22-1086 United States v. Johnson
UNITED STATES COURT OF APPEALS FOR THE SECOND CIRCUIT
August Term 2022
(Argued: February 17, 2023 Decided: February 27, 2024)
No. 22-1086
––––––––––––––––––––––––––––––––––––
UNITED STATES OF AMERICA,
Appellee,
-v.-
CORY JOHNSON,
Defendant-Appellant.
Before: LIVINGSTON, Chief Judge, CARNEY, and BIANCO, Circuit Judges.
Defendant Cory Johnson challenges his conviction for production of child pornography, in violation of 18 U.S.C. § 2251(a), after the United States District Court for the District of Vermont (Crawford, C.J.) denied his motions (1) to suppress evidence derived from an examination of segregated digital data, seized pursuant and identified as responsive to a search warrant, that took place after sentencing in connection with an earlier prosecution; and (2) to dismiss the indictment as precluded by an earlier plea agreement. We conclude that the later review of digital data seized and segregated as within the scope of the search warrant did not violate the Fourth Amendment and therefore that the district court
1 correctly denied Johnson’s motion to suppress. We further agree with the district court that the plea agreement did not bar Johnson’s second prosecution. The district court thus properly declined to dismiss the indictment. Accordingly, we AFFIRM Johnson’s conviction.
FOR DEFENDANT-APPELLANT: DENNIS J. JOHNSON (Frank J. Twarog, Catamount Law PLLC, Burlington, VT, on the brief), The Law Office of Dennis J. Johnson, South Hero, VT.
FOR APPELLEE: EUGENIA A.P. COWLES, Assistant United States Attorney (Gregory L. Waples, on the brief), on behalf of Nikolas P. Kerest, United States Attorney for the District of Vermont, Burlington, VT.
DEBRA ANN LIVINGSTON, Chief Judge:
Defendant-Appellant Cory Johnson (“Johnson”) appeals from a May 12,
2022, judgment of the United States District Court for the District of Vermont
(Crawford, C.J.), convicting him of a single count of the knowing production of
child pornography in violation of 18 U.S.C. § 2251(a), and sentencing him to a term
of imprisonment of 240 months, to be followed by a 15-year term of supervised
release. When Johnson was first identified by federal authorities as trading child
sexual abuse material (“CSAM”) within an Internet chat group in 2018, the
execution of a search warrant at his South Burlington, Vermont home resulted in
the seizure of electronic media containing over 8,000 videos and over 6,000 images
2 of such material. Johnson was first indicted for the distribution of child
pornography but as the result of a plea agreement pled guilty to a superseding
information charging him only with the possession of child pornography. For
that crime, he was sentenced principally to a 45-month term of imprisonment. A
later review of previously seized and segregated digital data responsive to the
original warrant produced evidence that Johnson had not only possessed child
pornography in 2018 but had sexually assaulted his then two-and-a-half-year-old
daughter and filmed the abuse. Johnson was indicted on the present production
charge in 2019 and again pled guilty, this time reserving the right to appeal the
denial of his motions to suppress evidence and to dismiss the 2019 charge as
precluded by his 2018 plea agreement. As explained below, we conclude that
Johnson’s arguments on appeal are without merit. Accordingly, we affirm the
district court judgment.
I. Factual Background 1
1 The factual background presented here is taken principally from the complaints, indictments, and warrant applications in the two prosecutions of Johnson, as well as the parties’ filings, testimony and evidence before the district court at evidentiary hearings on the combined motions, and the district court’s pertinent opinions. See United States v. Johnson, No. 18-CR-41 (D. Vt.) (“2018 District Court Docket”), 2018 District Court Docket No. 1-3; 2018 District Court Docket No. 5-1; see also United States v. Johnson, No. 19-CR-140 (D. Vt.) (“2019 District Court Docket”), 2019 District Court Docket No. 29-8.
3 A. The 2018 Investigation
In March 2018, a North Carolina-based Homeland Security Investigations
(“HSI”) Special Agent infiltrated a chat group on Kik, a smartphone messaging
app, and obtained several videos of CSAM from a user named “textiles.” 2 Upon
consulting subscriber information subpoenaed from Kik and Comcast and
matching that information to a public Facebook page, the special agent came to
suspect that “textiles” was Johnson. Because Johnson lived in South Burlington,
Vermont, the information developed in North Carolina was forwarded for further
investigation to Vermont-based HSI Special Agent Caitlin Moynihan (“SA
Moynihan”).
