United States v. Tolbert
United States v. Tolbert
Opinion of the Court
*1213This matter is before the Court on Defendant's Motion to Suppress Evidence Obtained in Violation of the Fourth Amendment Under United States v. Ackerman [Doc. 90] in which he asks the Court to suppress all evidence obtained either directly or indirectly as a result of the National Center for Missing and Exploited Children ("NCMEC") opening his emails and the attachments thereto. Defendant argues that under United States v. Ackerman ,
FINDINGS OF FACT
Defendant Donald Alvin Tolbert (hereafter, "Tolbert") has a 2006 state court conviction on two counts of criminal sexual contact of a child under age thirteen, among other charges. Tolbert served a term of years in prison until November of 2009, at which point he began serving concurrent terms of probation and parole. In 2010, the state arrested Tolbert for violating the terms of his probation and parole and reincarcerated him for 330 days. Then, the state released Tolbert a second time, subject to conditions of probation. As part of his release, Tolbert agreed to various standard conditions of probation, including allowing any probation or parole officer to visit him at his home or place of employment at any time, and permitting a warrantless search by the officer if he or she had reasonable cause to believe the search would produce evidence of a parole violation. Ex. A at 6-7. As a convicted sex offender, Tolbert also promised to provide all of his email addresses, usernames, and passwords to his probation officer. Ex. A at 3. Further, he agreed that any computer or electronic device to which Tolbert had access could "be examined for inappropriate content [which expressly included child pornography] at any time." Ex. A at 3.
On September 1, 2012, five emails with a total of fifteen attachments were sent through American Online ("AOL") by a user with the email address [email protected] -an email address allegedly belonging to Tolbert. See Exs. D1-D5 (NCMEC Cyber Tipline Report IDs 1576684, 1576685, 1576686, 1576688, and 1576689). Three of these emails were sent to a user with the email address [email protected]-also allegedly belonging to Tolbert. See Exs. D1, D2, and D3. The other two emails were sent to a third party email address, widd2703@web. de.
*1214Exs. D4 and D5. In accordance with its practice in 2012, AOL did not initially open or view the files attached to the emails. Trans. 4/25/18 at 35; Trans. 6/12/18 at 129-30, 135.
AOL's software also automatically prevented the five emails and their attachments from reaching their intended recipients, then terminated and saved a snapshot of the user's account. Trans. 4/25/18 at 8, 15. The entire process was fully automated, meaning no AOL employee opened or read the emails or attachments before AOL sent the CyberTip to NCMEC. Trans. 4/25/18 at 14, 18, 64; Trans. 6/12/18 at 128-30. However, in 2012 an AOL employee did open and view the email and attachments the next business day after the CyberTip was sent to NCMEC in order to confirm that the hashed image did in fact belong in AOL's database of images of child pornography. Trans 4/25/18 at 14. 35, 64; Trans. 6/12/18 at 130.
On September 5, 2012, NCMEC
NCMEC then forwarded the CyberTip reports containing those emails and attachments, as well as the results of its public record searches, to the New Mexico Attorney General's Office, Internet Crimes Against Children ("ICAC") division. See, e.g. , Ex. D1 at 216. The ICAC is the clearinghouse for CyberTips with a connection to New Mexico. Trans. 4/24/18 at 164. An analyst with the Attorney General's Office reviewed the CyberTips, including the hash-matched images, and ran open source searches regarding the associated IP address to determine that the source of the emails is in New Mexico. Id. at 168-170. Then, the analyst refers the CyberTips to the Special Agent in Charge, who assigns them to law enforcement for further investigation. Id. at 171. Certain types of cases, including those involving registered sex offenders on probation, take high priority. Id. at 172-73, 194-96.
