Summary
noting that even when a computer has been "wiped," where "all files and data associated with a prior user from a hard drive [are deleted]," the data may still be retrieved through forensic procedures
Summary of this case from U.S. v. ToupsOpinion
Criminal No. 05-26 Erie.
June 15, 2006.
MEMORANDUM OPINION
Presently pending before the Court is a motion to suppress filed by Defendant George L. Eberle, and a motion to for separate trials as between Defendants George L. Eberle and Defendant Alisha M. Eberle on Counts Three and Four of the indictment. Defendant Alisha Eberle has joined in each of the motions. For the reasons discussed below, the motions are denied.
I. BACKGROUND
George L. Eberle ("Mr. Eberle") and his wife, Alisha M. Eberle ("Mrs. Eberle") were charged in a four count indictment with conspiring to violate the laws of the United States in violation of 18 U.S.C. § 371 (Count I) and using a minor to engage in sexually explicit conduct for the purpose of producing visual depictions of such conduct in violation of 18 U.S.C. § 2251(a) (Count II). Counts III and IV of the indictment charge Mr. Eberle and Mrs. Eberle with knowingly receiving visual depictions of minors engaging in sexually explicit conduct in violation of 18 U.S.C. § 2252(a)(2), and possession of material depicting the sexual exploitation of a minor in violation of 18 U.S.C. § 2252(a)(4)(B), respectively. These charges, which form the basis of the motions addressed herein, stem from a search of the Eberle's computer in March of 2005.
The United States subsequently dismissed Counts One and Two on the record at the suppression hearing on March 7, 2006.
II. FINDINGS OF FACT
A suppression hearing was held on March 7, 2006, and the following constitutes this Court's findings of fact. On August 9, 2004, the legal department for Yahoo!, a major internet content provider, contacted the National Center for Missing and Exploited Children (NCMEC) to report that suspected child pornography had been posted to a yahoo site titledhttp://photos.yahoo.com/glepa2001. According to the information provided by Yahoo!, a person using the email address"glepa2001@yahoo.com" had uploaded photographic images of a child who appeared to be under the age of 18 exposing her genitals while in a sexual act or pose. Pursuant to a court order, Yahoo! revealed that the "glepa2001" account was registered to Mr. george e." with a date of birth of October 5, 1978, and an address in Corry, PA.
Because the address listed for the account was in Corry, the investigation was referred to the Erie County District Attorney's Office, where it was assigned to Erie County Detective Jessica Lynn. Working with postal inspectors, Detective Lynn ascertained that Defendant George Eberle and his wife, Defendant Alisha Eberle, resided at the address in question. Detective Lynn also discovered that the Eberles possessed a home computer, rented from House of Television Rental in Corry, Pennsylvania, as well as a webcam.
On August 20, 2004, as a result of his failure pay the rental fee for the home computer, employees for House of Television recovered the computer from Mr. Eberle, "wiped" the hard drive, and re-rented the computer to another customer. "Wiping" is a method of deleting all files and data associated with a prior user from a hard drive so that a computer may be safely transferred without a subsequent user being able to access the prior user's information. Generally, once a computer has been "wiped," any information contained on that computer is removed to "unallocated space." Data that has been relegated to unallocated space on a drive may only be recovered by a forensic procedure known as "data carving." As described at the suppression hearing by Mark Ganley, an expert witness for the defense:
Typically, on a hard drive all of the files are referenced in a table of contents on the drive, it says here's where the file is. Well, when you delete a file, it removes it from the table of contents. But the file is still on the drive, it doesn't actually go and remove the file. So when you carve data, what you do is look in this unallocated space that's considered to be empty space, and the data carving looks for patterns that indicate a certain type of file. Web pages will have a certain pattern. And it carves the data, basically, from the empty space.
(Transcript from Suppression Hearing, March 7, 2006, p. 131).
