United States v. Shah

UNITED STATES OF AMERICA v. NIKHIL NILESH SHAH, Defendant.

NO. 5:13-CR-328-FL

UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF NORTH CAROLINA EASTERN DIVISION

January 6, 2015

ORDER

This matter comes before the court on three motions of defendant Nikhil Nilesh Shah to suppress evidence obtained in violation of defendant's Fourth and Fifth Amendment rights (DE 23, 24, 25). The government timely filed a response in opposition to defendant's motions, to which defendant replied. The issues raised are ripe for ruling. For the reasons that follow, the court denies defendant's motions.

STATEMENT OF THE CASE

On December 17, 2013, a grand jury returned a one-count indictment charging defendant with intentional damage to a protected computer, in violation of 18 U.S.C. §§ 1030(a)(5)(A), 1030(c)(4)(B)(i), and 1030(c)(4)(A)(i)(I). After a period of discovery, defendant filed the instant motions to suppress on June 30, 2014.

Defendant asserts that the government violated his Fourth Amendment rights when it acquired "cell phone location evidence" for AT&T Wireless telephone numbers associated with defendant, along with "user location information" obtained from Facebook, Inc. ("Facebook"). (Mot. To Suppress Tracking Data, 13) (DE 25). Defendant also asserts Fourth Amendment violations based upon government seizure of email communications and associated data fromGoogle, Inc. ("Google"). (DE 24). Finally, defendant asserts that government agents violated his Fifth Amendment rights by confronting him with evidence after he had requested an attorney. (DE 23).

The government filed a combined response in opposition to defendant's three suppression motions on August 30, 2014. The government argues that defendant has no reasonable expectation of privacy in the information obtained from AT&T Wireless and Facebook because the records are business records created and held by the respective service providers. As to defendant's motion regarding emails and associated information obtained from Google, the government argues that the search warrant for this information ("Google Warrant") complied with the Fourth Amendment because it was supported by probable cause, and particularly described the information to be searched and the procedure for seizure. Alternatively, if the court finds that the challenged evidence was obtained in violation of defendant's Fourth Amendment rights, suppression should not be ordered, it argues, because the government reasonably relied in good faith on the Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701, et seq., and upon orders from a magistrate judge issued pursuant to § 2703(d).¹ Finally, the government responds to defendant's motion seeking suppression of evidence generated during his arrest that it will not attempt to offer into evidence any of the statements or conduct discussed in defendant's motion to suppress on Fifth Amendmentgrounds, rendering that motion moot. Defendant's reply, filed September 4, 2014, after seeking leave, concentrates on the government's stated opposition to his motion to suppress tracking data obtained without a warrant.

The complexity of issues presented has necessitated a more extended period of time for the court's decision making. Arraignment and trial was continued in this case until no sooner than 45 days after disposition of the instant motions. In accordance with the court's order entered July 30, 2014, the clerk now will set the matter for arraignment and trial at the court's next regular criminal term no sooner than 45 days from date of entry of this order.

FACTUAL BACKGROUND

Defendant was formerly an Information Technology Manager at Smart Online, Inc. ("SOLN"), a mobile application development company in Durham, North Carolina. On June 28, 2012, after defendant was no longer a SOLN employee, an intruder accessed the SOLN computer network and caused significant damage. On June 29, 2012, SOLN and the Durham Police Department initiated an investigation, which was later joined by the FBI. As part of the investigation, the FBI filed an application for a search warrant targeting the electronic mail address shahnn28@gmail.com. The Google Warrant issued from a magistrate judge on November 5, 2012.

The Google Warrant references Attachment A as the "the property to be searched." (Google Warrant, at 2) (DE 24-1.) Attachment A provides that the warrant applies to "information associated with SHAHNN28@GMAIL.COM that is stored on premises controlled by Google, Inc." (Id. at 4). For the "property to be seized," the affidavit references Attachment B. Section I of Attachment B details particular items of "Information to be disclosed by Google," including:

a. The contents of all e-mails stored in the account, including copies of e-mails sent to and from the account, draft e-mails, the source and destinationaddresses associated with each e-mail, the date and time at which each e-mail was sent, and the size and length of each e-mail;

b. All records or other information regarding the identification of the account, to include full name, physical address, telephone numbers and other identifiers, records of session times and durations, the date on which the account was created, the length of service, the types of service utilized, the IP address used to register the account, log-in IP addresses associated with session times and dates, account status, alternative e-mail addresses provided during registration, methods of connecting, log files, and means and source of payment (including any credit or bank account number);

c. All records or other information stored by an individual using the account, including address books, contact and buddy lists, calendar data, pictures, Google search history, and files;

d. All records pertaining to communications between including [sic] contacts with support services and records of actions taken.

(Google Warrant, 5-6). Section II of Attachment B specified that the information "to be seized by the government" would include

[a]ll information described above in Section I that constitutes fruits, evidence, and instrumentalities of Title 18, United States Code, Sections 1030 (Fraud and Related Activity in Connection with Computers), since account inception, including, for each account or identifier listed on Attachment A, information pertaining to the following matters:

a. Preparatory steps taken in furtherance of unauthorized network activity, communications regarding execution of the unauthorized network activity, and information regarding tools used in furtherance of the unauthorized network activity.

b. Records relating to who created, used, or communicated with the account or identifier, including records about their identities and whereabouts.

(Id. at 6).

As alleged by defendant, agents used the Google Warrant to obtain "over 1GB [gigabyte] of data associated with the shahnn28@gmail.com [account], including emails, chats, and other information spanning from roughly March 6, 2007 through November of 2012." (Mot. To SuppressEmail and Related Evidence, 3) (DE 24). According to the government, the data "revealed that on June 29, 2012 at 4:46 PM, [defendant] sent himself an e-mail ("June 29 Email") to shahnn28@gmail.com from shahnn28@gmail.com with no subject line that contained three website links related to Cisco ASA VPN and PIX firewall configurations." (Gov. Resp., 8) (DE 35). These firewall configurations were used by SOLN in its network infrastructure. The links in the June 29 Email directed to web pages that discuss security settings for these devices. Furthermore, the Internet Protocol (IP) address associated with the June 29 Email was also identified as connecting to the SOLN network. The IP address had also been used previously to send emails to SOLN employees. The government determined that the IP address was geographically located in Holly Springs, North Carolina, the city of defendant's residence at the time of the intrusion.²

The government also alleges that, although defendant contacted SOLN employees on June 28 and June 29, 2012, to report receiving security alerts regarding the SOLN network, a review of the email account shows that he never received any such alerts. Furthermore, chat sessions stored in the email account revealed that defendant had boasted of having access to the SOLN network and of performing the June 28, 2012 intrusion.

Subsequent to obtaining the Google Warrant, the government submitted two applications pursuant to Section 2703(d) of the SCA. On February 25, 2013, the magistrate judge issued an order requiring AT&T Wireless to disclose "[a]ll records and other information (not including the contents of communications) relating to the [referenced] [a]ccount," including "[r]ecords of user activity for each connection made to or from the account[;] . . . [i]nformation about each communication sent or received by the [a]ccount, including the date and time of the communication, the method ofcommunication, and the source and destination of the communication (such as source and destination email addresses, IP addresses, and telephone numbers)" and "[a]ll data about which 'cell towers' i.e. antenna towers covering specific geographic areas) and 'sectors' (i.e., faces of the towers, received a radio signal from each cellular telephone or device assigned to the Account." (AT&T Wireless Order, at 5) (DE 26-1). The AT&T Wireless Order specified that the time period for this information would span from June 1, 2012 through February 12, 2013.

Agents obtained from AT&T Wireless records that were created and maintained when the cell phone associated with the accounts transmitted a signal to a cell tower to connect communications. Defendant alleges that "[t]he information produced by AT&T allowed the government to pinpoint the geographic location of [defendant's] cell phone for over half a year." (Mot. To Suppress Tracking Data, 2). The government's response suggests the information revealed that defendant exchanged text messages with a...