United States v. Matthew Mann

In the
United States Court of Appeals
For the Seventh Circuit
No. 08-3041
U NITED S TATES OF A MERICA,
Plaintiff-Appellee,
v.
M ATTHEW E RIC M ANN,
Defendant-Appellant.
Appeal from the United States District Court for the
Northern District of Indiana, Hammond Division.
No. 2:07 CR 197—Rudy Lozano, Judge.
A RGUED F EBRUARY 18, 2009—D ECIDED JANUARY 20, 2010
Before R OVNER, E VANS, and T INDER, Circuit Judges.
R OVNER, Circuit Judge. Matthew Eric Mann entered a
conditional guilty plea to one count of possessing child
pornography in violation of 18 U.S.C. § 2252(a)(4)(B). The
district court sentenced Mann to sixty-three months
imprisonment to be followed by five years of supervised
release. Police discovered evidence supporting the child
pornography charges while executing a warrant to
search Mann’s computers and hard drives for the
2 No. 08-3041
unrelated crime of voyeurism. Mann preserved the right
to appeal the district court’s denial of his motion to
suppress the child pornography on the grounds that
the search exceeded the scope of the warrant. Although
we are troubled by some aspects of the search, we ulti-
mately conclude that, with one immaterial exception,
the officer executing the search did not exceed the scope
of the original warrant.
I.
While working as a life guard instructor in May 2007
for the Red Cross in Tippecanoe County, Indiana, Mann
covertly installed a video camera in the women’s locker
room to capture footage of women changing their
clothes. Unfortunately for Mann, he also captured footage
of himself installing the camera in an open locker. One
of the female students in his class later discovered the
camera. She recognized Mann in the video when she
rewound and viewed the tape. She and two other
women in Mann’s class contacted the Lafayette Police
Department and turned over the video camera and
the videotape.
Three days later, an Indiana state prosecutor sought
and received a search warrant for officers to search
Mann’s residence for “video tapes, CD’s or other digital
media, computers, and the contents of said computers,
tapes, or other electronic media, to search for images of
women in locker rooms or other private areas.” As
relevant here, officers executing the warrant seized a
Dell desktop computer with a Samsung hard drive, a
No. 08-3041 3
Dell laptop, an e-machine, and a Western Digital
external hard drive. The following day officers arrested
Mann and charged him with voyeurism in violation of
the Indiana Code. See Ind. Code Ann. § 35-45-4-5(a)(2)-
(b)(1) (defining voyeurism and making it a class D
felony when committed by means of any type of video
recording device).
Nearly two months later, at the end of July 2007, Detec-
tive Paul Huff of the Lafayette Police Department began
his search of Mann’s computers. At the suppression
hearing, Detective Huff testified that he searched the
computers by first using a “write blocker” to protect the
hard drives from being altered and then created an
exact match of each hard drive. He then used software
known as “forensic tool kit” (“FTK”) to catalogue the
images on the computer into a viewable format.
Detective Huff explained that once this indexing process
using FTK is completed, an “overview screen” is generated
that lets him know how many images, videos, and docu-
ments are on the computer and whether there are en-
crypted documents or files that may be ignored (such as
program files). The overview screen also lists files
flagged by the software as “KFF (Known File Filter)
Alert” and “KFF Ignorable” files. The “KFF Alert” flags
those files identifiable from a library of known files
previously submitted by law enforcement—most of
which are images of child pornography.
On the first computer, Detective Huff discovered evi-
dence that Mann had visited a web site called “Perverts
Are Us,” where he had read and possibly downloaded
4 No. 08-3041
stories about child molestation. On the Dell laptop, Detec-
tive Huff uncovered still images taken in the Jefferson
High school locker room, child pornography, and
evidence that the Western Digital external hard drive
had been connected to the laptop. Detective Huff then
searched the final computer, where he again found child
pornography, along with a disturbing story (presumably
written by Mann) about a swim coach masturbating
while watching young girls swim.
It was not until nearly another two months later, on
September 18, 2007, that Detective Huff first searched the
Western Digital external hard drive. As with the other
computers, Detective Huff used FTK to index the
contents of the hard drive. The FTK software identified
four “KFF Alert” files and 677 “flagged thumbnails.”
Detective Huff proceeded to open the files on the
computer and discovered “many, many images of child
pornography” as well as two videos from the Jefferson
High School locker room.
Mann moved in the district court to suppress all of the
evidence seized from his home and computers as a
result of the May 2007 warrant, arguing that the
warrant lacked probable cause and that the executing
officers exceeded the scope of the warrant’s authorization.
The district court denied Mann’s motion, concluding
that the magistrate judge had probable cause to issue
the warrant based on the evidence of Mann’s voyeurism
at Jefferson High School and the probability that Mann
possessed evidence of his crime at his residence. The
district court also rejected Mann’s claim that the
No. 08-3041 5
executing officers had exceeded the scope of the warrant
when they opened the files containing child pornogra-
phy. Specifically, the district court found as a factual
matter that Detective Huff believed the search warrant
authorized him to examine any digital file located on the
computer hard drives or storage devices and that he never
abandoned his search for evidence of voyeurism and began
looking for child pornography. The court ultimately
concluded that “with limited exceptions” the search was
within the scope of the warrant, and that any images
uncovered outside the scope of the warrant were discov-
ered in plain view. Mann then entered a conditional guilty
plea to the one count of possession of child pornography in
the indictment, reserving his right to challenge on appeal
the district court’s denial of his motion to suppress.
II.
On appeal, Mann maintains that the district court
erred by denying his motion to suppress. In particular,
Mann claims that the searches that uncovered the child
pornography on his computer exceeded the scope of the
original warrant and that the plain view doctrine does not
apply on these facts. The government insists that the
searches did not exceed the scope of the original war-
rant, and that the incriminating child pornography was
in any event discovered in plain view. When reviewing
a motion to suppress, we review the district court’s
legal conclusions de novo and its factual findings for
clear error. E.g., United States v. Marrocco, 578 F.3d 627, 632
(7th Cir. 2009).
6 No. 08-3041
We begin with Mann’s contention that Detective
Huff’s search of the computers exceeded the scope of the
warrant. The Fourth Amendment requires that a
warrant describe the things to be seized with sufficient
particularity to prevent a general exploratory rum-
maging through one’s belongings. See, e.g., Marron v. United
States, 275 U.S. 192, 196 (1927) (“The requirement that
warrants shall particularly describe the things to be
seized makes general searches under them impossible
and prevents the seizure of one thing under a warrant
describing another. As to what is to be taken, nothing is
left to the discretion of the officer executing the war-
rant.”). The description of items to be seized limits the
scope of the search to areas where those items are likely
to be discovered. Platteville Area Ap’t. Ass. v. City of
Platteville, 179 F.3d 574, 579 (7th Cir. 1999). Thus, our
question is whether, in light of the limitations in the
warrant, the execution of the search was reasonable—the
touchstone for all Fourth Amendment inquiries. Id.; see
also Ill. v. McArthur, 531 U.S. 326, 330 (2001).
Mann maintains that given the warrant’s directive to
search in those places likely to contain “images of
women in locker rooms and other private places,” it was
unreasonable for Detective Huff to employ the FTK
software and its accompanying “KFF Alert” system, which
ordinarily identifies files containing child pornography.
Undoubtedly the warrant’s description serves as a limita-
tion on what files may reasonably be searched. The prob-
lem with applying this principle to computer searches
lies in the fact that such images could be nearly any-
where on the computers. Unlike a physical object that
No. 08-3041 7
can be immediately identified as responsive to the
warrant or not, computer files may be manipulated to
hide their true contents. See United States v. Hill, 459
F.3d 966, 978 (9th Cir. 2006) (“Images can be hidden in
all manner of files, even word processing documents
and spreadsheets. Criminals will do all they can to
conceal contraband, including the simple expedient of
changing the names and extensions of files to disguise
their content from the casual observer.”).
