While the crimes themselves are despicable, child pornography prosecutions often feature cutting-edge forensic investigation techniques and challenges that are applicable to a wide range of white collar crimes.
On June 11, 2015, the United States Court of Appeals for the Second Circuit rejected a defendant’s challenge, and held that law enforcement may use third-party aggregating software in order to develop probable cause in support of a search warrant, and that the warrant application need not identify the software utilized.
In United States v. Thomas, 2015WL3619820, ___F.3d___(2015), the defendant pleaded guilty to the production of child pornography in violation of 18 U.S.C. § 2251(a). Key to the prosecution was child pornography retrieved from the defendant’s home computer. Law enforcement targeted the defendant after using software that traced child pornography traded on a peer to peer network to an internet protocol (“IP”) address utilized by a computer at his home address.
The software law enforcement utilized in this investigation was created by a “data fusion” company called TLO. TLO developed an entire software suite to help locate IP addresses used to distribute child pornography, called the Child Protection System (“CPS”) suite. TLO licenses CPS to law enforcement at no charge and trains officers in its use.
Using the CPS software, law enforcement found that child pornography files were being transmitted via an IP address utilized by a computer located at the defendant’s home address. A Homeland Security Investigations Special Agent presented a 22-page search warrant application to a magistrate judge seeking to search the defendant’s home and computers at the defendant’s home. The warrant application revealed in general terms the use of CPS software to isolate the IP address linked to the defendant, but it did not identify the CPS software by name, nor did it identify TLO as the software creator.
The defendant challenged the search warrant application. He alleged that the warrant application lacked probable cause because it relied upon third-party software, it failed to identify the software and its creator, and it failed to verify the reliability of the CPS software. The Second Circuit analyzed the challenge, examining whether the totality of circumstances test articulated in Illinois v. Gates, 462 U.S. 213 (1983), supported probable cause that child pornography would be found on a computer in the defendant’s residence.
The Court rejected the defendant’s challenges. First, it held that it was immaterial that TLO was a third-party company, and it noted that the CPS software merely aggregated publicly available information about IP addresses in an efficient manner. This efficiency merely sped up law enforcement’s abilities. Law enforcement could have filtered IP addresses manually, albeit much more slowly. More importantly, the Court noted, and the defendant conceded, that the search warrant application would only have been strengthened, not weakened, by the inclusion of the omitted information. Traditionally, in the context of a Franks hearing, search warrant applications diminish in credibility when omitted information is considered.
Rejecting the defendant’s analogy that the CPS software was similar to a drug sniffing dog, the Court held that the warrant application did not need to provide additional information about the reliability of the software. Unlike a drug sniffing dog, which could mistakenly offer a “false positive” that drugs are present, the CPS software merely compiled and summarized information in more usable form, in a readily verifiable manner. The Court likened the use of CPS software to a police officer witnessing the criminal transaction on closed circuit television.
The lessons learned from this case are twofold. First, we see that Homeland Security will lend its considerable resources to local law enforcement investigations; Second, law enforcement may use undisclosed outside help to compile public information to develop probable cause. While this case featured child pornography, the techniques used could equally apply to insider trading, embezzlement, and many other electronically facilitated crimes.
Persons facing investigation or prosecution in these types of case should seek the aid of experienced white collar counsel to quickly inventory and challenge evidence using more effective means than Mr. Thomas. The battles in these cases occur well before trial, and preparation is essential.