After further querying a Vermont state law enforcement database,
conducting surveillance outside Johnson’s house, inspecting license plate
registrations, and verifying Johnson’s identity by tracking him down at his job
behind a Costco deli counter, SA Moynihan sought and obtained a warrant to
search Johnson’s home for CSAM and evidence of crimes involving child
pornography. See Supp. App’x 5–6. The warrant authorized the seizure of any
2 HSI is the primary investigative division of the U.S. Department of Homeland Security. See Homeland Security Investigations, ICE.gov, https://www.ice.gov/about- ice/homeland-security-investigations.
4 “records, documents, and items,” including any electronic devices, constituting,
in relevant part, “evidence, contraband . . . and property . . . used in violations of
Title 18 U.S.C. § 2252A, relating to material involving the receipt, distribution,
transportation and possession of child pornography.” Supp. App’x 5. Records
“bearing on the production . . . of any visual depictions of minors engaged in
sexually explicit conduct as defined in 18 U.S.C. § 2256” were also subject to
seizure. Supp. App’x 7. As for any electronic device found to contain CSAM,
the warrant authorized, inter alia, seizure of evidence “of who used, owned or
controlled” the device at the time such material was created, edited, or deleted;
evidence of the times the device was used; and “[c]ontextual information
necessary to understand” the material subject to seizure. Supp. App’x 8.
The search warrant was executed on March 20, 2018. HSI special agents
seized “multiple computers, cell phones, tablets, cameras, thumb drives, and other
electronic devices,” and Johnson was charged with distributing child pornography
the same day. App’x 27. A subsequent forensic review of the seized material,
completed in June 2018, revealed approximately 8,816 videos and 6,931 images of
CSAM on multiple devices, as well as other digital evidence falling within the
search warrant’s scope.
5 Originally charged with the distribution of child pornography, Johnson
entered into a written plea agreement with the Government in November 2018
pursuant to which he ultimately pled guilty to a single count of possession of child
pornography in violation of 18 U.S.C. § 2252(a)(4)(B). The agreement included
the following provision:
12. The United States agrees that in the event that CORY JOHNSON fully and completely abides by all conditions of this agreement, the United States will:
a. not prosecute him in the District of Vermont for any other criminal offenses known to the United States as of the date it signs this plea agreement, committed by him in the District of Vermont relative to his knowing possession or distribution of child pornography. . . .
App’x 69. Pursuant to Federal Rule of Criminal Procedure 11(c)(1)(C), the parties
stipulated to a term of imprisonment of 45 months. Johnson entered his plea on
January 4, 2019. The United States District Court for the District of Vermont
(Crawford, C.J.) imposed the 45-month sentence in May of 2019.
B. The 2019 Investigation
About a month later, SA Moynihan sent the National Center for Missing and
Exploited Children (“NCMEC”) copies of the contraband video and image files –
the CSAM – provided to her by the HSI forensic analyst who had located this
6 material on Johnson’s devices and flagged it as responsive to the search warrant. 3
This segregated material constituted a subset of the much larger body of digital
data on his various devices. Law enforcement agencies like HSI regularly submit
such material to NCMEC, which is organized as a private nonprofit but
established by Congress, 4 so that newly seized CSAM can be compared with
material in the NCMEC database in order to identify children not previously
known to law enforcement who might be at risk and to assist in obtaining
restitution for victims. 5 Ordinarily this review would have been conducted
during the investigatory phase of Johnson’s original prosecution, but SA
Moynihan forgot to send NCMEC the files until June. 6
3 HSI submitted 3,761 images and 3,653 video files to NCMEC after removing various duplicate CSAM files found on the multiple devices. 4 See Missing Children’s Assistance Act, Pub. L. No. 98-473, div. II, § 660, 98 Stat. 2125 (1984) (codified as amended at 34 U.S.C. §§ 11291 et seq.). 5 NCMEC “maintain[s] a database of known collections of child pornography.” App’x 27. Its Child Victim Identification Program is used to compare investigative files with already-known CSAM images and videos in order to identify at-risk children and assist in providing restitution to victims by identifying the actual children depicted. 6 Based principally on SA Moynihan’s testimony at the suppression hearing, the district court found that this deviation from normal procedure was an oversight and that “[t]here is no basis for concluding that SA Moynihan intentionally postponed the submission of the file to NCMEC until the Government had secured a guilty plea and a conviction.” See App’x 28. Johnson does not challenge this factual finding on appeal.
7 After conducting its review over the summer, NCMEC notified SA
Moynihan that it had identified a video that was not already in its CSAM database.
In an email on September 4, 2019, NCMEC informed SA Moynihan that the video,
which depicted the sexual abuse of a toddler by an adult, appeared to have been
created near Burlington, Vermont. NCMEC based this determination on the
video’s metadata, which included GPS coordinates indicating that the video may
have been produced in South Burlington. 7 SA Moynihan retrieved and reviewed
the video file, which was originally located among the digital files on a cell phone
seized from Johnson. The video depicted an adult male abusing a young girl “by
rubbing his penis against her buttocks and ejaculating.” App’x 28. SA
Moynihan recognized Johnson’s voice in the video and believed the young child
to be about the age of Johnson’s daughter at the time the video was created. After
matching the GPS longitude and latitude coordinates provided by NCMEC to the
7 “Metadata” refers generally to digital information about other digital files including, e.g., a file’s author, the times it was modified, or – as is often the case for images and videos – the GPS coordinates where it was created. See 1 JAY E. GRENIG & WILLIAM C. GLEISNER, III, EDISCOVERY & DIGITAL EVIDENCE § 4:13 Metadata types (2023); Sharon D. Nelson & John W. Simek, Metadata in Digital Photos – Should You Care?, 87 WIS. LAW. 43 (2014). The video at issue had been identified as CSAM during HSI’s forensic analysis, but the GPS metadata had not previously been reviewed. At the time of HSI’s analysis, the forensic examiner could not have ascertained whether GPS data was embedded in the many videos identified as CSAM other than by going through them one at a time and using a different software than the software used to locate the contraband videos.
8 approximate location of Johnson’s house, SA Moynihan sought a second warrant
to again search Johnson’s home, this time looking for distinctive bedding that
appeared in the background of the video: a white and pink blanket; a yellow, pink,
and blue-flowered sheet; a pink pillow with flowers and butterflies; and fabric
decorated with a green elephant. 8
The second warrant issued in September 2019. When the execution of that
warrant turned up the bedding seen on video, the Government sought and
obtained an indictment from the Grand Jury charging Johnson with production of
child pornography in violation of 18 U.S.C. § 2251(a). The present prosecution
ensued.
8 Johnson had moved from one house to another since the first search, and since the video was apparently produced. The warrant application, which was for the new residence, stated that “it is common for individuals to move their belongings from one residence to a new residence” such that it remained probable Johnson still possessed the bedding. 2019 District Court Docket No. 29-8 at 9. As later conceded by the Government, the warrant application contained an error regarding the GPS coordinates. SA Moynihan attested that upon entering the coordinates into a Google Maps program, they “resolved back to a residence located at 7 Kingfisher Court in South Burlington,” which was Johnson’s former residence. App’x 28. In fact, the “pin” location in the Google Maps program was 1 Kingfisher Court, a nearby location. The district court determined that SA Moynihan had made an honest mistake and that “[a] search warrant application showing that the video found on Mr. Johnson’s cell phone was produced in the immediate vicinity of his prior address – but at 1 Kingfisher rather than 7 Kingfisher – would have been sufficient to support probable cause.” App’x 29–30.
9 II. Procedural History
Before the district court, Johnson sought to suppress the digital data seized
during the 2018 search and reviewed by NCMEC in 2019 (i.e., the CSAM video of
his daughter and its associated metadata), as well as the fruits of the 2019 search
of Johnson’s home, including the seized bedding. As relevant to this appeal,
Johnson argued that NCMEC, acting as a Government agent, violated the Fourth
Amendment by searching data beyond the scope of the 2018 warrant for evidence
of a new crime (i.e., production of child pornography, rather than distribution and
possession). Even if NCMEC’s search was within the scope of the initial warrant,
Johnson further urged, it still violated the Fourth Amendment because it was not
conducted within a reasonable time.
Johnson also sought dismissal of the 2019 indictment, arguing that the
production charge was precluded by his 2018 plea agreement and that the
Government had breached the agreement by prosecuting him again. Johnson
argued that the new charge ran afoul of the Government’s promise not to
prosecute him in the District of Vermont “for any other criminal offenses known
to the United States” as of the date it signed the plea agreement “committed by
him in the District of Vermont relative to his knowing possession or distribution
of child pornography.” United States v. Johnson, No. 19-CR-140 (D. Vt.) (“2019 10 District Court Docket”), Docket No. 20 at 9–12. He contended that even if the
production offense was not actually known to the Government, he nonetheless
reasonably expected that it was, and that the plea agreement should be interpreted
so as to uphold his reasonable expectation.
The district court denied the motions in October 2020 and June 2021 orders.
See 2019 District Court Docket No. 41 (the motion to dismiss); United States v.
Johnson, No. 19-CR-140, 2021 WL 2667168 (D. Vt. June 29, 2021) (the motion to
suppress).
As to the suppression motion, the district court concluded that even
assuming arguendo that NCMEC acted as an agent of law enforcement in
reviewing the CSAM in 2019, the Fourth Amendment was not violated. NCMEC
reviewed only known contraband, the district court concluded, in which Johnson
had no Fourth Amendment interest that could be infringed by the search, its
timing, or by any subsequent review of the same digital material by SA Moynihan.
