US v David Morel Jr.

2017 DNH 128

Opinion

UNITED STATES DISTRICT COURT DISTRICT OF NEW HAMPSHIRE

United States of America

v. Civil No. 14-cr-148-JL Opinion No. 2017 DNH 128

David Morel

ORDER

Defendant David Morel moves the court to reconsider its order denying his first motion to suppress evidence.1 See LR 7.2(d); see also LCrR 1.1(d). Specifically, Morel asks the court to reconsider its conclusion that he lacked a reasonable expectation of privacy in his IP address, see Morel, 2017 DNH 72, 20-21, arguing that the court misapplied the law because the Electronic Communications Privacy Act (ECPA) creates an expectation of privacy in the records, including the IP address, of a subscriber to an electronic service provider (ESP) such as Imgur.2

1 As the court explained in its order on that motion, it construed Morel’s series of motions and supplemental motions (doc. nos. 24, 31, 33, 35, and 40) as a single motion. United States v. Morel, 2017 DNH 72, 2 n.1. 2 Mot. to Reconsider (doc. no. 80) at 1-2.

The court does not revisit the full facts of the case, which it outlined in the original order on Morel’s motion. See Morel, 2017 DNH 72, 4-11. Those relevant to Morel’s motion for reconsideration are straightforward. In November 2013, an unidentified individual reported instances of child pornography to the National Center for Missing and Exploited Children (NCMEC). This report included a URL leading to a gallery of images hosted by Imgur. NCMEC forwarded the URLs of the images, as obtained by one of its analysts, to Imgur via an automated process. The bottom of the notice included the following message: “Please review the reported URL to determine if it contains content that violates federal and/or state law or your Terms of Service or Member Services Agreement.”3 After receiving this notice, Imgur filed three reports through NCMEC’s CyberTipline indicating that some of the URLs forwarded to it by NCMEC contained apparent child pornography. Imgur attached copies of the images to its reports and provided the IP address of the computer from which those images were uploaded. Ten days later, Imgur submitted three additional reports of apparent child pornography associated with the same IP address to NCMEC. NCMEC made the reports available to the

3 Hearing Ex. 3.

3

New Hampshire Internet Crimes Against Children task force, which forwarded them to the Derry, New Hampshire, police department. A detective discovered child pornography on Morel’s computer, which he searched pursuant to a warrant. Morel subsequently admitted to possessing those images.

Morel moved to suppress the images found on his computer and statements made during his custodial interrogation. He argued, inter alia, that Imgur’s provision of his IP address to NCMEC amounted to a warrantless governmental search in violation of his rights under the Fourth Amendment. In denying Morel’s motion, the court found, as many other courts have, that “subscriber information provided to an internet provider,” including a subscriber’s name, address, and IP address, “is not protected by the Fourth Amendment’s privacy expectation.” Morel, 2017 DNH 72, 20-21 (quoting United States v. Perrine, 518 F.3d 1196, 1204-05 (10th Cir. 2008) (collecting cases)).

Morel does not dispute this point -- indeed, he concedes that “there is abundant case law holding that there is no expectation of privacy in an IP address.”4 As he acknowledged in his supplemental memorandum on the subject, “Federal courts that have addressed this issue have thus far found that there is no

4 Mot. to Reconsider (doc. no. 80) at 3.

4

expectation of privacy in Internet subscriber information.”5 They find no such expectation because individuals voluntarily and routinely convey their IP addresses to third parties (e.g., when they visit a website) and through third-party equipment (e.g., that of their internet service provider). E.g., United States v. Ulbricht, No. 15-1815, 2017 WL 2346566, at *12-13 (2d Cir. May 31, 2017); Christie, 624 F.3d at 573-74; Bynum, 604 F.3d at 164; Perrine, 518 F.3d at 1204-05; Forrester, 512 F.3d at 510. In that sense, an IP address is akin to a telephone number or an address on the outside of an envelope. See Ulbricht, 2017 WL 2346566, at *13-14; Forrester, 512 F.3d at 510-11. Because individuals routinely share that information with others in the process of using the internet, they cannot reasonably expect it to remain private.

In moving for reconsideration, Morel argues that the court should disregard the weight of authority and conclude, in light of the ECPA, that Morel had a reasonable expectation of privacy in his subscriber information held by Imgur -- including his IP

5 Defendant’s Mem. in Response to Court’s Order Requiring Further Briefing (doc. no. 40) at 5-6 (citing United States v. Christie, 624 F.3d 558 (3d. Cir. 2010); Perrine, 518 F.3d at 1204; United States v. Bynum, 604 F.3d 161, 164 (4th Cir. 2010); United States v. Forrester, 512 F.3d 500, 510 (9th Cir. 2008)).

