Monday, February 18, 2013

LimeWire, the Wyoming Tool Kit and the 4th Amendment


After Levi Dunham “was charged by bill of information with seventeen counts of pornography involving juveniles” in violation of Louisiana Revised Statutes § 14:81.1(a)(3), he entered a plea of not guilty and then filed a motion to suppress evidence.  State v. Dunham, __ So.3d __, 2012 WL 6643838 (Louisiana Court of Appeals – 1st Circuit 2013). 

At the time Dunham was charged, § 14:81.1(a)(3) criminalized the “The intentional possession, sale, distribution, or possession with intent to sell or distribute of any photographs, films, videotapes, or other visual reproductions of any sexual performance involving a child under the age of seventeen.”  The statute was revised by legislation adopted in 2010.  State v. Dunham, supra.

The judge denied the motion to suppress and the case went to trial.  State v. Dunham, supra.  The jury convicted Dunham of “eight counts of pornography involving juveniles” and the judge sentenced him to “thirty months at hard labor without the benefit of probation, parole, or suspension of sentence for each count, to be served concurrently.” State v. Dunham, supra.  (I don't know what constitutes “hard labor” in Louisiana; I did some research, but could not find anything specific.)

Dunham appealed, arguing that “the use of technology unavailable to the public to search his computer constituted an illegal, warrantless search” which produced evidence that was used against him at trial.  State v. Dunham, supra.  As Wikipedia explains, and as I have noted in earlier posts, the 4th Amendment to the U.S. Constitution creates a right to be free from “unreasonable” searches and seizures, and to be “reasonable” a “search” or “seizure” must either be conducted pursuant to a valid search (and/or seizure) warrant or pursuant to an applicable exception to the warrant requirement that the officers can rely upon. 

We will come back to Dunham’s argument.  To understand his argument, it is necessary to understand how the charges against him came about:

Trooper Jared Sandifer with the Louisiana State Police became involved in an investigation of [Dunham] on July 19, 2009, while using peer-to-peer file sharing software called `GNU Watch.’ . . . [At the hearing on the motion to suppress,] Sandifer testified that GNU Watch searches for internet protocol (`IP’) addresses that are sharing files with a known secure hash algorithm (`SHA’) value, which he described as being `like a thumbprint’ for a video or image.

He used GNU Watch to search LimeWire, a peer-to-peer file sharing software system, for files with SHA values indicative of child pornography. According to Sandifer, if such files were not in LimeWire or another peer-to-peer file sharing software system, GNU Watch would not detect them. He also opined that if the files were not in the LimeWire user's `shared’ folder, GNU Watch would not detect them.

Through the information obtained by GNU Watch, Sandifer saw that IP address 68.11.192.222 had files with SHA values that were consistent with child pornography. Based on this information, Sandifer had a court ordered subpoena issued to Cox Communications, Inc., and determined that the IP address belonged to [Dunham’s] wife.

He obtained a search warrant, and he and a group of other officers . . . executed the warrant at [Dunham’s] residence. Sandifer found a laptop computer in the residence and seized it after [Dunham] stated that it belonged to him. Sandifer conducted an examination of the files on the computer and discovered that it contained images of child pornography.

State v. Dunham, supra.

After Sandifer found child pornography on the laptop, it was taken to the

Louisiana State Police headquarters and a forensic examination was conducted by Trooper Dwight Herson, an expert in the field of forensic computer examination. Herson testified [at the hearing on the motion to suppress] that he was provided with a list of files that Sandifer saw on [Dunham’s] computer and was able to locate all of those files.

When asked whether a LimeWire user would have access to the SHA value of a file on the program without the use of special police software, he responded that programs are available to obtain the SHA value of a file once the file has been transferred from LimeWire. According to Herson, although it is not normal practice, a user could access the SHA value of a file once the user has the file.

State v. Dunham, supra.

On appeal, Dunham argued that “the Louisiana State Police's use of the `Wyoming Tool Kit’ or GNU Watch software to search his personal computer was an illegal, warrantless search because the software is not readily available for public use.”  State v. Dunham, supra.  More precisely, he argued that

SHA values are not available to the general public and special software was required to obtain the value and compare it to other known files. He also argues that LimeWire shares parts of files, rather than whole files, and that SHA values cannot be obtained from the fragments available on LimeWire through publicly available software.

State v. Dunham, supra. (The opinion does not say this, but it appears that in making this argument, Dunham was relying on the Supreme Court's decision in Kyllo v. U.S., 533 U.S. 27 (2001). As I explained in an earlier post, the Kyllo Court held that it is a 4th Amendment "search" for law enforcement officers to use "technology not in public usage" to obtain information from inside a home. It seems, then, that  the Wyoming Tool Kit was technology "not in general public usage.")

The Court of Appeals began its analysis of Dunham’s argument (and, by implication, the prosecution’s argument to the contrary) by noting that when a

district court denies a motion to suppress, factual and credibility determinations should not be reversed in the absence of a clear abuse of the district court's discretion, i.e., unless such ruling is not supported by the evidence. . . . However, a district court's legal findings are subject to a de novo standard of review. . . .

State v. Dunham, supra.

The court also explained that when someone files a motion to suppress, the burden of proof

is on the defendant to prove the ground of his motion.  Louisiana Code of Criminal Procedure article 703. The defendant has the obligation of designating the transcript of the hearing of the motion to suppress for the record on appeal. See Louisiana Code of Criminal Procedure article 914.1. The transcript of that hearing is not in the record before us. However, in determining whether the ruling on defendant's motion to suppress was correct, we are not limited to the evidence adduced at the hearing on the motion. We may consider all pertinent evidence given at the trial of the case. . . .

State v. Dunham, supra.

The court then explained that, as noted above, the 4th Amendment protects U.S. citizens from “unreasonable” searches and seizures.  State v. Dunham, supra. It also noted that “[o]nly individuals who actually enjoy the reasonable expectation of privacy have standing to challenge the validity of a government search.”  State v. Dunham, supra.

As Wikipedia explains, and as I have noted in earlier posts, to constitute a “search” under the 4th Amendment, the conduct of law enforcement officers must violate a person’s “reasonable expectation of privacy” in a place or thing.  As Wikipedia also explains, and as I have noted in earlier posts, to have a “reasonable expectation of privacy” under Katz v. U.S., 389 U.S. 347 (1967), I must subjectively believe the place or thing is “private” and society must accept my belief as objectively reasonable.  So it would not, for example, be a “search” for a law enforcement officer to listen to my part of a conversation I am conducting via my cell phone in a public place.  A court would say that I may have thought it was private, but society would reject my belief as unreasonable . . . since anyone in the vicinity could have done what the officer did.

The Court of Appeals noted that the issues Dunham raised in this case were recently addressed by another panel of Louisiana Court of Appeals judges in State v. Daigle, 93 So.3d 657 (Louisiana Court of Appeals – 3d Circuit 2012).  State v. Dunham, supra.

In Daigle, Louisiana State Police detectives conducted an investigation using the Wyoming Tool Kit and discovered [Daigle’s] IP address was seen with SHA values consistent with child pornography. At trial, the detectives explained that the Wyoming Tool Kit was designed by the Wyoming Department of Justice and ran on the Gnutella network.

According to the detectives, software such as LimeWire and BearShare also ran on the Gnutella network. The Wyoming Tool Kit identified IP addresses that had SHA values matching images previously identified as child pornography. . . . The detectives used GNU Watch in addition to the Wyoming Tool Kit, and testified that both programs only ran on the Gnutella network. . . .

Citing several recent federal court decisions, the court found that in applying for a search warrant, the detective did not violate any reasonable expectation of privacy on [Daigle’s] part by using software available only to law enforcement to identify [his] IP address as having SHA values that might be associated with images of child pornography. 

State v. Dunham, supra.

This 1st Circuit panel of the Court of Appeals agreed with the Daigle court and found Sandifer

did not violate [Dunham’s] right to privacy by using GNU Watch to examine the SHA values for files [he] had already elected to freely share with other LimeWire users. Moreover, [Dunham] offered no evidence at trial in support of his assertion that publicly available programs are unable to obtain the SHA values of files on LimeWire, and the record does not support that argument. Therefore, [his] arguments related to the alleged violation of his right of privacy are without merit.

State v. Dunham, supra.

It also declined to address Dunham’s claim there were “misrepresentations in the search warrant regarding the technology used in obtaining evidence in support of the warrant and whether that technology was publicly available, such that the evidence used against him should have been suppressed.” State v. Dunham, supra. Since Dunham had the burden to prove that the warrant was invalid but did not include the search warrant application and transcript of the trial court’s hearing on the motion to suppress included in the record submitted to the Court of Appeals, the court found that he failed to prove there were any defects in the warrant application that caused the warrant to issue without probable cause.  State v. Dunham, supra.

(It also noted that in Sandifer’s testimony at trial, which was included in the record before the Court of Appeals, he “asserts that there are programs available to the public that can be downloaded to view the information that he was able to view using the special software.”  State v. Dunham, supra.)

The court therefore affirmed Dunham’s conviction and sentence.  State v. Dunham, supra. If you are interested, you can read a little more about the case and find a photo of Dunham in the news story you can find here.

No comments: