United States v. Kim

677 F. Supp. 2d 930 (2009)

UNITED STATES of America
v.
Steven Jinwoo KIM.

Criminal No. H-09-302.

United States District Court, S.D. Texas, Houston Division.

December 23, 2009.

Bret W. Davis, Financial Litigation, Office of U.S. Attorney, U.S. Marshal, U.S. Pretrial Svcs., U.S. Probation, Houston, TX, for Plaintiff.

ORDER

VANESSA D. GILMORE, District Judge.

I.

A.

Defendant Steven Jinwoo Kim ("Defendant" or "Kim") brings the instant Second Amended Motion to Suppress Evidence. (Instrument No. 65). Defendant alleges that the issuance of a warrant and the subsequent search and seizure of items from his residence violated his rights under the Fourth Amendment to the Constitution of the United States of America. (Id., at 4). A hearing was held on Defendant's Motion on November 3, 2009. Both sides presented evidence. Having considered the evidence in this case and the applicable law, the Court makes the following findings.

B.

Defendant was employed by GEXA Energy ("GEXA") as a Senior Database Administrator from May 22, 2006 until February 5, 2008. GEXA is a subsidiary of Florida Power and Light Group ("FPL"). GEXA is a Retail Electric Provider ("REP") and maintains the GEXA Energy Management System ("GEMS") Application and Database. GEMS houses the customer and billing information of GEXA's customers in Houston, Texas. (Instrument No. 65-2, at 8).

Defendant was responsible for maintaining the GEMS database. As part of his duties, he had administrative rights and passwords to access to' the GEMS system. (Id., at 9). Defendant was suspended from employment on January 17, 2008. After his suspension, Defendant was no longer authorized to access the GEXA network or the GEMS database. (Id.).

On or about May 2, 2008, the Director of Security for FPL advised United States Secret Service ("USSS") agents "that an individual, without authorization, accessed the private ``GEXA Energy' computing network system in Houston, Texas." (Id., at 8). On May 6, 2008, Sergio O. Guzman, a forensic investigator for the FPL group, advised USSS agents that between April 28, 2008 and May 1, 2008, while GEXA was going through an annual audit, the company discovered "several unauthorized attempts to access the GEXA computing network, via Virtual Private Network (VPN)." GEXA told the USSS agents that the nature of the unauthorized access appeared to be directed at obtaining access and compromising the integrity and availability of the GEMS Application Database. (Id., at 8-9).

On June 2, 2008, the Government applied for a search warrant based on information that had been provided. Special Agent Jimmy Mance ("Mance" or "Agent Mance") submitted his Affidavit in Support of the Application for Search Warrant. (Instrument No. 65-2). In the affidavit, Agent Mance stated that on. August 16, 2007, Kim and other GEXA employees learned that the GEMS database could be corrupted if large amounts of data were loaded onto the system. He alleged that Kim received an e-mail regarding these concerns on August 28, 2007. (Id., at 9). Agent Mance contended that, on October 24, 2007, Kim demonstrated his expertise of the GEMS database system in an e-mail directed to the GEXA database developer. (Id.). Mance asserted that Kim was suspended on January 17, 2008, pending a Human Resources Investigation. During this period of suspension, Mance stated that Kim no longer had access to the GEXA building, the GEXA network, or the GEMS database. (Id., at 10).

In the affidavit, Mance alleged that the GEXA Virtual Private Network ("VPN") logs reflected that from January 17, 2008 through February 5, 2008, during Kim's suspension, the Internet Protocol ("IP") address of 75.53.99.76 made twelve failed log-in attempts to gain access to the GEXA VPN network; two failed login attempts through the GEXA general administrator account; and one failed login attempt using another general administrator account. (Id.). Mance contended that, throughout these dates, that particular IP address was assigned to Kim at his known address. (Id.).

Agent Mance further alleged that on February 17, 2008, two intrusion attempts were made from a different IP address, 76.199.75.170. Mance contended that although the first attempt was unsuccessful, the second attempt succeeded in gaining access to the GEXA network system. (Id., at 11). This second IP address allegedly belonged to Defendant Kim during the time that he was employed with the company. (Id.).

Mance further asserted that several subsequent attempts to access and modify the database were made from a third IP address, 76.199.73.177. (Id., at 11-14). On May 1, 2008, the logs reflected that this third IP address viewed the usernames and encrypted passwords of all GEMS database users. (Id., at 13). Based on information obtained from the internet service provider, Mance alleged that this third IP address belonged to Kim at his residential address. (Id., at 14).

Agent Mance stated that, based on his experience, individuals who participate in fraud and related activity in connection with computers often maintain computer records, paper notes, and other electronic media at their residence related to the fraud or related activity within 18 U.S.C. § 1030. (Id.).

In the affidavit, Agent Mance requested that the Government issue a search warrant for Kim's property and he specifically described the property. The search warrant requested that the Government be permitted to seize items from Kim's residence. These items included: "all computer hardware; software; related computer devices; and any items obtained as a result of fraud and related activity in connection with computers." (Id., at 7). Mance stated in the affidavit that the investigation concerned the violation of 18 U.S.C. § 1030 (Computer Intrusion). The affidavit also included an outline of the elements of the violation. (Id., at 7). Agent Mance asserted that probable cause arose from the FPL Director of Security's accusation that an individual attempted to access the company's private GEXA network without authorization. (Id., at 8).

On June 2, 2008, United States Magistrate Judge Stephen W. Smith issued a search warrant for evidence in support of the suspected violation of 18 U.S.C. § 1030. The warrant was to be executed at the residence of Steven Jinwoo Kim ("Kim" or "Defendant"). (Instrument No. 31, at 1). The warrant authorized the seizure of hard data and information and/or data stored in the form of magnetic or electronic coding on computer media or media capable of being read by a computer or with the aid of computer-related equipment. (Instrument No. 65-2, at 18-19). The warrant also authorized the seizure of computer hardware, software, computer related documentation, computer passwords and data security devices. (Id., at 18-20). The Government was authorized to access information relating to any records or documents that refer to or relate to GEXA or GEMS. (Id., at 18). The Government could also access any records of personal and business activities relating to the operation of a computer, such as telephone records, notes, books, diaries, and reference materials, including evidence in photographic form. (Id.). Based on the search warrant, the Government seized several external hard drives, laptop and desktop computers, and brought them back to a forensic laboratory for forensically imaged analysis. (Instrument No. 36, at 2).

The Government alleges that from June 3, 2008 through January 24, 2009, the examiners searched for evidence of Computer Intrusion. (Id.). On June 6, 2008, while searching Defendant's electronic files and folders on his hard drive, the examiners came across encrypted files and folders. (Instrument No. 31, at 2). These files were allegedly labeled, "Forbidden-Fruit," "Illegal_Loli###," "Loli###," and other similar names. (Instrument No. 65-3, at 13). The Government believed that these names were suggestive of child pornography. (Id.).

