United States v. Morel

          OPINION AND ORDER

          Joseph N. Laplante United States District Judge.

         In advance of a trial on one count of possession of child pornography, see 18 U.S.C. § 2252(a)(4)(B), defendant David Morel Jr. filed a series of motions to suppress evidence. These motions turn on whether he had a reasonable expectation of privacy in images uploaded to the Internet and whether probable cause supported a warrant to search a computer for child pornography when the affiant police detective failed to attach known images of apparent child pornography to the warrant application.

         By his first motion, Morel asked the court to suppress images of child pornography obtained from his computer and statements he made during a custodial interrogation, arguing that this evidence was obtained as the result of a warrantless search conducted by Imgur, a corporation, acting at the instigation of the National Center for Missing and Exploited Children (NCMEC).^[1] By his second motion, Morel sought to suppress the images obtained from his computer because, he argues, it was searched pursuant to a constitutionally-deficient warrant.^[2] Morel also filed a third motion, seeking to suppress evidence obtained from what he contended was an unconstitutional warrantless arrest.^[3]

         After two evidentiary hearings, one on Morel's first motion to suppress and the other on Morel's second and third motions, the court denied all three motions.^[4] Morel subsequently conditionally pleaded guilty to one count of possessing child pornography in violation of 18 U.S.C. § 2252(a)(4)(B), reserving the right to appeal the court's orders denying his first and second motions.^[5] See Fed. R. Crim. P. 11(a)(2). This order serves to set forth the bases for the court's denial of those two motions in greater detail. See, e.g., United States v. Joubert, 980 F.Supp.2d 53, 55 n.1 (D.N.H. 2014), aff'd, 778 F.3d 247 (1st Cir. 2015) (citing In re Mosley, 494 F.3d 1320, 1328 (11th Cir. 2007) (noting a district court's authority to later reduce its prior oral findings and rulings to writing).

         As explained below, Morel vigorously argues that Imgur reviewed his uploaded images at the behest of NECMEC and, thus, that Imgur's review amounted to a warrantless governmental search. Because Morel fails to establish that he possessed a reasonable expectation of privacy in the uploaded images, the court need not reach that question. The images, uploaded to the Internet, were not only accessible to but actually accessed by an anonymous tipster and NCMEC, strongly suggesting that Morel lacked any such expectation. As to his second motion, though the affiant failed to follow the “best practice” of attaching the known images of alleged child pornography to his affidavit in support of a warrant, his affidavit did not run afoul of the requirement that a judicial officer, not the investigating officer, make the probable cause determination because he sufficiently described the manner in which the images met the statutory requirements for child pornography. Accordingly, the court denied both motions.

         I. Background

         The court makes the following findings of fact based on the testimony and other evidence received at the suppression hearings.

         A. NCMEC CyberTipline report

         The National Center for Missing and Exploited Children (NCMEC) is a non-profit organization that works to reunite missing children with their families, reduce child sexual exploitation, and prevent child victimization. See 42 U.S.C. § 5771. To further that mission, NCMEC hosts a CyberTipline --a website through which members of the public, law enforcement officials, and others can report child exploitation and child pornography by filling out a form on that website. Id. § 5773(b)(1). The law obligates electronic service providers (ESPs) that “obtain[] actual knowledge of” child pornography to report that fact to NCMEC through the CyberTipline. 18 U.S.C. § 2258A(a). Knowing and willful failure to do so is may be punished by a fine. Id. § 2258A(e). Upon receiving such a report, NCMEC must forward it to an appropriate federal law enforcement agency, and may forward it to an appropriate state or foreign law enforcement agency. Id. § 2258A(c).

         The CyberTipline's online form contains several fields. While an individual or ESP reporting an instance of child pornography may fill out many or all of the fields available, including contact information, only two fields are required: the date and time of the incident, and the substance of the report. An individual making a report can provide the web address of any files containing child pornography; he or she cannot, however, upload the image files. ESPs, on the other hand, can upload and attach images to those reports. Irrespective of how many or which fields someone making a report fills out, NCMEC automatically captures the date and time that a report is submitted, as well as the IP address of the computer from which it was submitted.

