Wednesday, September 27, 2017

Child Sex Trafficking and Bypassing Security on a Tablet Computer

This post examines a recent opinion from the U.S. Court of Appeals for the 11th Circuit:  U.S. v. Blake, 868 F.3d 960 (2017). The court begins the opinion by explaining that
[a]fter a nine-day trial, a jury found Dontavious Blake and Tara Jo Moore guilty of child sex trafficking for managing a prostitution ring involving at least two girls under the age of eighteen. Blake and Moore challenge numerous rulings the district court made before and during trial, and at sentencing.
U.S. v. Blake, supra.
The court goes on to explain why, and how, the prosecution arose:
Blake and Moore had a system for running their prostitution ring. One of them would post ads for prostitution services on the classifieds website Backpage. Moore would then take phone calls from potential customers who were responding to the ads. And Blake would give the prostitutes rides to their appointments and provide muscle. The money was split 50/50 between the working prostitute on the one hand and Blake and Moore on the other.

Through a variety of leads, the FBI discovered Blake and Moore's prostitution ring. It learned that the Backpage ads had been posted using an email address (hereafter the “S.B. email address”), which the FBI determined belonged to Moore. And it found out that at least two girls, known as T.H. and E.P., had been under the age of eighteen when they engaged in prostitution for Blake and Moore.

In the wake of those discoveries, the FBI arrested Blake and Moore. It continued the investigation, executing four post-arrest search warrants relevant to this appeal. First, it executed a warrant to seize and search electronics in Blake and Moore's townhouse, including an `Apple iPad tablet [ ].’ Once in possession of that iPad tablet, however, the FBI found itself unable to access any of the device's data due to its security features. So the FBI requested and received a district court order, issued under the All Writs Act, 28 U.S.C. § 1651(a), requiring the iPad's manufacturer, Apple Inc., to assist the FBI in bypassing the iPad's passcode lock and other security measures. With Apple's help, the FBI was able to successfully unlock the device and download its data.
U.S. v. Blake, supra.
The opinion goes on to explain that the
second relevant search warrant the FBI executed directed Microsoft, which owns Hotmail, to turn over emails from two of Blake and Moore's email accounts, including the S.B. email account. The Microsoft warrant did not seek all emails in those two email accounts; instead, it was limited to certain categories of emails in them that were linked to the sex trafficking charges against Blake and Moore. For example, the warrant required Microsoft to turn over all `[e]mails, correspondence, and contact information for’ and all `[e]mails and correspondence from online adult services websites’ that were contained within the two email accounts.

Finally, the FBI also applied for and received two almost identical search warrants for Moore's Facebook account. Because that account was associated with the S.B. email address and Moore's phone number, the FBI knew it belonged to her. At the time it executed the Facebook warrants, the FBI had extensive evidence linking Moore to the prostitution ring, including statements by T.H. inculpating her. And Moore's Facebook account was suggestive of criminal conduct: the publicly viewable version of the account listed Moore's occupation as `Boss Lady’ at `Tricks R [U]s.’

The two warrants required Facebook to `disclose’ to the government virtually every type of data that could be located in a Facebook account, including every private instant message Moore had ever sent or received, every IP address she had ever logged in from, every photograph she had ever uploaded or been `tagged’ in, every private or public group she had ever been a member of, every search on the website she had ever conducted, and every purchase she had ever made through `Facebook Marketplace,’ as well as her entire contact list. The disclosures were not limited to data from the period of time during which Moore managed the prostitution ring; one warrant asked for all data `from the period of the creation of the account’ and the other did not specify what period of time was requested. The warrants did state that the only information that would be `seized,’ after all that data had been `disclosed’ to the FBI, was data that “constitute[d] fruits, evidence and instrumentalities” of a specified crime.
U.S. v. Blake, supra.
The court ended its prefatory comments on the case by explaining that
[a]fter the execution of those four warrants, a third superseding indictment charged Blake and Moore with six violations of 18 U.S.C. § 1591: substantive child sex trafficking of T.H. (Count 1); substantive child sex trafficking of E.P. (Count 2); conspiracy to sex traffic children—T.H. and E.P. (Count 3); two substantive counts of sex trafficking adults by coercion (Counts 4 and 5); and one count of conspiracy to sex traffic by coercion (Count 6).

