigned to the fire station.
Based on information from the Fire Department's Division of Internal Affairs, Investigator Bell and Attorney General Investigator Kathryn Reed traveled to the fire station on June 30, 2009. Following their arrival, Bell obtained a consent form from the defendant, Eric J. Bradley, to load an image scan onto his computer in order to access any child pornography that might have been present. For reasons unknown, the program was unable to load, and Investigator Bell was not able to view any images of child pornography. Investigator Bell then asked for Bradley's permission to examine his LimeWire.props file. Bradley verbally consented to that request and provided Investigator Bell with his password to access the data. After reviewing that section, Investigator Bell found the Globally Unique Identifier ("GUID"), which had been previously associated with downloading suspected child pornography files. Investigator Bell then asked to speak to Bradley privately. They went to another room at the station, and during their subsequent conversation, which occurred at approximately 2:30 p.m., Investigator Bell advised Bradley that he was seizing Bradley's computer and applying for a search warrant. Investigator Bell explained that the matching GUID indicated that the computer had displayed known child pornography images over the internet. Bradley denied any knowledge of child pornography on the computer and stated that he was the sole user of the computer with the exception of his fourteen-year old son, and that he did not have internet service at his home.
The Limewire.props file is a configuration file that contains data about the installation and operation of the Limewire software program, including a unique identifier known as a globally unique identifier ("GUID"). Suppression Hr'g Tr. 48, March 25, 2010.
The following day, Investigator Bell obtained a state search warrant for a full forensic examination of the computer and turned the computer over to Attorney General Investigator Bill Baker. Investigator Baker's forensic examination of the laptop revealed approximately 50 videos and over 100 photographs containing suspected child pornography.
II. Analysis
Bradley has moved to suppress all of the evidence obtained from his laptop computer. R. 29. The basis for his suppression motion is that Investigator Bell seized his computer before obtaining either a valid search warrant or Bradley's consent, and no exception to the warrant requirement applied. R. 39 at 1. Bradley contends that the only possible exception to the warrant requirement that could justify the seizure of his laptop is exigent circumstances, but that the government has not met its burden of showing that the seizure was justified based on this exception.
"Seizure of a container, pending issuance of a warrant to examine its contents, is permitted where there is (1) probable cause to believe that it holds contraband or evidence of a crime and (2) if the exigencies of the circumstances demand it or some other recognized exception to the warrant requirement is present." United States v. Place, 462 U.S. 696, 701 (1983); see also United States v. Respress, 9 F.3d 483, 486 (6th Cir. 1993). Courts have analogized computers containing images of child pornography to containers and have relied on this principle in upholding the temporary seizure of a defendant's computer without a warrant. See, e.g., United States v. Vallimont, No. 09-14415, 2010 U.S. App. LEXIS 9651, at *2-3 (11th Cir. May 11, 2010).
Here, the warrantless seizure was appropriate under the exigent circumstances exception to the warrant requirement. In considering the presence of exigent circumstances, courts adopt a balancing approach, weighing the governmental interest being served against the intrusion on the individual's interest that would otherwise be preserved. United States v. Rohrig, 98 F.3d 1506, 1517 (6th Cir. 1996).
A. Probable Cause
First, Investigator Bell had probable cause to believe that Bradley's computer held child pornography. Probable cause is "a fair probability that contraband or evidence of a crime will be found in a particular place." Illinois v. Gates, 462 U.S. 213, 238 (1983). The presence of probable cause is determined by examining the totality of the circumstances "to make a practical, commonsense" determination of whether probable cause is present. Id. at 238-39. During his investigation, Bell determined that an IP address assigned to the fire station located at 1098 South Cleveland Road in Lexington, Kentucky, had been observed displaying file names and hash marks with known or suspected child pornography. During the consensual inspection of Bradley's computer, Investigator Bell matched Bradley's Limewire GUID to the GUID observed displaying images of child pornography between January 7, 2008, and September 19, 2008. Although Bradley denied any knowledge of his computer being used to view child pornography, he also told Investigator Bell that only he and his fourteen-year old son had access to it. In light of the totality of the circumstances, there was probable cause to believe that Bradley's computer contained images of child pornography.
B. Exigent Circumstances
Investigator Bell's concern that Bradley would destroy the computer and/or any evidence it contained constituted exigent circumstances. Investigator Bell testified that he and Bradley discussed that the visit to the fire station was part of an ongoing investigation of child pornography and that Bradley's software IP matched what Bell had identified. Investigator Bell testified that if he had left the computer in place, "there was a good chance or a probable chance that the hard drive could have been destroyed, tampered with, erased, and any evidence on it could have been destroyed." Suppression Hr'g Tr. 18, March 25, 2010. Although Bradley had consented to the image scan and examination of his LimeWire props, Bradley still could have attempted to destroy evidence once out of the investigators' presence. See United States v. Lamb, No 09-CR-44, 2010 U.S. Dist. LEXIS 19899, at *22 (N.D. W. Va. Jan. 14, 2010) (noting that although it seemed unlikely that the defendant would have destroyed evidence because he was cooperating with agents, he "could have gone into the residence and deleted some or all of the images from his computer or destroyed his computer"). Because Investigator Bell had a reasonable expectation that Bradley would destroy the evidence, exigent circumstances were present when Bell seized the computer. See Vallimont, 2010 U.S. App. LEXIS 9651 at *4 (noting that concern about destruction of evidence was understandable where defendant might become aware of the investigation); United States v. Stiles, 2010 U.S. Dist. LEXIS 41325, at *13 (holding that because the defendant had already admitted the that the computer contained child pornography, there was a risk the computer would disappear if the agents did not immediately seize it); cf. United States v. Santa, 236 F.3d 662, 670 (11th Cir. 2000) (holding that there were no exigent circumstances where defendants were "unaware of their impending arrest").
Bradley argues that the longevity of images on computers precludes a finding of exigent circumstances, but United States v. Frechette, 583 F.3d 374 (6th Cir. 2009), on which he relies, dealt with a staleness inquiry, and does not stand for the proposition that there is no danger of the destruction of potentially incriminating evidence in cases involving the storage of child pornography on personal computers.
Bradley also argues that Investigator Bell's statements regarding the ability to retrieve deleted files indicates that there was no danger of the destruction of evidence. Investigator Bell qualified his statements regarding the retrieval of deleted files, however, stating that "deleted files may reside in free space," that a computer's recovery system "may" keep a record of deleted data or a cache of temporary internet files, and that a browser "typically" only overwrites such files as they are replaced with more recently downloaded internet files. R. 39 at 7-8 (emphasis added). These qualified statements are not inconsistent with Investigator Bell's belief that Bradley would have attempted to destroy or conceal his computer and/or any evidence it contained.
C. Privacy Concerns and Timing
The warrantless seizure of Bradley's computer was sufficiently limited in scope and timing. Investigator Bell made a reasonable effort to reconcile the needs of law enforcement with Bradley's privacy interests. See Illinois v. McArthur, 531 U.S. 326, 331-32 (2001). Although Bell believed he had probable cause to arrest Bradley, he declined to do so at the time, and did not search the computer until he had obtained a warrant. See id. Moreover, the approximately twenty-six-hour period it took to obtain the warrant did not render the seizure unreasonable. See, e.g., United States v. Martin, 157 F.3d 46, 54 (2d Cir. 1995) (holding that an eleven-hour delay in obtaining a warrant to search a suitcase was not unreasonable where that period included Christmas and two weekends); United States v. Jodoin, 672 F.2d 232, 235 (1st Cir. 1982) (validating seizure of a suitcase where there was a four-day gap between the seizure and the issuance of a search warrant). In contrast to cases dealing with the seizure of a suitcase, which presumably would disrupt its owner's travel plans, this court does not find and Bradley has not articulated a reason that the approximately twenty-six-hour delay was unreasonable.
III. Conclusion
Accordingly, IT IS ORDERED that the motion to suppress, R. 29, is DENIED.