United States District Court, E.D. Pennsylvania
JAN E. DuBOIS, District Judge.
Defendant Javier Perez is charged in the Indictment with two counts of distributing child pornography, in violation of 18 U.S.C. § 2252(a)(2), and one count of possessing child pornography, in violation of 18 U.S.C. § 2252(a)(4)(B). Perez has moved to preclude the Government from introducing at trial physical evidence obtained during a search of his computer. An evidentiary hearing and oral argument on the Motion was held on May 1, 2015. For the reasons that follow, Perez's Motion is denied.
On October 15 and October 23, 2013, an undercover Federal Bureau of Investigation ("FBI") agent downloaded two files containing visual depictions of child pornography shared by a computer signed on to the Ares network. An investigation of the Internet Protocol ("IP") address which shared the downloaded files revealed that it was assigned to the home of Perez.
On March 19, 2014, FBI Special Agent Laura Pagel submitted an affidavit and applied for a warrant to search Perez's house for items related to the possession and distribution of child pornography. A warrant authorizing the search for and seizure of, inter alia, all "visual depictions" of child pornography "on whatever medium, " and documents, emails, records, notes, and other materials related to child pornography, was subsequently issued. (Def.'s Mot. to Suppress, Ex. A, 2.) On March 21, 2014, the warrant was executed, and agents seized one desktop computer and three thumbdrives from Perez's bedroom.
The Government employed the following search methodology to examine the seized items: The computer and thumbdrives were first delivered to the FBI's Computer Forensics Laboratory in Philadelphia. The first assigned case agent, Special Agent Andrea Manning,  requested that the forensic examiner process the computer and thumbdrives for various types of evidence, including: graphic and video files, files which matched known child pornography images (CVIP files), internet history, internet favorites, and mobile syncs and data. The FBI examiner, after making an exact digital copy of the seized evidence, loaded the copy of the digital evidence into Forensic Toolkit ("FTK"), a forensic analysis tool. The FTK software then catalogued and segregated the requested files into a viewable format. At the May 1, 2015 hearing, FBI examiner Donald Justin Price explained that the software "scans the entire computer system. It looks at every file and folder and it identifies it based on the file type. So it'll categorize it as a document, a video, a graphic file, so on and so forth." (Hearing Tr., May 1, 2015, 17.) The forensic software also compares the extension of each file with the source information of that file to identify if there is a mismatch. The program is thus able to identify and extract graphic images and video files, even if concealed in files with extensions that are not traditionally associated with those file types.
The examiner then reviewed the extracted data to filter out files that clearly fell outside the scope of the case agent's request, e.g. generic application icons. The extracted data included CVIP hits, directory file listings, email, items from the recycle bin, graphic and video files, internet artifacts, and various "favorites." A digital copy of only the extracted evidence was provided to the case agent for further review.
In February 2015, Special Agent Manning asked the FBI examiner for additional information from Perez's computer and thumbdrives with respect to the Ares peer-to-peer program. The examiner followed the same protocol as was followed in the first examination, and subsequently provided Special Agent Manning with information concerning incomplete and complete Ares downloads, search terms, shared files, and the install date. The Government contends that the extracted files provided by the FBI examiner constituted only a limited portion of all the data on Perez's computer and thumbdrives.
Special Agent Manning, and subsequently Special Agent Schreier, reviewed the extracted files to determine whether they contained evidence related to the possession and distribution of child pornography. At the May 1, 2015 hearing, Special Agent Schreier testified that their examination of the extracted files consisted of the following: they viewed graphic images, including those attached to emails, in a thumbnail version, and only opened them when it was believed that they contained evidence related to child pornography; opened and played short portions of video files; opened emails without attachments only if the subject line or sender gave them reason to believe that they contained evidence of child pornography; and opened and cursorily examined other extracted file types, e.g. internet history, to determine whether those files contained evidence that fell within the scope of the warrant and to identify the internet user at particular times. The case agents determined that approximately ten files on the computer contained visual depictions of child pornography. They also found a list of search terms on the computer related to child pornography, which had been used to search the Ares network software, and determined that the computer had Ares network software. The evidence was recovered from Perez's computer hard drive.
On November 13, 2014, a Grand Jury returned an Indictment charging Perez with two counts of distributing child pornography, in violation of 18 U.S.C. § 2252(a)(2), and one count of possessing child pornography, in violation of 18 U.S.C. § 2252(a)(4)(B).
Perez filed a Motion to Suppress the seized files on April 7, 2015. On May 1, 2015, the Court held an evidentiary hearing and oral argument on the Motion.
III. LEGAL STANDARD
"On a motion to suppress, the government bears the burden of showing that each individual act constituting a search or seizure under the Fourth Amendment was reasonable." United States v. Ritter, 416 F.3d 256, 261 (3d Cir. 2005) (citing United States v. Johnson, 63 F.3d 242, 245 (3d Cir. 1995)). The government must meet this burden ...