After discovering that Mr. Eberle's computer had been repossessed for lack of payment, Detective Lynn contacted the House of Television and learned that Mr. Eberle had possessed the computer from January 21, 2004, until repossession on August 20, 2004. On September 3, 2004, Detective Lynn obtained a search warrant for the computer and seized it from the House of Television. Detective Lynn then utilized a computer program known as "Forensic Tool Kit" to attempt to recover any images associated with the Eberles from the unallocated space of the computer. As indicated in this exchange from the suppression hearing, Detective Lynn failed to uncover anything of evidentiary value:
Q: Did you find anything of evidentiary value on the computer?
A: Absolutely not.
Q: And let's take that and do a few steps. Do you find child pornography on the computer?
A: No.
Q: Do you find anything in any way linking that computer to these two defendants?
A: No, I did not.
(Transcript, pp. 21-22). Detective Lynn, in fact, was unable to find any evidence whatsoever connecting that computer to the Eberles, despite searching for "Eberle," "George," "Alisha," and the screen name "glepa2001" in the unallocated space.
Detective Lynn then performed a more targeted search known as a "hash value check," whereby she searched for a specific identifier, known as an MD5 hash, that is particular to an internet image, much like a fingerprint. This hash check similarly failed to uncover any of the images that had been uploaded onto the Yahoo! server in 2001.
As a result of finding no evidence connecting that computer to the Eberles, Detective Lynn formed a conclusion that the computer given to her by the House of Television was not the same computer rented by the Eberles in 2004. At that point, Detective Lynn closed her investigation of Mr. Eberle.
On March 23, 2005, the Corry Police Department received a report that T.S., Mrs. Eberle's half-sister, had been sexually assaulted by Mr. and Mrs. Eberle in August/September 2001, when T.S. was twelve years old. A forensic interview of T.S. was conducted on March 24, 2005, during which T.S. described staying with the Eberles for several days in 2001. T.S. asserted that, while staying with the Eberles, she was frequently fondled and groped by both Mr. and Mrs. Eberle. She further claimed that Mr. Eberle forced T.S. to have sexual intercourse with her while Mrs. Eberle videotaped the assault. Additionally, and relevant to this motion, T.S. asserted that the Eberles had forced T.S. to remove her clothing while they took photographs of her in various states of undress, as well as completely nude, using their webcam. She stated that the Eberles' saved these images to their computer's hard drive and showed them to her later.
In January of 2005, T.S. was contacted in an internet chat room by Mrs. Eberle. This encounter revived her memories of the assault, and T.S. disclosed what had happened to her mother. T.S. then phoned Mrs. Eberle while her mother listened on a third line. During the ensuing conversation, Mrs. Eberle discussed the assault with T.S., informed her that the videotape of that event had been destroyed, and indicated that the Eberles would like to make another video with T.S. At some point, Mr. Eberle joined in the conversation and expressed his pleasure that T.S. wanted to make another videotape with them.
Following the forensic interview of T.S., Detective Lynn and another detective spoke with T.S. about the photographs taken with the webcam. Detective Lynn asked T.S. to identify whether she had been wearing any jewelry at the time of the assault, and T.S. disclosed that she often wore a silver ring and a necklace during that time period. After comparing the described jewelry items to those worn by the girl in the images uploaded to the glepa2001 account, Detective Lynn showed those images to T.S.T.S. then identified herself as the girl in the uploaded photos and confirmed that they were the ones taken the night of her sexual assault.
On March 28, 2005, Detective Lynn obtained a search warrant for the Eberles' residence, including:
Any/all digital records such as images, pictures, photos, computer hardware, storage and accessories to include, but not limited to: computer tower containing hard drive, monitor, mouse, keyboard, connecting wires, scanner, CD's, DVD's, USB drives, floppy disks, zip disks, digital camera, digital camera media, 8 mm tapes, VHS tapes, web camera, digital camera cell phone, any portable media devices.
(Search Warrant, Exhibit B, Defendant George Eberle's Omnibus Pretrial Motion, p. 1). The Eberles' computer was seized and a subsequent forensic search revealed approximately 80 images of child pornography stored on it. The instant indictment ensued.
II. MOTION TO SUPPRESS
The Eberles seek to suppress the images of child pornography found on their computer during the March, 2005 search. Their argument for suppression is twofold: first, they argue that Detective Lynn recklessly and/or willfully omitted material facts from the search warrant affidavit when seeking the March, 2005 warrant which, if included, would have vitiated probable cause. Second, Defendants contend that the affidavit failed to provide probable cause due to the staleness of the information contained therein.
A. Legal Standards
In Franks v. Delaware, 438 U.S. 154 (1978), the United States Supreme Court established the following procedure for challenging a search warrant affidavit that is alleged to contain materially false statements:
[W]here a defendant makes a substantial preliminary showing that a false statement knowingly and intentionally, or with reckless disregard for the truth, was included by the affiant in the warrant affidavit, and if the allegedly false statement is necessary to the finding of probably cause, the Fourth Amendment requires that a hearing be held at the defendant's request. In the event that at that hearing the allegation of perjury or reckless disregard is established by the defendant by a preponderance of the evidence, and, with the affidavit's false material set to one side, the affidavit's remaining content is insufficient to establish probable cause, the search warrant must be voided and the fruits of the search excluded to the same extent as if probable cause was lacking on the face of the affidavit.Id. at 155-56. The Third Circuit has held that Franks also applies to cases where it is alleged that facts have been deliberately or recklessly omitted from a search warrant affidavit. United States v. Frost, 999 F.2d 737, 742-43 (3rd Cir. 1993). In this context, "(1) omissions are made with reckless disregard for the truth when an officer recklessly omits facts that any reasonable person would know that a judge would want to know; and (2) assertions are made with reckless disregard for the truth when an officer has obvious reasons to doubt the trust of what he or she is asserting." Wilson v. Russo, 212 F.3d 781, 783 (3rd Cir. 2000).
Once a court finds that facts have been recklessly omitted from a search warrant application, the court must determine whether the omissions were material, or necessary to the finding of probable cause. This is because, even where there is an omission from an affidavit, the affidavit may nonetheless support a valid warrant if, when the omitted information is included in the affidavit, it still provides probable cause to search. Frost, 999 F.2d at 743. "To determine the materiality of the misstatements and omissions, we excise the offending inaccuracies and insert the facts recklessly omitted, and then determine whether or not the `corrected' warrant affidavit would establish probable cause." Id. at 789. In so doing, the Third Circuit has instructed courts to read the affidavit in its entirety in a common sense, non-technical manner, focusing on what the affidavit includes, rather than on what it does not include.United States v. Williams, 124 F.3d 411, 420 (3rd Cir. 1997); United States v. Jones, 994 F.2d 1051, 1056 (3rd Cir. 1993).
The Eberles argue that Detective Lynn failed to include the material fact that she had previously searched one of the Eberles' computers with negative results. In this regard, Defendants argue:
The basis for issuing the search warrant for the August 2004 computer was Detective Lynn's claim, identical to the claim in the affidavit in support of the March 2005 search warrant, that the images from 2001 would be on the August 2004 computer because Mr. Eberle would have moved them from each computer he had possessed . . . [but that] claim was refuted . . . by the search of the August 2004 computer which revealed that the computer did not contain the images of child pornography from August 2001.
(Omnibus Pretrial Motion, p. 13). They further argue that Detective Lynn recklessly or willfully omitted the information relative to her unsuccessful search of the computer to bolster the affidavit.
B. Were the omissions reckless or willful?
As an initial matter, we find that Detective Lynn's failure to include the information relative to her prior search of the Eberle's computer to have been neither willful nor reckless. As discussed more fully above, she did conduct a thorough forensic investigation of the computer. Having carefully considered the evidence, as well as Detective Lynn's demeanor on the witness stand, I conclude that as a result of her forensic examination she harbored a good faith belief that the computer had never been possessed by the Eberles:
Q: Now . . . once you finish your forensic exam, you don't find anything, what conclusion do you arrive at that point?
A: I honestly believed that [the computer obtained from House of Television] was not the computer the Eberles used.
Q: And why did you believe that?