On June 13, 2008, the Government applied for a warrant targeting potential child pornography in the encrypted folders. In the affidavit in support of the search warrant, Agent Mance alleged that there was probable cause to believe that Kim violated 18 U.S.C. 2252A, possession of child pornography. Mance stated that computerized depictions of child pornography are often stored as Joint Photographic Experts Group ("JPEG") files. (Id., at 7). Mance contended that people who possess child pornography "go to great lengths to conceal and protect" their collection from discovery through the use of passwords or encrypted files on their computer. (Id., at 12). Agent Mance maintained that probable cause existed based on the names of the file folders. (Id., at 13). He also stated that the files within the folder were encrypted with "CryptaPix" software, which "is designed to secure digital photos or image files from unauthorized access." (Id.).

Judge Smith denied the Government's application for a search warrant targeting potential evidence of child pornography in the encrypted folders, reasoning that the file names were not necessarily indicative of child pornography. (Instrument No. 31, at 2; Instrument No. 36, at 3).

Despite the ruling of the Magistrate Judge, the Government spent two months decrypting the files on the computer. Later, the Government decoded the encrypted files and allegedly discovered over eight hundred and forty child pornography images. (Instrument No. 42, at 3). The Government states that subsequent examination revealed digital evidence of Computer Intrusion. (Id.).

C.

On June 3, 2009, Steven Jinwoo Kim was named in a three count indictment for Computer Intrusion, Possession of Child Pornography, and Aggravated Identity Theft. (Instrument No. 1). In Count One of the indictment, the Government alleged that Defendant committed Computer Intrusion by violating 18 U.S.C. § 1030(a)(5)(A)(i) and (c)(4)(A). The Government asserted that Defendant knowingly caused the transmission of a program, information, code and command, and, as a result, intentionally caused damage without authorization to the protected computers of GEXA's network system. (Id., at 1). The Government stated that the computers were used in interstate commerce and communication. The Government alleged that Defendant caused damage by entering codes and commands that attempted to inject a database table into the GEMS database. (Id.). This conduct, the Government asserted, caused GEXA to incur a loss amount over $5,000 from April 2008 through May 2008. (Id.).

In Count Two of the indictment, the Government alleged that Defendant possessed child pornography in violation of 18 U.S.C. §§§ 2252A(a)(5)(B), 2252A(b)(2) and 2256(8)(A). (Id., at 2). The Government contended that Defendant knowingly possessed materials that contained multiple images of child pornography. The Government alleged that the images were transported in interstate and foreign commerce, by any means, including computer. (Id.) Specifically, the Government asserted that Defendant "possessed an Aspire desktop computer, serial number XXXXXXXXX, having a Maxtor 200.0 GB hard drive which contained still images of child pornography." (Id.).

In Count Three of the indictment, the Government alleged that Defendant committed aggravated identity theft in violation of 18 U.S.C. § 1028(A)(a)(1) and (c)(4). (Instrument No. 1, at 2). In support of this contention, the Government asserted that Defendant, during and in relation to a violation of 18 U.S.C. § 1030, "knowingly transferred, possessed, and used, without lawful authority, a means of identification of another person." (Id.). The Government stated that Defendant transferred, possessed, and used the GEXA customer and billing database within GEMS. This database, the Government asserted, contained names, addresses, and drivers license numbers. (Id.).

On June 29, 2009, Defendant filed a Motion to Suppress the Evidence. (Instrument No. 15). Defendant filed his First Amended Motion to Suppress the Evidence on August 17, 2009. (Instrument No. 31). In his First Amended Motion, Defendant sought suppression of all of the evidence obtained from the execution of the warrant. (Id., at 3). He argued that the issuance of the warrant and the search of his residence violated his rights under the Fourth Amendment of the Constitution. (Id.). Defendant argued that the affidavit in support of the search warrant did not contain any indications of the reliability of the source of the information and that the search warrant was overly broad and insufficiently specific as to the scope of the search. (Id., at 4). Defendant also argued that if the Court finds that the warrant was valid, the files alleged to contain evidence of child pornography should be suppressed. (Id.). Defendant argued that the files "were not ``in plain view.'" (Id., at 2). These files, Defendant contended, were encrypted in a way that caused the Government to take several days to open the files, despite clear indications that the files did not contain evidence relating to the purpose of the search warrant. (Id.). Defendant asserted that it was not reasonable for the Government to search the encrypted files with the expectation of finding evidence of Computer Intrusion. (Id., at 2-3).

On September 3, 2009, the Government responded to Defendant's First Amended Motion to Suppress. (Instrument No. 36). The Government contends that the alleged evidence of child pornography was contraband discovered in plain view during the Government's valid search for digital evidence of Computer Intrusion. (Id., at 3). The Government asserts that files and folders contained as digital evidence on a hard drive are entitled to the same Fourth Amendment analysis as a filing cabinet containing documents and records. The Government asserts that it is unreasonable to limit an evidentiary search of computer files based upon the Defendant's self-labeling of the file. (Id., at 7).

Additionally, the Government states that to search a container, it must be reasonable to expect that the items discussed in the search warrant could be found in said container. (Id.). The Government argues that it was not unreasonable to believe that documentation relating to Computer Intrusion could be located inside of the encrypted files. (Id.). The Government further asserts that agents sought a search warrant to uncover the images of child pornography out of an abundance of caution. The Government maintains that, even after the search warrant was denied, they continued attempting to decode the encrypted files in an effort to uncover evidence related to Computer Intrusion. (Id., at 11-12).

Finally, the Government argues that the search warrant did not lack particularity and was not overly broad. The Government states that "[w]hen agents cannot know the precise form that records will take before the search occurs, a generic description must suffice." (Id., at 13). The Government contends that the Court should examine the substance of the evidence and the agent's reasonable construction of the description when determining the particularity of the warrant. Here, the Government argues, the executing agents demonstrated the warrant's particularity by only obtaining evidence from Defendant's home that could reasonably contain digital evidence of computer intrusion. (Id., at 14). The Government argues that, for the above reasons, the Court should deny Defendant's Motion to Suppress. (Id., at 14-15).

On September 10, 2009, Defendant filed a Memorandum in Support of his First Amended Motion to Suppress Evidence. (Instrument No. 39). In the Memorandum, Defendant reasserted the arguments from his First Amended Motion to Suppress the Evidence. Defendant also argued that Agent Mance's affidavit supporting the Government's request for a search warrant for evidence of child pornography illustrates that the Government believed that the encrypted files contained evidence of child pornography when they decided to decode the files. (Id., at 3-4).