The district court thus denied Johnson’s motion to suppress the video of his
daughter and its GPS metadata. The court also declined to suppress the items
recovered from Johnson’s home in the 2019 search pursuant to the second warrant,
concluding that no Fourth Amendment violation had occurred.
11 As to the motion to dismiss, the district court declined to dismiss the
indictment, holding that Johnson’s 2018 plea agreement did not preclude the
subsequent production charge for two independent reasons. First, the court
determined that the plea agreement excluded future prosecution only for crimes
“relative to knowing possession or distribution of child pornography” and that
“the new charges,” for production of child pornography, did not fall within this
prohibition. App’x 19, 23. The court reasoned that production of child
pornography is a fundamentally different crime than possession or distribution of
it, both in its legal elements and its ordinary understanding. See App’x 19
(comparing statutory elements and observing, “[m]aking a movie is
fundamentally different from going to the theatre”). Second, concluding that the
plea agreement prohibited the Government from prosecuting Johnson only for
“any other criminal offenses known to the United States as of the date it sign[ed]
[the] plea agreement,” the district court held that the new charges were “based on
new information which arrived after final judgment issued in the first case.”
App’x 18, 23. “Either reason,” the district court concluded, “is sufficient to defeat
[the] motion to enforce” the agreement. App’x 23.
12 The district court accepted Johnson’s conditional guilty plea on the
production charge and sentenced him to 240 months of imprisonment for that
crime, to be followed by a term of 15 years of supervised release. This appeal
followed.
DISCUSSION
Johnson contends on appeal that (1) the district court erred in denying his
motion to suppress because NCMEC’s review of the metadata associated with the
CSAM video of his daughter’s abuse, which prompted SA Moynihan’s review of
the video and her subsequent investigation, violated the Fourth Amendment; and
(2) the district court erred in denying his motion to dismiss the production
indictment because this second prosecution was barred by his earlier 2018 plea
agreement. Johnson argues that this Court should reverse the denial of his
suppression motion, order specific performance of the 2018 plea agreement, and
dismiss the second indictment with prejudice. For the following reasons, we
disagree.
I. The Suppression Motion
As to the suppression motion, Johnson argues that NCMEC acted as a
Government agent when reviewing his digital data and that the Government
violated the Fourth Amendment in conducting this review by searching for
13 evidence—namely, the GPS metadata—beyond the scope of the 2018 warrant, and
in order to investigate a crime not specified in that warrant. 9 Johnson further
contends that even if the examination of the metadata was within the scope of the
2018 warrant, the review of that data in September 2019 did not occur within a
constitutionally reasonable time after the issuance of the warrant in April 2018.
The district court thus erred, according to Johnson, in concluding that no Fourth
Amendment violation occurred, and that suppression was not warranted.
These claims are without merit. Assuming arguendo that NCMEC acted as
a Government agent in reviewing the CSAM files located on Johnson’s digital
devices and identified pursuant to the 2018 search warrant, it in no way violated
the Fourth Amendment in conducting this review. NCMEC examined digital
material that was responsive to the 2018 search warrant and that had already been
segregated from Johnson’s other digital information as falling within the warrant’s
scope. Neither NCMEC nor SA Moynihan violated the Fourth Amendment by
examining this previously-segregated, responsive digital information, nor,
contrary to Johnson’s claim, was this examination constitutionally unreasonable
9 Because his conditional plea agreement does not permit it, Johnson does not challenge the denial of his motion to suppress evidence seized pursuant to the 2019 search warrant (i.e., the bedding found in his home) except insofar as such evidence can be characterized as a fruit of the NCMEC search.
14 because of its timing. Accordingly, we affirm the order of the district court
denying Johnson’s motion to suppress.
* * *
As an initial matter, NCMEC’s review of the digital information provided
to it by SA Moynihan did not constitute a search for Fourth Amendment purposes,
even assuming arguendo that NCMEC acted as a Government agent in reviewing
this material. Pursuant to Federal Rule of Criminal Procedure 41(e)(2)(B), the
2018 search warrant authorized the seizure of electronic storage media for later
review “to determine what electronically stored information [fell] within the scope
of the warrant.” Fed. R. Crim. P. 41 Advisory Committee’s Note (2009) (noting
that Rule 41 “acknowledges the need for a two-step process” in which officers may
seize or copy a storage medium for later off-site review, given the large amounts
of information often contained in electronic storage media). After the seizure of
Johnson’s electronic storage devices, material responsive to the warrant was
identified during a forensic review that was completed in June 2018. The CSAM
examined by NCMEC in 2019 had thus already been identified as responsive and
segregated from the remainder of Johnson’s digital information.
When criminal investigators reexamine evidence that has lawfully been
seized pursuant to a warrant – returning to look again at a drug ledger, for 15 instance, or to perform lab tests on a blood-stained jacket – we do not ordinarily
view such investigative steps as constituting a new Fourth Amendment event.
To be sure, as this Court has said before, the seizure of electronic devices, which
“can give the government possession of a vast trove of personal information about
the person to whom [the devices] belong[], much of which may be entirely
irrelevant to the criminal investigation that led to the seizure,” is very different
from the seizure of a drug ledger or an item of clothing. United States v. Ganias,
824 F.3d 199, 217 (2d Cir. 2016). For this reason, the mere fact that digital material
has been lawfully collected does not in all circumstances permit the future review
of stored information. See United States v. Hasbajrami, 945 F.3d 641, 670 (2d Cir.
2019). That said, the general principle that law enforcement can reexamine
lawfully seized material during the course of an investigation without engaging
in a new search has clear application in a case like this, where stored data
responsive to a search warrant has been separated out from nonresponsive data,
and investigators return to reexamine only the responsive material in pursuit of
law enforcement ends.
Johnson argues that this case falls outside the general rule on the theory that
the 2018 search warrant did not, in fact, authorize the search for and seizure of the
16 metadata—including GPS information—associated with his CSAM. He asserts
that “[n]either the 2018 Affidavit nor warrant mention GPS,” and that “[n]either
GPS nor metadata were designated responsive to the warrant.” Appellant’s Br.
at 46, 48-49; Reply Br. at 26. Further, he says that NCMEC accessed his GPS data
only to prove that Johnson produced the CSAM video of his daughter and that such
a search necessarily exceeded the scope of the 2018 warrant, which was limited to
the search for evidence of possession or distribution of child pornography. Both
of these arguments are without merit.
We “look directly to the text of the search warrant to determine the
permissible scope of an authorized search.” United States v. Bershchansky, 788
F.3d 102, 111 (2d Cir. 2015). Here, the 2018 search warrant provides for the
seizure of
records, documents, and items that constitute evidence, contraband, fruits of crime, other items illegally possessed, and property designed for use, intended for use, or used in violations of Title 18 U.S.C. § 2252A, relating to material involving the receipt, distribution, transportation and possession of child pornography, in any form wherever it may be stored or found . . .
Supp. App’x 5. The warrant goes on to list a wide variety of electronic data
storage devices, making clear that both the devices and “any visual depictions of
child erotica and obscene visual representations of the sexual abuse of children in
17 any of the above”—i.e., the electronic CSAM files themselves – are subject to
seizure. Supp. App’x 6. The warrant also expressly authorizes the seizure of
“records bearing on the production” and “reproduction” of such depictions, not
only records reflecting transactions in visual depictions of minors engaged in
sexually explicit conduct. Supp. App’x 7. Finally, the warrant explicitly
provides for the seizure and search of,
[f]or any computer hard drive or other electronic media (hereinafter, COMPUTER”) found to contain information otherwise called for by this warrant . . . [e]vidence of who used, owned or controlled the COMPUTER at the time the things described in this warrant were created, edited, or deleted, such as logs, registry entries, saved usernames and passwords, documents, and browsing history . . . ; [e]vidence of the times the COMPUTER was used . . . ; [and] [c]ontextual information necessary to understand the evidence in this attachment[.]
Supp. App’x 8.
Together, these provisions in the 2018 search warrant can only be read to
authorize a search for the metadata embedded in files containing CSAM, even if
neither the terms “GPS” nor “metadata” themselves appear in the warrant. As
we have repeatedly observed in the context of digital searches, “[t]he Fourth
Amendment does not require a perfect description of the data to be searched and
seized,” and “it will often be impossible to identify in advance the words or
phrases that will separate relevant files or documents before [a] search takes 18 place.” 10 United States v. Ulbricht, 858 F.3d 71, 100, 102 (2d Cir. 2017), abrogated on
other grounds by Carpenter v. United States, 585 U.S. 296 (2018). Metadata is, by
definition, data about other data: it may reveal who “created, edited, or deleted”
digital data; identify when other data was accessed; and provide necessary
“[c]ontextual information . . . to understand” digital files. Supp. App’x 8. Such
evidence is expressly sought in the 2018 search warrant—and indeed defined more
carefully than a simple reference to metadata would have achieved.
Johnson’s response—that “[w]here a video is recorded has nothing to do
with whether it is [CSAM] or was received or transferred on the internet,”
Appellant’s Br. at 46 (emphasis added)—gives us no reason to distinguish between
GPS location information and metadata more generally. The warrant specifically
authorizes the seizure, among other things, of “[e]vidence of who used, owned or
controlled” any electronic storage device “found to contain information otherwise
called for by this warrant,” at the time such information—including CSAM—was
“created, edited, or deleted.” Supp. App’x 8 (emphasis added). And contrary to
10 Indeed, we have long recognized the same principle outside the digital context. See, e.g., United States v. Riley, 906 F.2d 841, 845 (2d Cir. 1990) (“It is true that a warrant authorizing seizure of records of criminal activity permits officers to examine many papers in a suspect’s possession to determine if they are within the described category. But allowing some latitude in this regard simply recognizes the reality that few people keep documents of their criminal transactions in a folder marked ‘drug records.’”).
19 Johnson’s claim, information as to the location at which child pornography is
produced is potentially relevant to identifying those who possess or distribute it,
as well as to establishing the requisite nexus to interstate or foreign commerce that
18 U.S.C. § 2252A, referenced in the 2018 search warrant, requires. More
generally, so long as a warrant seeking digital evidence is sufficiently particular—
as this one is—it may properly “be broad, in that it authorizes the government to
search . . . for a wide range of potentially relevant material.” Ulbricht, 858 F.3d at
102; see also United States v. Purcell, 967 F.3d 159, 181 (2d Cir. 2020) (affirming
Fourth Amendment reasonableness of warrants authorizing broad searches of
both digital and non-digital locations “so long as probable cause supports the
belief that the location to be searched—be it a drug dealer’s home, an office’s file
cabinets, or an individual’s laptop—contains extensive evidence of suspected
crimes”). The GPS location data here thus falls comfortably within the search
warrant’s language, just as surely as does information regarding the dates the
CSAM video was modified or accessed. 11
11 Because we conclude that NCMEC’s search was authorized by the terms of the 2018 search warrant, we need not reach the district court’s conclusion that the GPS metadata, because associated with a digital file that is itself contraband, was also contraband, defeating Johnson’s claim to retaining any Fourth Amendment interest in this information.
20 Johnson’s remaining challenges to NCMEC’s retrieval of the GPS
information are similarly deficient. To the extent he argues that the NCMEC
review was infirm because it was motivated by the objective of finding evidence of
production of child pornography, rather than the possession or distribution of it,
this argument is foreclosed by the general Fourth Amendment principle that “[a]n
action is ‘reasonable’ under the Fourth Amendment, regardless of the individual
officer’s state of mind, ‘as long as the circumstances, viewed objectively, justify [the]
action.’” Brigham City, Utah v. Stuart, 547 U.S. 398, 404 (2006) (quoting Scott v.
United States, 436 U.S. 128, 138 (1978)). Here, the 2018 search warrant authorized
a search for the GPS location data at issue. In such circumstances, and assuming
arguendo that NCMEC acted as a Government agent in reexamining the material
earlier deemed responsive to that 2018 search warrant, the motivations of its
personnel are not relevant. See Horton v. California, 496 U.S. 128, 138 (1990) (“The
fact that an officer is interested in an item of evidence and fully expects to find it
in the course of a search should not invalidate its seizure if the search is confined
in area and duration by the terms of a warrant or a valid exception to the warrant
requirement.”); cf. Whren v. United States, 517 U.S. 806, 814 (1996) (“[T]he Fourth
21 Amendment’s concern with ‘reasonableness’ allows certain actions to be taken in
certain circumstances, whatever [an officer’s] subjective intent.”).
Johnson next argues that even assuming the GPS metadata fell within the
scope of the 2018 warrant, NCMEC’s retrieval of this information in 2019 violated
the Fourth Amendment because it was untimely, as “judged not just by the
passage of time, but also by the significance of the intervening events,” including
Johnson’s prosecution, guilty plea, and sentencing. Appellant’s Br. at 58. We
again disagree. Assuming arguendo that delays in the forensic examination of
digital material seized pursuant to a warrant might in some circumstances
implicate the Fourth Amendment, that is not the case here.
“The touchstone of the Fourth Amendment,” as we have said before, “is
reasonableness.” United States v. Miller, 430 F.3d 93, 97 (2d Cir. 2005) (alteration
omitted) (quoting United States v. Knights, 534 U.S. 112, 118 (2001)). To be sure,
“the Fourth Amendment’s proscription of unreasonable searches and seizures ‘not
only . . . prevent[s] searches and seizures that would be unreasonable if conducted
at all, but also . . . ensure[s] reasonableness in the manner and scope of searches
and seizures that are carried out.’” Lauro v. Charles, 219 F.3d 202, 209 (2d Cir.
2000) (alterations in original) (quoting Ayeni v. Mottola, 35 F.3d 680, 684 (2d Cir.
22 1994), abrogated on other grounds by Wilson v. Layne, 526 U.S. 603 (1999)). Here,
however, NCMEC’s reexamination of digital material that had been timely
identified as responsive to the 2018 search warrant was not rendered
constitutionally infirm simply because Johnson’s prosecution, guilty plea, and
sentencing had already occurred. 12 The Government’s interest in locating child
victims and securing restitution for them was not extinguished at the conclusion
of Johnson’s prosecution. Nor was the Government’s ability to re-examine
lawfully seized digital information that had already been identified as responsive
to the 2018 search warrant.
III. The Plea Agreement
As to the motion to dismiss, Johnson argues that the Government was
precluded by the 2018 plea agreement from bringing the subsequent prosecution
for producing child pornography because this charge constitutes another offense
“relative to his knowing possession or distribution” of CSAM that was “known to
12 Moreover, even if NCMEC’s examination of the responsive material had been part of the original forensic review, the eighteen months between the seizure of Johnson’s devices and NCMEC’s review falls well within time periods courts have deemed constitutionally reasonable based on the circumstances in individual cases. See, e.g., United States v. Jarman, 847 F.3d 259, 266 (5th Cir. 2017) (holding a 23-month-long review reasonable under the circumstances).
23 the United States as of the date it signed the plea agreement.” 13 We review such
a claim de novo, interpreting the plea agreement in accordance with principles of
contract law. United States v. Wilson, 920 F.3d 155, 162 (2d Cir. 2019) (citing United
States v. Riera, 298 F.3d 128, 133 (2d Cir. 2002)). Factual findings are reviewed for
clear error. United States v. Yousef, 327 F.3d 56, 137 (2d Cir. 2003). To determine
whether the Government is in breach of the agreement, “we look both to the
precise terms of the plea agreement[ ] and to the parties’ behavior” and “seek to
determine what ‘the reasonable understanding and expectations of the defendant
[were] as to the sentence for which he had bargained.’” Wilson, 920 F.3d at 163
(quoting Paradiso v. United States, 689 F.2d 28, 31 (2d Cir. 1982)). In keeping with
the “delicate private and public interests that are implicated in plea agreements,”
we construe them “strictly against the Government.” United States v. Padilla, 186
13 Paragraph 12(a) of the 2018 plea agreement provides in relevant part as follows:
The United States agrees that in the event that CORY JOHNSON fully and completely abides by all conditions of this agreement, the United States will[] not prosecute him in the District of Vermont for any other criminal offenses known to the United States as of the date it signs this plea agreement, committed by him in the District of Vermont relative to his knowing possession or distribution of child pornography . . . App’x 69.
24 F.3d 136, 140 (2d Cir. 1999) (quoting United States v. Ready, 82 F.3d 551, 558–59 (2d
Cir. 1996)).
Applying these principles, we agree with the district court that Johnson’s
2018 plea agreement, pursuant to which he pled guilty to one count of knowing
possession of child pornography in violation of 18 U.S.C. § 2252, did not preclude
his subsequent prosecution for the production of child pornography, in violation
of 18 U.S.C. § 2251. Johnson’s claim to the contrary fails because the agreement’s
prohibition on further prosecution is limited to offenses “known to the United
States as of the date it sign[ed] th[e] agreement.” 14
At the start, as the district court observed, “[t]he evidence is undisputed”
that the Government learned of Johnson’s abuse of his toddler and his production
of child pornography only in September 2019, when SA Moynihan was notified by
NCMEC of the video Johnson had made. App’x 20. SA Moynihan testified at
the suppression hearing that on March 20, 2018, the day on which Johnson’s
devices were seized from his home, Johnson admitted to using Kik and looking at
child pornography from the age of 14 but denied that he had ever taken
14 Given this conclusion, we need not address the district court’s alternative finding that the 2018 plea agreement does not exclude prosecution for production of child pornography because production is not an offense “relative to knowing possession or distribution of child pornography.” App’x 19.
25 “inappropriate pictures of children” or “inappropriately touched children.” 2019
District Court Docket, Mot. to Suppress Hr’g Tr., Dkt. No. 53 at 12. The
presentence report (“PSR”), prepared in connection with Johnson’s sentencing for
possession of child pornography, describes his conduct as encompassing
possession and distribution of CSAM, but not production. And consistent with
the PSR, the Government informed the district court in its sentencing
memorandum that it was “not aware of any allegations of abuse within the
defendant’s home.” 15 Supp. App’x 16.
Johnson argues that the Government is properly held to have had
constructive knowledge of the abuse, as well as the video’s production, because
the video was among the vast collection of CSAM images and videos located on
his many devices. He relies principally on this Court’s cases addressing the
question whether the Government breaches a plea agreement when it advocates
for a sentence above the so-called Pimentel estimate in the agreement, “based on
information that the Government knew about at the time the plea was
15 In his own sentencing memorandum, Johnson admitted only “to having engaged in the surreptitious trading of [the] images and videos,” and urged imposition of the 45-month term contained in the plea agreement in light of the fact that, inter alia, he was the father of three small children who had provided him with a new purpose in life. Supp. App’x 10–11.
26 negotiated.” 16 Wilson, 920 F.3d at 163. But in the Pimentel context itself, these
cases do not stand for the proposition that knowledge of facts germane to a
Pimentel estimate should be imputed to the Government based on digital material
in its possession that has not been reviewed. 17 Indeed, deviation from a Pimentel
estimate may not constitute a breach of the plea agreement even when a change in
position is based on information about which the Government was fully aware at
the time the agreement was negotiated. United States v. Habbas, 527 F.3d 266, 272
16 A Pimentel estimate is an estimate of a defendant’s likely sentencing range under the United States Sentencing Guidelines and is included in plea agreements at our suggestion, to avoid a defendant’s unfair surprise at the Guidelines range. See United States v. Pimentel, 932 F.2d 1029, 1034 (2d Cir. 1991) (suggesting that the Government “inform defendants, prior to accepting plea agreements, as to the likely range of sentences that their pleas will authorize under the Guidelines”). 17 Johnson relies principally on Wilson and United States v. Palladino, 347 F.3d 29 (2d Cir. 2003). In these cases, the Government was held to have breached a plea agreement by urging a sentence above the estimate, but in a context in which it relied on information that it not only possessed but had taken fully into account when the plea agreement was negotiated. Wilson, 920 F.3d at 166–67 (“the Government knew about [Defendant’s] activities and, based on that, made the conscious choice to exclude certain enhancements in the Government’s Guidelines estimate”); Palladino, 347 F.3d at 34 (“According to the Government, the information on the tape that served as the basis for the disputed enhancement was known to the Government at the time the plea agreement was signed.”). There was thus “little daylight,” as Wilson put it, between the information adduced at sentencing and that considered at the time of the plea negotiation. 920 F.3d at 165–66 (noting that the Government’s argument to sentence above the Pimentel estimate was “on the basis of information . . . well-known to the Government at the time it negotiated [the defendant’s] plea”). See also Palladino, 347 F.3d at 34 (noting that “the information on the tape” used by a “different Assistant United States Attorney” to urge sentencing above the Pimentel estimate was “known to the Government at the time the plea agreement was signed.”)
27 (2d Cir. 2008). “As with other questions of breached plea agreements,” as the
Wilson court put it, we look to “the precise terms of the plea agreements and to the
parties’ behavior,” seeking to determine “‘the reasonable understanding and
expectations of the defendant’” as to the bargained-for sentence, and with an eye
to avoiding unfairness and rectifying any bad faith act on the Government’s part.
Wilson, 920 F.3d at 163 (quoting Paradiso, 689 F.2d at 31).
Here, such considerations do not cut in favor of Johnson’s position. The
language of the plea agreement is clear: the Government’s commitment is to not
prosecute Johnson in the District of Vermont “for any other criminal offenses
known to the United States” as of the date it entered into the agreement and
“committed by him in the District of Vermont relative to his knowing possession
or distribution of child pornography.” App’x 69 (emphasis added). The plea
agreement itself, as already made clear, does not reference the production of child
pornography. 18 As to the record, it is not only devoid of any indication that the
Government was aware of Johnson’s sexual abuse of his daughter and his
18 Indeed, its favorable terms further evidence the Government’s lack of knowledge of Johnson’s more serious production offense. Johnson, initially charged with distribution of child pornography and facing a five-year mandatory minimum sentence and up to 20 years of imprisonment, pled guilty to a lesser-included possession offense and received a negotiated below-Guidelines sentence of 45 months, notwithstanding the immense trove of CSAM that he possessed.
28 production of CSAM: it affirmatively reflects the Government’s understanding
that Johnson had not engaged in the abuse of children. In such circumstances,
Johnson could not harbor the reasonable expectation that the plea agreement
absolved him of future prosecution for the as-yet undiscovered crime of producing
CSAM. Johnson’s argument to the contrary is without foundation in our
precedent or in the factual circumstances of this case.
CONCLUSION
We have considered Johnson’s remaining arguments and conclude that they
are without merit. Accordingly, discerning no error in the district court’s orders
denying Johnson’s motions to suppress and to dismiss the indictment, we AFFIRM
the judgment of the district court.