United States v. Simons, 29 F. Supp. 2d 324 (E.D. Va. 1998)

*325 David Hackney, Assistant U.S. Attorney, Alexandria, Virginia, for plaintiff.

Marvin D. Miller, Alexandria, Virginia, for defendant.

CACHERIS, District Judge.

The matter before the Court is Defendant's Motion to Suppress. On October 8, 1998, a federal grand jury in the Eastern District of Virginia returned a two count indictment charging Defendant, Mark L. Simons, with violating 18 U.S.C. § 2252A(a) (2) (A), Receiving Materials Containing Child Pornography, and 18 U.S.C. § 2252A(a) (5) (B), Possession of Material Containing Child Pornography. The Court conducted an evidentiary hearing on this matter on December 11, 1998, and the Court now concludes that the Motion must be DENIED.

Defendant Mark L. Simons is currently employed as an electronic engineer within the Foreign Bureau of Information Services ("FBIS") component of the CIA. Defendant has access to a government computer system owned and operated by the CIA, and he has access to the Internet.

At the December 11, 1998 hearing, the Government first called Clifford Lee Mauck ("Mauck") to testify. Mauck works as the Systems Operations Center Manager at Science Applications International Corporation ("SAIC"). As the Manager, Mauck manages the computer network for FBIS, which includes monitoring Internet connections through a device called a firewall. (Tr. at 12-13.) The firewall logs all traffic going outside of the network, and it shows which computers have accessed the outside. (Tr. at 13-15.)

Mauck explained that on July 17, 1998, he examined the firewall to determine the capabilities of the system. He examined the firewall because it was new, and he believed that FBIS would require him to know more about its capabilities. (Tr. at 15-16). He had no reason to believe that there was any inappropriate use of the network going on before he began his examination. (Tr. at 18.)

*326 During Mauck's examination, he noticed that the firewall's log was very large. He conducted a keyword search of the work "sex" because he believed that if the firewall registered inappropriate activity, then "sex" would likely be an area that would be registered. (Tr. at 17-18.)

After Mauck entered the word "sex," he came up with a significant number of "hits." When he pulled the "hits," he noticed that several of them were Internet web sites. Mauck also noticed that a significant group of hits traced back to the same work station, which was later determined to be Defendant's work station. Mauck determined, based on his experience, that these hits evidenced significant activity rather than casual or accidental activity. (Tr. at 17-18.) As Mauck explained, he "could see by looking at the web sites that they weren't necessarily for business purposes." (Tr. at 28.) After this discovery, Mauck called his Government counterpart at FBIS, the Network Branch Chief, Katherine Camer. (Tr. at 20.)

The Government next called Mr. Robert Harper ("Harper") to testify at the hearing. Harper is employed by SAIC, and his duties include monitoring, troubleshooting, and repairing FBIS's computer network. (Tr. at 37.) On July 20, 1998, his Branch Chief, also Katherine Camer, told him that a particular web site, was found in the network's firewall and based on its title it appeared to be pornographic the title was "www.xratedpictures.com." (Tr. at 37, 48.) The Branch Chief asked Harper to go to the web site and verify that the site was pornographic. Harper agreed, and from his own office, he went to the site, and verified its pornographic nature. (Tr. at 38.)

Harper's Branch Chief then asked him to examine the work station that was seen going to the pornographic site, i.e. Defendant's work station, to determine whether there were any pictures or files downloaded to that work station. From Harper's own office, he accessed Defendant's work station and determined that over one thousand files had been downloaded that contained pictures. (Tr. at 39-40.) He then examined several of the downloaded files and explained that "they were pornographic in nature." (Tr. at 41.)

After Harper's supervisors reviewed a listing of the downloaded files, he was asked to copy the contents of the hard drive at Defendant's work station. (Tr. at 42.) Harper copied the hard drive from his own work station and via the network and then set up a copy for Special Investigators of the CIA to review. (Tr. at 43, 52.) The Special Investigators arrived on July 31, 1998, and they reviewed certain files, which appeared to depict child pornography. (Tr. at 59.) After that, Harper went into Defendant's office, removed his hard drive, and replaced it with a copy of the original hard drive. (Tr. at 43-44).

On August 5, 1998, Special Agent John Mesisca ("Mesisca") of the FBI responded to a request by the Special Investigators and reviewed the copy of Defendant's hard drive. Then, on August 6, 1998, Mesisca obtained a search warrant from Judge Buchanan to search Defendant's CIA office. On that same day, the warrant was executed. Copies were made of Defendant's hard drive and of floppy disks found in Defendant's desk. Copies were also made of documents that pertained to computer screen names and personal correspondence. Mesisca did not leave a property inventory, and Defendant was not present during the search.

On September 17, 1998, Mesisca obtained a search warrant for Defendant's work site and computer from Judge Sewell in order to obtain the contraband observed during the August 6, 1998 search. That search warrant was executed on September 23, 1998 while Defendant was present.

Defendant first argues that the July 1998 searches conducted by Mauck, Harper, and the Special Investigators were illegal searches in violation of the Fourth Amendment because they were conducted without a warrant or other lawful justification.

For a Fourth Amendment analysis, the Court must first consider whether the employee searched had a reasonable expectation of privacy. The person must have had an actual or subjective expectation of privacy and the expectation must have been one that *327 society recognizes as reasonable. See Katz v. United States, 389 U.S. 347, 361, 88 S. Ct. 507, 19 L. Ed. 2d 576 (1967) (Harlan, J. concurring). "The employee's expectation of privacy must be assessed in the context of the employment relation.... Given the great variety of work environments in the public sector, the question whether an employee has a reasonable expectation of privacy must be addressed on a case-by-case basis." O'Connor v. Ortega, 480 U.S. 709, 717-18, 107 S. Ct. 1492, 94 L. Ed. 2d 714 (1987).

In Ortega, the Supreme Court found that the person searched had a reasonable expectation of privacy in his desk and file cabinets located in his office. See id. at 718, 107 S. Ct. 1492. The Court recognized, nonetheless, that public employees' expectations of privacy in their offices, desks, and file cabinets, may be reduced by actual office practices and procedures.

In this case, the FBIS had an official policy regarding Internet use. The policy statement was printed on June 4, 1998, and it applied to all FBIS staff. See Government Hearing Exhibit ("GHE") 1, at 2. One heading under the policy, entitled "Permitted and Prohibited Official Use of the Internet," provides that "permitted use includes official business use, incidental use, lawful use, and contractor communications." See GHE 1, at 3. Moreover, the FBIS policy had a section regarding audits. That section provides:

Audits. Electronic auditing shall be implemented within all FBIS unclassified networks that connect to the Internet or other publicly accessible networks to support identification, termination, and prosecution of unauthorized activity. These electronic audit mechanisms shall conform to FBIS standard audit data formats and be capable of recording:

• Access to the system, including successful and failed login attempts, and logouts;

• Inbound and Outbound file transfers;

• Terminal connections (telnet) to and from external systems;

• Sent and received e-mail messages;

• Web sites visited, including uniform resource locator (URL) of pages retrieved;

• Date, Time, and user associated with each event.

FBIS Supervisors shall:

Be responsible for ensuring appropriate Internet use for all employees under their direction.

See GHE 1, at 10.

Given this policy, the Court does not find that Defendant, as an employee at FBIS, had a reasonable expectation of privacy with regard to any Internet use. The Court gives significant weight to the portion of the policy stating that audits shall be implemented to support identification, termination and prosecution of unauthorized activity. The Court also gives weight to the part providing that audits would be capable of recording web sites visited. In light of this language, the Court does not find that Defendant had any reasonable expectation of privacy with respect to any of his Internet activity. Accordingly, the searches of Defendant's computer in July, 1998 do not constitute Fourth Amendment violations.

But even if Defendant had a reasonable expectation of privacy, the Fourth Amendment analysis would not be over. "In the cases of searches conducted by a public employer, [the Court] must balance the invasion of the employees' legitimate expectations of privacy against the government's need for supervision, control, and the efficient operation of the workplace." Id. at 719-20, 107 S. Ct. 1492. The Ortega Court found that public employer intrusions, for investigations of work-related misconduct, on government employees' privacy interests should be judged under a reasonableness standard rather than under a probable cause standard. See id. at 725, 107 S. Ct. 1492.

Determining whether a search is reasonable requires a two step inquiry. The first inquiry is whether the search was justified at the inception, and the second is whether the search as actually conducted was reasonably related in scope to the circumstances which justified the interference in the first place. See id. at 726, 107 S. Ct. 1492. *328 "Ordinarily, a search of an employee's office by a supervisor will be justified at its inception when there are reasonable grounds for suspecting that the search will turn up evidence that the employee is guilty of work-related misconduct." Id.

When Mauck conducted his examination of the firewall, he did not look at one particular user's activity. After the keyword "sex" search showed a large number of hits, he determined that a significant number of hits traced back to Defendant's work station. This "search" and the Court questions whether this even constituted a search was justified at the inception because it was Mauck's duty as Manager to monitor Internet use. The search was also reasonably related in scope because it was reasonable that a keyword "sex" search would show whether any users were engaging in inappropriate workplace computer activity.

The Court next finds that Harper's review of Defendant's work station computer, as directed by Harper's Branch Chief, was justified at its inception because there was already evidence that Defendant's computer had visited a pornographic web site "www.xratedpictures.com." Moreover, a review of Defendant's work station from Harper's own office was reasonable in scope because there was no entry into Defendant's office.

The Special Investigators review of Defendant's hard copy was also reasonable given that Harper had discovered that Defendant had downloaded thousands of pictures, which were pornographic in nature. It was reasonable for the Special Investigators to review Defendant's hard drive to make a determination of whether there was any child pornography, and the search was reasonable in scope because the Investigators only reviewed Defendant's hard drive, without ever entering his office.

Finally, Harper's retrieval of Defendant's hard drive, from Defendant's office was reasonable. At that point, there was evidence that Defendant had been downloading child pornography off of the Internet onto his own computer. Harper took nothing more than Defendant's hard drive, and the Court finds that this was reasonable in light all the other evidence showing that Defendant had engaged in improper computer activity.

Defendant argues, however, that once Mauck discovered the high volume of Internet use at Defendant's work station, the investigation should have ended because the CIA was on notice of the workplace misconduct. Defendant argues that by further pursuing the investigation, the Government was no longer investigating workplace misconduct, but was engaging in a criminal investigation, and therefore the subsequent July, 1998 searches were in violation of the Fourth Amendment.

The Court rejects this argument. The Court first notes that Defendant has provided no case law to support this argument. But, even so, the Court finds that the CIA had a legitimate workplace interest in continuing with the investigation after Mauck determined that one work station had a high volume of Internet use. The actions an employer might take in response to an employee's misconduct most likely would differ depending on the magnitude of the employee's misconduct; accordingly, the Court finds that the CIA had a legitimate interest in continuing the investigation into Defendant's misconduct. Moreover, the FBIS policy provided that audits would be conducted to support "prosecution of unauthorized [Internet] activity." GHE 1, at 10. This language illustrates the CIA's interest in fully investigating Defendant's misconduct.

Accordingly, the Court does not find that the July 1998 searches violated Defendant's Fourth Amendment rights.

Defendant argues that Mesisca did not carry out the August 6, 1998 warrant as it was commanded in that Mesisca did not leave a copy of the warrant, he did not leave a receipt for the items obtained, and he exceeded the scope of the search warrant. Defendant therefore contends that the information and items seized pursuant to the August 6, 1998 warrant are tainted and must be suppressed.

*329 Defendant contends that the agents exceeded the scope of the warrant because "[i]nstead of seizing the materials they were commanded to seize, they seized photocopies and mirror images of discs." After reviewing Mesisca's affidavit in support of the August 6, 1998 search warrant and after reviewing the search warrant signed by Judge Buchanan, the Court does not find that the agents exceeded the scope of the warrant.

In Mesisca's affidavit, he stated "I believe it is highly likely that Mark L. Simons' computer hard drive, his laptop computer, his 3 and ½ inch diskettes, his ZIP drive diskettes, and videotapes located in his office contain images sent by him, images received by him, and images viewed by him that are child pornography." (Mesisca Affidavit ¶ 20.) Mesisca also listed these items as ones that were to be "seized or copied." Given the language of the affidavit, the Court finds that the Government did not exceed the scope of the warrant. The Court also notes that copying is less intrusive than seizing because copying does not deprive a defendant the use of his property. See United States v. Villegas, 899 F.2d 1324, 1337 (2d Cir. 1990).

Defendant next argues in support of his Motion to Suppress on the ground that Mesisca did not leave a copy of the warrant or a receipt for the items obtained. The Government concedes that Mesisca did not leave these items. The Government maintains, however, that this violation of Rule 41(d) of the Federal Rules of Criminal Procedure is only ministerial and that the failure to comply with Rule 41(d) does not void an otherwise valid search without some showing of prejudice.

The Fourth Circuit has ruled that "`ministerial' violations of Rule 41(d) `require suppression only if the defendant can demonstrate that he was prejudiced by the violation.'" United States v. Smith, 914 F.2d 565, 568 (4th Cir.1990). Mesisca's failure to leave a copy of the warrant and a receipt for the items obtained is a ministerial violation. See United States v. Wyder, 674 F.2d 224, 226 (4th Cir.1982); United States v. Gross, 137 F. Supp. 244, 248 (S.D.N.Y.1956). Moreover, the Court finds there has been no showing of prejudice to the Defendant in not receiving notice of the August 6, 198 search. In fact, the August 6, 1998 search did not result in finding any records that substantially assisted any further investigations. Instead, "[w]hat was gained from the search was confirmation rather than any new leads." Villegas, 899 F.2d at 1338. Accordingly, the Court will not suppress the evidence on the ground that Rule 41(d) was violated.

Defendant argues that because the searches of July, 1998 and August 6, 1998 were illegal, the information acquired from those searches was improperly used to obtain the September 17, 1998 search warrant. Because the Court finds that these searches were not illegal, Defendant's argument is unpersuasive. Accordingly, the Court finds that the September 17, 1998 search warrant was justified.

Defendant last argues that "for government agents to conduct electronic interceptions of oral or wire communications, they need a warrant" and in this case there was no warrant. He contends that the Government's electronic interception of his personal E-mail is equivalent to an electronic interception of personal phone calls, which is violative of 18 U.S.C. §§ 2515, 2516. Because no application was made for a warrant, he argues, none of the evidence obtained may be used for a search warrant, in the indictment, or at trial.^[1]

It appears that Defendant is contesting the searches in July 1998 because these were the only searches conducted without a warrant. There has been no allegation and nothing in the Record suggests that Defendant's E-mail was obtained while it was being transferred. Instead, the CIA copied Defendant's E-mail that was in storage. Accordingly, 18 U.S.C. §§ 2515 and 2516 do not *330 apply. See Steve Jackson Games, Inc. v. United States Secret Service, 36 F.3d 457, 462 (5th Cir.1994).

For the foregoing reasons, Defendant's Motion to Suppress is DENIED. An appropriate Order shall issue.

In accordance with the accompanying Memorandum Opinion, it is hereby Ordered that:

1) Defendant Mark L. Simons's Motion to Suppress is DENIED in its entirety;

2) the Clerk shall forward copies of this Order and accompanying Memorandum Opinion to all counsel of record.

[1] It appears that Defendant has conceded that this argument must fail because the issue was not raised at the evidentiary hearing or in Defendant's Reply Brief to the Government's Opposition to the Motion to Suppress.