US v. Kim

677 F.Supp.2d 930

UNITED STATES of America v. Steven Jinwoo KIM.

Criminal No. H-09-302.

United States District Court, S.D. Texas, Houston Division.

December 23, 2009.

Bret W. Davis, Financial Litigation, Office of U.S. Attorney, U.S. Marshal, U.S. Pretrial Svcs., U.S. Probation, Houston, TX, for Plaintiff.

ORDER

VANESSA D. GILMORE, District Judge.

I.

A.

Defendant Steven Jinwoo Kim ("Defendant" or "Kim") brings the instant Second Amended Motion to Suppress Evidence. (Instrument No. 65). Defendant alleges that the issuance of a warrant and the subsequent search and seizure of items from his residence violated his rights under the Fourth Amendment to the Constitution of the United States of America. (Id., at 4). A hearing was held on Defendant's Motion on November 3, 2009. Both sides presented evidence. Having considered the evidence in this case and the applicable law, the Court makes the following findings.

B.

Defendant was employed by GEXA Energy ("GEXA") as a Senior Database Administrator from May 22, 2006 until February 5, 2008. GEXA is a subsidiary of Florida Power and Light Group ("FPL"). GEXA is a Retail Electric Provider ("REP") and maintains the GEXA Energy Management System ("GEMS") Application and Database. GEMS houses the customer and billing information of GEXA's customers in Houston, Texas. (Instrument No. 65-2, at 8).

Defendant was responsible for maintaining the GEMS database. As part of his duties, he had administrative rights and passwords to access to' the GEMS system. (Id., at 9). Defendant was suspended from employment on January 17, 2008. After his suspension, Defendant was no longer authorized to access the GEXA network or the GEMS database. (Id.).

On or about May 2, 2008, the Director of Security for FPL advised United States Secret Service ("USSS") agents "that an individual, without authorization, accessed the private `GEXA Energy' computing network system in Houston, Texas." (Id., at 8). On May 6, 2008, Sergio O. Guzman, a forensic investigator for the FPL group, advised USSS agents that between April 28, 2008 and May 1, 2008, while GEXA was going through an annual audit, the company discovered "several unauthorized attempts to access the GEXA computing network, via Virtual Private Network (VPN)." GEXA told the USSS agents that the nature of the unauthorized access appeared to be directed at obtaining access and compromising the integrity and availability of the GEMS Application Database. (Id., at 8-9).

On June 2, 2008, the Government applied for a search warrant based on information that had been provided. Special Agent Jimmy Mance ("Mance" or "Agent Mance") submitted his Affidavit in Support of the Application for Search Warrant. (Instrument No. 65-2). In the affidavit, Agent Mance stated that on. August 16, 2007, Kim and other GEXA employees learned that the GEMS database could be corrupted if large amounts of data were loaded onto the system. He alleged that Kim received an e-mail regarding these concerns on August 28, 2007. (Id., at 9). Agent Mance contended that, on October 24, 2007, Kim demonstrated his expertise of the GEMS database system in an e-mail directed to the GEXA database developer. (Id.). Mance asserted that Kim was suspended on January 17, 2008, pending a Human Resources Investigation. During this period of suspension, Mance stated that Kim no longer had access to the GEXA building, the GEXA network, or the GEMS database. (Id., at 10).

In the affidavit, Mance alleged that the GEXA Virtual Private Network ("VPN") logs reflected that from January 17, 2008 through February 5, 2008, during Kim's suspension, the Internet Protocol ("IP") address of 75.53.99.76 made twelve failed log-in attempts to gain access to the GEXA VPN network; two failed login attempts through the GEXA general administrator account; and one failed login attempt using another general administrator account. (Id.). Mance contended that, throughout these dates, that particular IP address was assigned to Kim at his known address. (Id.).

Agent Mance further alleged that on February 17, 2008, two intrusion attempts were made from a different IP address, 76.199.75.170. Mance contended that although the first attempt was unsuccessful, the second attempt succeeded in gaining access to the GEXA network system. (Id., at 11). This second IP address allegedly belonged to Defendant Kim during the time that he was employed with the company. (Id.).

Mance further asserted that several subsequent attempts to access and modify the database were made from a third IP address, 76.199.73.177. (Id., at 11-14). On May 1, 2008, the logs reflected that this third IP address viewed the usernames and encrypted passwords of all GEMS database users. (Id., at 13). Based on information obtained from the internet service provider, Mance alleged that this third IP address belonged to Kim at his residential address. (Id., at 14).

Agent Mance stated that, based on his experience, individuals who participate in fraud and related activity in connection with computers often maintain computer records, paper notes, and other electronic media at their residence related to the fraud or related activity within 18 U.S.C. § 1030. (Id.).

In the affidavit, Agent Mance requested that the Government issue a search warrant for Kim's property and he specifically described the property. The search warrant requested that the Government be permitted to seize items from Kim's residence. These items included: "all computer hardware; software; related computer devices; and any items obtained as a result of fraud and related activity in connection with computers." (Id., at 7). Mance stated in the affidavit that the investigation concerned the violation of 18 U.S.C. § 1030 (Computer Intrusion). The affidavit also included an outline of the elements of the violation. (Id., at 7). Agent Mance asserted that probable cause arose from the FPL Director of Security's accusation that an individual attempted to access the company's private GEXA network without authorization. (Id., at 8).

On June 2, 2008, United States Magistrate Judge Stephen W. Smith issued a search warrant for evidence in support of the suspected violation of 18 U.S.C. § 1030. The warrant was to be executed at the residence of Steven Jinwoo Kim ("Kim" or "Defendant"). (Instrument No. 31, at 1). The warrant authorized the seizure of hard data and information and/or data stored in the form of magnetic or electronic coding on computer media or media capable of being read by a computer or with the aid of computer-related equipment. (Instrument No. 65-2, at 18-19). The warrant also authorized the seizure of computer hardware, software, computer related documentation, computer passwords and data security devices. (Id., at 18-20). The Government was authorized to access information relating to any records or documents that refer to or relate to GEXA or GEMS. (Id., at 18). The Government could also access any records of personal and business activities relating to the operation of a computer, such as telephone records, notes, books, diaries, and reference materials, including evidence in photographic form. (Id.). Based on the search warrant, the Government seized several external hard drives, laptop and desktop computers, and brought them back to a forensic laboratory for forensically imaged analysis. (Instrument No. 36, at 2).

The Government alleges that from June 3, 2008 through January 24, 2009, the examiners searched for evidence of Computer Intrusion. (Id.). On June 6, 2008, while searching Defendant's electronic files and folders on his hard drive, the examiners came across encrypted files and folders. (Instrument No. 31, at 2). These files were allegedly labeled, "Forbidden-Fruit," "Illegal_Loli###," "Loli###," and other similar names. (Instrument No. 65-3, at 13). The Government believed that these names were suggestive of child pornography. (Id.).

On June 13, 2008, the Government applied for a warrant targeting potential child pornography in the encrypted folders. In the affidavit in support of the search warrant, Agent Mance alleged that there was probable cause to believe that Kim violated 18 U.S.C. 2252A, possession of child pornography. Mance stated that computerized depictions of child pornography are often stored as Joint Photographic Experts Group ("JPEG") files. (Id., at 7). Mance contended that people who possess child pornography "go to great lengths to conceal and protect" their collection from discovery through the use of passwords or encrypted files on their computer. (Id., at 12). Agent Mance maintained that probable cause existed based on the names of the file folders. (Id., at 13). He also stated that the files within the folder were encrypted with "CryptaPix" software, which "is designed to secure digital photos or image files from unauthorized access." (Id.).

Judge Smith denied the Government's application for a search warrant targeting potential evidence of child pornography in the encrypted folders, reasoning that the file names were not necessarily indicative of child pornography. (Instrument No. 31, at 2; Instrument No. 36, at 3).

Despite the ruling of the Magistrate Judge, the Government spent two months decrypting the files on the computer. Later, the Government decoded the encrypted files and allegedly discovered over eight hundred and forty child pornography images. (Instrument No. 42, at 3). The Government states that subsequent examination revealed digital evidence of Computer Intrusion. (Id.).

C.

On June 3, 2009, Steven Jinwoo Kim was named in a three count indictment for Computer Intrusion, Possession of Child Pornography, and Aggravated Identity Theft. (Instrument No. 1). In Count One of the indictment, the Government alleged that Defendant committed Computer Intrusion by violating 18 U.S.C. § 1030(a)(5)(A)(i) and (c)(4)(A). The Government asserted that Defendant knowingly caused the transmission of a program, information, code and...