Defendant further argued that the files were not discovered in plain view during the search for evidence of Computer Intrusion. He stated that the Government's agents spent significant time trying to decode the files after they were denied the search warrant. (Id., at 5). Defendant also reiterated his contention that there were multiple indications that the encrypted files did not contain evidence of Computer Intrusion. (Id.).

On September 23, 2009, the Government filed a Superseding Indictment. (Instrument No. 43). Under the first count of this indictment, Defendant is charged with Computer Intrusion under 18 U.S.C. §§§ 1030(a)(5)(A)(i), 1030(a)(5)(B)(i), 1030(b), 1030(c)(4)(A), and 2. The Government states that Defendant did knowingly cause and attempted to cause "the transmission of a command that impaired, altered, and modified the GEXA Energy database tables and files." (Id., at 1). As a result of that conduct, the Government alleges, Defendant "intentionally caused and attempted to cause damage, without authorization, to computers belonging to, and used in interstate commerce and communication by GEXA Energy ..." The Government charges that Defendant's actions resulted in an aggregate loss to GEXA Energy of at least five thousand dollars during a one year period. (Id.).

Under Count Two of the Superceding Indictment, Defendant is charged with Possession of Child Pornography in violation of 18 U.S.C. §§§ 2252(a)(5)(B), 2252A(b)(2), and 2256(8)(A). (Id., at 1-2). In support of this contention, the Government alleges that Defendant "knowingly possessed materials that contained multiple images of child pornography" that were shipped and transported in interstate and foreign commerce, by any means including by computer, or that were produced using materials that had been mailed, shipped and transported in interstate and foreign commerce, by any means including by computer. (Id., at 2). Specifically, the Government asserts that Defendant possessed a desktop computer that "contained still images of child pornography." (Id.).

In Count Three of the Superceding Indictment, Defendant was charged with Aggravated Identity Theft in violation of 18 U.S.C. § 1028(a)(1) and (c)(4). (Id.). The Government alleged that Defendant, during and in relation to the activity described in Count One, "knowingly transferred, possessed, and used, without lawful authority, a means of identification of another person, specifically, names, drivers license numbers and social security numbers of GEXA Energy customers." (Id.). This information, the Government states, was "contained within the GEMS database." (Id.).

On November 2, 2009, Defendant filed a Second Amended Motion to Suppress. (Instrument No. 65). This Second Amended Motion alleges essentially the same claims as the First Amended Motion. However, Defendant does add additional arguments in support of his claims that the warrant is facially deficient and therefore all of the evidence obtained from its execution should be suppressed. (Id., at 4). In the Second Amended Motion, Defendant lists six grounds for suppression. First, the Defendant reasserts his argument that the affidavit does not contain sufficient information about the reliability of the source of the information. (Id.). Second, Defendant claims that the affidavit contains material and false statements that Agent Mance fails to attribute to a reliable source. (Id.). Third, Defendant asserts that the affidavit does not provide facts that establish probable cause. (Id., at 4-5). Fourth, Defendant contends that the affidavit is insufficiently specific as to the scope of the search. Fifth, Defendant argues that the search warrant is overly broad and constitutes a general warrant which is prohibited under the Fourth Amendment. (Id., at 5). Finally, Defendant asserts that, if the Court finds the search warrant valid, the evidence obtained from the encrypted files exceeded the permissible scope of the warrant and should be suppressed. (Id.).

II.

A.

First, the Court will address Ground One of Defendant's Second Amended Motion to Suppress. Defendant moves to suppress all of the evidence obtained from the search warrant on the ground that the warrant did not contain indications as to the reliability of the source of the information. (Instrument No. 65, at 4). Defendant argues that his effort to secure the search warrant, Agent Mance merely stated, "Affiant is aware," "Affiant knows," and "Affiant was advised," without providing the source of much of his information. (Instrument No. 65, at 6). Where Agent Mance did indicate the sources of his information, Defendant argues that Mance did not evaluate the reliability, background, or qualifications of those sources. Defendant also asserts that Mance stated in the affidavit that he had received information from GEXA without discussing how, or from whom, he obtained the information. (Id., at 7).

At the hearing on November 2, 2009 Agent Stergios Symeonidis ("Symeonidis" or "Agent Symeonidis"), who worked with Agent Mance in preparing the affidavit, testified that the USSS received information from GEXA that someone had intruded into their system. They were able to verify that the IP addresses that attempted to intrude into the GEXA system belonged to Defendant. Symeonidis testified that GEXA told the USSS that Kim possessed a fluent knowledge of the computer system and that Kim knew certain key strokes could crash the GEXA system. On cross examination, Symeonidis stated that he and Agent Mance did not attempt to verify the validity of the information they received from GEXA or GEXA employees. Symeonidis also admitted that the individuals he talked with, including Guzman, were not database administrators. Symeonidis acknowledged that he and Agent Mance were not aware of these individual's areas of expertise at the time that they requested the search warrant.

The Magistrate Judge who issues the search warrant has the task of making a decision whether, "given the circumstances set forth in the affidavit before him, including the ``veracity' and ``basis of knowledge' of persons supplying hearsay information, there is a fair probability that contraband or evidence of a crime will be found in a particular place." Illinois v. Gates, 462 U.S. 213, 238, 103 S. Ct. 2317, 76 L. Ed. 2d 527 (1983). The reviewing court simply has the duty to "ensure that the magistrate had a ``substantial basis for ... conclud[ing]' that probable cause existed." Id., at 238-39, 103 S. Ct. 2317 (citing Jones v. United States, 362 U.S. 257, 271, 80 S. Ct. 725, 4 L. Ed. 2d 697 (1960)). The Supreme Court upheld a "totality-of-the-circumstances analysis" to determine whether probable cause existed. Gates, 462 U.S. at 239, 103 S. Ct. 2317. Defendant cites a case from the Eastern District of Texas which states, in a footnote, that "... judicial officers should scrutinize information presented in support of warrant applications and guard against ``rubber stamping' conclusory statements if offered without adequate and specific factual support." Matter of Search and Seizure of Shivers, No. 1:92-M-148, 1995 WL 293188, *2 n. 5 (E.D.Tex. May 8, 1995). However, the Fifth Circuit has stated that where affidavits describe an investigation, those affidavits are typically sufficient to establish probable cause. U.S. v. Perez, 484 F.3d 735, 740 (5th Cir.2007). This is especially true where the probable cause is strengthened with additional facts, such as an IP address associated with a particular address. Id. In Perez, the Fifth Circuit held that where the Government presented evidence that child pornography had been transmitted over a particular IP address that was assigned to the Defendant at his home address, "it remained likely that the source of the transmissions were inside of that residence." Perez, 484 F.3d at 740. The court reasoned that probable cause did not require proof beyond a reasonable doubt. Id.

