United States v. Flinn

521 F.Supp.2d 1097 (2007)

UNITED STATES of America, Plaintiff,
v.
Jeremy FLINN, Defendant.

CR. No. S-05-314 GEB (GGH).

United States District Court, E.D. California.

October 16, 2007.

Carolyn K. Delaney, United States Attorney's Office, Sacramento, CA, for Plaintiff.

Daniel J. Broderick, Federal Defender's Office, Sacramento, CA, for Defendant.

ORDER

GREGORY G. HOLLOWS, United States Magistrate Judge.

Introduction and Summary

In a superseding indictment filed February 2, 2006, defendant Jeremy Flinn was charged with receiving, and possession of, child pornography. 18 U.S.C. § § 2252(a)(2), 2252(a)(4)(B). By his discovery motion, Flinn seeks to have his expert examine a mirror image of Flinn's seized hard drive and thumb drive at his defense expert's facilities.

On July 27, 2006, the Adam Walsh Act took effect. One of its provisions codified at 18 U.S.C. § 3509(m) required that the Government or the court maintain control during the criminal case process of seized material constituting child pornography. The Act further required that the court deny any Fed.R.Crim.P. 16 request for defense duplication, copying, and so forth of the material "so long as the Government makes this property or material reasonably available to the defendant." § 3509(m)(2)(A). "[P]roperty or material shall be deemed to be reasonably available to the defendant if the Government provides ample opportunity for inspection, viewing, and examination at a Government facility" to the defendant, his attorney, and/or experts. § 3509(m)(2)(B).

Although defendant Flinn in his papers purportedly eschews a facial, constitutional attack on this statute, in effect, he argues that given the needs of a defendant in a child pornography case, the defense can essentially never have an "ample opportunity" to inspect the contraband unless the expert is free to take the contraband, or a mirror image, to the expert's own facilities for use with the expert's own devices/software. Flinn argues that this is certainly true in his particular case, but makes no attempt to differentiate his case from the "ordinary" child pornography case. His expert testified to a variety of impediments to adequate review as he saw it which would be present in almost any case. Indeed, the court's impression at evidentiary hearing was:

Well, I'm finding this all very interesting, and I mean that truly, although I'm tossing about in my own mind what the ultimate result would be if I agreed with you [defense counsel]. I would have to make a finding that [in restricting defense access to child pornography materials] Congress didn't know what it was doing when it passed this provision. That's kind of tough to do.

RT I, 42.

* * *

The Court: And your position is there's nothing unique about this case, it's every case?

Mr. Hansen: I can't come to any other conclusion just based on my experience in these type of cases.

RT II 50-51.

For the reasons expressed below, the court finds that the McClellan^[1] facility offered by the Government for forensic examination of child pornography material, including that maintained in digital form, provides "ample opportunity" for defense purposes, at least prior to the expression of a case specific rationale made after an initial, good faith attempt by the defense to forensically review the material at the Government facility.

Facts

Over the course of three separate days, the parties strove to demonstrate that the defense could, at a government facility, forensically examine, or not, mirror images of the seized materials. Flinn called Jeff Fischbach, a well qualified by experience computer forensic expert. This particular expert was not interested in the "usual" issue of distinguishing virtual child pornography from real, i.e., pictures of actual children, as that issue is often a foregone conclusion if the "hash values" of the seized images match a government held data base (NCMC) of known, real child pornography pictures. See RT I 37-39, 52.

One is that my job is not to look at an image. In fact, I can do my job without ever looking at an image and have volunteered that before. . . . My job is to work on these time lines, and to work on the idea of knowing, and what is possession, and what represents possession within a hard drive.

RT 33-34

* * *

As I explained earlier, one of the most important things for me is to time span, I create what's called an event matrix in most of my cases, because my understanding. . . . and therefore, I need to know what somebody was doing, or where somebody was at a particular point in time.

So these even matrixes, or matrices are for time spanning a number of parallel events and seeing what's going on. So, I may take data from credit card records, or from cell phones, that sort of thing, and compare them to a hard drive on a time line, on a single time line, and so the software . . . that I've evolved over the years, one of the main purposes is for taking that sort of information out of the different sources and rolling it into that time line so that I can prepare and examine a report.

RT I 15-16.

The length of time it would take this expert to do his job depended on the amount of information to be analyzed, e.g., the size of the hard drive and the amount of information on it. This expert desired to take a mirror image of the computer run it on his own equipment with his own software in his home office, perhaps even over night, or over the course of days, to obtain the information he desired.^[2]

The expert initially opined, without record evidence of the available government facilities, that he would be unable to use government facilities for his work. First, the equipment supplied by the government may be unsuitable; second, he was very reluctant to transport his equipment because he did not trust to leave it the possession of government officials; third: "I'm never able to do the same work that I can do outside of my office. . . . But I certainly can't offer the same level of expertise, or the use of tools." RT I 30; fourth, he could not work confidentially, by himself, or with other defense team members, if his worked was overseen by government officials; fifth, the cost to the defense client would be enhanced, perhaps greatly, enhanced, if the expert were compelled to travel, and do his work at government facilities; sixth, he could not work on other cases at the same time, i.e., computers in his home office can multi-task,

Prior to resumption of cross examination of Mr. Fischbach, FBI Agent Harris testified that the review facility was located in a" secure office complex at former McClellan Air Force Base. In the "review" section of the complex, the computers available included a Dell Optiplex GX260 with a processing speed of 2 gigahertz, a DDR SD — Ram of 1 gigabyte, drive docks, fire wire cards, and internet access. Software for computer forensic analysis included the standard FTK-1 and Encase. After the defense expert was finished, the hard drives could be erased so that any proprietary software or work product would not be available to the government. A defense expert could, nevertheless, bring in his or her own equipment, including laptops, RT III 40, which themselves could be secured in a locked case by the expert when not in use. Initially, Agent Harris testified that a government agent would have to be present in the room where the defense expert was working, RT II 12, but that requirement was later disavowed. RT III 20. The room was available during normal working hours, and at non-normal working hours upon request. RT II 19; III 36. A portion of the review room, or even a review room itself, could be reserved only for a particular defense expert, along with exclusive use of certain equipment. RT II 33-34,

Mr. Fischbach then testified why the government facilities were still inadequate. He might have to take out some information on a thumb drive for further analysis, and this information would have to be scrutinized by a government agent before he left. RT II 42, 46. He did not like the idea of a government agent looking "over his shoulder." He reiterated that he would not trust the government with his proprietary software. The expert could not be sure precisely what may be needed to be performed because he had not attempted any analysis at the government facility. RT II 60.

On re-cross examination, Mr. Fischbach conceded that the government computer hardware would be sufficient to perform his work. RT II 53. He conceded that the government had the standard software used in his field of work. RT II 54. However, for most of the reasons previously stated, he did not believe that he could accept further work in this case no matter what the particular protocol ordered to be followed at the McClellan facility. RT II 64.

Discussion

There appears to be no appellate court case dealing with the constitutionality of § 3509(m) or the issue of what is "ample opportunity" with respect to satisfying the due process investigation/preparation rights of a child pornography defendant. However, there are a multitude of district court cases. Not one case has thus far determined that § 3509(m) is facially unconstitutional. See United States v. O'Rourke, 470 F.Supp.2d 1049, 1055 (D.Ariz.2007); United States v. Knellinger, 471 F.Supp.2d 640, 644-645 (E.D.Va.2007); United States v. Renshaw, 2007 WL 710239 (S.D.Ohio 2007); United States v. Doane, 501 F.Supp.2d 897, 900-902 (E.D.Ky.2007); United States v. Sturm, 2007 WL 1453108 *6-*8 (D.Colo.2007); United States v. Battaglia, 2007 WL 1831108 (N.D.Oh.2007). All of these cases determined that § 3509(m) was at least consistent, if not coterminous with, due process. Sturm, supra at *7. Few could argue that a statute which gives the defense "ample opportunity" to perform its analyses is not on its face consistent with due process. The undersigned will not repeat their correct analyses insofar as Flinn does not expressly allege in his papers, or brief, any issue of facial unconstitutionality.

