United States District Court, D. Arizona
ORDER
David
G. Campbell Senior United States District Judge
Defendant
Anthony Espinoza Gonzales is charged with distributing and
possessing child pornography in violation of 18 U.S.C. §
2252(a). Doc. 1. On February 19, 2019, the Court granted in
part his motion to compel disclosure of the Torrential
Downpour software program the FBI used in the investigation
that led to his indictment. Docs. 25, 51. He has now filed a
motion to compel compliance with that order, to which the
government has responded. Docs. 54, 55. The Court will
require supplemental briefing on certain issues.
I.
The Court's Prior Order.
Defendant's
computer forensics expert, Tami Loehrs, testified at the
evidentiary hearing in support of Defendant's motion to
compel. See Docs. 41, 50. FBI Agent Jimmie Daniels
testified for the government. See Id. Based in part
on Loehrs's testimony, the Court found that Torrential
Downpour is material to the defense under Rule 16(a)(1)(E)(i)
because the distribution charges are based on child
pornography files that Torrential Downpour purportedly
downloaded from Defendant's computer but that were not
found on the computer when it was seized by the FBI. Doc. 51
at 8-10.[1] The Court denied Defendant's request
for a copy of Torrential Downpour under Roviaro v. United
States, 353 U.S. 53 (1957), given Agent Daniels's
testimony that the government's investigative efforts
would be severely hampered if a copy got into the wrong
hands. Id. at 14-15. But given the substantial
defense interest established by Defendant, the Court
concluded that Loehrs should be granted access to Torrential
Downpour to assist Defendant in preparing the defense.
Id. at 15. The Court adopted the Rule 16 disclosure
method authorized in United States v. Crowe, No. 11
CR 1690 MV, 2013 WL 12335320, at *8 (D.N.M. Apr. 3, 2013):
[T]he defense expert [will be permitted] to examine the
software at issue at a designated law enforcement facility,
at a mutually convenient date and time, for as much time as
is reasonably necessary for the expert to complete her
examination. No. copies of the software shall be made. The
software shall not leave the custody of the law enforcement
agency that controls it. Any proprietary information
regarding the software that is disclosed to the defense
expert shall not be reproduced, repeated or disseminated in
any manner. Violation of [this] order shall subject the
defense expert and/or defense counsel to potential sanctions
by this Court.
Id. at 15.
II.
Defendant's Motion to Compel Compliance with the
Court's Order.
The
parties have corresponded regarding their proposed testing
protocols for Torrential Downpour. Docs. 54-2, 54-3, 55-5.
Based on the government's April 9, 2019 letter and the
motion briefing, it appears that most issues have been
resolved. The main disagreement is whether Loehrs may access
the Internet Crimes Against Children Child Online Protection
System (“COPS”) during certain testing
procedures.
Defendant
claims that COPS is the “database that Torrential
Downpour relies upon to identify files of ‘suspected
child pornography' and therefore is a critical element in
testing the software.” Doc. 54 at 4. In her proposed
testing protocol, Loehrs describes COPS and her request for
access to the system as follows:
[COPS] is a web-based component of Torrential Downpour and
its operation including retrieving information about torrents
of investigative interest and reporting historical data back
to law enforcement for further investigation. Access
to the [COPS] database will simulate law enforcement's
undercover BitTorrent investigation by facilitating the same
search capabilities relied upon in [this case].
A unique login will be created by the government allowing
access to the live [COPS] system in order to track and locate
all information being reported by Torrential Downpour from
the Suspect Computer, described below. At all times during
the test, the login to [COPS] shall be monitored and
controlled by the government.
Doc. 54-4 at 8.
To
determine the accuracy and reliability of Torrential
Downpour, Loehrs proposes to perform nine tests: (1)
non-parsed torrents, (2) partially-parsed torrents, (3)
deleted torrent data, (4) unshared torrent data, (5)
non-investigative torrents, (6) files of interest, (7) single
source download, (8) detailed logging, and (9) restricted
sharing. Id. at 7, 12-15. The government agrees to
tests seven, eight, and nine, which do not involve COPS.
Docs. 54-5 at 4, 55 at 2. The government notes that these
tests will be conducted to determine whether Torrential
Downpour conducts a single source download, correctly logs
activity, and does not share files with others on the
BitTorrent network. Doc. 55 at 2 (citing Doc. 54-8 ¶ 5).
According to the government, this is the “heart of
[the] Court's order of the defense being allowed to test
the Torrential Downpour software, i.e. the single source
download[.]” Id.
Tests
one through six would each conclude with a search of the COPS
database for “any investigative hits on the Suspect IP
Addresses and determine whether Torrential Downpour attempts
to connect with the Suspect IP Address to download
data.” Doc. 54-4 at 12-14. The government objects to
tests three and four because they would assess whether
Torrential Downpour ...