Opinion
No. CR-17-01311-001-PHX-DGC
05-10-2019
United States of America, Plaintiff, v. Anthony Espinoza Gonzales, Defendant.
ORDER
Defendant Anthony Espinoza Gonzales is charged with distributing and possessing child pornography in violation of 18 U.S.C. § 2252(a). Doc. 1. On February 19, 2019, the Court granted in part his motion to compel disclosure of the Torrential Downpour software program the FBI used in the investigation that led to his indictment. Docs. 25, 51. He has now filed a motion to compel compliance with that order, to which the government has responded. Docs. 54, 55. The Court will require supplemental briefing on certain issues.
I. The Court's Prior Order.
Defendant's computer forensics expert, Tami Loehrs, testified at the evidentiary hearing in support of Defendant's motion to compel. See Docs. 41, 50. FBI Agent Jimmie Daniels testified for the government. See id. Based in part on Loehrs's testimony, the Court found that Torrential Downpour is material to the defense under Rule 16(a)(1)(E)(i) because the distribution charges are based on child pornography files that Torrential Downpour purportedly downloaded from Defendant's computer but that were not found on the computer when it was seized by the FBI. Doc. 51 at 8-10. The Court denied Defendant's request for a copy of Torrential Downpour under Roviaro v. United States, 353 U.S. 53 (1957), given Agent Daniels's testimony that the government's investigative efforts would be severely hampered if a copy got into the wrong hands. Id. at 14-15. But given the substantial defense interest established by Defendant, the Court concluded that Loehrs should be granted access to Torrential Downpour to assist Defendant in preparing the defense. Id. at 15. The Court adopted the Rule 16 disclosure method authorized in United States v. Crowe, No. 11 CR 1690 MV, 2013 WL 12335320, at *8 (D.N.M. Apr. 3, 2013):
The Court rejected Defendant's argument that Torrential Downpour is material to a Fourth Amendment challenge because he identified no evidence suggesting that the program accessed non-public space on his computer. Id. at 10. --------
[T]he defense expert [will be permitted] to examine the software at issue at a designated law enforcement facility, at a mutually convenient date and time, for as much time as is reasonably necessary for the expert to complete her examination. No copies of the software shall be made. The software shall not leave the custody of the law enforcement agency that controls it. Any proprietary information regarding the software that is disclosed to the defense expert shall not be reproduced, repeated or disseminated in any manner. Violation of [this] order shall subject the defense expert and/or defense counsel to potential sanctions by this Court.Id. at 15.
II. Defendant's Motion to Compel Compliance with the Court's Order.
The parties have corresponded regarding their proposed testing protocols for Torrential Downpour. Docs. 54-2, 54-3, 55-5. Based on the government's April 9, 2019 letter and the motion briefing, it appears that most issues have been resolved. The main disagreement is whether Loehrs may access the Internet Crimes Against Children Child Online Protection System ("COPS") during certain testing procedures.
Defendant claims that COPS is the "database that Torrential Downpour relies upon to identify files of 'suspected child pornography' and therefore is a critical element in testing the software." Doc. 54 at 4. In her proposed testing protocol, Loehrs describes COPS and her request for access to the system as follows:
[COPS] is a web-based component of Torrential Downpour and its operation including retrieving information about torrents of investigative interest and reporting historical data back to law enforcement for further investigation. Access to the [COPS] database will simulate law enforcement's undercover BitTorrent investigation by facilitating the same search capabilities relied upon in [this case].Doc. 54-4 at 8.
A unique login will be created by the government allowing access to the live [COPS] system in order to track and locate all information being reported by Torrential Downpour from the Suspect Computer, described below. At all times during the test, the login to [COPS] shall be monitored and controlled by the government.
To determine the accuracy and reliability of Torrential Downpour, Loehrs proposes to perform nine tests: (1) non-parsed torrents, (2) partially-parsed torrents, (3) deleted torrent data, (4) unshared torrent data, (5) non-investigative torrents, (6) files of interest, (7) single source download, (8) detailed logging, and (9) restricted sharing. Id. at 7, 12-15. The government agrees to tests seven, eight, and nine, which do not involve COPS. Docs. 54-5 at 4, 55 at 2. The government notes that these tests will be conducted to determine whether Torrential Downpour conducts a single source download, correctly logs activity, and does not share files with others on the BitTorrent network. Doc. 55 at 2 (citing Doc. 54-8 ¶ 5). According to the government, this is the "heart of [the] Court's order of the defense being allowed to test the Torrential Downpour software, i.e. the single source download[.]" Id.
Tests one through six would each conclude with a search of the COPS database for "any investigative hits on the Suspect IP Addresses and determine whether Torrential Downpour attempts to connect with the Suspect IP Address to download data." Doc. 54-4 at 12-14. The government objects to tests three and four because they would assess whether Torrential Downpour accesses non-shared and deleted spaces, an issue the Court eliminated in its prior order. Doc. 55 at 3.
Tests one and two - non-parsed torrents and partially-parsed torrents - seem relevant to whether Defendant downloaded complete torrent files containing actual child pornography. Loehrs states that test one will help determine whether Torrential Downpour "identified [Defendant] based on a torrent file only, meaning the torrent was never parsed and the files associated with that torrent were never downloaded to [Defendant's] computer." Doc. 54-8 ¶ 7. Similarly, test two will determine if Torrential Downpour "identified [Defendant] based on having a partially parsed torrent, meaning only some of the files associated with that torrent were downloaded to [his] computer. Id. ¶ 8. The government does not discuss these tests.
Loehrs wants to conduct tests five and six - non-investigative torrents and files of interest - to determine whether Torrential Downpour identified Defendant based only on torrent files of investigative interest. Id. ¶¶ 11-12. Defendant asserts that COPS "contains thousands of hash values for files that are not suspected child pornography, meaning the files are not unlawful[.]" Doc. 54 at 4. He notes that Torrential Downpour purportedly downloaded more than thirty files from his computer, only three of which were described as child pornography by Agent Daniels. Id. at 5. But Defendant does not explain how this is material to the preparation of a defense.
To facilitate tests five and six, Loehrs requests that the COPS database be cloned and moved to a unique testing location on the server. Doc. 54-4 at 10. The new database would then be loaded with predefined lawful torrents known to be on the suspect computer, and Torrential Downpour would be directed to pull information from this "test database" and identify lawful files. Id. Loehrs claims that a test database should be used to avoid further dissemination of child pornography. Id. The government asserts that cloning and moving the COPS database, and building a separate database from which to do testing, would require a massive expenditure of resources. Doc. 55 at 4; see Doc. 54-5 at 3. The actual resources are not specified.
The government objects to tests one through six, arguing that COPS must be protected from disclosure. Doc. 55 at 3-4. The government asserts that public exposure of COPS could compromise child exploitation investigations worldwide because disclosure of the torrents being investigated by law enforcement would enable child pornography offenders to evade law enforcement detection and destroy evidence to thwart further investigation. Id. But the government presents no evidence in support of this assertion. Nor does the government explain how Loehrs's proposed limited access to COPS, in a restrictive environment monitored by the FBI, would result in public disclosure of COPS.
The Court denied Defendant's request for an independent copy of Torrential Downpour based on Agent Daniels's testimony that the program must remain in law enforcement custody at all times to avoid the risk of disclosure to unauthorized third-parties. Doc. 51 at 14 (citing Doc. 50 at 126-28). Agent Daniels made clear, however, that Loehrs's testing of the program at an FBI facility would pose no security risk. Doc. 50 at 156-157. The Court therefore granted Loehrs access to Torrential Downpour under the conditions set forth above. See Doc. 51 at 15.
III. Supplemental Briefs.
The Court starts a three-week jury trial on Monday and no has time for a hearing before July. Additional briefing will refine the issues and assist the Court in deciding Defendant's motion. The parties shall, by May 31, 2019, file supplemental briefs addressing the issues described below with supporting affidavit testimony as necessary.
A. Defendant's Brief.
Defendant shall address the following questions in his supplemental brief:
1. Given the Court's finding that Torrential Downpour is not material to any Fourth Amendment challenge (Doc. 51 at 10), why are tests three and four - deleted torrent data and unshared torrent data - appropriate?
2. Why is access to COPS necessary to conduct tests one through six?
3. How are tests five and six - non-investigative torrents and files of interest -material to the preparation of a defense?
4. Assuming tests five and six are not allowed, does the COPS database still need to be cloned and moved to a separate server?
5. To the extent a separate test database is necessary, does the entire COPS database need to be cloned or would a smaller or simulated database suffice?
6. Will the government's proposal to have an FBI agent load lawful torrent files into Torrential Downpour (see Doc. 54-5 at 4) work for testing purposes?
7. Would Defendant object to a protective order governing Loehrs's access to COPS similar to the one issued with respect to Torrential Downpour?
B. Government's Brief.
The government shall address the following questions in its supplemental brief:
1. Why are tests one and two - non-parsed torrents and partially-parsed torrents - not material to the defense?
2. How is access to COPS not necessary to conduct tests one through six?
3. To the extent COPS is material to the defense, why would the Roviaro privilege not give way as it did for Torrential Downpour? Why would a protective order not suffice?
4. What specific resources would be needed to clone and move the COPS database to a separate server? Is it feasible to clone and move only a portion of the database or to create a simulated database?
IT IS ORDERED that the parties shall file supplemental briefs by May 31, 2019.
Dated this 10th day of May, 2019.
/s/_________
David G. Campbell
Senior United States District Judge