         On November 23, 2013, an unidentified individual reported instances of child pornography through the CyberTipline (report number 2195842), including a list of URLs of websites or images appearing to depict child pornography.^[6] This person provided no identifying information, but the CyberTipline captured his or her IP address and, via an automated process, populated the location associated with that IP address into the report. NCMEC's staff analysts then visited several of the reported URLs and annotated the report, indicating whether the visited URLs appeared to contain child pornography. In this report, one of the URLs led to a gallery of images hosted by an image-hosting service called Imgur.^[7] The analyst obtained the URLs of specific images in the gallery that appeared to contain child pornography without clicking on the links thereto, and copied those URLs into the report.^[8]

         Once a day, NCMEC sends automated notices to ESPs summarizing instances of apparent child pornography reported from or found on their websites that day. On November 26, 2013, NCMEC sent such a notice to Imgur, indicating that images found at Imgur URLs appeared to contain child pornography, including images identified in report number 2195842.^[9] In this notice, NCMEC asked Imgur to “[p]lease review the reported URL to determine if it contains content that violates federal and/or state law or your Terms of Service or Member Services Agreement.”^[10]

         NCMEC neither require ESPs to notify NCMEC whether they take action after receiving such a notice nor follows up with ESPs to see if they have done so. Nor does NCMEC instruct ESPs to report apparent child pornography found on such URLs. In this case, however, consistent with federal law, see 18 U.S.C. § 2258A(a), and with its own terms of service, ^[11] after receiving this notice, on November 26, 2013, Imgur filed three reports through the CyberTipline. These reports indicated that some of the URLs noted by NCMEC contained apparent child pornography (report nos. 2202631, 2202632, and 2202634).^[12] As an ESP, Imgur was able to -- and did -- attach copies of the images to the reports. Imgur also provided the IP address of the computer from which the images were uploaded to Imgur's servers, ^[13] which was the same for all three images, as well as the date and time each image was uploaded. Using a publicly-available website, NCMEC associated that IP address with a Comcast Cable subscriber in Derry, New Hampshire.^[14] Imgur then deleted the images from its server. On December 6, 2013, Imgur submitted three additional reports of apparent child pornography associated with the same IP address to NCMEC through the CyberTipline (report nos. 2217212, 2217316, and 2217317).^[15]

         Relying on Imgur's reports that the images contained apparent child pornography NCMEC notified and made Imgur's reports available to the New Hampshire Internet Crimes Against Children (ICAC) task force, which forwarded the reports to the Derry, Hew Hampshire police department.

         B. Investigation

         After receiving the six reports, Detective Kennedy Richard of the Derry Police Department reviewed the images attached thereto and characterized them as appearing to contain child pornography. He obtained a subpoena for Comcast's information concerning the owner of the identified IP address. On February 14, 2014, Comcast notified Det. Richard that the IP address in question belonged to a David Morel at an address on Pingree Hill Road in Derry, New Hampshire.

         In the meantime, on February 1, 2014, defendant Morel reported that his laptop computer was stolen during a burglary from the loft above the garage at his parents' house at that address. The Derry Police Department recovered that computer and other stolen property a week later. During a visit to the police department, Morel identified the recovered computer as the one he had reported stolen. The computer remained in the police department's custody as evidence of the burglary.

         Det. Richard subsequently spoke with the defendant's father, David Morel Sr., ^[16] who confirmed that defendant Morel lived at the Pingree Hill Road address in November, 2013, at the time the images were uploaded. David Morel Sr. also disavowed using the email address associated with the Comcast account connected to the identified IP address, and said he believed it was used by his son.

         On April 16, 2014, Det. Richard obtained a warrant to search Morel's laptop computer that was in the police department's custody. In the affidavit supporting his application for the warrant, he described the six images attached to the NCMEC reports.^[17] He described three of the images as depicting females “believed to be” or who “appear[] to be under the age of 10.”^[18] The other three images depicted females “believed to be under the age of 13.”^[19] Though he described the apparently sexual nature of the photographs, he did not, in this application, physically describe the girls other than to state his belief that they were under the ages of 10 and 13.

         Pursuant to the warrant issued on April 16, Det. Richard had a forensic copy made of Morel's computer's hard drive. He reviewed the contents of the hard drive a few days later and saw what he estimated to be approximately 200 videos and images depicting child pornography.

         On April 28, 2014, Morel was arrested on the charge of Attempted Possession of Child Sexual Abuse Images.^[20]Det. Richard interviewed Morel at the Derry Police Department where, after receiving customary Miranda warnings and waiving his Fifth Amendment rights, Morel admitted to possessing child pornography on his computer.^[21] After the court denied his motions to suppress both the contents of his hard drive and his statement, Morel pled guilty to one count of possession of child pornography.

         II. Analysis

         Morel moves to suppress evidence of child pornography images obtained during a search of his computer's hard drive. In his first motion, he argues that the government would not have obtained this evidence -- as well as his confession, which he also seeks to suppress -- but for a warrantless search by Imgur of the images uploaded to Imgur from his IP address. In his second motion, Morel argues that probable cause did not support the April 16, 2014 warrant pursuant to which Det. Richard searched his computer's hard drive because Det. Richard's affidavit did not describe the images in such a way as to allow the issuing magistrate to conclude that the images met the statutory definition of child pornography. The court addresses each motion in turn.

         A. First motion to suppress

         The Fourth Amendment protects from violation the “right of the people to be secure in their persons, houses, papers and effects, against unreasonable searches and seizures.” U.S. Const. amend. IV. “A search within the meaning of the Fourth Amendment ‘occurs when the government violates a subjective expectation of privacy that society recognizes as reasonable.'” United States v. D'Andrea, 648 F.3d 1, 5-6 (1st Cir. 2011) (quoting Kyllo v. United States, 533 U.S. 27, 33 (2001)). To determine whether an individual has a reasonable expectation of privacy in the place searched, the court asks, first, “whether the individual, by his conduct, has exhibited an actual (subjective) expectation of privacy, ” and second, “whether the individual's subjective expectation of privacy is one that society is prepared to recognize as reasonable.” Smith v. Maryland, 442 U.S. 735, 740 (1979) (internal quotations and citations omitted). Just as the defendant “has the burden of establishing that his own Fourth Amendment rights were violated by the challenged search or seizure, ” he also bears the “threshold burden . . . to prove that he had a legitimate expectation of privacy in ‘the place searched or the thing seized.'” United States v. Rheault, 561 F.3d 55, 58-59 (1st Cir. 2009) (internal quotations and citations omitted). Only after the defendant demonstrates a reasonable expectation of privacy does the court determine whether a governmental search violated that expectation.

         Morel's arguments in support of his first motion to suppress have evolved over the course of several rounds of briefing, presenting a moving target for the prosecution and the court.^[22] At the end of the day, that argument can be reduced to three points: (1) Morel had a reasonable expectation of privacy in images uploaded to Imgur's server and in the IP address from which those images were uploaded; (2) Imgur's review of those images and reporting of them and his IP address to NCMEC constituted a search that violated that expectation of privacy; and (3) that search amounted to a governmental search because Imgur, though not a governmental entity itself, conducted it at the request of NCMEC. Because the court concludes that Morel lacked a reasonable expectation of privacy in the images that he uploaded to Imgur's servers and the IP address from which he uploaded them, the court need not reach the latter two questions.^[23]

         1. Images uploaded to Imgur

         An individual may have an expectation of privacy in certain information conveyed over the Internet, even though that information is stored on a third party's server, as the images were here. For example, acknowledging that individuals have a certain privacy interest in the content of emails, Congress, through the Electronic Communications Privacy Act (“ECPA”), barred ESPs from disclosing information about a customer's electronic communications to the government without a court order, warrant, or the customer's consent.^[24] See 18 U.S.C. §§ 2702, 2703. Courts have similarly acknowledged such privacy interests, analogizing emails in the hands of a service provider to unopened packages in the hands of a common carrier like Federal Express or UPS. E.g., United States v. Warshak, 631 F.3d 266, 288 (6th Cir. 2010) (holding in the Fourth Amendment context that “a subscriber enjoys a reasonable expectation of privacy in the contents of emails that are stored with, or sent or received through, a commercial ISP”); see also Keith, 980 F.Supp.2d at 39-40 (analogizing the content of emails to the contents of a conversation held over a telephone line or a sealed envelope).

         Morel's emails are not implicated here.^[25] He argues, rather, that the same principles protecting emails apply to images uploaded to Imgur's servers and the IP address from which he uploaded them.^[26] But that analogy does not hold. Here, the evidence suggests that any images uploaded to Imgur's servers were publicly available. As Imgur's representative testified, there is no way to render an image entirely private on Imgur. At best, a user can decline to share the image's URL, thus not affirmatively inviting others to view the ...