Friday, June 03, 2011

Gigatribe, Privacy and Consent

As I’ve noted in earlier posts, courts have consistently rejected arguments that it is a 4th Amendment “search” for law enforcement officers to use file-sharing software, such as Limewire, to access and download files from someone’s hard drive.

As I’ve explained in earlier posts, a “search” under the 4th Amendment violates a reasonable expectation of privacy, and under the Supreme Court’s decision in Katz v. U.S., 389 U.S. 347 (1967), one has a reasonable expectation of privacy in a place/thing if two conditions are met: (i) he thinks it is private; and (ii) society accepts as objectively reasonable his belief that the place/thing is private.

And as I’ve noted in earlier posts on this specific issue, courts have generally found that by using file-sharing software, one forfeits any such expectation of privacy, on the premise(s) either that (i) they cannot subjectively believe files they make available for sharing are private and/or (ii) even if they do believe that, their belief is not objectively reasonable.

This post deals with a recent opinion that addressed this general issue in a distinct context, one I wrote about in an earlier post. The case is U.S. v. Sawyer, __ F.Supp.2d __, 2011 WL 2036444 (U.S. District Court for the Northern District of Ohio 2011), and this is the general context in which it arose:

[Brian Sawyer] used a `closed’ peer-to-peer file sharing program called GigaTribe. Normally, peer-to-peer file sharing programs, such as LimeWire or Kazaa, allow anyone using the same software to view and download files from the shared folder on any other user's computer, without special permission. Thus, in these `open’ file sharing programs, any files stored in the shared folder on a user's hard drive are visible and may be downloaded by any other person using that same program.

[Sawyer] used a program called GigaTribe that is slightly different from `open’ programs. With GigaTribe, a user's files are not automatically made publicly available to all other users; instead, users may view and download files only after receiving specific authorization. Consent to view and download files on GigaTribe is given when a user adds another user to his or her private list of so-called `friends.’

GigaTribe users may become `friends’ with other users through an electronic invitation; acceptance of this invitation allows the `friends’ to directly browse and download files that are stored on each other's computers over the internet. Individuals using the program select specified folders on their computer that they wish to share, and `friends’ can browse, search, and download any of the files stored in those folders. GigaTribe also features a chat function that allows users to communicate with each other. . . .

[Sawyer’s] GigaTribe username was `happyb.’ While using his `happyb’ username, [Sawyer] became online friends with another user, `SB,’ allowing the two accounts to access each other's shared folders to browse and download files. [FBI] Agent [Barry] Couch previously obtained written consent from the user in control of the of the `SB’ username to use that account for `any purpose relating to an official investigation by the above law enforcement authority [FBI], including (but not limited to) sending and receiving e-mail or conducting any other electronic communications, accessing stored information, and using and disclosing such communications or information.’

On February 22, 2011, Couch logged into the GigaTribe network using the `SB user name,’ viewed [Sawyer’s] shared file list, and downloaded twenty-eight images of child pornography. While downloading the images, Couch and [Sawyer], still using the `happyb’ and `SB’ usernames, engaged in a private chat about sexual contact with minors.

U.S. v. Sawyer, supra.

While the files were downloading and he was chatting with Sawyer, Couch also “ascertained the internet protocol (IP) address” for Sawyer’s Internet connection. U.S. v. Sawyer, supra. He later “obtained [Sawyer’s] physical address” by issuing a subpoena to Time Warner Cable. U.S. v. Sawyer, supra. “Based upon this information, the FBI obtained a search warrant for Sawyer's home at 230 Superior Street, Louisville, Ohio, that was executed on March 4, 2011.” U.S. v. Sawyer, supra. They seized Sawyer’s computer and interrogated him for “several hours.” U.S. v. Sawyer, supra.

On April 6, 2011, a federal grand jury indicted Sawyer “on one count of receipt and distribution of images of child pornography in violation of 18 U.S. Code § 2252(a)(2) and one count of possession of a computer containing child pornography in violation of 18 U.S. Code § 2252A(a). U.S. v. Sawyer, supra. After being indicted, Sawyer moved to suppress “ all evidence seized when Couch logged onto the `SB’ user name and downloaded files on February 22, 2011, as well as any evidence later seized as a result of that search and seizure, including” Sawyer’s computer. U.S. v. Sawyer, supra.

The federal district court judge who has the case began his analysis of Sawyer’s arguments in support of his motion to suppress by noting that the threshold issue he had to decide was whether Sawyer had a 4th Amendment reasonable expectation of privacy

in the materials stored on his computer that were shared on GigaTribe. A general consensus has formed among courts that an individual does not have a Fourth Amendment privacy interest in information made available on a public peer to peer filing sharing programs, such as LimeWire or Kazaa, since their expectation of privacy in that shared information is not objectively reasonable. . . .