Similarly, in this case, the Government presented evidence that particular IP addresses attempted to access the GEMS database, and that those IP addresses belonged to Defendant at his residence. (Instrument No. 65-2, at 10-11). Agent Mance obtained the IP addresses through an analysis of the VPN logs. (Id., at 10-13). He discovered that the IP addresses belonged to Defendant at his physical address through a subpoena served on AT & T Internet Services. (Id., at 13-14). Agent Mance also found that the physical address belonged to Kim through a search of the Texas Department of Public Safety database. (Id., at 14). This data illustrates that Mance did investigate whether Kim attempted to access the GEXA database. Agent Mance presented this data in his affidavit. (Id., at 10-14). The Supreme Court has held that an officer's affidavit must make clear that there is some connection between the items seized and the criminal activity being investigated. Warden v. Hayden, 387 U.S. 294, 302, 87 S. Ct. 1642, 18 L. Ed. 2d 782 (1967). The Court finds that the evidence presented in the affidavit that an IP address registered to Kim, at his residence, attempted to access the GEXA system sufficiently establishes that there was a "fair probability that contraband or evidence" of this act would be found at Kim's residence. See Gates, 462 U.S. at 238, 103 S. Ct. 2317.

For the reasons Set forth above, the Court DENIES Defendant's Second Amended Motion to Suppress on the ground that the warrant did not contain reliability as to the source of the information.

B.

In Ground Two of Defendant's Second Amended Motion to Suppress, Defendant argues that the warrant contains material and false statements. Although the affidavit supporting the warrant states that certain key strokes could change and cause harm to the GEXA database, Defendant argues that these statements are untrue. Kim asserts that the warrant is invalid because Agent Mance submitted the affidavit without concern for the accuracy of the information it contained. (Instrument No. 65, at 7).

In order to prevail in this argument, Defendant must make a substantial preliminary showing that Agent Mance made the disputed statements knowingly or with reckless disregard for the truth. U.S. v. Looney, 532 F.3d 392, 394 (5th Cir.2008). In Looney, the district court found that the Defendant did not prove that an officer "had acted deliberately or with reckless disregard for the truth ..." through an examination of his testimony. The court wrote that the officer's "``testimony and his forthright and honest demeanor on cross examination'" as well as his "testimony regarding his intentions" was credible. Based on this analysis, the Fifth Circuit upheld the district court's finding that the officer had not acted knowingly or with reckless disregard for the truth. Id., at 395.

In this case, the Court finds that Agent Symeonidis testified with a forthright and honest demeanor on cross-examination that he was not aware that the information relied upon in the warrant was false or misleading. Agent Symeonidis testified that he and Agent Mance obtained the information that certain key strokes could change and cause harm to the GEXA database through discussions with GEXA employees. Although they did not do further research into these employee's backgrounds to determine their expertise in the area, and did not do independent research to determine whether or not the key strokes could actually cause damage to the system, Mance's affidavit and Symeonidis's testimony indicate that the agents were not aware that the information was or could have been false. The Court finds that Defendant has not presented any evidence that, even if the disputed information was false, Agent Mance made the assertion "knowingly or with reckless disregard for the truth." Id., at 394. Therefore, the Court DENIES Defendant's Second Amended Motion to Suppress on the second ground, that the warrant contained material and false statements.

C.

Defendant also argues that Mance's affidavit does not provide facts establishing probable cause that a crime has occurred. Defendant asserts that the affidavit merely provides the statutory provision that Defendant is suspected of violating without describing how the facts satisfy the elements. (Instrument No. 65, at 9). Kim states that Mance's affidavit does not provide evidence establishing damage, fraud, or that the computer accessed was used in interstate commerce. (Id.). Defendant maintains that each of those elements is necessary to establish the crime of Computer Intrusion pursuant to 18 U.S.C. § 1030. (Id.).

The crime in this case allegedly occurred between April 30, 2008 and May 1, 2008. Therefore, Defendant was charged under the version of 18 U.S.C. § 1030 that was in effect during that time period. The affidavit in support of the application for the search warrant requests the search warrant for alleged violations of 18 U.S.C. §§ 1030(a)(5)(A)(i) and (a)(5)(B). The relevant portions of the statute state that:

whoever ... knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization to a protected computer ... and caused (or in the case of an attempted offense, would, if completed, have caused) loss to 1 or more persons during any 1-year period ... aggregating at least $5,000 in value ...

has violated the statute. 18 U.S.C. 1030(a)(5)(A)(i); (a)(5)(B). A "protected computer" is defined as a computer "used in interstate or foreign commerce or communication." 18 U.S.C. § 1030(e)(2)(B).

Here, Agent Mance's affidavit does present evidence that the Defendant repeatedly attempted to gain unauthorized access to the GEMS database. (Instrument No. 65-2, 9). In the affidavit, Mance stated that many unauthorized log in attempts were made from several IP addresses that belonged to Kim. (Id., at 10-14). The affidavit also presents evidence that Kim received an e-mail advising him that loading large amounts of information to the database could corrupt the system. (Id., at 9). Although the affidavit does not present evidence of a loss to one or more persons, the Court finds that the affidavit does present evidence of an attempted offense that could potentially have caused a loss to one or more persons.

Defendant also argues that the Government does not present evidence that the computer was used in interstate commerce. Although the affidavit does not specifically allege that the Defendant's computer was used in interstate commerce, at the hearing on the Kim's Second Amended Motion to Suppress the Evidence, the Government explained that ``Mance did allege in the affidavit that FPL, GEXA's parent company, is a foreign corporation with its principle place of business in Florida. (Id., at 8). Additionally, the Government alleged that the affidavit states that the alleged crime occurred over the internet and that the internet is considered a means of interstate commerce.

The Fifth Circuit has held that transmitting information via the internet constitutes interstate commerce. United States v. Barlow, 568 F.3d 215, 220-21 (5th Cir. 2009) (internet and e-mail are facilities or means of interstate commerce) (citing United States v. Runyan, 290 F.3d 223, 239 (5th Cir.2002)). In this case, Agent Mance alleged in the affidavit that the crime took place over the internet and the Government's evidence was based on Kim's attempts to log onto the GEXA computer network through various IP, or internet protocol, addresses. (Instrument No. 65-2, at 10-14). Therefore, the Court finds that the affidavit sufficiently alleged that the computer was used in interstate commerce. Accordingly, the Court DENIES Defendant's Second Amended Motion to Dismiss on Ground Three.

D.

Defendant also moves to suppress all of the evidence arising out of the execution of the search warrant because, he argues, the search warrant was insufficiently specific and overly broad as to the scope of the search. (Instrument No. 65, at 9). The search warrant authorized the search of "[a]ny records or documents that refer to or relate to GEXA Energy or GEMS" and "[a]ny records of personal and business activities relating to the operation of a computer, such as telephone records, notes (however and wherever written, stored or maintained) books, diaries and reference materials." (Instrument No. 65-2, at 18). Defendant contends that this language did not give the owner of the property a "reasonable understanding of the focus and authorized expanse of the search." (Instrument No. 65, at 9).

