Opinion
19-cr-00039-CRB-1
03-02-2023
United States, Plaintiff, v. Wesley Steven Bohannon, Defendant.
ORDER MAKING ADDITIONAL FINDINGS
CHARLES R. BREYER, DISTRICT JUDGE
This order arises from a limited remand issued by the Ninth Circuit regarding Bohannon's appeal of this Court's denial of his motion to suppress. See Remand Order (dkt. 139). This Court's initial order, issued in December 2020, denied Bohannon's motion, because Microsoft was not acting as a government entity or agent during its initial search of his OneDrive account, and neither the National Center for Missing & Exploited Children (“NCMEC”) nor the government further intruded on Bohannon's privacy. See United States v. Bohannon, 506 F.Supp.3d 907 (N.D. Cal. 2020). As to whether an employee at Microsoft viewed the image at issue before it forwarded the image to NCMEC, the Court held that it “need not resolve whether someone at Microsoft opened and looked at the image file in [Bohannon's] OneDrive account” because even if Microsoft “examined only the ‘associated hash' before passing the document on to NCMEC, . . . examining the hash values to locate a known compared image is equivalent to examining the image itself.” Id. at 916.
After his conditional plea and sentencing, Bohannon appealed the Court's judgment, including the order on his motion to suppress. In the interim, the Ninth Circuit decided United States v. Wilson, 13 F.4th 961 (9th Cir. 2021), which held that “an antecedent private search excuses the government from obtaining a warrant to repeat the search but only when the government search does not exceed the scope of the private one.” Id. at 968; see also Remand Order at 1. In the context of a private search of a defendant's Google account in a similar context, Wilson noted that “[t]he critical fact is that no Google employee viewed Wilson's files before [the government] did,” and thus “[w]hen the government views anything other than the specific materials that a private party saw during the course of a private search, the government search exceeds the scope of the private search.” Wilson, 13 F.4th at 974. Accordingly, the Ninth Circuit has issued an order remanding Bohannon's case back to this Court for the limited purpose of “mak[ing] additional findings and to determine whether a Microsoft employee viewed the contents of Bohannon's OneDrive file before the file was forwarded to NCMEC.” Remand Order at 3.
The Court finds that a Microsoft employee reviewed the image at issue in Bohannon's OneDrive file before the file was forwarded to NCMEC. The CyberTip report Microsoft submitted to NCMEC includes an answer to the question, “Did Reporting ESP view entire contents of uploaded file?” Microsoft responded, “Yes.” See CyberTip Report (dkt. 64-1) at WSB-192. Two declarations submitted along with the government's opposition, from John Shehan, Vice President of the Exploited Children Division at NCMEC, and Sean Davis, Head of Digital Safety Operations at Microsoft, confirm that “someone at Microsoft reviewed the image at issue before it was transmitted to NCMEC,” and that NCMEC understood that, by responding “Yes” to the above question on the CyberTip report, Microsoft had “indicat[ed] that [it] has viewed the contents of that file before reporting it to NCMEC.” Davis Decl. (dkt. 71-2) ¶ 15; Shehan Affidavit (dkt. 71-1) ¶¶ 21-22. By contrast, in support of his motion, Bohannon offers no evidence that the CyberTip Report and Shehan and Davis's testimony does not mean what it says: That Microsoft reviewed the contents of the actual file at issue, and not just the associated hash, before the file was forwarded to NCMEC, and then to law enforcement. The Court therefore finds that Microsoft viewed the contents of the file before it was forwarded to NCMEC.
In his reply to his motion to suppress, Bohannon argued that Microsoft's “carefully worded declaration” reveals that “in fact a Microsoft employee reviewed a duplicate or derivative image sometime in the past when populating the hash database.” Reply (dkt. 76) at 14. This conclusion is unsupported by evidence, and unsupported by the declaration itself: While Davis does not state precisely when the image was reviewed by a Microsoft employee, he states that “the image at issue”-not a hash, and not a derivative, associated, or duplicate image-was reviewed by a Microsoft employee before the image was transmitted to NCMEC. Davis Deci. ¶ 15.
IT IS SO ORDERED.