5

address.6 This amounts to a new gloss on the argument Morel raised in his supplemental memorandum, albeit one that the court did not address directly in its order,7 and which Morel now contends the court “misapprehended.”8 As Morel points out, the ECPA protects subscriber information by prohibiting “a provider of remote computing service or electronic communication service to the public” from “knowingly divulge[ing] a record or other information pertaining to a subscriber to or customer of such service . . . to any governmental entity.” 18 U.S.C. § 2702(a)(3). Nor may “[a] governmental entity . . . require a provider of electronic communication service or remote computing service to disclose a record or other information pertaining to a subscriber to or customer of such service” without the consent of the subscriber, a warrant, a court order, a subpoena, or a written request relevant to a telemarketing fraud investigation. Id. § 2703(c)(1). These prohibitions, Morel argues, lead him to reasonably expect that Imgur would not divulge his subscriber

6 Mot. to Reconsider (doc. no. 80) at 3. 7 The court may thus have implied that Morel’s argument concerning his IP address was under-developed. See Morel, 2017 DNH 72, 20. The court did, however, consider that memorandum in rendering its decision. See id. at 2 n.1. 8 Mot. to Reconsider (doc. no. 80) at 3.

6

information, such as his IP address, to NCMEC, a governmental entity, absent his consent, a warrant, or any the instruments described in 18 U.S.C. § 2703(c)(1).

As the court observed, however, “Congress explicitly carved out an exception to those privacy rules that permits ESPs to divulge a customer’s records (such as his IP address) ‘to the National Center for Missing and Exploited Children, in connection with a report submitted thereto under section 2258A.’” Morel, 2017 DNH 72, 20 (quoting 18 U.S.C. § 2702(b)(6), (c)(5)). Thus, even if Congress created an expectation of privacy in IP addresses through the ECPA, as Morel argues, it at the same time erased that expectation with respect to subscriber information that may be submitted to NCMEC through the CyberTipline -- as Morel’s IP address was here. Even absent such an exception, ECPA’s prohibition of ESPs from providing to the government, or of the government requesting, a subscriber’s information without a warrant or subpoena, does not create a privacy interest in information that the individual regularly provides to other third parties.9

9 The defendant bases his arguments purely on the ECPA’s text. He cites no extrinsic evidence of statutory purpose or legislative intent to support the purported expectation of privacy in otherwise publicly-disclosed information. The court therefore likewise confines itself to the statute’s text.

7

Morel argues that “the Court misapprehends the interaction between the protections of the ECPA and [this] exception . . . as they relate to the facts of this case.”10 In essence, Morel contends that the NCMEC report exception does not undermine Morel’s expectation of privacy in his IP address because Imgur submitted its reports to NCMEC only after NCMEC alerted it to potential child pornography on its servers. Because NCMEC, not Imgur, instigated Imgur’s disclosure, he argues, NCMEC was able to bypass the warrant requirement and obtain subscriber information in a manner it, as a likely governmental entity, see United States v. Keith, 980 F. Supp. 2d 33, 41 (D. Mass. 2013), would not have been able to do through a direct request.11 In making this argument, the defendant conflates the expectation of privacy analysis with that addressing whether NCMEC was a government actor for purposes of any “search” it may have performed or initiated. The court must conclude that an expectation of privacy in Morel’s IP address exists before it need address whether NCMEC acted as a governmental agency that instigated Imgur’s disclosure of information. As discussed supra, the weight of authority compels the conclusion that Morel

10 Id. at 4. 11 Mot. to Reconsider at 4.

8

possessed any such expectation; and the statute does not compel the alternative conclusion.

Even if the court viewed the ECPA as creating such a privacy interest, the exception carved out for reports to NCMEC would still undermine that expectation. It requires ESPs to report known child pornography to NCMEC, and explicitly allows ESPs to submit subscriber information along with such reports. See 18 U.S.C. § 2702(b)(6), (c)(5). A subscriber may therefore expect that, if he or she posts child pornography to Imgur or another ESP, that ESP may submit their information, including an IP address, to NCMEC. This exception does not require independent discovery of the child pornography, as Morel suggests; it requires only that the ESP know about the child pornography, regardless of the source of that information.

Because it still concludes that Morel lacks any expectation of privacy in his IP address, the court need not -- and therefore does not -- address his reiteration of his argument that NCMEC, as a government entity, instigated a search that violated his rights under the Fourth Amendment by prompting Imgur to divulge his IP address.12

12Mot. to Reconsider (doc. no. 80) 5-9; Defendant’s Mem. in Response to Court’s Order Requiring Further Briefing (doc. no. 40) at 2, 6-14.

9

The court accordingly DENIES the defendant’s motion for reconsideration.13

SO ORDERED.

Joseph N. Laplante

United States District Judge

Dated: June 26, 2017

cc: Donald A. Feith, AUSA Helen W. Fitzgibbon, AUSA Shane Kelbley, AUSA Philip H. Utter, Esq.

13 Document no. 80.