Opinion
No. 2:11-cr-00188-KJM
08-30-2013
UNITED STATES, Plaintiff, v. ALEXANDER NATHAN NORRIS, Defendant.
ORDER
On May 29, 2013, the parties appeared for hearing on defendant Alexander Norris's motion to suppress evidence and for a Franks hearing. Matthew Morris, Assistant United States Attorney, appeared for the government; Alexandra Paradis Negin and Matthew Scoble, Assistant Federal Defenders, appeared for defendant Norris, who was present out of custody. For the reasons set forth below, the court DENIES defendants' motions.
I. BACKGROUND
Defendant is charged with possessing child pornography under 18 U.S.C. § 2252(a)(2) and 18 U.S.C. § 2252(a)(4)(B). Some of the evidence in this case was gathered through a search of Norris's apartment at 2505 5th Street, Apartment 243, Davis, California ("Apartment 243"). This search was authorized by a warrant issued by a United States Magistrate Judge on April 11, 2009, based on an affidavit prepared by FBI Special Agent Nicholas G. Phirippidis.
Agent Phirippidis explained in his affidavit that his investigation leading to Norris began while he was working undercover and identified a user of Peer to Peer (P2P) file sharing software with the screen name "boyforboysl" who was distributing images of child pornography. (Phirippidis Aff. ¶¶ 35-40, Ex. A, ECF 42-1.) P2P file-sharing programs allow computer users to share files with each other directly, rather than through a central server. Metro-Goldwyn-Mayer Studios Inc. v. Grokster, Ltd., 545 U.S. 913, 919-20 (2005). Agent Phirippidis was able to identify boyforboys1's IP address - that "unique string of numbers separated by full stops that identifies each computer using the Internet Protocol to communicate over a network" as registered to AT&T Internet Services. (Id. ¶ 44; see Oxford Dictionaries Online (2013)). He learned from AT&T that the subscriber associated with the IP address lived at 2505 5th Street, Apartment 242, Davis, California ("Apartment 242") and obtained a search warrant for Apartment 242. (Id. ¶¶ 46, 49.)
Agent Phirippidis and other FBI agents executed the warrant on April 1, 2011, and determined that neither the apartment residents nor their regular visitors had child pornography on their computers. With consent, the agents then reviewed Apartment 242's wireless router log, which revealed that other devices had connected to Apartment 242's password-protected router. (Id. ¶¶ 50-53.) A router is "a device which forwards data packets to the appropriate parts of a computer network." Oxford Dictionaries Online (2013). The router log listed the Media Access Control ("MAC") address of each device. (Id. ¶ 51.) The affidavit defines a MAC address as "a unique identifier assigned to a network device for communication on a physical network. MAC addresses are most often assigned by the manufacturer of a network device." (Id. ¶ 11ab.)
Two of the devices that had connected to the network were listed in the router log as "CK" and "bootycop." (Id. ¶¶ 53-54.) Special Agents then used software described in the affidavit as "an open-source wireless tracking utility" that uses "a wireless antenna in a passive mode" to determine if the "CK" device was located in the vicinity of Apartment 242. (Id. ¶ 55.) The software tracks a device's physical location through the device's MAC address. (Id.) Although not identified by name in the affidavit, the parties agree that the software is that known as "Moocherhunter." Using the software, the agents took signal strength readings from Apartment 242, from Apartment 240, which was a vacant apartment accessed with the apartment complex manager's permission, and from the outdoor common areas of the apartment complex. (Id.) The readings indicated that the CK device was most likely located in Apartment 243 of the same building. (Id.)
On April 8, 2011, Agent Phirippidis signed back on to the P2P file sharing program and saw that boyforboys1 was logged in and sharing child pornography. (Id. ¶ 56.) Several hours later, Agent Phirippidis returned to Apartment 242 and observed that "CK" and "bootycop" devices were both at that time, accessing Apartment 242's network. (Id. ¶ 58.) "CK" then disconnected, while "bootycop" stayed connected, with boyforboys1 still logged into the P2P file sharing program. (Id. ¶ 59.)
Agent Phirippidis then used the Moocherhunter software program to ascertain the physical location of the bootycop device. (Id. ¶ 60.) He took "numerous signal strength readings at various locations within Apartment 242 and Apartment 240," which was vacant and entered with the consent of the building manager. Based on the readings, the agent determined the most likely location of the "bootycop" device was Apartment 243. (Id. ¶ 60.)
An FBI investigative report, submitted with the government's opposition, describes Moocherhunter as
a free, downloadable, mobile tracking software tool, for the geo-location of wireless devices. MOOCHERHUNTER has the ability to identify the location of an 802.11-based wireless device by the traffic sent across a network. MOOCHERHUNTER enables the user to detect traffic from a wireless client passively. No data is transmitted from the computer running MOOCHERHUNTER, data is only monitored. MOOCHERHUNTER does not collect packets of data, it only displays the number of packets encountered and the signal strength of each.(Ex. G at 5, ECF 43-7.) The parties agree that on April 8, 2011, Agent Phirippidis used Moocherhunter in the passive mode described above and that no data were transmitted from the agents' device running the Moocherhunter software into Apartment 243.
During discovery, defendant requested "any and all video or audio recording, and photographs take [sic] during the investigation, particularly of the process of using MOOCHERHUNTER to track the signal in this investigation." (Ex. K ¶ 6, ECF 44-1.) The government responded that there were no video or audio recordings that it had not already provided to defendant. (Ex. L ¶ 6, ECF 44-1.) However, the agents reported that "[s]everal pictures and a video were taken of [the] process" of taking "approximately 16 readings" with the software during the April 8 investigation. (ECF 43-7.) At hearing on July 8, both parties agreed that discs containing these pictures and video were not in the investigatory file and that their location was unknown, assuming that they existed. (Tr. at 3:24-4:4, 5:23-6:17, ECF 47.) II. MOTION FOR FRANKS HEARING
In Franks v. Delaware, the Supreme Court held:
where the defendant makes a substantial preliminary showing that a false statement knowingly and intentionally, or with reckless disregard for the truth, was included by the affiant in the warrant affidavit, and if the allegedly false statement is necessary to the finding of probable cause, the Fourth Amendment requires that a hearing be held at the defendant's request.438 U.S. 154, 155-56 (1978). The Court continued that "to mandate an evidentiary hearing, the challenger's attack must be more than conclusory. . . . There must be allegations of deliberate falsehood or reckless disregard for the truth, and those allegations must be accompanied by an offer of proof." Id. at 171. It cautioned that "[a]llegations of negligence or innocent mistake are insufficient." Id. "[D]eliberate or reckless omissions of facts that tend to mislead" may also trigger a Franks hearing. United States v. Stanert, 762 F.2d 775, 781 as amended by 769 F.2d 1410 (9th Cir. 1985).
In the Ninth Circuit, a defendant is entitled to a Franks hearing if he makes specific allegations that identified portions of the affidavit necessary to a finding of probable cause are false or misleading, and a sufficient showing that the statements or omissions were deliberately false or made with a reckless disregard for the truth. The latter showing, in turn, requires an offer of proof challenging the veracity of the affiant, not that of any informant. United States v. Kiser, 716 F.2d 1268, 1271 (9th Cir. 1983). At the pleading stage, a defendant need not present clear proof of deliberate or reckless misrepresentations or omissions; it is sufficient if he makes a substantial showing to support a finding of recklessness or intent. United States v. Gonzalez, Inc., 412 F.3d 1102, 1111 (9th Cir. 2005), amended on denial of rehearing by 437 F.3d 854 (9th Cir. 2006).
Defendant asserts there are numerous material misrepresentations and omissions in Agent Phirippidis's affidavit. Defendant first contends that Agent Phirippidis misled the Magistrate Judge by not disclosing the true total number of unauthorized users of the Apartment 242 router. (ECF 42 at 13-14.) When the FBI agents served the warrant for Apartment 242 on April 1, 2011, the Apartment 242 wireless router log revealed that 33 devices had connected to the router, but the log did not indicate when each device had been connected. (Ex. F, ECF 42-6.) The agents identified four of the devices as belonging to the residents of Apartment 242 or an agent, leaving 28 devices unaccounted for. (Id.) Defendants argue that Agent Phirippidis's affidavit in support of the warrant for Apartment 243 is misleading because it states there were only two devices connected to the router, rather than 33. However, as the government credibly explains, only two of the devices on the log, "CK" and "bootycop," were connected to the Apartment 242 router at the same time that boyforboys1 was connected to the P2P network. (ECF 43 at 13.) The agents had narrowed their search for the boyforboys1 transmissions to these devices, and it was immaterial to their establishment of probable cause to search the apartment containing the device using the bootycop moniker that, at some other time, 26 other devices had connected to the router.
Defendant also argues that the description of a MAC address in the affidavit was misleading because it omitted the fact that a device owner can alter a MAC address, so a MAC address is not necessarily unique to a particular device. (ECF 42 at 13.) This information also is not material to the finding of probable cause. At the time the agents tracked defendant's bootycop device with Moocherhunter, the agents knew that the MAC address was assigned to the bootycop device and that the device was being used to access the P2P network under the boyforboys1 username. (ECF 43 at 15.) Thus, any prior alteration of the device's MAC address before April 8, 2011, did not affect the reliability of the investigation. (Id.)
Defendant further asserts that Agent Phirippidis's affidavit omitted the following information about the Moocherhunter software, without identifying the software by name: (1) that Moocherhunter is an open-source software instead of proprietary; (2) that the FBI had not tested Moocherhunter, trained its agents in its use, or authorized agents to use it; (3) that the agents downloaded and used the free version of Moocherhunter instead of the law enforcement version of the software; (4) that Moocherhunter was made in Singapore; (5) that the makers of Moocherhunter warned that it could be inaccurate if not used properly; (6) any description of the number of readings or locations from which the agents took readings when locating the CK device. (ECF 42 at 15-16.) Additionally, defendant claims he is unable to challenge the agents' methods properly because the pictures and videos of the April 8, 2011 investigation are missing. (ECF 44 at 3.) The government contends that each of these criticisms is either immaterial or incorrect, while conceding that the CD is missing is troubling.
According to defendant, each of the alleged omissions is relevant to whether Moocherhunter is a reliable source of information, and therefore relevant to the finding of probable cause. (ECF 42 at 20.) Defendant has not made the substantial showing required under Franks. In response to defendant's claims that the agents withheld the information that they did not have authorization or training to use Moocherhunter, the government has submitted a declaration from Darren Holtz, FBI Special Agent, explaining that he and Special Agent Michael G. Cahoon tested Moocherhunter before it was used on April 8, 2011. (Holtz Decl., Ex. D, ECF 43-4.) The government has also submitted a declaration from Agent Cahoon, stating he learned about Moocherhunter and similar software at a FBI Cyber Division course before assisting with the April 8 investigation, along the curricula vitae of the three agents, including Phirippidis, who deployed Moocherhunter on April 8. (Cahoon Decl., Ex. D, ECF 43-4; Holtz CV, Cahoon CV, Phirippidis CV, Ex. C, ECF 43-3.) The agents' familiarity with Moocherhunter, combined with their general expertise in computer science, shows that additional information about their training with the software would not have been material to the finding of probable cause; in any event it further supports such a finding.
The court also finds that additional information about warnings on the Moocherhunter website would have been immaterial because there is no indication that the agents used the software incorrectly. The agents complied with the website's advisement to use the proper chipset and antenna. (Holtz Decl. ¶ 3.) The warning that Moocherhunter can give false readings if a MAC address has been changed was not material because as explained above, the agents were certain of the MAC address of the bootycop device at the time they were searching for it. Moreover, defendant does not explain how the mere fact that Moocherhunter was made in Singapore and downloaded for free raises questions about the software's reliability.
The government does not dispute that Moocherhunter is proprietary and not open-source, and that the terminology used in the affidavit was incomplete. If the affidavit had included the information that defendants assert is required, the magistrate judge would have had a more complete picture about Moocherhunter, but this would not have significantly altered the determination of probable cause. See United States v. Flyer, 633 F.3d 911, 917 (9th Cir. 2011) (statement about investigator's inability to download multiple child pornography files from defendant's computer did not need to be included in affidavit when affidavit already contained sufficient information for probable cause).
Finally, defendant argues that a Franks hearing is necessary to determine the import of the missing videos and photographs of the April 8 Moocherhunter readings. At the court's invitation, the parties submitted supplemental briefing to clarify whether this missing information by itself warrants a Franks hearing. (ECF 49, 50, 51.) After careful consideration, the court concludes it does not.
Defendant asks the court to infer that the missing documentation of the readings would demonstrate that the Moocherhunter software did not, in fact, show that the wireless signal was coming from Apartment 243, negating probable cause. (ECF 49 at 1, 3.) In arguing that the loss of evidence merits this inference, defendant relies on United States v. Sivilla, 714 F.3d 1168 (9th Cir. 2013). The defendant in Sivilla was arrested after border patrol agents found drugs hidden inside the engine manifold of his jeep. Id. at 1170. In response to the defendant's request, the government agreed to preserve the jeep as evidence, and the court subsequently granted the defendant's motion to preserve evidence. Id. However, without the knowledge of the Assistant U.S. Attorney or the case agent, the Department of Homeland Security forfeited the jeep. Id. at 1170-71. The Ninth Circuit affirmed the district court's determination that the government acted negligently but not in bad faith, id. at 1172, but held that the district court abused its discretion in not granting a remedial jury instruction to the defendant, id. at 1174.
Defendant asserts that Sivilla stands for the proposition that there must be a remedy for the government's negligence here. (ECF 49 at 3.) While this may be true, the court is not convinced that drawing an inference that the missing photographs and video were exculpatory so as to justify a Franks hearing is the appropriate remedy. That several photographs and video are missing, without any other indication they were exculpatory, does not meet the standard for a "substantial preliminary showing" that contradicts the "presumption of validity" of Agent Phirippidis's statements in the affidavit describing the Moocherhunter readings. Franks, 438 U.S. at 171. Under Franks, allegations that the statements in the affidavit are false must be accompanied by "[a]ffidavits or sworn or otherwise reliable statements of witnesses . . . or their absence satisfactorily explained." Id.; cf. United States v. Jeffus, 22 F.3d 554, 557-58 (4th Cir. 1994) (the possibility that missing witnesses had information to refute the information in the affidavit submitted in support of a warrant was insufficient grounds for a Franks hearing). Defendant has not made such a proffer here.
Defendant's request for a Franks hearing is denied, although defendant may seek a remedial jury instruction addressed to the missing records at trial.
III. MOTION TO SUPPRESS
Defendant contends the government's use of Moocherhunter software to detect defendant's Internet transmissions constituted a warrantless search in violation of the defendant's Fourth Amendment rights. (ECF 42 at 9.) A search occurs when the government trespasses on the "persons, house, papers, or effects" of the defendant, or there is a violation of a reasonable expectation of privacy. United States v. Jones, 565 U.S. ___, 132 S. Ct. 945, 949-50 (2012).
The government argues there was no violation of defendant's Fourth Amendment rights because there was no trespass onto defendant's property, and defendant had no reasonable expectation of privacy in the signals transmitted through his neighbor's wireless internet connection. (ECF 43 at 5-11.) As explained below, the undisputed facts support the conclusion that use of Moocherhunter was not a search.
A. No Trespass
Defendant argues that using Moocherhunter to "sniff the air waves coming from inside Mr. Norris' bedroom, to discover the location of a computer inside his bedroom that otherwise could not have been seen without actually being in the home, intrudes into areas of his home that he has a reasonable expectation of privacy will not be trespassed." (ECF 42 at 9-10.) The government contends no trespass occurred as the Moocherhunter was only "passively" detecting Internet traffic coming from defendant's home. (ECF 43 at 5.)
Defendant relies heavily on the recent case of Florida v. Jardines, ___ U.S. ___, 133 S. Ct. 1409 (2013). In Jardines, the police used a drug-sniffing dog on a suspect's front porch without a search warrant. Id. at 1413. The Court held this use was a search, explaining that the front porch "is the classic exemplar of an area adjacent to the home" and is considered the home's "curtilage," which has been widely protected by the Fourth Amendment. Id. at 1415. By using the drug-sniffing dog in this area, the police made an unwarranted physical intrusion. Id. at 1414. In this case, however, law enforcement made no physical intrusion into the defendant's property or anything equivalent to the curtilage; rather, agents obtained permission to use Moocherhunter only passively while standing with permission in other apartments or in common areas. (ECF 42 at 5.) Thus, no physical trespass onto the defendant's property occurred.
B. No Reasonable Expectation of Privacy
Defendant contends he had a reasonable expectation of privacy in his bedroom, and a reasonable expectation of privacy in the location of his computer within that bedroom. (ECF 42 at 11.) The government argues he had no expectation of privacy because defendant "knowingly and intentionally transmitted radio signals from inside his apartment to a location defendant knew had to be outside his apartment[.]" (ECF 43 at 7.)
In determining whether a reasonable expectation of privacy has been violated the court conducts a two-part analysis: "first, has the individual manifested a subjective expectation of privacy in the object of the challenged search? Second, is society willing to recognize that expectation as reasonable?" California v. Ciraolo, 476 U.S. 207, 211 (1986) (citing Katz v. United States, 389 U.S. 347, 360 (1967) (Harlan, J, concurring)). In Katz, the Court held government agents' use of a listening device on a telephone booth constituted a search in violation of the Fourth Amendment because the defendant had a reasonable expectation of privacy in his telephone conversation. Katz, 389 U.S. at 351. "What a person knowingly exposes to the public, even in his own home or office, is not a subject of Fourth Amendment protection . . . [b]ut what he seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected." Id. at 351.
Later, the Court in Smith v. Maryland determined that the government's use of a pen register to record the phone numbers that a suspect dialed on his telephone, without a warrant, was not a violation of the Fourth Amendment. 442 U.S. 735, 745 (1979). The Court reasoned, "petitioner voluntarily conveyed numerical information to the telephone company and 'exposed' that information to its equipment in the ordinary course of business. In so doing, petitioner assumed the risk that the company would reveal to police the numbers he dialed." Id. at 744. In Smith, the Court distinguished Katz based on the fact that unlike the listening device used by the authorities in Katz, pen registers do not obtain the contents of the conversations. Id. at 741.
Here, the use of Moocherhunter is more analogous to the use of the pen register in Smith than the listening device used in Katz, in that Moocherhunter does not capture the contents of the target user's Internet activity, only the strength of the target signal. (ECF 43 at 4.) Defendant had no expectation of privacy when he initiated a wireless signal from his computer to the wireless router located in Apartment 242, as he "assumed the risk" his information would be conveyed to law enforcement by Apartment 242's occupants. See Smith, 442 U.S. at 744.
Defendant also argues, however, that the agents' actions here were similar to those of the agents in Kyllo v. United States, 533 U.S. 27 (2001), in which the Supreme Court reversed the district court's denial of a defendant's motion to suppress. (ECF 42 at 10-11). In Kyllo, government agents stood on the public street outside the home of a suspected marijuana grower and used thermal imaging devices to scan his home. 533 U.S. at 29-30. The imaging devices detected thermal "hot spots," suggesting there were fluorescent lights used inside for growing marijuana. Id. Agents then used this information to obtain a search warrant for the defendant's residence. Id. Even though the agents were outside a constitutionally protected area when they conducted their scans, the Court reasoned "that obtaining by sense-enhancing technology any information regarding the interior of the home that could not otherwise have been obtained without physical intrusion into a constitutionally protected area, constitutes a search." Id. at 34 (internal citations omitted). In this case the agents used Moocherhunter to pick up signals the defendant was voluntarily transmitting to the Apartment 242 router, not information confined to the private area of defendant's home. And Moocherhunter in the passive mode did not enhance the agent's senses in a way that allowed for intrusion into Apartment 243.
Generally there is no expectation of privacy for internet data voluntarily turned over to third parties. See Quon v. Arch Wireless Operating Co., Inc., 529 F.3d 892, 905 (9th Cir. 2008), reversed and remanded on other grounds by City of Ontario, Cal. v. Quon, ___ U.S. ___, 130 S. Ct. 2619 (2010); United States v. Forrester, 512 F.3d 500, 509 (9th Cir. 2008) (citing Smith and holding the use of computer surveillance techniques that revealed email addresses was not a search because Internet users have no expectation of privacy in content that is voluntarily communicated to third parties). In United States v. Stanley, another district court recently denied the defendant's motion to suppress evidence obtained by government agents with Moocherhunter software. No. CRIM. 11-272, 2012 WL 5512987 (W.D. Pa. Nov. 14, 2012). The court reasoned the defendant "did not have a legitimate expectation of privacy in the wireless signal he caused to emanate from his computer to [a third party] wireless router or in the signal being sent from the router back to his computer, and therefore, [government's] use of Moocherhunter did not constitute a search in violation of the Fourth Amendment." Id. at *12. This court's understanding of the Moocherhunter software is consistent with that of its sister court in Pennsylvania.
Moreover, societal interests do not support recognizing defendant's reasonable expectation of privacy in data transmitted without authorization to Apartment 242's password-protected wireless router. In United States v. Caymen, the defendant obtained a laptop from a store through the use of a fraudulent credit card. 404 F.3d 1196, 1197 (9th Cir. 2005). Police later recovered the laptop, and obtained the store's permission to search the computer. Id. at 1198. Police recovered child pornography from the laptop and the defendant was charged. Id. In denying the defendant's motion to suppress the evidence obtained from the computer, the court reasoned "one who takes property by theft or fraud cannot reasonably expect to retain possession and exclude others from it once he is caught. Whatever expectation of privacy he might assert is not a legitimate expectation that society is prepared to honor." Id. at 1201.
Similar to the defendant in Caymen, the defendant here transmitted information through an internet connection he did not have permission to use. (ECF 43 at 7.) Specifically, defendant hacked into Apartment 242's wireless Internet router and used the Internet without those occupants' consent. (Id.) The agents used Moocherhunter to detect the router activity with permission of the router's owners. (ECF 43 at 3.) Any expectation of privacy the defendant may have had is trumped by the lawful owners' authorization given to the government. See Caymen, 404 F.3d at 1201.
Because there was no trespass on the defendant's property and defendant had no reasonable expectation of privacy society is willing to protect, the court denies his motion to suppress.
ACCORDINGLY, the court orders as follows:
1. Defendant's motion for a Franks hearing is denied.
2. Defendant's motion to suppress on Fourth Amendment grounds is denied.
IT IS SO ORDERED.
____________
UNITED STATES DISTRICT JUDGE