United States v. Gonzales

          ORDER

          DAVID G. CAMPBELL SENIOR UNITED STATES DISTRICT JUDGE

         Defendant Anthony Espinoza Gonzales is charged with distributing and possessing child pornography in violation of 18 U.S.C. § 2252(a). Doc. 1. Following an evidentiary hearing on January 31, 2019, the Court granted in part Defendant's motion to compel disclosure of the Torrential Downpour software the FBI used in the investigation that led to his indictment. Doc. 51. Defendant moves to compel compliance with that order. Doc. 54. The motion is fully briefed (Docs. 55-56, 63-65, 81), and the Court held an evidentiary hearing on August 16, 2019 (Doc. 82). For reasons stated below, the motion is granted in part and denied in part.

         I. Background.

         The indictment alleges that Defendant distributed child pornography files on eight occasions in December 2016 and January 2017. Doc. 1 at 1-5. The government claims that Defendant downloaded and publicly shared the files using BitTorrent, an online peer-to-peer network that allows users to download files containing large amounts of data, such as movies, videos, and music. To download and share files over the BitTorrent network, a user must install a BitTorrent software “client” on his computer and download a “torrent” from a torrent-search website. A torrent is a text-file containing instructions on how to find, download, and assemble the pieces of image or video files the user wishes to view. Once the torrent is downloaded to the BitTorrent client software, the software reads the instructions in the torrent, finds the pieces of the target files on the internet from other BitTorrent users who have the same torrent, and downloads and assembles the pieces, producing complete files. The client software also makes the pieces of the files accessible over the internet to other BitTorrent users by placing them in a shared folder on the user's computer.

         The Torrential Downpour software is law enforcement's modified version of the BitTorrent protocol. The software is used to identify, on the BitTorrent network, internet protocol (“IP”) addresses that have torrents associated with known child pornography files. When such an IP address is found, the software can be used to connect to that address and attempt to download child pornography.

         II. The Court's Prior Order.

         Defendant's computer forensics expert, Tami Loehrs, testified at the initial hearing in support of Defendant's motion to compel. Docs. 41, 50. FBI Agent Jimmie Daniels testified for the government. Id. Based in part on Loehrs's testimony, the Court found that Torrential Downpour is material to the defense under Rule 16(a)(1)(E)(i) because the distribution charges are based on child pornography files that Torrential Downpour purportedly downloaded over the internet from Defendant's computer, but that were not found on Defendant's computer when the FBI seized it pursuant to a search warrant. Doc. 51 at 8-10. The Court denied Defendant's request for a copy of Torrential Downpour under Roviaro v. United States, 353 U.S. 53 (1957), given Agent Daniels's testimony that the government's investigative efforts would be severely hampered if a copy got into the wrong hands. Id. at 14-15. But given the substantial defense interest established by Defendant, the Court concluded that Loehrs should be granted access to Torrential Downpour to assist Defendant in preparing the defense. Id. at 15. The Court adopted the Rule 16 disclosure method authorized in United States v. Crowe, No. 11 CR 1690 MV, 2013 WL 12335320, at *8 (D.N.M. Apr. 3, 2013):

[T]he defense expert [will be permitted] to examine the software at issue at a designated law enforcement facility, at a mutually convenient date and time, for as much time as is reasonably necessary for the expert to complete her examination. No. copies of the software shall be made. The software shall not leave the custody of the law enforcement agency that controls it. Any proprietary information regarding the software that is disclosed to the defense expert shall not be reproduced, repeated or disseminated in any manner. Violation of [this] order shall subject the defense expert and/or defense counsel to potential sanctions by this Court.

Doc. 51 at 15.

         Although the Court concluded that Loehrs should be permitted to examine Torrential Downpour given that the charged files were not found on Defendant's computer when it was seized, the Court rejected Defendant's argument that the software is material to a Fourth Amendment challenge because Defendant identified no evidence suggesting that the program accessed non-shared space on his computer. Id. at 10.

         III. Defendant's Motion to Compel.

         The parties corresponded regarding their proposed testing protocols for Torrential Downpour. Docs. 54-2, 54-3, 55-5. Based on the government's April 9, 2019 letter and the motion briefing, some issues have been resolved. A main point of contention is whether Loehrs may access during testing the Internet Crimes Against Children Task Force's Child Online Protection System (“COPS”).

         To determine the accuracy and reliability of Torrential Downpour, Loehrs proposes to perform nine tests: (1) non-parsed torrents, (2) partially-parsed torrents, (3) deleted torrent data, (4) unshared torrent data, (5) non-investigative torrents, (6) files of interest, (7) single source download, (8) detailed logging, and (9) restricted sharing. Doc. 56-1 at 21-24. Tests one through six would each conclude with a search of COPS for any investigative hits on the suspect IP address and determine whether Torrential Downpour attempts to connect with that address to download data. Id. at 21-23. The government agrees to tests seven, eight, and nine, which do not involve COPS. Docs. 54-5 at 4, 55 at 2.

         Tests one and two - non-parsed torrents and partially-parsed torrents - are relevant to whether Defendant downloaded complete files containing actual child pornography. The government does not address the potential materiality of these tests in its response to Defendant's motion. See Doc. 55.

         The government objects to tests three and four because they would assess whether Torrential Downpour accesses non-shared space on the suspect computer, an issue the Court dealt with in its prior order when it rejected Defendant's argument that the software is material to a Fourth Amendment challenge. Id. at 3; see Doc. 51 at 10.

         Loehrs wants to conduct tests five and six - non-investigative torrents and files of interest - to determine whether Torrential Downpour identified Defendant based solely on torrent files of investigative interest. Doc. 56-1 at 4, ¶¶ 11-12. But Defendant does not explain in his motion how this is material to the preparation of a defense.

         To facilitate tests five and six, Loehrs requests that the COPS database be cloned and moved to a unique testing location on the server. Doc. 56-1 at 21. The new database would then be loaded with predefined lawful torrents known to be on the suspect computer, and Torrential Downpour would be directed to pull information from this “test database” and identify lawful files. Id. Loehrs claims that a test database should be used to avoid further dissemination of child pornography. Id.

         The government objects to tests one through six, asserting that COPS must be protected from disclosure. Doc. 55 at 3-4. The government explains that public exposure of COPS could compromise child exploitation investigations worldwide because disclosure of the torrents being investigated by law enforcement would enable child pornographers to evade law enforcement detection and destroy evidence to thwart further investigation. Id. The government further explains that cloning and moving the COPS database, or building a separate database from which to do testing, would require a massive expenditure of resources. Id. at 4.

         After reviewing memoranda filed by the parties, the Court directed them to provide supplemental briefing, with supporting affidavit testimony as necessary, to refine the issues and assist the Court in deciding Defendant's motion. Doc. 59. The parties filed the briefing in late June 2019 (Docs. 63-65), and Defendant filed an additional brief shortly before the August 16 hearing (Doc. 81). Loehrs testified at the hearing in support of Defendant's motion. Detective Robert Erdely, who helped create Torrential Downpour and is the current administrator of COPS, testified for the government. Doc. 82. Defendant filed a post-hearing brief on August 19. Doc. 85.

         IV. Discussion.

         A. Torrential Downpour and Its Interaction with COPS.

         In its prior order, the Court described Torrential Downpour as follows:

Torrential Downpour is law enforcement's modified version of the BitTorrent protocol. Torrential Downpour acts as a BitTorrent user and searches the internet for internet protocol (“IP”) addresses offering torrents containing known child pornography files. When such an IP address is found, the program connects to that address and attempts to download the child pornography. The program generates detailed logs of the activity and communications between the program and the IP address. Unlike traditional BitTorrent programs, the government claims that Torrential Downpour downloads files only from a single IP address - rather than downloading pieces of files from multiple addresses - and does not share those files with other BitTorrent users.

Doc. 51 at 2-3.

         The government now explains that Torrential Downpour is really a suite of software whose components include (1) “Torrential Downpour Receptor, ” which the government claims is not involved in this case, and (2) the “Torrential Downpour program, ” which was used by Agent Daniels in this case. Doc. 64 at 2-4; see ...