Blake and Moore filed several pre-trial motions relevant to this appeal. Moore moved to sever Counts 1 through 3, which involved sex trafficking of children, from Counts 4 through 6, which involved sex trafficking of adults by coercion. Blake and Moore moved to suppress evidence obtained from the iPad. And they moved to suppress all the evidence gathered as a result of the search warrants served on Microsoft and Facebook. The district court denied all of those motions.
U.S. v. Blake, supra.
Next, the court outlines what occurred during the trial and the later sentencing.  It began by explaining that
[a]t trial T.H. testified about her time prostituting for Blake and Moore, starting when she was sixteen years old. To explain why she turned to prostitution, T.H. described her difficult upbringing. She explained that her great uncle had sexually abused her when she was between the ages of five and eight. During that same period, her parents separated, her father left her life, and her mother fell into a deep depression, leaving T.H.'s older sister to raise her. That older sister was a drug addict who physically abused her.

E.P. testified as well. She stated that she called Blake after she found his business card and started prostituting for him soon thereafter. She was sixteen when she started—young enough that Blake had to buy her cigarettes. On cross examination she admitted that she saw Moore only six times `at most.’ One of those times was when Moore spent about twenty minutes taking pictures of her for a Backpage ad.

The government also called Khrystyna Trejo, an adult prostitute who had spent time working alongside T.H. and E.P. She testified that, although E.P. had told her that she was eighteen, E.P.'s way of `approach[ing] certain things’ and her interest in children's television shows made her seem `younger than what . . .she said she was.’

In addition to testimony related solely to the child sex trafficking charges, the government called several witnesses in an attempt to prove its theory that Blake and Moore `coerced’ adult prostitutes by controlling their drug supply, evidence that went to Counts 4 through 6. Several adult prostitutes testified both to the general structure of the prostitution ring and the fact that almost all the money the prostitutes made was immediately spent buying drugs from Blake. The government also called an addiction expert who testified about the physical and neurological characteristics of drug dependency and withdrawal.
U.S. v. Blake, supra.
The opinion went on to explain that
Blake and Moore did not present any evidence of their own. The jury found them guilty of the remaining charges—two substantive counts of child sex trafficking and one count of conspiracy to sex traffic children, and the district court entered judgment of conviction on those counts.

After applying a number of enhancements, the district court sentenced Blake to 324 months imprisonment, followed by supervised release for a term of life. And it sentenced Moore to 180 months imprisonment followed by 240 months supervised release.
U.S. v. Blake, supra.
The opinion goes on to take the arguments the defendants made in their appeal, starting with the “bypass order.” U.S. v. Blake, supra.  The court explains that
Blake and Moore next contend that the order requiring Apple to assist in bypassing the iPad's security features—what we will call the `bypass order’—exceeded the authority granted by the All Writs Act. As a threshold matter, we must address whether Blake and Moore have standing to make this challenge. They satisfy the three requirements of constitutional standing because they `(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct ... and (3) that is likely to be redressed by a favorable judicial decision.’ Spokeo, Inc. v. Robins, 578 U.S. ––––, 136 S.Ct. 1540, 1547, 194 L.Ed.2d 635 (2016). Specifically, they were injured because the evidence gathered as a result of the bypass order was used to convict them. That injury is fairly traceable to the government's request for and the district court's issuance of the bypass order. And if a court ruled in their favor on the All Writs Act issue, and if a court further ruled that suppression was the proper remedy for the violation of the All Writs Act, Blake and Moore's injury would be redressed.

In addition to the three constitutional standing requirements, `the Supreme Court has held that prudential requirements pose additional limitations on standing.’ Wolff v. Cash 4 Titles, 351 F.3d 1348, 1353 (11th Cir. 2003). One of those prudential limitations is the rule that a litigant `generally must assert his own legal rights and interests, and cannot rest his claim to relief on the legal rights or interests of third parties.’ Warth v. Seldin, 422 U.S. 490, 499, 95 S.Ct. 2197, 2205, 45 L.Ed.2d 343 (1975); see also Craig v. Boren, 429 U.S. 190, 193, 97 S.Ct. 451, 455, 50 L.Ed.2d 397 (1976) (explaining that the limitation on asserting third parties' rights is not `constitutionally mandated’ but instead `stem[s] from a salutary rule of self-restraint’) (quotation marks omitted). Here, Blake and Moore are attempting to invoke All Writs Act protections, such as its restriction that any burden imposed on a third party not be `unreasonable,’ that shield third parties like Apple, not criminal defendants. See United States v. N.Y. Tel. Co., 434 U.S. 159, 171, 98 S.Ct. 364, 372, 54 L.Ed.2d 376 (1977). In other words, they are attempting to assert Apple's legal rights, not their own.
U.S. v. Blake, supra.
The Court of Appeals then took up Blake’s and Moore’s argument that “the district court did not have the authority to issue the bypass order, and, as a result, it should have suppressed any evidence resulting from Apple's compliance with that order.” U.S. v. Blake, supra.  The court began its analysis of whether the trial court ‘s order “exceeded the court's authority under the All Writs Act.”  U.S. v. Blake, supra.
It began by explaining that the All Writs Act provides as follows:
`The Supreme Court and all courts established by Act of Congress may issue all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law.’
28 U.S.C. § 1651(a). The Supreme Court has recognized five requirements that must be met before a court can compel under the All Writs Act the assistance of a third party in a criminal investigation: (1) the order must be necessary or appropriate to effectuate a previously issued order, (2) it must not be covered by another statute, (3) it must not be inconsistent with the intent of Congress, (4) the third party must not be too far removed from the underlying case, and (5) the burden imposed on the third party must not be unreasonable. See United States v. N.Y. Tel. Co., 434 U.S. 159, 172–78 (1977).
U.S. v. Blake, supra.
The Court of Appeals then began its analysis of all five requirements, in the order given above:
1. Necessary or Appropriate

The first requirement for use of the All Writs Act is that the use be necessary or appropriate to carry out an issued order. See id. at 172, 98 S.Ct. at 372. (`This Court has repeatedly recognized the power of a federal court to issue such commands under the All Writs Act as may be necessary or appropriate to effectuate and prevent the frustration of orders it has previously issued....’). The bypass order in this case was necessary or appropriate because there was no other way for the FBI to execute the district court's order to search the contents of the iPad. See In re Grand Jury Subpoena Duces Tecum Dated March 25, 2011, 670 F.3d 1335, 1346–49 (11th Cir. 2012) (holding that compelling a defendant to produce data protected by his password without providing constitutionally sufficient immunity violates the Fifth Amendment).

2. Not Otherwise Covered by Statute

The authority granted by the All Writs Act is broad but not boundless. The Act `is a residual source of authority’ that permits issuing writs only if they `are not otherwise covered by statute.’ Penn. Bureau of Corr. v. U.S. Marshals Serv., 474 U.S. 34, 43, 106 S.Ct. 355, 361, 88 L.Ed.2d 189 (1985). It is a gap filler. `Where a statute specifically addresses the particular issue at hand, it is that authority, and not the All Writs Act, that is controlling.’ Id. And where Congress has proscribed a certain type of judicial action, the Act cannot overcome that proscription. See id.  The bypass order meets this requirement because no statute expressly permits or prohibits it.

3. Not Inconsistent with Intent of Congress

Even where, as here, no statute expressly permits or prohibits a particular judicial action, the court cannot always use the Act to fill the gap. Any order issued under the All Writs Act must still be `consistent with the intent of Congress.’ See United States v. New York Telephone Co., 434 U.S. 159 (1977). To determine if a judicial action is consistent with congressional intent, it is not enough to ask whether there is an on-point statute. We must also look at laws that are not directly on point but that speak to similar issues in order to determine whether the proposed judicial action is in line with congressional intent. See id. at 172, 176–78, 98 S.Ct. at 372, 374–75. If the legislative context bearing on the proposed action suggests that Congress did not intend for the court to have a given power, taking the action under the All Writs Act is inconsistent with congressional intent and cannot be the basis for the action. See id.

