United States v. Bohannon

506 F.Supp.3d 907

USA, Plaintiff,

v.Wesley Steven BOHANNON, Defendant.

Case No. 19-cr-00039-CRB-1

United States District Court, N.D. California.

Signed December 11, 2020

Dan Karmel, Alexandra Shepard, United States Attorneys Office, San Francisco, CA, for Plaintiff.

David W. Rizk, Office of the Federal Public Defender, San Francisco, CA, for Defendant.

ORDER DENYING MOTION TO SUPPRESS

CHARLES R. BREYER, United States District Judge

Defendant Wesley Bohannon has been charged with possession of child pornography in violation of 18 U.S.C. §§ 2252(a)(4)(B), (b)(2). He now moves to suppress the fruits of: (1) Microsoft's automated search of files that Bohannon uploaded to his cloud storage account, which resulted in Microsoft reporting the presence of a child pornography image to the National Center for Missing & Exploited Children (NCMEC); (2) NCMEC's visual inspection of the image and identification of an office at California State University as the owner of the IP address associated with the Microsoft account; (3) San Francisco Police Department (SFPD) Sergeant Christopher Servat's visual inspection of the image; and (4) the SPFD's execution of a search warrant that authorized the SFPD to search Bohannon's Microsoft account.

The Court heard argument from the parties on December 9, 2020. The Court hereby denies Bohannon's motion to suppress.

I. BACKGROUND

Microsoft is a private company that, among many other businesses, offers consumers a cloud file storage service called OneDrive. OneDrive allows users to upload digital files and access those files across devices. See Mot. to Suppress (dkt. 63) at 2. Microsoft's "Code of Conduct" requires OneDrive users to agree not to engage in unlawful acts or "any activity that exploits, harms, or threatens to harm children." See Services Agreement (dkt. 71-3) at 135. It also states that Microsoft "reserves the right to review Your Content" when "investigating alleged violations of these terms." Id. Microsoft's Services Agreement requires users to agree to "consent to Microsoft's collection, use, and disclosure" of their content and data "as described in [a] Privacy Statement." Id. at 160. The Privacy Statement informs users that Microsoft will "access, transfer, disclose, and preserve personal data, including ... files in private folders on OneDrive" when Microsoft has "a good faith belief that doing so is necessary to ... enforcing the terms governing the use of the services." Privacy Statement (dkt. 71-4) at 422–23.

The National Center for Missing & Exploited Children (NCMEC), a nonprofit corporation, operates a "CyberTipline" that receives reports of child sexual exploitation, including child pornography. See Shehan Affidavit (dkt. 71-1) ¶¶ 2–3. Microsoft has supported NCMEC in various ways. For example, Microsoft helped found NCMEC's "public-private Technology Coalition," which is meant to "facilitate information-sharing and cooperation among industry and law enforcement." Mot. to Suppress at 7 (citation omitted). And although NCMEC is "primarily financed by the U.S. Department of Justice ... Microsoft has made donations to NCMEC worth millions of dollars over the years." Id. at 8.

Whenever Microsoft obtains "actual knowledge" that a user's conduct constitutes an "apparent violation" of certain statutory provisions criminalizing offenses relating to child pornography, federal law requires Microsoft to report information about the violation to NCMEC's CyberTipline. See 18 U.S.C. § 2258A(a) – (b). NCMEC has broader obligations than Microsoft—federal law requires "its collaboration with federal (as well as state and local) law enforcement in over a dozen different ways." United States v. Ackerman, 831 F.3d 1292, 1296 (10th Cir. 2016). For example, NCMEC has statutory obligations to maintain the CyberTipline or its equivalent and to forward any report it receives to law enforcement agencies. 18 U.S.C. § 2258A(c).

On December 14, 2017, Microsoft submitted a "CyberTip" to NCMEC stating that Microsoft had located child pornography on a user's OneDrive account eight days earlier. See CyberTip Report (dkt. 64-1) at WSB-192. Microsoft's PhotoDNA system, which uses image file hash values to automatically compare users’ uploaded images to known child pornography images, had identified the child pornography. See id. at WSB-193; Mot. to Suppress at 2 (citing Microsoft PhotoDNA, at https://www.microsoft.com/en-us/photodna (October 9, 2020)). According to Microsoft's Head of Digital Safety Operations Sean Davis, Microsoft uses PhotoDNA to "keep individuals and families safer and more secure online" as part of its broader effort to "deliver secure, private, and reliable computing experiences." Davis Decl. (dkt. 71-2) ¶¶ 2–3. PhotoDNA contributes to a "safer online environment" by helping Microsoft "find and remove images of child sexual abuse from Microsoft's online services." Id. ¶ 4. Although Microsoft developed PhotoDNA to serve its "business interests," Microsoft complies with its statutory obligation to report any child pornography it identifies to NCMEC. Id. ¶¶ 5, 11. Here, before submitting the CyberTip, Microsoft had not communicated with NCMEC or any government agency regarding its use of PhotoDNA in relation to this OneDrive account. See id. ¶¶ 4–5, 12–13. But Microsoft has separately "donated" the PhotoDNA system to NCMEC and to law enforcement entities. See Mot. to Suppress at 2–3; Davis Decl. ¶ 14. And in general, Microsoft and NCMEC have continued to work together to improve the PhotoDNA system's database and technology. See Mot. to Suppress at 8–9.

Microsoft's CyberTip categorized the image as depicting a "prepubescent minor" engaging in "sexually explicit conduct." CyberTip Report at WSB-192, 194. The CyberTip also disclosed a numeric username and IP address associated with the OneDrive account. Id. at WSB-190. NCMEC identified the owner of the IP address as an office at California State University, and an NCMEC analyst "viewed the uploaded files" and confirmed that the image was child pornography. See CyberTip Report at WSB-194, 196. Consistent with its own statutory obligations, see 18 U.S.C. § 2258A(c), NCMEC forwarded the CyberTip and information regarding the owner of the IP address to local law enforcement in a CyberTip Report. Id. at WSB-198.

San Francisco Police Department Sergeant Christopher Servat was assigned the CyberTip Report on January 2, 2018—27 days after Microsoft identified the child pornography and 19 days after Microsoft submitted the CyberTip—and applied for a search warrant on January 4, 2018. See Warrant Application (dkt. 64-2) at WSB-58–59. Servat's warrant application stated that he had received the CyberTip, that the listed IP address had been "geo-located" to San Francisco, that Servat had reviewed the uploaded file and confirmed that it was child pornography, and that based on his "training and experience" (which he described), the child pornography would be located in the "above premises," referring to the OneDrive account. Id. at WSB-58–59.¹ The warrant application clarified that the purpose of the investigation was to "identify and arrest" the person who had stored the child pornography on the OneDrive account. Id. at WSB-59. The application did not disclose the precise date that Microsoft had identified the child pornography. Id. at WSB-58–59; CyberTip Report at WSB-192.

Based on Servat's warrant application, a Superior Court of California magistrate judge issued Servat's requested search warrant. See Warrant (dkt. 64-2) at WSB-57. The warrant granted permission to search Microsoft's digital records for "all account information," including "subscriber names, user names, and other identities." Id. at WSB-56. It also granted permission to search "all content" in the OneDrive account. Id. Finally, the warrant granted permission to search all "images, links [and] videos uploaded and saved on [the] account from 7/1/2017 to 1/3/2018," which was redundant given its permission to search all content in the account. Id. at WSB-56–57.

Servat received the contents of the OneDrive account for review on March 7, 2018. SFPD Investigation Rpt. (dkt. 64-3) at WSB-45–52. Examining the files, Servat found over five hundred child pornography images. Id. at WSB-46. Servat also found numerous documents authored by a person named "Wesley" and a letter purporting to be authored by "Wesley Bohannon." Id. at WSB-46. In the same folder as the child pornography images, Servat found several "selfie" photographs of an adult male with gray hair and a grey beard. Id. at WSB-47. These pictures matched Wesley Bohannon's mugshot and driver's license. Id. at WSB-48.²

On March 15, 2018, SFPD officers arrested Bohannon and seized a cell phone and laptop that he was carrying; law enforcement eventually searched the devices, discovering more child pornography. Id. at WSB-48–49. On January 22, 2019, Bohannon was indicted for one count of possession of child pornography based on these materials. See Indictment (dkt. 1).

II. LEGAL STANDARD

Under the Fourth Amendment, "[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated." U.S. Const. Amend. IV. Unless an exception applies, the exclusionary rule prevents unlawfully obtained evidence from being introduced at trial against the person whose Fourth Amendment rights were violated. See Mapp v. Ohio, 367 U.S. 643, 655, 81 S.Ct. 1684, 6 L.Ed.2d 1081 (1961). This includes other evidence "come at by exploitation of that illegality." Wong Sun v. United States, 371 U.S. 471, 488, 83 S.Ct. 407, 9 L.Ed.2d 441 (1963) (quotation omitted).

III. DISCUSSION

Bohannan moves the Court to suppress the fruits of any searches conducted by Microsoft and NCMEC, which includes all evidence of child pornography images obtained in later searches. See Mot. to Suppress at 1, 10–12, 14. Bohannon also moves to suppress the fruits of Servat's visual inspection of the image, and...