So although the officers were limited by the warrant to
a search likely to yield “images of women in locker
rooms and other private places,” those images could be
essentially anywhere on the computer. Detective Huff
testified at the suppression hearing that “[r]egardless of
what I found, I would search in all the files if I felt it
necessary, if I felt that it contained information that was
pertinent to my case or even exculpatory.” Thus, the
government’s argument goes, Detective Huff was at all
relevant times searching for the type of image detailed
in the warrant, and the fact that he uncovered child
pornography does not invalidate the lawful search.
Mann, however, maintains that Detective Huff ignored
the limitations in the warrant and instead conducted a
general search for crimes unrelated to voyeurism. Mann
relies heavily on a Tenth Circuit decision, United States
v. Carey, 172 F.3d 1268 (10th Cir. 1999), for the proposi-
tion that the seizure of the child pornography on his
computer was unauthorized. In Carey, police obtained a
warrant to search the defendant’s computers for “ ‘names,
telephone numbers, ledger receipts, addresses and other
8 No. 08-3041
documentary evidence pertaining to the sale and dis-
tribution of controlled substances.’ ” Carey, 172 F.3d at
1270. After unsuccessfully searching the computers’ text
files using key words such as “money” and “accounts,” the
officers searched the directories and downloaded and
then opened JPG (image) files containing child pornogra-
phy. After opening the first JPG file and finding child
pornography, the officer in Carey “continued to open
every JPG file to confirm his expectations” of finding
child pornography. Id. at 1273. The Tenth Circuit con-
cluded that the seized images of child pornography
were neither authorized by the warrant nor found in
plain view. Rather than delve into the “intriguing” ques-
tion of “what constitutes ‘plain view’ in the context of
computer files,” the panel judged the case “only by its
own facts.” Id. The panel concluded that discovery of
the child pornography was not “inadvertent” as
required by the plain view doctrine, and that by looking
for child pornography in the JPG files on the computer
the officer exceeded the scope of the warrant and executed
an unconstitutional general search. Id. at 1276.
More recently, the Tenth Circuit decided United States
v. Burgess, 576 F.3d 1078 (10th Cir. 2009), where the court
upheld the admission of child pornography discovered
on the defendant’s computer when officers were
executing a warrant to search his motor home and com-
puter records for evidence of transportation and
delivery of controlled substances, id. at 1088-89. In
Burgess, the court reiterated that “the Carey holding was
limited.” Burgess, 576 F.3d at 1092. The court in Burgess
noted specifically that both the majority and the
No. 08-3041 9
concurring opinions in Carey “were careful to warn that
the case was fact intense.” Id. (citing Carey, 172 F.3d at
1276); see also Carey, 172 F.3d at 1276 (emphasizing that
“the questions presented in this case are extremely
close calls and, in my opinion, are totally fact driven”)
(Baldock, J., concurring).
In particular, the court in Carey premised its holding on
a few key facts that are absent here. First, the warrant in
Carey authorized a search of the computer solely for
“documentary” evidence of drug dealing; thus, the
court found it significant that officers downloaded and
viewed numerous image files containing child pornogra-
phy. Id. at 1271, 1273 (noting that “scope of the search
was . . . circumscribed to evidence pertaining to drug
trafficking”). In contrast, Officer Mann was searching for
“images” of women—a type of file that he could not
search thoroughly for without stumbling upon Mann’s
extensive collection of child pornography. In this
respect, the search of Mann’s computer more closely
resembles the search in Wong, where the Ninth Circuit
upheld the denial of a motion to suppress child pornogra-
phy found on a defendant’s computer incident to a
murder investigation. United States v. Wong, 334 F.3d
831 (9th Cir. 2003). There, the court concluded that the
officer was within the scope of the warrant to search
for evidence pertaining to a murder investigation when
he opened images of child pornography, made a note of
the files’ location, and continued with his search for
evidence relating to the murder. Id. at 835, 837-38.
Second, the court in Carey found as a factual matter
that the officer conducting the search “made clear as he
10 No. 08-3041
opened each of the JPG files he was not looking for evi-
dence of drug trafficking” and had “abandoned that
search to look for more child pornography.” Carey, 172
F.3d at 1273. In contrast, the district court here in its
factual findings credited Detective Huff’s testimony that
at all times during the search, “I continued to look for
items with voyeurism, and as I came across the child
pornography, then I would not ignore it obviously.” Thus,
Detective Huff’s actions are much closer to the detective
in Wong, who discovered child pornography as he
searched for items within the scope of the original
warrant for evidence tied to a murder investigation. See
Wong, 334 F.3d at 838; see also United States v. Gray, 78
F. Supp.2d 524, 529 (E.D. Va. 1999) (“In searching for the
items listed in the warrant, Agent Ehuan was entitled to
examine all of defendant’s files to determine whether
they contained items that fell within the scope of the
warrant. In the course of doing so, he inadvertently
discovered evidence of child pornography, which was
clearly incriminating on its face.”). And although intent
is not generally relevant when assessing whether a given
search falls within the scope of the warrant, Platteville,
179 F.3d at 580, Detective Huff’s focus on finding
images related to the voyeurism charges serves to
further distinguish this case from Carey. Compare Carey,
172 F.3d at 1273 (noting that searching detective knew
he was expanding scope of search and had abandoned
the drug-related search to search for more child pornogra-
phy) with Burgess, 576 F.3d at 1092 (upholding search
where officer “was only looking for ‘trophy photos’ when
he came upon the child pornography”); see also Gray, 78
No. 08-3041 11
F. Supp.2d at 527 (agent opened subdirectory entitled
“Tiny Teen” not “because he believed it might contain
child pornography, but rather because it was the next
subdirectory listed and he was opening all of the sub-
directories as part of his routine search for the items
listed in the warrant”).
Additionally, we note that Mann’s primary complaint
with Detective Huff’s search—that he used FTK software
employing a filter and viewed those files flagged with the
“KFF Alert”—does not impact the outcome here. First,
as to the use of the filtering software itself, Detective
Huff used it to index and catalogue the files into a
viewable format. Given the nature of Detective Huff’s
search and the fact that Mann could have images of
women in locker rooms virtually anywhere on his com-
puters, there is no reason to believe that Detective
Huff exceeded the scope of the warrant by employing
the FTK software without more. But see United States v.
Comprehensive Drug Testing, Inc., 579 F.3d 989, 999 (9th Cir.
2009) (admonishing that government’s “sophisticated
hashing tools . . . that allow the identification of well-
known illegal files . . . and similar search tools may not
be used without specific authorization in the warrant”).
The same cannot be said of the four flagged “KFF Alert”
files. Once those files had been flagged, Detective Huff
knew (or should have known) that files in a database
of known child pornography images would be outside
the scope of the warrant to search for images of women
in locker rooms—presumably images that Mann himself
had captured. Unfortunately for Mann, suppressing those
four images has no impact on the outcome here. Without
12 No. 08-3041
those images, the government still possessed ample
evidence of child pornography to sustain both Mann’s
conviction and sentence. Although we hold that Officer
Huff exceeded the scope of the warrant by opening the
four flagged “KFF Alert” files, those files are severable
from the remaining files seized. See United States v.
Buckley, 4 F.3d 552, 557-58 (7th Cir. 1993). We thus
reject Mann’s suggestion that all of the evidence of child
pornography should be suppressed because Officer
Huff exceeded the authorization of the warrant when
opening the “KFF Alert” files.
We also reject Mann’s suggestion that we take our cue
from the more comprehensive rules regarding computer
searches recently outlined by the Ninth Circuit. In
United States v. Comprehensive Drug Testing, Inc., an
en banc panel of the Ninth Circuit rejected the govern-
ment’s attempt to justify its seizure of drug testing
records for hundreds of Major League Baseball Players
despite a warrant authorizing the seizure of only ten
players’ records. 579 F.3d 989, 993, 1000 (9th Cir. 2009).1
In so doing, the Ninth Circuit laid down a series of rules
to address the difficulties posed by searches and
seizures of digital media. The court set forth the
following guidelines applicable when officers conduct
computer searches and seizures. First, the opinion directs
1
The Ninth Circuit recently (November 4, 2009) entered an
order asking the parties in this case to brief the question of
whether the case should be reheard by the full en banc court
(comprised of all active judges as opposed to the 11 ordinarily
selected randomly for standard en banc review).
No. 08-3041 13
magistrate judges to insist that the government
waive reliance on the plain view doctrine. See Comprehen-
sive Drug Testing, 579 F.3d at 998, 1006. Second, the
warrant application should include protocol “for pre-
venting agents involved in the investigation from ex-
amining or retaining any data other than that for
which probable cause is shown”—preferably by
requiring segregation to be done by specially trained
computer personnel unconnected to the investigation
who agree not to “communicate any information they
learn during the segregation process absent further ap-
proval of the court.” Id. at 1000. Third, the government
must use search protocol tailored to uncover only infor-
mation for which it has probable cause. Id. at 999-1001,
1006. Finally, the government must either destroy or
return any non-responsive data and inform the
magistrate what it has kept, destroyed, or returned. Id. at
1000-01, 1006.
Mann urges us to apply the Ninth Circuit’s rationale
to conclude that Detective Huff’s search was unconstitu-
tional. Although the Ninth Circuit’s rules provide some
guidance in a murky area, we are inclined to find more
common ground with the dissent’s position that
jettisoning the plain view doctrine entirely in digital
evidence cases is an “efficient but overbroad approach.” Id.
at 1013 (Callahan, J., concurring in part and dissenting in
part). As the dissent recognizes, there is nothing in the
Supreme Court’s case law (or the Ninth Circuit’s for
that matter) counseling the complete abandonment of
the plain view doctrine in digital evidence cases. Id. We
too believe the more considered approach “would be to
14 No. 08-3041
allow the countours of the plain view doctrine to
develop incrementally through the normal course of fact-
based case adjudication.” Id. We are also skeptical of a
rule requiring officers to always obtain pre-approval
from a magistrate judge to use the electronic tools neces-
sary to conduct searches tailored to uncovering
evidence that is responsive to a properly circumscribed
warrant.
Instead, we simply counsel officers and others involved
in searches of digital media to exercise caution to
ensure that warrants describe with particularity the
things to be seized and that searches are narrowly
tailored to uncover only those things described. As dis-
cussed above, with the exception of the four “KFF Alert”
images, Detective Huff’s search was indeed targeted to
uncovering evidence of voyeurism as described in what
Mann now concedes was a lawful warrant.2 In so doing,
he uncovered obvious evidence of child pornography.
Although we now hold that his actions were within
the scope of the warrant, we emphasize that his failure
to stop his search and request a separate warrant for
child pornography is troubling. Burgess, 576 F.3d at 1095(noting that when searching detective “observed a
possible criminal violation outside the scope of the war-
rant’s search authorization” he “immediately closed the
gallery view . . . and did not renew the search until he
2
Although Mann argued in the district court that the
warrant lacked probable cause, he has since abandoned that
challenge.
No. 08-3041 15
obtained a new warrant”). Because Detective Huff
was not in a rapidly unfolding situation or searching a
location where evidence was likely to move or change,
there was no downside to halting the search to obtain
a second warrant. Indeed, we find it problematic that
nearly two months elapsed before Detective Huff began
his search of the Western Digital hard drive despite
having found child pornography on the Dell laptop.
However, notwithstanding our distaste for the timeline
of the investigation, we conclude that the original
warrant authorized Detective Huff’s search of the
external hard drive for images of voyeurism. Given this,
we ultimately conclude that, with the exception of the
four “KFF alert” images, the search was lawful, particu-
larly since Detective Huff did indeed uncover further
evidence of voyeurism on the external hard drive.
Because Detective Huff discovered the child pornography
while conducting a systematic search for evidence of
voyeurism, we conclude that his actions were reasonable
and within the scope of the warrant’s authorization. See
United States v. Grimmett, 439 F.3d 1263, 1270 (10th Cir.
2006) (recognizing that computer search may be “‘as
extensive as reasonably required to locate the items
described in the warrant.’ ” (quoting United States v.
Wuagneux, 683 F.2d 1343, 1352 (11th Cir. 1982))).
For the foregoing reasons we A FFIRM the judgment of
the district court denying Mann’s motion to suppress.
1-20-10