United States v. Gonzales

          ORDER

          David G. Campbell Senior United States District Judge

         Defendants Anthony Espinosa Gonzales and Aaron Ordonez are charged in two separate cases with distributing and possessing child pornography in violation of 18 U.S.C. § 2252(a). Each has filed a motion to compel disclosure of the Torrential Downpour software program used by the FBI in the investigation that led to his indictment. Doc. 25, No. CR-17-01311; Doc. 32, No. CR-18-00539. Both motions are fully briefed, and the Court held a joint evidentiary hearing on January 31, 2019. Computer forensics expert Tami Loehrs testified on behalf of Defendant Gonzalez, and FBI Agent Jimmie Daniels testified for the government. The Court will grant Defendant Gonzalez's motion in part and deny it in part, and will deny Defendant Ordonez's motion.

         I. Background.

         A. The BitTorrent Network and Torrential Downpour.

         The indictments in these cases allege that Defendants downloaded and shared child pornography files using the BitTorrent file-sharing network. BitTorrent is an online peer-to-peer network that allows users to download files containing large amounts of data, such as movies, videos, and music. Instead of relying on a single server to provide an entire file directly to another computer, which can cause slow download speeds, BitTorrent users can download portions of the file from numerous other BitTorrent users simultaneously, resulting in faster download speeds.

         To download and share files over the BitTorrent network, a user must install a BitTorrent software “client” on his computer and download a “torrent” from a torrent-search website. A torrent is a text-file containing instructions on how to find, download, and assemble the pieces of the image or video files the user wishes to view. The client software reads the instructions in the torrent, finds the pieces of the target file from other BitTorrent users who have the same torrent, and downloads and assembles the pieces, producing a complete file. The client software also makes the file accessible to the other BitTorrent users in a shared folder on the user's computer.

         Torrential Downpour is law enforcement's modified version of the BitTorrent protocol. Torrential Downpour acts as a BitTorrent user and searches the internet for internet protocol (“IP”) addresses offering torrents containing known child pornography files. When such an IP address is found, the program connects to that address and attempts to download the child pornography. The program generates detailed logs of the activity and communications between the program and the IP address. Unlike traditional BitTorrent programs, the government claims that Torrential Downpour downloads files only from a single IP address - rather than downloading pieces of files from multiple addresses - and does not share those files with other BitTorrent users.

         B. The Investigations into Defendants' BitTorrent Activity.

         1. Defendant Gonzales.

         In December 2016, Agent Daniels used Torrential Downpour to identify IP address 24.255.44.200, which allegedly was making known child pornography files available on the BitTorrent network. Agent Daniels testified that he used Torrential Downpour to connect with this IP address and download child pornography video files on eight occasions between December 13, 2016 and January 9, 2017. He reviewed the Torrential Downpour activity logs to confirm that the program downloaded complete files solely from this IP address, and reviewed the video files to confirm that they were child pornography.

         Through further investigation, Agent Daniels learned the subscriber information for the IP address. He obtained a search warrant for the subscriber's residence, and FBI agents searched the residence on February 8, 2017. They found a Microsoft tablet and other computer equipment. Gonzales, who lived there with his parents and siblings, stated during an interview that he had used a tablet to find and view child pornography. Forensic examinations performed by the FBI and Loehrs revealed child pornography files on the tablet, but the video files that Torrential Downpour allegedly had downloaded from the IP address were not found on the tablet or any other seized device.

         On October 4, 2017, the government charged Gonzales with eight counts of distributing child pornography and one count of possessing such material. Doc. 6. The eight distribution counts are based on the video files that Torrential Downpour allegedly downloaded between December 13, 2016 and January 9, 2017. Id. at 1-5. The possession count is based on the child pornography found on the tablet after the search. Id. at 5-7.

         2. Defendant Ordonez.

         Agent Daniels conducted a similar investigation into Defendant Ordonez's BitTorrent activity. On five occasions between December 2, 2017 and February 5, 2018, Agent Daniels used Torrential Downpour to connect with and download child pornography files from IP address 24.251.70.98. The FBI obtained a search warrant for the residence associated with that IP address, and seized Ordonez's computer during a search on April 4, 2018. The FBI performed a forensic examination of the computer and found thousands of child pornography files in the recycle bin, including the files Torrential Downpour had downloaded. On April 17, 2018, the government charged Ordonez with five counts of distributing child pornography and one count of possessing such material. Doc. 10.

         II. Discussion.

         Defendants contend that Torrential Downpour may be flawed and should be tested and verified by a third party. They also contend that they need access to the program in order to prepare effective cross examination of Agent Daniels and the presentations by their own computer experts. Defendants seek disclosure of an installable copy of the software pursuant to Federal Rule of Criminal Procedure 16, Brady v. Maryland, 373 U.S. 83 (1963), and Giglio v. United States, 405 U.S. 150 (1972). Gonzales also seeks disclosure of Torrential Downpour's user and training manuals. Neither Defendant seeks the program's source code.

         The government contends that Defendants have failed to show how Torrential Downpour is material to their defense. The government further contends that even if materiality has been shown, Torrential Downpour is protected from disclosure by the qualified law enforcement privilege recognized in Roviaro v. United States, 353 U.S. 53 (1957).

         A. Rule 16(A)(1)(E)(i) - Items Material to Preparing a Defense.

         Under Rule 16(a)(1)(E), the government must disclose any “books, papers, documents, data, . . . or portions of any of these items, if the item is within the government's possession, custody, or control and: (i) the item is material to preparing the defense[.]” To obtain disclosure under subsection (i), “[a] defendant must make a ‘threshold showing of materiality[.]'” United States v. Budziak, 697 F.3d 1105, 1111 (9th Cir. 2012) (citing United States v. Santiago, 46 F.3d 885, 894 (9th Cir. 1995)). “Neither a general description of the information sought nor conclusory allegations of materiality suffice; a defendant must present facts which would tend to show that the ...