United States v. Herrington

UNITED STATES OF AMERICA, v. TAYLOR RUFFIN HERRINGTON, Defendant.

No. 2:20-cr-00040-cr

United States District Court, D. Vermont

August 9, 2021

OPINION AND ORDER

DENYING DEFENDANT'S MOTION TO SUPPRESS EVIDENCE

(Doc. 57)

Christina Reiss, District Judge United States District Court

Defendant Taylor Ruffin Herrington (also known as "Tee") moves to suppress evidence obtained as a result of a subpoena for his Apple internet protocol (IP) address data. (Doc. 57.) The government opposes Defendant's motion. The court took this motion under advisement on July 8, 2021.

Defendant was indicted in a two count Indictment of Count I: knowingly carrying and using a firearm in relation to a drug trafficking crime in violation of 18 U.S.C. § 924(c)(1)(A), and Count II: knowingly and willfully conspiring with others to distribute heroin, a schedule 1 controlled substance, in violation of 21 U.S.C. §§ 841(a)(1), 841(b)(1)(C), 846.

The government is represented by Assistant United States Attorneys Spencer Willig and Wendy L. Fuller. Defendant is represented by Assistant Federal Public Defender Michael L Desautels.

I. Findings of Fact.

On March 3, 2020, at approximately 2:50 a.m. Michael Haines and Amy Pudvah contacted Vermont State Police ("VSP") and reported that a person had attempted to enter their home in Cambridge, Vermont. They identified the person as "Tee" and said that he was with another individual who they identified as "Sam Simms." They reported that Tee and Sam Simms had left in Sam Simms's truck but then returned a short time later. While Mr. Haines was on the phone with VSP, he stated that he had been shot. VSP officers arrived at Mr. Haines's and Ms. Pudvah's residence at approximately 3:50 a.m. and saw a man, later identified as Mr. Haines, on the kitchen floor. Mr. Haines was pronounced dead at 3:57 a.m. His death was declared a homicide and Defendant became the primary suspect early in the investigation. That same day, law enforcement interviewed Ms. Pudvah about the events preceding the shooting. She reported that, on March 2, 2020, Mr. Haines asked Ms. Pudvah to provide a ride for his friend Tee from Burlington to their home. When she picked Tee up in Burlington, he placed a duffel bag in the trunk of the car before getting in it. He told her that he was from Philadelphia, Pennsylvania and was born in August 1991.

When they reached Mr. Haines's and Ms. Pudvah's residence, Tee and Mr. Haines went into the basement. At approximately 8:00 p.m., they left and told Ms. Pudvah they were going to the store for beer. They returned forty minutes later and left the house again between 10:30 p.m. and 11:00 p.m. Mr. Haines returned home alone at 1:15 a.m. Ms. Pudvah asked where Tee was and Mr. Haines reported that he had dropped him off at Becky Bessette's home. Ms. Pudvah noticed that Tee's duffel bag was still in their basement. Mr. Haines left again for approximately thirty minutes and told Ms. Pudvah that he went to his friend Matthew Gillespie's house.

Ms. Pudvah was in her kitchen when she saw a dark colored pickup truck pull into the driveway. Mr. Haines told her that the car belonged to Sam Simms, instructed her to call the police, and stated that he was in a fight with Tee. Someone began to knock on the door and said that he wanted his duffel bag. Mr. Haines went into the basement, got the duffel bag, and threw it over the back deck. The pickup truck left the residence and made a right turn out of the driveway down a dead end street. Approximately fifteen minutes later, the pickup truck returned and Ms. Pudvah saw Tee at the door. Mr. Haines went to the door and told Tee that the duffel bag was out back. Ms. Pudvah saw what she thought was a pellet gun and saw Mr. Haines on the floor. Mr. Haines said that he had been shot. Ms. Pudvah showed law enforcement officers text messages on the phone that she shared with Mr. Haines and provided a phone number, 802-495-1040, which she reported belonged to Tee.

VSP officers also interviewed Ms. Bessette who told officers that Tee was using the phone number 802-234-3454, and had called her three times from that number. Ms. Bessette consented to a search of her phone which confirmed this information.

An open-source database search for the 802-495-1040 number revealed that it was connected to Verizon Wireless. A search warrant was sought for information from Verizon Wireless associated with the cellular device connected to 802-495-1040. An open-source database search for 802-234-3453 revealed that it was assigned to the carrier Bandwidth, Inc. Further investigation indicated that Bandwidth, Inc. had leased the number to Pinger, Inc. A search warrant was served on Pinger, Inc. for records related to the phone number 802-234-3453. These records revealed that the account was created on March 3, 2020, and the third-party email address provided by the user was taylorherrington26@icloud.com and the username was taylorherrington26. Thereafter, a grand jury subpoena was served on Apple on March 5, 2020, seeking information related to the Apple account associated with taylorherrington26@icloud.com. The subpoena sought all customer and subscriber information for the email address and/or any related accounts that fell into the following categories: names, addresses, email addresses, telephone numbers, and usernames; records of session times and durations; length of service, types of services utilized, and devices associated with the subscriber's account; telephone or instrument number or other subscriber numbers or identity for any devices associated with the account; means and source of payment for services, including credit card or bank account number; and Apple IP logs for any device associated with the account.

From the production by Apple in response to the subpoena, law enforcement learned that the account was registered to Taylor Ruffin of 1304 W. Chelten Avenue, Philadelphia, Pennsylvania; created on November 29, 2017 and was still active; the phone number associated with the account was 215-900-3590; and the most recent iTunes update used the phone number 215-858-7026. In addition, Apple provided four spreadsheets with "account and activity information" for the taylorherrington26 account. (Doc. 57 at 2.)

The first spreadsheet titled "iCloud Logs," contained a time-stamped log of instances in which the taylorherrington26 account accessed various iCloud services and the IP address from which the services were accessed. Id. The spreadsheet included records for approximately thirteen months, from February 11, 2019 until March 5, 2020, and contained 12, 880 entries. The second spreadsheet contained basic account details and the third, titled "iTunes data," included a series of sheets with time-stamped entries for the subscriber's iTunes updates. Id. Another spreadsheet for "iTunes Updates" contained approximately 1, 174 entries. Id. These entries were time-stamped and included an IP address and the associated global unique identifier. The entries covered the period from March 2019 until March 2020. A spreadsheet of "iTunes Transactions" covered a similar time frame and included sixty-five time-stamped entries, an IP address, as well as a global unique identifier. Id. at 3. The "iDMS Signons" spreadsheet included 4, 900 entries from March 9, 2019 until January 22, 2020 and documented the Apple service accessed and provided an IP address for the activity. (Doc. 57 at 3.) The final spreadsheet, "My Apple ID and iForgot data," provided approximately 160 time-stamped entries over a one year period and included the IP address from which the services were accessed. Id.

Law enforcement conducted an open-source database search for the phone number 215-900-3590 and determined it was assigned to AT&T. A search warrant for information related to that phone number was served on AT&T on March 9, 2020. A PEN trap was authorized to monitor that phone number. On March 9, 2020, the Federal Bureau of Investigations ("FBI") received information from AT&T that the device was in or about Philadelphia, Pennsylvania. The FBI also reviewed historical records from AT&T regarding the number 215-900-3590 and mapped cellular tower and sector information for the device which, on March 2, 2020, connected to cellular towers in Burlington, Vermont and Lamoille County, Vermont. In the early morning hours of March 3, 2020, the device connected to towers in Burlington and to towers between Burlington and Cambridge, Vermont. The device remained in Vermont until approximately March 4, 2020 when it was used to call a local taxi company before travelling south to White River Junction, Vermont. The device continued to connect to cellular telephone towers suggesting travel to New York City and then Philadelphia.

On March 12, 2020, a grand jury subpoena was served on the carrier associated with 267-250-0072.^[1] The records received pursuant to the subpoena indicated that the subscriber was Taylor Ruffm and the phone number associated with the account from April until June 2019 was 267-624-3449. That same day, Defendant was indicted for violations of 18 U.S.C. § 924(c)(1)(A) and 21 U.S.C. §§ 841(a)(1)(C), 841(b)(1)(C), 846 and a warrant was issued for his arrest. Law enforcement subsequently arrested Defendant at his apartment.

On March 13, 2020, Google was served with a grand jury subpoena requesting subscriber information for any Google accounts associated with 802-495-1040, 215-900-3590, and/or the device identifiers associated with those numbers. Google responded that the Google accountjr5555976@gmail.com was associated with 802-495-1040. It was determined that the account was created on December 29, 2019, and was last logged into on February 14, 2020. The sign-in phone number and recovery SMS phone number was...