United States v. Kirk Cottom

679 F. App'x 518

• Court: Court of Appeals for the Eighth Circuit
• Decided: February 17, 2017
• Docket: 16-1050
• Status: Unpublished

Opinion

PER CURIAM.

Kirk Cottom pled guilty to accessing with intent to view child pornography, in violation of 18 U.S.C. § 2252A(a)(5)(B), and receipt of child pornography, in violation of 18 U.S.C. § 2252A(a)(2)(A), On appeal, Cottom challenges the district court’s 1 denials of his motion to suppress and motion in limine. We affirm.

I. BACKGROUND

This case involves charges stemming from a 2012 FBI investigation into a computer server in Bellevue, Nebraska, that was hosting child-pornography websites. See also United States v. Welch, 811 F.3d 275 (8th Cir.), cert. denied, — U.S. -, 136 S.Ct. 2476, 195 L.Ed.2d 811 (2016). Cottom is one of multiple defendants charged as a result of the investigation. Welch described the investigation in detail:

[The investigated websites] operate[d] on a clandestine network, accessible only with special software and designed to obscure a user’s identity. This prevented FBI agents from discovering the Internet Protocol (IP) addresses of [the websites’] users, An Internet Service Provider (ISP) assigns an IP address to an individual computer using its Internet service and associates the IP address with the physical address to which that service is being provided. If investigators know an Internet user’s IP address, they can subpoena that user’s ISP to provide the associated physical address.

Rather than shut the server down, the FBI sought to install software on the server that would circumvent this [clandestine] network, providing agents with information about any user who accessed certain content on [the targeted websites] (the “Network Investigative Technique” or NIT). This information included the user’s IP address, the date and time the user accessed the content, and his or her computer’s operating system. The FBI obtained a warrant (the NIT warrant) to install the software in November 2012 and kept the website[s] in operation for approximately three weeks, collecting information on several ... users. Based on this information, the FBI obtained [Cottom’s] IP address.

Id. at 277-78. Once the FBI obtained Cot-tom’s IP address through the use of the NIT, it issued an administrative subpoena to the corresponding ISP to identify Cot-tom’s physical address. In April 2013, officers executed a search warrant at Cot-tom’s Rochester, New York, residence, seized evidence containing images of child pornography, and arrested him. The search and subsequent arrest of Cottom took place as part of a coordinated, synchronized search effort by the FBI and government lawyers designed to conduct searches in temporal proximity with each other so as to reduce communication between the alleged would-be codefendants and to ultimately preserve evidence.

Before the district court, Cottom, along with other codefendants, challenged the delayed notice they received following the execution of the NIT warrant and objected to the introduction of evidence obtained as a result of the search. In Cottom’s case, for example, although the warrant was executed and the NIT installed in November 2012, the search of his residence, and his subsequent arrest, occurred in April 2013. Cottom argued that this delay violated Federal Rule of Criminal Procedure 41, which requires that a copy of an executed search warrant be provided to the owner of the property seized. Fed. R. Crim. P. 41(f). By statute, this Rule 41 provision may be delayed under circumstances for thirty days or to a later date certain and officers may seek extensions. 18 U.S.C. § 3103a(b). 2 The warrant at issue here did contain a request for such a delay. The various defendants challenged the warrant and the delay requested therein, arguing that the relevant language in the warrant required notice within thirty days of execution of the warrant, not thirty days after the user was identified, as the delay request was interpreted and applied by the government. The district court rejected the argument, holding “that the [NIT] warrant intended the thirty-day notice period to begin running when the FBI identified an individual ’behind the keyboard[,]’ ... [which] occurred in April 2013 when officers executed the residential search warrant[s.]” Welch, 811 F.3d at 279 (reviewing the NIT wax-rant at issue in Cot-tom’s case). Thus, the district court held that the government's request for a delay was valid and denied the motions to suppress filed by the defendants.

Regarding Cottom’s motion in limine, during discovery Cottom moved for additional discovery, including a request for the original source code that was used to create and deploy the NIT; a code Cottom claimed was needed to determine how the NIT was configured. The government conceded that the original source code was not preserved and Cottom sought exclusion of the expert testimony of FBI Special Agent Smith and Supervisory Special Agent Gordon under Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579, 113 S.Ct. 2786, 125 L.Ed.2d 469 (1993). Because the original source code was not preserved, Cottom argued that these experts’ opinions regarding the NIT employed in this case lacked proper foundation and were based on insufficient data. The district court denied the motion following a hearing on the matter. Cottom additionally challenges this ruling on appeal.

II. DISCUSSION

A. Motion to Suppress

“When reviewing a district court’s denial of a suppression motion, we review for clear error the district court’s factual findings and review de novo whether the Fourth Amendment was violated.” Welch, 811 F.3d at 279 (quoting United States v. Bell, 480 F.3d 860, 863 (8th Cir. 2007)). On these facts, “a Rule 41 violation amounts to a violation of the Fourth Amendment warranting exclusion ’only if [Cottom] is prejudiced or if reckless disregard of proper procedure is evident.’” Id. (quoting United States v. Spencer, 439 F.3d 905, 913 (8th Cir. 2006)).

The NIT warrant at issue included a section- entitled “Request for Delayed Notice” that cited the provisions of Rule 41(f)(3) and § 3103a(b)(l) and (3), and included factual support for the requested delay. Namely the affidavit stated that announcing the proposed use of the NIT could cause those individuals accessing the websites to undertake measures to conceal their identity or abandon the use of the websites completely; would risk the destruction of, or tampering with, evidence; and could seriously jeopardize the success of the investigation into the conspiracy and impede efforts to learn the identity of the target individuals, whose exact identities had not yet been determined. Accordingly, the government sought delay of notice “until 30 days after any individual accessing [the targeted websites] has been identified to a sufficient degree as to provide notice, unless the Court finds good cause for further delayed disclosure.”

In Welch, a case involving a codefendant of Cottom, we reviewed the district court order denying the defendants’ motions to suppress evidence obtained as a result of the NIT warrant—the same order at issue here. Id. at 279-81. As to the delay request in the NIT warrant, Welch argued “that the [statutory] thirty-day period began to run from the date the government received the subscriber information for Welch’s IP address from his ISP.” Id. at 280. Welch claimed that because agents testified that the NIT warrant was used to obtain a user’s IP address, “the subject of the warrant was the subscriber assigned that IP address, and so the subject was ’identified’ in December, not the following April,” and thus he was provided notice beyond the thirty-day time period in violation of Rule 41. Id.

On appeal in Welch, we disagreed with the district court’s determination that the delay request in the NIT warrant was valid under the law. Rather, we held that the notice the government gave Welch failed to comport with Rule 41. Id. We held that the statute authorizing the judge to delay notice is perfectly clear—“the thirty-day extension runs from the execution of the warrant,” which in these cases, occurred in November 2012. Id. Despite the procedural violation, however, we concluded that Welch was not prejudiced by the violation nor did the investigators recklessly disregard proper procedure, and thus “the delayed notice to Welch of the NIT warrant did not violate the Fourth Amendment and so did not warrant suppression of evidence obtained from it.” Id. at 281. Welch controls the matter now before us. “A panel of this Court is bound by a prior Eighth Circuit decision unless that case is overruled by the Court sitting en banc.” United States v. Manning, 786 F.3d 684, 686 (8th Cir.) (quoting United States v. Wright, 22 F.3d 787, 788 (8th Cir. 1994)), cert. denied, — U.S. -, 136 S. Ct. 278, 193 L.Ed.2d 203 (2015).

On appeal, Cottom asks this court to follow our determination in Welch that the thirty-day extension ran from the execution of the warrant and thus the notice Cottom was provided failed to comply with Rule 41. Relying upon our analysis in Welch, we agree. 3 Welch, 811 F.3d at 281. Cottom goes on to argue, however, that the government lawyers authored the “Request for Delayed Notice” portion of the affidavit supporting the NIT warrant with an intentional and deliberate disregard of the procedural requirements in order “to grant the officers a pass around the proper procedures.” In that light, according to Cottom, the delay was a deliberate violation of Rule 41 and the officers’ delay in providing him notice could not have been a good faith application of the warrant and he was thus prejudiced by the violation. But, this issue, too, was analyzed and decided in Welch. Id. No matter who drafted the paragraph itself, we held in Welch that “the officers’ delay was a good-faith application of the warrant rather than a deliberate violation of Rule 41.” Id. This determination of good faith was corroborated by the agent who swore out the affidavit and applied for the NIT warrant, and who testified that the “delayed notice period was to begin when the government identified the true name user of an individual that accessed one of these three websites.” Id. This holding is binding upon us today.

Cottom unsuccessfully attempts to separate himself from the analysis in Welch, which resolved the issue as to whether the defendants were prejudiced by the violation that is now binding on this court. Therefore, the district court’s additional finding in this case that any Rule 41 violar tion did not prejudice Cottom is also not clearly erroneous. In that same vein, we, too, find that the district court’s finding that any Rule 41 violation was not due to reckless disregard of proper procedure was not clearly erroneous. Id. There is nothing in this record to indicate “that had the officers followed Rule 41 they would not have been able to search [Cottom’s] residence and obtain the evidence they did. The nature of the investigation indicates they could have easily obtained extensions had they sought them.” Id. The delayed notice to Cottom of the NIT warrant did not violate the Fourth Amendment and so did not warrant suppression of evidence obtained from it. The district court properly denied the motion to suppress.

B. Motion in Limine/Evidence Spoliation

During discovery, Cottom sought the original source code that was used to create and deploy the NIT. The government conceded that the original source code was not preserved, and on that basis, Cottom sought exclusion of expert testimony offered by the government, arguing that without the original source code, Cot-tom’s own experts could not definitively determine whether the NIT satisfied the Daubert standard and thus opinions of the government experts lacked proper foundation and were based on insufficient data. The district court denied the motion, concluding after an evidentiary hearing that the government’s failure to preserve and produce the original source code was of little consequence to the determination whether the government’s experts satisfied the prerequisites under Daubert.

We review a district court’s determination on the admissibility of expert testimo ny for abuse of discretion. United States v. Coutentos, 651 F.3d 809, 820 (8th Cir. 2011). In a case involving the alleged spoliation of evidence, “a district court is required to make two findings before an adverse inference instruction is warranted: (1) ‘there must be a finding of intentional destruction indicating a desire to suppress the truth,’ and (2) ‘[tjhere must be a finding of prejudice to the opposing party.’ ” Hallmark Cards, Inc. v. Murley, 703 F.3d 456, 460 (8th Cir. 2013) (alteration in original) (quoting Stevenson v. Union Pac. R.R. Co., 354 F.3d 739, 746, 748 (8th Cir. 2004)).

Thoroughly reviewing all of the evidence, the district court noted that “[t]he government’s experts and the defendant’s own expert all testified that source code information would make little difference in determining that the NIT employed in this case is reliable and that the techniques that were used to derive it are repeatable.” Additionally, “[tjhere [was] no evidence of anything other than an inadvertent failure to preserve the source code ... and the lost data [was] essentially recoverable,” which lead to the district court’s sound holding on the issue of spoliation and admissibility. Reviewing the evidence and arguments on appeal, we find no abuse of discretion by the district court in denying the motion in limine.

III. CONCLUSION

For the reasons stated herein we affirm.

1 . The Honorable Joseph F. Bataillon, United States District Judge for the District of Nebraska.

2 . Rule 41(f)(1)(C) states:

The officer executing the warrant must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken or leave a copy of the warrant and receipt at the place where the officer took the property.

Rule 41(f)(3) allows a delay in providing the warrant if authorized by statute. Title 18 U.S.C. 3103a(b) provides that notice of a warrant may be delayed if:

(1)the court finds reasonable cause to believe that providing immediate notification of the execution of the warrant may have an adverse result .,.;

(2) the warrant prohibits the seizure of any tangible property, any wire or electronic communication ..., or ... any stored wire or electronic information, except where the court finds reasonable necessity for the seizure; and

(3) the warrant provides for the giving of such notice within a reasonable period not to exceed 30 days after the date of its execution, or on a later date certain if the facts of the case justify a longer period of delay.

3 . Our determination on the matter in Welch, as here, was conditioned on the assumption that Rule 41(f) applies to the NIT warrant. Rule 41(f)(1)(C) requires that a copy of the warrant and a receipt of the property taken be left with the "person from whom, or from whose premises, the property was taken.” Rule 41 defines property to "include[] documents, books, papers, any other tangible objects, and information." Fed. R. Crim. P. 41(a)(2)(A) (emphasis added). Whether Cot-tom's IP address (which is generated by a third party and assigned by the ISP), the time and date he accessed the website content, and his computer’s operating system are the kind of "information” considered to be property under Rule 41 is an open question. 811 F.3d at 280 n.4. As in Welch, however, because we affirm the district court, we need not address that argument here.