This post examines a recent opinion from the U.S. Court of Appeals for the 8th Circuit: U.S. v. Huyck, 2017 WL 694517 (2017). The
court begins the opinion by explaining that
[f]ollowing a jury trial, Michael Huyck
was convicted of multiple child pornography-related crimes. On appeal, he raises
four issues, claiming that . . . the district court erred in denying his
motion to suppress evidence seized pursuant to an allegedly stale search warrant. . . .
U.S. v. Huyck, supra. The reference to “the district court” in the
paragraph above refers to the U.S. District Court Judge who presided over the
prosecution that was brought in the U.S. District Court for the District of Nebraska. U.S. v. Huyck, supra.
The Court of Appeals begins the opinion by explaining what
happened at the District Court level:
In November 2012, the FBI seized a
computer server in Bellevue, Nebraska that hosted child pornography websites on
the `Tor’ network. The Tor network is designed to allow users to surf the
Internet anonymously and access otherwise hidden websites, including illegal
websites like `Pedoboard,’ which was strictly devoted to child pornography. To
access the Tor network, a user downloads special software that obscures a
user's Internet Protocol (`IP’) address, thereby evading traditional law
enforcement IP identification techniques. Once on the Tor network, users must
have a unique, sixteen-character web address to access the Pedoboard website.
Unlike traditional web addresses, a Tor web address does not indicate the
services or content available on the site. Thus, a Pedoboard user must obtain
the web address from other users or from Internet postings describing
Pedoboard's content. The most common way to find Pedoboard's web address was to
access the `Hidden Wiki’—a directory of Tor hidden services providing the name
of the hidden service, a description of its content, and the Tor web address.
To identify people accessing Pedoboard, the FBI installed Network InvestigativeTechnique (`NIT’) software on the website, which revealed the true IP addresses
of people accessing the site, the date and time the user accessed the content,
and the user's computer operating system.
U.S. v. Huyck, supra.
The opinion goes on to explain that the FBI
controlled and monitored Pedoboard from
November 16, 2012 to December 2, 2012. On November 21, 2012, an IP address
linked to Huyck's residence utilized the Tor network and browsed Pedoboard for
at least nine minutes. The computer used Windows XP and a Google Chrome
browser. Huyck and his sixteen-year-old daughter were the only people present
at his residence that night. No child pornography was downloaded during the
visit.
In early April 2013, law enforcement
agents conducted physical surveillance of Huyck's residence. They noted that
Huyck utilized an unsecured wireless network, though the signal strength was so
weak that agents could not obtain the signal from the front yard of his
residence. Agents prepared a search warrant for the residence, which was
executed on April 9, 2013, more than four months after the November 2012
Pedoboard access date. Officers went to the basement of Huyck's residence and
discovered a complex computer network. They also found a Hitachi 160GB hard
drive, a G–Technology 2GB external storage drive, and a Molex 2GB thumb drive
on his desk and among his personal belongings. Two computers were located
underneath the desk, and neither used Windows XP or Google Chrome at the time
of the search. However, one of the computers had been recently wiped clean of
all data, and stickers on the computer towers indicated Windows 7 had been
downgraded to Windows XP Pro. Huyck was the only adult living at the residence,
and during the search, Huyck told officers that no one else had access to his
computers and that he worked at Molex in an information technology position.
Finally, Huyck admitted that he was familiar with and had used the Tor network,
believing it to be anonymous.
U.S. v. Huyck, supra.
The court then explains that a
forensic analysis of the Hitachi hard
drive revealed ninety-five thumbnail images of child pornography in the
thumbs.db file, though the images were not viewable without special software.
Nonetheless, the thumbnail images indicated that original, full-size images
were present on the Hitachi hard drive in 2010 but had been deleted by the time
of the search. A forensic analysis of the G–Technology external storage drive
revealed a text file with instructions on how to configure a computer to access
the Tor network using a Google Chrome browser. The forensic analysis also
exposed a list of Tor hidden services—including a link to the Onion Pedo Video
Archive (OPVA), a different Tor child pornography website—and an image of a
young girl, appearing to be under eighteen years of age, taking a picture with
her genitalia showing. A forensic analysis of the Molex thumb drive revealed a
picture of Huyck; another reference to the OPVA hyperlink; and a text file
stating, `[H]ttps:// opva2pilscvtwmh.onion/ Need to use download manager
downthemall is good for some.’ The hyperlink was the Tor web address for OPVA.
`Downthemall’ is a download manager that helps a user efficiently download
contents of an Internet website, such as child pornography, though it is
commonly used for legal purposes.
Based on this evidence, the Government
charged Huyck with five offenses in two separate indictments, which were later
consolidated for trial. In the first indictment, the Government charged Huyck
with two crimes in connection with the Pedoboard activity: (1) receipt or
attempted receipt of child pornography, in violation of 18 U.S. Code §§ 2252A(a)(2)and (b)(2) (`Pedoboard receipt count’); and (2) accessing with intent to view
child pornography, in violation of 18 U.S. Code § 2252A(a)(5)(B) (`Pedoboard
access count’). In the second indictment, the Government charged Huyck with
three crimes related to evidence seized from his residence. In relation to the
ninety-five images found on the Hitachi hard drive, the Government charged
Huyck with (1) receipt or attempted receipt of child pornography, in violation
of 18 U.S. Code §§ 2252A(a)(2) and (b)(1) (`Hitachi receipt
count'); and (2) possession of child pornography, in violation of 18 U.S. Code § 2252A(a)(5)(B) (`Hitachi possession count’). The last count was for
possession of child pornography contained on the G–Technology external storage
drive.
U.S. v. Huyck, supra.
The Court of Appeals goes on to explain that
Huyck moved to suppress evidence seized
during the search of his residence, alleging that a four and one half-month delay
between his browsing of Pedoboard and the warrant's issuance rendered the
warrant fatally stale. The magistrate judge recommended denying the motion
to suppress, which the district court adopted. Huyck also moved to exclude
Exhibits 16, 18, 23, 24, 27, 28, and 32, claiming unfair prejudice. Exhibits
23, 24, and 32 concerned the `downthemall’ program, and Exhibits 16, 18, 27,
and 28 involved instructions for accessing and anonymizing the Tor network and
references and links to OPVA. The district court admitted all of the challenged
evidence over Huyck's objections.
After the close of evidence, the
district court granted Huyck's motion for a judgment of acquittal as to the
G–Technology possession count after finding that the Government had not
sufficiently demonstrated that the person depicted in the image was under
eighteen years of age. The district court provided the jury with a special verdict form for the Pedoboard receipt and Hitachi receipt counts. The verdict
form allowed the jury to convict Huyck of receipt of child pornography,
attempted receipt of child pornography, or neither.
The jury began deliberations but asked
the district court for supplemental instructions defining intent, knowledge,
and access. The court provided minor clarifications but generally referred the
jury back to its previous instructions. The jury then found Huyck guilty as to
the Pedoboard receipt and access counts. It also returned an inconsistent response
to the special verdict form on the Hitachi receipt count, finding Huyck guilty
of receiving child pornography but not guilty of attempted receipt of child
pornography. The jury concluded by finding Huyck guilty of the Hitachi
possession count. The district court denied Huyck's motion for a judgment of
acquittal except for the Hitachi receipt count, which it granted. It then
denied Huyck's motion for a new trial because the remaining verdicts were
supported by sufficient evidence. Finally, the court sentenced Huyck to 72
months' imprisonment on the Pedoboard receipt count, with concurrent 36–month
sentences for the Pedoboard access and Hitachi possession counts. This appeal
followed.
U.S. v. Huyck, supra.
Huyck’s motion to suppress, like many motions to suppress,
was based on the Fourth Amendment to the U.S. Constitution which, as Wikipedia
explains, creates a right to be free from “unreasonable” searches and seizures.
The Court of Appeals then took up Huyck’s argument that the
U.S. District Court Judge
erred in denying his motion to suppress
because the search warrant was based on stale information and was thus unsupported
by probable cause. `We examine the factual findings underlying the district
court's denial of the motion to suppress for clear error and review de
novo the ultimate question of whether the Fourth Amendment has been
violated.’ United States v. Williams, 577 F.3d 878, 880 (8th
Circuit Court of Appeals 2009) (quotation omitted). `Probable cause means
a fair probability that contraband or evidence of a crime will be found in a
particular place, given the circumstances set forth in the affidavit.’ United
States v. Lemon, 590 F.3d 612, 614 (8th Circuit Court of Appeals 2010) (quotations
omitted). `A warrant becomes stale if the information supporting the warrant is
not sufficiently close in time to the issuance of the warrant and the
subsequent search conducted so that probable cause can be said to exist as of
the time of the search.’ United States v. Brewer, 588 F.3d 1165,
1173 (8th Circuit Court of Appeals 2009) (quotation and citation omitted).