Defendant argues that a search warrant requires a level of specificity such that nothing is left to the discretion of the officers executing the warrant. (Instrument No. 65, at 10) (citing Marron v. United States, 275 U.S. 192, 48 S. Ct. 74, 72 L. Ed. 231 (1927); Stanford v. Texas, 379 U.S. 476, 485, 85 S. Ct. 506, 13 L. Ed. 2d 431 (1965); Andresen v. Maryland, 427 U.S. 463, 480, 96 S. Ct. 2737, 49 L. Ed. 2d 627 (1976)). Defendant asserts that the affidavit did not contain limiting dates or a reference to statutes or criminal conduct. (Instrument No. 65, at 12). Kim contends that, "if a warrant permits a search of all computer records without a description or limitation, it does not meet the particularity requirement of the Fourth Amendment." (Id.) (citing United States v. Leary, 846 F.2d 592, 601 (10th Cir.1988)).

Additionally, Defendant argues that the warrant was overly broad. The Government has alleged that the search warrant gave the agents authorization to search the encrypted files. (Instrument No. 65, at 9). Defendant responds that the Government's argument illustrates that the warrant was overly broad because the agents' interpretation of the broad language resulted in their perception that the Government had "carte blanche" authority to search any and all records present on Defendant's computer. (Id.).

The Government acknowledges that the search warrant did not specifically describe the items to be seized. The Government asserts, however, that when agents cannot know the precise form that records will take before the search occurs, a generic description will suffice. Here, the Government contends, a precise description of the files to be searched was not possible. (Instrument No. 42, at 17).

In order to comply with the Fourth Amendment, a search warrant must describe the items to be seized with sufficient particularity. The officer executing the search warrant should not be left with discretion to decide which items may be seized. Marron v. United States, 275 U.S. 192, 196, 48 S. Ct. 74, 72 L. Ed. 231 (1927). However, where detailed particularity is impossible, generic language suffices if it particularizes the types of items to be seized. Williams v. Kunze, 806 F.2d 594, 598 (5th Cir.1986). United States v. Webster, 734 F.2d 1048, 1055 (5th Cir. 1984). An "all records" search at a residence requires closer scrutiny than an "all records" search of a business. United States v. Humphrey, 104 F.3d 65, 68 (5th Cir.1997).

In Humphrey, the defendants operated a loan brokerage service scheme from their residence and did not maintain bank accounts. Id., at 67. The search warrant authorized the seizure of all documents related to financial transactions, relationships with financial institutions, transactions at banks, and information related to the use of credit cards. The warrant also authorized the seizure of computer storage devices which "could be used to store information regarding customer files and banking information." Id., at 69 n. 1. The court, however, cautioned that the holding was not a broad authorization for the issuance for "all records" searches of homes. The court stated that the holding only applied to extreme cases. Id., at 70. The Fifth Circuit found that the search warrant was valid where the nature of the fraud was pervasive, there was considerable overlap of the Defendants' business and personal lives, and the warrant limited the search to records pertaining to financial transactions. Id., at 68.

Similarly, in this case, there was considerable overlap of Defendant's business and personal lives. The Court finds that the seizure of computer files at Kim's residence was justified because the IP addresses involved in the alleged Computer Intrusion originated from his home address. (Instrument No. 65-2, at 10-14). Also, as in Humphrey, the warrant in this case limited the search to documents that related to the alleged crime of Computer Intrusion. While the warrant did not provide specific dates, the warrant did provide some specificity as to the types of information that the Government could search for. The warrant provided that the Government could search for items relating to GEXA Energy or GEMS or any records of personal and business activities relating to the operation of a computer. (Id.., at 18). The Defendant's expert witness, David McGrody ("McGrody"), testified that a search limited to the dates of the alleged offense was possible and simple to perform. The evidence presented by the Government indicates that the Government did not perform a date limited search. However, the Court finds, despite the fact that the warrant did not provide for a search between specific dates, the limitation that the Government could only search for times related to GEXA Energy, GEMS, or the operation of a computer, described the items to be seized with sufficient particularity and was not overly broad. Therefore, the Court DENIES Defendant's Motion to Suppress on Grounds Four and Five.

E.

Finally, Defendant argues that if the Court does not find the original warrant facially insufficient, the Government's search of the encrypted files allegedly containing child pornography exceeded the permissible scope of the search authorized by the warrant.

Defendant first analyzes the reasonableness of the Government's actions. Defendant argues that the Fourth Amendment guarantees "[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures." Instrument No. 39, at 13 (citing U.S. Const. amend. IV). Defendant contends that the Government acted unreasonably after the magistrate denied their application for a search warrant to open the encrypted files. (Instrument No. 39, at 13). Kim argues that the Government could not have reasonably believed that the encrypted files contained evidence of computer intrusion. Defendant states that the Government's request for a search warrant looking for information specifically related to child pornography, and the accompanying affidavit, illustrate that the Government believed that the files contained evidence of child pornography. Defendant asserts that, in the affidavit supporting the application for a search warrant of the encrypted files, Agent Mance did not mention that the Government thought the encrypted files could contain information related to the charge of Computer Intrusion. (Id.).

The Government argues that the agents discovered the evidence of child pornography in plain view during a valid search for evidence related to Computer Intrusion. The Government contends that the agents reasonably believed that the files contained evidence of Computer Intrusion when they began decoding the files. (Instrument No. 42, at 6-8).

1.

Under the plain view doctrine, law enforcement may make a warrantless seizure when they are legitimately on the premises, discover evidence, fruits or instrumentalities of crime, or contraband and see such evidence in plain view. Law enforcement officers must also have probable cause to believe that the item is evidence, contraband or a fruit or instrumentality of crime. Arizona v. Hicks, 480 U.S. 321, 107 S. Ct. 1149, 94 L. Ed. 2d 347 (1987). There is no requirement that the evidence be discovered inadvertently. Horton v. California, 496 U.S. 128, 110 S. Ct. 2301, 110 L. Ed. 2d 112 (1990). In other words, the plain view doctrine justifies a seizure if the officers were lawfully in an area where the items could be plainly viewed, the incriminating nature of the items was immediately apparent, and the officers had a lawful right of access to the items. United States v. Waldrop, 404 F.3d 365, 368 (5th Cir.2005).

Defendant argues that Fifth Circuit precedent related to the plain view doctrine and searches of closed containers informs the evaluation of this case. (Instrument No. 65, at 19). In United States v. Villarreal, 963 F.2d 770, 776 (5th Cir. 1992), the Fifth Circuit found that labels attached to "opaque 55-gallon drums do not expose the contents of the drums to plain view." Although the items were placed in opaque containers, the court wrote that individuals still maintain legitimate expectations of privacy. Villarreal, 963 F.2d at 773 (citing United States v. Ross, 456 U.S. 798, 823, 102 S. Ct. 2157, 72 L. Ed. 2d 572 (1982)). The court stated, a "label on a container is not an invitation to search it. If the government seeks to learn more than the label reveals by opening the container, it generally must obtain a search warrant." Villarreal, 963 F.2d at 776. Therefore, the court held that the warrantless search was invalid. Defendant argues that, similarly, the labels on the files were not invitations for government agents to search the encrypted folders. (Instrument No. 65, at 19).

The encrypted files in this case are similar to an opaque container. The materials within the container are not immediately visible to onlookers. Agents can only view the evidence inside of the containers upon the expenditure of additional effort. Under the Villarreal reasoning, the Government would not have been permitted to search the encrypted files in a warrantless search. While the Government did attempt to obtain a warrant to search the encrypted folders (Instrument No. 65-3), this request was denied. However, the issue in this case is not that the Government discovered the files in plain view pursuant to a warrantless search; rather the issue is whether the Government's warrant to search for evidence related to computer intrusion allowed the Government's agents to decode and search the encrypted files.

2.

Both Defendant and the Government agree that neither the Fifth Circuit nor the United States Supreme Court have developed precedent specifically addressing the scope of a search for digital evidence. They both agree that the Ninth Circuit has the most robust body of law on the subject matter and base their arguments on Ninth Circuit precedent. The Court will examine the primary cases that the parties relied on in this case.

a.

The Government argues that the Ninth Circuit case of United States v. Giberson supports dismissal of Defendant's Motion to Suppress. In United States v. Giberson, the Government had a valid warrant to search the computer for information relevant to the creation of fake IDs. United States v. Giberson, 527 F.3d 882, 889 (9th Cir.2008). The search program that the agents used categorized files and put similar files into one folder. For instance, the program put all of the graphic files into one folder. Id., at 886. Once the agent opened the folder containing graphic images, many thumbnail images of graphic files came into view at one time without the agent having to open any individual files. Id., at 886. The agent discovered images believed to be child pornography as he was searching through the thumbnails of graphic images. While the government applied for a warrant to search specifically for child pornography, the agent continued his search for information related to the production of fake IDs. Id. The Ninth Circuit rejected the defendant's argument that the government exceeded the scope of its warrant. Id. The court reasoned that "computer files are easy to disguise or rename," and "the government should not be required to trust the suspect's self-labeling when executing the warrant." Id., at 889.

The court found that it was reasonable for the government's agents to look at graphic files because evidence of fake IDs could have been stored as graphic files. Id., at 889. The Ninth Circuit stated that, in fact, it would have been unreasonable for the government's agents to limit their search to directories labeled "Fake ID Documents" or other obviously incriminating names. Id. The court wrote that this case is distinguished from the Tenth Circuit case, US v. Carey, discussed below, because the government inadvertently discovered images while searching for evidence of fake IDs. Id., at 890. The Ninth Circuit stated that after discovering the original files, the government continued to search for evidence of fake IDs and only inadvertently discovered additional pornographic images. Id., at 890. The court relied on the fact that the government did not actually begin searching for pornography until the search was authorized by an additional warrant. Id., at 891.

In the case presently before the Court, the Government asserts that the agent's search of the files in dispute was valid because, as in Giberson, the government should not rely on the Defendant's self-labeling of files when conducting its investigation. Defendant asserts, however, that his case is distinguishable from Giberson because the Government applied for a search warrant that was denied. (Instrument No. 65, at 20). In this case, Defendant contends, the Magistrate Judge found that the names on the files did not create a sufficient basis for the government to search for files that contained child pornography. If the file names did not even create probable cause for the government to suspect the presence of child pornography, Defendant argues, it was not reasonable for the Government to believe that the files labeled "ForbiddenFruit," "Illegal_Loli###," "Loli###," and other names would contain evidence of Computer Intrusion. (Instrument No. 36, at 14-15).

The Court agrees that the Government should not have been forced to limit its search to files with such labels as "Evidence of Computer Intrusion." However, the Court finds that the Government's assertion at the suppression hearing—that the agents reasonably believed that Defendant would hide files related to computer intrusion folders with labels suggesting child pornography—unpersuasive. Unlike in Giberson, the agents in this case requested a search warrant specifically for this encrypted file. In his affidavit, Agent Mance stated that the folder labels were suggestive of child pornography. (Instrument No. 65-3, at 15). Nowhere in the application for a search warrant did Mance state that the encrypted files could also contain evidence of Computer Intrusion. (Instrument No. 65-3). This new position clearly appears to have been developed specifically for the hearing on Defendant's motion. Additionally, child pornography is a much more serious crime, with more serious consequences than Computer Intrusion. If the Government's contention were true, Defendant would be a competitive contestant on World's Dumbest Criminals. The Government's witness, Agent Symeonidis, testified that, in his career as a computer forensic examiner, he has never seen a case where a defendant hid evidence of another crime in files with labels suggestive of child pornography. Therefore the Court finds that the Giberson court's reasoning—that the government did not have to limit its search based upon the Defendant's self-labeling of the files—is not applicable to this case. See Giberson, 527 F.3d at 889.

b.

The Government further contends that the Court should be persuaded by other district court cases applying Giberson's reasoning. Specifically, the Government cites a case from the Eastern District of Virginia where the government obtained a search warrant for evidence of Computer Intrusion. During the examination, an agent discovered a directory with files labeled "Teen" and "Tiny Teen." United States v. Gray, 78 F. Supp. 2d 524, 527 (E.D.Va.1999). While continuing to search for evidence of Computer Intrusion, the government opened the files and discovered images of child pornography. Id. The court found that the agent's search was not beyond the scope of the warrant. The district court held that the agent was entitled to examine all of the defendant's files that fell within the scope of the warrant and that the files allegedly containing child pornography fell within the scope of the warrant. Gray, 78 F.Supp.2d at 529. The investigating agent testified that he did not target the subdirectories allegedly containing child pornography because of their names. The court found that the agent persuasively testified that, while he found the names on the subdirectory suspicious, he opened the files in the course of a systematic search for evidence of computer intrusion. Gray, 78 F.Supp.2d at 530.

The Government, in the present action, argues that the examiners in this case were legally authorized to search Kim's computer for ``evidence of Computer Intrusion. (Instrument No. 36, at 7). When the agents came across the encrypted files, the Government contends that the agents reasonably believed that the Defendant may have mislabeled the files in an effort to hide evidence. Once they decrypted the files, the Government argues, the child pornography images appeared in plain view. (Id.).

However, the evidence does not support the Government's contentions. The Government applied for a search warrant for the encrypted files specifically stating that the agent believed the files to contain evidence of child pornography. (Instrument No. 65-3, at 13). The application for the warrant did not mention that the files might contain evidence of Computer Intrusion. (Instrument No. 65-3). Agent Symeonidis testified that none of the other files related to Computer Intrusion were encrypted but that he continued attempting to decode the encrypted files in an effort to discover further evidence of Computer Intrusion. The Court is not persuaded by Agent Symeonidis's testimony that he was continuing his search for evidence of Computer Intrusion when he spent two months attempting to decode the encrypted files. Therefore, the Court does not find that the Eastern District of Virginia's holding is persuasive in this case.

c.

Defendant further asserts that the Ninth Circuit has changed its position since its decision in Giberson. The Defendant argues that in United States v. Comprehensive Drug Testing, Inc. et. al, 579 F.3d 989 (9th Cir.2009), the Circuit Court outlined its new approach towards digital searches. In Comprehensive Drug Testing, the Government obtained a search warrant for electronic information concerning ten Major League Baseball players who tested positive for drug use. The government in that case conducted a search of the electronic drug testing records for all of the players in Major League Baseball. Id., at 993. In Comprehensive Drug Testing, the court reasoned that the search parameters for computer files should be tailored to find only the information described by the warrant. For instance, the Ninth Circuit stated that if the government is permitted to seize information related to ten names, the search parameters "must be designed to discover data pertaining to those ten names only, not to others and not to those pertaining to other illegality." Id., at 999. The court indicated that the government's search could have been narrowed to produce only the information authorized by the warrant. Id. The Ninth Circuit found that this was "an obvious case of deliberate overreaching by the government in an effort to seize data as to which it lacked probable cause." Id., at 1000.

The court then provided guidelines for future magistrate judges to use when issuing search warrants. The court stated that for warrants to examine computer hard drives or electronic storage medium, the magistrate should insist upon several things. The magistrate should insist that the government waive reliance upon the plain view doctrine for digital evidence. Id., at 1006. The magistrate should also insist that the computer personnel conducting the search must not disclose any information other than that which is the target of the warrant to the investigators. Id. The magistrate should also ensure that the government's search protocol is designed to uncover only information for which it has a probable cause, and agents must restrict their examination to that information. Finally, the court stated that the magistrate should require that the government destroy or return non-responsive data, and keep the issuing magistrate informed about when it has done so and what data the government has retained. Id.

Defendant argues that Comprehensive Drug Testing illustrates the Ninth Circuit's current approach towards searches involving digital media. Kim asserts that this case illustrates that, in the Ninth Circuit, a warrant to search computer documents for particular information does not give the government a right to search all of a defendant's computer files. (Instrument No. 65, at 25). The Government, however, argues that Comprehensive Drug Testing should not be followed outside of the Ninth Circuit because no other jurisdiction requires the government to waive reliance on the plain view doctrine. (Instrument No. 42, at 19).

The Court is not suggesting that the requirements for a warrant should change in this jurisdiction. However, Comprehensive Drug Testing does illustrate the Ninth Circuit's perspective on government searches of digital media. The opinion clearly indicates that the Ninth Circuit is narrowing government authority in "all records" searches of computer hardware for that jurisdiction.

Defendant argues that, in this case, the search could have been tailored to find only information within the scope of the warrant. Defendant's witness, David McGrody ("McGrody"), testified that the search could easily have been limited by date. The Government's witness, Symeonidis, testified that the government chose to decode the encrypted files because the files were last accessed during the period of alleged Computer Intrusion, in May of 2008. However, Defendant proved at the hearing that the last access to the encrypted files that occurred in May 2008 was clearly the result of a massive backup or file scan. In fact, on the date of last access, over two thousand files, including the encrypted files, were accessed in less than one minute. Defendant illustrated that this rate of access was the result of an automated program, not human access.

Instead of relying on the last access date, McGrody stated that the government could have limited the search by using the file created or last modified date. The Defendant argued that these dates would reflect the last time that the files were actually manipulated by a non-automated process. The files in the encrypted folder were created five years before the alleged Computer Intrusion and last modified three years before the alleged Computer Intrusion. (Instrument No, 65, at 15). Agent Symeonidis testified that the government did not rely on the created or last modified dates because the agents thought that the dates could have been changed or altered. However, McGrody testified that changing the dates would have taken Defendant hundreds of hours. He stated that the databases and other files which allegedly illustrate Defendant's involvement with Computer Intrusion were on a different computer, were not encrypted and none of the dates on those files were altered. Given these facts, McGrody testified that it would not make sense for Defendant to spend the time changing the dates on the files.

Therefore, the search conducted by the government in this case was clearly not conducted in accordance with the narrow guidelines promulgated in Comprehensive Drug Testing. 579 F.3d at 1000. As in Comprehensive Drug Testing, the instant case appears to be "an obvious case of deliberate overreaching by the government in an effort to seize data as to which it lacked probable cause." 579 F.3d at 1000.

d.

The Tenth Circuit has also limited the plain view doctrine in computer searches. In U.S. v. Carey, the government obtained a warrant to search a defendant's computer for evidence pertaining to the sale and distribution of controlled substances. Through their initial search, looking for text, they did not find any files related to drugs. They did, however, find numerous files which contained sexually explicit titles and were labeled as JPEGs. U.S. v. Carey, 172 F.3d 1268, 1270-71 (10th Cir.1999). Several of the file names contained the words "teen" or "young." However, the detective testified that the agents decided to look at the files because drug dealers frequently obscure or disguise evidence of their drug activity. Id., at 1271 n. 3. During the course of the investigation, the officer downloaded the images onto disks and viewed them on another computer. The investigating detective maintained that, when he downloaded the images, he believed they might contain evidence pertaining to a drug investigation. Id., at 1271 n. 2. The officer testified that he was not conducting a search for child pornography when he downloaded and viewed all of the images. The officer argued that it was not until he opened each file, that he knew of its contents. Upon viewing the images, however, he was immediately able to tell that the images contained child pornography. Id., at 1271.

In Carey, the Tenth Circuit reasoned that certainly after opening the first file, and seeing an image of child pornography, the searching officer knew what the remaining files contained and what the label meant. Id., at 1274. The court found that the government's authority to search was limited to evidence pertaining to drug trafficking. Id., at 1272-1273. When he opened the rest of the files, he knew that he was not going to find items related to drug activity as specified in the warrant. Id, at 1274. The court held that the detective impermissibly expanded the scope of his search when he abandoned his search for drug related evidence in order to search for evidence of child pornography. Id., at 1278. However, the court confined the holding to the documents opened after the first image, when the officer reasonably knew that he was not going to find any information related to drugs in these files. Id.

The present action is similar to the facts of Carey. Here, the Government was searching Kim's computer for evidence of Computer Intrusion when they came across image files with labels that suggested sexually explicit content. (Instrument No. 39, at 15). The Government now argues that the agents viewed the files in furtherance of their search warrant for evidence of Computer Intrusion. (Instrument No. 42, at 7).

However, in this case, the first image file allegedly depicting child pornography was not in plain view. As stated in Agent Mance's affidavit in support of the search warrant, the Government believed that the encrypted files in question contained child pornography. (Instrument No. 65-3, at 13). At the hearing, Agent Symeonidis testified that he had never discovered evidence of a lesser crime hidden in files with labels that were suggestive of child pornography. Additionally, the files were encrypted through a means so complicated that, according to Agent Symeonidis, it took the agents two months to decode the files. Therefore, it is clear that when the agents decided to decode and to open each of the over eight hundred image files, the agents had abandoned their search for evidence of computer intrusion and had commenced a warrantless search for child pornography.

Most courts no longer rely upon the subjective intent of the investigating agents as the Tenth Circuit did in Carey. The Supreme Court rejected an examination of subjective intent, and instead relied on an objective view of the circumstances when determining whether an agent acted reasonably in conducting their search. The High Court stated that, "[a]n action is ``reasonable' under the Fourth Amendment, regardless of the individual officer's state of mind, as long as the circumstances, viewed objectively, justify the action." Brigham City v. Stuart, 547 U.S. 398, 404, 126 S. Ct. 1943, 164 L. Ed. 2d 650 (2006).

The Tenth Circuit has also shifted the focus away from the agent's subjective intent. The court later characterized Carey as standing for "the proposition that law enforcement may not expand the scope of a search beyond its original justification." U.S. v. Grimmett, 439 F.3d 1263, 1268 (10th Cir.2006). Instead, the court focused on whether the search was objectively within the scope of the warrant by examining the evidence obtained. Id., at 1268-69. In Grimmett, the government had a search warrant to search the defendant's computer for evidence of child pornography. The Tenth Circuit held that the evidence obtained, images of child pornography, was "consistent with the probable cause originally articulated" in the search warrant. Therefore, the court reasoned, the search was permissible under Carey. Id. The present case is distinguishable from Grimmett. Here, the magistrate judge determined that the agents had probable cause to search the Defendant's computer for evidence of Computer Intrusion. (Instrument No. 65-2). Through decoding the encrypted files, the government obtained evidence of a completely different crime. (Instrument No. 42, at 3). The Court finds that the alleged evidence of child pornography is not consistent with the probable cause articulated in the search warrant for computer intrusion. Therefore, the Court finds that the Tenth Circuit's decision in Grimmett is not applicable to this case.

The Ninth Circuit also does not attempt to determine the agent's subjective intent when conducting the search. The appellate court stated that, "[u]sing a subjective criterion would be inconsistent with [Supreme Court precedent], and would make suppression depend too much on how the police tell their story rather than on what they did." United States v. Ewain, 88 F.3d 689, 694 (9th Cir.1996) (discussing Horton v. California, 496 U.S. 128, 138, 110 S. Ct. 2301, 110 L. Ed. 2d 112 (1990)). The court ultimately held that the agent's subjective good faith intent to find evidence within the scope of the warrant was not determinative. Ewain, 88 F.3d at 692.

However, the Ninth Circuit stated that the holding does not mean that anytime the search turns up evidence outside of the scope of the warrant, the additional evidence must be suppressed. For instance, when the search is part of a "``serious valid investigation' and not ``a pretense fabricated to mask the [federal officers'] lack of probable cause' to search for evidence of crimes other than that specified in the warrant, the plain view evidence is admissible." Id., at 693 (citing U.S. v. Washington, 797 F.2d 1461, 1471 (9th Cir.1986)). The court stated that the determination is to be made based upon whether the investigators confined their search to the scope of the warrant. Ewain, 88 F.3d at 694. The test, then, is whether "the officers looked in places or in ways not permitted by the warrant." Id., at 695. In Ewain, the Court held that, in the objective sense, the search did not go outside the scope authorized by the warrant. There, the agents had a search warrant to search for evidence of methamphetamine but uncovered evidence of a postal crime. However, the court found that "seeing the postal evidence did not require the officers to look anywhere they would not have looked for methamphetamine evidence." Id.

In the present case, however, uncovering the evidence of child pornography required the government agents to look in the encrypted folders. Looking in the encrypted folders for evidence of Computer Intrusion was unreasonable for several reasons. First, none of the other evidence of Computer Intrusion was located in encrypted folders. Agent Mance signed a sworn affidavit to the court asserting that he believed the encrypted folders to contain evidence of child pornography. He did not mention that the folders could contain evidence of Computer Intrusion. (Instrument No. 65-3). Second, the encrypted folders were created five years before, and last modified approximately three years before the dates of the alleged computer intrusion. (Instrument No. 65, at 15).

Third, Cryptapix, the software used to encrypt the folders in question was not the type that could be used to encrypt images. At the hearing McGrody, the Government's witness, established that the Defendant had version 2.2 of Cryptapix on his computer. Only Cryptapix 3.04, which was created in 2009, had the technology to store data as image files. Cryptapix 2.2, the version that the Defendant had on his computer and the version used to encrypt the files in the folder allegedly containing evidence of child pornography, did not have this feature.

Finally, at the hearing, Agent Symeonidis testified that the Government did not find any evidence of Computer Intrusion on the computer allegedly containing evidence of child pornography. In fact, McGrody testified that the Government did not have any evidence that the IP address of the computer containing the encrypted files attempted to gain access to the GEXA network. In fact, he stated that none of the IP addresses discussed in the search warrant belonged to the computer containing the encrypted files. Accordingly, the Court finds that when the Government agents began looking at the encrypted files, they were acting outside the scope of their warrant.

For the reasons stated above, the Court finds that when the Government agents decided to spend two months decoding the files in the encrypted folders, they did not do so in continuation of a valid search for evidence of Computer Intrusion. Rather, the Court finds that the Government examined the encrypted folders searching for evidence of child pornography, in direct defiance of the magistrate court's order. The Court finds that the Government's attempts to claim that they discovered the files while looking for evidence of Computer Intrusion is a clear attempt to justify the government's warrantless search for evidence of child pornography and to manipulate the Court into authorizing their defiance of the Magistrate's order.

III.

For the foregoing reasons, Defendant's Motion to Suppress is GRANTED (Instrument No. 65). Accordingly, all of the alleged evidence of child pornography discovered in the encrypted folders is suppressed.

The Clerk shall enter this Order and provide a copy to all parties.