Opinion
CR 05-1049-TUC-FRZ (GEE).
July 13, 2007
REPORT AND RECOMMENDATION
The District Court referred this case to the Magistrate-Judge for consideration of pretrial motions.
Pending before the court is the defendant's motion to dismiss superceding indictment, suppress evidence collected pursuant to a search warrant, and hold a Franks hearing. [doc. ## 96, 118] The government filed a response and a supplement. [doc. ## 102, 119]
Franks v. Delaware, 438 U.S. 154 (1978).
That portion of the motion addressing count 5 is now moot. The court orally granted the government's motion to dismiss that count. The Magistrate-Judge recommends the remainder of the motion be denied on the merits.
CHARGES :
In Count 1 of the superceding indictment, Flyer is charged with attempted transportation and shipping of child pornography in violation of 18 U.S.C. § 2252(a)(1) and (b)(1). Specifically, he is charged with attempted transmission of a computer image entitled "0-KIDDY-PTHC bw 025.jpg" on or about March 9, 2004.
In Count 2, Flyer is charged with attempted transportation and shipping of child pornography in violation of 18 U.S.C. § 2252(a)(1) and (b)(1). Specifically, he is charged with attempted transmission of a computer image entitled "2 Preteen Boys Fucking In The Bathtub (Gay Kiddy Porn) (3).jpg" on or about March 10, 2004.
In Count 3, Flyer is charged with possession of child pornography in violation of 18 U.S.C. § 2252(a)(4)(B) and (b)(2). The indictment specifically names 8 computer files contained in his Gateway desktop computer on or about April 13, 2004.
In Count 4, Flyer is charged with possession of child pornography in violation of 18 U.S.C. § 2252(a)(4)(B) and (b)(2). The indictment specifically names 21 computer files contained on disks and various storage media on or about April 13, 2004. One of the named computer files is "0-KIDDY-PTHC bw 025.jpg"
In Count 5, Flyer is charged with possession of child pornography in violation of 18 U.S.C. § 2252(a)(4)(B) and (b)(2). The indictment specifically names 6 computer files contained in his Apple Laptop computer on or about April 13, 2004.
Facts:
The government alleges the following facts: On or about March 9, 2004, Agent Andrews of the FBI was acting in an undercover capacity on the internet and launched file sharing software "LimeWire." She searched the network for someone offering child pornography by using the search term, "PTHC." (Defendant's motion, Exhibit 1, ¶ 32.) Agent Andrews discovered an individual with internet protocol address 68.231.131.248 who was offering several such items. Id. Andrews downloaded a computer image entitled "0-KIDDY-PTHC bw 025.jpg" from this address. Id. To allow this image to be transmitted, the sender must turn on his computer, run the LimeWire software program, and place this file in a special "shared" file folder. Andrews attempted to download further images but was unable to do so. Id., ¶ 33. The LimeWire program printed the following message: Need More Sources. Id. According to Andrews, this message means too many people are requesting files from this address. Id.
On March 10, 2004, Andrews continued her investigation. Id., ¶ 36. She found the individual with internet protocol address 68.231.131.248 was again offering several items. Id. Andrews downloaded a computer image entitled "2 Preteen Boys Fucking In The Bathtub (Gay Kiddy Porn) (3).jpg" from this address. Id. Andrews attempted to download further images but was unable to do so. The LimeWire program again printed the following message: Need More Sources. Id.
Agents traced this internet address to a house in the Tucson area. Agent Andrews obtained a search warrant for that address. (Defendant's motion, Exhibit 1.) On April 13, 2004, agents executed the warrant and seized a Gateway desktop computer, an Apple Laptop computer, and 178 pieces of loose storage media. When Flyer was interviewed, he admitted he used the LimeWire program to download music and videos and "sometimes child pornography comes down." (Government's response, p. 2.) Flyer said he has an academic interest in the accessibility of child pornography on the internet and "wanted to see what percentage of uploads are child pornography versus adult pornography." Id., p. 3. He said "he usually deletes the child pornography that he finds on the internet and only keeps a minimal amount in the `LimeWire' share folder." Id.
On July 8, 2005, Flyer pleaded guilty to the original indictment. He later retained substitute counsel, and on October 26, 2005, the court granted his motion to withdraw his plea. On January 4, 2006, the government obtained a superseding indictment.
On April 2, 2007, Flyer filed the instant motion to dismiss the superseding indictment or suppress the evidence collected pursuant to the search warrant and for a Franks hearing. Flyer offers the affidavit of a computer forensics expert, Tami L. Loehrs. In her affidavit, Loehrs states she examined the electronic evidence gathered pursuant to the search warrant. She concluded the Gateway desktop computer had been properly seized and acquired pursuant to industry standards. She found a number of irregularities, however, when she examined the Apple Laptop.
