Opinion
2018NY014091
11-20-2018
The PEOPLE of the State of New York, Plaintiff, v. Abigail SIME, Defendant.
For the Defense: Emily Paul, Esq., Jerome Greco, Esq., The Legal Aid Society, 49 Thomas Street, New York, NY 10013 For the People: Cyrus R. Vance, Jr., New York County District Attorney, One Hogan Place, Trial Bureau 40, New York, NY 10013, New York, NY 10013, By: A.D.A. Jasmine H. Ahmetovic, A.D.A. Emily H. Benjamin
For the Defense: Emily Paul, Esq., Jerome Greco, Esq., The Legal Aid Society, 49 Thomas Street, New York, NY 10013
For the People: Cyrus R. Vance, Jr., New York County District Attorney, One Hogan Place, Trial Bureau 40, New York, NY 10013, New York, NY 10013, By: A.D.A. Jasmine H. Ahmetovic, A.D.A. Emily H. Benjamin
David Frey, J.
By decision and order dated October 2, 2018, a hearing was ordered to determine the following:
(1) Did defendant establish standing to controvert the search warrant issued to Instagram? If so,
(2) Who executed the warrant, where it was executed, and when it was executed? and
(3) What was recovered and whether the court must suppress any data recovered outside the probable cause confines for date and time.
The defense called no witnesses, instead relying on the People's allegations in the criminal court complaint and search warrant application. The defense entered the following into evidence:
Exhibit/Description
A Search Warrant Application
The People called two witnesses, Assistant District Attorney (ADA) Emily Benjamin and Detective Jamel Crawford, who was assigned to the New York City Police Department's (NYPD) 7th Precinct Detective Squad. The court found both witness's testimony credible in all respects. The People entered the following into evidence:
Exhibit/Description
1 Search Warrant No. 294/2018 (Instagram search warrant)
2 Email confirmation3 Error message screen shot
4-8 Emails to and from Facebook
9 Email from Facebook confirming search warrant receipt
10A Instagram records (IP addresses)
10B Instagram records (photographs and other Instagram data)
DEFENDANT'S STANDING
In this court's October 2, 2018 decision ( People v. Sime , 61 Misc. 3d 896, 85 N.Y.S.3d 363 [Crim. Ct., N.Y. County 2018] ), this court held that the defendant failed to meet her burden to show a legitimate privacy expectation in the subject Instagram accounts' data. The court however held the motion to controvert the search warrant in abeyance for the defendant to provide (1) whether the accounts were created or controlled by her, and (2) if so, the privacy settings she maintained for each account ( Sime , 61 Misc.3d 896, 85 N.Y.S.3d at 369–71.
In a pre-hearing memorandum to the court, the defendant cited People v. Ramirez-Portoreal, 88 N.Y.2d 99, 643 N.Y.S.2d 502, 666 N.E.2d 207 [1996] as controlling authority that the defendant has standing to controvert the search warrant. In Ramirez-Portoreal , the Court of Appeals stated that the defendant must first establish "by defendant's own evidence or by relying on the People's evidence" that she had a legitimate privacy expectation in the place or item that was searched ( id. at 109, 643 N.Y.S.2d 502, 666 N.E.2d 207 ). This is not the same as whether the defendant had a possessory interest in the items seized ( id. ). First, the court must identify the object of defendant's privacy expectation, determine whether the defendant exhibited an expectation of privacy in it (a subjective component), and then evaluate whether the circumstances would lead society to regard defendant's expectation as reasonable (an objective component) ( id. at 108, 643 N.Y.S.2d 502, 666 N.E.2d 207 ). Also, if the defendant had a legitimate privacy expectation at first, did she abandon it, and did that abandonment result from police activity? ( id. at 110-111, 643 N.Y.S.2d 502, 666 N.E.2d 207 ).
The defendant conceded that there is no privacy expectation for the posted photographs, and the defendant's concession was correct. There was no evidence that the defendant exhibited any privacy expectation by posting photographs — allegedly under pseudonyms — to the general public on a software application available to the world. Indeed, the complaining witness was able to see the posts because the defendant took no steps to prevent anyone from accessing the account. And, the defendant did not provide evidence showing what privacy settings she maintained for each account. Nor was there any evidence that would lead the court to believe that society would regard the defendant's expectation as reasonable if the defendant had met her burden on the first two analysis steps.
As noted during the hearing, any reference to the defendant being the person who posted the pictures is for brevity's sake and does not reflect that the court made a factual determination or the People having proven that fact beyond a reasonable doubt.
This court's previous order determined, and the People argued, that the defendant would need to provide (1) whether the accounts were created or controlled by her, and (2) if so, the privacy settings she maintained for each account, in order to reach whether she had a privacy expectation. The defense in turn argued that there is a general right to privacy for the IP addresses associated with the person who posted the pictures and the metadata contained in the photographs public posted under the recently decided Carpenter v. United States, ––– U.S. ––––, 138 S.Ct. 2206, 201 L.Ed.2d 507 [2018], and that they rely on the People's allegations that it was her data.
There are currently two Internet Protocol (IP) address types: IP version 4 (IPv4) and IP version 6 (IPV6). Both IP address types were associated with the account and posted photographs (People's Exhibits 10A and 10B). The simplistic difference between the two is:
IPv4 IPv6 Approximate number 4.3 billion 340 undecillion2 of addresses Address location Network/router Device Security Not much Encryption
An undecillion is a number followed by 36 zeroes, or a trillion trillion trillion.
(Tony Bradley, PC World, IPv6: Five Things You Should Know , https://www.pcworld.com/article/257037/ipv6_five_things_you_should_know.html; IBM Knowledge Center, Comparison of IPv4 and IPv6 , https://www.ibm.com/support/knowledgecenter/en/ssw_ibm_i_72/rzai2/rzai2compipv4ipv6.htm [both last accessed November 19, 2018] ).
Starting in 1976, the US Supreme Court established the third-party doctrine by holding that "a person has no legitimate expectation of privacy in information ... voluntarily turn[ed] over to third parties ... even if the information is revealed on the assumption that it will be used only for a limited purpose" ( Carpenter v. United States , ––– U.S. ––––, 138 S.Ct. 2206, 2216, 201 L.Ed.2d 507 [2018], quoting Smith v. Maryland , 442 U.S. 735, 743–744, 99 S.Ct. 2577, 61 L.Ed.2d 220 [1979] and United States v. Miller , 425 U.S. 435, 443, 96 S.Ct. 1619, 48 L.Ed.2d 71 [1976] ). In Carpenter , the Court held that the third-party doctrine was not absolute and declined to extend the rule to cell-site records that convey "a detailed and comprehensive record of [a] person's movements" ( id. at 2217 ).
"There is a world of difference between the limited types of personal information addressed in Smith and Miller and the exhaustive chronicle of location information casually collected by wireless carriers today. The Government thus is not asking for a straightforward application of the third-party doctrine, but instead a significant extension of it to a distinct category of information" ( id. at 2219 ).
Thus, while the Carpenter Court requires the government to obtain a warrant to obtain a person's telephone location for seven or more days, it also made it clear that its decision was a "narrow one" and there was no intention to disturb the third-party doctrine as it applied to other technologies or "other business records that might incidentally reveal location information" ( id. at 2220 ). This was due, in part, to the "unique nature of cell phone location information" ( id. ), in that it provided a "detailed, encyclopedic, and effortlessly compiled" information about a person's past movements and that people have "a reasonable expectation of privacy in the whole of their physical movements" ( id. at 2216, citing United States v. Jones , 565 U.S. 400, 430, 132 S.Ct. 945, 181 L.Ed.2d 911 [2012] ). The Fifth Circuit held that IP address associated with an address "had no bearing on any person's day-to-day movement" therefore "the defendant lacked a reasonable expectation of privacy in that information" ( United States v. Contreras , 905 F.3d 853, 857 [5th Cir. 2018] ; see also United States v. Tirado , 2018 WL 3995901 [E.D. Wis. 2018] [on reconsideration the court held that Carpenter did not require a different result because pole cameras do not require a warrant] ).
Similar to the Carpenter decision is People v. Weaver, 12 N.Y.3d 433, 882 N.Y.S.2d 357, 909 N.E.2d 1195 [2009]. The Weaver Court's stated impetus in creating a new privacy right for Q-ball GPS devices attached to cars was that it was offended that the police could use a GPS device to easily track a person's movement about New York State's public streets. The Court thus determined that a GPS device attached to a car is a telephone or telegraph communication protected by New York State's Constitution (Article I, § 12 ), and that the police must obtain a warrant before attaching it to a vehicle ( Weaver at 438-439, 882 N.Y.S.2d 357, 909 N.E.2d 1195 ).
