United States District Court, D. Arizona
ORDER
David
G. Campbell Senior United States District Judge
Defendants
Anthony Espinosa Gonzales and Aaron Ordonez are charged in
two separate cases with distributing and possessing child
pornography in violation of 18 U.S.C. § 2252(a). Each
has filed a motion to compel disclosure of the Torrential
Downpour software program used by the FBI in the
investigation that led to his indictment. Doc. 25, No.
CR-17-01311; Doc. 32, No. CR-18-00539. Both motions are fully
briefed, and the Court held a joint evidentiary hearing on
January 31, 2019. Computer forensics expert Tami Loehrs
testified on behalf of Defendant Gonzalez, and FBI Agent
Jimmie Daniels testified for the government. The Court will
grant Defendant Gonzalez's motion in part and deny it in
part, and will deny Defendant Ordonez's motion.
I.
Background.
A.
The BitTorrent Network and Torrential Downpour.
The
indictments in these cases allege that Defendants downloaded
and shared child pornography files using the BitTorrent
file-sharing network. BitTorrent is an online peer-to-peer
network that allows users to download files containing large
amounts of data, such as movies, videos, and music. Instead
of relying on a single server to provide an entire file
directly to another computer, which can cause slow download
speeds, BitTorrent users can download portions of the file
from numerous other BitTorrent users simultaneously,
resulting in faster download speeds.
To
download and share files over the BitTorrent network, a user
must install a BitTorrent software “client” on
his computer and download a “torrent” from a
torrent-search website. A torrent is a text-file containing
instructions on how to find, download, and assemble the
pieces of the image or video files the user wishes to view.
The client software reads the instructions in the torrent,
finds the pieces of the target file from other BitTorrent
users who have the same torrent, and downloads and assembles
the pieces, producing a complete file. The client software
also makes the file accessible to the other BitTorrent users
in a shared folder on the user's computer.
Torrential
Downpour is law enforcement's modified version of the
BitTorrent protocol. Torrential Downpour acts as a BitTorrent
user and searches the internet for internet protocol
(“IP”) addresses offering torrents containing
known child pornography files. When such an IP address is
found, the program connects to that address and attempts to
download the child pornography. The program generates
detailed logs of the activity and communications between the
program and the IP address. Unlike traditional BitTorrent
programs, the government claims that Torrential Downpour
downloads files only from a single IP address - rather than
downloading pieces of files from multiple addresses - and
does not share those files with other BitTorrent users.
B.
The Investigations into Defendants' BitTorrent
Activity.
1.
Defendant Gonzales.
In
December 2016, Agent Daniels used Torrential Downpour to
identify IP address 24.255.44.200, which allegedly was making
known child pornography files available on the BitTorrent
network. Agent Daniels testified that he used Torrential
Downpour to connect with this IP address and download child
pornography video files on eight occasions between December
13, 2016 and January 9, 2017. He reviewed the Torrential
Downpour activity logs to confirm that the program downloaded
complete files solely from this IP address, and reviewed the
video files to confirm that they were child pornography.
Through
further investigation, Agent Daniels learned the subscriber
information for the IP address. He obtained a search warrant
for the subscriber's residence, and FBI agents searched
the residence on February 8, 2017. They found a Microsoft
tablet and other computer equipment. Gonzales, who lived
there with his parents and siblings, stated during an
interview that he had used a tablet to find and view child
pornography. Forensic examinations performed by the FBI and
Loehrs revealed child pornography files on the tablet, but
the video files that Torrential Downpour allegedly had
downloaded from the IP address were not found on the tablet
or any other seized device.
On
October 4, 2017, the government charged Gonzales with eight
counts of distributing child pornography and one count of
possessing such material. Doc. 6. The eight distribution
counts are based on the video files that Torrential Downpour
allegedly downloaded between December 13, 2016 and January 9,
2017. Id. at 1-5. The possession count is based on
the child pornography found on the tablet after the search.
Id. at 5-7.
2.
Defendant Ordonez.
Agent
Daniels conducted a similar investigation into Defendant
Ordonez's BitTorrent activity. On five occasions between
December 2, 2017 and February 5, 2018, Agent Daniels used
Torrential Downpour to connect with and download child
pornography files from IP address 24.251.70.98. The FBI
obtained a search warrant for the residence associated with
that IP address, and seized Ordonez's computer during a
search on April 4, 2018. The FBI performed a forensic
examination of the computer and found thousands of child
pornography files in the recycle bin, including the files
Torrential Downpour had downloaded. On April 17, 2018, the
government charged Ordonez with five counts of distributing
child pornography and one count of possessing such material.
Doc. 10.
II.
Discussion.
Defendants
contend that Torrential Downpour may be flawed and should be
tested and verified by a third party. They also contend that
they need access to the program in order to prepare effective
cross examination of Agent Daniels and the presentations by
their own computer experts. Defendants seek disclosure of an
installable copy of the software pursuant to Federal Rule of
Criminal Procedure 16, Brady v. Maryland, 373 U.S.
83 (1963), and Giglio v. United States, 405 U.S. 150
(1972). Gonzales also seeks disclosure of Torrential
Downpour's user and training manuals. Neither Defendant
seeks the program's source code.
The
government contends that Defendants have failed to show how
Torrential Downpour is material to their defense. The
government further contends that even if materiality has been
shown, Torrential Downpour is protected from disclosure by
the qualified law enforcement privilege recognized in
Roviaro v. United States, 353 U.S. 53 (1957).
A.
Rule 16(A)(1)(E)(i) - Items Material to Preparing a
Defense.
Under
Rule 16(a)(1)(E), the government must disclose any
“books, papers, documents, data, . . . or portions of
any of these items, if the item is within the
government's possession, custody, or control and: (i) the
item is material to preparing the defense[.]” To obtain
disclosure under subsection (i), “[a] defendant must
make a ‘threshold showing of materiality[.]'”
United States v. Budziak, 697 F.3d 1105, 1111 (9th
Cir. 2012) (citing United States v. Santiago, 46
F.3d 885, 894 (9th Cir. 1995)). “Neither a general
description of the information sought nor conclusory
allegations of materiality suffice; a defendant must present
facts which would tend to show that the ...