The Supreme Court's decision in New York Telephone illustrates this principle. In that case the district court had issued an order under the All Writs Act requiring a phone company to assist the FBI in installing pen registers on certain phone lines. Id. at 161–62, 98 S.Ct. at 367. The Supreme Court held the order was consistent with congressional intent for two reasons. Id. at 176–78, 98 S.Ct. at 374–75. First, the legislative history of Title III of the Omnibus Crime Control and Safe Streets Act, which governs the issuance of wiretaps, makes clear that Congress intended for courts to be able to order the installation of pen registers. See id. at 176–77, 98 S.Ct. at 374. Second, amendments to Title III had authorized courts to compel assistance in installing wiretaps, though they did not specifically mention pen registers. Id. at 176–77, 98 S.Ct. at 374–75. The Court reasoned that Congress likewise intended for courts to be able to compel assistance in installing pen registers when assistance was necessary. Id. at 177–78, 98 S.Ct. at 374–75. As a result, the Court held that the district court's order was within the authority granted by the All Writs Act. Id. at 177–78, 98 S.Ct. at 375.

Blake and Moore argue that the New York Telephone case is distinguishable because, unlike the pen register order involved in that case, the issuance of the bypass order in this case is contrary to congressional intent. They rely on the Communications Assistance for Law Enforcement Act (CALEA), 47 U.S.C. §§ 1001-1010, for that proposition. Section 1002, which is part of CALEA, requires `telecommunications carrier[s]” to provide certain forms of assistance to law enforcement, while exempting “information services’ companies—a category that includes Apple—from those same requirements. See id. §§ 1001(6), 1001(6), 1002(a), (b)(2). Blake and Moore assert that the `information services’ exemption in § 1002 shows that Congress intends for companies like Apple to be insulated from court-ordered law enforcement cooperation through bypass orders.

The problem is that the § 1002 requirements are all about design choices and ensuring that telephone networks “are capable of” delivering evidence to law enforcement. See id. § 1002(a). If this case were about a court order forcing Apple to initially design its devices so that law enforcement would be capable of accessing them in the future, § 1002's exemption of information services companies would be relevant. But that is not what this case is about. It is, instead, about a device that has already been designed, manufactured, sold, and used, and about how to access the information on that device. In light of the distinction between initial design and later access, § 1002 does not show that bypass orders are inconsistent with congressional intent.

4. Third Party Not Too Far Removed from Underlying Case

The fourth requirement for use of the All Writs Act, at least for compelling a non-party in a criminal case, is that the non-party not be `so far removed from the underlying controversy that its assistance could not be permissibly compelled.’ N.Y. Tel., 434 U.S. at 174, 98 S.Ct. at 373. Blake and Moore argue that `Apple's connection to the case [is] merely that it ... originally manufactured the iPad,’ so it is too far removed for its assistance to be compelled. That argument misstates the technology. Apple continued being connected to Blake and Moore's use of the iPad even after they bought it: the iPad ran on an operating system owned by Apple (Blake and Moore were only licensing it); Apple servers conveyed messages sent from the iPad; and Apple servers backed up the iPad's data. See Apple, Inc., Apple iOS Software License Agreement 1 (2016),; Greg Kumparak, Apple Explains Exactly How Secure iMessage Really Is, TechCrunch (Feb. 27, 2014), Apple's continued connection to the case means that it was not so far removed from the underlying controversy that its assistance could not be compelled.

5. Not Unreasonable Burden on Third Party
The final New York Telephone requirement is that any burden imposed on the compelled party must not be `unreasonable.’ N.Y. Tel., 434 U.S. at 172, 98 S.Ct. at 372. To comply with the bypass order, Apple simply had to have an employee plug the iPad into a special computer and then transfer the iPad's data to a thumb drive. That is not an unreasonable burden, especially in light of the fact that Apple did not object to the bypass order's requirements.
U.S. v. Blake, supra.
The Court of Appeals sums up the analysis above by explaining that the
bypass order was necessary or appropriate to carry out the search warrant the district court had issued, the assistance sought was not specifically addressed by another statute, the bypass order was not inconsistent with Congress' intent, Apple was not too far removed from the underlying controversy, and the burden the order imposed on it was not unreasonable. See id. at 172–74, 98 S.Ct. at 372–73. It follows that the bypass order did not exceed the district court's authority and the evidence gathered as a result of that order did not have to be suppressed.
U.S. v. Blake, supra.
The opinion goes on to examine some additional issues not related to the analyses aboe and ended the opinion by affirming Blake’s conviction and sentence. U.S. v. Blake, supra.

No comments: