The Cioffi Email Search Warrant: Residual Issues

My last post was about U.S. v. Cioffi, in which a federal judge held that the search warrant issued for a suspect’s gmail account violated the 4^th Amendment’s particularity requirement. The judge therefore granted the suspect’s motion to suppress evidence “seized from his personal email account.” U.S. v. Cioffi, 2009 WL 3416241 (U.S. District Court for the Eastern District of New York 2008).

Taken on its face, Cioffi seems straightforward: an application of basic 4^th Amendment principles to an electronic search and seizure. That is probably true . . . but there may be some other, statutory issues lurking in the Cioffi decision. More precisely, the facts in the case may implicate some issues that are neither articulated nor addressed in the Cioffi decision.

Why do I mention statutes when it was argued and decided as a 4^th Amendment case? As I mentioned in my first post on the Warshak case, the government uses a federal statute – 18 U.S. Code § 2703 – to get the contents of emails stored on an ISP’s server. The statute is implicitly predicated on the premise that we do not have a 4^th Amendment expectation of privacy in emails stored on a third-party’s server; as I noted in an earlier post on the statute, it is, at least by implication, based on the U.S. Supreme Court’s decision in Smith v. Maryland, 442 U.S. 735 (1979).

In Smith, and the companion case of U.S. v. Miller, 425 U.S. 435 (1976), the Supreme Court held that we do not have a 4^th Amendment expectation of privacy in information we share with a third-party, like a telephone company (Smith) or a financial institution (Miller). The premise is that by sharing information with a third-party, I assume the risk that this person or entity will share the information with the government; in other words, I assume the risk of betrayal.

As I’ve noted in earlier posts, I don’t agree with that and don’t agree with the current approach of using statutes – instead of the 4^th Amendment – to govern law enforcement searches and seizures of emails and other stored content. This post, though isn’t about that; it’s about why the Cioffi court based its decision on the 4^th Amendment and not on the statute that governs access to stored emails.

That statute is, as noted above, section 2703 of Title 18 of the U.S. Code. Two sections of § 2703 – sections (a) and (b) -- deal with the government’s gaining access to stored emails. Here is what § 2703(a) says:

A governmental entity may require the disclosure by a provider of electronic communication service of the contents of a[n] . . . electronic communication, that is in electronic storage . . . for one hundred and eighty days or less, only pursuant to a warrant issued using the procedures described in the Federal Rules of Criminal Procedure . . . by a court of competent jurisdiction. A governmental entity may require the disclosure by a provider of electronic communications services of the contents of a[n] . . . electronic communication that has been in electronic storage . . . for more than one hundred and eighty days by the means available under subsection (b) of this section.

Subsection (b) lets the government obtain emails in storage for more than 180 days by using a search warrant, a subpoena or a court order. So under § 2703(b), an agent CAN use a search warrant to get the emails, but doesn’t have to.

The Cioffi opinion doesn’t explain why the FBI agent in that case sought a search warrant, and I don’t have access to the briefs in the case so I can’t be sure as to why he did. At one point, though, the Cioffi U.S. v. Cioffi, supra. After saying that, the court cites § 2703(b)(1)(A), which is the provision that says an agent can use a search warrant or a subpoena or a court order to get the contents of emails that have been stored with an ISP for over 180 days. U.S. v. Cioffi, supra. opinion says that the affidavit the agent submitted to obtain the search warrant for the gmail account quoted extensively from the statutory scheme of which § 2703 is a part.

Does that matter? . . . and if it does, why? That’s what I’m trying to figure out. In the legislative history relating to the adoption of 18 U.S. Code § 2703, Congress indicated that email content in storage for less than 180 days is entitled to more protection than content stored longer. The premise seems to have been that email stored for shorter periods is analogous to stuff kept in a safe deposit box while email stored for over 180 days is more like the content in Smith and Miller, i.e., is presumptively available to the party with which it’s stored. See Susan Freiwald, Online Surveillance, 56 Alabama Law Review 9 (2004). As many have pointed out, the distinction doesn’t make any sense, especially given how we now use email, but that’s not the issue I want to address here.

We know the agent in Cioffi used a search warrant to access the contents of the suspect’s email account. We don’t know how long the emails had been in storage. If they were stored for 180 days or less, the agent had to get the warrant under § 2703(a). If they were stored for over 180 days, he had the option of using a warrant but could have gone with a subpoena or a court order; since the court cited § 2703(b)(1)(A), I suspect they were stored for over 180 days.

If they were stored for 180+ days, then, as I said, the agent didn’t have to get a search warrant; he could proceed under the statute, instead of the 4^th Amendment (because the assumption is that these emails weren’t protected by the 4^th Amendment). If he didn’t have to get a warrant because the emails weren’t protected by the 4^th Amendment, why did the federal judge analyze, and decide, the case under the 4^th Amendment?

I was at a conference not long ago, and a speaker was talking about how a § 2703(b) warrant isn’t a 4^th I’d never heard that before; I’d always tended to assume that § 2703(b)(1)(A) incorporates 4^th Amendment procedure, which would mean that an agent has to get a warrant that’s supported by the 4^th Amendment, particularly describes the place to be searched and the things to be seized. She seemed to think it doesn’t. If it doesn’t, then it would seem that a failure to comply with 4^th Amendment procedures doesn’t trigger the exclusionary rule, i.e., if the agent messes up (as the agent apparently did in Cioffi), the evidence can still be used because there was no constitutional violation. Amendment warrant – it’s a statutory warrant.

Even it does, what does this mean when it comes to the applicability of the exclusionary rule? If § 2703(b)(1)(A) incorporates 4^th Amendment procedure as an option for gaining authorization to search for and seize electronic evidence, does that mean the statute incorporates the 4^th Amendment, so a violation of the statue triggers application of the 4^th Amendment’s exclusionary rule? I don’t think that’s the way the statute was intended to work because this interpretation of § 2703(b)(1)(A) would effectively mean it’s applying full 4^th Amendment protection to emails that have been stored for 180+ days . . . which clearly does not seem to have been Congress’ intention.

I can’t find a good explanation of any of this . . . but the impression I get is that in adopting § 2703(b)(1)(A), Congress was telling agents (and officers) they could play it safe and get a warrant, but didn’t have to. I suspect the position noted above – that a § 2703(b) warrant isn’t a 4^th Amendment warrant – might be correct when it comes to the consequences of going for the warrant option but not adequately complying with the warrant requirements. Maybe the net effect of the § 2703(b)(1)(A) option is that an agent (or officer) can use a warrant to get emails stored 180+ days but not lose the evidence if he/she doesn’t comply with all the procedures needed to get a warrant. (A related statutory provision – 18 U.S. Code § 2708 – says suppression isn’t a remedy for violating § 2703.)

If that’s true, then why did the Cioffi court analyze the case as a straight 4^th Amendment case instead of as a § 2703(b)(1)(A) case? If I’m right, and the emails had been stored for 180+ days, then the court seems to have implicitly assumed that the 4^th Amendment applies to such emails. Otherwise, why would it have gone with the 4^th Amendment analysis . . and applied the exclusionary rule as the remedy?

What if I’m wrong and the emails had been stored for 180 days or less . . . so the agent had to proceed under § 2703(a)? As I understand it – and as I think the Department of Justice would argue – the premise isn’t that § 2703(a) implements full 4^th Amendment protection for emails that have been stored for less than 180 days. My understanding is that a warrant is required because Congress believed (based on how email worked in the mid-1980s, when the statute was drafted and adopted) that shorter storage justified greater protection. The greater protection, I think, was intended to be statutory, not 4^th So if that’s correct, then it seems the Cioffi judge should have analyzed the propriety of the agent’s actions under § 2703(a), not under the 4^th Amendment. Amendment.

I may well be missing some simple, obvious solution to all this. If you know what it is, please share it with the rest of us.

Even if there is some logical, statutorily-based explanation for why the Cioffi court did what it did, I don’t think it matters. As I’ve argued here and elsewhere, I think we need to get rid of these statutes and apply the 4^th Amendment to the contents of emails and other electronic communications. Not all electronic communications may be entitled to equal treatment under the 4^th Amendment, but that is something we could work out, just as courts have worked out how to apply the 4^th Amendment to telephone conversations and cars.

Lack of Particularity in Email Search Warrant

The 4^th Amendment to the U.S. Constitution requires that search warrants be based on probable cause and particularly describe “the place to be searched and the . . . things to be seized.” This post is about a case in which a court had to decide if a warrant issued to search an email account satisfied the 4^th Amendment’s particularity requirement.

The case is U.S. v. Cioffi, 2009 WL 3416241 (U.S. District Court for the Eastern District of New York 2009), and it began when FBI Agent Munster applied for a warrant to search Matthew Tannin’s gmail account.

The warrant sought evidence that Tannin was involved in fraud involving “two hedge funds he managed for Bear Stearns Management (`BSAM’). U.S. v. Cioffi, supra. Tannin had been indicted on conspiracy, securities fraud and wire fraud charges some time before the agent sound the warrant:

An affidavit executed by Munster accompanied the application. . . . It set forth Munster's proffered bases for issuing the Warrant.

The Affidavit incorporated . . . the 27-page indictment to demonstrate probable cause that Tannin had committed the charged crimes. To connect those crimes to Tannin's personal email account, the Affidavit alluded to paragraph 41 of the indictment, which excerpted an email sent by Tannin from his personal account to Cioffi on April 22, 2007 (`the April 22nd Email’):

[T]he subprime market looks pretty damn ugly.... If we believe the [CDO report is] ANYWHERE close to accurate I think we should close the funds now. . . . [I]f [the report] is correct then the entire subprime market is toast. . . . If AAA bonds are systemically downgraded then there is simply no way for us to make money-ever. . . .

[T]he April 22nd Email was produced to BSAM's counsel [during] an investigation into the funds' collapse. BSAM turned the email over to . . . the U.S. Attorney's Office in November 2007. Munster opined that Tannin's use of his personal email account, instead of his Bear Stearns account, to discuss work-related matters made it `likely that [he] used THE SUBJECT E-MAIL ACCOUNT to facilitate the charged conspiracy’ because the conspirators `were able to communicate privately by using THE SUBJECT E-MAIL ACCOUNT, in that their communications would not be subject to capture and review by Bear Stearns.’ . . .

In the Affidavit's next section, Munster described the procedures necessary to . . . execute the search. First, he averred that the search would be limited to emails created on or before August 12, 2007, `the day prior to Tannin's retention of private counsel, to prevent the danger of intercepting privileged communications.’ He stated that the nature of electronically stored data required `the searching authorities [to] carefully open and examine all the stored data to determine which of the various files are evidence, fruits, or instrumentalities of the crime,’ that such a procedure `would be impractical to do at Google's offices’ and would instead need to be carried out off-site `in a controlled environment.’ Finally, he averred that `[f]ederal law enforcement officials will review the records sought by the search warrant and will segregate any messages and content constituting evidence of violations of federal criminal law.’

The final paragraph . . . recited Munster's belief, based on the facts set forth, that `there is probable cause to search THE SUBJECT E-MAIL ACCOUNT for evidence of . . . conspiracy to commit. . . securities fraud, . . . and wire fraud. . . .’

U.S. v. Cioffi, supra.

The Magistrate to whom Munster submitted the application signed the warrant, which “authorized a search of `the premises . . . described as electronic mail address `matt.tannin@gmail.com.’” U.S. v. Cioffi, supra. The warrant included what the district court judge described as “a boilerplate statement reflecting the magistrate judge’s `satisf[action] that the affidavit(s) . . . establish probable cause to believe the . . . property . . . described is now concealed on the . . . premises above-described and establish grounds for the issuance of this warrant.’” U.S. v. Cioffi, supra. Munster’s affidavit was neither attached to nor incorporated by reference into the warrant. U.S. v. Cioffi, supra.

The warrant authorized Munster (or “any Authorized Officer of the United States”) to

seize from Tannin's email account the items set forth in `Attachment A’. . . . The attachment listed seven categories of `. . . stored information’ . . . [one of which] was described as `all e-mail up through August 12, 2007, including any attachments, and all instant messages, sent by or received by the accounts [sic], whether saved or deleted, whether contained directly in the e-mail account or in a customized ”‘folder.”’ There was no provision limiting the emails to be seized to those containing evidence of the crimes charged in the indictment or, indeed, of any crime at all.

Attachment A also. . . . directed Google employees to `locate . . . and create an exact duplicate’ of all records sought, and to produce the duplicate to the executing officer `in electronic form.’ The attachment did not . . . describe any procedures for the executing officer to follow in searching the account and seizing particular records.

U.S. v. Cioffi, supra. The warrant was served on Google, and it eventually sent a CD containing a copy of the information in Tannin’s account as it existed on November 7 to the prosecutor in Tannin’s case. U.S. v. Cioffi, supra. When prosecutors searched the CD, they found a November 23, 2006 email from Tannin to himself:

The lengthy email is essentially a diary entry, in which Tannin recorded his thoughts about such sundry matters as recent vacations and medical issues; however, several paragraphs were devoted to Tannin's anxiety about work and the state of the market.

U.S. v. Cioffi, supra. When prosecutors told Tannin they intended to use the November 23 email at his trial, he filed a motion to suppress, claiming the search warrant violated the 4^th Amendment because it did not “`describe with particularity the materials that would be the proper subject of a search’” of his email account. U.S. v. Cioffi, supra.

The district court judge who ruled on the motion to suppress began his analysis by noting that while courts have yet to adopt a specific standard of particularity for searches of electronic records, there is one type of warrant authorization courts have universally condemned: “`authorization to search for “evidence of a crime,’ that is to say any crime”. U.S. v. Cioffi, supra. Such an authorization violates the 4<sup>th</sup> Amendment because it permits a search for anything that can be evidence of any kind of crime; the particularity requirement is intended to prevent this kind of fishing expedition by restricting the scope of a search authorized by a warrant to the crime(s) for which the investigating officer has probable cause to believe were committed. Amendment’s particularity requirement is meant to ensure that “`those searches deemed necessary should be as limited as possible.”

After reviewing the warrant, the district court judge found that it “did not, on its face, limit the items to be seized from Tannin's personal email account to emails containing evidence of the crimes charged in the indictment, or, indeed, any crime at all. It was, therefore, unconstitutionally broad”. U.S. v. Cioffi, supra. The prosecution argued that the scope of the warrant was limited by what Agent Munster had included in the affidavit he used to obtain it, but the judge rejected that argument. U.S. v. Cioffi, supra.

