Summary
concluding search warrant application was supported by probable cause because "hash values [are] a reliable means of investigating child pornography because in practical application, a file's hash value is unique to that file."
Summary of this case from United States v. FioreOpinion
Case No. 2:06-cr-73.
January 30, 2007
MEMORANDUM OPINION AND ORDER
The Defendant Steven Cartier has moved to suppress (doc. #51) evidence gathered during a search of his house and statements he made to law enforcement officers during that search and to dismiss this case (doc. #56). For the reasons stated below and at the suppression hearing, his motions are DENIED.
I. Facts
On January 24, 2006, the Spanish Guardia Civil Computer Crime Unit ("Spanish Guardia") contacted the Federal Bureau of Investigation ("FBI") regarding a computer the Spanish Guardia believed contained child pornography. The Spanish Guardia was using a software program it developed with a private company to search the Edonkey peer-to-peer ("P2P") computer network to search for people who possessed child pornography. The software allowed the Spanish Guardia to search for child pornography by using hash values. A hash value is a unique multi-character number that is associated with a computer file. Some computer scientists compare a hash value to an electronic fingerprint in that each file has a unique hash value. The Spanish Guardia was using an investigative strategy in which it would start with a known image of child pornography, take the hash value associated with that file, enter the hash value in its P2P software to search for others possessing the same image of child pornography, and record the internet protocol ("IP") address associated with the other person's computer if that person shared more than five known images of child pornography. In conducting its search, the Spanish Guardia did not open the file it located to confirm it was child pornography.
Using this search strategy, the Spanish Guardia located an IP address in North Dakota that had shared images of child pornography. The Spanish Guardia contacted the FBI's Innocent Images Unit. After subpoenaing a North Dakota telephone company, the FBI acquired the IP address owner's name and address. The owner was Cartier.
The investigation was assigned to FBI Special Agent Christopher Boeckers. Relying on the information from the Spanish Guardia, Agent Boeckers obtained a search warrant from Magistrate Judge Alice Senechal. The warrant authorized the search of Cartier's residence and seizure of all computer equipment or storage devices that could transmit, create, or store child pornography; documentation related to those devices; software for those devices; access devices or passwords; and any papers containing sexually explicit material. The warrant also included an addendum, directing the FBI to use a reasonable computer search methodology that would not invade information irrelevant to the case.
The warrant was executed on April 13, 2006. Two other FBI agents, including Special Agent Mike Thompson, accompanied Agent Boeckers. The three met with three Bureau of Indian Affairs ("BIA") investigators prior to the search and then drove to Cartier's residence. The house was locked, so one BIA investigator contacted Cartier at work. Agent Thompson and one BIA investigator drove to Cartier's place of work and asked Cartier if they could have a house key so they would not have to break Cartier's lock to execute the search. Cartier agreed to drive back to his house and open it for them. Cartier stayed at his house while the agents executed the warrant. He agreed to talk to Agent Thompson during the search. Agent Thompson testified he told Cartier he was not under arrest, he did not have to talk to the agents, and he was free to end the interview and leave at any time. Agent Thompson testified the interview took approximately forty-five minutes to an hour. During the interview, Cartier made several incriminating statements regarding his possession of child pornography. Agent Thompson testified he asked Cartier for the passwords to his computers, and Cartier refused to provide them. He also testified Cartier took a telephone call during the interview. Agent Thompson testified that at the end of the interview Cartier stood and walked around the house, although to ensure the safety of those conducting the search he was usually accompanied by an agent or investigator. The search took approximately three hours. Several computers, hard drives, other pieces of computer equipment, and many storage devices such as VHS tapes and compact discs or floppy disks were seized.
The BIA was included in the search because Cartier lived on an Indian reservation.
Cartier moved to have this evidence and his statements suppressed and to have the case dismissed. He argues that his statements were involuntarily given in violation of the Fifth Amendment, that the search warrant was not based on probable cause, and that the search warrant was overbroad.
II. Discussion
a. Incriminating Statements
Cartier claims his Fifth Amendment rights have been violated because he was submitted to a custodial interrogation without being given his Miranda rights. A person is in custody if law enforcement formally arrests the person or restrains the person's freedom of movement to a degree associated with an arrest. United States v. Czichray, 378 F.3d 822, 826 (8th Cir. 2004) (citingCalifornia v. Beheler, 463 U.S. 1121, 1125 (1983)). However, the Eighth Circuit has held that questioning a suspect in his home after informing him that he is not under arrest, may terminate the interview, and may leave at any time is the best evidence that someone is not in custody. Id. (holding that a man who was interrogated for seven hours and denied permission to use the phone was not under arrest because he was at home and could end the interrogation at any time).
Miranda v. Arizona, 384 U.S. 436 (1966).
Cartier's interview took approximately one hour. Agent Thompson testified Cartier was told from the beginning that the interview was voluntary and that he could terminate it or leave at any time. He also testified the tone during the interview was cooperative, not coercive. The interview occurred in Cartier's home while law enforcement was executing a search warrant. Although the atmosphere was police dominated because six law enforcement agents were present, no restraint of movement or coercive tactics were implemented. Agent Thompson testified Cartier was allowed to use his phone and move around the house. Therefore, the Court concludes the interview of Cartier was noncustodial, Cartier's Fifth Amendment rights were not violated, and his statements to Agent Thompson should not be suppressed.
b. Probable Cause for the Warrant
Cartier argues no probable cause existed for the search warrant because only the hash values were used to establish probable cause. The Fourth Amendment provides, "no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." U.S. Const. amend. IV. A magistrate judge has probable cause to issue a search warrant when the totality of the circumstances presents facts establishing a fair probability that contraband or evidence of criminal activity will be found in the specific place to be searched. Illinois v. Gates, 462 U.S. 213, 238 (1983).
Each party presented an expert who testified regarding the reliability of hash values in file identification. Cartier's expert testified hash values are not a reliable means of determining what a file contains. He testified an investigator cannot evaluate a file's content based on the hash value alone. He also testified two files could have duplicate hash values but completely different content, known as a "collision" of hash values. The Government's expert testified that hash values were a reliable means of investigating child pornography because in practical application, a file's hash value is unique to that file. He testified that if this premise were not true, P2P networks would not work because the searcher could not reliably search for a known file, which is what P2P networks are designed to do. He also testified that as long as the investigator starts with an image with known content and a known hash value, an investigator can use the hash value to search for duplicates of that file. Both experts testified that in their professional knowledge, the only collision of hash values ever encountered were in studies designed to prove that hash values can be duplicated in different files. The Government's expert testified that had two hash values ever collided in "real-world" application, the event would be well publicized because it would be significant in their field.
The Court concludes the search warrant was based on probable cause. While relying on a hash value alone would doubtfully meet a certainty standard, Judge Senechal only had to find probable cause. While the use of hash values is not full proof, few things are. Agent Boeckers possessed information from a reliable law-enforcement agency, the Spanish Guardia. The Spanish Guardia relied on a trustworthy means of computer forensics. Therefore, this reliable information established probable cause to issue a warrant.
c. Overbroad Warrant
Finally, Cartier argues the search warrant was overbroad because it did not describe the search methodology to be used when searching the computers. However, other courts have held that a computer search warrant does not have to contain the search methodology to be used, only the place to be searched and the items to be seized. See United States v. Brooks, 427 F.3d 1246, 1251 (10th Cir. 2005) ("This court has never required warrants to contain a particularized computer search strategy. We have simply held that officers must describe with particularity the objects of their search."); United States v. Upham, 168 F.3d 532, 537 (1st Cir. 1999) ("The warrant process is primarily concerned with identifying what may be searched or seized-not how- and whether there is sufficient cause for the invasion of privacy thus entailed."). Therefore, the warrant is not defective because it did not include a computer search methodology. In fact, Judge Senechal went further than necessary and ordered the search of the computers be reasonably limited so as to not delve into irrelevant, personal information, thus protecting Cartier's rights.
III. Conclusion
Cartier's statements to Agent Thompson were voluntarily given. The warrant affidavit relied on a reliable source and a reliable science for identifying files, thus establishing probable cause. Finally, the warrant did not have to include the computer search methodology to be used. Therefore, Cartier's motion to suppress (doc. #51) and motion to dismiss (doc. #56) are DENIED.