Wednesday, March 08, 2017

The Search Warrant, Staleness and Child Pornography

This post examines a recent opinion from the U.S. Court of Appeals for the 8th Circuit:  U.S. v. Huyck, 2017 WL 694517 (2017). The court begins the opinion by explaining that
[f]ollowing a jury trial, Michael Huyck was convicted of multiple child pornography-related crimes. On appeal, he raises four issues, claiming that . . . the district court erred in denying his motion to suppress evidence seized pursuant to an allegedly stale search warrant. . . .
U.S. v. Huyck, supra.  The reference to “the district court” in the paragraph above refers to the U.S. District Court Judge who presided over the prosecution that was brought in the U.S. District Court for the District of Nebraska. U.S. v. Huyck, supra.  
The Court of Appeals begins the opinion by explaining what happened at the District Court level:
In November 2012, the FBI seized a computer server in Bellevue, Nebraska that hosted child pornography websites on the `Tor’ network. The Tor network is designed to allow users to surf the Internet anonymously and access otherwise hidden websites, including illegal websites like `Pedoboard,’ which was strictly devoted to child pornography. To access the Tor network, a user downloads special software that obscures a user's Internet Protocol (`IP’) address, thereby evading traditional law enforcement IP identification techniques. Once on the Tor network, users must have a unique, sixteen-character web address to access the Pedoboard website. Unlike traditional web addresses, a Tor web address does not indicate the services or content available on the site. Thus, a Pedoboard user must obtain the web address from other users or from Internet postings describing Pedoboard's content. The most common way to find Pedoboard's web address was to access the `Hidden Wiki’—a directory of Tor hidden services providing the name of the hidden service, a description of its content, and the Tor web address. To identify people accessing Pedoboard, the FBI installed Network InvestigativeTechnique (`NIT’) software on the website, which revealed the true IP addresses of people accessing the site, the date and time the user accessed the content, and the user's computer operating system.
U.S. v. Huyck, supra.  
The opinion goes on to explain that the FBI
controlled and monitored Pedoboard from November 16, 2012 to December 2, 2012. On November 21, 2012, an IP address linked to Huyck's residence utilized the Tor network and browsed Pedoboard for at least nine minutes. The computer used Windows XP and a Google Chrome browser. Huyck and his sixteen-year-old daughter were the only people present at his residence that night. No child pornography was downloaded during the visit.

In early April 2013, law enforcement agents conducted physical surveillance of Huyck's residence. They noted that Huyck utilized an unsecured wireless network, though the signal strength was so weak that agents could not obtain the signal from the front yard of his residence. Agents prepared a search warrant for the residence, which was executed on April 9, 2013, more than four months after the November 2012 Pedoboard access date. Officers went to the basement of Huyck's residence and discovered a complex computer network. They also found a Hitachi 160GB hard drive, a G–Technology 2GB external storage drive, and a Molex 2GB thumb drive on his desk and among his personal belongings. Two computers were located underneath the desk, and neither used Windows XP or Google Chrome at the time of the search. However, one of the computers had been recently wiped clean of all data, and stickers on the computer towers indicated Windows 7 had been downgraded to Windows XP Pro. Huyck was the only adult living at the residence, and during the search, Huyck told officers that no one else had access to his computers and that he worked at Molex in an information technology position. Finally, Huyck admitted that he was familiar with and had used the Tor network, believing it to be anonymous.
U.S. v. Huyck, supra.  
The court then explains that a
forensic analysis of the Hitachi hard drive revealed ninety-five thumbnail images of child pornography in the thumbs.db file, though the images were not viewable without special software. Nonetheless, the thumbnail images indicated that original, full-size images were present on the Hitachi hard drive in 2010 but had been deleted by the time of the search. A forensic analysis of the G–Technology external storage drive revealed a text file with instructions on how to configure a computer to access the Tor network using a Google Chrome browser. The forensic analysis also exposed a list of Tor hidden services—including a link to the Onion Pedo Video Archive (OPVA), a different Tor child pornography website—and an image of a young girl, appearing to be under eighteen years of age, taking a picture with her genitalia showing. A forensic analysis of the Molex thumb drive revealed a picture of Huyck; another reference to the OPVA hyperlink; and a text file stating, `[H]ttps:// opva2pilscvtwmh.onion/ Need to use download manager downthemall is good for some.’ The hyperlink was the Tor web address for OPVA. `Downthemall’ is a download manager that helps a user efficiently download contents of an Internet website, such as child pornography, though it is commonly used for legal purposes.

Based on this evidence, the Government charged Huyck with five offenses in two separate indictments, which were later consolidated for trial. In the first indictment, the Government charged Huyck with two crimes in connection with the Pedoboard activity: (1) receipt or attempted receipt of child pornography, in violation of 18 U.S. Code §§ 2252A(a)(2)and (b)(2) (`Pedoboard receipt count’); and (2) accessing with intent to view child pornography, in violation of 18 U.S. Code § 2252A(a)(5)(B) (`Pedoboard access count’). In the second indictment, the Government charged Huyck with three crimes related to evidence seized from his residence. In relation to the ninety-five images found on the Hitachi hard drive, the Government charged Huyck with (1) receipt or attempted receipt of child pornography, in violation of 18 U.S. Code §§ 2252A(a)(2) and (b)(1) (`Hitachi receipt count'); and (2) possession of child pornography, in violation of 18 U.S. Code § 2252A(a)(5)(B) (`Hitachi possession count’). The last count was for possession of child pornography contained on the G–Technology external storage drive.
U.S. v. Huyck, supra.  
The Court of Appeals goes on to explain that
Huyck moved to suppress evidence seized during the search of his residence, alleging that a four and one half-month delay between his browsing of Pedoboard and the warrant's issuance rendered the warrant fatally stale. The magistrate judge recommended denying the motion to suppress, which the district court adopted. Huyck also moved to exclude Exhibits 16, 18, 23, 24, 27, 28, and 32, claiming unfair prejudice. Exhibits 23, 24, and 32 concerned the `downthemall’ program, and Exhibits 16, 18, 27, and 28 involved instructions for accessing and anonymizing the Tor network and references and links to OPVA. The district court admitted all of the challenged evidence over Huyck's objections.

After the close of evidence, the district court granted Huyck's motion for a judgment of acquittal as to the G–Technology possession count after finding that the Government had not sufficiently demonstrated that the person depicted in the image was under eighteen years of age. The district court provided the jury with a special verdict form for the Pedoboard receipt and Hitachi receipt counts. The verdict form allowed the jury to convict Huyck of receipt of child pornography, attempted receipt of child pornography, or neither.

The jury began deliberations but asked the district court for supplemental instructions defining intent, knowledge, and access. The court provided minor clarifications but generally referred the jury back to its previous instructions. The jury then found Huyck guilty as to the Pedoboard receipt and access counts. It also returned an inconsistent response to the special verdict form on the Hitachi receipt count, finding Huyck guilty of receiving child pornography but not guilty of attempted receipt of child pornography. The jury concluded by finding Huyck guilty of the Hitachi possession count. The district court denied Huyck's motion for a judgment of acquittal except for the Hitachi receipt count, which it granted. It then denied Huyck's motion for a new trial because the remaining verdicts were supported by sufficient evidence. Finally, the court sentenced Huyck to 72 months' imprisonment on the Pedoboard receipt count, with concurrent 36–month sentences for the Pedoboard access and Hitachi possession counts. This appeal followed.
U.S. v. Huyck, supra.  
Huyck’s motion to suppress, like many motions to suppress, was based on the Fourth Amendment to the U.S. Constitution which, as Wikipedia explains, creates a right to be free from “unreasonable” searches and seizures.
The Court of Appeals then took up Huyck’s argument that the U.S. District Court Judge
erred in denying his motion to suppress because the search warrant was based on stale information and was thus unsupported by probable cause. `We examine the factual findings underlying the district court's denial of the motion to suppress for clear error and review de novo the ultimate question of whether the Fourth Amendment has been violated.’ United States v. Williams, 577 F.3d 878, 880 (8th Circuit Court of Appeals 2009) (quotation omitted). `Probable cause means a fair probability that contraband or evidence of a crime will be found in a particular place, given the circumstances set forth in the affidavit.’ United States v. Lemon, 590 F.3d 612, 614 (8th Circuit Court of Appeals 2010) (quotations omitted). `A warrant becomes stale if the information supporting the warrant is not sufficiently close in time to the issuance of the warrant and the subsequent search conducted so that probable cause can be said to exist as of the time of the search.’ United States v. Brewer, 588 F.3d 1165, 1173 (8th Circuit Court of Appeals 2009) (quotation and citation omitted). `There is no bright-line test for determining when information in a warrant is stale.’ United States v. Lemon, supra (quotation omitted). Instead, we look to `the lapse of time since the warrant was issued, the nature of the criminal activity, and the kind of property subject to the search.’ United States v. Estey, 595 F.3d 836, 840 (8th Circuit Court of Appeals 2010) (quotation omitted).
U.S. v. Huyck, supra.  
The court went on to explain that Huyck argued that the
affidavit did not establish probable cause because briefly browsing a child pornography website is not sufficiently likely to result in evidence of child pornography possession four-and-one-half months later. He acknowledges that the Eighth Circuit has upheld time lapses of similar or longer durations, see Lemon, 590 F.3d at 614 (upholding a search warrant issued eighteen months after discovering information related to child pornography), but he argues that there is a difference between someone who downloads child pornography and someone who browses through child pornography. Huyck, however, does not proffer any evidence demonstrating a difference in the habits of those browsing through child pornography and those downloading child pornography. See Estey, 595 F.3d at 840) (`Meanwhile, Estey does not offer evidence contrary to the FBI statements regarding the habits of child pornography collectors.’). More importantly, his argument misrepresents the facts of this case.

Here, Huyck did not simply and accidentally navigate to Pedoboard for a few meaningless minutes. Instead, the evidence shows he accessed Pedoboard after taking a number of intermediate steps that indicated his knowledge that Pedoboard trafficked in child pornography. First, Pedoboard was not some random website that any Internet user could randomly stumble upon by chance. It was located on the Tor network, and Huyck had to download specific software to access the Tor network. Second, accessing Pedoboard required knowledge of Pedoboard's exact Tor web address. According to the warrant affidavit, that Tor web address was not common information; users could only obtain the Pedoboard web address directly from other users or from Internet postings detailing the child pornography content available. In United States v. DeFoggi, a case which dealt with a different child pornography website hidden on the Tor network, we held that `[a]ccessing PedoBook therefore required numerous affirmative steps by the user, making it extremely unlikely that a user would stumble upon it without knowing that its purpose was to advertise and distribute child pornography and understanding the content to be found there.’ 839 F.3d 701, 707 (8th Cir. 2016). That logic applies here with equal force. And coupled with the fact that `child pornographers generally retain their pornography for extended periods,’ United States v. Chrobak, 289 F.3d 1043, 1046 (8th Cir. 2002), this evidence is sufficient to demonstrate that probable cause existed at the time of the search. See United States v. Wagers, 452 F.3d 534, 540 (6th Cir. 2006) (`[E]vidence that a person has visited or subscribed to websites containing child pornography supports the conclusion that he has likely downloaded, kept, and otherwise possessed the material.’).
U.S. v. Huyck, supra.  
The Court of Appeals then articulates its analysis of, and ruling on, this issue:
We also note that the warrant sought not just contraband—that is additional child pornography—but evidence related to Huyck's prior November 21, 2012 crimes of receiving child pornography and accessing with intent to view child pornography. The warrant affidavit noted that `[d]igital information can also be retained unintentionally . . .  (e.g., temporary files or ISP client software, among others)’ and described how `a computer user's Internet activities generally leave traces or “footprints” in the web cache and history files of the browser used.’ Thus, law enforcement officials had probable cause to search Huyck's residence, as there was a fair probability that they would unearth evidence of the completed crime in Huyck's possession at the time of the search. See United States v. McArthur, 573 F.3d 608, 612 n.4 (8th Cir. 2009) (`When a user deletes a file, it is not erased completely from the computer’); United States v. Lewis, 605 F.3d 395, 402 (6th Cir. 2010) (`[I]mages typically persist in some form on a computer hard drive even after the images have been deleted and . . . can often be recovered by forensic examiners.’ (quotation omitted)). As a result, the district court properly denied Huyck's motion to suppress.
U.S. v. Huyck, supra.  
For these and other reasons, the Court of Appeals affirmed Huyck’s convictions. U.S. v. Huyck, supra.  

No comments: