22-1086 United States v. Johnson

UNITED STATES COURT OF APPEALS FOR THE SECOND CIRCUIT

August Term 2022

(Argued: February 17, 2023 Decided: February 27, 2024)

No. 22-1086

––––––––––––––––––––––––––––––––––––

UNITED STATES OF AMERICA,

Appellee,

-v.-

CORY JOHNSON,

Defendant-Appellant.

––––––––––––––––––––––––––––––––––––

Before: LIVINGSTON, Chief Judge, CARNEY, and BIANCO, Circuit Judges.

Defendant Cory Johnson challenges his conviction for production of child pornography, in violation of

(a), after the United States District Court for the District of Vermont (Crawford, C.J.) denied his motions (1) to suppress evidence derived from an examination of segregated digital data, seized pursuant and identified as responsive to a search warrant, that took place after sentencing in connection with an earlier prosecution; and (2) to dismiss the indictment as precluded by an earlier plea agreement. We conclude that the later review of digital data seized and segregated as within the scope of the search warrant did not violate the Fourth Amendment and therefore that the district court

1 correctly denied Johnson’s motion to suppress. We further agree with the district court that the plea agreement did not bar Johnson’s second prosecution. The district court thus properly declined to dismiss the indictment. Accordingly, we AFFIRM Johnson’s conviction.

FOR DEFENDANT-APPELLANT: DENNIS J. JOHNSON (Frank J. Twarog, Catamount Law PLLC, Burlington, VT, on the brief), The Law Office of Dennis J. Johnson, South Hero, VT.

FOR APPELLEE: EUGENIA A.P. COWLES, Assistant United States Attorney (Gregory L. Waples, on the brief), on behalf of Nikolas P. Kerest, United States Attorney for the District of Vermont, Burlington, VT.

DEBRA ANN LIVINGSTON, Chief Judge:

Defendant-Appellant Cory Johnson (“Johnson”) appeals from a May 12,

2022, judgment of the United States District Court for the District of Vermont

(Crawford, C.J.), convicting him of a single count of the knowing production of

child pornography in violation of

(a), and sentencing him to a term

of imprisonment of 240 months, to be followed by a 15-year term of supervised

release. When Johnson was first identified by federal authorities as trading child

sexual abuse material (“CSAM”) within an Internet chat group in 2018, the

execution of a search warrant at his South Burlington, Vermont home resulted in

the seizure of electronic media containing over 8,000 videos and over 6,000 images

2 of such material. Johnson was first indicted for the distribution of child

pornography but as the result of a plea agreement pled guilty to a superseding

information charging him only with the possession of child pornography. For

that crime, he was sentenced principally to a 45-month term of imprisonment. A

later review of previously seized and segregated digital data responsive to the

original warrant produced evidence that Johnson had not only possessed child

pornography in 2018 but had sexually assaulted his then two-and-a-half-year-old

daughter and filmed the abuse. Johnson was indicted on the present production

charge in 2019 and again pled guilty, this time reserving the right to appeal the

denial of his motions to suppress evidence and to dismiss the 2019 charge as

precluded by his 2018 plea agreement. As explained below, we conclude that

Johnson’s arguments on appeal are without merit. Accordingly, we affirm the

district court judgment.

I. Factual Background 1

1 The factual background presented here is taken principally from the complaints, indictments, and warrant applications in the two prosecutions of Johnson, as well as the parties’ filings, testimony and evidence before the district court at evidentiary hearings on the combined motions, and the district court’s pertinent opinions. See United States v. Johnson, No. 18-CR-41 (D. Vt.) (“2018 District Court Docket”), 2018 District Court Docket No. 1-3; 2018 District Court Docket No. 5-1; see also United States v. Johnson, No. 19-CR-140 (D. Vt.) (“2019 District Court Docket”), 2019 District Court Docket No. 29-8.

3 A. The 2018 Investigation

In March 2018, a North Carolina-based Homeland Security Investigations

(“HSI”) Special Agent infiltrated a chat group on Kik, a smartphone messaging

app, and obtained several videos of CSAM from a user named “textiles.” 2 Upon

consulting subscriber information subpoenaed from Kik and Comcast and

matching that information to a public Facebook page, the special agent came to

suspect that “textiles” was Johnson. Because Johnson lived in South Burlington,

Vermont, the information developed in North Carolina was forwarded for further

investigation to Vermont-based HSI Special Agent Caitlin Moynihan (“SA

Moynihan”).

After further querying a Vermont state law enforcement database,

conducting surveillance outside Johnson’s house, inspecting license plate

registrations, and verifying Johnson’s identity by tracking him down at his job

behind a Costco deli counter, SA Moynihan sought and obtained a warrant to

search Johnson’s home for CSAM and evidence of crimes involving child

pornography. See Supp. App’x 5–6. The warrant authorized the seizure of any

2 HSI is the primary investigative division of the U.S. Department of Homeland Security. See Homeland Security Investigations, ICE.gov, https://www.ice.gov/about- ice/homeland-security-investigations.

4 “records, documents, and items,” including any electronic devices, constituting,

in relevant part, “evidence, contraband . . . and property . . . used in violations of

Title 18 U.S.C. § 2252A, relating to material involving the receipt, distribution,

transportation and possession of child pornography.” Supp. App’x 5. Records

“bearing on the production . . . of any visual depictions of minors engaged in

sexually explicit conduct as defined in 18 U.S.C. § 2256” were also subject to

seizure. Supp. App’x 7. As for any electronic device found to contain CSAM,

the warrant authorized, inter alia, seizure of evidence “of who used, owned or

controlled” the device at the time such material was created, edited, or deleted;

evidence of the times the device was used; and “[c]ontextual information

necessary to understand” the material subject to seizure. Supp. App’x 8.

The search warrant was executed on March 20, 2018. HSI special agents

seized “multiple computers, cell phones, tablets, cameras, thumb drives, and other

electronic devices,” and Johnson was charged with distributing child pornography

the same day. App’x 27. A subsequent forensic review of the seized material,

completed in June 2018, revealed approximately 8,816 videos and 6,931 images of

CSAM on multiple devices, as well as other digital evidence falling within the

search warrant’s scope.

5 Originally charged with the distribution of child pornography, Johnson

entered into a written plea agreement with the Government in November 2018

pursuant to which he ultimately pled guilty to a single count of possession of child

pornography in violation of

(a)(4)(B). The agreement included

the following provision:

12. The United States agrees that in the event that CORY JOHNSON fully and completely abides by all conditions of this agreement, the United States will:

a. not prosecute him in the District of Vermont for any other criminal offenses known to the United States as of the date it signs this plea agreement, committed by him in the District of Vermont relative to his knowing possession or distribution of child pornography. . . .

App’x 69. Pursuant to Federal Rule of Criminal Procedure 11(c)(1)(C), the parties

stipulated to a term of imprisonment of 45 months. Johnson entered his plea on

January 4, 2019. The United States District Court for the District of Vermont

(Crawford, C.J.) imposed the 45-month sentence in May of 2019.

B. The 2019 Investigation

About a month later, SA Moynihan sent the National Center for Missing and

Exploited Children (“NCMEC”) copies of the contraband video and image files –

the CSAM – provided to her by the HSI forensic analyst who had located this

6 material on Johnson’s devices and flagged it as responsive to the search warrant. 3

This segregated material constituted a subset of the much larger body of digital

data on his various devices. Law enforcement agencies like HSI regularly submit

such material to NCMEC, which is organized as a private nonprofit but

established by Congress, 4 so that newly seized CSAM can be compared with

material in the NCMEC database in order to identify children not previously

known to law enforcement who might be at risk and to assist in obtaining

restitution for victims. 5 Ordinarily this review would have been conducted

during the investigatory phase of Johnson’s original prosecution, but SA

Moynihan forgot to send NCMEC the files until June. 6

3 HSI submitted 3,761 images and 3,653 video files to NCMEC after removing various duplicate CSAM files found on the multiple devices. 4 See Missing Children’s Assistance Act,

div. II, § 660,

(1984) (codified as amended at

et seq.). 5 NCMEC “maintain[s] a database of known collections of child pornography.” App’x 27. Its Child Victim Identification Program is used to compare investigative files with already-known CSAM images and videos in order to identify at-risk children and assist in providing restitution to victims by identifying the actual children depicted. 6 Based principally on SA Moynihan’s testimony at the suppression hearing, the district court found that this deviation from normal procedure was an oversight and that “[t]here is no basis for concluding that SA Moynihan intentionally postponed the submission of the file to NCMEC until the Government had secured a guilty plea and a conviction.” See App’x 28. Johnson does not challenge this factual finding on appeal.

7 After conducting its review over the summer, NCMEC notified SA

Moynihan that it had identified a video that was not already in its CSAM database.

In an email on September 4, 2019, NCMEC informed SA Moynihan that the video,

which depicted the sexual abuse of a toddler by an adult, appeared to have been

created near Burlington, Vermont. NCMEC based this determination on the

video’s metadata, which included GPS coordinates indicating that the video may

have been produced in South Burlington. 7 SA Moynihan retrieved and reviewed

the video file, which was originally located among the digital files on a cell phone

seized from Johnson. The video depicted an adult male abusing a young girl “by

rubbing his penis against her buttocks and ejaculating.” App’x 28. SA

Moynihan recognized Johnson’s voice in the video and believed the young child

to be about the age of Johnson’s daughter at the time the video was created. After

matching the GPS longitude and latitude coordinates provided by NCMEC to the

7 “Metadata” refers generally to digital information about other digital files including, e.g., a file’s author, the times it was modified, or – as is often the case for images and videos – the GPS coordinates where it was created. See 1 JAY E. GRENIG & WILLIAM C. GLEISNER, III, EDISCOVERY & DIGITAL EVIDENCE § 4:13 Metadata types (2023); Sharon D. Nelson & John W. Simek, Metadata in Digital Photos – Should You Care?, 87 WIS. LAW. 43 (2014). The video at issue had been identified as CSAM during HSI’s forensic analysis, but the GPS metadata had not previously been reviewed. At the time of HSI’s analysis, the forensic examiner could not have ascertained whether GPS data was embedded in the many videos identified as CSAM other than by going through them one at a time and using a different software than the software used to locate the contraband videos.

8 approximate location of Johnson’s house, SA Moynihan sought a second warrant

to again search Johnson’s home, this time looking for distinctive bedding that

appeared in the background of the video: a white and pink blanket; a yellow, pink,

and blue-flowered sheet; a pink pillow with flowers and butterflies; and fabric

decorated with a green elephant. 8

The second warrant issued in September 2019. When the execution of that

warrant turned up the bedding seen on video, the Government sought and

obtained an indictment from the Grand Jury charging Johnson with production of

child pornography in violation of

(a). The present prosecution

ensued.

8 Johnson had moved from one house to another since the first search, and since the video was apparently produced. The warrant application, which was for the new residence, stated that “it is common for individuals to move their belongings from one residence to a new residence” such that it remained probable Johnson still possessed the bedding. 2019 District Court Docket No. 29-8 at 9. As later conceded by the Government, the warrant application contained an error regarding the GPS coordinates. SA Moynihan attested that upon entering the coordinates into a Google Maps program, they “resolved back to a residence located at 7 Kingfisher Court in South Burlington,” which was Johnson’s former residence. App’x 28. In fact, the “pin” location in the Google Maps program was 1 Kingfisher Court, a nearby location. The district court determined that SA Moynihan had made an honest mistake and that “[a] search warrant application showing that the video found on Mr. Johnson’s cell phone was produced in the immediate vicinity of his prior address – but at 1 Kingfisher rather than 7 Kingfisher – would have been sufficient to support probable cause.” App’x 29–30.

9 II. Procedural History

Before the district court, Johnson sought to suppress the digital data seized

during the 2018 search and reviewed by NCMEC in 2019 (i.e., the CSAM video of

his daughter and its associated metadata), as well as the fruits of the 2019 search

of Johnson’s home, including the seized bedding. As relevant to this appeal,

Johnson argued that NCMEC, acting as a Government agent, violated the Fourth

Amendment by searching data beyond the scope of the 2018 warrant for evidence

of a new crime (i.e., production of child pornography, rather than distribution and

possession). Even if NCMEC’s search was within the scope of the initial warrant,

Johnson further urged, it still violated the Fourth Amendment because it was not

conducted within a reasonable time.

Johnson also sought dismissal of the 2019 indictment, arguing that the

production charge was precluded by his 2018 plea agreement and that the

Government had breached the agreement by prosecuting him again. Johnson

argued that the new charge ran afoul of the Government’s promise not to

prosecute him in the District of Vermont “for any other criminal offenses known

to the United States” as of the date it signed the plea agreement “committed by

him in the District of Vermont relative to his knowing possession or distribution

of child pornography.” United States v. Johnson, No. 19-CR-140 (D. Vt.) (“2019 10 District Court Docket”), Docket No. 20 at 9–12. He contended that even if the

production offense was not actually known to the Government, he nonetheless

reasonably expected that it was, and that the plea agreement should be interpreted

so as to uphold his reasonable expectation.

The district court denied the motions in October 2020 and June 2021 orders.

See 2019 District Court Docket No. 41 (the motion to dismiss); United States v.

Johnson, No. 19-CR-140,

(D. Vt. June 29, 2021) (the motion to

suppress).

As to the suppression motion, the district court concluded that even

assuming arguendo that NCMEC acted as an agent of law enforcement in

reviewing the CSAM in 2019, the Fourth Amendment was not violated. NCMEC

reviewed only known contraband, the district court concluded, in which Johnson

had no Fourth Amendment interest that could be infringed by the search, its

timing, or by any subsequent review of the same digital material by SA Moynihan.

The district court thus denied Johnson’s motion to suppress the video of his

daughter and its GPS metadata. The court also declined to suppress the items

recovered from Johnson’s home in the 2019 search pursuant to the second warrant,

concluding that no Fourth Amendment violation had occurred.

11 As to the motion to dismiss, the district court declined to dismiss the

indictment, holding that Johnson’s 2018 plea agreement did not preclude the

subsequent production charge for two independent reasons. First, the court

determined that the plea agreement excluded future prosecution only for crimes

“relative to knowing possession or distribution of child pornography” and that

“the new charges,” for production of child pornography, did not fall within this

prohibition. App’x 19, 23. The court reasoned that production of child

pornography is a fundamentally different crime than possession or distribution of

it, both in its legal elements and its ordinary understanding. See App’x 19

(comparing statutory elements and observing, “[m]aking a movie is

fundamentally different from going to the theatre”). Second, concluding that the

plea agreement prohibited the Government from prosecuting Johnson only for

“any other criminal offenses known to the United States as of the date it sign[ed]

[the] plea agreement,” the district court held that the new charges were “based on

new information which arrived after final judgment issued in the first case.”

App’x 18, 23. “Either reason,” the district court concluded, “is sufficient to defeat

[the] motion to enforce” the agreement. App’x 23.

12 The district court accepted Johnson’s conditional guilty plea on the

production charge and sentenced him to 240 months of imprisonment for that

crime, to be followed by a term of 15 years of supervised release. This appeal

followed.

DISCUSSION

Johnson contends on appeal that (1) the district court erred in denying his

motion to suppress because NCMEC’s review of the metadata associated with the

CSAM video of his daughter’s abuse, which prompted SA Moynihan’s review of

the video and her subsequent investigation, violated the Fourth Amendment; and

(2) the district court erred in denying his motion to dismiss the production

indictment because this second prosecution was barred by his earlier 2018 plea

agreement. Johnson argues that this Court should reverse the denial of his

suppression motion, order specific performance of the 2018 plea agreement, and

dismiss the second indictment with prejudice. For the following reasons, we

disagree.

I. The Suppression Motion

As to the suppression motion, Johnson argues that NCMEC acted as a

Government agent when reviewing his digital data and that the Government

violated the Fourth Amendment in conducting this review by searching for

13 evidence—namely, the GPS metadata—beyond the scope of the 2018 warrant, and

in order to investigate a crime not specified in that warrant. 9 Johnson further

contends that even if the examination of the metadata was within the scope of the

2018 warrant, the review of that data in September 2019 did not occur within a

constitutionally reasonable time after the issuance of the warrant in April 2018.

The district court thus erred, according to Johnson, in concluding that no Fourth

Amendment violation occurred, and that suppression was not warranted.

These claims are without merit. Assuming arguendo that NCMEC acted as

a Government agent in reviewing the CSAM files located on Johnson’s digital

devices and identified pursuant to the 2018 search warrant, it in no way violated

the Fourth Amendment in conducting this review. NCMEC examined digital

material that was responsive to the 2018 search warrant and that had already been

segregated from Johnson’s other digital information as falling within the warrant’s

scope. Neither NCMEC nor SA Moynihan violated the Fourth Amendment by

examining this previously-segregated, responsive digital information, nor,

contrary to Johnson’s claim, was this examination constitutionally unreasonable

9 Because his conditional plea agreement does not permit it, Johnson does not challenge the denial of his motion to suppress evidence seized pursuant to the 2019 search warrant (i.e., the bedding found in his home) except insofar as such evidence can be characterized as a fruit of the NCMEC search.

14 because of its timing. Accordingly, we affirm the order of the district court

denying Johnson’s motion to suppress.

* * *

As an initial matter, NCMEC’s review of the digital information provided

to it by SA Moynihan did not constitute a search for Fourth Amendment purposes,

even assuming arguendo that NCMEC acted as a Government agent in reviewing

this material. Pursuant to Federal Rule of Criminal Procedure 41(e)(2)(B), the

2018 search warrant authorized the seizure of electronic storage media for later

review “to determine what electronically stored information [fell] within the scope

of the warrant.” Fed. R. Crim. P. 41 Advisory Committee’s Note (2009) (noting

that Rule 41 “acknowledges the need for a two-step process” in which officers may

seize or copy a storage medium for later off-site review, given the large amounts

of information often contained in electronic storage media). After the seizure of

Johnson’s electronic storage devices, material responsive to the warrant was

identified during a forensic review that was completed in June 2018. The CSAM

examined by NCMEC in 2019 had thus already been identified as responsive and

segregated from the remainder of Johnson’s digital information.

When criminal investigators reexamine evidence that has lawfully been

seized pursuant to a warrant – returning to look again at a drug ledger, for 15 instance, or to perform lab tests on a blood-stained jacket – we do not ordinarily

view such investigative steps as constituting a new Fourth Amendment event.

To be sure, as this Court has said before, the seizure of electronic devices, which

“can give the government possession of a vast trove of personal information about

the person to whom [the devices] belong[], much of which may be entirely

irrelevant to the criminal investigation that led to the seizure,” is very different

from the seizure of a drug ledger or an item of clothing. United States v. Ganias,

(2d Cir. 2016). For this reason, the mere fact that digital material

has been lawfully collected does not in all circumstances permit the future review

of stored information. See United States v. Hasbajrami,

, 670 (2d Cir.

2019). That said, the general principle that law enforcement can reexamine

lawfully seized material during the course of an investigation without engaging

in a new search has clear application in a case like this, where stored data

responsive to a search warrant has been separated out from nonresponsive data,

and investigators return to reexamine only the responsive material in pursuit of

law enforcement ends.

Johnson argues that this case falls outside the general rule on the theory that

the 2018 search warrant did not, in fact, authorize the search for and seizure of the

16 metadata—including GPS information—associated with his CSAM. He asserts

that “[n]either the 2018 Affidavit nor warrant mention GPS,” and that “[n]either

GPS nor metadata were designated responsive to the warrant.” Appellant’s Br.

at 46, 48-49; Reply Br. at 26. Further, he says that NCMEC accessed his GPS data

only to prove that Johnson produced the CSAM video of his daughter and that such

a search necessarily exceeded the scope of the 2018 warrant, which was limited to

the search for evidence of possession or distribution of child pornography. Both

of these arguments are without merit.

We “look directly to the text of the search warrant to determine the

permissible scope of an authorized search.” United States v. Bershchansky,

(2d Cir. 2015). Here, the 2018 search warrant provides for the

seizure of

records, documents, and items that constitute evidence, contraband, fruits of crime, other items illegally possessed, and property designed for use, intended for use, or used in violations of Title 18 U.S.C. § 2252A, relating to material involving the receipt, distribution, transportation and possession of child pornography, in any form wherever it may be stored or found . . .

Supp. App’x 5. The warrant goes on to list a wide variety of electronic data

storage devices, making clear that both the devices and “any visual depictions of

child erotica and obscene visual representations of the sexual abuse of children in

17 any of the above”—i.e., the electronic CSAM files themselves – are subject to

seizure. Supp. App’x 6. The warrant also expressly authorizes the seizure of

“records bearing on the production” and “reproduction” of such depictions, not

only records reflecting transactions in visual depictions of minors engaged in

sexually explicit conduct. Supp. App’x 7. Finally, the warrant explicitly

provides for the seizure and search of,

[f]or any computer hard drive or other electronic media (hereinafter, COMPUTER”) found to contain information otherwise called for by this warrant . . . [e]vidence of who used, owned or controlled the COMPUTER at the time the things described in this warrant were created, edited, or deleted, such as logs, registry entries, saved usernames and passwords, documents, and browsing history . . . ; [e]vidence of the times the COMPUTER was used . . . ; [and] [c]ontextual information necessary to understand the evidence in this attachment[.]

Supp. App’x 8.

Together, these provisions in the 2018 search warrant can only be read to

authorize a search for the metadata embedded in files containing CSAM, even if

neither the terms “GPS” nor “metadata” themselves appear in the warrant. As

we have repeatedly observed in the context of digital searches, “[t]he Fourth

Amendment does not require a perfect description of the data to be searched and

seized,” and “it will often be impossible to identify in advance the words or

phrases that will separate relevant files or documents before [a] search takes 18 place.” 10 United States v. Ulbricht,

(2d Cir. 2017), abrogated on

other grounds by Carpenter v. United States,

(2018). Metadata is, by

definition, data about other data: it may reveal who “created, edited, or deleted”

digital data; identify when other data was accessed; and provide necessary

“[c]ontextual information . . . to understand” digital files. Supp. App’x 8. Such

evidence is expressly sought in the 2018 search warrant—and indeed defined more

carefully than a simple reference to metadata would have achieved.

Johnson’s response—that “[w]here a video is recorded has nothing to do

with whether it is [CSAM] or was received or transferred on the internet,”

Appellant’s Br. at 46 (emphasis added)—gives us no reason to distinguish between

GPS location information and metadata more generally. The warrant specifically

authorizes the seizure, among other things, of “[e]vidence of who used, owned or

controlled” any electronic storage device “found to contain information otherwise

called for by this warrant,” at the time such information—including CSAM—was

“created, edited, or deleted.” Supp. App’x 8 (emphasis added). And contrary to

10 Indeed, we have long recognized the same principle outside the digital context. See, e.g., United States v. Riley,

(2d Cir. 1990) (“It is true that a warrant authorizing seizure of records of criminal activity permits officers to examine many papers in a suspect’s possession to determine if they are within the described category. But allowing some latitude in this regard simply recognizes the reality that few people keep documents of their criminal transactions in a folder marked ‘drug records.’”).

19 Johnson’s claim, information as to the location at which child pornography is

produced is potentially relevant to identifying those who possess or distribute it,

as well as to establishing the requisite nexus to interstate or foreign commerce that

18 U.S.C. § 2252A, referenced in the 2018 search warrant, requires. More

generally, so long as a warrant seeking digital evidence is sufficiently particular—

as this one is—it may properly “be broad, in that it authorizes the government to

search . . . for a wide range of potentially relevant material.” Ulbricht,

; see also United States v. Purcell,

(2d Cir. 2020) (affirming

Fourth Amendment reasonableness of warrants authorizing broad searches of

both digital and non-digital locations “so long as probable cause supports the

belief that the location to be searched—be it a drug dealer’s home, an office’s file

cabinets, or an individual’s laptop—contains extensive evidence of suspected

crimes”). The GPS location data here thus falls comfortably within the search

warrant’s language, just as surely as does information regarding the dates the

CSAM video was modified or accessed. 11

11 Because we conclude that NCMEC’s search was authorized by the terms of the 2018 search warrant, we need not reach the district court’s conclusion that the GPS metadata, because associated with a digital file that is itself contraband, was also contraband, defeating Johnson’s claim to retaining any Fourth Amendment interest in this information.

20 Johnson’s remaining challenges to NCMEC’s retrieval of the GPS

information are similarly deficient. To the extent he argues that the NCMEC

review was infirm because it was motivated by the objective of finding evidence of

production of child pornography, rather than the possession or distribution of it,

this argument is foreclosed by the general Fourth Amendment principle that “[a]n

action is ‘reasonable’ under the Fourth Amendment, regardless of the individual

officer’s state of mind, ‘as long as the circumstances, viewed objectively, justify [the]

action.’” Brigham City, Utah v. Stuart,

(2006) (quoting Scott v.

United States,

(1978)). Here, the 2018 search warrant authorized

a search for the GPS location data at issue. In such circumstances, and assuming

arguendo that NCMEC acted as a Government agent in reexamining the material

earlier deemed responsive to that 2018 search warrant, the motivations of its

personnel are not relevant. See Horton v. California,

(1990) (“The

fact that an officer is interested in an item of evidence and fully expects to find it

in the course of a search should not invalidate its seizure if the search is confined

in area and duration by the terms of a warrant or a valid exception to the warrant

requirement.”); cf. Whren v. United States,

(1996) (“[T]he Fourth

21 Amendment’s concern with ‘reasonableness’ allows certain actions to be taken in

certain circumstances, whatever [an officer’s] subjective intent.”).

Johnson next argues that even assuming the GPS metadata fell within the

scope of the 2018 warrant, NCMEC’s retrieval of this information in 2019 violated

the Fourth Amendment because it was untimely, as “judged not just by the

passage of time, but also by the significance of the intervening events,” including

Johnson’s prosecution, guilty plea, and sentencing. Appellant’s Br. at 58. We

again disagree. Assuming arguendo that delays in the forensic examination of

digital material seized pursuant to a warrant might in some circumstances

implicate the Fourth Amendment, that is not the case here.

“The touchstone of the Fourth Amendment,” as we have said before, “is

reasonableness.” United States v. Miller,

(2d Cir. 2005) (alteration

omitted) (quoting United States v. Knights,

(2001)). To be sure,

“the Fourth Amendment’s proscription of unreasonable searches and seizures ‘not

only . . . prevent[s] searches and seizures that would be unreasonable if conducted

at all, but also . . . ensure[s] reasonableness in the manner and scope of searches

and seizures that are carried out.’” Lauro v. Charles,

(2d Cir.

2000) (alterations in original) (quoting Ayeni v. Mottola,

(2d Cir.

22 1994), abrogated on other grounds by Wilson v. Layne,

(1999)). Here,

however, NCMEC’s reexamination of digital material that had been timely

identified as responsive to the 2018 search warrant was not rendered

constitutionally infirm simply because Johnson’s prosecution, guilty plea, and

sentencing had already occurred. 12 The Government’s interest in locating child

victims and securing restitution for them was not extinguished at the conclusion

of Johnson’s prosecution. Nor was the Government’s ability to re-examine

lawfully seized digital information that had already been identified as responsive

to the 2018 search warrant.

III. The Plea Agreement

As to the motion to dismiss, Johnson argues that the Government was

precluded by the 2018 plea agreement from bringing the subsequent prosecution

for producing child pornography because this charge constitutes another offense

“relative to his knowing possession or distribution” of CSAM that was “known to

12 Moreover, even if NCMEC’s examination of the responsive material had been part of the original forensic review, the eighteen months between the seizure of Johnson’s devices and NCMEC’s review falls well within time periods courts have deemed constitutionally reasonable based on the circumstances in individual cases. See, e.g., United States v. Jarman,

(5th Cir. 2017) (holding a 23-month-long review reasonable under the circumstances).

23 the United States as of the date it signed the plea agreement.” 13 We review such

a claim de novo, interpreting the plea agreement in accordance with principles of

contract law. United States v. Wilson,

(2d Cir. 2019) (citing United

States v. Riera,

(2d Cir. 2002)). Factual findings are reviewed for

clear error. United States v. Yousef,

(2d Cir. 2003). To determine

whether the Government is in breach of the agreement, “we look both to the

precise terms of the plea agreement[ ] and to the parties’ behavior” and “seek to

determine what ‘the reasonable understanding and expectations of the defendant

[were] as to the sentence for which he had bargained.’” Wilson,

(quoting Paradiso v. United States,

(2d Cir. 1982)). In keeping with

the “delicate private and public interests that are implicated in plea agreements,”

we construe them “strictly against the Government.” United States v. Padilla, 186

13 Paragraph 12(a) of the 2018 plea agreement provides in relevant part as follows:

The United States agrees that in the event that CORY JOHNSON fully and completely abides by all conditions of this agreement, the United States will[] not prosecute him in the District of Vermont for any other criminal offenses known to the United States as of the date it signs this plea agreement, committed by him in the District of Vermont relative to his knowing possession or distribution of child pornography . . . App’x 69.

(2d Cir. 1999) (quoting United States v. Ready,

, 558–59 (2d

Cir. 1996)).

Applying these principles, we agree with the district court that Johnson’s

2018 plea agreement, pursuant to which he pled guilty to one count of knowing

possession of child pornography in violation of

, did not preclude

his subsequent prosecution for the production of child pornography, in violation

of

. Johnson’s claim to the contrary fails because the agreement’s

prohibition on further prosecution is limited to offenses “known to the United

States as of the date it sign[ed] th[e] agreement.” 14

At the start, as the district court observed, “[t]he evidence is undisputed”

that the Government learned of Johnson’s abuse of his toddler and his production

of child pornography only in September 2019, when SA Moynihan was notified by

NCMEC of the video Johnson had made. App’x 20. SA Moynihan testified at

the suppression hearing that on March 20, 2018, the day on which Johnson’s

devices were seized from his home, Johnson admitted to using Kik and looking at

child pornography from the age of 14 but denied that he had ever taken

14 Given this conclusion, we need not address the district court’s alternative finding that the 2018 plea agreement does not exclude prosecution for production of child pornography because production is not an offense “relative to knowing possession or distribution of child pornography.” App’x 19.

25 “inappropriate pictures of children” or “inappropriately touched children.” 2019

District Court Docket, Mot. to Suppress Hr’g Tr., Dkt. No. 53 at 12. The

presentence report (“PSR”), prepared in connection with Johnson’s sentencing for

possession of child pornography, describes his conduct as encompassing

possession and distribution of CSAM, but not production. And consistent with

the PSR, the Government informed the district court in its sentencing

memorandum that it was “not aware of any allegations of abuse within the

defendant’s home.” 15 Supp. App’x 16.

Johnson argues that the Government is properly held to have had

constructive knowledge of the abuse, as well as the video’s production, because

the video was among the vast collection of CSAM images and videos located on

his many devices. He relies principally on this Court’s cases addressing the

question whether the Government breaches a plea agreement when it advocates

for a sentence above the so-called Pimentel estimate in the agreement, “based on

information that the Government knew about at the time the plea was

15 In his own sentencing memorandum, Johnson admitted only “to having engaged in the surreptitious trading of [the] images and videos,” and urged imposition of the 45-month term contained in the plea agreement in light of the fact that, inter alia, he was the father of three small children who had provided him with a new purpose in life. Supp. App’x 10–11.

26 negotiated.”

F.3d at 163. But in the Pimentel context itself, these

cases do not stand for the proposition that knowledge of facts germane to a

Pimentel estimate should be imputed to the Government based on digital material

in its possession that has not been reviewed. 17 Indeed, deviation from a Pimentel

estimate may not constitute a breach of the plea agreement even when a change in

position is based on information about which the Government was fully aware at

the time the agreement was negotiated. United States v. Habbas,

, 272

16 A Pimentel estimate is an estimate of a defendant’s likely sentencing range under the United States Sentencing Guidelines and is included in plea agreements at our suggestion, to avoid a defendant’s unfair surprise at the Guidelines range. See United States v. Pimentel,

(2d Cir. 1991) (suggesting that the Government “inform defendants, prior to accepting plea agreements, as to the likely range of sentences that their pleas will authorize under the Guidelines”). 17 Johnson relies principally on Wilson and United States v. Palladino,

(2d Cir. 2003). In these cases, the Government was held to have breached a plea agreement by urging a sentence above the estimate, but in a context in which it relied on information that it not only possessed but had taken fully into account when the plea agreement was negotiated. Wilson, 920 F.3d at 166–67 (“the Government knew about [Defendant’s] activities and, based on that, made the conscious choice to exclude certain enhancements in the Government’s Guidelines estimate”); Palladino,

(“According to the Government, the information on the tape that served as the basis for the disputed enhancement was known to the Government at the time the plea agreement was signed.”). There was thus “little daylight,” as Wilson put it, between the information adduced at sentencing and that considered at the time of the plea negotiation. 920 F.3d at 165–66 (noting that the Government’s argument to sentence above the Pimentel estimate was “on the basis of information . . . well-known to the Government at the time it negotiated [the defendant’s] plea”). See also Palladino,

(noting that “the information on the tape” used by a “different Assistant United States Attorney” to urge sentencing above the Pimentel estimate was “known to the Government at the time the plea agreement was signed.”)

27 (2d Cir. 2008). “As with other questions of breached plea agreements,” as the

Wilson court put it, we look to “the precise terms of the plea agreements and to the

parties’ behavior,” seeking to determine “‘the reasonable understanding and

expectations of the defendant’” as to the bargained-for sentence, and with an eye

to avoiding unfairness and rectifying any bad faith act on the Government’s part.

Wilson,

(quoting Paradiso,

).

Here, such considerations do not cut in favor of Johnson’s position. The

language of the plea agreement is clear: the Government’s commitment is to not

prosecute Johnson in the District of Vermont “for any other criminal offenses

known to the United States” as of the date it entered into the agreement and

“committed by him in the District of Vermont relative to his knowing possession

or distribution of child pornography.” App’x 69 (emphasis added). The plea

agreement itself, as already made clear, does not reference the production of child

pornography. 18 As to the record, it is not only devoid of any indication that the

Government was aware of Johnson’s sexual abuse of his daughter and his

18 Indeed, its favorable terms further evidence the Government’s lack of knowledge of Johnson’s more serious production offense. Johnson, initially charged with distribution of child pornography and facing a five-year mandatory minimum sentence and up to 20 years of imprisonment, pled guilty to a lesser-included possession offense and received a negotiated below-Guidelines sentence of 45 months, notwithstanding the immense trove of CSAM that he possessed.

28 production of CSAM: it affirmatively reflects the Government’s understanding

that Johnson had not engaged in the abuse of children. In such circumstances,

Johnson could not harbor the reasonable expectation that the plea agreement

absolved him of future prosecution for the as-yet undiscovered crime of producing

CSAM. Johnson’s argument to the contrary is without foundation in our

precedent or in the factual circumstances of this case.

CONCLUSION

We have considered Johnson’s remaining arguments and conclude that they

are without merit. Accordingly, discerning no error in the district court’s orders

denying Johnson’s motions to suppress and to dismiss the indictment, we AFFIRM

the judgment of the district court.

29