In Groh v. Ramirez, 540 U.S. 551 (2004), the U.S. Supreme Court held that affidavits used to obtain a search warrant cannot be used to satisfy the 4^th Amendment’s particularity requirement unless they were attached to or otherwise incorporated into the warrant itself. The Groh Court said the “fact that the application adequately described the ‘things to be seized’ does not save the warrant from its facial invalidity. The Fourth Amendment by its terms requires particularity in the warrant, not in the supporting documents.” Groh v. Ramirez, supra. The Cioffi judge found that Groh foreclosed the prosecution’s attempt to use Agent Munster’s affidavit to satisfy the 4^th Amendment particularity requirement and save the evidence. U.S. v. Cioffi, supra.

The prosecution then argued that the email was admissible under the inevitable discovery doctrine, “under which unlawfully seized evidence is not suppressed if `the prosecution can establish by a preponderance of the evidence that the information . . . inevitably would have been discovered by lawful means.’” U.S. v. Cioffi, supra (quoting Nix v. Williams, 467 U.S. 431 (1984)). Here’s how the judge described the government’s argument:

The government does not-and could not-argue that the November 23rd Email would have been discovered by lawful means had the Warrant never been executed. Rather, it argues that the email could lawfully be obtained through another, more particularized warrant now that the Warrant has been invalidated.

U.S. v. Cioffi, supra (emphasis in the original). The Cioffi judge didn’t buy this argument. He found there was

little doubt that the government could now obtain a warrant authorizing a search that would yield the November 23rd Email, and that the email would still be found on Google's server. Nevertheless, the government's timing still presents a problem: Having seen the November 23rd Email, the government is now in a position to obtain a warrant with perfect particularity. There is, in other words, no way to purge the taint of its unconstitutionally overbroad search.

U.S. v. Cioffi, supra. I think the judge was right.

As a federal court of appeals noted, the inevitable discovery doctrine “requires the district court to determine, viewing affairs as they existed at the instant before the unlawful search, what would have happened had the unlawful search never occurred.” U.S. v. Eng., 997 F.2d 987 (U.S. Court of Appeals for the Second Circuit 1993) (emphasis in the original). If the warrant to search Tannin’s gmail account had incorporated Agent Munster’s affidavit, it would have only allowed the government to search for evidence of conspiracy to commit securities fraud and wire fraud plus securities fraud and wire fraud. From what we know of the November 23 email (the judge didn’t describe its contents in detail because he was granting the motion to suppress), it seems it would not have fallen within the scope of that warrant and therefore would not have been discovered . . . inevitably.

Privilege and Email Strings

This post is about how the attorney-client privilege applies to emails; more precisely, it’s about how the privilege applies to a series of emails between an attorney and a client.

As Wikipedia explains (and as everyone probably knows), the attorney-client privilege is an evidentiary privilege “that protects communications between a client and his or her attorney and keeps [them] confidential.” As Wikipedia notes, the policy behind the privilege is that it encourages free and open communications between a lawyer and his/her client, which helps the lawyer to a better job of representing the client.

If I know my attorney can’t be forced to disclose what I tell her, I’m much more likely to tell her what really happened than if I knew she could be forced to reveal what I told her. (And the same principle underlies other evidentiary privileges, like the doctor-patient privilege or the priest-penitent privilege.)

This post is about an issue that came up in Dawe v. Corrections USA, 2009 WL 3233883 (U.S. District Court for the Eastern District of California 2009). I really don’t know what the case (a civil suit) is about. According to one website, Brian Dawe is (or was) the Executive Director of Corrections USA, “a nonprofit coalition of the nation’s public corrections officers.” And that’s about all I know as to the facts in this case or what kind of claims are involved.

That’s really not essential. The judge to whom the case is assigned issued the above-cited opinion in October of this year; it contains the federal judge’s rulings on several discovery motions filed by the plaintiffs and defendants in the case. Dawe v. Corrections USA, supra. As Wikipedia explains, “discovery is the pre-trial phase in a lawsuit in which each party through the law of civil procedure can request documents and other evidence from other parties”.

As Wikipedia also explains, discovery requests don’t trump privileges, including the attorney-client privilege. Discovery rules, like those in the Federal Rules of Civil Procedure, generally bar one party from using discovery to obtain material that contains information protected by a privilege, such as the attorney-client privilege. As Wikipedia notes, when one side seeks the production of such material, these rules usually require the other party to produce a “`privilege log’ which describes the privileged information or material in a way that allows others to see . . . (if) it is privileged, but does not divulge the privileged material.”

That’s what happened in this case. The defendants sought access to emails that the plaintiff claimed were protected by the attorney-client privilege. All the defendants were given was a privilege log that had these entries (which I’ve slightly edited and reformatted):

Date & Description

8/21/06 Email between Gary Harkins and attorney Barry Peek, with prior email exchange between Mr. Harkins and Richard Loud (cc to Mr. Peek) re issues to address with corporate and employment attorneys and advice provided by California corporate attorney re, removal and replacement of Board of Directors’ members

9/26/06 Email to Richard Loud and Brian Dawe re information provided by attorney related to potential claims by and against CUSA and representatives thereof.

Dawe v. Corrections USA, supra.

The defendants (who were seeking discovery of the emails) argued that the attorney-client privilege does not

protect communications between parties, even if an attorney is `copied,’ and even if the communications include legal advice; they argue that the disclosure constitutes a waiver of any privilege that may originally have existed between attorney and client. Plaintiffs respond that these documents are privileged because they transmit information provided by attorneys who have been jointly consulted regarding possible litigation by and against CUSA.

Dawe v. Corrections USA, supra.

The federal judge began his analysis of the arguments by noting that the attorney-client privilege protects communications “between a lawyer and client which are intended to be confidential”. Dawe v. Corrections USA, supra. He then addressed the nature and status of the emails at issue:

The first privilege log entry is a four-message e-mail string that is fairly described by the privilege log. The initial (earliest in time/last in string) message, from Loud to Harkins, sets forth several questions to be asked, respectively, of a `corporate attorney’ and an `employment attorney.’ The message is a communication between parties, does not contain legal advice, and is not subject to attorney-client privilege.

The second message, from Harkins to Loud, with a `cc’ to Barry Peek (described to the court as `another lawyer in this case’ . . . recounts Harkins' discussion `with Mr. May, a ca corporate attorney,’ and the legal advice conveyed therein. This, again, is a communication among parties. While the subject information was clearly protected when conveyed by `Mr. May’ to Harkins, Harkin's communication (in which he transmits that information) to third parties Dawe and Loud, notwithstanding that the information was simultaneously `cc'd to attorney Peek, has not been shown to be a privileged communication. See, e.g., U.S. v. ChevronTexaco Corp., 241 F.Supp.2d 1065 (N.D. Cal. 2002) (`[t]he mere fact that outside counsel was copied with the e-mail will not shield communications not made for the purpose of securing legal advice’).

The court need not, however, reach these issues since the initial messages in the e-mail string were, essentially, `attachments’ to the final message between client and attorney. The third message is a single question posed by Peek to Harkins, concerning the advice given by Mr. May, while the fourth and last (most recent in time/first in string) e-mail message is Harkins' response to Peek, responding to the question. These last two messages are clearly protected by attorney-client privilege, and while the application of privileges to email communications remains an evolving area of the law, it appears that the current weight of authority favors examination of the most recent communication as the means for characterizing the entire e-mail string.

Dawe v. Corrections USA, supra. The judge then elaborated on the last point, noting that the U.S. v. ChevronTexaco court found that each email

`consists of the text of the sender's message as well as all of the prior e-mails that are attached to it. Therefore, [the] assertion that each separate e-mail stands as an independent communication is inaccurate. What is communicated with each e-mail is the text of the e-mail and all the e-mails forwarded along with it. . . . . “As Upjohn Co. v. United States makes clear, the fact that non-privileged information was communicated to an attorney may be privileged, even if the underlying information remains unprotected. 449 U.S. 383 (1981). As applied in the e-mail discovery context, the court understands Upjohn to mean that even though one e-mail is not privileged, a second e-mail which forwards that prior e-mail to counsel might be privileged in its entirety. In this respect, the forwarded material is similar to prior conversations or documents that are quoted verbatim in a letter to a party's attorney.”’

Dawe v. Corrections USA, supra (quoting U.S. v. ChevronTexaco, supra).

The judge therefore held that the first entry in the privilege log was “indeed privileged and should remain confidential.” Dawe v. Corrections USA, supra. He then turned to the second entry, which was a

single e-mail . . . from Gary Harkins, to Brian Dawe and Richard Loud, repeating legal advice Harkins received from his attorney. The legal information is specific to Harkins, even to the possible detriment of Dawe and Loud. While the information contained therein was clearly protected by the attorney-client privilege when transmitted from Harkins' attorney to Harkins, the essential question is whether Harkins waived the privilege by transmitting it to third parties Dawe and Loud.

Dawe v. Corrections USA, supra.

The plaintiffs argued that the attorney-client privilege had not been waived because the email was protected by a “joint defense” or “common interest” privilege that protected communications involving two or more clients who have retained or consulted a lawyer on a matter of common interest. Dawe v. Corrections USA, supra. After reviewing the cases that had addressed this apparent privilege, the federal judge in this case found that it does not encompass communications between co-plaintiffs when “`counsel is not present, or at the very least, where the specific conversations of the co-parties at issue was not expressly directed by counsel.’” Dawe v. Corrections USA, supra.

The judge held, therefore that

Harkins waived the confidentiality of the information he obtained from his attorney when he conveyed that information to Dawe and Loud. The court concludes, therefore, that the second entry in Harkins' privilege log is not privileged. Plaintiffs shall provide a copy of this e-mail to defendants within five days after this order is filed.

Dawe v. Corrections USA, supra.

This obviously isn’t a cybercrime case. I decided to write about it because the issue of how the attorney-client privilege applies to emails that incorporate the text of prior emails among the same parties can come up in a criminal case just as easily as it can in a civil case. And I hadn’t seen much written on this; I haven’t found a cybercrime case in which it’s come up, at least not so far.

Defendant Wins on Motion to Compel

This post is about a case in which a defendant in a criminal case filed what is known as a “motion to compel.” As Wikipedia explains, a motion to compel asks a court to

order either the opposing party or a third party to take some action. This sort of motion most commonly deals with discovery disputes, when a party who has propounded discovery to either the opposing party or a third party believes that the discovery responses are insufficient. The motion to compel is used to ask the court to order the non-complying party to produce the documentation or information requested, and/or to sanction the non-complying party for their failure to comply with the discovery requests.

The discovery process in civil and criminal cases, at both the state and federal levels, is governed by rules of court and/or statutes. Since the case we’ll be dealing with is a federal criminal case, the applicable rule is Rule 16 of the Federal Rules of Criminal Procedure, which you can find here.

The case is U.S. v. Pires, 2009 WL 2176664 (U.S. District Court for the District of Massachusetts 2009). Pires was indicted on two counts of attempted receipt of child pornography in violation of 18 U.S. Code §§ 2252(a)(2) and (b)(1) and one count of possessing child pornography in violation of 18 U.S. Code § 2252(a)(4)(B). U.S. v. Pires, supra. Here, according to a news story, is how the charges came about:

[T]he case arose from an FBI undercover operation that targeted individuals using file sharing programs to trade child pornography. . . . Pires was using Limewire, a file share program that allows users to exchange image and video files for free, to share images of child pornography. [An FBI agent] . . . downloaded images depicting children engaged in sexually explicit conduct from Pires and was able to access Pires' shared folder. During the review of Pires' shared folder, the agent discovered numerous images of child pornography depicting pre-pubescent children engaged in various sexual acts. Based on this information, a search warrant was executed at Pires' residence, and Pires admitted to accessing child pornography through file share programs and downloading images of the sexual abuse of children. A forensic examiner testified that a hard drive seized from Pires' residence revealed numerous images of child pornography, including those downloaded from Limewire.

Prior to his trial, which began in late July of 2009, Pires “moved to compel the” prosecution to “make substantive disclosures” under Rule 16 of the Federal Rules of Criminal Procedure [“Rule 16”] concerning “anticipated testimony by its proposed computer forensic expert, FBI employee David Brinton.” U.S. v. Pires, supra.

The motion to compel focused on two distinct issues, the first of which arose under Rule 16(a)(1)(F), which provides as follows:

Upon a defendant's request, the government must permit a defendant to inspect and to copy or photograph the results or reports of any physical or mental examination and of any scientific test or experiment if:

(i) the item is within the government's possession, custody, or control;

(ii) the attorney for the government knows--or through due diligence could know--that the item exists; and

(iii) the item is material to preparing the defense or the government intends to use the item in its case-in-chief at trial.

Here is what this part of Pires’ motion to compel focused on:

The government has provided Pires with a `Report of Examination’ dated December 6, 2007 (Docket # 48, Ex. D), in which Brinton describes the steps he took to examine computers seized during a search of defendant's residence. The report, however, only describes in the most general terms the evidence Brinton collected, without describing substantively the contents of that evidence. For example:

Located and bookmarked file cache and settings from the LimeWire application. Provided an internet history and cookie information in spreadsheet and database form. Provided basic Windows registry information in web page based format.

(Id. at 209.) The actual data in the spreadsheets, databases and web pages mentioned in this account and elsewhere in the report is neither described nor was it provided to defendant. ( See id. at 209-10 (describing additional bookmarks, database and spreadsheet evidence files created by Brinton).) [Rule 16(a)(1)(F)] requires the government, upon defendant's request, to `permit a defendant to inspect and to copy or photograph the results or reports of any physical or mental examination and of any scientific test or experiment’ if . . . the government intends to use the item in its case-in-chief at trial.’ Here, the government has made a physical examination of the computer it alleges contained child pornography.

U.S. v. Pires, supra. Pires had requested access to this information, but the prosecution was apparently refusing to give it to him (which is why he filed the motion to compel). The federal district court judge held that “[i]f the government intends to rely on any of the items listed in Brinton’s report not yet provided to defendant to establish an element of the charged offenses, it must make those items available for inspection by Pires’ counsel and computer expert.” U.S. v. Pires, supra. So Pires won on that issue.

The other issue Pires raised in his motion to compel arose under Rule 16(a)(1)(G), which provides as follows:

At the defendant's request, the government must give to the defendant a written summary of any testimony that the government intends to use under Rules 701, 703, or 705 of the Federal Rules of Evidence during its case-in-chief at trial. . . . . The summary provided under this subparagraph must describe the witness's opinions, the bases and reasons for those opinions, and the witness's qualifications.

In his motion to compel, Pires argued that

Brinton's proposed testimony [at his upcoming trial] amounts to expert interpretation and thus falls under the disclosure requirements of [Rule 16(a)(1)(G). In particular, he points to the government's disclosure that Brinton

may testify as to the history of [I]nternet sites visited, registry reports regarding recently used files and registered names, information regarding cookies and any viruses found on the computer as well. FE Brinton may testify as to how many searches were performed using the LimeWire software, when they were done and how many files were downloaded. In so testifying, FE Brinton will rely on his knowledge, skill, training and experience in forensic analysis of computers.

U.S. v. Pires, supra.

In ruling on this part of Pires’ motion to compel, the federal district court judge noted that Rule 16(a)(2)(G) “requires the government to provide defendant with a summary of any testimony that it intends to use under [Rules 702, 703 or 705]. . . . [which] pertain to lay or expert opinion testimony.” U.S. v. Pires, supra. In its commentary for this rule, the Advisory Committee that drafted Rule 16 explained that Rule 16(a)(2)(G) serves two purposes: By requiring that the defendant be given a summary of the expert’s anticipated testimony, it “permit[s] more complete pretrial preparation” by defense counsel. The Committee noted that the summary should inform the defendant and defense counsel “whether the expert will be providing only background information on a particular issue or whether the witness will actually offer an opinion.” Advisory Committee Note, Rule 16 of the Federal Rules of Criminal Procedure.

The other purpose is served by the requirement that the summary describe the “bases and reasons for” the opinion the expert intends to offer. Rule 16(a)(2)(GO. The Advisory Committee said the summary of the “bases and reasons” should encompass “not only written and oral reports, tests, reports, and investigations, but any information that might be recognized as a legitimate basis for an opinion” under Rule 703 of the Federal Rules of Evidence. Advisory Committee Note, Rule 16 of the Federal Rules of Criminal Procedure. In other words, this part of the rule ensures that the defense will not only learn that the expert will be offering an opinion, but will be given information from which it can evaluate the soundness of that opinion and, presumably, be able to attack the expert on cross-examination.

Pires won on this issue, as well. The federal judge held that he was entitled to the information he sought: “If, as defendant asserts, the government intends to elicit from Brinton factual information that is not recorded directly, but rather requires interpretation of or inference from some related information, then the government must provide defendant with a summary of that anticipated testimony.” U.S. v. Pires, supra.

I think the judge was right in both instances. The whole purpose of discovery (and the prosecution can seek discovery from the defendant, as well) is to try to make a trial as fair as possible (by preventing the “gotcha” tricks that used to be played, especially in criminal cases) and to make it as efficient as possible. If Pires weren’t given access to this information before trial, his lawyer might well ask the judge for an extended recess after Brinton testified so that the defense attorney and his computer expert could then prepare their cross-examination of him. This avoids the need for that.

The motion worked, but nothing else went well for Pires. As this news story notes, he went to trial and, on July 30 of this year, was convicted of attempting to receive child pornography and receiving child pornography. He apparently hasn’t been sentenced yet (though the article says sentencing was then set for October 22), but the story says he faces a minimum of 5 years in prison and up to 20 years, followed by a lifetime of supervised release. He was 24 when he was convicted.

"Fruit of the Poisonous Tree"

As Wikipedia explains, the “fruit of the poisonous tree” is “a legal metaphor in the United States used to describe evidence gathered with the aid of information obtained illegally. The logic of the terminology is that if the source of the evidence (the `tree’) is tainted, then anything gained from it (the `fruit) is as well.”

The principle dates back at least to the U.S. Supreme Court’s decision in Silverthorne Lumber Co. v. U.S., 251 U.S. 385 (1920), in which the Court said that the “essence of a provision forbidding the acquisition of evidence in a certain way is that not merely evidence so acquired shall not be used before the Court but that it shall not be used at all.”

In other words, if the government violates the 4^th Amendment in obtaining evidence, it cannot use that evidence directly (in court) or derivatively, i.e., by obtaining information it then uses to pursue charges against the person whose were violated. The Supreme Court first used the phrase “fruit of the poisonous tree” to refer to this principle in 1939, in Nardone v. United States, 308 U.S. 338. It has used the phrase ever since.

That brings us to U.S. v. Miranda, 325 Fed. Appx. 858 (U.S. Court of Appeals for the Eleventh Circuit 2009). David Miranda was convicted of possessing child pornography in violation of 18 U.S. Code § 2252A(a)(5)(B) and appealed. On appeal, he argued that “the police violated the Fourth Amendment . . . by searching his computer for information outside the scope of the warrant, which was limited to searching for evidence of counterfeit software.” U.S. v. Miranda, supra.

