Opinion
Case No. 3:16-cr-00105-AA-1
03-22-2018
UNITED STATES OF AMERICA, Plaintiff, v. ROBERT EVANS MAHLER, Defendant.
OPINION AND ORDER
:
In February 2016, defendant Robert Evans Mahler was indicted on one count of being a felon in possession of a firearm, in violation of 18 U.S.C. § 922(g)(1). On December 7, 2017, defendant filed a set of four pretrial motions: a motion in limine (doc. 88), a motion for recusal (doc. 90), a motion to suppress (doc. 93), and a motion to dismiss for outrageous government conduct (doc. 95), I previously denied the motions in limine and for recusal. At a March 12, 2018 hearing, I orally denied the motions to suppress and to dismiss. This opinion and order explains in greater detail the reasons for that denial.
BACKGROUND
Defendant's motions to suppress and to dismiss rest on the same underlying factual allegation: he contends that an agent of the Bureau of Alcohol, Tobacco and Firearms ("ATF") entered his home and searched his property without a warrant on January 25, 2016. The evidentiary basis of that contention is a set of still images, taken by a motion-activated trail camera mounted on defendant's back porch, which show an individual entering the back door of defendant's home. The individual is dressed in clothing that covers him or her from head to toe. No facial features are visible, and it appears that the individual may have a mask or some other item covering his or her face. The back of the individual's shirt or jacket appears to have the letters "ATF" stamped on it. The images are marked with the date 01/25/2016 and times between 12:23AM and 12:37AM. In some of the images, the individual is carrying items; government witnesses identified those items as a rifle case and an ammunition belt. The parties' dispute with respect to the suppression and dismissal motions centers entirely on whether those images are sufficient proof that there was an unauthorized ATF search of defendant's home on January 25.
The government's first witness was Amanda Johnson, the lead ATF agent assigned to defendant's case, Agent Johnson testified that she had supervised this case since its inception on January 19, 2016; that she had no knowledge of any ATF agents entering defendant's property before February 16, 2016, at which point their entry and search was justified by a warrant; and that she specifically asked each ATF agent who had been involved in defendant's case whether he or she had entered the property prior to February 16, and they all responded "no." Agent Johnson also looked at still frames from the surveillance footage and confirmed that the images appear to have been taken on defendant's property—specifically, on his back porch. Finally, Agent Johnson testified that it is not ATF agents' practice to cover their faces during searches.
The government also called a forensic expert, Michelle Beltz. Through her testimony, Ms. Beltz defined some relevant technical terms. First, she discussed metadata. Ms. Beltz testified that metadata can provide information such as whether a digital image has been modified or saved, GPS location of the photo, information about the camera that was used, whether a flash was used, the software that wrote the image to the computer, camera setting speeds, and image name. Ms. Beltz also explained that a hash value is a "digital fingerprint," which consists of a variety of letters and numbers that give a unique identified to a file. As long as the contents of an image remain unaltered, the hash value stays the same. But if changes are made to the contents or metadata of the image, the hash value changes. Thus, the hash value can be used to see if changes have been made to still images that appear, upon visual inspection, to be identical.
The government introduced two exhibits related to Ms. Beltz's testimony: one page of handwritten notes and a twenty-two page Report of Investigation. This summary of evidence incorporates Ms. Beltz's testimony and those exhibits. --------
Ms. Beltz testified that she first reviewed an image related to this case on December 18, 2017, when she was asked, via email, to authenticate it, Ms. Beltz testified that her initial thought, based on her expertise and experience, was that the image did not "look right." She noted that the photo was similar to infrared images she has seen in the past, but that the tint (purple) was different from typical infrared images. Ms. Beltz testified that the metadata from the image she received by email showed that the image had been manipulated on November 27, 2017, with Microsoft Photo Editor. The metadata did not show the nature of the manipulation, but Ms. Beltz testified that the change was not simply copying the file, because copying does not show up in metadata. Ms. Beltz also noted that when an image is downloaded multiple times, it is assigned a number in parenthesis to differentiate it from previous downloads of the same file. The name for the image she received included a "3" in parenthesis, indicating that it was the third version of an image that was downloaded.
On January 17, 2018, Ms. Beltz received a Dropbox link with a larger set of images; she received a follow-up hard copy CD with the same images on January 29, 2018. Later, on February 9, 2018, she received a second Dropbox link from Deadbolt Forensics.
On February 15, 2018, Ms. Beltz received the camera that took the images in question in this case. The camera had been tagged as evidence and came with two different SD memory cards, one 4GB in size and one 16GB in size. Ms. Beltz examined the camera and came to the following conclusions. First, she found that the camera was "completely user-dependent" for date and time; there is no way to verify whether the date and time stamped on a digital image from the camera is the actual date and time the photo was taken rather than some other data and time input by the user. Second, she learned that the camera requires an SD card to operate; it will not take photos without a memory card in place and does not store images without a memory card.
Ms. Beltz also examined the SD cards. She did not perform a complete forensic examination due to time constraints. She testified that the 4GB SD card at first appeared to be blank, but that she was able to forensically extract deleted images. The 16GB SD card had images on it that had not been deleted, which she also forensically extracted. She testified that the two SD cards had duplicate images on them; those images also matched, in part, the images provided to her via the two Dropbox links. Because the camera does not operate without an SD card in it and can hold only one SD card at a time, she concluded that someone must have copied the images from one SD card to the other. Ms. Beltz then compared the images from the 4G and 16G SD cards to one another. She found that three "pairs" of images, i.e., images that appeared visually identical, contained different hash values. She concluded from that information that at least three of the images had been altered, though she could not say for sure the nature of the alteration.
Ms. Beltz noted that the camera is motion-triggered and takes sets of images in eight-image bursts. The camera's naming convention automatically assigns sequential numbers to the images. Ms. Beltz testified that there are time and number gaps in the image series. For example, she noted that an eight-image burst numbered 381 to 388 has a 12:23AM time stamp. There is then a three-minute gap, a missing image (389), and slight shift in camera angle. There are then five images time-stamped 12:26AM; those images are numbered 390, 391, 392, 393, 394, and 396 (395 was missing.) Ms. Beltz testified that she could not explain with certainty why there are missing images, different hash values, or time gaps. However, she hypothesized that the slight shift in camera position could be explained by someone swapping out the memory cards, which are spring-loaded, while the camera was still in place.
Ms. Beltz testified that, in her expert opinion, the photographic evidence she reviewed is not credible.
STANDARDS
"A prosecution results from outrageous government conduct when the actions of law enforcement officials , . . are 'so outrageous that due process principles would absolutely bar the government from invoking judicial processes to obtain a conviction.'" United States v. Pedrin, 797 F.3d 792, 795 (9th Cir. 2015) (quoting United States v. Russell, 411 U.S. 423, 431-32 (1973)). "The standard for dismissal on this ground is extremely high." Id. (internal quotation marks omitted). An indictment can be dismissed only where the government's conduct is "so grossly shocking and so outrageous as to violate the universal sense of justice." United States v. Stinson, 647 F.3d 1196, 1209 (9th Cir. 2011). Whether the government's conduct is sufficiently outrageous to violate due process is a question of law directed to the trial judge. United States v. Dudden, 65 F.3d 1461, 1466-67 (9th Cir. 1995). The defendant, however, bears the burden of demonstrating a factual basis for a motion to dismiss the indictment for outrageous governmental conduct. United States v. Lazarevich, 147 F.3d 1061, 1065 (9th Cir. 1998).
The Fourth Amendment prohibits unreasonable searches and seizures by the government. U.S. Const. amend. IV. "As a general rule, to satisfy the Fourth Amendment a search of a home must be supported by probable cause, and there must be a warrant authorizing the search." United States v. Brooks, 367 F.3d 1128, 1133 (9th Cir. 2004) (emphasis in original). Even when the government can show probable cause, a warrantless search of the home is normally "invalid unless there are exigent circumstances that justify proceeding without a warrant." Id. (internal quotation marks omitted). "Evidence derivative of a Fourth Amendment violation—the so-called fruit of the poisonous tree—is ordinarily tainted by the prior illegality and thus inadmissible, subject to a few recognized exceptions." United States v. Gorman, 859 F.3d 706, 716 (9th Cir. 2017) (internal citations and quotation marks omitted). As a general rule, the defendant bears the burden of proof on a motion to suppress evidence. United States v. Caymen, 404 F.3d 1196, 1199 (9th Cir. 2005). Because warrantless searches are presumptively unreasonable, however, the burden of proving that a warrantless seizure did not violate the Fourth Amendment is on the government. United States v. Scott, 705 F.3d 410, 416 (9th Cir. 2012).
DISCUSSION
It is undisputed that the guns at issue in this case were seized during searches conducted pursuant to warrants. Defendant does not challenge the validity of those searches; rather, he argues that the surveillance video evidence shows that an ATF agent surreptitiously entered his property in the middle of the night on January 25, without a warrant and weeks before any warrant would issue in this case. Defendant asserts that this purported warrantless search constitutes outrageous governmental conduct and that due process requires dismissal of the indictment. In the alternative, he contends that the warrantless search requires suppression of all evidence seized in this case as fruit of the poisonous tree, because the first illegal search led to the discovery of all the evidence it eventually seized. The government does not contend that an exception to the warrant requirement justified the January 25 search. Instead, the government argues that defendants' motions must be denied because he was failed to present sufficient evidence that the January 25 search took place at all.
Having heard the witnesses' testimony and reviewed the other evidence, I agree with the government. Before the government assumes the burden to prove that a warrantless search did not violate the Fourth Amendment, a defendant has the initial burden to prove, as a factual matter, that a warrantless search took place. Similarly, it is a defendant's burden to prove the facts underlying his motion to dismiss for outrageous governmental conduct. Here, defendant has fallen far short of carrying either burden. Defendant's still images were, in the first instance, weak evidence of an ATF search, because it is not possible to see any of the pictured individual's facial features. And whatever evidentiary weight those images might have had was decimated by the government's witnesses, both of whom I find credible. Agent Johnson testified that she has overseen the investigation of this case from the beginning and that no ATF agents searched defendant's property prior to the first warrant-supported search on February 16, 2016. Ms. Beltz, who I find duly qualified to give expert testimony, gave numerous, persuasive reasons to doubt the authenticity of the photos, including visual irregularities, evidence of manipulation by photo editing software nearly two years after the photo was allegedly taken, multiple downloads of images, different hash values in apparently identical images, the fact that the photos appear on both SD cards, missing images from the sequence, time gaps, the position shift in the camera between series of images, and the fact that the time and date on each image is entirely user-dependent.
At the March 12 hearing, defendant argued that his motions should be granted because Ms. Beltz could not testify definitively that the images had been altered to show a different date and time. But that is not the standard. As explained above, with respect to both motions, defendant bore the burden to present evidence sufficient to support the conclusion that the images in fact show an ATF agent searching his premises on January 25. He failed to carry that burden. Because the purported warrantless search was the sole basis for defendants' motions, those motions must be denied.
CONCLUSION
Defendant's Motion to Suppress (doc. 93) and Motion to Dismiss (doc. 95) are DENIED.
IT IS SO ORDERED.
Dated this 22nd day of March 2018.
/s/_________
Ann Aiken
United States District Judge