United States v. Keith

980 F. Supp. 2d 33, 2013 WL 5918524, 2013 U.S. Dist. LEXIS 158282
CourtDistrict Court, D. Massachusetts
DecidedNovember 5, 2013
DocketCriminal Action No. 11-10294-GAO
StatusPublished
Cited by14 cases

This text of 980 F. Supp. 2d 33 (United States v. Keith) is published on Counsel Stack Legal Research, covering District Court, D. Massachusetts primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
United States v. Keith, 980 F. Supp. 2d 33, 2013 WL 5918524, 2013 U.S. Dist. LEXIS 158282 (D. Mass. 2013).

Opinion

OPINION AND ORDER

O’TOOLE, District Judge.

The defendant, David Keith, is charged with distribution of child pornography in violation of 18 U.S.C. § 2252(a)(2) and possessing and accessing child pornography in violation of 18 U.S.C. § 2252(a)(4)(B). He has moved to suppress physical evidence and statements obtained as the result of a [36]*36search of his residence by the Massachusetts State Police pursuant to a warrant.

The application for the warrant relied on two distinct sources of information for a showing of probable cause. First, in December 2009, the National Center for Missing and Exploited Children (“NCMEC”) made available to the Massachusetts State Police a “CyberTipline” report indicating that a computer that eventually was linked to the defendant’s residence was likely the source of an emailed file that contained what appeared to be child pornography meeting the federal criminal definition.1 Second, on July 29, 2010, employees of a Staples store in New Hampshire notified local police that a laptop computer left for repair contained files with filenames apparently describing child pornography. The work order for the Staples laptop listed the defendant’s name and his residential address in Haverhill, Massachusetts. When later questioned by the police in New Hampshire, the defendant admitted both that the Staples laptop was his and that he had seen and downloaded files depicting images of children as young as eight years old engaging in sexual activity. The New Hampshire police ultimately shared with the Massachusetts State Police information they had gathered in their investigation, including some evidence from a warranted search of the laptop. Relying on both the NCMEC CyberTipline report and the information from the New Hampshire police, the Massachusetts State Police applied for and obtained a search warrant for the defendant’s residence, which was executed on September 17, 2010. The search yielded incriminating information, and the defendant also made incriminating admissions after having been advised of his Miranda rights.

I. The CyberTipline Report

The following factual findings are based on the parties’ written submissions and testimony given at an evidentiary hearing.

America Online (“AOL”), which may be described variously as an electronic service provider (“ESP”) and an internet service provider (“ISP”), provides an email service for subscribers. To prevent its communications network from serving as a conduit for illicit activity, AOL systematically attempts to identify suspected child pornography that may be sent through its facilities. It uses an Image Detection and Filtering Process (“IDFP”) of its own devise which compares files embedded in or attached to transmitted emails against a database containing what is essentially a catalog of files that have previously been identified as containing child pornography.

Commonly, AOL may be alerted that an image or video file being transmitted through its facilities likely contains child pornography by a complaint from a customer. When AOL receives such a complaint, an employee called a “graphic review analyst” opens and looks at the image or video file and forms an opinion whether what is depicted likely meets the federal criminal definition of child pornography. If the employee concludes that the file contains child pornography, a hash value of the file is generated automatically by operation of an algorithm designed for that purpose. A hash value is an alphanumeric sequence that is unique to a specific digital file. Any identical copy of the file will have exactly the same hash value as the original, but any alteration of the file, in-[37]*37eluding even a change of one or two pixels, would result in a different hash value. Consequently, once a file has been “hashed,” a suspected copy can be determined to be identical to the original file if it has the same hash value as the original, and not to be identical if it has a different hash value.

AOL maintains a “flat file” database of hash values of files that AOL has at some time concluded contain child pornography. It does not maintain the actual files themselves; once a file is determined to contain child pornography, it is deleted from AOL’s system. When AOL detects a file passing through its network that has the same hash value as one in the flat file database, AOL reports that fact to NCMEC via the latter’s CyberTipline. By statute, an ESP or ISP such as AOL has a duty to report to NCMEC any apparent child pornography it discovers “as soon as reasonably possible.” 18 U.S.C. § 2258A(a)(l). The CyperTipline report transmits the intercepted file to NCMEC, but no AOL employee opens or views the file. AOL’s decision to report a file to NCMEC is made solely on the basis of the match of the hash value of the file to a stored hash value.

A CyberTipline report is typically created by direct upload to NCMEC’s server through a facility made available by NCMEC to an ESP such as AOL specifically for that purpose. After a report is received, a NCMEC analyst opens and views the file to determine whether its content meets the federal criminal definition of child pornography. If it is determined that the file contains child pornography, the NCMEC analyst queries the email sender’s internet protocol (“IP”) address using conventional “open source” search engines to try to identify the sender’s geographic location, as well as the ISP through which the sender accesses the internet. When the general geographic location and the relevant ISP for the computer of interest have been determined, the NCMEC analyst adds the report containing the file to a database that is accessible only to law enforcement agencies in the identified geographic location via a virtual private network (“VPN”) that is dedicated to that use.

In this case, AOL identified a suspect file in an email sent on November 26, 2009. The following day, AOL uploaded a Cyber-Tipline report that contained the file to NCMEC’s server. In accordance with its practice, no AOL employee opened or viewed the file before it was forwarded to NCMEC. Rather, it was forwarded solely because its hash value matched a hash value in AOL’s flat file database. Nothing is known about how the file came to be originally hashed and added to the flat file database, except that it was AOL’s practice to hash and add to the database either the hash value of any file that was identified by one of its graphic file analysts as containing child pornography or a hash value similarly generated by a different ESP or ISP and shared with AOL.2

After the file was received at NCMEC, an analyst opened and examined the image file, determined that it met the criteria for classification as child pornography, investigated the IP address from which the offending email originated, and determined that the IP address was located within Massachusetts. NCMEC then created the CyberTipline report and made it accessible to law enforcement personnel in Massachusetts through the dedicated VPN, along with information about the email sender’s [38]*38IP address and ISP. Subsequently subpoenaed records from the ISP associated the IP address with a computer at the defendant’s residential address in Haverhill, Massachusetts.

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Commonwealth v. Dunn
Massachusetts Supreme Judicial Court, 2024
People v. Wilson
California Court of Appeal, 2020
United States v. DiTomasso
932 F.3d 58 (Second Circuit, 2019)
United States v. Streett
363 F. Supp. 3d 1212 (D. New Mexico, 2018)
State v. Stuart Lizotte, Jr.
2018 VT 92 (Supreme Court of Vermont, 2018)
United States v. Tolbert
326 F. Supp. 3d 1211 (D. New Mexico, 2018)
United States v. Coyne
387 F. Supp. 3d 387 (D. Vermont, 2018)
United States v. Ackerman
296 F. Supp. 3d 1267 (D. Kansas, 2017)
US v David Morel Jr.
2017 DNH 128 (D. New Hampshire, 2017)
USA v David Morel
2017 DNH 072 (D. New Hampshire, 2017)
United States v. Ackerman
831 F.3d 1292 (Tenth Circuit, 2016)
People v. Pierre
51 Misc. 3d 1035 (New York Supreme Court, 2016)
People v. Thompson
51 Misc. 3d 693 (New York Supreme Court, 2016)

Cite This Page — Counsel Stack

Bluebook (online)
980 F. Supp. 2d 33, 2013 WL 5918524, 2013 U.S. Dist. LEXIS 158282, Counsel Stack Legal Research, https://law.counselstack.com/opinion/united-states-v-keith-mad-2013.