However, as noted above, Flinn makes the same argument indirectly, i.e., there are no significant number of cases where anything but a bit-by-bit mirror image of the seized drives taken off site will suffice to allow a defendant to prepare a defense. As is usually the case, one should not be able to accomplish indirectly what one could not accomplish directly.

All of the aforementioned cases agreed that allowing defense counsel "ample opportunity" to examine seized materials negatived constitutional concerns. However, one must define "ample opportunity" to give the terms constitutional substance. United States v, O'Rourke, supra, defined it with its ordinary dictionary definition, i.e., something more than adequate opportunity. Id at 470 F.Supp.2d at 1056. The undersigned takes no issue with this definition in the abstract; however, it is. not that helpful in a legal sense. The undersigned doubts that a defendant could ever claim his defense was prejudiced merely because he had an "adequate" opportunity to prepare his defense as opposed to an "ample" one. Rather, the definition should ``be keyed to the context of the examination itself. An ample opportunity to forensically examine seized computer items means an examination whereby the government can supply reasonably up-to-date tools (hardware and software) and facilities such that a defendant can construct a reasonable, available forensic defense, if one is available at all, and whereby the analysis will not be impeached because it was not supported by the proper hardware or software. An ample opportunity will permit a defense expert to utilize his or her hardware or software. An ample opportunity also requires that the analysis be performed in a situation where attorney-client privilege and work product will not be easily, accidentally exposed to the government, and in a facility which is open to the defense at its request during normal working hours, and to the extent feasible, during nonworking hours.

The defense has tailored its presentation with that set forth in United States v. Knellinger, supra. Although finding the statute constitutional on its face, this court found it unacceptable as applied given the testimony in that case. The defense witnesses told of geometrically increasing costs if analysis had to be performed at the government facility. Indeed, one witness said his fees would rise from $135,000 to over half a million dollars. Knellinger, 471 F.Supp.2d at 647. If true, at either price, that type of cost would doom almost any financially ordinary defendant. This witness also determined that he would not be able to confirm that his equipment in the government's facility would be working properly, and finally, that he would simply refuse to work on the case if compelled to perform his analysis out of his office environment. Id. Another expert witness said that he had never moved all of his office equipment to another location and if he did, the transport would be logistically onerous. Id. at 647-48. The court found that these impediments demonstrated that the government could not give "ample opportunity" at its facilities.

With due respect to Knellinger, the undersigned disagrees that the defense should be able to manipulate § 3509(m) by merely positing conceptual difficulties to be encountered at government facilities, or mere preferences to use their own. Knellinger sets a template for indirect repeal of § 3509(m). The witnesses expressed no concern which was specific to that case; all of the same concerns could be voiced in any case. The undersigned listened carefully to all testimony in this case and is convinced, at least for an initial analysis, that a competent examination can be made at government facilities. At the very least, nothing case specific was presented to establish the lack of ample opportunity. First, the witness here conceded that the computer hardware offered by the government was adequate, and the two basic software programs were the ones normally utilized. Perhaps because of proprietary reasons, or perhaps because there would be not much, if any, impediment to a prima facie examination, Mr. Fischbach never detailed precisely why his software could do the job where the government software could not. The undersigned notes from the testimony that Mr. Fischbach is presently conducting, or did so in the recent past, a computer forensic examination in a government facility in a case with national security concerns — with no apparent, significant examination impediments.

Moreover, the undersigned is convinced that he could structure an environment at the government facility where Mr. Fishbach's software and analyses could be adequately protected. The court will not presume that the FBI personnel in this case, or at the McClellan facility, lack integrity or otherwise harbor the intention to steal proprietary information or violate this court's orders in that respect. If Mr. Fischbach can be trusted to analyze data implicating national security, the FBI agents can be trusted not to interfere with, or steal work product from, Mr. Fischbach in this case.

The court remains cognizant of the financially devastating effect which can accrue from defending a criminal case against a government agency with great resources. And certainly, a defendant should be permitted access to tools which level the playing field somewhat. However, Flinn presented no evidence beyond "guesstimate" that the seemingly outrageous fees described in Knellinger would be applicable here. Nor has evidence been presented that if Mr. Fischbach refuses to forensically examine the hard drive and thumb drive at the McClellan facility, there is not an available, satisfactory expert who can and will — at a cost not greatly exceeding what might be incurred if the analyses were to be performed in a home or office environment. While a defendant is entitled to a defense which comports with due process, he is not entitled to the "best defense money can buy." See Sturm, supra: the fact that some extra cost will be incurred because of § 3509(m) was surely something that Congress considered. Nor is the defense entitled to an expert who simply refuses to even try to conduct his examination under Congressionally prescribed standards.

In sum, the undersigned finds that the McClellan facility offers an "ample opportunity" to perform at least the initial examination which, in all probability, will inform the defendant whether he has a supportable defense or not. In the event that Flinn can offer case specific reasons why a further off-site examination must take place, the court will consider any such request.

In the event Flinn, through his expert, chooses to examine the computer drives at McClellan, the following protections are ordered:

1. His expert will be given private space at the McClellan facility, i.e., a space where he can conduct analyses of his choosing without purposeful or otherwise direct surveillance of those activities;

2. The expert will be given the hardware and software described as available at the McClellan facility at evidentiary hearing, or the expert will be permitted to bring his own items with which he desires to conduct the examination/analyses;

3. The expert will be given access to the facility upon his request for normal work hours; every effort will be made to accommodate access during non-normal work hours if such is requested;

4. With the exception of materials which would be considered child pornography under federal law, the expert may take off site that electronic or electronically derived information necessary for his examination or report; the expert will certify in writing that he has taken no materials which would be considered child pornography under federal law, and that he has not caused any such child pornography to be sent off site;^[3]

5. With the exception of a defense expert failing to so certify, no government official, or any person connected with the government, shall examine or acquire in any fashion any of the items used by the expert in order to conduct the defense analyses. In the event that a defense witness fails to certify that his items/materials/information to be taken off site do not contain child pornography, government officials may inspect or examine the items/material/information in order to ensure that prohibited child pornography has not been removed;

6. Under no circumstances, shall the defendant or his attorney remove from the government facility any items/material/information utilized in the analyses or derived from the analyses.

Conclusion

One could reasonably argue that § 3509(m) is legislation by anecdote, and is an overreaction to an infrequent problem, the burdens of which outweigh the possible benefits. However, Congress gets to make its judgments on less than empirically perfect data. Except in the most arbitrary situations, concerns about the wisdom of legislation are to be raised before Congress.

The defense motion for a mirror image of the seized hard drive and thumb drive to be taken outside of a government facility is denied. Access by defense personnel to a mirror image of the seized drives shall take place at the McClellan facility pursuant to the terms of this order.

NOTES

[1] Formerly McClellan Air Force Base, Sacramento, California.

[2] At one point it appeared that the expert would be satisfied if the government deleted child pornographic images off a "mirror image," such that he could take away and analyze the hard drive/thumb drive for his purposes which did not require the viewing of pornography images. However, after initial promise, this "settlement" effort failed because the government did not believe that it could guarantee that all child pornographic images had been deleted and/or, the time to do so would be inordinate. Evidently, a computer's hard drive has more hidden nooks and crannies than the Winchester Mystery House. And child pornography, once placed on a hard drive, can infiltrate those nooks and crannies even without the conscious knowledge of a computer operator. See United States v. Ziegler, 497 F.3d 890 (9th Cir.2007) (finding that the mere visitation of a child porn website may result in digital images being retained in cache files for some time without the knowledge of the computer operator).

[3] Virtual child pornography or adult pornography shall not be removed unless the expert could testify with reasonable certainty that the pornography to be removed would not be encompassed within federal child pornography law.