On September 7, 2012, Special Agent Owen Pena of the AG's office was assigned to conduct an investigation regarding the five CyberTips relating to "Donald Alvin Tolbert." Trans. 4/24/18 at 180, 183, 193. By using open source searches on the IP address associated with the email addresses [email protected] and [email protected] listed in the CyberTip reports, Pena verified the geographical connection between the IP address and Albuquerque, New Mexico. Id. at 182-83. Using that information, Pena obtained grand jury subpoenas duces tecum for information associated with the IP address from ISP CenturyLink as well as information from AOL regarding the two email addresses. Id. at 183; Ex. J. AOL's response to the subpoena resulted in information linking [email protected] with "Donald Tolbert" at an address in Albuquerque, New Mexico, 87105. Id. at 184-85. Century Link responded to the subpoena with information linking the IP address with "Margaret Tolbert" at an address on 57th Street in Albuquerque, New Mexico. Id. at 186. Pena further found that the IP address associated with the above was also associated with an account on a Russian file uploading website, IMGSRC, under the name YUNGMUFFMAN. Id. at 187. That public account contained pictures of young girls, some of them naked. Id. at 187-88; Ex. L. The "real name" listed for the owner of the account was "Donnie," with the email address [email protected]. Ex. L. Under "user info," it states: "I love girls between 8-15. Someone told on me got my other 2 email accounts cancelled. AOL has something that reads your emails." Ex. L. After determining that the emails in the CyberTips were associated with Donald Tolbert, Pena called Tolbert's probation officer and confirmed that he was a registered sex offender on probation in New Mexico. Trans. 4/24/18 at 189-90.
Pena contacted Christina Altamirano, an agent with Homeland Security Investigations specializing in internet crimes against children and sexual exploitation crimes. Trans. 5/25/18 at 67-69; Trans. 4/24/18 at *1216190. Altamirano met with Pena and reviewed the evidence that he had obtained regarding Tolbert. Trans. 5/25/18 at 69-70. This included subscriber information from AOL and Century Link, as well as five NCMEC reports and associated videos. Using that evidence, Altamirano prepared and obtained search warrants for AOL regarding the two email addresses mentioned in the CyberTip reports, [email protected] and [email protected]. Id. at 71. These warrants revealed subscriber information for the two email addresses, along with IP addresses, times, and dates the accounts were used. Id. at 71-72; Exs. M and N. Similarly, Pena obtained search warrants for Tolbert's residence, as well as that of Tolbert's mother. Id. at 74; Trans. 4/24/18 at 190-91; Exs. K1 and K2. At Tolbert's residence, officials seized cell phones, a notebook, photographs, books and videos. Trans. 5/25/18 at 74. At his mother's home, they found two computers, a digital camera, and a cell phone. Id. at 75. Police found photos and videos depicting child pornography on the two computers seized at Tolbert's mother's home. Id. at 75-76.
After the Tenth Circuit released the Ackerman decision, the Rio Rancho police department obtained a new search warrant for the two computers without the benefit of the contents of the emails and the attached videos and images. Trans. 5/25/18 at 105. The computers were reexamined, and child pornography images and videos were again found on those machines. Id. at 76-77. In an interview, Margaret Tolbert told police that she and Defendant were the only ones with access to those computers. Id. at 79.
Altamirano testified in some detail, and with credibility, about the steps that she would have taken and the investigation she would have conducted if the CyberTips in this case had come to her without the opened emails and attachments (photos and videos) for her to examine. See Trans. 4/25/18 at 80-97. Altamirano explained that even without the emails and attachments, she still would have conducted an investigation that would have ended in obtaining the emails and attachments, as well as connecting them to Tolbert. Id. For example, Altamirano could have used the fact that AOL obtained a hash value match to obtain a search warrant for the emails and their attachments, as well as to obtained the name and address of the user associated with that account. Id. at 81-83. She also explained that once she had a name and address of the AOL account user, she could use law enforcement and open source databases to find out more information about that person. In this case, that information would have led Altamirano to Tolbert, and information about his prior criminal case. Id. at 83-86. Altamirano also admitted that she had never actually done this, as all of the NCMEC CyberTips she had worked with in the past contained opened emails and/or attachments. Id. at 99-100.
DISCUSSION
Tolbert moves to suppress "all evidence obtained directly or indirectly as a result of NCMEC's warrantless search." Doc. 90 at 9. He reasons that under the Tenth Circuit's decision in United States v. Ackerman ,
In its opposition to the motion to suppress, the Government relies on numerous arguments in support of the conclusion that the exclusionary rule does not apply.
*1217First, the government contends that Tolbert had no legitimate expectation of privacy in his emails because of both the terms of his probation and the terms of the AOL user agreement. Second, it contends that despite the Tenth Circuit's ruling to the contrary in United States v. Ackerman ,
The Court concludes that despite the fact that NCMEC opened the emails and attachments without a warrant, the evidence should not be suppressed because both the good faith and the inevitable discovery exceptions to the warrant requirement apply here. Having reached that conclusion, the Court will not reach the other arguments raised by the parties.
I. Legal Standard
The Fourth Amendment to our Constitution protects persons against unreasonable searches and seizures in their "persons, houses, papers, and effects." U.S. Const. amend. IV. "The basic purpose of this Amendment ... is to safeguard the privacy and security of individuals against arbitrary invasions by governmental officials." Camara v. Mun. Court of City & Cnty. of S.F. ,
II. The Ackerman Decision
On August 5, 2016, the Tenth Circuit issued its opinion in United States v. Ackerman ,
Once AOL identified a hash value match in Ackerman's email, the company forwarded a report to NCMEC's online CyberTipline. AOL's report included Ackerman's email along with all four attached images. A NCMEC analyst opened the email, viewed each of the attached images, and confirmed that all four (not just the one AOL's automated filter identified) appeared to be child pornography. After the analyst determined that Ackerman was the likely owner of the account, NCMEC alerted law enforcement agents in the area where he lived. A federal grand jury indicted Ackerman on charges of possession and distribution of child pornography.
There were two issues raised in the Ackerman case. First, Ackerman alleged that NCMEC's actions amounted to an unreasonable search of his email and its attachments because no one sought a warrant and no one invoked any recognized lawful basis for failing to seek one. Because the Fourth Amendment only protects *1218against unreasonable searches undertaken by the government or its agents, Ackerman's motion to suppress raised the question of whether NCMEC qualifies as a governmental entity or agent. The second issue was whether NCMEC merely repeated or actually exceeded the scope of AOL's investigation. This question arose because the Supreme Court's "private search" doctrine suggests the government does not conduct a Fourth Amendment "search" when it merely repeats an investigation already conducted by a private party like AOL.
As to the first issue, the Tenth Circuit held that the NCMEC is a governmental entity. The Court based this conclusion on five considerations. First, the court noted that NCMEC has law enforcement powers, and those powers extend well beyond those enjoyed by private citizens. NCMEC's two primary authorizing statutes- 18 U.S.C. § 2258A and
The Ackerman court then turned to the second issue, which was whether the *1219"private search doctrine" made the search permissible. The Supreme Court has concluded that even a "wrongful search ... conducted by a private party does not violate the Fourth Amendment." Walter v. United States ,
In Ackerman , the government attempted to analogize Jacobsen to the search NCMEC conducted on Ackerman's emails. The Tenth Circuit rejected this argument, stating:
Yes, AOL ran a search that suggested a hash value match between one attachment to Mr. Ackerman's email and an image AOL employees had previously identified as child pornography. But AOL never opened the email itself. Only NCMEC did that, and in at least this way exceeded rather than repeated AOL's private search. Neither is there any doubt NCMEC's search of the email itself quite easily "could [have] disclose[d]" information previously unknown to the government besides whether the one attachment contained contraband. Indeed, when NCMEC opened Mr. Ackerman's email it could have learned any number of private and protected facts, for (again) no one before us disputes that an email is a virtual container, capable of storing all sorts of private and personal details, from correspondence to other private (and perfectly legal) images, video or audio files, and beyond. And we know, too, that this particular container did contain three additional attachments, the content of which AOL and NCMEC knew nothing about before NCMEC opened them too. As far as anyone knew at the time, they could have revealed virtually any kind of noncontraband information to the prying eye.
