United States v. Matthew Mann

• Court: Court of Appeals for the Seventh Circuit
• Decided: January 20, 2010
• Docket: 08-3041
• Status: Published

Opinion

In the

United States Court of Appeals For the Seventh Circuit

No. 08-3041

U NITED S TATES OF A MERICA, Plaintiff-Appellee, v.

M ATTHEW E RIC M ANN, Defendant-Appellant.

Appeal from the United States District Court for the Northern District of Indiana, Hammond Division. No. 2:07 CR 197—Rudy Lozano, Judge.

A RGUED F EBRUARY 18, 2009—D ECIDED JANUARY 20, 2010

Before R OVNER, E VANS, and T INDER, Circuit Judges. R OVNER, Circuit Judge. Matthew Eric Mann entered a conditional guilty plea to one count of possessing child pornography in violation of 18 U.S.C. § 2252(a)(4)(B). The district court sentenced Mann to sixty-three months imprisonment to be followed by five years of supervised release. Police discovered evidence supporting the child pornography charges while executing a warrant to search Mann’s computers and hard drives for the 2 No. 08-3041

unrelated crime of voyeurism. Mann preserved the right to appeal the district court’s denial of his motion to suppress the child pornography on the grounds that the search exceeded the scope of the warrant. Although we are troubled by some aspects of the search, we ulti- mately conclude that, with one immaterial exception, the officer executing the search did not exceed the scope of the original warrant.

I. While working as a life guard instructor in May 2007 for the Red Cross in Tippecanoe County, Indiana, Mann covertly installed a video camera in the women’s locker room to capture footage of women changing their clothes. Unfortunately for Mann, he also captured footage of himself installing the camera in an open locker. One of the female students in his class later discovered the camera. She recognized Mann in the video when she rewound and viewed the tape. She and two other women in Mann’s class contacted the Lafayette Police Department and turned over the video camera and the videotape. Three days later, an Indiana state prosecutor sought and received a search warrant for officers to search Mann’s residence for “video tapes, CD’s or other digital media, computers, and the contents of said computers, tapes, or other electronic media, to search for images of women in locker rooms or other private areas.” As relevant here, officers executing the warrant seized a Dell desktop computer with a Samsung hard drive, a No. 08-3041 3

Dell laptop, an e-machine, and a Western Digital external hard drive. The following day officers arrested Mann and charged him with voyeurism in violation of the Indiana Code. See Ind. Code Ann. § 35-45-4-5(a)(2)- (b)(1) (defining voyeurism and making it a class D felony when committed by means of any type of video recording device). Nearly two months later, at the end of July 2007, Detec- tive Paul Huff of the Lafayette Police Department began his search of Mann’s computers. At the suppression hearing, Detective Huff testified that he searched the computers by first using a “write blocker” to protect the hard drives from being altered and then created an exact match of each hard drive. He then used software known as “forensic tool kit” (“FTK”) to catalogue the images on the computer into a viewable format. Detective Huff explained that once this indexing process using FTK is completed, an “overview screen” is generated that lets him know how many images, videos, and docu- ments are on the computer and whether there are en- crypted documents or files that may be ignored (such as program files). The overview screen also lists files flagged by the software as “KFF (Known File Filter) Alert” and “KFF Ignorable” files. The “KFF Alert” flags those files identifiable from a library of known files previously submitted by law enforcement—most of which are images of child pornography. On the first computer, Detective Huff discovered evi- dence that Mann had visited a web site called “Perverts Are Us,” where he had read and possibly downloaded 4 No. 08-3041

stories about child molestation. On the Dell laptop, Detec- tive Huff uncovered still images taken in the Jefferson High school locker room, child pornography, and evidence that the Western Digital external hard drive had been connected to the laptop. Detective Huff then searched the final computer, where he again found child pornography, along with a disturbing story (presumably written by Mann) about a swim coach masturbating while watching young girls swim. It was not until nearly another two months later, on September 18, 2007, that Detective Huff first searched the Western Digital external hard drive. As with the other computers, Detective Huff used FTK to index the contents of the hard drive. The FTK software identified four “KFF Alert” files and 677 “flagged thumbnails.” Detective Huff proceeded to open the files on the computer and discovered “many, many images of child pornography” as well as two videos from the Jefferson High School locker room. Mann moved in the district court to suppress all of the evidence seized from his home and computers as a result of the May 2007 warrant, arguing that the warrant lacked probable cause and that the executing officers exceeded the scope of the warrant’s authorization. The district court denied Mann’s motion, concluding that the magistrate judge had probable cause to issue the warrant based on the evidence of Mann’s voyeurism at Jefferson High School and the probability that Mann possessed evidence of his crime at his residence. The district court also rejected Mann’s claim that the No. 08-3041 5

executing officers had exceeded the scope of the warrant when they opened the files containing child pornogra- phy. Specifically, the district court found as a factual matter that Detective Huff believed the search warrant authorized him to examine any digital file located on the computer hard drives or storage devices and that he never abandoned his search for evidence of voyeurism and began looking for child pornography. The court ultimately concluded that “with limited exceptions” the search was within the scope of the warrant, and that any images uncovered outside the scope of the warrant were discov- ered in plain view. Mann then entered a conditional guilty plea to the one count of possession of child pornography in the indictment, reserving his right to challenge on appeal the district court’s denial of his motion to suppress.

II. On appeal, Mann maintains that the district court erred by denying his motion to suppress. In particular, Mann claims that the searches that uncovered the child pornography on his computer exceeded the scope of the original warrant and that the plain view doctrine does not apply on these facts. The government insists that the searches did not exceed the scope of the original war- rant, and that the incriminating child pornography was in any event discovered in plain view. When reviewing a motion to suppress, we review the district court’s legal conclusions de novo and its factual findings for clear error. E.g., United States v. Marrocco, 578 F.3d 627, 632 (7th Cir. 2009). 6 No. 08-3041

We begin with Mann’s contention that Detective Huff’s search of the computers exceeded the scope of the warrant. The Fourth Amendment requires that a warrant describe the things to be seized with sufficient particularity to prevent a general exploratory rum- maging through one’s belongings. See, e.g., Marron v. United States, 275 U.S. 192, 196 (1927) (“The requirement that warrants shall particularly describe the things to be seized makes general searches under them impossible and prevents the seizure of one thing under a warrant describing another. As to what is to be taken, nothing is left to the discretion of the officer executing the war- rant.”). The description of items to be seized limits the scope of the search to areas where those items are likely to be discovered. Platteville Area Ap’t. Ass. v. City of Platteville, 179 F.3d 574, 579 (7th Cir. 1999). Thus, our question is whether, in light of the limitations in the warrant, the execution of the search was reasonable—the touchstone for all Fourth Amendment inquiries. Id.; see also Ill. v. McArthur, 531 U.S. 326, 330 (2001). Mann maintains that given the warrant’s directive to search in those places likely to contain “images of women in locker rooms and other private places,” it was unreasonable for Detective Huff to employ the FTK software and its accompanying “KFF Alert” system, which ordinarily identifies files containing child pornography. Undoubtedly the warrant’s description serves as a limita- tion on what files may reasonably be searched. The prob- lem with applying this principle to computer searches lies in the fact that such images could be nearly any- where on the computers. Unlike a physical object that No. 08-3041 7

