United States District Court, D. New Hampshire
OPINION AND ORDER
Joseph
N. Laplante United States District Judge.
In
advance of a trial on one count of possession of child
pornography, see 18 U.S.C. § 2252(a)(4)(B), defendant
David Morel Jr. filed a series of motions to suppress
evidence. These motions turn on whether he had a reasonable
expectation of privacy in images uploaded to the Internet and
whether probable cause supported a warrant to search a
computer for child pornography when the affiant police
detective failed to attach known images of apparent child
pornography to the warrant application.
By his
first motion, Morel asked the court to suppress images of
child pornography obtained from his computer and statements
he made during a custodial interrogation, arguing that this
evidence was obtained as the result of a warrantless search
conducted by Imgur, a corporation, acting at the instigation
of the National Center for Missing and Exploited Children
(NCMEC).[1] By his second motion, Morel sought to
suppress the images obtained from his computer because, he
argues, it was searched pursuant to a
constitutionally-deficient warrant.[2] Morel also filed a third
motion, seeking to suppress evidence obtained from what he
contended was an unconstitutional warrantless
arrest.[3]
After
two evidentiary hearings, one on Morel's first motion to
suppress and the other on Morel's second and third
motions, the court denied all three motions.[4] Morel
subsequently conditionally pleaded guilty to one count of
possessing child pornography in violation of 18 U.S.C. §
2252(a)(4)(B), reserving the right to appeal the court's
orders denying his first and second motions.[5] See Fed. R. Crim.
P. 11(a)(2). This order serves to set forth the bases for the
court's denial of those two motions in greater detail.
See, e.g., United States v. Joubert, 980 F.Supp.2d
53, 55 n.1 (D.N.H. 2014), aff'd, 778 F.3d 247 (1st Cir.
2015) (citing In re Mosley, 494 F.3d 1320, 1328 (11th Cir.
2007) (noting a district court's authority to later
reduce its prior oral findings and rulings to writing).
As
explained below, Morel vigorously argues that Imgur reviewed
his uploaded images at the behest of NECMEC and, thus, that
Imgur's review amounted to a warrantless governmental
search. Because Morel fails to establish that he possessed a
reasonable expectation of privacy in the uploaded images, the
court need not reach that question. The images, uploaded to
the Internet, were not only accessible to but actually
accessed by an anonymous tipster and NCMEC, strongly
suggesting that Morel lacked any such expectation. As to his
second motion, though the affiant failed to follow the
“best practice” of attaching the known images of
alleged child pornography to his affidavit in support of a
warrant, his affidavit did not run afoul of the requirement
that a judicial officer, not the investigating officer, make
the probable cause determination because he sufficiently
described the manner in which the images met the statutory
requirements for child pornography. Accordingly, the court
denied both motions.
I.
Background
The
court makes the following findings of fact based on the
testimony and other evidence received at the suppression
hearings.
A.
NCMEC CyberTipline report
The
National Center for Missing and Exploited Children (NCMEC) is
a non-profit organization that works to reunite missing
children with their families, reduce child sexual
exploitation, and prevent child victimization. See 42 U.S.C.
§ 5771. To further that mission, NCMEC hosts a
CyberTipline --a website through which members of the public,
law enforcement officials, and others can report child
exploitation and child pornography by filling out a form on
that website. Id. § 5773(b)(1). The law
obligates electronic service providers (ESPs) that
“obtain[] actual knowledge of” child pornography
to report that fact to NCMEC through the CyberTipline. 18
U.S.C. § 2258A(a). Knowing and willful failure to do so
is may be punished by a fine. Id. § 2258A(e).
Upon receiving such a report, NCMEC must forward it to an
appropriate federal law enforcement agency, and may forward
it to an appropriate state or foreign law enforcement agency.
Id. § 2258A(c).
The
CyberTipline's online form contains several fields. While
an individual or ESP reporting an instance of child
pornography may fill out many or all of the fields available,
including contact information, only two fields are required:
the date and time of the incident, and the substance of the
report. An individual making a report can provide the web
address of any files containing child pornography; he or she
cannot, however, upload the image files. ESPs, on the other
hand, can upload and attach images to those reports.
Irrespective of how many or which fields someone making a
report fills out, NCMEC automatically captures the date and
time that a report is submitted, as well as the IP address of
the computer from which it was submitted.
On
November 23, 2013, an unidentified individual reported
instances of child pornography through the CyberTipline
(report number 2195842), including a list of URLs of websites
or images appearing to depict child
pornography.[6] This person provided no identifying
information, but the CyberTipline captured his or her IP
address and, via an automated process, populated the location
associated with that IP address into the report. NCMEC's
staff analysts then visited several of the reported URLs and
annotated the report, indicating whether the visited URLs
appeared to contain child pornography. In this report, one of
the URLs led to a gallery of images hosted by an
image-hosting service called Imgur.[7] The analyst obtained the
URLs of specific images in the gallery that appeared to
contain child pornography without clicking on the links
thereto, and copied those URLs into the report.[8]
Once a
day, NCMEC sends automated notices to ESPs summarizing
instances of apparent child pornography reported from or
found on their websites that day. On November 26, 2013, NCMEC
sent such a notice to Imgur, indicating that images found at
Imgur URLs appeared to contain child pornography, including
images identified in report number 2195842.[9] In this notice,
NCMEC asked Imgur to “[p]lease review the reported URL
to determine if it contains content that violates federal
and/or state law or your Terms of Service or Member Services
Agreement.”[10]
NCMEC
neither require ESPs to notify NCMEC whether they take action
after receiving such a notice nor follows up with ESPs to see
if they have done so. Nor does NCMEC instruct ESPs to report
apparent child pornography found on such URLs. In this case,
however, consistent with federal law, see 18 U.S.C. §
2258A(a), and with its own terms of service, [11] after
receiving this notice, on November 26, 2013, Imgur filed
three reports through the CyberTipline. These reports
indicated that some of the URLs noted by NCMEC contained
apparent child pornography (report nos. 2202631, 2202632, and
2202634).[12] As an ESP, Imgur was able to -- and did
-- attach copies of the images to the reports. Imgur also
provided the IP address of the computer from which the images
were uploaded to Imgur's servers, [13] which was the
same for all three images, as well as the date and time each
image was uploaded. Using a publicly-available website, NCMEC
associated that IP address with a Comcast Cable subscriber in
Derry, New Hampshire.[14] Imgur then deleted the images from
its server. On December 6, 2013, Imgur submitted three
additional reports of apparent child pornography associated
with the same IP address to NCMEC through the CyberTipline
(report nos. 2217212, 2217316, and 2217317).[15]
Relying
on Imgur's reports that the images contained apparent
child pornography NCMEC notified and made Imgur's reports
available to the New Hampshire Internet Crimes Against
Children (ICAC) task force, which forwarded the reports to
the Derry, Hew Hampshire police department.
B.
Investigation
After
receiving the six reports, Detective Kennedy Richard of the
Derry Police Department reviewed the images attached thereto
and characterized them as appearing to contain child
pornography. He obtained a subpoena for Comcast's
information concerning the owner of the identified IP
address. On February 14, 2014, Comcast notified Det. Richard
that the IP address in question belonged to a David Morel at
an address on Pingree Hill Road in Derry, New Hampshire.
In the
meantime, on February 1, 2014, defendant Morel reported that
his laptop computer was stolen during a burglary from the
loft above the garage at his parents' house at that
address. The Derry Police Department recovered that computer
and other stolen property a week later. During a visit to the
police department, Morel identified the recovered computer as
the one he had reported stolen. The computer remained in the
police department's custody as evidence of the burglary.
Det.
Richard subsequently spoke with the defendant's father,
David Morel Sr., [16] who confirmed that defendant Morel lived
at the Pingree Hill Road address in November, 2013, at the
time the images were uploaded. David Morel Sr. also disavowed
using the email address associated with the Comcast account
connected to the identified IP address, and said he believed
it was used by his son.
On
April 16, 2014, Det. Richard obtained a warrant to search
Morel's laptop computer that was in the police
department's custody. In the affidavit supporting his
application for the warrant, he described the six images
attached to the NCMEC reports.[17] He described three of the
images as depicting females “believed to be” or
who “appear[] to be under the age of
10.”[18] The other three images depicted females
“believed to be under the age of
13.”[19] Though he described the apparently
sexual nature of the photographs, he did not, in this
application, physically describe the girls other than to
state his belief that they were under the ages of 10 and 13.
Pursuant
to the warrant issued on April 16, Det. Richard had a
forensic copy made of Morel's computer's hard drive.
He reviewed the contents of the hard drive a few days later
and saw what he estimated to be approximately 200 videos and
images depicting child pornography.
On
April 28, 2014, Morel was arrested on the charge of Attempted
Possession of Child Sexual Abuse Images.[20]Det. Richard
interviewed Morel at the Derry Police Department where, after
receiving customary Miranda warnings and waiving his Fifth
Amendment rights, Morel admitted to possessing child
pornography on his computer.[21] After the court denied his
motions to suppress both the contents of his hard drive and
his statement, Morel pled guilty to one count of possession
of child pornography.
II.
Analysis
Morel
moves to suppress evidence of child pornography images
obtained during a search of his computer's hard drive. In
his first motion, he argues that the government would not
have obtained this evidence -- as well as his confession,
which he also seeks to suppress -- but for a warrantless
search by Imgur of the images uploaded to Imgur from his IP
address. In his second motion, Morel argues that probable
cause did not support the April 16, 2014 warrant pursuant to
which Det. Richard searched his computer's hard drive
because Det. Richard's affidavit did not describe the
images in such a way as to allow the issuing magistrate to
conclude that the images met the statutory definition of
child pornography. The court addresses each motion in turn.
A.
First motion to suppress
The
Fourth Amendment protects from violation the “right of
the people to be secure in their persons, houses, papers and
effects, against unreasonable searches and seizures.”
U.S. Const. amend. IV. “A search within the meaning of
the Fourth Amendment ‘occurs when the government
violates a subjective expectation of privacy that society
recognizes as reasonable.'” United States v.
D'Andrea, 648 F.3d 1, 5-6 (1st Cir. 2011) (quoting
Kyllo v. United States, 533 U.S. 27, 33 (2001)). To
determine whether an individual has a reasonable expectation
of privacy in the place searched, the court asks, first,
“whether the individual, by his conduct, has exhibited
an actual (subjective) expectation of privacy, ” and
second, “whether the individual's subjective
expectation of privacy is one that society is prepared to
recognize as reasonable.” Smith v. Maryland,
442 U.S. 735, 740 (1979) (internal quotations and citations
omitted). Just as the defendant “has the burden of
establishing that his own Fourth Amendment rights were
violated by the challenged search or seizure, ” he also
bears the “threshold burden . . . to prove that he had
a legitimate expectation of privacy in ‘the place
searched or the thing seized.'” United States
v. Rheault, 561 F.3d 55, 58-59 (1st Cir. 2009) (internal
quotations and citations omitted). Only after the defendant
demonstrates a reasonable expectation of privacy does the
court determine whether a governmental search violated that
expectation.
Morel's
arguments in support of his first motion to suppress have
evolved over the course of several rounds of briefing,
presenting a moving target for the prosecution and the
court.[22] At the end of the day, that argument can
be reduced to three points: (1) Morel had a reasonable
expectation of privacy in images uploaded to Imgur's
server and in the IP address from which those images were
uploaded; (2) Imgur's review of those images and
reporting of them and his IP address to NCMEC constituted a
search that violated that expectation of privacy; and (3)
that search amounted to a governmental search because Imgur,
though not a governmental entity itself, conducted it at the
request of NCMEC. Because the court concludes that Morel
lacked a reasonable expectation of privacy in the images that
he uploaded to Imgur's servers and the IP address from
which he uploaded them, the court need not reach the latter
two questions.[23]
1.
Images uploaded to Imgur
An
individual may have an expectation of privacy in certain
information conveyed over the Internet, even though that
information is stored on a third party's server, as the
images were here. For example, acknowledging that individuals
have a certain privacy interest in the content of emails,
Congress, through the Electronic Communications Privacy Act
(“ECPA”), barred ESPs from disclosing information
about a customer's electronic communications to the
government without a court order, warrant, or the
customer's consent.[24] See 18 U.S.C. §§ 2702,
2703. Courts have similarly acknowledged such privacy
interests, analogizing emails in the hands of a service
provider to unopened packages in the hands of a common
carrier like Federal Express or UPS. E.g., United States
v. Warshak, 631 F.3d 266, 288 (6th Cir. 2010) (holding
in the Fourth Amendment context that “a subscriber
enjoys a reasonable expectation of privacy in the contents of
emails that are stored with, or sent or received through, a
commercial ISP”); see also Keith, 980 F.Supp.2d at
39-40 (analogizing the content of emails to the contents of a
conversation held over a telephone line or a sealed
envelope).
Morel's
emails are not implicated here.[25] He argues, rather, that
the same principles protecting emails apply to images
uploaded to Imgur's servers and the IP address from which
he uploaded them.[26] But that analogy does not hold. Here,
the evidence suggests that any images uploaded to Imgur's
servers were publicly available. As Imgur's
representative testified, there is no way to render an image
entirely private on Imgur. At best, a user can decline to
share the image's URL, thus not affirmatively inviting
others to view the ...