Ackerman ,
However, the Tenth Circuit explicitly left open the questions of whether the third-party doctrine could preclude motions to suppress like Ackerman's, or that changes in how reports are submitted or reviewed might allow NCMEC to access attachments with matching hash values directly, without reviewing email correspondence or other attachments with possibly *1220private, noncontraband content-and in this way perhaps bring the government closer to a successful invocation of the private search doctrine. The court also left open the possibility that the government could cite exigent circumstances, the attenuation doctrine, the special needs doctrine, or the good faith exception to excuse warrantless searches or avoid suppression in at least some cases.
III. The Good Faith Exception
The government argues even if NCMEC's search of Tolbert's emails violated the Fourth Amendment, suppression is unwarranted because NCMEC and law enforcement officers acted in good faith. The Court agrees.
As the Supreme Court has explained, the purpose of the exclusionary rule is not to remedy a private wrong, but rather as a practical means of deterring future unlawful behavior by law enforcement. United States v. Calandra ,
In Leon , the Court applied the good faith exception because the officers acted in objectively reasonable reliance on a warrant issued by a magistrate. However, the good faith exception is not restricted to situations in which police officers rely upon a warrant later found to be invalid. For example, the Supreme Court has also held that the exclusionary rule should not be applied to suppress evidence obtained by officers who acted in objectively reasonable reliance on a statutory scheme that authorized warrantless administrative searches, even though the statute was later found to violate the Fourth Amendment. Illinois v. Krull ,
This case is similar to Krull in that there was a statutory scheme in place which expressly authorized NCMEC to open emails and attachments forwarded to it by ISPs and then forward the information obtained to members of law enforcement;
*1221nowhere in the statute does Congress require NCMEC to obtain a warrant. As the Tenth Court set forth in great detail in Ackerman , Congress created a detailed statutory scheme endowing NCMEC, an incorporated entity, Ackerman ,
What was a surprise to NCMEC, however, was the fact that it would be considered a government entity or government agent that was required to obtain a warrant prior to viewing emails and attachments contained in CyberTips. To the Court's knowledge, the First Circuit was the first federal court to suggest that NCMEC was a government agent; that ruling, in United States v. Cameron ,
Nor can this Court assert that NCMEC and law enforcement could not have reasonably relied either on the statutory scheme authorizing NCMEC to view the attachments to Tolbert's emails without a warrant, or on their apparent belief that NCMEC was a private entity. Although Tolbert argues that it should have been immediately obvious to the employees of NCMEC and to law enforcement agencies that NCMEC is a government agent, that argument is undermined by the fact that even the district court in United States v. Ackerman ,
*1222When Altamirano and Pena acquired the search warrants for AOL's records, Tolbert's home, and Margaret Tolbert's home, they had no reason to believe that AOL had provided NCMEC with information procured in violation of Tolbert's Fourth Amendment rights. There was no evidence NCMEC had exceeded the scope of its authority when it relied on the information AOL provided and opened the hash matched images. And, when the officers executed the search warrant on Tolbert's and his mother's respective homes, they had no reason to believe the warrants were obtained in violation of Tolbert's Fourth Amendment rights. When an officer relies on a warrant, a presumption exists that the officer acts in good faith. United States v. Cardall ,
Other federal district courts have reached the same conclusion in similar cases. For example, in United States v. Stratton ,
*1223In United States v. Keith ,
Congress has by statute given NCMEC's CyberTipline a significant role in the investigation and subsequent prosecution of child pornography crimes, and has directed that it be supported by government grants. While I have concluded that NCMEC conducts its CyberTipline program as an agent of law enforcement so that its inspections of the content of emails are subject to the Fourth Amendment, it still must be acknowledged that those who heretofore regarded NCMEC's role only as that of a private party, so that the Fourth Amendment was inapplicable, were not acting in willful or negligent disregard of constitutional principles, but rather pursuant to a view of NCMEC's statutorily sanctioned role and activity that was, under all the circumstances, objectively reasonable, just as the officers' view of the statutory scheme was found to be in Krull . In that case the Court explained that "evidence should be suppressed only if it can be said that the law enforcement officer had knowledge, or may properly be charged with knowledge, that the search was unconstitutional under the Fourth Amendment." Krull ,480 U.S. at 348-49 ,107 S.Ct. 1160 (internal quotation marks and citation omitted).
There is nothing in the record in this case that would suggest either NCMEC or the police or the magistrate who issued the warrant knew or ought to have known that by relying on the CyberTipline report they were doing something that was unconstitutional under the Fourth Amendment. No persuasive argument can be made that an organization like NCMEC needs to be deterred from acting in good faith in a way that is consistent with explicit congressional will.
Id. at 46. As required by Leon ,
In this case, suppression would have very little deterrent effect because the law enforcement officers involved had no knowledge, nor could they properly be charged with knowledge, that NCMEC was required to get a warrant before opening Tolbert's emails and attachments. At *1224the same time, there is a significant social cost if the evidence were to be suppressed. Thus, the Court concludes that the good faith exception applies and the motion to suppress should be denied. See also United States v. Reddick ,
For the first time in his written closing argument [Doc. 123], Tolbert relies on the Supreme Court's very recent decision in Carpenter v. United States , No. 16-402, --- U.S. ----,
In Carpenter , after the FBI identified the cell phone numbers of several robbery suspects, prosecutors were granted court orders to obtain the suspects' cell phone records under the Stored Communications Act. Among this information was cell-site location information (CSLI). Each time a phone connects to a radio antenna or "cell site," it generates a time-stamped record, or CSLI, which wireless carriers collect and store for their own business purposes. In Carpenter , wireless carriers produced CSLI for the defendant's phone, and the Government was able to obtain 12,898 location points cataloging Carpenter's movements over 127 days-an average of 101 data points per day. Carpenter moved to suppress the data, arguing that the Government's seizure of the records without obtaining a warrant supported by probable cause violated the Fourth Amendment. The Supreme Court agreed. It noted that individuals have a reasonable expectation of privacy in the whole of their physical movements, and that allowing government access to these types of comprehensive cell-site records without a warrant contravenes that expectation. The Court then noted that in United States v. Jones,
The information subpoenaed by law enforcement in this case is much more like the bank and telephone records in Miller and Smith than the comprehensive, detailed, and long-term location information in Carpenter . The grand jury subpoenas in this case (Ex. J) requested identifying information, such as the name and address of the person who opened the account, the date the account was opened, the detailed method of payment, telephone numbers used to access the internet, email address, connection address, IP address, and any identifying information. The privacy interest in this type of identifying data, which presumably any AOL or CenturyLink employee could access during the regular course of business, simply does not rise to the level of the evidence in Carpenter such that it would require law enforcement to obtain a search warrant. The grand jury subpoenas were valid.
Thus, the good faith exception applies, and the motion to suppress will be denied.
IV. Inevitable Discovery
Subject to a few exceptions, evidence obtained in violation of the Fourth Amendment will be suppressed under the exclusionary rule; the inevitable discovery doctrine is one such exception. United States v. Cunningham ,
In both Cunningham and United States v. Souza ,
In this case, the Government has met its burden to show that the evidence provided to NCMEC in the various CyberTips would have inevitably led law enforcement to obtaining a warrant and searching Tolbert's home even if NCMEC, Pena, and Altamirano had not opened the attachment *1226to Tolbert's email before doing so. In its various CyberTips to NCMEC, which contained only information collected by a private entity, AOL transmitted a significant amount of information regarding the email accounts of the senders, including the originating email addresses, the email addresses of the intended recipient(s), the names of the files that were hash-matched using AOL's IDFP, the hash values for those files, the IP addresses from which the emails originated, and the subjects of the emails. In this case, that included the email addresses [email protected] and [email protected], as well as the IP address 67.0.46.137. Then, a NCMEC analyst ran "open source" queries-that is, he or she used information available to members of the public online-with regard to the information described above. The open source query of the IP address showed that the sender's location was in Albuquerque, New Mexico and the internet service provider was Century Link. Searching the email address [email protected] showed a profile on IMGSRC for a user calling himself "YUNGMUFFMAN,"
At this point, without looking at the attachment in question or opening the emails themselves, the NMAGO would have had ample evidence to support probable cause for a search warrant to open the emails and their attachments, and for NMAGO to continue its own investigation. See Trans. 4/24/2018 at 202-204. In fact, this is what Pena did by conducting his own open source investigation (which also led him to Donald Tolbert, registered sex offender) and by securing grand jury subpoenas for the email addresses identified by AOL in the CyberTips. At that point, the evidence that AOL provided in response to the subpoena would have led law enforcement to Tolbert's residence, as well as to his mother's home-all without opening the emails or their attachments.
There are two additional sources of information that would have led to inevitable discovery of the evidence without opening the five emails or their attachments. They are the two additional CyberTips from AOL to NCMEC that are not the subject *1227of the motion to suppress. See Exs. B (CyberTip # 1522765) and C (CybertTip # 1544073). Those two CyberTips-dated July 18, 2012 and August 8, 2012, respectively-also both referred to emails containing images that AOL hash-matched with known child pornography.
Thus, the same evidence that Tolbert seeks to suppress would have been inevitably discovered through independent means. Accordingly, the motion to suppress will be denied
IT IS THEREFORE ORDERED that Defendant's Motion to Suppress Evidence Obtained in Violation of the Fourth Amendment Under United States v. Ackerman [Doc. 90] is DENIED.
The Court cites to the transcript, the date of the hearing, and the page number.
A "hash value" is a unique 32-character string of alphanumeric characters that is the result of an algorithm that has been applied to a particular photograph or video. Trans. 4/25/18 at 8-9; Trans. 6/12/18 at 125-26; Ex. E at ¶ 5. No two photographs or videos will produce the exact same 32-character hash value unless the two are identical; any change to a photo or video, no matter how small, will result in a different hash value. Trans. 4/25/18 at 16; Ex. E at ¶ 7. AOL maintains a database of hash value strings generated from photographs and videos containing known or suspected child pornography. Trans. 4/25/18 at 9-10, 57-58; Trans. 6/12/18 at 124; Ex. E at ¶ 7. AOL maintains a system known as "image detection filtering process," or IDFP, that scans its users' emails for hash values that are identical to those in AOL's database. Trans. 4/25/18 at 7-9; Trans. 6/12/18 at 123-24, Ex. E at ¶ 7. AOL did not develop this system at the behest of law enforcement. Trans. 4/25/18 at 13; Ex. E at ¶¶ 8-9, 18.
IP stands for internet protocol, and an IP address helps to locate where in the world a computer or other electronic device is being used. Trans. 4/24/18 at 63-64, 65-66.
NCMEC was created in 1984. Trans. 4/24/18 at 15, 25. It is a nonprofit organization whose mission is to help reunited families with missing children, to reduce child sexual exploitation, and to prevent child victimization. Id. at 15. NCMEC also focuses on training; safety and prevention; and child victim and family services. Id. at 16-17. NCMEC serves as a clearinghouse for information about missing and exploited children. Id. at 21, 115.
In contrast, at least one federal court had found prior to that time that NCMEC is a private entity that is not subject to the Freedom of Information Act's disclosure requirements. See Lazaridis v. U.S. Dep't of Justice ,
Sony received reports about the defendant in June and December of 2012, as well as in July of 2013. Id at 1234-35.
The Government presented evidence at the hearing that this username conveys that the owner is a man who likes the genitalia of young women. Trans. 4/25/2018 at 93-94, 97-98.
Reference
- Full Case Name
- United States v. Donald Alvin TOLBERT
- Cited By
- 2 cases
- Status
- Published