United States v. Kirk Cottom , 679 F. App'x 518 ( 2017 )


Menu:
  •                  United States Court of Appeals
    For the Eighth Circuit
    ___________________________
    No. 16-1050
    ___________________________
    United States of America
    lllllllllllllllllllll Plaintiff - Appellee
    v.
    Kirk Cottom
    lllllllllllllllllllll Defendant - Appellant
    ____________
    Appeal from United States District Court
    for the District of Nebraska - Omaha
    ____________
    Submitted: November 16, 2016
    Filed: February 17, 2017
    [Unpublished]
    ____________
    Before COLLOTON, BEAM, and GRUENDER, Circuit Judges.
    ____________
    PER CURIAM.
    Kirk Cottom pled guilty to accessing with intent to view child pornography, in
    violation of 18 U.S.C. § 2252A(a)(5)(B), and receipt of child pornography, in
    violation of 18 U.S.C. § 2252A(a)(2)(A). On appeal, Cottom challenges the district
    court's1 denials of his motion to suppress and motion in limine. We affirm.
    I.    BACKGROUND
    This case involves charges stemming from a 2012 FBI investigation into a
    computer server in Bellevue, Nebraska, that was hosting child-pornography websites.
    See also United States v. Welch, 
    811 F.3d 275
     (8th Cir.), cert. denied, 
    136 S. Ct. 2476
    (2016). Cottom is one of multiple defendants charged as a result of the investigation.
    Welch described the investigation in detail:
    [The investigated websites] operate[d] on a clandestine network,
    accessible only with special software and designed to obscure a user's
    identity. This prevented FBI agents from discovering the Internet
    Protocol (IP) addresses of [the websites'] users. An Internet Service
    Provider (ISP) assigns an IP address to an individual computer using its
    Internet service and associates the IP address with the physical address
    to which that service is being provided. If investigators know an
    Internet user's IP address, they can subpoena that user's ISP to provide
    the associated physical address.
    Rather than shut the server down, the FBI sought to install
    software on the server that would circumvent this [clandestine] network,
    providing agents with information about any user who accessed certain
    content on [the targeted websites] (the "Network Investigative
    Technique" or NIT). This information included the user's IP address,
    the date and time the user accessed the content, and his or her
    computer's operating system. The FBI obtained a warrant (the NIT
    warrant) to install the software in November 2012 and kept the
    website[s] in operation for approximately three weeks, collecting
    1
    The Honorable Joseph F. Bataillon, United States District Judge for the
    District of Nebraska.
    -2-
    information on several . . . users. Based on this information, the FBI
    obtained [Cottom's] IP address.
    
    Id. at 277-78
    . Once the FBI obtained Cottom's IP address through the use of the NIT,
    it issued an administrative subpoena to the corresponding ISP to identify Cottom's
    physical address. In April 2013, officers executed a search warrant at Cottom's
    Rochester, New York, residence, seized evidence containing images of child
    pornography, and arrested him. The search and subsequent arrest of Cottom took
    place as part of a coordinated, synchronized search effort by the FBI and government
    lawyers designed to conduct searches in temporal proximity with each other so as to
    reduce communication between the alleged would-be codefendants and to ultimately
    preserve evidence.
    Before the district court, Cottom, along with other codefendants, challenged
    the delayed notice they received following the execution of the NIT warrant and
    objected to the introduction of evidence obtained as a result of the search. In
    Cottom's case, for example, although the warrant was executed and the NIT installed
    in November 2012, the search of his residence, and his subsequent arrest, occurred
    in April 2013. Cottom argued that this delay violated Federal Rule of Criminal
    Procedure 41, which requires that a copy of an executed search warrant be provided
    to the owner of the property seized. Fed. R. Crim. P. 41(f). By statute, this Rule 41
    provision may be delayed under circumstances for thirty days or to a later date certain
    and officers may seek extensions. 18 U.S.C. § 3103a(b).2 The warrant at issue here
    2
    Rule 41(f)(1)(C) states:
    The officer executing the warrant must give a copy of the warrant and
    a receipt for the property taken to the person from whom, or from whose
    premises, the property was taken or leave a copy of the warrant and
    receipt at the place where the officer took the property.
    Rule 41(f)(3) allows a delay in providing the warrant if authorized by statute. Title
    -3-
    did contain a request for such a delay. The various defendants challenged the warrant
    and the delay requested therein, arguing that the relevant language in the warrant
    required notice within thirty days of execution of the warrant, not thirty days after the
    user was identified, as the delay request was interpreted and applied by the
    government. The district court rejected the argument, holding "that the [NIT] warrant
    intended the thirty-day notice period to begin running when the FBI identified an
    individual 'behind the keyboard[,]' . . . [which] occurred in April 2013 when officers
    executed the residential search warrant[s.]" Welch, 811 F.3d at 279 (reviewing the
    NIT warrant at issue in Cottom's case). Thus, the district court held that the
    government's request for a delay was valid and denied the motions to suppress filed
    by the defendants.
    Regarding Cottom's motion in limine, during discovery Cottom moved for
    additional discovery, including a request for the original source code that was used
    to create and deploy the NIT; a code Cottom claimed was needed to determine how
    the NIT was configured. The government conceded that the original source code was
    not preserved and Cottom sought exclusion of the expert testimony of FBI Special
    Agent Smith and Supervisory Special Agent Gordon under Daubert v. Merrell Dow
    18 U.S.C. 3103a(b) provides that notice of a warrant may be delayed if:
    (1)    the court finds reasonable cause to believe that providing
    immediate notification of the execution of the warrant may have
    an adverse result . . .;
    (2)    the warrant prohibits the seizure of any tangible property, any
    wire or electronic communication . . ., or . . . any stored wire or
    electronic information, except where the court finds reasonable
    necessity for the seizure; and
    (3)    the warrant provides for the giving of such notice within a
    reasonable period not to exceed 30 days after the date of its
    execution, or on a later date certain if the facts of the case justify
    a longer period of delay.
    -4-
    Pharmaceuticals, 
    509 U.S. 579
     (1993). Because the original source code was not
    preserved, Cottom argued that these experts' opinions regarding the NIT employed
    in this case lacked proper foundation and were based on insufficient data. The district
    court denied the motion following a hearing on the matter. Cottom additionally
    challenges this ruling on appeal.
    II.   DISCUSSION
    A.     Motion to Suppress
    "When reviewing a district court's denial of a suppression motion, we review
    for clear error the district court's factual findings and review de novo whether the
    Fourth Amendment was violated." Welch, 811 F.3d at 279 (quoting United States v.
    Bell, 
    480 F.3d 860
    , 863 (8th Cir. 2007)). On these facts, "a Rule 41 violation
    amounts to a violation of the Fourth Amendment warranting exclusion 'only if
    [Cottom] is prejudiced or if reckless disregard of proper procedure is evident.'" 
    Id.
    (quoting United States v. Spencer, 
    439 F.3d 905
    , 913 (8th Cir. 2006)).
    The NIT warrant at issue included a section entitled "Request for Delayed
    Notice" that cited the provisions of Rule 41(f)(3) and § 3103a(b)(1) and (3), and
    included factual support for the requested delay. Namely the affidavit stated that
    announcing the proposed use of the NIT could cause those individuals accessing the
    websites to undertake measures to conceal their identity or abandon the use of the
    websites completely; would risk the destruction of, or tampering with, evidence; and
    could seriously jeopardize the success of the investigation into the conspiracy and
    impede efforts to learn the identity of the target individuals, whose exact identities
    had not yet been determined. Accordingly, the government sought delay of notice
    "until 30 days after any individual accessing [the targeted websites] has been
    identified to a sufficient degree as to provide notice, unless the Court finds good
    cause for further delayed disclosure."
    -5-
    In Welch, a case involving a codefendant of Cottom, we reviewed the district
    court order denying the defendants' motions to suppress evidence obtained as a result
    of the NIT warrant–the same order at issue here. Id. at 279-81. As to the delay
    request in the NIT warrant, Welch argued "that the [statutory] thirty-day period began
    to run from the date the government received the subscriber information for Welch's
    IP address from his ISP." Id. at 280. Welch claimed that because agents testified that
    the NIT warrant was used to obtain a user's IP address, "the subject of the warrant
    was the subscriber assigned that IP address, and so the subject was 'identified' in
    December, not the following April," and thus he was provided notice beyond the
    thirty-day time period in violation of Rule 41. Id.
    On appeal in Welch, we disagreed with the district court's determination that
    the delay request in the NIT warrant was valid under the law. Rather, we held that
    the notice the government gave Welch failed to comport with Rule 41. Id. We held
    that the statute authorizing the judge to delay notice is perfectly clear–"the thirty-day
    extension runs from the execution of the warrant," which in these cases, occurred in
    November 2012. Id. Despite the procedural violation, however, we concluded that
    Welch was not prejudiced by the violation nor did the investigators recklessly
    disregard proper procedure, and thus "the delayed notice to Welch of the NIT warrant
    did not violate the Fourth Amendment and so did not warrant suppression of evidence
    obtained from it." Id. at 281. Welch controls the matter now before us. "A panel of
    this Court is bound by a prior Eighth Circuit decision unless that case is overruled by
    the Court sitting en banc." United States v. Manning, 
    786 F.3d 684
    , 686 (8th Cir.)
    (quoting United States v. Wright, 
    22 F.3d 787
    , 788 (8th Cir. 1994)), cert. denied, 
    136 S. Ct. 278
     (2015).
    On appeal, Cottom asks this court to follow our determination in Welch that
    the thirty-day extension ran from the execution of the warrant and thus the notice
    Cottom was provided failed to comply with Rule 41. Relying upon our analysis in
    -6-
    Welch, we agree.3 Welch, 811 F.3d at 281. Cottom goes on to argue, however, that
    the government lawyers authored the "Request for Delayed Notice" portion of the
    affidavit supporting the NIT warrant with an intentional and deliberate disregard of
    the procedural requirements in order "to grant the officers a pass around the proper
    procedures." In that light, according to Cottom, the delay was a deliberate violation
    of Rule 41 and the officers' delay in providing him notice could not have been a good
    faith application of the warrant and he was thus prejudiced by the violation. But, this
    issue, too, was analyzed and decided in Welch. Id. No matter who drafted the
    paragraph itself, we held in Welch that "the officers' delay was a good-faith
    application of the warrant rather than a deliberate violation of Rule 41." Id. This
    determination of good faith was corroborated by the agent who swore out the
    affidavit and applied for the NIT warrant, and who testified that the "delayed notice
    period was to begin when the government identified the true name user of an
    individual that accessed one of these three websites." Id. This holding is binding
    upon us today.
    Cottom unsuccessfully attempts to separate himself from the analysis in Welch,
    which resolved the issue as to whether the defendants were prejudiced by the
    violation that is now binding on this court. Therefore, the district court's additional
    finding in this case that any Rule 41 violation did not prejudice Cottom is also not
    3
    Our determination on the matter in Welch, as here, was conditioned on the
    assumption that Rule 41(f) applies to the NIT warrant. Rule 41(f)(1)(C) requires that
    a copy of the warrant and a receipt of the property taken be left with the "person from
    whom, or from whose premises, the property was taken." Rule 41 defines property
    to "include[] documents, books, papers, any other tangible objects, and information."
    Fed. R. Crim. P. 41(a)(2)(A) (emphasis added). Whether Cottom's IP address (which
    is generated by a third party and assigned by the ISP), the time and date he accessed
    the website content, and his computer's operating system are the kind of
    "information" considered to be property under Rule 41 is an open question. 811 F.3d
    at 280 n.4. As in Welch, however, because we affirm the district court, we need not
    address that argument here.
    -7-
    clearly erroneous. In that same vein, we, too, find that the district court's finding that
    any Rule 41 violation was not due to reckless disregard of proper procedure was not
    clearly erroneous. Id. There is nothing in this record to indicate "that had the officers
    followed Rule 41 they would not have been able to search [Cottom's] residence and
    obtain the evidence they did. The nature of the investigation indicates they could
    have easily obtained extensions had they sought them." Id. The delayed notice to
    Cottom of the NIT warrant did not violate the Fourth Amendment and so did not
    warrant suppression of evidence obtained from it. The district court properly denied
    the motion to suppress.
    B.     Motion in Limine/Evidence Spoliation
    During discovery, Cottom sought the original source code that was used to
    create and deploy the NIT. The government conceded that the original source code
    was not preserved, and on that basis, Cottom sought exclusion of expert testimony
    offered by the government, arguing that without the original source code, Cottom's
    own experts could not definitively determine whether the NIT satisfied the Daubert
    standard and thus opinions of the government experts lacked proper foundation and
    were based on insufficient data. The district court denied the motion, concluding
    after an evidentiary hearing that the government's failure to preserve and produce the
    original source code was of little consequence to the determination whether the
    government's experts satisfied the prerequisites under Daubert.
    We review a district court's determination on the admissibility of expert
    testimony for abuse of discretion. United States v. Coutentos, 
    651 F.3d 809
    , 820 (8th
    Cir. 2011). In a case involving the alleged spoliation of evidence, "a district court is
    required to make two findings before an adverse inference instruction is warranted:
    (1) 'there must be a finding of intentional destruction indicating a desire to suppress
    the truth,' and (2) '[t]here must be a finding of prejudice to the opposing party.'"
    Hallmark Cards, Inc. v. Murley, 
    703 F.3d 456
    , 460 (8th Cir. 2013) (alteration in
    -8-
    original) (quoting Stevenson v. Union Pac. R.R. Co., 
    354 F.3d 739
    , 746, 748 (8th Cir.
    2004)).
    Thoroughly reviewing all of the evidence, the district court noted that "[t]he
    government's experts and the defendant's own expert all testified that source code
    information would make little difference in determining that the NIT employed in this
    case is reliable and that the techniques that were used to derive it are repeatable."
    Additionally, "[t]here [was] no evidence of anything other than an inadvertent failure
    to preserve the source code . . . and the lost data [was] essentially recoverable," which
    lead to the district court's sound holding on the issue of spoliation and admissibility.
    Reviewing the evidence and arguments on appeal, we find no abuse of discretion by
    the district court in denying the motion in limine.
    III.   CONCLUSION
    For the reasons stated herein we affirm.
    ______________________________
    -9-