United States v. Kirk Cottom

United States Court of Appeals
For the Eighth Circuit
___________________________
No. 16-1050
___________________________
United States of America
lllllllllllllllllllll Plaintiff - Appellee
v.
Kirk Cottom
lllllllllllllllllllll Defendant - Appellant
____________
Appeal from United States District Court
for the District of Nebraska - Omaha
____________
Submitted: November 16, 2016
Filed: February 17, 2017
[Unpublished]
____________
Before COLLOTON, BEAM, and GRUENDER, Circuit Judges.
____________
PER CURIAM.
Kirk Cottom pled guilty to accessing with intent to view child pornography, in
violation of 18 U.S.C. § 2252A(a)(5)(B), and receipt of child pornography, in
violation of 18 U.S.C. § 2252A(a)(2)(A). On appeal, Cottom challenges the district
court's1 denials of his motion to suppress and motion in limine. We affirm.
I. BACKGROUND
This case involves charges stemming from a 2012 FBI investigation into a
computer server in Bellevue, Nebraska, that was hosting child-pornography websites.
See also United States v. Welch, 811 F.3d 275 (8th Cir.), cert. denied, 136 S. Ct. 2476(2016). Cottom is one of multiple defendants charged as a result of the investigation.
Welch described the investigation in detail:
[The investigated websites] operate[d] on a clandestine network,
accessible only with special software and designed to obscure a user's
identity. This prevented FBI agents from discovering the Internet
Protocol (IP) addresses of [the websites'] users. An Internet Service
Provider (ISP) assigns an IP address to an individual computer using its
Internet service and associates the IP address with the physical address
to which that service is being provided. If investigators know an
Internet user's IP address, they can subpoena that user's ISP to provide
the associated physical address.
Rather than shut the server down, the FBI sought to install
software on the server that would circumvent this [clandestine] network,
providing agents with information about any user who accessed certain
content on [the targeted websites] (the "Network Investigative
Technique" or NIT). This information included the user's IP address,
the date and time the user accessed the content, and his or her
computer's operating system. The FBI obtained a warrant (the NIT
warrant) to install the software in November 2012 and kept the
website[s] in operation for approximately three weeks, collecting
1
The Honorable Joseph F. Bataillon, United States District Judge for the
District of Nebraska.
-2-
information on several . . . users. Based on this information, the FBI
obtained [Cottom's] IP address.
Id. at 277-78. Once the FBI obtained Cottom's IP address through the use of the NIT,
it issued an administrative subpoena to the corresponding ISP to identify Cottom's
physical address. In April 2013, officers executed a search warrant at Cottom's
Rochester, New York, residence, seized evidence containing images of child
pornography, and arrested him. The search and subsequent arrest of Cottom took
place as part of a coordinated, synchronized search effort by the FBI and government
lawyers designed to conduct searches in temporal proximity with each other so as to
reduce communication between the alleged would-be codefendants and to ultimately
preserve evidence.
Before the district court, Cottom, along with other codefendants, challenged
the delayed notice they received following the execution of the NIT warrant and
objected to the introduction of evidence obtained as a result of the search. In
Cottom's case, for example, although the warrant was executed and the NIT installed
in November 2012, the search of his residence, and his subsequent arrest, occurred
in April 2013. Cottom argued that this delay violated Federal Rule of Criminal
Procedure 41, which requires that a copy of an executed search warrant be provided
to the owner of the property seized. Fed. R. Crim. P. 41(f). By statute, this Rule 41
provision may be delayed under circumstances for thirty days or to a later date certain
and officers may seek extensions. 18 U.S.C. § 3103a(b).2 The warrant at issue here
2
Rule 41(f)(1)(C) states:
The officer executing the warrant must give a copy of the warrant and
a receipt for the property taken to the person from whom, or from whose
premises, the property was taken or leave a copy of the warrant and
receipt at the place where the officer took the property.
Rule 41(f)(3) allows a delay in providing the warrant if authorized by statute. Title
-3-
did contain a request for such a delay. The various defendants challenged the warrant
and the delay requested therein, arguing that the relevant language in the warrant
required notice within thirty days of execution of the warrant, not thirty days after the
user was identified, as the delay request was interpreted and applied by the
government. The district court rejected the argument, holding "that the [NIT] warrant
intended the thirty-day notice period to begin running when the FBI identified an
individual 'behind the keyboard[,]' . . . [which] occurred in April 2013 when officers
executed the residential search warrant[s.]" Welch, 811 F.3d at 279 (reviewing the
NIT warrant at issue in Cottom's case). Thus, the district court held that the
government's request for a delay was valid and denied the motions to suppress filed
by the defendants.
Regarding Cottom's motion in limine, during discovery Cottom moved for
additional discovery, including a request for the original source code that was used
to create and deploy the NIT; a code Cottom claimed was needed to determine how
the NIT was configured. The government conceded that the original source code was
not preserved and Cottom sought exclusion of the expert testimony of FBI Special
Agent Smith and Supervisory Special Agent Gordon under Daubert v. Merrell Dow
18 U.S.C. 3103a(b) provides that notice of a warrant may be delayed if:
(1) the court finds reasonable cause to believe that providing
immediate notification of the execution of the warrant may have
an adverse result . . .;
(2) the warrant prohibits the seizure of any tangible property, any
wire or electronic communication . . ., or . . . any stored wire or
electronic information, except where the court finds reasonable
necessity for the seizure; and
(3) the warrant provides for the giving of such notice within a
reasonable period not to exceed 30 days after the date of its
execution, or on a later date certain if the facts of the case justify
a longer period of delay.
-4-
Pharmaceuticals, 509 U.S. 579 (1993). Because the original source code was not
preserved, Cottom argued that these experts' opinions regarding the NIT employed
in this case lacked proper foundation and were based on insufficient data. The district
court denied the motion following a hearing on the matter. Cottom additionally
challenges this ruling on appeal.
II. DISCUSSION
A. Motion to Suppress
"When reviewing a district court's denial of a suppression motion, we review
for clear error the district court's factual findings and review de novo whether the
Fourth Amendment was violated." Welch, 811 F.3d at 279 (quoting United States v.
Bell, 480 F.3d 860, 863 (8th Cir. 2007)). On these facts, "a Rule 41 violation
amounts to a violation of the Fourth Amendment warranting exclusion 'only if
[Cottom] is prejudiced or if reckless disregard of proper procedure is evident.'" Id.(quoting United States v. Spencer, 439 F.3d 905, 913 (8th Cir. 2006)).
The NIT warrant at issue included a section entitled "Request for Delayed
Notice" that cited the provisions of Rule 41(f)(3) and § 3103a(b)(1) and (3), and
included factual support for the requested delay. Namely the affidavit stated that
announcing the proposed use of the NIT could cause those individuals accessing the
websites to undertake measures to conceal their identity or abandon the use of the
websites completely; would risk the destruction of, or tampering with, evidence; and
could seriously jeopardize the success of the investigation into the conspiracy and
impede efforts to learn the identity of the target individuals, whose exact identities
had not yet been determined. Accordingly, the government sought delay of notice
"until 30 days after any individual accessing [the targeted websites] has been
identified to a sufficient degree as to provide notice, unless the Court finds good
cause for further delayed disclosure."
-5-
In Welch, a case involving a codefendant of Cottom, we reviewed the district
court order denying the defendants' motions to suppress evidence obtained as a result
of the NIT warrant–the same order at issue here. Id. at 279-81. As to the delay
request in the NIT warrant, Welch argued "that the [statutory] thirty-day period began
to run from the date the government received the subscriber information for Welch's
IP address from his ISP." Id. at 280. Welch claimed that because agents testified that
the NIT warrant was used to obtain a user's IP address, "the subject of the warrant
was the subscriber assigned that IP address, and so the subject was 'identified' in
December, not the following April," and thus he was provided notice beyond the
thirty-day time period in violation of Rule 41. Id.
On appeal in Welch, we disagreed with the district court's determination that
the delay request in the NIT warrant was valid under the law. Rather, we held that
the notice the government gave Welch failed to comport with Rule 41. Id. We held
that the statute authorizing the judge to delay notice is perfectly clear–"the thirty-day
extension runs from the execution of the warrant," which in these cases, occurred in
November 2012. Id. Despite the procedural violation, however, we concluded that
Welch was not prejudiced by the violation nor did the investigators recklessly
disregard proper procedure, and thus "the delayed notice to Welch of the NIT warrant
did not violate the Fourth Amendment and so did not warrant suppression of evidence
obtained from it." Id. at 281. Welch controls the matter now before us. "A panel of
this Court is bound by a prior Eighth Circuit decision unless that case is overruled by
the Court sitting en banc." United States v. Manning, 786 F.3d 684, 686 (8th Cir.)
(quoting United States v. Wright, 22 F.3d 787, 788 (8th Cir. 1994)), cert. denied, 136
S. Ct. 278 (2015).
On appeal, Cottom asks this court to follow our determination in Welch that
the thirty-day extension ran from the execution of the warrant and thus the notice
Cottom was provided failed to comply with Rule 41. Relying upon our analysis in
-6-
Welch, we agree.3 Welch, 811 F.3d at 281. Cottom goes on to argue, however, that
the government lawyers authored the "Request for Delayed Notice" portion of the
affidavit supporting the NIT warrant with an intentional and deliberate disregard of
the procedural requirements in order "to grant the officers a pass around the proper
procedures." In that light, according to Cottom, the delay was a deliberate violation
of Rule 41 and the officers' delay in providing him notice could not have been a good
faith application of the warrant and he was thus prejudiced by the violation. But, this
issue, too, was analyzed and decided in Welch. Id. No matter who drafted the
paragraph itself, we held in Welch that "the officers' delay was a good-faith
application of the warrant rather than a deliberate violation of Rule 41." Id. This
determination of good faith was corroborated by the agent who swore out the
affidavit and applied for the NIT warrant, and who testified that the "delayed notice
period was to begin when the government identified the true name user of an
individual that accessed one of these three websites." Id. This holding is binding
upon us today.
Cottom unsuccessfully attempts to separate himself from the analysis in Welch,
which resolved the issue as to whether the defendants were prejudiced by the
violation that is now binding on this court. Therefore, the district court's additional
finding in this case that any Rule 41 violation did not prejudice Cottom is also not
3
Our determination on the matter in Welch, as here, was conditioned on the
assumption that Rule 41(f) applies to the NIT warrant. Rule 41(f)(1)(C) requires that
a copy of the warrant and a receipt of the property taken be left with the "person from
whom, or from whose premises, the property was taken." Rule 41 defines property
to "include[] documents, books, papers, any other tangible objects, and information."
Fed. R. Crim. P. 41(a)(2)(A) (emphasis added). Whether Cottom's IP address (which
is generated by a third party and assigned by the ISP), the time and date he accessed
the website content, and his computer's operating system are the kind of
"information" considered to be property under Rule 41 is an open question. 811 F.3d
at 280 n.4. As in Welch, however, because we affirm the district court, we need not
address that argument here.
-7-
clearly erroneous. In that same vein, we, too, find that the district court's finding that
any Rule 41 violation was not due to reckless disregard of proper procedure was not
clearly erroneous. Id. There is nothing in this record to indicate "that had the officers
followed Rule 41 they would not have been able to search [Cottom's] residence and
obtain the evidence they did. The nature of the investigation indicates they could
have easily obtained extensions had they sought them." Id. The delayed notice to
Cottom of the NIT warrant did not violate the Fourth Amendment and so did not
warrant suppression of evidence obtained from it. The district court properly denied
the motion to suppress.
B. Motion in Limine/Evidence Spoliation
During discovery, Cottom sought the original source code that was used to
create and deploy the NIT. The government conceded that the original source code
was not preserved, and on that basis, Cottom sought exclusion of expert testimony
offered by the government, arguing that without the original source code, Cottom's
own experts could not definitively determine whether the NIT satisfied the Daubert
standard and thus opinions of the government experts lacked proper foundation and
were based on insufficient data. The district court denied the motion, concluding
after an evidentiary hearing that the government's failure to preserve and produce the
original source code was of little consequence to the determination whether the
government's experts satisfied the prerequisites under Daubert.
We review a district court's determination on the admissibility of expert
testimony for abuse of discretion. United States v. Coutentos, 651 F.3d 809, 820 (8th
Cir. 2011). In a case involving the alleged spoliation of evidence, "a district court is
required to make two findings before an adverse inference instruction is warranted:
(1) 'there must be a finding of intentional destruction indicating a desire to suppress
the truth,' and (2) '[t]here must be a finding of prejudice to the opposing party.'"
Hallmark Cards, Inc. v. Murley, 703 F.3d 456, 460 (8th Cir. 2013) (alteration in
-8-
original) (quoting Stevenson v. Union Pac. R.R. Co., 354 F.3d 739, 746, 748 (8th Cir.
2004)).
Thoroughly reviewing all of the evidence, the district court noted that "[t]he
government's experts and the defendant's own expert all testified that source code
information would make little difference in determining that the NIT employed in this
case is reliable and that the techniques that were used to derive it are repeatable."
Additionally, "[t]here [was] no evidence of anything other than an inadvertent failure
to preserve the source code . . . and the lost data [was] essentially recoverable," which
lead to the district court's sound holding on the issue of spoliation and admissibility.
Reviewing the evidence and arguments on appeal, we find no abuse of discretion by
the district court in denying the motion in limine.
III. CONCLUSION
For the reasons stated herein we affirm.
______________________________
-9-