A: Because there was absolutely no evidence whatsoever relating to the Eberles ever using this computer.
Q: In your experience did you expect, before you did the exam, to be able to extract information relative to the Eberles?
A: I would have expected to at least find a photo, if they had taken a photo.
(Transcript. P. 24). Otherwise stated, as a result of her forensic search, she held a good faith belief that the details of her search were immaterial or neutral given the computer's apparent lack of connection to the Eberles.
The fact that the Court concluded at the hearing, based upon the testimony of Mr. Culhane, the Manager of the House of Television, and the computer's stock number and the tracking data maintained by the store, that the computer had been in the Eberle's possession, does not undermine the Court's conclusion as to Detective Lynn's conduct. See, e.g., United States v. Capozzi, 347 F.3d 327, 332 (1st Cir. 2003) (holding that mere "negligence, mistake, or inattention to detail" in the preparation of a search warrant affidavit will not operate to deprive the government of the benefits of the affidavit where it was prepared in good faith).
C. Were the omissions material?
Even if Detective Lynn was reckless in her failure to discover that the computer she had searched had been possessed by the Eberles, the inclusion in the affidavit that a search of the Eberle's computer had failed to reveal incriminating evidence would not vitiate probable cause. An analogous situation was presented in United States v. Frost, 999 F.2d 737, 742-43 (3rd Cir. 1993), where the affiant to a search warrant omitted from his affidavit that a drug sniffing dog was exposed to, but did not alert to, a suitcase subsequently searched pursuant to the warrant and found to contain narcotics. Id. at 743. In reviewing the search warrant affidavit, the Third Circuit found that, even if the affidavit had included the dog's non-alert to the suitcase, the failure to alert was not inconsistent with the substantial probative thrust or information that was in the affidavit. Id. at 744. The affidavit was replete with factual allegations to support the search of the suitcase; the defendant's travel itinerary and methods were consistent with those of drug couriers; defendant was traveling without luggage, carrying large quantities of cash, acting furtively, and employing counter-surveillance techniques; and defendant became nervous and contradicted himself when speaking with detectives. Id. at 743-44. In light of this evidence, as well as the explanation of "masking" techniques that the affiant would have described had he included the non-alert in the affidavit, the Court held that probable cause supported the warrant despite the omission.Here, Detective Lynn offered a plethora of factual allegations to support her application for a warrant to search the Eberle's home and computer. Detective Lynn averred in the affidavit that photos depicting an underage girl had been uploaded from Mr. Eberle's email account to a free Yahoo! webpage in 2001; that the girl depicted in those photos, T.S., had approached police and volunteered that they had been taken at the Eberles' house and uploaded to their computer in 2001; that T.S. had been allegedly raped and assaulted while staying with the Eberles; that T.S. had been videotaped in the course of being raped; and that Mrs. Eberle had, only days before the search warrant application was filed, renewed the Eberles' interest in filming another sex video with T.S. via an internet chatroom and subsequent telephone conversation. We find that even if Detective Lynn had included the results of the prior fruitless search of the Eberles' computer in her affidavit, the "substantial probative thrust of information" included in the warrant was sufficient to provide a "fair probability that contraband or evidence of a crime [would have been] found" in the Eberles' home. Frost, 999 F.2d at 744 (quoting Illinois v. Gates, 462 U.S. 213, 238 (1983)).
Moreover, a computer's hard drive was only one of several potential storage devices that Detective Lynn's affidavit cited as a potential archiving device for child pornography:
Based on this officer's past experience and training, this affiant believes that graphic image files containing child pornography can be maintained for long periods of time in a number of ways: on a computer's build in hard disk drive, on portable storage disks, on CD ROMs or on other computer media.
(Search Warrant, p. 7). Although the computer searched in August 2004 was clean, this does not necessarily break the chain connecting the August 2001 images to the Eberles' 2005 computer. Those images, at the time Detective Lynn was searching the Eberles' computer in 2004, could have been stored on disks, CD ROMs, zip drives, or many other digital storage mechanisms:
Q: Why in the second warrant would you seek media or storage devices beyond just their computer?
