Monday, April 08, 2013

The Warrant, the Affidavit and the Metadata

-->
After Benjamin Joseph Hager was charged with “receiving and possessing materials involving the sexual exploitation of minors in violation of 18 U.S. Code § 2252(a)(2) and (a)(4)(B)” he filed a motion to suppress “the evidence derived from the search at his residence.”  U.S. v. Hager, __ F.3d __, 2013 WL 1274564 (U.S. Court of Appeals for the 8th Circuit 2013).   

When the district court judge who had the case denied the motion, Hager “entered into a conditional guilty plea that reserved his right to appeal the denial of the motion”, the  judge accepted the plea and “sentenced Hager to 120 months' imprisonment.”  U.S. v. Hager, supra. In this opinion, the Court of Appeals is ruling on the denial of Hager’s motion to suppress.  U.S. v. Hager, supra.



The case began in September of 2010, when Special Agents from the Department of Homeland security found child pornography on a computer belonging to Robert J. Mueller, a Michigan resident.  U.S. v. Hager, supra.  When they searched Mueller’s hard drive, “they found emails from the email address `Cujoben@webtv.net’” that indicated “this person had a sexual interest in children, . . . referred to himself as `Ace,’ and that the account was registered to Ben Hager at Wahpeton, North Dakota address from which a package had been sent to Mueller. U.S. v. Hager, supra. 



The Michigan agents subsequently sent Agent Timothy Litzinger a CD that contained “explicit emails in which `Cujoben’ admitted having a sexual interest in young girls”. U.S. v. Hager, supra.  Some of the emails “contained non-pornographic sexually suggestive photographs of Mueller's daughters” and some of the images. U.S. v. Hager, supra.   “Some, but not all, of the emailed images contained exchangeable image file or `EXIF’ metadata.”  U.S. v. Hager, supra.  After Litzinger received this information, North Dakota Homeland Security agents investigated Hager and found that he had `at least' two prior



law enforcement contacts resulting from his interest in young girls and lived . . . at the same Wahpeton address provided as the package's return address. Litzinger told the Michigan HSI agents he intended to seek a search warrant for Hager's residence and to search for copies of the images of Mueller's daughters in Hager's possession and for metadata to aid their case against Mueller. The Michigan HSI agents thanked Litzinger, saying that they would find the information helpful.



U.S. v. Hager, supra. 



On November 23, 2010, Litzinger applied for a warrant to search Hager's residence. U.S. v. Hager, supra.  The application said the “basis for the search was `contraband, fruits of crime, or other items illegally possessed’” and it was supported by an affidavit in which “Litzinger averred” that there was “probable cause to believe that currently located within [Hager's] residence are sexually suggestive images depicting known children which were produced by Robert John Mueller in Detroit, Michigan.” U.S. v. Hager, supra.  


The affidavit provided more detail about the contacts between Hager and Mueller and generally described “procedures for seizing computers and characteristics of individuals who have a sexual interest in children”. U.S. v. Hager, supra. It also described the investigation of Hager “in great detail” and concluded as follows:



`Based upon these prior investigations involving a pattern of conduct involving children as well as the information contained in previous paragraphs 15–56, it is believed that Ben Hager is the individual who received the sexually suggestive images of [Mueller's minor daughters] via the email account CujoBen@webtv.net.’



`As set forth in paragraph 56, the exif metadata associated with the sexually suggestive images depicting Mueller's minor daughters (which is believed to be stored on a computer within Hager's residence), when compared with the exif metadata associated with the child pornographic images depicting Mueller's minor daughters that were recovered from Mueller's residence in Detroit, Michigan, will reveal whether the two sets of images were produced with the same two cameras. . . ‘


U.S. v. Hager, supra. 



The U.S. Magistrate Judge issued a warrant that authorized a search of Hager’s residence and the seizure of “`sexually suggestive images depicting [Mueller's minor daughters] wherever they may be stored or found’”. U.S. v. Hager, supra.  In an addencum [sic], the warrant listed “`requirements [applicable] to any . . . tapes . . . seized pursuant to [the] warrant’”, which included the requirement that:



`Electronic Devices, Storage Media, and Electronically Stored Information seized pursuant to this warrant are subject to search only for the Electronically Stored Information that is specifically described in and that is the subject of this warrant.’


U.S. v. Hager, supra. 



The next day, Litzinger and other agents executed the warrant.  U.S. v. Hager, supra.  During the search, Hager told them he knew Miller and admitted that he knew


Mueller was molesting his daughters and admitted he had received non-pornographic pictures of Mueller's daughters. . . . Hager said also he used a WebTV connection to copy information from the Internet to VHS tapes.



During the search . . . agents found 747 VHS tapes capable of holding more than 4,400 hours of information when viewed on a television. Litzinger called a computer forensic expert in North Dakota to ask whether [they] constituted `electronic media.’ The expert said that they did. Litzinger then called the First Assistant United States Attorney for North Dakota, who said that the VHS tapes were within the scope of the warrant. Agents then seized the tapes.



Litzinger was unfamiliar with WebTV or how VHS recording devices worked, thinking WebTV was similar to a modem. [He] believed he would find the Mueller images on the VHS tapes and that the VHS tapes would contain metadata useful to the Mueller case. Litzinger did not know tVHS tapes are analog, not digital, and . . . cannot contain metadata; Litzinger saw a USB port on the WebTV box and assumed that the information on the VHS tapes would be the same as if it was saved on a computer.



Litzinger and a non-expert support staff member . . . reviewed the VHS tapes at the . . . office. Neither Litzinger nor the support staff member knew the VHS tapes could not contain metadata, although a reasonably competent forensic computer examiner would know this. Upon viewing the tapes, Litzinger and the support staff member found child pornography, whereupon they stopped viewing the tapes and sought and obtained an additional warrant.



U.S. v. Hager, supra. 



In appealing the denial of his motion to suppress, Hager argued that the first



search warrant authorized only a search for the metadata of the sexually suggestive images of Mueller's daughters. . . . Hager argues that the agents were not authorized to search for the images on the VHS tapes in his residence because the VHS tapes could not contain metadata.



U.S. v. Hager, supra. 



The Court of Appeals rejected Hager’s scope of the warrant argument, finding that in



his affidavit in support of the search warrant, Litzinger made clear that he sought to recover `sexually suggestive images depicting known children which were produced by Robert John Mueller in Detroit, Michigan[.]’ . . .Similarly, the warrant authorized a search for and the seizure of `sexually suggestive images depicting [Mueller's minor daughters] wherever they may be stored or found[.]’ . . . 

Although Litzinger undoubtedly sought to examine any metadata from the Mueller images, a fair reading of his affidavit reveals that Litzinger sought to recover the metadata in addition to, and not to the exclusion of, the images themselves. . . .



Hager argues also that the warrant's addendum limited the scope of the search to metadata. The addendum limited the search of tapes to `Electronically Stored Information that is specifically described in and that is the subject of this warrant.’ . . . The warrant, however, authorized a search for `sexually suggestive images depicting [Mueller's minor daughters] wherever they may be stored or found[.]. . . . 

When read in conjunction with the warrant's authorization, the addendum limited the search of tapes to the Mueller images and accompanying metadata. . . .



U.S. v. Hager, supra. 



Hager also argued that “Litzinger's affidavit did not establish probable cause to search for the Mueller images or the metadata because the affidavit did not establish how recovery of the Mueller images or the metadata would aid in the prosecution of Mueller.”   U.S. v. Hager, supra.  The Court of Appeals noted that probable exists when



`“there is a fair probability that contraband or evidence of a crime will be found in a particular place.”’ U.S. v. Palega, 556 F.3d 709 (U.S. Court of Appeals for the 8th Circuit 2009) (quoting Illinoisv. Gates, 462 U.S. 213 (1983)). `A totality of the circumstances test is used to determine whether probable cause exists.’ U.S. v. Gleich, 397 F.3d 608 (U.S. Court of Appeals for the 8th Circuit 2005). `Courts should apply a common sense approach and, considering all relevant circumstances, determine whether probable cause exists.’ Id.



U.S. v. Hager, supra. 



The Court of Appeals then found that Litzinger’s affidavit stated that the



`recovery of [the Mueller] images [would] establish that Robert John Mueller is responsible for producing other images depicting his minor daughters engaged in sexually explicit conduct [.]’ . . . Litzinger averred that the metadata from the Mueller images thought to be at Hager's residence, `when compared with the exif metadata associated with the child pornographic images depicting Mueller's minor daughters that were recovered from Mueller's residence in Detroit, MI, [would] reveal whether the . . . images were produced with the same two cameras. . . .



To the extent the affidavit lacked a thorough explanation as to how this evidence would aid in the prosecution of Mueller, this omission is not fatal to the validity of the search warrant, for `[j]udges “may draw reasonable inferences from the totality of the circumstances in determining whether probable cause exists to issue a warrant[.]”’ U.S. v. Summage, 481 F.3d 1075 (U.S. Court of Appeals for the 8th Circuit 2007) (quoting U.S. v. Thompson, 210 F.3d 855 (U.S. Court of Appeals for the 8th Circuit 2000)).



Upon considering Litzinger's affidavit in its entirety, the magistrate judge could have reasonably inferred that recovery of the Mueller images at Hager's residence would establish that Mueller produced sexually suggestive, albeit legal, images of his minor daughters and that Mueller distributed those images over the Internet. Similarly, the magistrate judge could have reasonably inferred that recovery of the metadata, in turn, would establish that the same camera used to take the sexually suggestive photographs of Mueller's daughters was used to take the illegal pornographic photographs of Mueller's daughters. 

From all of this, the magistrate judge could have reasonably inferred that recovery of the Mueller images and the metadata would aid in the Mueller prosecution.



U.S. v. Hager, supra.  So the court  rejected Hager’s argument.. U.S. v. Hager, supra. 



The Court of Appeals also noted that “even if” it were to agree with Hager that



Litzinger's affidavit somehow failed to establish probable cause to search for the Mueller images and the metadata, the evidence would . . . be admissible under the Leon good-faith exception to the exclusionary rule. See U.S. v. Leon, 468 U.S.897 (1984). `Under the Leon . . . exception, disputed evidence will be admitted if it was objectively reasonable for the officer executing a warrant to have relied in good faith on the judge's determination that there was probable cause to issue the warrant.’ U.S. v. Patten, 664 F.3d 247 (U.S. Court of Appeals for the 8th Circuit 2011). . . .



U.S. v. Hager, supra. 



Hager claimed “it was not objectively reasonable for Litzinger to rely on the warrant because a reasonable computer forensic examiner, such as the one Litzinger consulted before searching the VHS tapes, would have known [they] could not contain metadata.”  U.S. v. Hager, supra.  The Court of Appeals, however, found that this argument failed



because as discussed above, . . . the warrant authorized the search for the Mueller images themselves in addition to the metadata. Accordingly, even if Litzinger had personally known that the tapes could not contain metadata, they would nonetheless have come within the scope of the warrant.



U.S. v. Hager, supra. 



The court then found that the Leon exception would apply here because given the



facts. . . it was objectively reasonable for Litzinger to rely on the magistrate judge's determination that there was probable cause to issue the search warrant. Authorities recovered emails and other evidence from Mueller's computer indicating that Hager possessed sexually suggestive images taken by Mueller of Mueller's daughters and that these images might contain metadata. . . . 

[R]ecovery of the images and the metadata would have aided the prosecution against Mueller. . . . In short, `[n]othing . . . indicates the warrant was facially invalid or the issuing judge abandoned h[er] role as a neutral and detached magistrate. U.S. v. Keele,589 F.3d 940 (U.S. Court of Appeals for the 8th Circuit 2009).



Moreover, Litzinger exhibited good-faith reliance on the warrant during his execution thereof. Prior to seizing and searching the VHS tapes, Litzinger contacted a computer forensic expert and the First Assistant United States Attorney . . . to ensure compliance with the warrant. . . . When [he] discovered child pornography on the tapes, he stopped searching the tapes and sought a second search warrant. 

Accordingly, . . . the evidence . . . was admissible pursuant to the Leon good-faith exception.



U.S. v. Hager, supra. 



For these and other reasons, the court affirmed the district court judge’s denial of Hager’s motion to suppress and therefore affirmed his conviction.  U.S. v. Hager, supra. 

No comments: