United States v. Gonzales

          ORDER

          David G. Campbell Senior United States District Judge

         Defendant Anthony Espinoza Gonzales is charged with distributing and possessing child pornography in violation of 18 U.S.C. § 2252(a). Doc. 1. On February 19, 2019, the Court granted in part his motion to compel disclosure of the Torrential Downpour software program the FBI used in the investigation that led to his indictment. Docs. 25, 51. He has now filed a motion to compel compliance with that order, to which the government has responded. Docs. 54, 55. The Court will require supplemental briefing on certain issues.

         I. The Court's Prior Order.

         Defendant's computer forensics expert, Tami Loehrs, testified at the evidentiary hearing in support of Defendant's motion to compel. See Docs. 41, 50. FBI Agent Jimmie Daniels testified for the government. See Id. Based in part on Loehrs's testimony, the Court found that Torrential Downpour is material to the defense under Rule 16(a)(1)(E)(i) because the distribution charges are based on child pornography files that Torrential Downpour purportedly downloaded from Defendant's computer but that were not found on the computer when it was seized by the FBI. Doc. 51 at 8-10.^[1] The Court denied Defendant's request for a copy of Torrential Downpour under Roviaro v. United States, 353 U.S. 53 (1957), given Agent Daniels's testimony that the government's investigative efforts would be severely hampered if a copy got into the wrong hands. Id. at 14-15. But given the substantial defense interest established by Defendant, the Court concluded that Loehrs should be granted access to Torrential Downpour to assist Defendant in preparing the defense. Id. at 15. The Court adopted the Rule 16 disclosure method authorized in United States v. Crowe, No. 11 CR 1690 MV, 2013 WL 12335320, at *8 (D.N.M. Apr. 3, 2013):

[T]he defense expert [will be permitted] to examine the software at issue at a designated law enforcement facility, at a mutually convenient date and time, for as much time as is reasonably necessary for the expert to complete her examination. No. copies of the software shall be made. The software shall not leave the custody of the law enforcement agency that controls it. Any proprietary information regarding the software that is disclosed to the defense expert shall not be reproduced, repeated or disseminated in any manner. Violation of [this] order shall subject the defense expert and/or defense counsel to potential sanctions by this Court.

Id. at 15.

         II. Defendant's Motion to Compel Compliance with the Court's Order.

         The parties have corresponded regarding their proposed testing protocols for Torrential Downpour. Docs. 54-2, 54-3, 55-5. Based on the government's April 9, 2019 letter and the motion briefing, it appears that most issues have been resolved. The main disagreement is whether Loehrs may access the Internet Crimes Against Children Child Online Protection System (“COPS”) during certain testing procedures.

         Defendant claims that COPS is the “database that Torrential Downpour relies upon to identify files of ‘suspected child pornography' and therefore is a critical element in testing the software.” Doc. 54 at 4. In her proposed testing protocol, Loehrs describes COPS and her request for access to the system as follows:

[COPS] is a web-based component of Torrential Downpour and its operation including retrieving information about torrents of investigative interest and reporting historical data back to law enforcement for further investigation. Access to the [COPS] database will simulate law enforcement's undercover BitTorrent investigation by facilitating the same search capabilities relied upon in [this case].

A unique login will be created by the government allowing access to the live [COPS] system in order to track and locate all information being reported by Torrential Downpour from the Suspect Computer, described below. At all times during the test, the login to [COPS] shall be monitored and controlled by the government.

Doc. 54-4 at 8.

         To determine the accuracy and reliability of Torrential Downpour, Loehrs proposes to perform nine tests: (1) non-parsed torrents, (2) partially-parsed torrents, (3) deleted torrent data, (4) unshared torrent data, (5) non-investigative torrents, (6) files of interest, (7) single source download, (8) detailed logging, and (9) restricted sharing. Id. at 7, 12-15. The government agrees to tests seven, eight, and nine, which do not involve COPS. Docs. 54-5 at 4, 55 at 2. The government notes that these tests will be conducted to determine whether Torrential Downpour conducts a single source download, correctly logs activity, and does not share files with others on the BitTorrent network. Doc. 55 at 2 (citing Doc. 54-8 ¶ 5). According to the government, this is the “heart of [the] Court's order of the defense being allowed to test the Torrential Downpour software, i.e. the single source download[.]” Id.

         Tests one through six would each conclude with a search of the COPS database for “any investigative hits on the Suspect IP Addresses and determine whether Torrential Downpour attempts to connect with the Suspect IP Address to download data.” Doc. 54-4 at 12-14. The government objects to tests three and four because they would assess whether Torrential Downpour ...