[A] person who grants the public access to folders on his computer cannot be said to have an objectively reasonable expectation of privacy in those folders, as any member of the public using that program has free and unfettered access to them.

U.S. v. Sawyer, supra.

The judge noted, though, that in

the current case, . . . where a person shares files over a `closed’ network -- in which only pre-approved friends have access -- an expectation of privacy is somewhat more reasonable. Unlike in an open program, where any user can see and download the files, Sawyer's files were only visible to his `friends.’

U.S. v. Sawyer, supra.

Notwithstanding that comment, this judge ultimately found that despite GigaTribe’s

affording some greater degree of privacy, the rationale of the decisions analyzing open file sharing programs is still persuasive here and the Court finds that Sawyer did not have an objectively reasonable expectation of privacy in the files that were shared over GigaTribe. . . . Once Sawyer granted his `friends’ access to his files, he had no control over the manner in which his friends used that access.

The Supreme Court `consistently has held that a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties.’ Smith v. Maryland, 442 U.S. 735 (1979). . . . Sawyer voluntarily made his files available to all of his `friends’ and he also bore the risk that those `friends’ might turn the files over to law enforcement. The Court, therefore, finds that [he] did not have an objectively reasonable expectation of privacy in the information that he shared over GigaTribe and that Agent Couch's activities on the `SB’ username did not implicate the Fourth Amendment.

U.S. v. Sawyer, supra. This judge, then, reached the same result a Massachusetts district court judge reached in U.S. v. Ladeau, 2010 WL 14427523, which I wrote about in an earlier post.

Unlike the Ladeau judge, however, this federal judge then proceeded to address an alternate theory as to why Agent Couch’s conduct did not violate the 4th Amendment:

[E]ven if Sawyer possessed a privacy interest in the shared files stored on his computer, . . . consent was given to search those files. Sawyer himself directly consented to the February 22 downloads. Simply because the government obtained access to these files through use of a ruse does not render the consent involuntary. Rather, `it is well established that an undercover officer may gain entrance [to a home] by misrepresenting his identity and may gather evidence while there.’ U.S. v. Pollard, 215 F.3d 643 (U.S. Court of Appeals for the 6th Circuit 2000).

For example, in U.S. v. Lord, the Sixth Circuit found consent voluntary where government agents posing as real estate investors gained access to an individual's bedroom and bedroom closet. 230 Fed. Appx. 511 (6th Cir. 2007) closet. [Sawyer] freely granted the username `SB,’ which Couch was using at the time, access to his files, believing that Couch wanted to download child pornography, even going as far as to discuss previous sexual contact with minors during the download process. It is difficult to see how the consent directly given to Agent Couch while using the `SB’ account was not made voluntarily.

U.S. v. Sawyer, supra.

As I’ve noted in earlier posts, consent is an exception to the 4th Amendment’s default requirement that officers obtain a warrant to conduct a 4th Amendment search of a private place or thing. To be valid, consent must be (i) given voluntarily (ii) by someone who has authority to consent to the search.

This judge went on to address an issue the Ladeau judge noted only briefly:

[T]he owner of the `SB’ account validly consented to Couch searching the shared folder on Sawyer's computer. It is well accepted that a third party with authority or control over property subject to a search may grant law enforcement consent to search that property. . . . For example, a third party with access to a home computer may consent to a police search of the files on that computer. . . .

U.S. v. Sawyer, supra.

He then explained that by becoming “friends” with “SB,” Sawyer granted the SB

username the authority to access any files or folders designated as shared. The owner of the `SB’ name then voluntarily consented to Couch using that username to access the shared folders and files on Sawyer's computer.

It makes little difference that `SB’ was granted authority to access and download the files on the computer over the internet, rather than through a grant of physical access to the computer actually storing those files, particularly since Couch only accessed the files remotely over the internet. As such, the Court finds that even if [Sawyer] has a 4th Amendment privacy interest in the shared files on his computer, that the user in control of the `SB’ gave effective third-party consent to a police search of those shared files.

U.S. v. Sawyer, supra.

If the judge is correct in holding that Sawyer did not have a 4th Amendment privacy interest in the shared files on his computer, then his findings re consent are probably dictum. If the judge erred in reaching that conclusion, then the findings re consent would constitute an alternative rationale for denying Sawyer’s motion to suppress.

No comments: