United States v. DiTomasso
United States v. DiTomasso
Opinion of the Court
OPINION AND ORDER
1. INTRODUCTION
Frank DiTomasso faces criminal charges for the production and transportation of child pornography. Much of the government’s case against DiTomasso depends on evidence found on his computer — evidence that he claims was obtained in violation of the Fourth Amendment. Accordingly, DiTomasso has moved to suppress (1) evidence obtained when internet service provider (“ISP”)
For the reasons set forth below, DiTo-masso’s motion to suppress is DENIED in part.
II. BACKGROUND
A. AOL Emails
DiTomasso has an AOL email account— [email protected]. When AOL users send or receive emails that contain attachments, AOL runs two background monitoring systems designed to scan for illicit material, including, but not limited to, child pornography.
AOL employs two different hashing programs. The first — the Image Detection and Filtering Process (“IDFP”) — -sweeps for one-to-one matches with known child pornography.
AOL’s second hashing program — “pho-toDNA” — looks for similarities among hash numbers.
On August 17, 2012, two emails intended for [email protected] were hashed and quarantined, giving rise to two corresponding NCMEC reports. The first email, which formed the basis of NCMEC report # 1560137, was hashed using pho-toDNA — and its contents were reviewed by an AOL employee.
B. AOL’s Privacy Policy
At the time of the disputed searches, AOL’s privacy policy and terms of use required users to assent to the following
C. Omegle Chats
Omegle.com is an online platform that “randomly pairs a user in a one-on-one session with a stranger, and allows strangers to communicate via text and video chats.”
On three separate occasions — November 30, 2012, January 4, 2013, and December 11, 2013 — snapshots of DiTomasso’s Ome-gle chats were flagged for evidence of child pornography. This led to the filing of three NCMEC reports: # 1704143, # 1741964, and # 2235394, respectively.
D. Omegle’s Privacy Policy
At the time of the disputed searches, Omegle’s privacy policy set forth the following conditions. First, Omegle’s policy explained that Omegle keeps “record[s] of the IP addresses involved in every chat,”
E. DiTomasso’s Probation
At the time of the disputed searches, DiTomasso was on probation in connection with a 2010 conviction for possession of child pornography.
III. APPLICABLE LAW
A. Expectations of Privacy in General
The Fourth Amendment to the United States Constitution protects “the right of the people to be secure ... against unreasonable searches and seizures.”
Constitutionally-recognized “expectations of privacy” differ in two important respects from the “mere expectation ... that certain facts will not come to the attention of the authorities.”
Second,.“a person has no legitimate expectation of privacy in information that he voluntarily turns over to third parties.”
B.Diminished Expectations of Privacy While on Probation
“Probationers and parolees are subject to ‘a degree of impingement upon privacy that would not be constitutional if applied to the public at large.’ ”
Elaborating on these principles, the Second Circuit has explained that “persons on supervised release who sign [] documents [consenting to future searches of their home] manifest an awareness that supervision can include intrusions into their residence and, thus, have ‘a severely diminished expectation of privacy.’ ”
C. Fourth Amendment Standing
“Fourth Amendment rights are personal rights which ... may not be vicariously asserted.”
D. Consent to Search
“[T]he ultimate touchstone of the Fourth Amendment is reasonableness.”
IV. DISCUSSION
A. DiTomasso’s Expectations of Privacy
In assessing DiTomasso’s expectations of privacy, three questions arise. First, did DiTomasso have an expectation of privacy in his electronic communications? Second, did DiTomasso’s probation agreement, granting his probation officer (or the officer’s designee) blanket permission to “inspect and access [his] computer at any time,”
1. Expectations of Privacy in Electronic Communications Generally
The government offers multiple theories why DiTomasso had no expectation of privacy in his electronic communications. First, the government maintains that by “broadcasting] his statements in the presence of others”
On the government’s logic, if DiTomasso were to disclose private information to a friend over the phone- — which, by the nature of the act, would cause DiTomasso to “assume[ ] the risk” that his friend might relay the information to law enforcement— he would have no expectation of privacy in the phone call, and no Fourth Amendment protection would apply. This reasoning was rejected by the Supreme Court in Katz v. United States,
Second, the government argues that even if DiTomasso had an expectation of privacy in the .emails, the same is not true of the chats, because the latter occurred in “a public chat room, which was open to all who cared to enter.”
This argument misunderstands how Omegle works. Although the company adopts the term “chatroom” to refer to its online platform, that platform is “a far cry from the public chat rooms that were popular [ ] years ago,” in which “a user [knew] that his comments are out there for the rest of the world to see.”
Third, the government suggests that DiTomasso had no expectation of privacy in his electronic communications because the ISPs responsible for facilitating those communications — -AOL and Ome-gle — warned him that they might be “monitor[ing]” his activity.
Along with the Sixth and Ninth Circuits, both of whom have addressed variations on this argument,
For example, the Supreme Court has held that employees, including public employees, enjoy an expectation of privacy in their workplace desks — and that the expectation stays intact vis-a-vis law enforcement even if it would be unreasonable, given the “operational realities” of the workplace, for employees to expect the same privacy protection from their supervisors.
Both of these holdings cut against the government’s position. In essence, the government argues that by consenting to have his emails and chats searched by AOL and Omegle — as DiTomasso arguably did when he agreed to their respective terms of use — he also consented to permitting the government to search. Fourth Amendment privacy, however, is a context-sensitive question of societal norms. In some domains, people expect information to stay shielded from law enforcement even as they knowingly disclose it to other parties. As the Supreme Court has recognized, workplace desks and hotel rooms are two such domains. In the digital age, electronic communication is another.
Moreover, the lower-court cases that the government cites — United States v. Hagood, from the Northern District of California, and United States v. Caraballo, from the District of Vermont — do not support its position. Neither case holds that users lack an expectation of privacy in the contents of digital communication. Rather, both cases are about expectations of
2. DiTomasso’s Probation Agreement Does Not Extinguish His Expectation of Privacy
The government argues that DiTomasso’s expectation of privacy in his computer&emdash;and by extension, in his emails and chats&emdash;was “severely diminished” by his probation agreement,
Even supposing the government is right, however, it requires a significant leap to conclude that DiTomasso had no expectation of privacy in his computer. Were that so, any government actor could continually surveil all of DiTomasso’s electronic communications without ever triggering Fourth Amendment scrutiny. This would be a radical extension of existing case law. If anything, the probation search cases are about a probationer’s expectations of privacy vis-a-vis his probation officer, not visa-vis all law enforcement.
If it had been DiTomasso’s probation officer who examined his chat history, or who looked through his emails, this might well be a different case. As it stands, however, I cannot conclude that DiTomas-so’s probation agreement extinguished his expectations of privacy vis-a-vis law enforcement in general.
3. AOL’s Interception of DiTomasso’s Emails Does Not Vitiate His Expectation of Privacy
Finally, the government argues that DiTomasso does not have “standing” to challenge the search of emails that “[he] never received.”
This arguments fails. For Fourth Amendment purposes, there is no basis for treating recipients of email differently from senders of email. Both have a reasonable expectation of privacy in the content of correspondence. If the government’s reasoning were correct, law enforcement officers could read a user’s incoming email with impunity, so long as they made sure to divert it from the user’s inbox before doing so. In other words, on the government’s logic, a search that might otherwise be subject to Fourth Amendment scrutiny — were the email in the recipient’s inbox — would escape Fourth Amendment scrutiny if law enforcement took the added step of seizing the email outright.
This, as DiTomasso rightly puts it, “is completely antithetical to the general public’s expectations of privacy.”
Nevertheless, a helpful parallel arises in cases involving the surveillance of prisoner mail. There, courts have assumed that prisoners have a privacy interest in all mail, regardless of whether it is incoming or outgoing — and any Fourth Amendment analysis proceeds from that assumption. If prisoners have an expectation of privacy in their incoming mail, it follows a fortiori that free citizens do as well.
B. DiTomasso Consented to Search of His Emails, But Not His Chats
Having established that DiTomasso had an expectation of privacy in the content of his electronic communications, the final question the Court must resolve is whether DiTomasso consented to a search of those communications by law enforcement. Because consent cases typically involve encounters between citizens and police officers, the voluntariness of agreement is often a source of controversy. Here, by contrast, there is no question that DiTo-masso voluntarily agreed to AOL’s and Omegle’s policies. The only question is what he consented to by doing so.
As the Supreme Court has explained, this question should be answered “objective[ly]”&emdash;by reference to what a “typical reasonable person [would understand]” AOL’s and Omegle’s policies to mean.
Omegle’s policy makes two references to “law enforcement.”
On these facts, I cannot conclude that DiTomasso consented to a search by Ome-gle in a law enforcement capacity. Ome-gle took snapshots of DiTomasso’s .chats and parsed them for content. Although that form of monitoring is referenced in the policy, it is mentioned exclusively as a means of “monitoring for misbehavior”
AOL’s policy is quite different. Not only does it explicitly warn users that criminal activity is disallowed,
Y. CONCLUSION
For the foregoing reasons, I conclude that DiTomasso had a reasonable expectation of privacy in the contents of his Ome-gle chats as well as his AOL emails. However, by agreeing to AOL’s terms of service, DiTomasso consented to a search of his AOL emails by law enforcement, thereby waiving his Fourth Amendment rights. Therefore, the two NCMEC reports arising from DiTomasso’s AOL emails, # 1560137 and # 1558963 — as well as any other evidence gathered as a result of those reports — are admissible under the Fourth Amendment.
The constitutional status of NCMEC reports # 1704143, # 1741964, and # 2235394 — the reports resulting from Omegle chats — remains unresolved. The next question this Court must address is whether Omegle’s monitoring of DiTomas-so’s chats was a “private search,” outside the bounds of constitutional protection, or whether it was a search carried out at the
SO ORDERED.
. The exact meaning of "Internet Service Provider” is unclear. Wikipedia defines the term broadly — to encompass not only entities that provide "internet service,” thereby allowing consumers to get online (such as Comcast and Time Warner), but also entities that provide internet-based services (such as Google and AOL). See "Internet Service Provider,” Wife-ipedia, available at http://en.wikipedia.org/wiki/ Internetservice-provider (last updated Sept. 24, 2014). The parties here have followed suit, adopting the broader interpretation. This Opinion does the same.
. Memorandum of Law in Support of Motion to Suppress, at 1.
. See Declaration of Greg Phillips, Senior Technical Security Investigator for the Public Safety and Criminal Investigation at AOL (“Phillips Decl.”), Exhibit ("Ex.”) F to Government's Memorandum in Opposition to the Motion to Suppress ("Opp. Mem.”), ¶-¶ 4-6.
. I'd. ¶ 5.
. See id. ¶¶ 7-8.
. See id. ¶ 7.
. See id. ¶ 9.
. I'd. ¶11.
. Id.
. See Opp. Mem. at 3.
. See id.
. AOL Terms of Service, Ex. I to Opp. Mem., at 1.
. AOL Member Community Guidelines ("AOL Guidelines”), Ex. G to Opp. Mem., at 1-2.
. AOL Privacy Policy, Ex. H to Opp. Mem., at 2.
. Declaration of Lief Brooks, Founder of Omegle.com, Ex. C to Opp. Mem., V 2.
. Id. It 3.
. Id. ¶4.
. Id.
. Id.
. Id.
. See Order and Conditions of Probation for Frank DiTomasso (“Probation Order”), Ex. J to Opp. Mem.
. Id. at 2 ¶ U.
. U.S. Const, amend. IV.
. See Katz v. United States, 389 U.S. 347, 360-62, 88 S.Ct. 507, 19 L.Ed.2d 576 (1967) (Harlan J., concurring).
. Id. at 361, 88 S.Ct. 507.
. United States v. Jacobsen, 466 U.S. 109, 122, 104 S.Ct. 1652, 80 L.Ed.2d 85 (1984).
. Hoffa v. United States, 385 U.S. 293, 302, 87 S.Ct. 408, 17 L.Ed.2d 374 (1966).
. Smith v. Maryland, 442 U.S. 735, 743-44, 99 S.Ct. 2577, 61 L.Ed.2d 220 (1979).
. Id. at 741, 99 S.Ct. 2577 (emphasis added).
. See id. V 5.
. See Opp. Mem. at 3.
. Omegle.com Privacy Policy (“Omegle Policy”), Ex. E to Opp. Mem. at 1.
. Id. In fact, users’ IP addresses are recorded with the explicit “inten[tion] [of] be[ing] used for the purpose of law enforcement.” Id.
. Id.
. Id.
. United States v. Newton, 369 F.3d 659, 665 (2d Cir. 2004) (citing Griffin v. Wisconsin, 483 U.S. 868, 875, 107 S.Ct. 3164, 97 L.Ed.2d 709 (1987)).
. 534 U.S. 112, 120, 122 S.Ct 587, 151 L.Ed.2d 497 (2001).
. Id. at 120 n. 6, 122 S.Ct. 587.
. Id.
. Newton, 369 F.3d at 665 (citing United States v. Reyes, 283 F.3d 446, 461 (2d Cir. 2002)).
. United States v. Lifshitz, 369 F.3d 173, 182 (2d Cir. 2004) (internal citations omitted).
. Alderman v. United States, 394 U.S. 165, 174, 89 S.Ct. 961, 22 L.Ed.2d 176 (1969).
. Rakas v. Illinois, 439 U.S. 128, 134, 99 S.Ct. 421, 58 L.Ed.2d 387 (1978).
. Brigham City v. Stuart, 547 U.S. 398, 403, 126 S.Ct. 1943, 164 L.Ed.2d 650 (2006) (internal citations omitted).
. United States v. Garcia, 56 F.3d 418, 422 (2d Cir. 1995) (emphasis added). Accord Schneckloth v. Bustamonte, 412 U.S. 218, 222, 93 S.Ct. 2041, 36 L.Ed.2d 854 (1973) ("[A] search conducted pursuant to a valid consent is constitutionally permissible.”).
. Garcia, 56 F.3d at 422 (quoting United States v. Wilson, 11 F.3d 346, 352 (2d Cir. 1993)).
. See Schneckloth, 412 U.S. at 241-42, 93 S.Ct. 2041 (explaining the differences between criminal procedure rights associated with trial, and criminal procedure rights associated with search). See also Ohio v. Robinette, 519 U.S. 33, 117 S.Ct. 417, 136 L.Ed.2d 347 (1996) (holding, inter alia, that a search can be consented to even if a defendant to be advised that he is "free to go”); United States v. Drayton, 536 U.S. 194, 122 S.Ct. 2105, 153 L.Ed.2d 242 (2002) (holding that a search can be consented to even if a defendant does not subjectively feel free to leave).
. Garcia, 56 F.3d at 422.
. Florida v. Jimeno, 500 U.S. 248, 250, 111 S.Ct. 1801, 114 L.Ed.2d 297 (1991).
. Probation Order at 2 ¶ U.
. Opp. Mem. at 11.
. United States v. Jacobsen, 466 U.S. 109, 117, 104 S.Ct. 1652, 80 L.Ed.2d 85 (1984) (emphasis added).
. See Katz, 389 U.S. at 356-57, 88 S.Ct. 507.
. Smith, 442 U.S. at 740, 99 S.Ct. 2577.
. Opp. Mem. at 11.
. Id.
. DiTomasso’s Reply Memorandum ("Rep. Mem.”), at 5.
. Opp. Mem. at 13.
. Id. at 12.
. Id. at 13.
. Id. at 12.
.See Warshak v. United States, 490 F.3d 455 (6th Cir. 2007) (holding that users have a reasonable expectation of privacy in the content of stored email), vacated en hanc on other grounds, 532 F.3d 521 (6th Cir. 2008); Quon v. Arch Wireless Operating Co., 529 F.3d 892 (9th Cir. 2008) (holding that users have reasonable expectation of privacy in text messages, despite advance warning that the messages could be read), rev'd on other grounds, 560 U.S. 746, 130 S.Ct. 2619, 177 L.Ed.2d 216 (2010).
. United States v. Jones, -U.S. -, 132 S.Ct. 945, 957, 181 L.Ed.2d 911 (2012) (Soto-mayor J., concurring).
. See O’Connor v. Ortega, 480 U.S. 709, 717-18, 107 S.Ct. 1492, 94 L.Ed.2d 714 (1987) ("[Although] [t]he operational realities of the workplace [] may make some employees’ expectations of privacy unreasonable when an intrusion is by a supervisor rather than a law enforcement official ... [the] [constitutional protection, against unreasonable searches by the government does not disappear merely because the government has the right to make reasonable intrusions in its capacity as employer.”).
.See Stoner v. California, 376 U.S. 483, 84 S.Ct. 889, 11 L.Ed.2d 856 (1964) (holding that searches of hotel rooms are subject to Fourth Amendment scrutiny despite the fact that “when a person [rents] a [] room he undoubtedly gives 'implied or express permission' to 'such persons as maids, janitors or repairmen' to enter his room ‘in the performance of their duties,’ ”) (internal citations omitted). See also Chapman v. United States, 365 U.S. 610, 81 S.Ct. 776, 5 L.Ed.2d 828 (1961) (holding the same with respect to an apartment).
. United States v. Hagood, No. 13 Cr. 393, 2014 WL 2918271, at *2 (N.D.Cal. June 26, 2014).
. See United States v. Caraballo, 963 F.Supp.2d 341, 361 (D.Vt. 2013). But see In re United States for an Order Authorizing the Release of Historical Cell-Site Infonnation, 809 F.Supp.2d 113 (E.D.N.Y. 2011) (holding that Fourth Amendment protection extends to cell-site location records).
. With respect to one of the electronic communications in dispute&emdash;the email hashed by IDFP, forming the basis of NCMEC report # 1558963&emdash;it appears that only the metada-ta was examined. Unlike the "photoDNA” program, which hashes for image and video attachments that are "similar” to known child pornography&emdash;and requires an AOL employee to screen the file manually&emdash;IDFP only finds exact matches, making it possible to send "an automatic report to [NCMEC]” without human review. Phillips Decl. ¶¶ 7, 11. In essence, IDFP is a mechanism for flagging images and videos that have already been transmitted through AOL, which means that the file is already known to be illicit.
To challenge the constitutionality of AOL's IDFP hashing program, DiTomasso must claim an expectation of privacy not in the content of his email, but rather in the "hash number” of an attached file. Whether he can do so is unclear: the constitutional status of digital metadata is currently in flux. Compare ACLU v. Clapper, 959 F.Supp.2d 724, 749-53 (S.D.N.Y. 2013) (holding, under Smith, that individuals do not have a reasonable expectation of privacy in telephony metadata), with Klayman v. Obama, 957 F.Supp.2d 1, 32 (D.D.C. 2013) ("I am convinced that the surveillance program now before me is so different from a simple pen register [in] Smith ... that bulk telephony metadata collection and analysis [violates] a reasonable expectation of privacy.”). Because I conclude that DiTo-masso consented to law enforcement search of his emails when he agreed to AOL’s terms of use, no ruling on the metadata issue is necessary.
. Opp. Mem. at 13.
. Probation Order at 2 ¶ U.
. See Reyes, 283 F.3d at 462 (focusing exclusively on home visits and searches by probation officers, not by law enforcement in general).
.In the Second Circuit, the rule is that consent-to-search provisions attenuate, but do not destroy, the need for a baseline level of suspicion in searches by probation officers. See Lifshitz, 369 F.3d at 181-82 (explaining that consent-to-search terms in probation agreements lessen expectations of privacy, but they do not give probation officers carte blanche to perform truly suspicionless searches); Newton, 369 F.3d at 665 (holding that probationers who sign consent-to-search agreements have a " 'severely diminished expectation of privacy' " in connection with their "supervision” by probation officers) (quoting Reyes, 283 F.3d at 461). See also U.S. v. Knights, 534 U.S. 112, 119-20, 122 S.Ct. 587, 151 L.Ed.2d 497 (2001) (explicitly reserving the question of whether a consent-to-search provision in a probation agreement “diminishe[s], or completely eliminate[s], [the probationer’s] expectation of privacy”).
. Opp. Mem. at 12.
. Id.
. Rep. Mem. at 3.
. See, e.g., United States v. Felipe, 148 F.3d 101, 107-08 (2d Cir. 1998) (assuming that the defendant, while in prison, had an expectation of privacy in both incoming and outgoing mail).
. Jimeno, 500 U.S. at 250, 111 S.Ct. 1801.
. Omegle Policy at 1.
. Id.
. Id.
. Id.
. Id.
. Id.
. See id. (explaining that snapshots of chats are sometimes “stored and used to improve Omegle’s monitoring process”). Not only does the policy itself distinguish between IP address records (kept for law enforcement
. See AOL Terms of Service at 1.
. AOL Guidelines at 1-2.
. AOL Privacy Policy at 2.
Reference
- Full Case Name
- United States v. Frank DiTOMASSO
- Cited By
- 3 cases
- Status
- Published