Plain View, Computer Forensics and Rosetta Stone

As this press release from the U.S. Attorney for the Northern District of Georgia explains, on August 2, 2011 Carl Skow, of Marietta, Georgia, was indicted on federal charges of

attempting to obtain a minor for the purpose of engaging in a commercial sex act, enticement of a minor to engage in sexual activity, and possession of child pornography. . . . In June 2011, an undercover federal agent responded to an ad posted by Skow on an online classifieds website in which he offered a younger girl sex for money.

Between early June 2011 and July 6, 2011, Skow and the agent communicated several times through electronic mail, by telephone, and in person, regarding [his] interest in purchasing a minor female from Guatemala for sexual services. Skow agreed to pay the agent $2,500 for a year of her services and made a down payment of $1,250. . . . The agent and Skow agreed to meet at Hartsfield-Jackson International Airport on July 6, 2011, where SKOW planned to pick up the minor female, and make the final $1,250 payment to the undercover agent. 

On that day at the agreed meeting location, Skow was arrested in possession of the final payment.  Also on July 6, agents executed a search warrant at [his] home and found, among other items, numerous images of child pornography on Skow’s home computer.

This post examines a recent opinion in which the federal district court judge who has the case ruled on Skow’s motion to suppress certain evidence.  U.S. v. Skow, 2013 WL 5493308 (U.S.District Court for the Northern District of Georgia 2013).  As to how the motion arose, the judge explained, in an earlier opinion, that

Agent Tad G. Schlatre presented a search warrant application to Judge Linda T. Walker on July 6, 2011, seeking a warrant to search [Skow’s] residence at 502 Olde Mill Lane in Norcross, Georgia, to include a search of computer storage media and other items specified in the application. . . . The warrant application recited that it was seeking evidence of the violation of 18 U.S. Code § 2422(b), which makes it a crime to persuade, induce, entice, or coerce a minor to engage in prostitution or any other criminal sexual activity, or attempt to do so. . . .

Judge Walker signed the warrant, which was executed by law enforcement at [Skow’s] residence at about the same time [he] was being arrested at the Atlanta Airport when he showed up for a meeting with an undercover agent.

U.S. v. Skow, 2012 WL 4514282 (U.S. District Court for the Northern District of Georgia 2012) (“U.S. v. Skow 2012”). 

In the opinion this post examines, the district court judge adopts the “report and recommendation” a U.S. Magistrate Judge wrote analyzing Skow’s argument in his motion to suppress.  As Wikipedia explains, a U.S. District Court judge can assign a Magistrate Judge to write a “Report and Recommendation” on a legal issue and submit it to the District Court Judge, who accepts it as written, rejects it or ask that it be revised. 

The issue the Magistrate Judge analyzes is whether,

under the plain view doctrine, during the search of [Skow’s] computer undertaken pursuant to a warrant, the officers were lawfully in a place where the incriminating or evidentiary character of the images of child pornography would have been `immediately apparent,’ assuming that the officers were not authorized by probable cause under the warrant to search for child pornography. 

U.S. v. Skow, supra.

As Wikipedia explains, and as I have noted in priorposts, the plain view doctrine is a principle that can expand the scope of a lawful 4^th Amendment search, i.e., a search conducted pursuant to a valid search warrant.  It lets, as Wikipedia notes, an officer seize evidence found during a lawful 4^th Amendment search if (i) the officer does not violate the 4^th Amendment by being at the police where he/she saw the evidence, (ii) the officer does not violate the 4^th Amendment by accessing and seizing the evidence and (iii) the incriminating nature of the item(s) is “immediately apparent” to the officer.

At the hearing on Skow’s motion to suppress, two of the agents who participated in the investigation testified about the process used to search Skow’s computer.  Schlatre did not perform the forensic analysis of the computer, but was the affiant on the application for the search warrant and testified how agents, “generally speaking,” would go about

searching for the evidence or items listed in the warrant. . . . [He] testified that they were looking for evidence on the computer of who owned the computer, which could include resumés, photos of the owner, or other similar identifying information. . . . He would also look for Skype or instant messaging, and also for photographs that would indicate ownership of the computer. . . .To find photos of the owner, the examiner would need to look at all the photographs on the computer. . . .