`There is no bright-line test for determining when information in a warrant is
stale.’ United States v. Lemon, supra
(quotation omitted). Instead, we look to `the lapse of time since the warrant
was issued, the nature of the criminal activity, and the kind of property
subject to the search.’ United States v. Estey, 595 F.3d 836, 840 (8th
Circuit Court of Appeals 2010) (quotation omitted).
U.S. v. Huyck, supra.
The court went on to explain that Huyck argued that the
affidavit did not establish probable cause because briefly browsing a child pornography website is not sufficiently
likely to result in evidence of child pornography possession four-and-one-half
months later. He acknowledges that the Eighth Circuit has upheld time lapses of
similar or longer durations, see Lemon, 590 F.3d at 614 (upholding
a search warrant issued eighteen months after discovering information related
to child pornography), but he argues that there is a difference between someone
who downloads child pornography and someone who browses through child
pornography. Huyck, however, does not proffer any evidence demonstrating a
difference in the habits of those browsing through child pornography and those
downloading child pornography. See Estey, 595 F.3d at 840) (`Meanwhile,
Estey does not offer evidence contrary to the FBI statements regarding the
habits of child pornography collectors.’). More importantly, his argument
misrepresents the facts of this case.
Here, Huyck did not simply and
accidentally navigate to Pedoboard for a few meaningless minutes. Instead, the
evidence shows he accessed Pedoboard after taking a number of intermediate
steps that indicated his knowledge that Pedoboard trafficked in child
pornography. First, Pedoboard was not some random website that any Internet
user could randomly stumble upon by chance. It was located on the Tor network,
and Huyck had to download specific software to access the Tor network. Second,
accessing Pedoboard required knowledge of Pedoboard's exact Tor web address.
According to the warrant affidavit, that Tor web address was not common
information; users could only obtain the Pedoboard web address directly from
other users or from Internet postings detailing the child pornography content
available. In United States v. DeFoggi, a case which dealt with a
different child pornography website hidden on the Tor network, we held that `[a]ccessing
PedoBook therefore required numerous affirmative steps by the user, making it
extremely unlikely that a user would stumble upon it without knowing that its
purpose was to advertise and distribute child pornography and understanding the
content to be found there.’ 839 F.3d 701, 707 (8th Cir. 2016). That logic
applies here with equal force. And coupled with the fact that `child
pornographers generally retain their pornography for extended periods,’ United
States v. Chrobak, 289 F.3d 1043, 1046 (8th Cir. 2002), this evidence is
sufficient to demonstrate that probable cause existed at the time of the
search. See United States v. Wagers, 452 F.3d 534, 540 (6th
Cir. 2006) (`[E]vidence that a person has visited or subscribed to websites
containing child pornography supports the conclusion that he has likely
downloaded, kept, and otherwise possessed the material.’).
U.S. v. Huyck, supra.
The Court of Appeals then articulates its analysis of, and
ruling on, this issue:
We also note that the warrant sought
not just contraband—that is additional child pornography—but evidence related
to Huyck's prior November 21, 2012 crimes of receiving child pornography and
accessing with intent to view child pornography. The warrant affidavit noted
that `[d]igital information can also be retained unintentionally . . . (e.g., temporary files or ISP client software,
among others)’ and described how `a computer user's Internet activities
generally leave traces or “footprints” in the web cache and history files of
the browser used.’ Thus, law enforcement officials had probable cause to search
Huyck's residence, as there was a fair probability that they would unearth
evidence of the completed crime in Huyck's possession at the time of the
search. See United States v. McArthur, 573 F.3d 608, 612 n.4
(8th Cir. 2009) (`When a user deletes a file, it is not erased completely
from the computer’); United States v. Lewis, 605 F.3d 395, 402 (6th
Cir. 2010) (`[I]mages typically persist in some form on a computer hard drive
even after the images have been deleted and . . . can often be recovered by
forensic examiners.’ (quotation omitted)). As a result, the district court
properly denied Huyck's motion to suppress.
U.S. v. Huyck, supra.
For these and other reasons, the Court of Appeals affirmed
Huyck’s convictions. U.S. v. Huyck, supra.
No comments:
Post a Comment