can be immediately identified as responsive to the warrant or not, computer files may be manipulated to hide their true contents. See United States v. Hill, 459 F.3d 966, 978 (9th Cir. 2006) (“Images can be hidden in all manner of files, even word processing documents and spreadsheets. Criminals will do all they can to conceal contraband, including the simple expedient of changing the names and extensions of files to disguise their content from the casual observer.”). So although the officers were limited by the warrant to a search likely to yield “images of women in locker rooms and other private places,” those images could be essentially anywhere on the computer. Detective Huff testified at the suppression hearing that “[r]egardless of what I found, I would search in all the files if I felt it necessary, if I felt that it contained information that was pertinent to my case or even exculpatory.” Thus, the government’s argument goes, Detective Huff was at all relevant times searching for the type of image detailed in the warrant, and the fact that he uncovered child pornography does not invalidate the lawful search. Mann, however, maintains that Detective Huff ignored the limitations in the warrant and instead conducted a general search for crimes unrelated to voyeurism. Mann relies heavily on a Tenth Circuit decision, United States v. Carey, 172 F.3d 1268 (10th Cir. 1999), for the proposi- tion that the seizure of the child pornography on his computer was unauthorized. In Carey, police obtained a warrant to search the defendant’s computers for “ ‘names, telephone numbers, ledger receipts, addresses and other 8 No. 08-3041

documentary evidence pertaining to the sale and dis- tribution of controlled substances.’ ” Carey, 172 F.3d at 1270. After unsuccessfully searching the computers’ text files using key words such as “money” and “accounts,” the officers searched the directories and downloaded and then opened JPG (image) files containing child pornogra- phy. After opening the first JPG file and finding child pornography, the officer in Carey “continued to open every JPG file to confirm his expectations” of finding child pornography. Id. at 1273. The Tenth Circuit con- cluded that the seized images of child pornography were neither authorized by the warrant nor found in plain view. Rather than delve into the “intriguing” ques- tion of “what constitutes ‘plain view’ in the context of computer files,” the panel judged the case “only by its own facts.” Id. The panel concluded that discovery of the child pornography was not “inadvertent” as required by the plain view doctrine, and that by looking for child pornography in the JPG files on the computer the officer exceeded the scope of the warrant and executed an unconstitutional general search. Id. at 1276. More recently, the Tenth Circuit decided United States v. Burgess, 576 F.3d 1078 (10th Cir. 2009), where the court upheld the admission of child pornography discovered on the defendant’s computer when officers were executing a warrant to search his motor home and com- puter records for evidence of transportation and delivery of controlled substances, id. at 1088-89. In Burgess, the court reiterated that “the Carey holding was limited.” Burgess, 576 F.3d at 1092. The court in Burgess noted specifically that both the majority and the No. 08-3041 9

concurring opinions in Carey “were careful to warn that the case was fact intense.” Id. (citing Carey, 172 F.3d at 1276); see also Carey, 172 F.3d at 1276 (emphasizing that “the questions presented in this case are extremely close calls and, in my opinion, are totally fact driven”) (Baldock, J., concurring). In particular, the court in Carey premised its holding on a few key facts that are absent here. First, the warrant in Carey authorized a search of the computer solely for “documentary” evidence of drug dealing; thus, the court found it significant that officers downloaded and viewed numerous image files containing child pornogra- phy. Id. at 1271, 1273 (noting that “scope of the search was . . . circumscribed to evidence pertaining to drug trafficking”). In contrast, Officer Mann was searching for “images” of women—a type of file that he could not search thoroughly for without stumbling upon Mann’s extensive collection of child pornography. In this respect, the search of Mann’s computer more closely resembles the search in Wong, where the Ninth Circuit upheld the denial of a motion to suppress child pornogra- phy found on a defendant’s computer incident to a murder investigation. United States v. Wong, 334 F.3d 831 (9th Cir. 2003). There, the court concluded that the officer was within the scope of the warrant to search for evidence pertaining to a murder investigation when he opened images of child pornography, made a note of the files’ location, and continued with his search for evidence relating to the murder. Id. at 835, 837-38. Second, the court in Carey found as a factual matter that the officer conducting the search “made clear as he 10 No. 08-3041

opened each of the JPG files he was not looking for evi- dence of drug trafficking” and had “abandoned that search to look for more child pornography.” Carey, 172 F.3d at 1273. In contrast, the district court here in its factual findings credited Detective Huff’s testimony that at all times during the search, “I continued to look for items with voyeurism, and as I came across the child pornography, then I would not ignore it obviously.” Thus, Detective Huff’s actions are much closer to the detective in Wong, who discovered child pornography as he searched for items within the scope of the original warrant for evidence tied to a murder investigation. See Wong, 334 F.3d at 838; see also United States v. Gray, 78 F. Supp.2d 524, 529 (E.D. Va. 1999) (“In searching for the items listed in the warrant, Agent Ehuan was entitled to examine all of defendant’s files to determine whether they contained items that fell within the scope of the warrant. In the course of doing so, he inadvertently discovered evidence of child pornography, which was clearly incriminating on its face.”). And although intent is not generally relevant when assessing whether a given search falls within the scope of the warrant, Platteville, 179 F.3d at 580, Detective Huff’s focus on finding images related to the voyeurism charges serves to further distinguish this case from Carey. Compare Carey, 172 F.3d at 1273 (noting that searching detective knew he was expanding scope of search and had abandoned the drug-related search to search for more child pornogra- phy) with Burgess, 576 F.3d at 1092 (upholding search where officer “was only looking for ‘trophy photos’ when he came upon the child pornography”); see also Gray, 78 No. 08-3041 11

F. Supp.2d at 527 (agent opened subdirectory entitled “Tiny Teen” not “because he believed it might contain child pornography, but rather because it was the next subdirectory listed and he was opening all of the sub- directories as part of his routine search for the items listed in the warrant”). Additionally, we note that Mann’s primary complaint with Detective Huff’s search—that he used FTK software employing a filter and viewed those files flagged with the “KFF Alert”—does not impact the outcome here. First, as to the use of the filtering software itself, Detective Huff used it to index and catalogue the files into a viewable format. Given the nature of Detective Huff’s search and the fact that Mann could have images of women in locker rooms virtually anywhere on his com- puters, there is no reason to believe that Detective Huff exceeded the scope of the warrant by employing the FTK software without more. But see United States v. Comprehensive Drug Testing, Inc., 579 F.3d 989, 999 (9th Cir. 2009) (admonishing that government’s “sophisticated hashing tools . . . that allow the identification of well- known illegal files . . . and similar search tools may not be used without specific authorization in the warrant”). The same cannot be said of the four flagged “KFF Alert” files. Once those files had been flagged, Detective Huff knew (or should have known) that files in a database of known child pornography images would be outside the scope of the warrant to search for images of women in locker rooms—presumably images that Mann himself had captured. Unfortunately for Mann, suppressing those four images has no impact on the outcome here. Without 12 No. 08-3041

those images, the government still possessed ample evidence of child pornography to sustain both Mann’s conviction and sentence. Although we hold that Officer Huff exceeded the scope of the warrant by opening the four flagged “KFF Alert” files, those files are severable from the remaining files seized. See United States v. Buckley, 4 F.3d 552, 557-58 (7th Cir. 1993). We thus reject Mann’s suggestion that all of the evidence of child pornography should be suppressed because Officer Huff exceeded the authorization of the warrant when opening the “KFF Alert” files. We also reject Mann’s suggestion that we take our cue from the more comprehensive rules regarding computer searches recently outlined by the Ninth Circuit. In United States v. Comprehensive Drug Testing, Inc., an en banc panel of the Ninth Circuit rejected the govern- ment’s attempt to justify its seizure of drug testing records for hundreds of Major League Baseball Players despite a warrant authorizing the seizure of only ten players’ records. 579 F.3d 989, 993, 1000 (9th Cir. 2009).1 In so doing, the Ninth Circuit laid down a series of rules to address the difficulties posed by searches and seizures of digital media. The court set forth the following guidelines applicable when officers conduct computer searches and seizures. First, the opinion directs

1 The Ninth Circuit recently (November 4, 2009) entered an order asking the parties in this case to brief the question of whether the case should be reheard by the full en banc court (comprised of all active judges as opposed to the 11 ordinarily selected randomly for standard en banc review). No. 08-3041 13

magistrate judges to insist that the government waive reliance on the plain view doctrine. See Comprehen- sive Drug Testing, 579 F.3d at 998, 1006. Second, the warrant application should include protocol “for pre- venting agents involved in the investigation from ex- amining or retaining any data other than that for which probable cause is shown”—preferably by requiring segregation to be done by specially trained computer personnel unconnected to the investigation who agree not to “communicate any information they learn during the segregation process absent further ap- proval of the court.” Id. at 1000. Third, the government must use search protocol tailored to uncover only infor- mation for which it has probable cause. Id. at 999-1001, 1006. Finally, the government must either destroy or return any non-responsive data and inform the magistrate what it has kept, destroyed, or returned. Id. at 1000-01, 1006. Mann urges us to apply the Ninth Circuit’s rationale to conclude that Detective Huff’s search was unconstitu- tional. Although the Ninth Circuit’s rules provide some guidance in a murky area, we are inclined to find more common ground with the dissent’s position that jettisoning the plain view doctrine entirely in digital evidence cases is an “efficient but overbroad approach.” Id. at 1013 (Callahan, J., concurring in part and dissenting in part). As the dissent recognizes, there is nothing in the Supreme Court’s case law (or the Ninth Circuit’s for that matter) counseling the complete abandonment of the plain view doctrine in digital evidence cases. Id. We too believe the more considered approach “would be to 14 No. 08-3041

allow the countours of the plain view doctrine to develop incrementally through the normal course of fact- based case adjudication.” Id. We are also skeptical of a rule requiring officers to always obtain pre-approval from a magistrate judge to use the electronic tools neces- sary to conduct searches tailored to uncovering evidence that is responsive to a properly circumscribed warrant. Instead, we simply counsel officers and others involved in searches of digital media to exercise caution to ensure that warrants describe with particularity the things to be seized and that searches are narrowly tailored to uncover only those things described. As dis- cussed above, with the exception of the four “KFF Alert” images, Detective Huff’s search was indeed targeted to uncovering evidence of voyeurism as described in what Mann now concedes was a lawful warrant.2 In so doing, he uncovered obvious evidence of child pornography. Although we now hold that his actions were within the scope of the warrant, we emphasize that his failure to stop his search and request a separate warrant for child pornography is troubling. Burgess, 576 F.3d at 1095 (noting that when searching detective “observed a possible criminal violation outside the scope of the war- rant’s search authorization” he “immediately closed the gallery view . . . and did not renew the search until he

2 Although Mann argued in the district court that the warrant lacked probable cause, he has since abandoned that challenge. No. 08-3041 15

obtained a new warrant”). Because Detective Huff was not in a rapidly unfolding situation or searching a location where evidence was likely to move or change, there was no downside to halting the search to obtain a second warrant. Indeed, we find it problematic that nearly two months elapsed before Detective Huff began his search of the Western Digital hard drive despite having found child pornography on the Dell laptop. However, notwithstanding our distaste for the timeline of the investigation, we conclude that the original warrant authorized Detective Huff’s search of the external hard drive for images of voyeurism. Given this, we ultimately conclude that, with the exception of the four “KFF alert” images, the search was lawful, particu- larly since Detective Huff did indeed uncover further evidence of voyeurism on the external hard drive. Because Detective Huff discovered the child pornography while conducting a systematic search for evidence of voyeurism, we conclude that his actions were reasonable and within the scope of the warrant’s authorization. See United States v. Grimmett, 439 F.3d 1263, 1270 (10th Cir. 2006) (recognizing that computer search may be “‘as extensive as reasonably required to locate the items described in the warrant.’ ” (quoting United States v. Wuagneux, 683 F.2d 1343, 1352 (11th Cir. 1982))). For the foregoing reasons we A FFIRM the judgment of the district court denying Mann’s motion to suppress.

1-20-10