A: When [T.S.] said that there was another web cam there, I definitely wanted to grab the computer for that part. She also said it was videotaped on VHS. So I wanted to look for the VHS. And other means, such as digital cameras or recorders. I also wanted to look for floppies, USB's and DVD's, because you could also store images on there, such as the images that were taken and uploaded to Yahoo. Generally, people who rent computers or upgrade computers will save them on those portable media devices so they always have it accessible to their new computer.
(Transcript, p. 35; see also Transcript, pp. 53-55). Indeed, considering that the Eberles were renting the computer searched by Detective Lynn in 2004, it seems reasonable that the fear of detection might prevent them from storing their illegal images on a computer that they knew they would have to return.
Significantly, the 2005 search warrant accounted for this precise possibility by expanding the scope of the search to include:
Any/all digital records such as images, pictures, photos, computer hardware, storage and accessories to include, but not limited to: computer tower containing hard drive, monitor, mouse, keyboard, connecting wires, scanner, CD's, DVD's, USB drives, floppy disks, zip disks, digital camera, digital camera media, 8 mm tapes, VHS tapes, web camera, digital camera cell phone, any portable media devices.
(Search Warrant, p. 1). Thus, the warrant recognized that the child pornography sought might as easily be contained in portable storage media as on the computer's hard drive.
B. Staleness
If information offered in support of a search warrant application is "too old, the information is stale, and probably cause may no longer exist." United States v. Harvey, 2 F.3d 1318, 1322 (3rd Cir. 1993). Age alone, however, does not determine staleness. "The determination of probable cause is not merely an exercise in counting the days or even months between the facts relied on and the issuance of the warrant." Id. (quoting United States v. Williams, 897 F.2d 1034, 1039 (10th Cir. 1990), cert. denied, 500 U.S. 937 (1991)). Rather, a court is required to also examine the nature of the crime and the type of evidence. Id.
The Eberles argue that the information contained in the affidavit was stale because "[t]he only evidence presented in the affidavit to establish that Mr. Eberle's computer would contain child pornography was the fact that over three and a half years prior to the time the search warrant was issued, a different computer possessed by Mr. Eberle contained child pornography." (Omnibus Motion, p. 14). However, in the context of child pornography, courts have recognized that "individuals will protect and retain child pornography for long periods of time because it is illegal and difficult to obtain." Zimmerman, 277 F.3d at 434. As one district court has noted:
The observation that images of child pornography are likely to be hoarded by persons interested in those materials in the privacy of their homes is supported by common sense and the cases. Since the materials are illegal to distribute and possess, initial collection is difficult. Having succeeded in obtaining images, collectors are unlikely to quickly destroy them. Because of their illegality and the imprimatur of severe social stigma such images carry, collectors will want to secret them in secure places, like a private residence. This proposition is not novel in either state or federal court: pedophiles, preferential child molesters, and child pornography collectors maintain their materials for significant periods of time.Lamb, 945 F. Supp. at 460 (citing, e.g., Harvey, 2 F.2d at 1322-23). Here, Detective Lynn included language in the affidavit explaining the collection tendencies of persons who collect child pornography:
Those who have demonstrated an interest or preference in sexually explicit visual images depicting children are likely to keep secreted, but readily at hand, sexually explicit visual images depicting children. . . . These depictions tend to be extremely important to such individuals and are likely to remain in the possession of or under the control of such an individual for extensive periods of time. A person who has this type of material is not likely to destroy the collection.
(Search Warrant, p. 4).
The Eberles counter that, while the notion that child pornographers do not destroy their collections is indeed widely accepted, the three and a half year interval between the uploading of the pictures in 2001 and the search for those photos in 2005 strains the limits of that principle:
The possession of child pornography at some point in time cannot result in probably cause to search for that child pornography existing into infinity. At some point even information about the possession of child pornography becomes stale. Where ever that point is three and a half years passes it.
(Omnibus Motion, p. 16). In the instant case, Detective Lynn presented additional evidence vitiating any claim of staleness. Shortly before Detective Lynn filed the search warrant application, T.S. had contacted her and disclosed that, in the course of an internet chat, Mrs. Eberle had indicated an interest in manufacturing another video of T.S. engaged in sexual intercourse with Mr. Eberle:
T.S. 11/6/89 stated that she had not had contact with her half sister, Alesha Eberle AKA Corbett until March 20, 2005 when Alesha Eberle AKA Corbett contacted T.S. 11/6/89 in a Yahoo! chat room. A phone call occurred between Alesha Eberle AKA Corbett and T.S. 11/6/89 on March 20, 2005. During the phone conversation, T.S. 11/6/89 stated that Alesha Eberle AKA Corbett told T.S. 11/6/89 that the VHS tape from three years ago was broken and that Alesha Eberle AKA Corbett and George Eberle wanted to make another tape with T.S. 11/6/89.
(Search Warrant, p. 5). The fact that the Eberles wanted to manufacture new child pornography with T.S. supports the notion that there was likely still child pornography in the Eberles' residence. See United States v. Sherr, 400 F.Supp.2d 843, 847 (D. Md. 2005) (holding that defendant's online chat 1 month prior to obtaining search warrant indicated defendant's continued interest in child pornography despite 8 month delay between defendant's receipt of child pornography and obtaining of warrant); Rabe, 848 F.2d at 997 (finding that information about pornography that was over 2 years old was not stale when coupled with more recent correspondence indicating a continued interest in pornography).
For the reasons discussed above, we find that the affidavit of probable cause was not constitutionally infirm. The Defendants' motion to suppress is therefore denied.
III. MOTION TO SEVER
Defendant George Eberle also requests his trial be severed from that of his wife and co-defendant, Alesha Eberle. Mr. Eberle notes that the government intends to introduce statements at trial against Mrs. Eberle that she made during internet chats and which display an interest in pornography and sex. These statements would be offered to help carry the government's burden of showing that Mrs. Eberle knowingly received and possessed the images of child pornography found on the March 2005 computer. Mr. Eberle argues that those statements, while admissible only against his wife, will severely prejudice him in the minds of the jurors if his trial is not severed.
"[A] district court should grant a severance under Rule 14 only if there is a serious risk that a joint trial would compromise a specific trial right of one of the defendants, or prevent the jury from making a reliable judgment about guilt or innocence."Zafiro v. United States, 506 U.S. 534, 539 (1993). Severance may be appropriate "when evidence that the jury should not consider against a defendant and that would not be admissible if a defendant were tried alone is admitted against a codefendant." Id. However, "`[p]redjudice should not be found in a joint trial just because all evidence adduced is not germane to all counts against each defendant' or some evidence adduced is `more damaging to one defendant than others.'" United States v. Balter, 91 F.3d 427, 432-33 (3rd Cir. 1996) (citing United States v. Console, 13 F.3d 641, 655 (3rd Cir. 1993), cert denied, 511 U.S. 1076 (1994)). Rather, the court must consider whether the evidence can reasonably be compartmentalized by the jury as it relates to each defendant. United States v. Sandini, 888 F.2d 300, 307 (3rd Cir. 1989).
In Sandini, the Third Circuit emphasized that "a prejudicial spillover" is unlikely where "there is substantial independent evidence of a defendant's guilt." Id. at 307-08. Here, we find that almost all of the evidence to be introduced at trial is admissible against each defendant, and there is substantial evidence of guilt against each of them. Therefore, we find that Mr. Eberle will not be prejudiced by a joint trial.
IV. CONCLUSION
For all of the foregoing reasons, Defendants' motion to suppress and motion to sever are DENIED. An appropriate order follows.
ORDER
AND NOW, to wit, this 15th day of June, 2006, for the reasons set forth in the accompanying Memorandum Opinion,IT IS HEREBY ORDERED that the Defendant George and Alesha Eberles' Motion [Doc. No. 57 and 58] to Suppress and Motion to Sever are hereby DENIED.