On the Laptop, Loehrs found that over 63,000 files had been accessed on March 18, 2005, approximately 11 months after it had been seized. She further found 6,100 files had been accessed and eleven files had been created on November 3, 2005, approximately 19 months after it had been seized.
Loehrs searched the Laptop for the two files that constitute counts 1 and 2 of the superseding indictment. She found both files. They listed creations dates of March 8, 2004 at 3:08:40 a.m. and 3:08:44 a.m., respectively. Loehrs found it implausible that these two files should have been created at approximately the same time. Loehrs further found these two files had been accessed on March 18, 2005, approximately 11 months after the Laptop was seized.
According to Loehrs, the chain of custody suppled by the government does not explain why the Laptop shows the access dates March 18, 2004, and November 3, 2005.
Loehrs believes the Apple Laptop was accessed by unknown persons on at least two separate occasions after it had been seized. She opines the data on the Laptop could have been "inadvertantly or intentionally changed, deleted or added." (Defendant's motion, Affidavit of Tami Loehrs, ¶ 37.) Accordingly, she concludes the data on the Laptop is "completely unreliably and unusable." Id.
On April 27, 2007, the government filed a response to the motion. The government proffered the statement of SA Meshinsky who examined the Apple Laptop. (This document was later added to the record.) [doc. # 119, Attachment 1]
Meshinsky reports that on November 3, 2005, he conducted a forensic examination of the Apple Laptop. He attempted to image the Laptop's hard drive, but his examining computer system inadvertently had the "disk arbitration" setting left on. This error created some files on the Laptop and accessed some other files. This error was not documented in his notes. (Compare Hearing Exhibit A5 with Hearing Exhibit G and doc. # 119, Attachment 1)
Meshinsky also found the system date and time on the Laptop read 04/01/1976 and 8:00 A.M. This is the default setting. Meshinsky believes the battery on the Parameter RAM failed, and this failure caused the Laptop to reset the date and time to the default setting. He also hypothesizes battery failure could have caused the March 18, 2005, access file dates to have erroneously appeared.
A hearing on the motion was held on the 13th, 14th, and 18th of June, 2007. The court denied the defendant's motion for a Franks hearing. The government orally moved to dismiss count 5 of the superseding indictment, and the court granted the motion. [doc. # 113] The court allowed the defendant to make an offer of proof, and Tami Loehrs offered expert computer forensic testimony.
Discussion — Franks Hearing:
Under certain circumstances, a defendant may challenge the veracity of the statements contained in the affidavit that the Magistrate relied upon when he or she issued the search warrant. Franks v. Delaware, 438 U.S. 154 (1978). The affidavit supporting the warrant is presumed to be valid. Id. at 171. Accordingly, the defendant is entitled to a hearing on the issue only "if he makes a substantial preliminary showing that a false statement was deliberately or recklessly included in the search warrant affidavit and that the statement was necessary to the magistrate's finding of probable cause." United States v. Napier, 436 F.3d 1133, 1139 (9th Cir. 2006), cert, denied, 127 U.S. 164 (2006).
Flyer maintains the files on the Apple Laptop are irretrievably compromised. The government, therefore, cannot show Flyer had the two images of child pornography on his computer when Agent Andrews said she downloaded them. He argues these images were not on the Apple Laptop before the search, and Agent Andrews lied when she said she downloaded them from his computer.
Flyer further notes that Tami Loehrs worked on two previous cases where Agent Andrews claimed she downloaded files from the defendants' computers, but the files subsequently were not found on the computers' hard drives. He further notes the computer in this case was accessed by the government on November 3, 2005, just two days after the government learned the defendant had retained Tami Loehrs. These facts, he argues, create the suspicion that the Apple Laptop was deliberately tampered with to make it appear that these two image files were on the computer when Agent Andrews said she downloaded them.
In this case, Flyer has not made a "substantial preliminary showing that a false statement was deliberately or recklessly included in the search warrant affidavit." See United States v. Napier, 436 F.3d 1133, 1139 (9th Cir. 2006). The Apple Laptop is no longer in the same conditions as it was when it was seized. If Loehrs is correct and the hard drive has no evidentiary value, the government cannot now show the two image files were on the Apple Laptop when Agent Andrews allegedly downloaded them. This, however, does not prove Agent Andrews lied when she said she downloaded the image files from Flyer's computer. There are many reasons why these files might not be on the Laptop on the day of the seizure. They could have been erased. When examining the Gateway desktop computer, the government found child pornography in the "DriveFreeSpace" indicating these images had been downloaded and then deleted. (Government's response, p. 3.) Flyer, himself, said he usually deletes the child pornography he finds on the internet.
Moreover, other evidence supports the veracity of the affidavit. Large amounts of child pornography were found in the loose storage media and on the Gateway desktop computer. Flyer admitted he downloads computer files using the LimeWire program. He further admitted he downloaded child pornography and was interested in what percentage of uploads are child pornography versus adult pornography. This evidence bolsters the presumption that the affidavit is valid, and undermines Flyer's argument. See Napier, 436 F.3d at 1139 ("This presumption is bolstered, where as here, the incriminating results of the search . . . undermine [the defendant's] offer of proof.").
Flyer maintains the timing of the government's forensic investigation, conducted on November 3, 2005, is suspicious. He offers the following hypothesis: When the government agents found out the defendant retained a computer expert, they feared she would discover the two image files were missing and decided to falsify the evidence. The court finds this scenario unlikely.
This case has a rather lengthy history of proceedings. Flyer was originally indicted on May 25, 2005. He pleaded guilty less than two months later. Presumably, the government hoped to resolve the case quickly without expending the time and resources necessary to image the computer and allow the defendant access to the electronic evidence. Flyer subsequently filed motions to withdraw his plea and substitute counsel which the court granted in October of 2005. The government conducted its forensic examination of the Apple Laptop in November of 2005 because the case appeared to be headed for trial and the defendant was entitled to discovery. There is no evidence the government accessed the Laptop because it was afraid the defendant's expert would discover that the two image files were missing.
Flyer notes that in two earlier cases, Agent Andrews claimed she downloaded files from the defendants' computers, but the files subsequently were not found on the computers' hard drives. He argues this fact strengthens the likelihood that evidence was falsified in this case. The court does not agree.
In United States v. Ernest David Craighead, CR 04-2351 TUC JMR, the District Court denied the defendant's motion for a Franks hearing even though the government was unable to find the computer files that Agent Andrews said she downloaded from the defendant's computer. (Government's response, p. 9.) This case, in fact, weakens Flyer's argument. If Agent Andrews were indeed fabricating these downloads, why would she try to falsify evidence in this particular case? In the earlier case, the smoking-gun files were missing from the defendant's computer, and the defendant still lost his motion for a Franks hearing. Presumably, she would expect the same result here: The files would be found to be missing, the defendant would file a Franks motion, and the court would deny the motion. This earlier case makes it less likely the government would attempt to falsify the evidence. There is simply no need to cheat when you expect to win as a matter of course. See also United States v. Anthony David Hibble, CR 05-1410-TUC-DCB (HCE) (Although the smoking gun files were not found on the defendant's computer, the defendant's motion for a Franks hearing was denied.).
In the alternative, Flyer argues the time and date information attached to the two image files is valid and the creation dates of the two files are suspiciously similar. These two files have creation dates of March 8, 2004 at 3:08:40 and 3:08:44 a.m. respectively. Agent Andrews claims she downloaded one on March 9, 2004 and the other on March 10, 2004. Flyer argues that because Agent Andrews had hundreds of possible files to chose from on March 10, 2004, it is unlikely she would choose a file that was created within four seconds of the file she chose to download the previous day.
This argument is undercut by Flyer's main argument. The Apple Laptop was inadvertently accessed and is no longer in the same condition as it was on the day it was seized. These creation times are therefore suspect.
Assuming the creation information is correct, Flyer cannot show it is unlikely the two files would have similar creation times. Apparently, Loehrs assumes Agent Andrews downloaded these two files at random from the scores of files she located using the search term, "PTHC." If Andrews did indeed do this, then it would be unlikely that she would download two files with similar creation times. The affidavit, however, does not say this. (Defendant's motion, Exhibit 1.) It says, Andrews found and downloaded a file located using the search term, "PTHC," from IP address 68.231.131.248. Id., ¶ 32. The next day, she found additional files using the search term, "PTHC." Id., ¶ 36. She again found many such files available from IP address 68.231.131.248. Id. She then downloaded the second image file from that address. Id. She does not say the second image file was among those files she found using the search term, "PTHC."
The second file was not chosen at random. It was chosen from the group of files offered by IP address 68.231.131.248 on March 10, 2004 — the same IP address, presumably the same computer, that offered the first image file. It is one thing to say two files of child pornography chosen at random from all the LimeWire files offered on two successive days probably would not have the same creation times. It is quite another to say two files of child pornography offered from the same IP address on two successive days would not have the same creation times. It is possible these two files were copied by Flyer at the same time. The defendant provides no evidence to discount this possibility.
Flyer has not made a "substantial preliminary showing" that Agent Andrews lied when she stated she downloaded two images of child pornography from Flyer's computer. See United States v. Napier, 436 F.3d 1133, 1139 (9th Cir. 2006). His request for a Franks hearing should be denied.
Flyer further argues Andrews was intentionally misleading when she said in the affidavit she was unable to download further files because too many other users were trying to copy Flyer's files. Flyer maintains there are many other possible reasons why LimeWire would print the message, "Need More Sources."
Andrews' statement, however, was not necessary to the magistrate's finding of probable cause. See United States v. Napier, 436 F.3d 1133, 1139 (9th Cir. 2006). Accordingly, Flyer is not entitled to a Franks hearing even if it was intentionally misleading.
Discussion — Due Process:
Flyer further moves that this court dismiss the superseding indictment or suppress the evidence obtained from the search because potentially exculpatory information was destroyed by the government.
The government's failure to preserve evidence violates the defendant's right to due process right if "the unavailable evidence possessed exculpatory value that was apparent before the evidence was destroyed, and is of such a nature that the defendant would be unable to obtain comparable evidence by other reasonably available means." United States v. Cooper, 983 F.2d 928, 931 (9th Cir. 1993). Due process is violated only if the government acted in bad faith. Id. The defendant's task of proving bad faith is problematic if the exculpatory value was not apparent before the evidence was destroyed. If the defendant's due process rights are so violated, the court may dismiss the indictment against him. Id. at 933.
In this case, there is no evidence the alleged exculpatory value of the Apple Laptop was apparent when it was accessed by the government. Flyer admitted to the agents that he used the LimeWire program and downloaded pornography. There is no evidence the government believed the Laptop would have any exculpatory value, e.g., no evidence the government believed the two image files would be absent from Flyer's computer. Because the alleged exculpatory value of the Laptop was not apparent, Flyer cannot show the government destroyed evidence in bad faith. Flyer's due process rights were not violated, and the indictment should not be dismissed.
Discussion — Suppression:
If the government destroys evidence under circumstances that do not violate the defendant's constitutional rights, the court may still issue a protective order or impose sanctions including suppression of secondary evidence. United States v. Loud Hawk, 628 F.2d 1139, 1152 (9th Cir. 1979) (en banc) (Kennedy, J., concurring), cert. denied, 445 U.S. 917 (1980). The court must balance "the quality of the Government's conduct and the degree of prejudice to the accused." Id. "The Government bears the burden of justifying its conduct and the defendant bears the burden of demonstrating prejudice." Id.
"In weighing the conduct of the Government, the court should inquire whether the evidence was lost or destroyed while in its custody, whether the Government acted in disregard for the interests of the accused, whether it was negligent in failing to adhere to established and reasonable standards of care for police and prosecutorial functions, and, if the acts were deliberate, whether they were taken in good faith or with reasonable justification." Id. "It is relevant also to inquire whether the government attorneys prosecuting the case have participated in the events leading to loss or destruction of the evidence, for prosecutorial action may bear upon existence of a motive to harm the accused." Id.
"In analyzing prejudice, the court must consider a wide number of factors including, without limitation, the centrality of the evidence to the case and its importance in establishing the elements of the crime or the motive or intent of the defendant; the probative value and reliability of the secondary or substitute evidence; the nature and probable weight of factual inferences or other demonstrations and kinds of proof allegedly lost to the accused; the probable effect on the jury from absence of the evidence, including dangers of unfounded speculation and bias that might result to the defendant if adequate presentation of the case requires explanation about the missing evidence." Id.
In this case, the Laptop was in the government's custody when it was altered. The government agents were negligent in their handling of the evidence. There is, however, no evidence the government acted in bad faith or that government attorneys prosecuting the case were involved in the loss of evidence.
The Laptop is of some importance to counts one and two. (It is of central importance to count five, but this count has been dismissed.) If the two image files were not on the Laptop and the Laptop were unaltered, this would be some evidence that Flyer did not attempt to transmit them over the internet. The remainder of the evidence, however, weighs against this possible defense. Large amounts of child pornography was found in Flyer's possession. He admitted he used LimeWire to transfer files such as child pornography. In fact, one of the two image files he allegedly attempted to transport, "0-KIDDY-PTHC bw 025.jpg," was found in the loose storage media. [doc. #31] Moreover, Flyer said he deleted most of the child pornography that he downloaded. This evidence tends to prove that Flyer attempted to transport these two image files in March of 2004 and supplies an explanation for why they might not be found on the Laptop at the time of the seizure. In sum, Flyer cannot show the government's destruction of evidence has significantly affect his ability to present an effective defense.
The government has been negligent, but Flyer has not been significantly prejudiced. Flyer's motion for sanctions should be denied. If the government introduces evidence that the two image files were found on the Laptop, the defendant should be able to effectively dispute the reliability of that evidence.
RECOMMENDATION :
In view of the foregoing, it is recommended that after an independent review of the record, the District Court should DENY the defendant's motion to dismiss the superceding indictment, suppress evidence collected pursuant to a search warrant, and hold a Franks hearing. [doc. ## 96, 118] The defendant's motion to dismiss count 5 is now moot. The remainder of the motion should be denied on the merits.
This Report and Recommendation is being faxed to all counsel on this date. Counsel must file any objections within ten (10) days of today's date.