United States District Court, D. Arizona
ORDER
DAVID
G. CAMPBELL SENIOR UNITED STATES DISTRICT JUDGE
Defendant
Anthony Espinoza Gonzales is charged with distributing and
possessing child pornography in violation of 18 U.S.C. §
2252(a). Doc. 1. Following an evidentiary hearing on January
31, 2019, the Court granted in part Defendant's motion to
compel disclosure of the Torrential Downpour software the FBI
used in the investigation that led to his indictment. Doc.
51. Defendant moves to compel compliance with that order.
Doc. 54. The motion is fully briefed (Docs. 55-56, 63-65,
81), and the Court held an evidentiary hearing on August 16,
2019 (Doc. 82). For reasons stated below, the motion is
granted in part and denied in part.
I.
Background.
The
indictment alleges that Defendant distributed child
pornography files on eight occasions in December 2016 and
January 2017. Doc. 1 at 1-5. The government claims that
Defendant downloaded and publicly shared the files using
BitTorrent, an online peer-to-peer network that allows users
to download files containing large amounts of data, such as
movies, videos, and music. To download and share files over
the BitTorrent network, a user must install a BitTorrent
software “client” on his computer and download a
“torrent” from a torrent-search website. A
torrent is a text-file containing instructions on how to
find, download, and assemble the pieces of image or video
files the user wishes to view. Once the torrent is downloaded
to the BitTorrent client software, the software reads the
instructions in the torrent, finds the pieces of the target
files on the internet from other BitTorrent users who have
the same torrent, and downloads and assembles the pieces,
producing complete files. The client software also makes the
pieces of the files accessible over the internet to other
BitTorrent users by placing them in a shared folder on the
user's computer.
The
Torrential Downpour software is law enforcement's
modified version of the BitTorrent protocol. The software is
used to identify, on the BitTorrent network, internet
protocol (“IP”) addresses that have torrents
associated with known child pornography files. When such an
IP address is found, the software can be used to connect to
that address and attempt to download child pornography.
II.
The Court's Prior Order.
Defendant's
computer forensics expert, Tami Loehrs, testified at the
initial hearing in support of Defendant's motion to
compel. Docs. 41, 50. FBI Agent Jimmie Daniels testified for
the government. Id. Based in part on Loehrs's
testimony, the Court found that Torrential Downpour is
material to the defense under Rule 16(a)(1)(E)(i) because the
distribution charges are based on child pornography files
that Torrential Downpour purportedly downloaded over the
internet from Defendant's computer, but that were not
found on Defendant's computer when the FBI seized it
pursuant to a search warrant. Doc. 51 at 8-10. The Court
denied Defendant's request for a copy of Torrential
Downpour under Roviaro v. United States, 353 U.S. 53
(1957), given Agent Daniels's testimony that the
government's investigative efforts would be severely
hampered if a copy got into the wrong hands. Id. at
14-15. But given the substantial defense interest established
by Defendant, the Court concluded that Loehrs should be
granted access to Torrential Downpour to assist Defendant in
preparing the defense. Id. at 15. The Court adopted
the Rule 16 disclosure method authorized in United States
v. Crowe, No. 11 CR 1690 MV, 2013 WL 12335320, at *8
(D.N.M. Apr. 3, 2013):
[T]he defense expert [will be permitted] to examine the
software at issue at a designated law enforcement facility,
at a mutually convenient date and time, for as much time as
is reasonably necessary for the expert to complete her
examination. No. copies of the software shall be made. The
software shall not leave the custody of the law enforcement
agency that controls it. Any proprietary information
regarding the software that is disclosed to the defense
expert shall not be reproduced, repeated or disseminated in
any manner. Violation of [this] order shall subject the
defense expert and/or defense counsel to potential sanctions
by this Court.
Doc. 51 at 15.
Although
the Court concluded that Loehrs should be permitted to
examine Torrential Downpour given that the charged files were
not found on Defendant's computer when it was seized, the
Court rejected Defendant's argument that the software is
material to a Fourth Amendment challenge because Defendant
identified no evidence suggesting that the program accessed
non-shared space on his computer. Id. at 10.
III.
Defendant's Motion to Compel.
The
parties corresponded regarding their proposed testing
protocols for Torrential Downpour. Docs. 54-2, 54-3, 55-5.
Based on the government's April 9, 2019 letter and the
motion briefing, some issues have been resolved. A main point
of contention is whether Loehrs may access during testing the
Internet Crimes Against Children Task Force's Child
Online Protection System (“COPS”).
To
determine the accuracy and reliability of Torrential
Downpour, Loehrs proposes to perform nine tests: (1)
non-parsed torrents, (2) partially-parsed torrents, (3)
deleted torrent data, (4) unshared torrent data, (5)
non-investigative torrents, (6) files of interest, (7) single
source download, (8) detailed logging, and (9) restricted
sharing. Doc. 56-1 at 21-24. Tests one through six would each
conclude with a search of COPS for any investigative hits on
the suspect IP address and determine whether Torrential
Downpour attempts to connect with that address to download
data. Id. at 21-23. The government agrees to tests
seven, eight, and nine, which do not involve COPS. Docs. 54-5
at 4, 55 at 2.
Tests
one and two - non-parsed torrents and partially-parsed
torrents - are relevant to whether Defendant downloaded
complete files containing actual child pornography. The
government does not address the potential materiality of
these tests in its response to Defendant's motion.
See Doc. 55.
The
government objects to tests three and four because they would
assess whether Torrential Downpour accesses non-shared space
on the suspect computer, an issue the Court dealt with in its
prior order when it rejected Defendant's argument that
the software is material to a Fourth Amendment challenge.
Id. at 3; see Doc. 51 at 10.
Loehrs
wants to conduct tests five and six - non-investigative
torrents and files of interest - to determine whether
Torrential Downpour identified Defendant based solely on
torrent files of investigative interest. Doc. 56-1 at 4,
¶¶ 11-12. But Defendant does not explain in his
motion how this is material to the preparation of a defense.
To
facilitate tests five and six, Loehrs requests that the COPS
database be cloned and moved to a unique testing location on
the server. Doc. 56-1 at 21. The new database would then be
loaded with predefined lawful torrents known to be on the
suspect computer, and Torrential Downpour would be directed
to pull information from this “test database” and
identify lawful files. Id. Loehrs claims that a test
database should be used to avoid further dissemination of
child pornography. Id.
The
government objects to tests one through six, asserting that
COPS must be protected from disclosure. Doc. 55 at 3-4. The
government explains that public exposure of COPS could
compromise child exploitation investigations worldwide
because disclosure of the torrents being investigated by law
enforcement would enable child pornographers to evade law
enforcement detection and destroy evidence to thwart further
investigation. Id. The government further explains
that cloning and moving the COPS database, or building a
separate database from which to do testing, would require a
massive expenditure of resources. Id. at 4.
After
reviewing memoranda filed by the parties, the Court directed
them to provide supplemental briefing, with supporting
affidavit testimony as necessary, to refine the issues and
assist the Court in deciding Defendant's motion. Doc. 59.
The parties filed the briefing in late June 2019 (Docs.
63-65), and Defendant filed an additional brief shortly
before the August 16 hearing (Doc. 81). Loehrs testified at
the hearing in support of Defendant's motion. Detective
Robert Erdely, who helped create Torrential Downpour and is
the current administrator of COPS, testified for the
government. Doc. 82. Defendant filed a post-hearing brief on
August 19. Doc. 85.
IV.
Discussion.
A.
Torrential Downpour and Its Interaction with COPS.
In its
prior order, the Court described Torrential Downpour as
follows:
Torrential Downpour is law enforcement's modified version
of the BitTorrent protocol. Torrential Downpour acts as a
BitTorrent user and searches the internet for internet
protocol (“IP”) addresses offering torrents
containing known child pornography files. When such an IP
address is found, the program connects to that address and
attempts to download the child pornography. The program
generates detailed logs of the activity and communications
between the program and the IP address. Unlike traditional
BitTorrent programs, the government claims that Torrential
Downpour downloads files only from a single IP address -
rather than downloading pieces of files from multiple
addresses - and does not share those files with other
BitTorrent users.
Doc. 51 at 2-3.
The
government now explains that Torrential Downpour is really a
suite of software whose components include (1)
“Torrential Downpour Receptor, ” which the
government claims is not involved in this case, and (2) the
“Torrential Downpour program, ” which was used by
Agent Daniels in this case. Doc. 64 at 2-4; see ...