UNITED STATES DISTRICT COURT DISTRICT OF NEW HAMPSHIRE
United States of America
v. Civil No. 14-cr-148-JL Opinion No. 2017 DNH 128
David Morel
ORDER
Defendant David Morel moves the court to reconsider its
order denying his first motion to suppress evidence.1 See LR
7.2(d); see also LCrR 1.1(d). Specifically, Morel asks the
court to reconsider its conclusion that he lacked a reasonable
expectation of privacy in his IP address, see Morel, 2017 DNH
72, 20-21, arguing that the court misapplied the law because the
Electronic Communications Privacy Act (ECPA) creates an
expectation of privacy in the records, including the IP address,
of a subscriber to an electronic service provider (ESP) such as
Imgur.2
1 As the court explained in its order on that motion, it construed Morel’s series of motions and supplemental motions (doc. nos. 24, 31, 33, 35, and 40) as a single motion. United States v. Morel, 2017 DNH 72, 2 n.1. 2 Mot. to Reconsider (doc. no. 80) at 1-2. The court does not revisit the full facts of the case,
which it outlined in the original order on Morel’s motion. See
Morel, 2017 DNH 72, 4-11. Those relevant to Morel’s motion for
reconsideration are straightforward. In November 2013, an
unidentified individual reported instances of child pornography
to the National Center for Missing and Exploited Children
(NCMEC). This report included a URL leading to a gallery of
images hosted by Imgur. NCMEC forwarded the URLs of the images,
as obtained by one of its analysts, to Imgur via an automated
process. The bottom of the notice included the following
message: “Please review the reported URL to determine if it
contains content that violates federal and/or state law or your
Terms of Service or Member Services Agreement.”3
After receiving this notice, Imgur filed three reports
through NCMEC’s CyberTipline indicating that some of the URLs
forwarded to it by NCMEC contained apparent child pornography.
Imgur attached copies of the images to its reports and provided
the IP address of the computer from which those images were
uploaded. Ten days later, Imgur submitted three additional
reports of apparent child pornography associated with the same
IP address to NCMEC. NCMEC made the reports available to the
3 Hearing Ex. 3.
2 New Hampshire Internet Crimes Against Children task force, which
forwarded them to the Derry, New Hampshire, police department.
A detective discovered child pornography on Morel’s computer,
which he searched pursuant to a warrant. Morel subsequently
admitted to possessing those images.
Morel moved to suppress the images found on his computer
and statements made during his custodial interrogation. He
argued, inter alia, that Imgur’s provision of his IP address to
NCMEC amounted to a warrantless governmental search in violation
of his rights under the Fourth Amendment. In denying Morel’s
motion, the court found, as many other courts have, that
“subscriber information provided to an internet provider,”
including a subscriber’s name, address, and IP address, “is not
protected by the Fourth Amendment’s privacy expectation.”
Morel, 2017 DNH 72, 20-21 (quoting United States v. Perrine, 518
F.3d 1196, 1204-05 (10th Cir. 2008) (collecting cases)).
Morel does not dispute this point -- indeed, he concedes
that “there is abundant case law holding that there is no
expectation of privacy in an IP address.”4 As he acknowledged in
his supplemental memorandum on the subject, “Federal courts that
have addressed this issue have thus far found that there is no
4 Mot. to Reconsider (doc. no. 80) at 3.
3 expectation of privacy in Internet subscriber information.”5
They find no such expectation because individuals voluntarily
and routinely convey their IP addresses to third parties (e.g.,
when they visit a website) and through third-party equipment
(e.g., that of their internet service provider). E.g., United
States v. Ulbricht, No. 15-1815, 2017 WL 2346566, at *12-13 (2d
Cir. May 31, 2017); Christie, 624 F.3d at 573-74; Bynum, 604
F.3d at 164; Perrine, 518 F.3d at 1204-05; Forrester, 512 F.3d
at 510. In that sense, an IP address is akin to a telephone
number or an address on the outside of an envelope. See
Ulbricht, 2017 WL 2346566, at *13-14; Forrester, 512 F.3d at
510-11. Because individuals routinely share that information
with others in the process of using the internet, they cannot
reasonably expect it to remain private.
In moving for reconsideration, Morel argues that the court
should disregard the weight of authority and conclude, in light
of the ECPA, that Morel had a reasonable expectation of privacy
in his subscriber information held by Imgur -- including his IP
5 Defendant’s Mem. in Response to Court’s Order Requiring Further Briefing (doc. no. 40) at 5-6 (citing United States v. Christie, 624 F.3d 558 (3d. Cir. 2010); Perrine, 518 F.3d at 1204; United States v. Bynum, 604 F.3d 161, 164 (4th Cir. 2010); United States v. Forrester, 512 F.3d 500, 510 (9th Cir. 2008)).
4 address.6 This amounts to a new gloss on the argument Morel
raised in his supplemental memorandum, albeit one that the court
did not address directly in its order,7 and which Morel now
contends the court “misapprehended.”8
As Morel points out, the ECPA protects subscriber
information by prohibiting “a provider of remote computing
service or electronic communication service to the public” from
“knowingly divulge[ing] a record or other information pertaining
to a subscriber to or customer of such service . . . to any
governmental entity.” 18 U.S.C. § 2702(a)(3). Nor may “[a]
governmental entity . . . require a provider of electronic
communication service or remote computing service to disclose a
record or other information pertaining to a subscriber to or
customer of such service” without the consent of the subscriber,
a warrant, a court order, a subpoena, or a written request
relevant to a telemarketing fraud investigation. Id.
§ 2703(c)(1). These prohibitions, Morel argues, lead him to
reasonably expect that Imgur would not divulge his subscriber
6 Mot. to Reconsider (doc. no. 80) at 3. 7 The court may thus have implied that Morel’s argument concerning his IP address was under-developed. See Morel, 2017 DNH 72, 20. The court did, however, consider that memorandum in rendering its decision. See id. at 2 n.1. 8 Mot. to Reconsider (doc. no. 80) at 3.
5 information, such as his IP address, to NCMEC, a governmental
entity, absent his consent, a warrant, or any the instruments
described in 18 U.S.C. § 2703(c)(1).
As the court observed, however, “Congress explicitly carved
out an exception to those privacy rules that permits ESPs to
divulge a customer’s records (such as his IP address) ‘to the
National Center for Missing and Exploited Children, in
connection with a report submitted thereto under section
Free access — add to your briefcase to read the full text and ask questions with AI
UNITED STATES DISTRICT COURT DISTRICT OF NEW HAMPSHIRE
United States of America
v. Civil No. 14-cr-148-JL Opinion No. 2017 DNH 128
David Morel
ORDER
Defendant David Morel moves the court to reconsider its
order denying his first motion to suppress evidence.1 See LR
7.2(d); see also LCrR 1.1(d). Specifically, Morel asks the
court to reconsider its conclusion that he lacked a reasonable
expectation of privacy in his IP address, see Morel, 2017 DNH
72, 20-21, arguing that the court misapplied the law because the
Electronic Communications Privacy Act (ECPA) creates an
expectation of privacy in the records, including the IP address,
of a subscriber to an electronic service provider (ESP) such as
Imgur.2
1 As the court explained in its order on that motion, it construed Morel’s series of motions and supplemental motions (doc. nos. 24, 31, 33, 35, and 40) as a single motion. United States v. Morel, 2017 DNH 72, 2 n.1. 2 Mot. to Reconsider (doc. no. 80) at 1-2. The court does not revisit the full facts of the case,
which it outlined in the original order on Morel’s motion. See
Morel, 2017 DNH 72, 4-11. Those relevant to Morel’s motion for
reconsideration are straightforward. In November 2013, an
unidentified individual reported instances of child pornography
to the National Center for Missing and Exploited Children
(NCMEC). This report included a URL leading to a gallery of
images hosted by Imgur. NCMEC forwarded the URLs of the images,
as obtained by one of its analysts, to Imgur via an automated
process. The bottom of the notice included the following
message: “Please review the reported URL to determine if it
contains content that violates federal and/or state law or your
Terms of Service or Member Services Agreement.”3
After receiving this notice, Imgur filed three reports
through NCMEC’s CyberTipline indicating that some of the URLs
forwarded to it by NCMEC contained apparent child pornography.
Imgur attached copies of the images to its reports and provided
the IP address of the computer from which those images were
uploaded. Ten days later, Imgur submitted three additional
reports of apparent child pornography associated with the same
IP address to NCMEC. NCMEC made the reports available to the
3 Hearing Ex. 3.
2 New Hampshire Internet Crimes Against Children task force, which
forwarded them to the Derry, New Hampshire, police department.
A detective discovered child pornography on Morel’s computer,
which he searched pursuant to a warrant. Morel subsequently
admitted to possessing those images.
Morel moved to suppress the images found on his computer
and statements made during his custodial interrogation. He
argued, inter alia, that Imgur’s provision of his IP address to
NCMEC amounted to a warrantless governmental search in violation
of his rights under the Fourth Amendment. In denying Morel’s
motion, the court found, as many other courts have, that
“subscriber information provided to an internet provider,”
including a subscriber’s name, address, and IP address, “is not
protected by the Fourth Amendment’s privacy expectation.”
Morel, 2017 DNH 72, 20-21 (quoting United States v. Perrine, 518
F.3d 1196, 1204-05 (10th Cir. 2008) (collecting cases)).
Morel does not dispute this point -- indeed, he concedes
that “there is abundant case law holding that there is no
expectation of privacy in an IP address.”4 As he acknowledged in
his supplemental memorandum on the subject, “Federal courts that
have addressed this issue have thus far found that there is no
4 Mot. to Reconsider (doc. no. 80) at 3.
3 expectation of privacy in Internet subscriber information.”5
They find no such expectation because individuals voluntarily
and routinely convey their IP addresses to third parties (e.g.,
when they visit a website) and through third-party equipment
(e.g., that of their internet service provider). E.g., United
States v. Ulbricht, No. 15-1815, 2017 WL 2346566, at *12-13 (2d
Cir. May 31, 2017); Christie, 624 F.3d at 573-74; Bynum, 604
F.3d at 164; Perrine, 518 F.3d at 1204-05; Forrester, 512 F.3d
at 510. In that sense, an IP address is akin to a telephone
number or an address on the outside of an envelope. See
Ulbricht, 2017 WL 2346566, at *13-14; Forrester, 512 F.3d at
510-11. Because individuals routinely share that information
with others in the process of using the internet, they cannot
reasonably expect it to remain private.
In moving for reconsideration, Morel argues that the court
should disregard the weight of authority and conclude, in light
of the ECPA, that Morel had a reasonable expectation of privacy
in his subscriber information held by Imgur -- including his IP
5 Defendant’s Mem. in Response to Court’s Order Requiring Further Briefing (doc. no. 40) at 5-6 (citing United States v. Christie, 624 F.3d 558 (3d. Cir. 2010); Perrine, 518 F.3d at 1204; United States v. Bynum, 604 F.3d 161, 164 (4th Cir. 2010); United States v. Forrester, 512 F.3d 500, 510 (9th Cir. 2008)).
4 address.6 This amounts to a new gloss on the argument Morel
raised in his supplemental memorandum, albeit one that the court
did not address directly in its order,7 and which Morel now
contends the court “misapprehended.”8
As Morel points out, the ECPA protects subscriber
information by prohibiting “a provider of remote computing
service or electronic communication service to the public” from
“knowingly divulge[ing] a record or other information pertaining
to a subscriber to or customer of such service . . . to any
governmental entity.” 18 U.S.C. § 2702(a)(3). Nor may “[a]
governmental entity . . . require a provider of electronic
communication service or remote computing service to disclose a
record or other information pertaining to a subscriber to or
customer of such service” without the consent of the subscriber,
a warrant, a court order, a subpoena, or a written request
relevant to a telemarketing fraud investigation. Id.
§ 2703(c)(1). These prohibitions, Morel argues, lead him to
reasonably expect that Imgur would not divulge his subscriber
6 Mot. to Reconsider (doc. no. 80) at 3. 7 The court may thus have implied that Morel’s argument concerning his IP address was under-developed. See Morel, 2017 DNH 72, 20. The court did, however, consider that memorandum in rendering its decision. See id. at 2 n.1. 8 Mot. to Reconsider (doc. no. 80) at 3.
5 information, such as his IP address, to NCMEC, a governmental
entity, absent his consent, a warrant, or any the instruments
described in 18 U.S.C. § 2703(c)(1).
As the court observed, however, “Congress explicitly carved
out an exception to those privacy rules that permits ESPs to
divulge a customer’s records (such as his IP address) ‘to the
National Center for Missing and Exploited Children, in
connection with a report submitted thereto under section
2258A.’” Morel, 2017 DNH 72, 20 (quoting 18 U.S.C. §
2702(b)(6), (c)(5)). Thus, even if Congress created an
expectation of privacy in IP addresses through the ECPA, as
Morel argues, it at the same time erased that expectation with
respect to subscriber information that may be submitted to NCMEC
through the CyberTipline -- as Morel’s IP address was here.
Even absent such an exception, ECPA’s prohibition of ESPs from
providing to the government, or of the government requesting, a
subscriber’s information without a warrant or subpoena, does not
create a privacy interest in information that the individual
regularly provides to other third parties.9
9 The defendant bases his arguments purely on the ECPA’s text. He cites no extrinsic evidence of statutory purpose or legislative intent to support the purported expectation of privacy in otherwise publicly-disclosed information. The court therefore likewise confines itself to the statute’s text.
6 Morel argues that “the Court misapprehends the interaction
between the protections of the ECPA and [this] exception . . .
as they relate to the facts of this case.”10 In essence, Morel
contends that the NCMEC report exception does not undermine
Morel’s expectation of privacy in his IP address because Imgur
submitted its reports to NCMEC only after NCMEC alerted it to
potential child pornography on its servers. Because NCMEC, not
Imgur, instigated Imgur’s disclosure, he argues, NCMEC was able
to bypass the warrant requirement and obtain subscriber
information in a manner it, as a likely governmental entity, see
United States v. Keith, 980 F. Supp. 2d 33, 41 (D. Mass. 2013),
would not have been able to do through a direct request.11
In making this argument, the defendant conflates the
expectation of privacy analysis with that addressing whether
NCMEC was a government actor for purposes of any “search” it may
have performed or initiated. The court must conclude that an
expectation of privacy in Morel’s IP address exists before it
need address whether NCMEC acted as a governmental agency that
instigated Imgur’s disclosure of information. As discussed
supra, the weight of authority compels the conclusion that Morel
10 Id. at 4. 11 Mot. to Reconsider at 4.
7 possessed any such expectation; and the statute does not compel
the alternative conclusion.
Even if the court viewed the ECPA as creating such a
privacy interest, the exception carved out for reports to NCMEC
would still undermine that expectation. It requires ESPs to
report known child pornography to NCMEC, and explicitly allows
ESPs to submit subscriber information along with such reports.
See 18 U.S.C. § 2702(b)(6), (c)(5). A subscriber may therefore
expect that, if he or she posts child pornography to Imgur or
another ESP, that ESP may submit their information, including an
IP address, to NCMEC. This exception does not require
independent discovery of the child pornography, as Morel
suggests; it requires only that the ESP know about the child
pornography, regardless of the source of that information.
Because it still concludes that Morel lacks any expectation
of privacy in his IP address, the court need not -- and
therefore does not -- address his reiteration of his argument
that NCMEC, as a government entity, instigated a search that
violated his rights under the Fourth Amendment by prompting
Imgur to divulge his IP address.12
12Mot. to Reconsider (doc. no. 80) 5-9; Defendant’s Mem. in Response to Court’s Order Requiring Further Briefing (doc. no. 40) at 2, 6-14.
8 The court accordingly DENIES the defendant’s motion for
reconsideration.13
SO ORDERED.
Joseph N. Laplante United States District Judge
Dated: June 26, 2017
cc: Donald A. Feith, AUSA Helen W. Fitzgibbon, AUSA Shane Kelbley, AUSA Philip H. Utter, Esq.
13 Document no. 80.