But, neither IP data nor photograph metadata is GPS data. Obtaining IP data does not provide the police the ability to exhaustively know a defendant's exact position — at best it might incidentally reveal what device was used to post a photograph in the general vicinity of an internet router. In other words, at most it will let the police find a building near the used cell phone or computer device on discrete dates when pictures were uploaded for the public to view, and has no bearing on the defendant's day-to-day movement ( Contreras, at 857 ). Similarly, photograph metadata might let you know what camera was used to take a particular picture, and (if it was not already obvious from the picture itself) where that picture was taken. Neither IP nor metadata allows the police to exhaustively determine when and where a person visited "the psychiatrist, the plastic surgeon, the abortion clinic, the AIDS treatment center, the strip club, the criminal defense attorney, the by-the-hour motel, the union meeting, the mosque, synagogue or church, the gay bar ..." ( Weaver , at 441-442, 882 N.Y.S.2d 357, 909 N.E.2d 1195 ), unless the poster actually took pictures at these places and/or posted the pictures from those locations, in which case the person would have no privacy interest in this publicly displayed information anyway. IP data and metadata are roughly analogous to telephone billing records, and there is no legal reason to protect this data to the same extent as long-term GPS data and cell-site information (see e.g. Contreras , at 857 ; People v. Jiles, 158 A.D.3d 75, 68 N.Y.S.3d 787 [4th Dept. 2017], lv denied 31 N.Y.3d 1149, 83 N.Y.S.3d 431, 108 N.E.3d 505 [2017] [four days of historical cell-site data has no federal or state constitutional protection] ).
The burden was on the defendant to establish standing by showing a legitimate privacy expectation in the place searched (see Rakas v. Illinois , 439 U.S. 128, 144, 99 S.Ct. 421, 58 L.Ed.2d 387 (1978) ; Ramirez-Portoreal , 88 N.Y.2d at 108, 643 N.Y.S.2d 502, 666 N.E.2d 207 ; People v. Gonzalez , 68 N.Y.2d 950, 951, 510 N.Y.S.2d 86, 502 N.E.2d 1001 [1986] ; People v. Ponder , 54 N.Y.2d 160, 165, 445 N.Y.S.2d 57, 429 N.E.2d 735 [1981] ). A subjectively held privacy expectation is legitimate only if it is "one that society is prepared to recognize as reasonable" ( Rakas , 439 U.S. at 143–144, n 12, 99 S.Ct. 421 ). This court finds that there is no constitutional privacy afforded to the IP data and photograph metadata that the defendant uploaded and shared with the world, nor would a subjectively held privacy expectation be reasonable or one that society is prepared to recognize.
In light of this, and because the defendant did not sustain her burden to demonstrate either that the accounts were created or controlled by her, and if so, the privacy settings she maintained for each account, the defendant's motion to controvert is denied. WARRANT EXECUTION
Because this is a case of first impression, should a subsequent appellate court somehow find that the defendant had standing to controvert the warrant under some newly created theory, the following are this court's additional findings of fact and conclusions of law:
1. Service Within Ten Days
The People's witness met their burden to show that the warrant was served on Facebook, Instagram's parent company, within 10 days. The warrant was issued on March 16, 2018 (People's Exhibit 1). The warrant was served on Facebook (Instagram's parent company) through their online law enforcement portal and via email to Facebook on March 16, 2018 (People's Exhibits 2-9).
2. Service Method
The warrant was "executed" in New York County by uploading and emailing it from a computer located in New York State. It was served in a manner that Facebook has voluntarily provided (and prefers) for law enforcement requests pursuant to court orders (People's Exhibit 2 ["The following link allows authorized law enforcement officials to securely access our Law Enforcement Online Request System .... Requests made through this system may be made only by governmental entities authorized to obtain evidence in connection with official legal proceedings ...") (see also, www.facebook.com/records ["...you may request records from Facebook through this system."] [last accessed November 19, 2018] ), and is an acceptable method to serve court orders for Facebook business records ( In the Matter of 381Search Warrants Directed to Facebook, Inc. , 29 N.Y.3d 231, 55 N.Y.S.3d 696, 78 N.E.3d 141 [2017] ).
