Friday, September 09, 2011

The “Metadata Warrant”

After being federally charged for what I assume are child pornography crimes (the opinion I’m working with doesn’t specifically say what the charges were/are), Benjamin Hager moved to suppress “747 VHS videotapes . . . seized from his residence on November 24, 2010.” U.S. v. Hager, 2011 WL 3862072 (U.S. District Court for North Dakota 2011). He argued that the tapes were seized in violation of the 4th Amendment. U.S. v. Hager, supra.

Hager had several 4th Amendment arguments, but we’re only going to focus on one: that “viewing the VHS tapes exceeded the scope of the underlying warrant.” U.S. v. Hager, supra. The case began when a North Dakota “Special Agent with the directorate ICE Homeland Security Investigations (`HSI’) was contacted by HIS agents from Michigan”, who said they were investigating a local man for child pornography and found “images of more than one man sexually assaulting Mueller’s four minor daughters.” U.S. v. Hager, supra. Mueller admitted producing and sharing child pornography online, and said he’d traded images online using “Bitwise, an encrypted peer-to-peer program.” U.S. v. Hager, supra.

The HSI agents searched “computer media” seized from Mueller and found a photo of a package from “`Ben Hager’” at an address in Wahpeton, North Dakota. U.S. v. Hager, supra. The Michigan agents said they had found emails showing that a “person using the email address, `CujoBen@webtv.net’” had a sexual interest in children and used the name “Ace” online. U.S. v. Hager, supra. The agents had found a package containing what appeared to be evidence that “Ace” had sexually molested a young girl. U.S. v. Hager, supra. They also linked “Ace” to Ben Hager, who was the registered user of the CujoBen@webtv email account. U.S. v. Hager, supra.

Local HSI agents investigated and discovered that Benjamin Hager and his “young daughter” lived at the address on the package and received mail at the Wahpeton address on the package. U.S. v. Hager, supra. Also, the Michigan HSI agents had

reported to [North Dakota HSI] Special Agent Litzinger that a search of Mueller's Yahoo email account uncovered a series of sexually suggestive emails between Mueller and Hager, and some of the emails included non-pornographic pictures of Mueller's daughters. It is undisputed that while some of the images seized from Yahoo contained EXIF-metadata (hereafter `metadata') at least one of the Yahoo thumbnail images sent to Hager did not contain the metadata.

U.S. v. Hager, supra.

After the North Dakota agents received this information, they investigated Hager further and found he had “at least two prior law enforcement contacts as a result of his interest in young girls.” U.S. v. Hager, supra.

After discovering this information, Litzinger contacted the Michigan HSI agents and informed them that he intended to seek a search warrant of Hager's residence. He told them he intended to search for copies of the images of Mueller's daughters in Hager's possession and was going to look for metadata to provide them additional information for their case. When informed of this decision, the Michigan HSI officers indicated that they would find the information helpful and thanked Special Agent Litzinger for his help.


On November 23, 2010 Special Agent Litzinger applied for a search warrant to allow agents to search Hager's apartment for `contraband, fruits of a crime, or other items illegally possessed.’ U.S. Magistrate Judge Karen K. Klein reviewed the . . . application and issued a warrant authorizing the search of the apartment. Attachment B described with specificity the items that could be seized, which included `tapes.’

U.S. v. Hager, supra.

Hager was present when they executed the warrant and told the agents, among other things, that he had been in contact with Mueller and that they “shared an interest in young girls.” U.S. v. Hager, supra. Hager also denied possessing child pornography and said he “used the WebTV connection to copy information on the internet to VHS tapes.” U.S. v. Hager, supra.

When the agents searched Hager’s apartment, they found 747 videotapes. U.S. v. Hager, supra. Litzinger called a HSI forensics expert in Grand Forks to ask him if the VHS tapes “constituted `electronic media.’” U.S. v. Hager, supra. After the forensics expert told Litzinger that they did, he called an Assistant U.S. Attorney, and asked him if the tapes were covered by the warrant. U.S. v. Hager, supra. The prosecutor said they were, so Litzinger and the agents with him seized the tapes, but did not seize the WebTV access box or the VHS recorder. U.S. v. Hager, supra.

Litzinger admits he was unfamiliar with WebTV before this case; thought it was similar to a modem; and he had no idea of how VHS recording devices worked before this case. When he seized the tapes, he believed he would find the Mueller images on them. He also believed the videotape images would contain metadata useful to the Michigan case. Litzinger admits it never occurred to him that VHS tapes were analog tapes and that they would not contain metadata. [He] noticed a USB port on the WebTV box and assumed that whatever information was on the videotape was essentially the same as if it had been stored to a computer media.


Once the tapes were taken to HSI offices in Grand Forks, Litzinger and a support staff member, . . . Devon Stefanowicz, reviewed the tapes on a standard VHS player. Neither Litzinger nor Stefanowicz is a forensic expert. They did not understand that no metadata could be contained on a VHS tape. It is undisputable that metadata is not found on VHS recordings, as such recordings are analog and by definition metadata is digital. It is also undisputable that any reasonably competent forensic computer scientist would know that metadata cannot be stored on analog tape.

U.S. v. Hager, supra. When they viewed the tapes, the found “images of what appeared to be child pornography”, at which point they stopped and got an additional warrant to search the tapes, which they did. U.S. v. Hager, supra.

Hager, as I noted earlier moved to suppress the evidence seized in the search of his apartment, arguing that the search exceeded the scope of the warrant. U.S. v. Hager, supra.

In ruling on that argument, the federal district court judge noted, first, that while

much has been made about the reference to EXIF-metadata in the supporting warrant affidavit and application, it is plain that neither the application nor the warrant itself limits application to files that could contain metadata. The warrant more broadly includes evidence of crimes committed by Mueller. The warrant authorized the agents to search and seize a broad array of media in order to locate the images of Mueller's daughters `wherever they may be stored or found, including but not limited to . . . any computer, computer system and related peripherals; tapes, cassettes,. . . . .’ (Search Warrant Aff. 1, Att. B).

U.S. v. Hager, supra.

The judge also found that the warrant was based on probable cause:

They had probable cause to believe they would find photographs with embedded metadata that would be useful in prosecuting Mueller. Given the nature of the relationship between Hager and Mueller, they would also conclude that there was full probable cause to believe that other photographs tying Mueller to distribution of child pornography were likely to be found in Hager's possession.

U.S. v. Hager, supra.

And, finally, in what lawyers refer to as dicta, the judge explained that even if Hager

were correct in his belief that the warrant was limited to metadata, his motion would still fail. Other than trial lawyers, forensic specialists, and IT professionals, few people could define what metadata is and where it could be found. While Litzinger took classes related to child pornography investigations that discussed metadata, it is highly unlikely that any of those classes discussed the nature of VHS tapes and how the recording system works. The Court suspects VHS tapes are discussed at training sessions for modern investigations about as frequently as the Rule in Queen Anne's case is discussed in Continuing Legal Education sessions for lawyers -- and for the same reason: they are both largely irrelevant in today's legal world.


It is credible that Litzinger expected to find metadata on the VHS tapes. His calls to Craig Williams, the forensic scientist, and Lynn Jordheim, First Assistant United States Attorney for the District of North Dakota, further establish prudence and good faith. Even if Hager's strained reading of the warrant were applied, the evidence would still be admissible under the good faith exception to the exclusionary rule. See U.S. v. Leon, 468 U.S. 897 (1984). Under Leon, evidence obtained pursuant to an invalid search warrant is not barred unless the magistrate judge issuing the warrant `abandoned his or her neutral and detached role in issuing it’ or the officers preparing the affidavit were dishonest or reckless and could not have harbored an objectively reasonable belief in the existence of probable cause. In this case, there is no indication the magistrate abandoned her neutral and detached role in issuing the warrant, nor has Hager made this contention. Although Hager contends the affidavit supporting the warrant application contained misleading information, the officers were not dishonest or reckless in preparing the affidavit. . . . . It was objectively reasonable for Litzinger to rely on the assurances of Williams, a forensic scientist, or the First Assistant United States Attorney, that the tapes were covered by the warrant.

U.S. v. Hager, supra.

So Hager lost on that argument on his other arguments, which is why the judge denied his motion to suppress. U.S. v. Hager, supra.

No comments: