Commonwealth v. Davis

176 A.3d 869

COMMONWEALTH of Pennsylvania

v.Joseph J. DAVIS, Appellant

No. 1243 MDA 2016

Superior Court of Pennsylvania.

Argued August 16, 2017

Filed November 30, 2017

Reargument Denied February 5, 2018

Michael C. Kostelaba, Public Defender, Wilkes–Barre, for appellant.

William R. Stoycos, PA Office of Attorney General, Harrisburg, for Commonwealth, appellee.

BEFORE: GANTMAN, P.J., PANELLA, J., AND FORD ELLIOTT, P.J.E.

OPINION BY FORD ELLIOTT, P.J.E.:

Joseph J. Davis appeals from the June 30, 2016 order granting the Commonwealth's pre-trial motion to compel appellant to provide the password that will allow access to his lawfully-seized encrypted computer. After careful review, we affirm.

The relevant facts and procedural history of this case are as follows. On October 10, 2015, law enforcement officials executed a search warrant at appellant's residence after it was determined that a computer with an IP address subscribed to appellant utilized peer-to-peer file sharing network, eMule, to share videos depicting child pornography. During the course of the search, law enforcement officials seized a password-encrypted HP Envy 700 desktop computer. The Forensic Unit of the Pennsylvania Office of Attorney General ("POAG") was unable to examine the contents of this computer due to the "TrueCrypt" encryption program installed on it and appellant has refused to provide the password to investigating agents.

On December 17, 2015, the Commonwealth filed a pre-trial "Motion to Compel Defendant to Provide Password for Encryption Enabled Device." On January 14, 2016, the trial court conducted an evidentiary hearing on the Commonwealth's motion. The testimony adduced at this hearing was summarized by the trial court as follows:

TESTIMONY OF SPECIAL AGENT [JUSTIN] LERI

On July 14, 2014, [POAG] Agent Leri was conducting an online investigation on the eDonkey2000¹ network for offenders sharing child pornography. On that date a computer was located that was sharing files believed to be sharing other files of child pornography. When the computer is located that is suspected of sharing these files, the IP address of that computer is recorded and one-to-one connection is made.

Agent Leri testified that the focus of the investigation was a device at IP address 98.235.69.242. This device had a 1–to–1 connection to the [POAG] as a suspect file, depicting child pornography. The agent was undercover in a peer to peer connection. Later that same day, the file from the suspect device was made available and downloaded through the direct connection to the law enforcement computer.

Special Agent Leri personally viewed the file identified as [boy+man] [MB]NEW!!Man&Boy 13Yo.mpg. He described it as a video, approximately twenty [-]six (26) minutes and fifty[-] four (54) seconds in length, depicting a young prepubescent boy. [Agent Leri's description of the contents of the video clearly established its extensive pornographic nature.] Officer Leri is certain that the video he watched came from [appellant's] computer. He attested that the law enforcement software is retrofitted for law enforcement and the software logs in the activity. The retrofit allows for one-to-one connection only. According to Agent Leri, what this means is that law enforcement is directly connected to the subject's computer and only the suspect's computer.

The IP address was registered to Comcast Communication. After obtaining a court order directing Comcast Cable to release the subscriber information, [appellant] was identified as the subscriber. The [POAG] then obtained a search warrant for the listed address. The warrant was executed on September 9, 2014. The agent testified that [appellant] waived his Miranda² rights and admitted that he did his time for prior pornography arrests. He then refused to answer any questions.

SPECIAL AGENT [DANIEL] BLOCK

Agent Block testified that he is a special agent assigned to the Child Predator Section of the [POAG]. On October 4, 2015, an online investigation on the eMule network for offenders sharing child pornography was being conducted. The internet provider was determined to be Comcast and an administrative subpoena was issued which revealed the billing information belonged to the billing address. The focus of the investigation was IP address 174.59.168.185, port 6350. The file was downloaded and viewed.

[Agent Block's testimony indicated that the video in question depicted a prepubescent boy between the ages of nine and eleven years old and clearly described the extensive pornographic content of the video.]

Special Agent Block indicated that the Log File provides the date and time of the download and the client user's hashtag which is unique to [appellant]. Again Comcast Cable identified, through a Court Order, the subscriber was [appellant]. A search warrant was prepared and executed at [appellant's] home. Agent Block executed a search warrant on [appellant] at his residence and gave [appellant] his Miranda warnings. While he was at [appellant's] home, [appellant] spoke to Agent Block telling him he resided alone at the apartment since 2006 and that he was hardwired internet services which are password protected. According to Agent Block, [appellant] stated he uses this service so no one else can steal his Wi–Fi. There was only one computer in the house and that [no]one else uses it.

[Appellant] told Agent Block that he was previously arrested for child pornography related crimes. His reasoning was that it is legal in other countries like Japan and [the] Czech Republic, and he does not know why it is illegal here. He stated "what people do in the privacy of their own homes is their own business. It's all over the Internet. I don't know why you guys care so much about stuff when people are getting killed and those videos are being posted."

Agent Block testified that [appellant's] IP address was used during downloads on the following dates: July 4, 2015; July 5, 2015; July 6, 2015; July 19, 2015; July 20, 2015, August 2, 2015; August 9, 2015; August 16, 2015; September 5, 2015; September 12, 2015; September 13, 2015; September 14, 2015; September 19, 2015; September 20, 2015; September 23, 2015; September 26, 2015; September 27, 2015; October 4, 2015; October 5, 2015; October 10, 2015; October 17, 2015; October 18, 2015 and October 19, 2015.

While transporting [appellant] to his arraignment, [appellant] spoke about gay, X-rated movies that he enjoyed watching. He stated that he liked 10, 11, 12 & 13 year olds, referring to them as, "[a] perfectly ripe apple." Agent Block requested that [appellant] give him his password. [Appellant] replied that it is sixty-four (64) characters and "Why would I give that to you?" "We both know what's on there. It's only going to hurt me. No f[* * *]ing way I'm going to give it to you."

TESTIMONY OF AGENT BRADEN COOK

After [appellant] was arrested and the various devices were confiscated, Agent Cook previewed the computer. The hard drive was found to contain a "TrueCrypt" encrypted protected password setup with TrueCrypt 7.1 aBootloader. The user must input the password for the TrueCrypt encrypted volume in order to boot the system into the Operating System.

Agent Cook stated that [appellant] told him that he could not remember the password. Moreover [appellant] stated that although the hard drive is encrypted, Agent Cook knows what is on the hard drive.

Trial court opinion, 6/30/16 at 3–7 (citations to notes of testimony omitted).

On February 11, 2016, appellant was charged with two counts of distribution of child pornography and two counts of criminal use of a communication facility.³ Thereafter, on June 30, 2016, the trial court granted the Commonwealth's motion to compel and directed appellant to supply the Commonwealth with the password used to access his computer within 30 days. (Trial court order, 6/30/16; certified record at no. 4.) In reaching this decision, the trial court reasoned that appellant's argument under the Fifth Amendment right against self-incrimination is meritless because "[his] act of [providing the password in question] loses its testimonial character because the information is a for[e]gone conclusion." (See trial court opinion, 6/30/16 at 13 (internal quotation marks omitted).)

On July 15, 2016, appellant filed a motion to immediately appeal the trial court's June 30, 2016 order. On July 19, 2016, the trial court granted appellant's motion by amending its June 30, 2016 order to include the 42 Pa.C.S.A. § 702(b) language.⁴

On July 21, 2016, appellant filed a timely notice of appeal, pursuant to Pa.R.A.P. 313(b).⁵ The trial court ordered appellant to file a concise statement of errors complained of on appeal, in accordance with Pa.R.A.P. 1925(b), on July 29, 2016. Thereafter, on August 8, 2016, this court entered an order directing appellant to show cause why the appeal should not be quashed. On August 17, 2016, appellant filed a timely Rule 1925(b) statement. Appellant then filed a response to our show-cause order on August 22, 2016. On September 27, 2016, the trial court filed a one-page Rule 1925(a) opinion that incorporated by reference its prior June 30, 2016 opinion. On October 5, 2016, this court entered an order denying appellant's July 15, 2016 motion, which we treated as a petition for permission to appeal, discharging the show-cause order, and referring the issue of appealability to the merits panel.

Appellant raises the following issue for our review:

Whether [a]ppellant should be compelled to provide his encrypted digital password despite the rights and protection provided by the Fifth Amendment to the United States Constitution and Article 1, Section 9 of the Pennsylvania Constitution ?

Appellant's brief at 4.

Before we may entertain the merits of appellant's underlying claim, we must first determine whether this court has jurisdiction to consider the appeal under Pa.R.A.P. 313. Although the Commonwealth has not raised a question regarding our jurisdiction over the trial court's...