3. Execution by Police Officer.
The ADA-witness testified that the warrant was served by her uploading the warrant to Facebook's law enforcement records portal, and that no police officer was present when she did so. The defendant argues that the warrant was not "executed" by NYPD officers ( CPL 690.25 [1 ] ), and there is no provision in CPL article 690 that allows a private citizen to serve or execute a search warrant.
The SCA's express language sets out that,
"[T]he presence of an officer shall not be required for service or execution of a search warrant issued in accordance with this chapter requiring disclosure by a provider of electronic communications service or remote computing service of the contents of communications or records or other information pertaining to a subscriber to or customer of such service" ( 18 USC § 2703 [g] ).
The defendant claims the SCA does not apply, and even if it did, the SCA cannot override state law.
First, the SCA does apply.
Second, the Court notes that an ADA uploading the search warrant is not a favored practice, if only to avoid ADAs being witnesses in their own cases. A prosecutor should have a police officer serve the warrant by uploading it to avoid this problem and unnecessarily having to litigate this issue. Nonetheless, while the defense is correct that the SCA requires the warrant to be "issued using State warrant procedures" ( 18 USC § 2703 [a] ) (emphasis added), it does not state that it must be executed using State warrant procedures. The Court of Appeals has already addressed this issue, and the Court approved Facebook employees "executing" the warrants for the simple fact that "the framework of execution for SCA warrants ensure efficiency and minimizes intrusion into the provider's business while promoting and protecting legitimate law enforcement interests in criminal investigation" ( Facebook , 29 N.Y.3d at 244, 55 N.Y.S.3d 696, 78 N.E.3d 141 ). This warrant was properly issued pursuant to CPL article 690 and executed by Facebook employees pursuant to 18 USC 2703 (a) and (g) ( Facebook at 244, 55 N.Y.S.3d 696, 78 N.E.3d 141 ).
4. Records Recovered.
The warrant limited the images and associated data recovered to after February 2017, and IP history data from February, 12, 2018, through March 16, 2018. The images and data recovered (People's Exhibits 10A and 10B) show that all the images and data recovered where:
Account Recovered Records' Date span First Account (defendant's account) February 19, 2018 - March 16, 2018 Second Account (in CW's name) February 20, 2018 - February 22, 2018
The only record obtained outside this time period was the data showing information and IP address provided to Instagram when the account was created. The People's application for the warrant provided probable cause to retrieve this subscriber data, regardless of its creation date.
In sum, the records recovered were properly limited to the date's authorized by the warrant.
5. Whether the Applicant understood what EXIF data was at the time she signed the search warrant affidavit.
During cross-examination, the defense asked the detective, "What's exif data, E-X-I-F?" and she responded, "I'm not sure. I'm not in computer crimes." During re-direct the People asked the following questions and Detective Crawford provided the following answers:
Q. Detective, at the time that you swore out the search warrant did you understand what kind of information was needed?
A. Yes, initially.
Q. And did you understand why it was needed?
A. Yes.
Q. And was it in furtherance of the investigation?
A. Yes.
The search warrant application itself stated,
"Based on my training and experience, I am aware that messages or images maintained in an Instagram account may contain or have associated data files which could assist in determining the geographic location of the individual who posted such items to the account, including geo-graphical location information and EXIF data, which is associated with digital photographs" (Search Warrant affidavit at ¶ 7.e.).
While this cross-examination by the defense may go to the detective's credibility at the hearing and at a trial, it was not crucial to the probable cause set out before the issuing judge or the relief sought, as the paragraph itself stated that EXIF data is data associated with digital photographs and would assist in determining who posted the photograph and from where it was posted.
As set out in this court's previous decision (Sime, 85 N.Y.S.3d at 373, n. 7 ), dated October 2, 2018, EXIF is short for Exchangeable Image File, a metadata format. Metadata provides information about a computer file's contents. For example, a digital image may contain when the image was created. A text document's metadata may contain information about who the author is and when the document was written (https: techterms.com/definition/metadata, last accessed September 28, 2018).
--------
CONCLUSION
The defendant did not meet her burden to establish standing. If the defendant had met her burden, the warrant was properly issued and executed, and the records recovered were within the time span authorized.
The defendant's motion to controvert the search warrant is denied.