Monday, May 04, 2015

The Wyoming Tool Kit, Kyllo and the 4th Amendment

After entering “ a conditional guilty plea to five charges of sexual exploitation of a minor arising from child pornography on his laptop computer”, Daniel Roberts appealed his conviction.  State v. Roberts, 345 P.3d 1226, 2015 UT 24 (Supreme Court of Utah 2015).  On appeal, Roberts, among other things, challenged “the propriety of law enforcement's use of the Wyoming Toolkit, a computer program and database used to identify child pornography shared over the Internet through peer-to-peer file sharing networks” in gathering evidence that was used to charge him and challenged the trial judge’s “ruling that denied him discovery of the Wyoming Toolkit.” State v. Roberts, supra.  
The Supreme Court began its analysis of his arguments by explaining how the prosecution arose:
Utah's Internet Crimes Against Children task force (ICAC) works to prevent the online distribution of child pornography. The ICAC searches peer-to-peer (P2P) file sharing networks for child pornography being shared among P2P users. Gnutella, one such P2P network, allows its users to share digital files directly over the Internet. Gnutella uses what is called the secure hash algorithm (SHA–1) encryption method to assign a unique digital signature to each file shared over its network. Because each digital file has a different SHA–1 value, those values can be used to identify a file. Through prior investigations, law enforcement has compiled a database of thousands of SHA–1 values that correspond to files containing child pornography. This database, along with software that searches Gnutella for the identified SHA–1 values, is known as the Wyoming Toolkit.

The ICAC uses the Wyoming Toolkit to monitor Gnutella for IP addresses sharing files with suspect SHA–1 values. Once the Toolkit flags an IP address sharing a file with an SHA–1 value that matches known child pornography files, officers confirm that the suspect file is indeed child pornography either by downloading and viewing the file directly or by comparing the identified file's SHA–1 value with SHA–1 values of known child pornography contained in databases like the National Child Victim Identification Program. Upon confirming that the identified file is child pornography, officers send an administrative subpoena to the applicable internet service provider to obtain the subscription information associated with the identified IP address.

During a 2009 investigation, the ICAC determined that an IP address in Emery County, Utah, had used Gnutella to share hundreds of `files with SHA–1 digital signatures identical to images of suspected child pornography’ during a five month period. The ICAC submitted these findings to FBI Agent Sonja Nordstrom. Upon confirming the files contained child pornography,  Nordstrom served a subpoena on Emery Telecom, the local internet service provider, which was able to identify Roberts as the owner of the suspect IP address. Based on this information, Nordstrom obtained a search warrant for Roberts' home and computers
State v. Roberts, supra.  
The court goes on to explain that Roberts was not home on the day the officers
executed the search warrant. Nordstrom called Roberts on his cell phone to inform him of the search, but did not discuss the purpose of the investigation. Roberts told Nordstrom he was in Ogden, Utah, where his wife was in the hospital. Nordstrom later spoke with Roberts' wife, who indicated that Roberts had his laptop computer with him in Ogden.

Nordstrom traveled to Ogden to meet with Roberts. Roberts brought his laptop to the meeting, and Nordstrom explained . . . that he was being investigated for possession of child pornography. After some questioning, Roberts admitted he had been downloading child pornography for approximately a year and had been in the process of deleting the child pornography from his computer since Nordstrom had called him. After Roberts made this admission, Nordstrom asked if she could see his laptop. Roberts consented. Nordstrom subsequently obtained a search warrant specifically for Roberts' laptop.
State v. Roberts, supra.  
The Supreme Court went on to explain that Roberts’ laptop was taken to a
computer forensic lab, where an examiner found video and still images of child pornography. Roberts was charged with thirty counts of sexual exploitation of a minor, a second degree felony. Utah Code § 76–5a–3. . . . Before trial, [he] made four motions. . . . First, he moved to suppress the evidence of child pornography found on his laptop. Relying on the U.S. Supreme Court case Kyllo v. U.S., 533 U.S. 27 (2001), Roberts argued that the Wyoming Toolkit, like the thermal image scanning at issue in Kyllo, constituted a search, and therefore use of the Toolkit without a warrant violated the 4th Amendment to the U.S. Constitution.

Roberts further argued that he had an expectation of privacy in the contents of his computer and that by accessing those contents through the Wyoming Toolkit, the State violated his expectation of privacy through an unlawful search. The district court denied Roberts' motion, reasoning that the Wyoming Toolkit did not have `the same intrusiveness as thermal imaging’ and that `peer-to-peer file sharing is not entitled to a reasonable expectation of privacy.’
State v. Roberts, supra.  
Roberts also moved to compel discovery of the Wyoming Tool Kit and
its methodologies. He also moved to compel discovery of `any and all associated program documentation, instruction manuals, technical support materials, training materials, and purchase documents . . . to verify that the images [he] is alleged to have possessed are in fact[ ] illegal images.’ The district court granted the motion in part and denied it in part.

