Opinion
3:21-cr-00011-MMD-WGC-1
01-20-2022
UNITED STATES OF AMERICA, Plaintiff, v. RYAN THOMAS ELEY, Defendant.
ORDER
MIRANDA M. DU CHIEF UNITED STATES DISTRICT JUDGE.
I. SUMMARY
Defendant Ryan Thomas Eley was indicted on two counts for receipt and possession of child pornography. (ECF No. 1.) Before the Court is Eley's motion to suppress all information obtained from his home pursuant to a search warrant because he argues that certain information included in that search warrant comes from unlawful searches that violated his Fourth Amendment rights. (ECF No. 36 (“Motion”).) Primarily because the two files viewed by Detective Gregory Sawyer and described in the challenged search warrant application fall within the private search exception to the Fourth Amendment's warrant requirement, and as further explained below, the Court will deny the Motion.
The government filed a response (ECF No. 41), and Eley filed a reply (ECF No. 42). Eley requested an evidentiary hearing on the Motion. (ECF No. 36 at 1.) The Court denies the hearing request because it finds a hearing unnecessary, as the Court cannot see how a hearing would lead to the Court reaching a different result than it reaches in this order.
II. FACTUAL BACKGROUND
The Court relies on documents filed by the parties in support of the Motion and related briefs to construct this factual background.
Google identifies and reports child sexual abuse imagery to the National Center for Missing and Exploited Children (“NCMEC”) in accordance with federal law. (ECF No. 36-1 at 4.) Each report submitted by Google to NCMEC is called a Cybertip. (ECF No. 36-3 at 4.) Between April and December 2019 NCMEC received nine Cybertips from Google regarding child pornography uploaded to Google accounts associated with IP addresses that return to the residence located at 265 Lupin Court, Sun Valley, Nevada. (Id. at 4.) As particularly pertinent to the Motion, Google sent NCMEC Cybertips with the report numbers 48545864 and 60635340. (Id. at 19-21.)
Defendant filed these two Cybertips as exhibits to his Motion. (ECF Nos. 36-1, 36-2.) Cybertip 48545864 reports that Google became aware of three files containing child pornography. (ECF No. 36-1 at 2.) As pertinent to the Motion, one of those files is 4903df20-8cea-4d17-ae49-fea6f67d2385.jpg. (Id. at 8.) For that file, the Cybertip includes the answer ‘yes' to the question, “Did Reporting ESP view entire contents of uploaded file?” (Id.) And this additional explanation is included elsewhere in that same report: “With respect to the portion of this CyberTip containing the heading: ‘Was File Reviewed by Company?', when Google responds ‘Yes' it means the contents of the file reported were viewed by a person concurrently to or immediately preceding the sending of the CyberTip.” (Id. at 4.) The Google employee who reviewed the file tagged it ‘B2' (id. at 8) which, as defined elsewhere in the Cybertip, means the file contains a lascivious exhibition of a pubescent minor (id. at 10). The Cybertip elsewhere states that NCMEC staff viewed the same file. (Id. at 14.)
Cybertip 60635340 reports that Google became aware of 64 files containing child pornography. (ECF No. 36-2 at 2.) As pertinent to the Motion, one of those files is Google-CT-RPT-a2a023de0c5c9685fe67a4902c50b4d7-VID-20170223-WA0052.mp4. (Id. at 7.) For that file, the Cybertip report includes the answer ‘yes' to the question, “Did Reporting ESP view entire contents of uploaded file?” (Id.) And this additional explanation is included elsewhere in that same report: “With respect to the portion of this CyberTip containing the heading: ‘Was File Reviewed by Company?', when Google responds ‘Yes' it means the contents of the file reported were viewed by a person concurrently to or immediately preceding the sending of the CyberTip.” (Id. at 4.) The Google employee who submitted this Cybertip tagged this file ‘B1' (id. at 7), which, as defined elsewhere in the report, means the file contains a sex act involving a pubescent minor (id. at 29). The Cybertip elsewhere states that NCMEC staff viewed the same file. (Id. at 35.) Finally, this Cybertip contains the following statement, “[a] NCMEC analyst has viewed the uploaded files and found what appears to be Apparent Child Pornography.” (Id. at 31.)
Detective Sawyer applied for a search warrant for 265 Lupin Court, Sun Valley, Nevada, along with any computers, hard drives, or the like in that house. (ECF No. 36-3.) United States Magistrate Judge William G. Cobb granted the application. (Id. at 26.)
Pursuant to the search warrant, Detective Sawyer and other officers seized several electronic devices from Eley's home. (ECF No. 36 at 3.) Forensic analysis of these devices allegedly revealed child pornography. (Id.) Eley also made incriminating statements to law enforcement about the contents of his electronic devices. (Id.)
Detective Sawyer included discussion of the two Cybertip reports described above in his application for the search warrant. (ECF No. 36-3 at 19-21.) Detective Sawyer opened the files 4903df20-8cea-4d17-ae49-fea6f67d2385.jpg and Google-CT-RPT-a2a023de0c5c9685fe67a4902c50b4d7-VID-20170223-WA0052.mp4 before submitting the search warrant application. (Id.) In the application, he describes the content of these two files and states that he believes they contain child pornography. (Id.) He goes on to explain that he used the information he got from Google in these two Cybertips to coordinate service of administrative subpoenas on Charter Communications, who, in turn, responded to those subpoenas stating that the IP address included in the subpoenas resolved back to account holder Ryan Ely 265 Lupin Court, Sun Valley, NV, 89433. Detective Sawyer concludes based on all of this information that Eley uploaded child pornography to various Google accounts. (Id. at 21.)
However, the application continues. In the next section, Detective Sawyer states that another detective, Detective Harris, downloaded multiple child pornography files via the BitTorrent network from the IP address that he eventually determined from his investigation into the Cybertips described above was associated with Eley. (Id. at 22.) Detective Sawyer provides descriptions of the contents of three of the files downloaded by Detective Harris to support his view that they contain child pornography. (Id.) He goes on to describe some additional investigation related to these BitTorrent downloads that led him to conclude that either Eley or someone else at his house had received or possessed child pornography. (Id. at 23.)
III. DISCUSSION
In his Motion, Eley argues that Detective Sawyer violated his Fourth Amendment rights when he opened the two files mentioned in the Cybertip reports that he described in the search warrant application (ECF No. 36 at 4), and Detective Harris' downloads using BitTorrent violated Eley's Fourth Amendment rights by intruding into an area that Eley intended to keep private (id. at 9). “Once the warrant affidavit is stripped of the fruits of Sawyer's unlawful viewing of the CyberTip images as well as the fruits of the direct download that was derived from Sawyer's actions, the warrant is devoid of probable cause.” (Id. at 9-10.) Eley accordingly asks the Court to suppress the fruits of the search warrant because it was not supported by probable cause. (Id. at 10.)
The government counters that Detective Sawyer's decision to open the two files mentioned in the search warrant application falls within the private search exception to the Fourth Amendment's warrant requirement because those two files were previously viewed by Google employees, and Detective Sawyer did not exceed the scope of that antecedent private search. (ECF No. 41 at 5-8.) For this reason, the government continues, there was sufficient material in the warrant application for probable cause even if Judge Cobb disregarded the information also included in it about the BitTorrent downloads. (Id. at 9.) However, and alternatively, the government also argues that Eley's assumptions about how Detective Harris' BitTorrent downloads worked in this case are incorrect, offering some explanation about how they worked. (Id. at 10-13.) The Court agrees with the government.
“The private search doctrine concerns circumstances in which a private party's intrusions would have constituted a search had the government conducted it and the material discovered by the private party then comes into the government's possession.” United States v. Wilson, 13 F.4th 961, 967 (9th Cir. 2021). The government bears the burden to show the private search exception to the Fourth Amendment's warrant requirement applies. See Id. at 971. The key question is whether the second search conducted by the government agent exceeded the scope of the first, private search. See id. at 971-72.
The parties and the Court agree that Wilson is the controlling case here. (ECF Nos. 36 at 4, 41 at 5.) However, there is a determinative difference between this case and Wilson, which, based on the Court's review of Wilson, is because Google submits two different types of Cybertips to NCMEC. This difference is also explained by Google in the two Cybertips Defendant submitted with his Motion:
With respect to the portion of this CyberTip containing the heading: ‘Was File Reviewed by Company?', when Google responds ‘Yes' it means the contents of the file reported were viewed by a person concurrently to or immediately preceding the sending of the CyberTip. When Google responds ‘No', it means that while the contents of the file were not reviewed concurrently to making the report, historically a person had reviewed a file whose hash (or digital fingerprint) matched the hash of the reported image and determined it contained apparent child pornography.(ECF No. 36-1 at 4; see also ECF No. 36-2 at 4 (including the same explanation).) From the background explanation provided by the Wilson court, that case involved Cybertips where Google responded, ‘no.' See 13 F.4th at 964-965. As described in Section II, above, the Motion centers on two files where Google checked ‘yes.' (ECF Nos. 36-1 at 8, 36-2 at 7.) Said otherwise, Wilson involved automatically submitted Cybertips where the hash value of the reported image matched the hash value of another image previously flagged as child pornography, whereas the Motion centers on two Cybertips submitted after a Google employee manually flagged the two particularly pertinent files (those described in the search warrant application) as child pornography. (Id.) See also Wilson, 13 F.4th at 965-66 (describing how the images at issue were automatically identified as child pornography, and the Cybertips were automatically generated).
Here, the Court finds that Detective Sawyer's opening of 4903df20-8cea-4d17-ae49-fea6f67d2385.jpg and Google-CT-RPT-a2a023de0c5c9685fe67a4902c50b4d7-VID-20170223-WA0052.mp4, and his subsequent description of the contents of the two files in the search warrant application, fall within the private search exception to the warrant requirement. The two pertinent Cybertips state that a Google employee viewed these files in full and applied tags to each file describing the type of suspected child pornography each contained before the Cybertips were submitted to NCMEC, and subsequently passed along to Detective Sawyer. (ECF Nos. 36-1 at 4, 8, 10, 36-2 at 4, 7, 29.) Thus, Detective Sawyer did not exceed the scope of those private searches when he, too, viewed the files in full and described their contents in the search warrant application. (ECF No. 36-3 at 19-21.) Accordingly, Detective Sawyer did not need to get a warrant before he opened 4903df20-8cea-4d17-ae49-fea6f67d2385.jpg and Google-CT-RPT-a2a023de0c5c9685fe67a4902c50b4d7-VID-20170223-WA0052.mp4, or when he described their contents in the search warrant application.
And while the Wilson court reversed the district court's denial of a motion to suppress, see 13 F. 4th at 980, Wilson actually supports denying the Motion. Generally speaking, the Wilson court emphasized how no human at Google had reviewed the files in question that the government agent opened and described in the pertinent search warrant application, and also discussed how the Wilson court lacked evidence of how Google's hashing software worked, expressing skepticism that the images included in the pertinent Cybertips were exact matches of images previously identified as child pornography. See Id. at 971-980. More specifically, the Wilson court discussed how the government agent's search exceeded the scope of the antecedent private search first “because it allowed the government to learn new, critical information that it used first to obtain a warrant and then to prosecute” the defendant, and second “because the government agent viewed [the defendant's] email attachments even though no Google employee-or other person-had done so, thereby exceeding any earlier privacy intrusion.” Id. at 971-72.
Neither of these sets of circumstances are present here. Starting with the second set of circumstances from Wilson first, here, a Google employee viewed the two files Detective Sawyer opened and described in the warrant application in their entirety before submitting the Cybertip report. See generally supra. Second, Detective Sawyer did not learn anything new when he opened up the files because a Google employee had already categorized them as containing a lascivious exhibition of a pubescent minor (ECF No. 36-1 at 8, 10) (as to 4903df20-8cea-4d17-ae49-fea6f67d2385.jpg) and containing a sex act involving a pubescent minor (ECF No. 36-2 at 7, 29) (as to Google-CT-RPT-a2a023de0c5c9685fe67a4902c50b4d7-VID-20170223-WA0052.mp4). Detective Sawyer's description of the contents of these two files in the search warrant application, albeit more graphic, is consistent with the tags already applied to them by the Google employee who reviewed each file. (ECF No. 36-3 at 20-21.) Thus, he did not learn anything new by opening up the files. Overall, Detective Sawyer did not exceed the scope of the private search performed by the Google employee or employees who reviewed the files and submitted the Cybertip reports when he opened them and described their contents in his search warrant application.
In reply, Eley argues that the Court should require the government to produce a witness from Google to confirm the statements in the Cybertip reports or present some evidence that Detective Sawyer directly communicated with the particular Google employee who submitted each Cybertip so that he knew the precise contours of the antecedent private search. (ECF No. 42 at 3.) Eley does not proffer any caselaw that directly supports these arguments. (Id.) As to the first point, the Court finds such testimony cumulative and therefore unnecessary-the Google employee or employees would merely be verifying the written contents of the Cybertips discussed throughout this order. The Court finds the Cybertips sufficient as written to support its finding that the private search exception applies here.
Similarly, as to Eley's other argument in his reply, the Cybertip reports are written to render direct communication between the particular Google employee and the particular law enforcement agent investigating the tip unnecessary. Most notably, the key question is phrased “Did Reporting ESP view entire contents of uploaded file?” (ECF No. 36-1 at 8 (emphasis added).) Detective Sawyer could reasonably infer from that unambiguous statement that a Google employee viewed the entire file. Thus, Detective Sawyer could view up to the entire contents of the file without exceeding the antecedent prior search. It is moreover logical that the Cybertip report form is thoughtfully constructed to obviate direct interaction between a particular employee of a reporting company like Google and a particular law enforcement agent because there were apparently “18.4 million CyberTips in 2018[.]” Wilson, 13 F.4th at 980. That would be a lot of meetings to schedule, even over the phone. Said otherwise, while the government bears the burden to show the private search exception applies, the government has met that burden here by showing Detective Sawyer's searches did not exceed the antecedent searches described in the pertinent Cybertips. Requiring something more than what the government has shown here would be unduly burdensome for law enforcement and reporting companies given the high annual volume of Cybertips.
Because the Court finds that Detective Sawyer's opening and description of the two files discussed in his search warrant application falls within the private search exception to the warrant requirement, the Court need not address Eley's other argument regarding the BitTorrent downloads. Even stripped of paragraphs seven, the reference to BitTorrent in paragraph eight, and paragraphs 36-40, the search warrant application would still support Judge Cobb's probable cause finding-most notably because of the two files Detective Sawyer described and stated he believed to contain child pornography that he was made aware of through the Cybertips, which he tied to Eley through a description of additional investigative work. (ECF No. 36-3 at 19-21 see also Id. at 4, 22-23 (describing the BitTorrent downloads).) Said otherwise, the Court need not rule on Eley's BitTorrent argument to deny the Motion.
But the Court nonetheless mentions that Eley's speculation about Detective Harris' use of BitTorrent in this case is based entirely on the Court's discussion of law- enforcement-only software called RoundUp used in a different case, United States v. Finigan, Case No. 3:19-cr-053-MMD-CLB (D. Nev. Filed Oct. 31, 2019), particularly a hearing transcript (ECF No. 42-1) from a hearing the Court held in that case. However, the Court has not seen anything in the record for this case indicating that Detective Harris used RoundUp for the BitTorrent downloads described in the search warrant application, and the government represents that the BitTorrent downloads described in the search warrant application operated differently than those using RoundUp at issue in Finigan (ECF No. 41 at 10-13.)
It is of course possible that the government is somehow concealing that Detective Harris also used RoundUp-though the Court is not accusing the government of doing so-but even if that were the case, it would not change the Court's core finding that the warrant was supported by probable cause because Detective Sawyer's opening and description of the two files discussed throughout this order falls within the private search exception in a way Wilson left open. Thus, the Court finds it unnecessary to delve deeper into Detective Harris' BitTorrent downloads, such as by giving the government the opportunity at a hearing to put on witnesses supporting the government's argument regarding the operation of Detective Harris' BitTorrent downloads. (ECF No. 41 at 10-13.)
The Court will accordingly deny the Motion.
IV. CONCLUSION
The Court notes that the parties made several arguments and cited to several cases not discussed above. The Court has reviewed these arguments and cases and determines that they do not warrant discussion as they do not affect the outcome of the Motion before the Court.
It is therefore ordered that Defendant Ryan Thomas Eley's motion to suppress (ECF No. 36) is denied.