The opinion gives very few facts, so all I know about what happened is this:

[T]he searching officer was searching Miranda's hard drives pursuant to a warrant. In doing so, the officer had a lawful right to view each file to determine whether or not it was evidence of counterfeiting crimes. . . . The child pornography files were intermingled with counterfeiting files, so they were in plain view. Once the officer saw child pornography on Miranda's hard drives, its incriminating character was immediately apparent, so the officer could seize the files. . . . This is distinguishable from the child pornography found on Miranda's computer tower, which the district court suppressed because it was found during a search conducted solely for the purpose of finding child pornography, outside the scope of the counterfeiting warrant. For these reasons, the district court did not err in denying Miranda's motion to suppress the child pornography found on his laptop computer, external hard drive, and uninstalled hard drive.

U.S. v. Miranda, supra.

As I explained in an earlier post, the plain view doctrine is a 4^th Amendment rule that lets an officer seize evidence he runs across while he’s executing a warrant to search for evidence of a different crime. For the plain view doctrine to apply, the item the officer sees that’s outside the warrant must be in “plain view” (he can’t be searching for it) and its “incriminating character” must be apparent to him when he sees it. The latter requirement simply means that when the officer looks at the item in question, he immediately has probable cause to believe it’s evidence of a crime. For more on that, please see my prior post.

So here, the court says, the officer was executing a warrant that let him search for child pornography and, while staying within the scope of that warrant, he saw what he knew immediately was child pornography. The plain view lets the officer him seize the files; it doesn’t let him embark on a new search for child pornography, which is what his officer seems to have done. He seems to have found child pornography on Miranda’s laptop and hard drives while he was executing the warrant for the counterfeit software; as long as he was looking for counterfeit software (not child pornography) when he found the child pornography, the plain view doctrine justifies the seizure of the files he found.

It looks like that’s what happened – the officer found child pornography on the laptop and hard drives while he was looking for counterfeit software but then started looking for child pornography on the computer tower. If that’s what the officer did, then the court was correct in suppressing the evidence found on the tower; what the officer should have done at that point is to go get a warrant to search for child pornography, using the child pornography he’d already found to establish probable cause for the issuance of such a warrant.

We, though, aren’t concerned about the child pornography they found. Miranda also argued, on appeal, that

the district court erred in refusing to exclude time-stamp evidence obtained from the external hard drive and uninstalled hard drive. Specifically, he argues this evidence was `fruit of the poisonous tree’ because the information originated from the computer tower's internal timing mechanism, and evidence pertaining to the computer tower was suppressed by the district court.

U.S. v. Miranda, supra. As I understand it, Miranda is claiming the officer searched the computer tower because he was looking for child pornography, which made that an illegal search in violation of the 4^th Amendment. He seems to be extrapolating from that; Miranda seems to be saying that since the search of the computer tower violated the 4^th Amendment because it was not authorized by the officer’s warrant or by any exception to the warrant requirement, the government shouldn’t be allowed to use any evidence obtained from or derived from the tower.

The Court of Appeals began its analysis of Miranda’s argument by outlining the applicable law:

In addition to the illegally obtained evidence, a court may suppress incriminating evidence that was derived from that primary evidence as `fruit of the poisonous tree.’ . . . When determining whether evidence is `fruit of the poisonous tree’ and therefore must be excluded, the relevant question is `whether, granting establishment of the primary illegality, the evidence to which instant objection is made has been come at by exploitation of that illegality or instead by means sufficiently distinguishable to be purged of the primary taint.’ Wong Sun v. United States, 371 U.S. 471 (1963). The government can establish that evidence has been `purged of the primary taint’ by showing that the evidence was discovered from an independent source, would have been discovered inevitably by lawful means, or was so attenuated from the illegality `as to dissipate the taint’ of the unlawful conduct. . . . Under the `independent source’ doctrine, the challenged evidence is admissible if it was obtained from a lawful source, independent of the illegal conduct.

U.S. v. Miranda, supra.

The Court of Appeals then upheld the federal district court judge’s refusal to suppress the time-stamp evidence:

[T]he district court granted Miranda's motion to suppress child pornography found on his computer tower but declined to suppress the actual computer tower, as it was lawfully seized pursuant to a search warrant. The time-stamp evidence was unrelated to the suppressed child pornography because it was derived from the internal timing mechanism in the computer tower, a lawful source. For these reasons, the district court did not err by denying Miranda's motion to suppress the time-stamp evidence.

U.S. v. Miranda, supra.

That sounds like it makes sense, but not being an expert on computer technology, I can’t really assess whether it’s the correct result or not. And this is the only reported case I can find in which a motion to suppress time-stamp evidence comes up, so I can’t put this decision in context by comparing it to how other courts dealt with the same issue.