In addition, . . . the agents were looking for evidence of purchase of a copy of any `Rosetta Stone’ language courses or materials. . . . To look for this evidence, agents would use a keyword search. . . . Alternatively, agents could look for a logo for Rosetta Stone or a picture of the packaging indicating that someone went to a website for it. . . .Examiners would look in different places in the computer for any such evidence. . . .

The warrant also authorized a search for evidence of the purchase of a girl's bicycle as a means of transportation for a teenage girl. . . . Insofar as the warrant authorized search for `[a]ny evidence of preparation for the arrival of a 14–year–old female, including[,] but not limited to, girl's clothing, beds, toys, games,’ . . . the agent would do word searches for these items and also look for pictures of toys and games. . .

The warrant also authorized a search for certain photographs of minor girls provided by the undercover agent to [Skow]. . . . Again, the agent testified that the examiner could be expected to do a keyword search for the particular e-mail account that the pictures were sent to. . . . would also look in the internet cache or in slack space, but ultimately would have to look at all the pictures on the computer to find them. . . .

U.S. v. Skow, supra.

Agent Michael Richardson, who examined Skow’s computer, testified that he used

`Encase Portable.’ . . . After performing several operations on the computer and hard drives over a two-hour period, he received a manageable `bucket of images’ to look at. . . . He immediately noticed . . .child pornography. . . . At that point he just shut the preview down because they were seizing the computers anyway. . . .

Back at the lab, he also used another version of Encase. . . . He looked at [the] . . . `bucket of images.’ . . . He was also looking for images of `Mariena,’ a 14-year-old girl whose name he had been given. . . . Scrolling through the images he ultimately found images of Mariena. . . .Those images were later `hashed’ and found to be the same images sent by the undercover agent to [Skow]. . . .

He also found evidence of Rosetta Stone through a keyword search which took him directly to it. . . . With regard to the girls' bicycles, he did image searching and a keyword search. . . . He did not find anything. . . . With regard to evidence of `preparation for the arrival of a 14–year–old female,’ he went through images to see if there were any images of any of these items. . . . He also did keyword searches and again checked the Internet history and found no evidence of those items either. . . .

Richardson was looking for child pornography because he believed the warrant authorized him to do that. . . . [I]f he had just been looking for photographs of Mariena when he searched under the search warrant he would not have done anything differently. . . . And with regard to Rosetta Stone, the bicycle, the children's clothing, the evidence of usership, he would have scrolled through all the images. . . .

U.S. v. Skow, supra.

Jim Persinger is a computer forensics consultant Skow hired. U.S. v. Skow, supra. He examined Skow’s computer in an office at the Department of Homeland Security. U.S. v. Skow, supra.  He started with hash values but “also did a keyword search for `Mariena.’” U.S. v. Skow, supra.  Persinger “used a function called Gallery Viewer”, which “turned up images of the pictures in question.” U.S. v. Skow, supra.“It did not turn up any child pornography” but Persinger “found the term `Rosetta.’” U.S. v. Skow, supra.

In his opinion, someone who found child pornography on this computer had to be

zeroing in and looking particularly for child pornography, not looking for Rosetta Stone, or references to a girl's bicycle, or the five particular photographs. . . . He was asked to perform particular tasks. To find the three to five pictures and references to Rosetta Stone, he focused on two hard drives. . . . He was not asked to look for references to bicycles or evidence of shopping for children's clothing or toys. . . . 

He said that if he had been asked to look for information regarding a girl's bicycle or women's clothes he would have said the search was too broad. . . . He agreed that once he found what he thought was a picture, ultimately he would have to open the picture and look at it to be sure it was what he was looking for. . . .

He was shown the last page of [Skow’s] Exhibit 1, page 17, an exhibit created by him. . . . [H]is attention was called to a file labeled as follows, in part: `Guatemala 9yo fucked in car with sound.mpg.lnk.’ . . .That file was found on [Skow’s] computer on a hard drive. . . . In fact, he found this in the course of his examination. . . .

He admitted that if he was looking for evidence of [Skow’s] preparation to bring a young Guatemalan girl into his home for sex he would search `Guatemala.’ . . .  If he did that, this file would come up. . . . He could then play the video and determine whether, as the title suggests, it showed a 9–year–old Guatemalan girl being raped. . . .  He admitted that if he had gone as far as to find this link he would have had reason to believe that the link was pornographic in nature and involved a child. . . .

U.S. v. Skow, supra.

In his motion to suppress, Skow argued that

a properly limited search using hash values and keywords would have immediately disclosed the pictures of the young girls given to [him] by the undercover officer, any reference to a girl named `Mariena,’ any reference to Rosetta Stone language courses, and any indicators of ownership of the computer, without ever placing the examining agents in a place where they would have seen child pornography.

U.S. v. Skow, supra.  He also argued that “a limitation of the search to evidence received or created after June 3, 2011, would likewise have assured that no child pornography would have been seen.”  U.S. v. Skow, supra. 

-->

In his Report and Recommendation, the Magistrate Judge noted, first, that “even though [Skow] is correct that it would have been possible to target narrowly the girl photographs, and the references to Rosetta Stone and Mariena, without necessarily having ventured into a place on the computer where child pornography could have been discovered,” his argument “fails as it is applied to other categories of information authorized to be searched for and seized in the warrant.”  U.S. v. Skow, supra.  He also noted that the "warrant authorized search for any evidence of the purchase of a bicycle [and] for any evidence of preparation for and arrival of a 14–year–old female, probably from Guatemala” and said he could not “conclude it was unreasonable for Richardson to have looked through his `bucket of images’ seeking such evidence.” U.S. v. Skow, supra.   

And he noted Persinger said that, under the circumstances, he “himself would have retrieved the file described above and would have recognized it as a link to child pornography.”  U.S. v. Skow, supra. He did not find Richardson’s actions in this regard to violate the 4^th Amendment’s requirement of “reasonableness.” U.S. v. Skow, supra.

As to the date limitation Skow suggested, the Magistrate Judge found that “given that the preview software used on the scene by Richardson lacked the capability of date limitation, . . . it was not unreasonable for [him] to have reviewed the images on site without applying such a limitation.” U.S. v. Skow, supra. As to “the more comprehensive search performed back at the lab,” he did not find “any unreasonable conduct in the agents looking at the list of files and at least cursorily opening those that appeared to be evidentiary or contraband.”  U.S. v. Skow, supra. As the Magistrate Judge noted, when an officer has a lawful warrant that authorizes him/her to search for and seize evidence, he/she can look wherever the evidence could be. U.S. v. Skow, supra.

As to the general scope of the search, the Magistrate Judge found that whether it would

have been reasonable to have looked through all the jpegs and other photographic image files just to find the pictures of the girls, or a reference to Rosetta Stone, it was certainly reasonable for the agent to look through [Skow’s]photographs for evidence of [his] ownership, possession and control of the computer and its hard drives, and it was reasonable to look for any evidence of [his] planning and preparations for the coming of this Guatemalan girl he believed the undercover officer was going to deliver to him. And, as Richardson testified, as soon as he started looking through the images on [Skow’s] computer, he came very quickly in the process upon child pornography.

U.S. v. Skow, supra.

The judge therefore held that the fact Richardson was

looking for child pornography does not render his search unconstitutional. At the time he made his search, he was possessed of a search warrant that, on its face, authorized him to search for child pornography. The issue is not whether he was looking for child pornography.

The issue is whether the search warrant authorized the agent to look through the photographs in making the searches he had probable cause to make, and whether, in so carrying out this authorized mandate, the agent came into a place where photographs would have been in plain view whose incriminating character as child pornography would have been `immediately apparent.’ I answer these questions, `Yes.’ I thus conclude on this issue that the requirements of the plain view doctrine were met in this case with regard to Richardson's discovery of child pornography on [Skow’s] computer and its associated hard drives.

U.S. v. Skow, supra.

The Magistrate Judge therefore recommended that Skow’s motion to suppress should be denied.  U.S. v. Skow, supra.  The U.S. District Court Judge who has the case later adopted the Magistrate Judge’s Report and Recommendation as his opinion, which meant he denied Skow’s motion to suppress.  U.S. v. Skow, supra.