It held that Roberts was entitled to discovery of `whatever information the State has in regards to this case,’ including `any information the State has’ regarding the SHA–1 values associated with the files found on Roberts' laptop. But it denied [his] motion to compel discovery of every SHA–1 value in the Wyoming Toolkit database and `the search algorithm process and methodology utilized’ in the Toolkit. It reasoned that discovery of the Toolkit was unnecessary for the purpose Roberts alleged because Nordstrom had personally verified that the files Roberts had shared on Gnutella were indeed child pornography and because `disclosure of investigative techniques and procedures would interfere with law enforcement efforts.’
State v. Roberts, supra.  
Roberts argued, on appeal, that the trial court erred in rejecting his 4th Amendment argument and not allowing discovery concerning the Wyoming Tool Kit. State v. Roberts, supra.  The Supreme Court began its opinion by explaining that
[d]ifferent standards of review apply to each of Mr. Roberts' arguments. We review for correctness the district court's denial of Mr. Roberts' motion to suppress on the ground that law enforcement's use of the Wyoming Toolkit constituted an unlawful search. State v. Tripp, 2010 UT 9, ¶ 23, 227 P.3d 1251 (Utah Supreme Court 2010) Because district courts `have broad discretion in matters of discovery,’ we review for an abuse of discretion the district court's ruling that denied Mr. Roberts discovery of the Wyoming Toolkit. Green v. Louder, 2001 UT 62, ¶ 37, 29 P.3d 638 (Utah Supreme Court 2001).
State v. Roberts, supra.  
The court then began its analysis of Roberts’ arguments on appeal with his 4th Amendment argument, explaining that the 4th Amendment to the U.S. Constitution
prohibits `unreasonable searches and seizures.’ Government conduct that infringes upon a subjective and `reasonable expectation of privacy’ constitutes a search and therefore cannot take place absent a valid warrant or a recognized exception to the warrant requirement. State v. Price, 2012 UT 7, ¶ 9, 270 P.3d 527 (Utah Supreme Court 2012). . . . A subjective and reasonable expectation of privacy exists when `(1) an individual has “exhibited an actual (subjective) expectation of privacy” and (2) “the expectation [is] one that society is prepared to recognize as reasonable.”’ State v. Price, supra  (quoting Katz v. U.S., 389 U.S. 347 (1967) (Harlan, J., concurring)). In this case, we must decide whether Roberts had a subjective expectation of privacy in files he shared on Gnutella and, if so, whether that expectation of privacy was objectively reasonable.
State v. Roberts, supra.  
The court then explained that
[a]lthough we have yet to consider whether a reasonable expectation of privacy exists in a file shared over a P2P network, several federal courts have considered the issue and none has found an expectation of privacy. See U.S. v. Hill, 750 F.3d 982 (U.S. Court of Appeals for the 8th Circuit 2014) (`[A] defendant has no reasonable expectation of privacy in files . . . retrieved from his personal computer where [the defendant] admittedly installed and used LimeWire to make his files accessible to others for file sharing’); U.S. v. Conner, 521 Fed. Appx. 493 (U.S. Court of Appeals for the 6th Circuit 2013) (finding no reasonable expectation of privacy in files shared through a P2P file-sharing program); U.S. v. Norman, 448 Fed. Appx. 895 (U.S. Court of Appeals for the 11th Circuit 2011) (same); U.S. v. Borowy, 595 F.3d 1045 (U.S. Court of Appeals for the 9th Circuit 2010) (same); U.S. v. Perrine, 518 F.3d 1196 (U.S. Court of Appeals for the 10th Circuit 2008) (same). We agree with this federal precedent and hold that there is no reasonable expectation of privacy in a file that an individual publicly shares on a P2P network.
State v. Roberts, supra.  
The Supreme Court then applied these holdings to the facts in this case, explaining that
Roberts publicly shared his files on Gnutella, thereby rendering them publicly available to anyone with a Gnutella client. And because [he] made no effort to limit access to his files on Gnutella, he exhibited no subjective expectation of privacy in those files. Neither the ICAC's investigation of Roberts' publicly shared files nor its use of the Wyoming Toolkit to identify the files as child pornography constituted a search. The Wyoming Toolkit merely enabled the ICAC officers to recognize files with SHA–1 values associated with child pornography. But it did not allow the government to access private information on Roberts' computer. It therefore did not invade a constitutionally protected private space.
State v. Roberts, supra.  
The Supreme Court wen on to explain t why Roberts’ attempt to rely on the holding in the Kyllo case was misplaced:
Roberts relies on the U.S. Supreme Court's opinion in Kyllo v. U.S., 533 U.S. 27, (2001). In Kyllo, the Court held that the use of thermal imaging scanners to detect high-intensity lamps used to grow marijuana in a home constituted an unlawful search. U.S. v. Kyllo, supra. The Court reasoned that the thermal imaging intruded on the interior of the home, which is protected by a high expectation of privacy. U.S. v. Kyllo, supra. [It] thus held that where `the Government uses a device that is not in general public use, to explore details of the home that would previously have been unknowable without physical intrusion, the surveillance is a ‘search’ and is presumptively unreasonable without a warrant.’ U.S. v. Kyllo, supra.

Roberts focuses on the fact that the government in Kyllo used technology that is not publicly available. He argues that, like the thermal imaging scanners at issue in Kyllo, the Wyoming Toolkit is not accessible to the public. But the greater concern in Kyllo was that the government was using the technology to intrude the privacy of the home. The Wyoming Toolkit, on the other hand, is used only to identify child pornography in files that are publicly shared on P2P network. Unlike thermal imaging scanners, the Toolkit does not intrude on any interest in which the defendant has a reasonable expectation of privacy. Use of the Toolkit therefore does not constitute an unlawful search.
State v. Roberts, supra.  
The court then took up Roberts’ argument that the trial judge abused his discretion in denying his motion to compel discovery of the Wyoming Toolkit, including
its methodologies and all of the SHA–1 values in its database. We review this claim for an abuse of discretion and the appellant bears a heavy burden in showing that the district court abused its discretion. R & R Energies v. Mother Earth Indus., Inc., 936 P.2d 1068 (Supreme Court of Utah 1997). To meet this burden, the appellant must show either `an erroneous conclusion of law or [that] there is no evidentiary basis’ for the court's discovery ruling. . R & R Energies v. Mother Earth Indus., Inc., supra. . . . (internal quotation marks omitted). Roberts has shown neither.
State v. Roberts, supra.  
It went on to note that when the trial judge ruled on Roberts’ motion to compel, he
allowed Roberts to discover any information the State had regarding his case, including the SHA–1 values associated with files found on his laptop. But the district court denied the remainder of Roberts' discovery request for two independent reasons: (1) that discovery of the Toolkit would not produce the evidence Mr. Roberts sought (i.e., verification that the files Roberts had shared and that the Toolkit had detected were indeed child pornography) and (2) that disclosure of all of the Toolkit's methodologies and SHA–1 values would harm future ICAC investigations.
State v. Roberts, supra.  
The Supreme Court was not convinced, explaining, initially, that Roberts’
main argument on appeal is that the Toolkit and its methodologies are not privileged. But the district court did not hold that the Toolkit was privileged information; it merely held that discovery of all aspects of the Toolkit and its methodologies were not relevant and would be harmful to future ICAC investigations. And because Roberts provides no authority to the contrary, he has failed to show that the district court abused its discretion by denying discovery.
State v. Roberts, supra.  
It also pointed out that Roberts had not addressed the trial judge’s
alternative ground for denying the motion: that discovery of the Toolkit would not be useful in verifying that the files Roberts shared on Gnutella contained child pornography. See Salt Lake Cnty. v. Butler, Crockett & Walsh Dev. Corp., 2013 UT App 30, 297 P.3d 38 (Utah Court of Appeals 2013) (an appellate court `will not reverse a ruling of the trial court that rests on independent alternative grounds where the appellant challenges only one of those grounds’). As the district court reasoned, discovery of all of the Toolkit's SHA–1 values would not have been helpful to Roberts because the government relied on Nordstrom's review of the files, rather than on the Toolkit's SHA–1 values, to verify that those files contained child pornography.

Discovery of the Toolkit and its methodologies was therefore not material to Roberts' case. See State v. Spry, 2001 UT App 75, 21 P.3d 675 (Utah Court of Appeals 2001) (explaining that under the `good cause’ standard in Utah Rule of Criminal Procedure 16(a)(5), a defendant must `establish the materiality of the requested records to the case. . . )). Roberts has made no attempt to refute this basis for denying his motion.
State v. Roberts, supra.  
The Supreme Court therefore held that Roberts had failed to
meet his burden of persuasion on appeal. And where the district court permitted discovery of those aspects of the Wyoming Toolkit that were most relevant to Roberts' case, it did not abuse its discretion in denying discovery of the entire Toolkit database, its methodologies, and all of its SHA–1 values. We therefore affirm the district court's discovery ruling.
State v. Roberts, supra.  

Since it also rejected the other arguments he made on appeal, the Supreme Court affirmed Roberts’ conviction and sentence.  State v. Roberts, supra. The news story you can find here provides a little more information about the case, including the details of the “deal” Roberts struck with the prosecutors that had him plead guilty but retain the right to appeal.  It also notes the sentence that was imposed on him pursuant to the deal.

No comments: