Monday, October 15, 2012

Discovery, Materiality and EP2P

This is another post about a case in which a defendant sought discovery concerning the EP2P software, which the Federal Bureau of Investigation uses in at least some online investigations.  The case is U.S. v. Budziak, __ F3d __, 2012 WL 4748704 (U.S. Court of Appeals for the 9th Circuit 2012), and this is how it arose:

On June 6, 2007, FBI Special Agent Stacie Lane downloaded several images containing child pornography from an Internet Protocol (`IP’) address registered to Max Budziak. On June 14, 2007, FBI Special Agent Richard Whisman conducted a search for child pornography on an online file-sharing network that led him to download 52 files from an IP address registered to Budziak. Both Lane and Whisman used an FBI computer program called `EP2P’ to search for the child pornography files and to download them.

U.S. v. Budziak, supra.

As to the software, the opinion explains that,

[a]ccording to the FBI, EP2P is an enhanced version of LimeWire, a publicly available peer-to-peer file-sharing program that allows users to search for and download files stored on other users' computers. EP2P purportedly allows the FBI to view all files that a particular user on the file-sharing network is making available for download by other users at a given time. While the publicly available version of LimeWire typically downloads files by piecing together file fragments from multiple users, the enhanced EP2P software purportedly allows the FBI to download complete files from a single user.

U.S. v. Budziak, supra.

Getting back to the facts, FBI Special Agent Wade Luders used information he received from Agent Lane to obtain

a warrant to search Budziak's residence. On July 14, 2007, FBI agents executed the warrant. During their search of Budziak's home, agents discovered a desktop computer containing child pornography and an installed copy of the LimeWire program. The FBI seized the computer and conducted a forensic examination of its hard drive.

The FBI's examination of the hard drive revealed that five videos containing child pornography were saved on it in a folder labeled `shared.’ Files containing child pornography were also saved in other folders, including files containing two of the images Lane had downloaded on June 6, and five of the images Whisman had downloaded on June 14.

None of the files had a creation date pre-dating July 2, 2007. The FBI also examined the `properties’ file of the LimeWire software installed on Budziak's computer and concluded that the default settings had not been altered. LimeWire's default settings allow for file-sharing with other users.

U.S. v. Budziak, supra.

On April 30, 2008, a federal grand jury indicted Budziak on two counts of distributing child pornography and one count of possessing material containing a visual depiction of a minor engaging in sexually explicit conduct. U.S. v. Budziak, supra.  He filed a motion to suppress, “arguing that the affidavit supporting the warrant to search his residence contained false statements and material omissions about the LimeWire software and its uses.” U.S. v. Budziak, supra.
The government responded by submitting “a declaration by Luders, which outlined the differences between the publicly available LimeWire software and the FBI's EP2P program.” U.S. v. Budziak, supra. The district court judge denied Budziak's motion to suppress, instructing “him to file a discovery motion if he wished to review the EP2P software.” U.S. v. Budziak, supra.  Budziak filed “three successive motions . . . seeking discovery on the specifications of the FBI's EP2P software or a copy of the program.”  U.S. v. Budziak, supra. After the judge denied the motions, Budziak “filed a renewed motion to suppress,” which the judge also denied.  U.S. v. Budziak, supra.

The case went to trial on January 10, 2011. U.S. v. Budziak, supra. Agents Lane, Whisman and Luders testified about their investigations and the search of Budziak's residence. U.S. v. Budziak, supra. The prosecution also presented testimony from

Special Agent Michael Gordon, an expert witness on the use of EP2P. . . . Gordon. . . . testified that LimeWire's default setting is to save files downloaded through the program into a `shared’ folder, and to make files stored in that folder available for download by other users. He testified that LimeWire provides an option for users to disable the sharing function so other users cannot download their files.

On cross-examination, he testified that it was possible that a user could accidentally share files through LimeWire that he wanted to keep private, if he was not familiar with the program. Gordon also testified about the FBI's EP2P software and its capabilities. He testified that EP2P allows the FBI to download files from a single user, but it does not enable the FBI to override a user's settings to look at or download files not designated for sharing.

U.S. v. Budziak, supra.

The jury convicted Budziak on all three counts and the judge sentenced him to “60 months of imprisonment, followed by five years of supervised release.”  U.S. v. Budziak, supra.  Budziak appealed.  U.S. v. Budziak, supra.  Budziak raised several arguments on appeal, but we are only concerned with one of them.  He claimed the district court judge “erred in denying him discovery on the FBI’s EP2P software.”  U.S. v. Budziak, supra.

The Court of Appeals began its analysis of Budziak’s argument by explaining that under Rule 16 of the Federal Rules of Criminal Procedure, a criminal defendant has the right to

inspect all documents, data, or tangible items within the government's `possession, custody, or control’ that are `material to preparing the defense.’ Rule 16(a)(1)(E). Evidence is `material’ under Rule 16 if it is helpful to the development of a possible defense. . . .

A defendant must make a `threshold showing of materiality’ in order to compel discovery pursuant to Rule 16(a)(1)(E). U.S. v. Santiago, 46 F.3d 885 (U.S. Court of Appeals for the 9th Cir.1995). `Neither a general description of the information sought nor conclusory allegations of materiality suffice; a defendant must present facts which would tend to show the Government is in possession of information helpful to the defense.’ U.S. v. Mandel, 914 F.2d 1215 (U.S. Court of Appeals for the 9th Cir.1990).

U.S. v. Budziak, supra.

Budziak argued that when he sought discovery prior to trial, he made “a sufficient showing that discovery of the EP2P software was material to preparing his defense”, and the Court of Appeals agreed. U.S. v. Budziak, supra.  It explained that

[a]ll three of Budziak's motions to compel provided more than a general description of the information sought; they specifically requested disclosure of the EP2P program and its technical specifications. Budziak also identified specific defenses to the distribution charge that discovery on the EP2P program could potentially help him develop.

In support of his first two motions to compel, Budziak presented evidence suggesting that the FBI may have only downloaded fragments of child pornography files from his `incomplete’ folder, making it `more likely’ that he did not knowingly distribute any complete child pornography files to Agents Lane or Whisman. . . . In support of his third motion to compel, Budziak submitted evidence suggesting that the FBI agents could have used the EP2P software to override his sharing settings.

U.S. v. Budziak, supra. 

The court also explained that

[m]uch of the evidence the prosecution presented at trial was devoted to describing EP2P and the FBI's use of the program. Although Budziak had an opportunity to cross-examine the government's EP2P expert, he was denied background material on the software that could have enabled him to pursue a more effective examination.

As the [U.S. Court of Appeals for the 3d Circuit] has held, `A party seeking to impeach the reliability of computer evidence should have sufficient opportunity to ascertain by pretrial discovery whether both the machine and those who supply it with data input and information have performed their tasks accurately.’ U.S. v. Liebert, 519 F.2d 542 (U.S. Court of Appeals for the 3d Circuit 1975).

U.S. v. Budziak, supra. 

It also noted that although the prosecution argued that the computer logs it gave

Budziak demonstrated that he would not uncover any helpful information through discovery of the software, the declarations of Budziak's computer forensics expert stated otherwise.  In cases where the defendant has demonstrated materiality, the district court should not merely defer to government assertions that discovery would be fruitless.

While we have no reason to doubt the government's good faith in such matters, criminal defendants should not have to rely solely on the government's word that further discovery is unnecessary. This is especially so where, as here, a charge . . . is predicated largely on computer software functioning in the manner described by the government, and the government is the only party with access to that software. 

Accordingly, we hold that it was an abuse of discretion for the district court to deny Budziak discovery on the EP2P program.

U.S. v. Budziak, supra. 

The fact that the district court judge abused his discretion in denying Budziak’s requests for discovery was not, however, enough to warrant reversing his conviction.  As the Court of Appeals noted, in order to have his conviction reversed,

Budziak must show not only that the district court abused its discretion, but also that there is a likelihood that the outcome of the trial would have been different if discovery had been granted. . . . `This he cannot do, because the Government has never surrendered the materials for review.’ U.S. v. Stever, 603 F.3d 747 (U.S. Court of Appeals for the 9th Circuit 2010). Because the EP2P evidence Budizak requested is not part of the appellate record, it is impossible for us to determine whether the result of Budziak's trial would have been different if it had been disclosed to him. . . .

We therefore remand this case to the district court for a determination on whether the EP2P materials Budziak requested `in fact contain, or would have led to, information that might have altered the verdict.’ U.S. v. Stever, supra. If the district court determines that the EP2P discovery could have affected the outcome of the trial, it shall order a new trial; if the court determines the nondisclosure was harmless, it may reinstate the judgment of conviction. . . .

We leave to the district court to determine in the first instance whether, on remand, a protective order or an in camera hearing is necessary to accommodate any law enforcement confidentiality concerns. 

U.S. v. Budziak, supra. 

No comments: