United States v. Osorio

OPINION OF THE COURT

HEIMANN, Judge:

The appellant was tried at Wright-Patterson Air Force Base, Ohio before a military judge sitting alone as a general court-martial. Contrary to his plea, the appellant was convicted of one charge and specification of wrongful possession of child pornography, in violation of Article 134, UCMJ, 10 U.S.C. § 934. The adjudged and approved sentence consists of a bad-conduct discharge, confinement for 12 months, and reduction to E-l.

The appellant raises four issues on appeal: (1) whether the military judge erred in failing to suppress evidence of images found on the appellant’s laptop computer hard drive; (2) whether the military judge erred in failing to suppress the evidence of images found on the appellant’s external hard drive; (3) whether the military judge erred in failing to suppress the appellant’s oral and written confessions and the additional evidence obtained during a search of the appellant’s apartment as fruit of the poisonous tree; and (4) whether the military judge’s erroneous admission of hearsay substantially prejudiced the appellant’s right to confrontation under the Sixth Amendment.¹ The Court heard oral argument on the first two issues.² We conclude that the motion to suppress the images found on the appellant’s laptop, external hard drive, and the appellant’s confession, along with additional evidence obtained during the search should have been granted and set aside the charge and its specification.

Background

Senior Airman Luis Osorio was a 22-year-old airman who had served approximately 4.5 years on active duty at the time of his court-martial. He was a workgroup manager for the security forces squadron. On 12 February 2005, he attended a party with other airmen, and a game of strip poker ensued. On 25 March 2005, Special Agent (SA) AW, Air Force Office of Special Investigations (hereinafter OSI) received information that an alleged sexual assault had taken place during the night of the 12 February 2005 party. The appellant was not the suspect of the alleged assault. However, during the course of the sexual assault investigation, OSI discovered that the appellant took pictures at the party, which included photographs of partially nude people who attended the party.

Interested in the pictures for their investigation, the OSI agents approached the appellant while he was in the dayroom of a base dormitory and spoke with him about the pictures. The appellant told the agents he had saved the party pictures on his laptop, and took the agents to his off-base apartment to show them the pictures. The appellant offered to give the agents copies of the images saved on his computer, but he would not consent to turning over his laptop. After reviewing the pictures provided, the OSI, convinced that the computer may contain more pictures than provided by the appellant, sought and received search authorization from the military magistrate for the appellant’s off-base quarters. Upon receiving search authorization, the agents went back to the appellant’s apartment and seized the laptop and a digital memory card. During the course of the seizure the agents reassured the appellant that he was not suspected of any offense but advised the appellant that he had no choice but to provide the computer and memory card because they contained possible evidence. The appellant asked if he could see the warrant and the agents explained they had oral authorization, and that they would provide him with written authorization later.

A couple hours after the seizure, the appellant went to the OSI office and gave SA AW a power cord for his laptop and an external hard drive, and explained that he used both items with his laptop. The OSI agents had the appellant sign a consent form for the external hard drive. The consent form indicated that he was not suspected of any offense and he was consenting to a search of his “Western Digital External Hard Drive 120 GH.”

The following Monday, OSI, realizing that they had executed an off-base search improperly³, contacted United States Magistrate Judge SO to obtain a valid search authorization. Judge SO asked if the items had been searched yet and SA AW informed the judge that the items were in a secure area and had not been searched. Judge SO issued the warrant. The search warrant authorized search and seizure for “one Toshiba laptop computer and one digital memory card used to record photographs taken on February 12, 2005.” Significantly, the new warrant made no mention of the external hard drive appellant provided to the OSI several days before the federal warrant was obtained.

On 26 April 2005, eleven days after the initial seizure, another OSI agent, SA JL, was asked to prepare a forensic mirror image of the appellant’s hard drive to be sent to the Defense Computer Forensic Laboratory (DCFL) for analysis. She was not a case agent assigned to the case and was unaware of the objectives and the scope of the search warrant at the time of her actions. She was simply a technical expert asked to prepare the hard drive for shipment. In order to confirm she had a made a correct functioning mirror image of the hard drive necessary for DCFL, SA JL used forensic software to view all the photos on the computer at once as thumbnails. Once she confirmed the mirror image, she had done everything necessary to fulfill her technical task.

Despite having completed her task, SA JL began reviewing the thumbnails, and noticed several thumbnails of nude persons, and decided to open the thumbnails to make sure the pictures were not “contraband.” Without opening the thumbnails, it was impossible for her to determine the true contents of the picture. Therefore, she double-clicked on one thumbnail and saw what she believed to be the image of a nude minor. She continued to open thumbnails to see how many similar pictures were on the computer and noticed several more pictures of nude minors. She then searched to see if the pictures were saved to the computer or just stored in temporary internet files, the latter of which could show that the pictures existence on the hard drive may not have been intentional. She searched the computer for 20-30 minutes and then informed the OSI agents about the photos depicting nude minors.

The OSI agents immediately confronted the appellant about the pictures and he waived his Article 31, UCMJ, 10 U.S.C. § 831 rights and made an oral and sworn confession admitting that he downloaded and possessed child pornography. The appellant consented to a search of his apartment and during that search the agents seized several compact disks (CDs).

The mirror image of the appellant’s laptop, prepared by SA JL, was ultimately sent to DCFL with a request to investigate it for child pornography in addition to the party pictures. DCFL, recognizing that the same computer was being used for two different cases, contacted OSI and requested a separate search authorization to search the media for child pornography prior to their analysis of the laptop and memory card. At this point, on 10 May 2005, SA JH sought and received a second search authorization for the laptop and memory card from the military magistrate for the base. Relying on this final warrant, DCFL searched the laptop and memory card, along with the CDs, and the external hard drive for child pornography. No additional authorization was sought or obtained for the external hard drive. The DCFL analysis revealed multiple images of what was believed to be child pornography, and six of the suspected images matched known child victims.

Standard of Review

The military judge’s ruling on the admission or exclusion of evidence is reviewed for an abuse of discretion. United States v. Rodriguez, 60 M.J. 239, 246 (C.A.A.F.2004). Fact-finding is reviewed under the clearly erroneous standard and conclusions of law are reviewed de novo. Id. A military judge abuses her discretion on a motion to suppress if the factual findings are clearly erroneous or if the law is applied erroneously. Id.

Discussion

I. Lawfulness of the Search of the Laptop

Search warrants must be specific and specificity has two aspects, particularity and breadth. United States v. Hill, 459 F.3d 966, 973 (9th Cir.2006) (citing United States v. Towne, 997 F.2d 537, 544 (9th Cir.1993)). This level of detail is required to comply with the Fourth Amendment.⁴ See United States v. Knights, 534 U.S. 112, 118, 122 S.Ct. 587, 151 L.Ed.2d 497 (2001). Here the federal magistrate authorized a very specific search of the appellant’s computer and memory card.⁵ The warrant expressly authorized, “a search of the Toshiba laptop computer and the digital memory card for photographs taken on February 12, 2005.” Despite the initial problem of going to the wrong search authority, we find that the operative warrant, obtained from the federal magistrate, was valid and sufficiently specific.⁶ Finding the warrant valid, we next look at the search itself to determine if it was validly executed.

On the issue of executing computer search warrants, we find the 10th Circuit case of United States v. Carey, 172 F.3d 1268 (10th Cir.1999) persuasive. In Carey, an investigator was searching a computer pursuant to a warrant to search for records of drug distribution when he came across pictures of what appeared to be child pornography. Similar to the case sub judice, the investigator continued to search the computer for child pornography without obtaining an additional search warrant specifically for the child pornography. The court in Carey found that the investigator exceeded the scope of the warrant once he proceeded to search past the terms of the warrant.⁷ Carey, 172 F.3d at 1273. That is also what occurred in this case.

Here we find SA JL exceeded the scope of the search warrant the minute she opened the thumbnail to, in her own words, “make sure it was not contraband.”⁸ SA JL admitted on cross-examination that she opened the thumbnail to verify if the picture was child or adult pornography, not to verify it was a mirror image of the other computer or to review a photograph taken on February 12, 2005. Having testified that she was not aware of the terms of the warrant and that once she opened the picture directory tree, her job was done, we find that SA JL was not acting within the scope of the warrant at the time of the discovery of the first suspect image.

As in Carey, the terms of the first warrant did not authorize SA JL to conduct a general search. She was only authorized to search for photos that related to a specific date. Thus we find that the military judge erred when she found that the scope of the warrant included clicking on any nude photos. While the affidavit mentions photos of nude or partially nude people, the warrant does not reference or authorize a search for any “nude photos” unrelated to the specific date included in the warrant. The federal magistrate limited the scope by the date of the photos. Searching beyond that date exceeded the warrant’s scope. To conclude otherwise would invalidate our conclusion that the warrant was sufficiently specific to be valid.

Furthermore, we find that the intent of SA JL during her search is significant on the issue of scope. SA JL’s intent in clicking on the nude photographs was, in her own words, to determine if it was “contraband” and child pornography. As she was unaware of the terms of the warrant, it is clear she was not opening the files to see if the pictures related to the 12 February party. Similar to the investigator in Carey, SA JL was conducting a “general search” of the thumbnails for pictures of child pornography and looking for child pornography, instead of pictures of the 12 February 2005 party.⁹ See Carey, 172 F.3d at 1273.

Consistent with the conclusion in Carey we also agree with the 10th Circuit’s reasoning in United States v. Walser, 275 F.3d 981 (10th Cir.2001). In Walser, the investigator was restricting his search of a computer for places on the hard drive where drug trafficking records would logically be stored when he came across a file that happened to be child pornography. As soon as he found the first suspect file, beyond the scope of his search authority, he suspended his search and went to the magistrate for a new warrant for child pornography. Id. at 987. Thus, he limited the scope of his search to the terms of the warrant.

Here, however, we have an agent who, unaware of the scope of the warrant, intentionally, albeit unknowingly, exceeded the warrant’s scope. Upon noticing suspicious images, SA JL enlarged the thumbnails to determine whether or not they were child pornography and examined the details as to how the pictures of the alleged child pornography were saved to the appellant’s computer. This search was outside the scope of the warrant and the items seized were not authorized by the warrant.

We agree with the 10th Circuit’s point that computers make tempting targets in searches for incriminating information, and electronic storage is likely to contain a greater quantity and variety of information than any previous storage methods. Carey, 172 F.3d at 1275. We specifically agree with the court’s rationale regarding computer searches,

Where officers come across relevant documents so intermingled with irrelevant documents that they cannot feasibly be sorted at the site, the officers may seal or hold the documents pending approval by a magistrate of the conditions and limitations on a further search through the documents. The magistrate should then require officers to specify in a warrant what types of files are sought.

Id.

This Court finds that when dealing with search warrants for computers, there must be specificity in the scope of the warrant which, in turn, mandates specificity in the process of conducting the search. Practitioners must generate specific warrants and search processes necessary to comply with that specificity and then, if they come across evidence of a different crime, stop their search and seek a new authorization. This was not done in this case, therefore the search was invalid.

Ia. Plain View — Laptop

Assuming we found the search invalid, the appellee argues that the discovery of the images on the laptop could be saved because the images were in plain view when discovered. We disagree. The United States Supreme Court has said, the plain view doctrine may “not be used to extend a general exploratory search from one object to another until something incriminating at last emerges.” Arizona v. Hicks, 480 U.S. 321, 328, 107 S.Ct. 1149, 94 L.Ed.2d 347 (1987) (citing Coolidge, 403 U.S. 443, 466, 91 S.Ct. 2022, 29 L.Ed.2d 564 (1971)). In the case sub judiee, the special agent stated that she opened the images to verify if it was pornography, not to verify if it was a mirror image. When SA JL began examining the files on the computer the pictures of child pornography were not in plain view. She had to enlarge the thumbnails in order to determine that the images depicted were child pornography. Thus, as determined above, the inspection of those files exceeded the authorized scope of the authorized search. See United States v. Conklin, 63 M.J. 333 (C.A.A.F.2006). As the Supreme Court noted, the “distinction between looking at a suspicious object in plain view and moving it even a few inches is much more than trivial for the purposes of the Fourth Amendment.” Arizona v. Hicks, 480 U.S. 321, 325, 107 S.Ct. 1149, 94 L.Ed.2d 347 (1987). Here, we find that SA JL’s act of opening the thumbnails to see if they were images of child pornography is similar to moving an object, which is more than trivial for purposes of the Fourth Amendment.¹⁰ Thus the images were not in plain view.

Ib. Good Faith Exception — Laptop

We also do not find that the good faith exception applies to justify admission of the child pornography found on the laptop. The good faith exception applies only when police rely on the terms of the warrant. See Mil. R. Evid. 311(b)(3)(C); United States v. Leon, 468 U.S. 897, 922-23,104 S.Ct. 3405, 82 L.Ed.2d 677 (1984). SA JL did not rely on the terms of the warrant in this ease. She admitted at trial that she did not know what the warrant was for or that the terms of the warrant did not include a search for child pornography.

II. Scope of Consent of the External Hard Drive

In addition to the child pornography found on the appellant’s laptop, the appellant’s external hard drive also contained images of child pornography. The appellee argues that these images are admissible because the appellant provided unlimited consent to search his external hard drive. All of the parties agree that the federal warrant did not include the external hard drive and that admissibility of any items from the external hard drive hard drive hinges on the validity and the scope of the consent.

We find that the scope of the appellant’s consent to search the external hard drive was limited to pictures of the 12 February 2005 party. The scope of any consent search may not exceed the scope of the actual consent given. Florida v. Jimeno, 500 U.S. 248, 251, 111 S.Ct. 1801, 114 L.Ed.2d 297 (1991). “The standard for measuring the scope of a suspect’s consent under the Fourth Amendment is that of ‘objective’ reasonableness — what would the typical reasonable person have understood by the exchange between the officer and the suspect?” Id. “The scope of a search is generally defined by its expressed object.” Id.; cited in United States v. McMahon, 58 M.J. 362, 366 (C.A.A.F.2003).

Mil. R. Evid. 314(e)(3) implements the limited scope rule of Schneckloth v. Bustamante, 412 U.S. 218, 248-49, 93 S.Ct. 2041, 36 L.Ed.2d 854 (1973), which requires investigators to account for any expressed or implied limitations on a consent to search. United States v. Wallace, 66 M.J. 5, 8 (C.A.A.F. 2008). The prosecution must prove the voluntariness and the scope of the consent by clear and convincing evidence. Mil. R. Evid. 314(e)(5).

In determining the scope and voluntariness of the consent given by the appellant, we must consider what the reasonable person would have understood by the exchange between the appellant and the OSI agents at the time the consent was provided. Looking to the testimony we note the following significant specifies of that exchange:

1) The OSI agents advised the appellant that they were looking into an investigation and some pictures taken at the party may prove valuable to their investigation.

2) OSI advised the appellant they needed the laptop verses the thumb drive in order to get time/date stamps and modifications and other information (of the party pictures) that they could not get on the thumb drive.

3) The OSI agents advised the appellant they would return his computer as soon as possible.

4) When the appellant displayed discomfort about giving his laptop to OSI pursuant to the warrant, the agents tried to explain to him that “he wasn’t in any kind of trouble, and that they were not interested in underage drinking or things like that that [they] may find.”

5) Ultimately, the appellant was told that they had a warrant for these items and that he must surrender the computer parts.

6) At 1730 on 15 April 2005, just a couple hours after the OSI agents seized the laptop, when the appellant turned over an external hard drive and his laptop power cord to OSI, he stated he thought that OSI would want them because he used them with his laptop. In response, the OSI told him, “Thank you, [a]nd I need you to sign this form,” (consent to search and seizure) with no further explanation as to the difference between the consent form and the search warrant.

7) The consent form had “N/A” written in the section that indicates what the consenter is suspected of, therefore, it would have been clear to a reasonable person that he was not going to be investigated for a criminal act during the search. In this context, the “N/A” further affirmed appellant’s consent was limited to the dates prescribed in the search warrant itself.

8) The OSI agent who accepted the external hard drive admitted on cross examination that he told the appellant they were just looking for party pictures and the agent agreed with the defense counsel that appellant was consenting to getting the party pictures off [the external hard drive].

The record supports a finding that a reasonable person would have believed that consent was limited to searching for the party pictures from 12 February 2005 and not to a general search of the external hard drive. We find the prosecution failed to prove that the appellant’s consent was unlimited by clear and convincing evidence. This conclusion was particularly corroborated by the OSI agent herself, when she told the appellant they were only looking for the party photos.

With regard to the parameters of consent-based searches, we turn to our superior court’s decision in United States v. McMahon, 58 M.J. 362 (C.A.A.F.2003) for guidance. In McMahon, the Court proposed that when agents are conducting a search and find items indicative of criminal activity, but unrelated to their original search, the agents should promptly stop their search and properly obtain search authorization from a military magistrate. Id. at 367. In regard to the external hard drive, despite the fact that the agents assumed they had consent to search the external hard drive, that consent was still limited by scope. Once the original scope is exceeded, the agents must stop the search and seek a search authorization from a magistrate before continuing their search.

III. Inevitable discovery

The Appellee’s argument that the DCFL would have ultimately discovered the child pornography on either the laptop or the external hard drive also fails because DCFL could and would have limited themselves to the warrant or consent parameters.¹¹ The warrant and consent only authorized a search for pictures of the 12-13 February party and DCFL was limited to those dates. Ms. JH, who examined the media at DCFL, was told to extract photos created on 12-13 February 2005. She testified that in the course of conducting her limited search she did not recall seeing any child pornography during her investigation. Finally, all the child pornography images on the laptop were contained in hidden folders or were in deleted files that were only recovered through the use of forensic software. Therefore, for all the reasons above, we do not find that the inevitable discovery doctrine would have validated the ultimate seizure of the child pornography images from the laptop or the external hard drive.

IV. The Independent Source Doctrine

In addition, we determine that the 10 May 2005 search authorization for child pornography, required by DCFL and authorized by the military magistrate, has no independent source. The only source of information regarding the possession of child pornography appeared as a result of the unlawful search conducted by SA JL on 26 April 2005. The subsequent confession by the appellant was tainted by the initial illegality of the 26 April 2005 search. Therefore, the independent source doctrine can not be applied to remedy the illegal search conducted by SA JL. See Murray v. United States, 487 U.S. 533, 537, 108 S.Ct. 2529, 101 L.Ed.2d 472 (1988).

V. Remaining Evidence — Fruit of the Poisonous Tree

Finally, we find that all derivative evidence, to include the appellant’s admission, the full search of the external hard drive, and the CDs are fruit of the poisonous tree and therefore not admissible. Conklin, 63 M.J. at 339-40.

The taint from the illegal search of the laptop remained when the appellant confessed and subsequently consented to a search of his house. “If the appellant’s consent, albeit voluntarily, is determined to have been obtained through exploitation of the illegal entry, it can not be said to be sufficiently attenuated from the taint of that entry.” Conklin, 63 M.J. at 338 (quoting United States v. Khamsouk, 57 M.J. 282, 290 (C.A.A.F.2002)).

In Brown v. Illinois,¹² the Supreme Court analyzed three factors to determine if Miranda warnings were sufficient to remove the taint of an illegal search. The Fifth Circuit, in a case dealing with consent to computer searches, followed the Brown test. “To determine whether the defendant’s consent was an independent act of free will, breaking the causal chain between the consent and the constitutional violation, we must consider three factors: (1) the temporal proximity of the illegal conduct and the consent; (2) the presence of intervening circumstances; and (3) the purpose and the flagrancy of the initial misconduct.” Conklin 63 M.J. at 338-39 (citing United States v. Hernandez, 279 F.3d 302, 307 (5th Cir.2002)). The Brown factors can also be used to consider whether a confession was obtained by exploitation of a Fourth Amendment violation, in addition to the threshold requirement of the voluntariness of the confession. Khamsouk, 57 M.J. at 290; United States v. Davis, 30 M.J. 718, 720 (A.F.C.M.R.1990).

Applying this three-prong test to the facts at hand, we determine that all three favor the appellant. First, the illegal search of the computer was relatively close in time to the OSI actions which led to the additional evidence. Less than two hours elapsed between the time SA JL began opening the thumbnails and the time the OSI agents sought and obtained the appellant’s confession and consent to further search his house. Second, there were no intervening circumstances sufficient to remove the taint from the initial illegal search. One of the OSI agents, Ms. JH, stated that the “only lead” to the child pornography case was SA JL’s discovery when she opened the thumbnails. Within hours of the illegal search conducted by SA JL, the appellant was apprehended in his commander’s office and removed to the OSI detachment in handcuffs, and remained “in custody” during the search of his apartment.

In regard to the third factor, while we find no improper motive on behalf of the government agents in this case, we do find that their actions were unnecessary and unwise. The actions of SA JL, who was admittedly unaware of the terms of the warrant, were improper because she chose to expand the scope of a search by searching thumbnails that were in private files stored on a personal computer. SA JL had other options. She could have stopped the search after noticing one suspicious looking thumbnail and sought broader search authorization from a magistrate. She also could have sought another federal warrant to search the house for child pornography. While it is difficult to determine if the information would have been sufficient to justify an expanded warrant, that is precisely why the matter should have been brought to a magistrate.

Therefore, applying the Brown framework to this case, we find that the confession and the consent to search on 26 April 2008 were not sufficiently attenuated from the taint of the illegal search of the laptop. Likewise, we find the appellant’s confession, while receiving in-patient psychiatric treatment, on 2 May 2005 is similarly tainted. Like the first confession on 26 April 2005, there were no intervening circumstances to remove the taint from this confession.

Under these circumstances, we find the military judge abused her discretion by denying the defense motion to suppress the appellant’s oral and written confessions. We also find that the military judge erred in faffing to suppress the fruits of that search, to include the photos found on the external hard drive, the appellant’s confession and the computer media taken from the appellant’s house during the second search.

Remaining Issue

Although a final error was raised, we do not reach it because of our conclusion that the seizure of evidence was beyond the scope of the warrant. We specifically do not reach the issue of whether the military judge erred in admission of hearsay, and whether that error substantially prejudiced the appellant’s right to confrontation under the Sixth Amendment.¹³

Conclusion

We conclude that SA JL’s search exceeded the scope of the warrant in this case. The seizure of evidence upon which the charge and conviction was based was a consequence of an unconstitutional general search and the military judge erred by refusing to suppress it. Accordingly, the findings and the sentence are set aside and the charge dismissed. Article 66(d), UCMJ, 10 U.S.C. § 866(d).

1 . U.S. Const, amend. VI.

2 . Oral argument was heard at University of Louisville, Louis D. Brandéis School of Law, on 1 February 2008, as part of this Court's Project Outreach.

3 . The first warrant was obtained from the installation's military magistrate, despite the fact the appellant's apartment was not on the base.

4 . U.S. Const, amend. IV.

5 . There was no evidence presented that illegal images were ever found on the memory card itself. Thus appellant raises no issues with respect to the memory card.

6 . Probable cause for the search warrant was never disputed.

7 . The Carey Court’s conclusion that the first image was valid is based upon their conclusion that the agent was acting within the scope of the warrant at the time of the discovery.

8 . We note that this Court does not take issue with SA JL’s procedure of opening the directory tree to determine proper functioning of the mirror image. A technician could make a duplicate of a hard drive without violating the terms of the warrant.

9 . SA JL testified that at the time of her search she did not know the terms of the warrant. We recognize this oversight was probably due to the fact that her job was not to investigate the computer data, instead it was to make a mirror image of the hard drive; however, as an OSI agent, when she began to search for contraband, she should have become familiar with the terms of the warrant.

10 . U.S. Const, amend. IV.

11 . The Court is mindful our superior court’s recent findings in United States v. Wallace, 66 M.J. 5, 10 (C.A.A.F.2008) that pornography would have been "inevitably discovered” because the "military judge concluded, investigators would have had to sift through all the captured data to find relevant email traffic.” In this case Appellate Exhibit XXXII is a report from the DCFL showing that they both could and did conduct their search for the photos within the limits of the search. Appellate Exhibit XXXII contains the results of this limited search. The facts of Wallace, to include the warrant itself, distinguish it from the case sub judice. We also note Judge Baker’s concurring opinion in Wallace regarding the use of "primitive" software to conduct computer searches does not "excuse the resulting violation of Appellant’s Fourth Amendment rights.” Id. at 12.

12 . Brown v. Illinois, 422 U.S. 590, 95 S.Ct. 2254, 45 L.Ed.2d 416 (1975).

13 . U.S. Const, amend. VI.