United States v. Gray, 78 F. Supp. 2d 524 (E.D. Va. 1999)

*525 Patricia M. Haynes, U.S. Attorney's Office, Alexandria, VA, for plaintiff.

Peter David Greenspun, David D. Greenspun & Associates, P.C., Fairfax, VA, for defendant.

ELLIS, District Judge.

This is a prosecution for (i) unlawfully accessing a government computer in violation of 18 U.S.C. § 1030(a) (2) (B) and (a) (2) (C), (ii) unlawfully accessing a government computer causing damage thereto, in violation of 18 U.S.C. § 1030(a) (5) (C),^[1] and (iii) possession of *526 child pornography, in violation of 18 U.S.C. § 2252A(a) (5) (B). Pretrial motions inter alia raised two issues: (1) whether evidence of child pornography discovered during a search of defendant's computer files authorized by an unrelated warrant must be suppressed as beyond the scope of the warrant and (2) whether the charges of unlawful access and possession of child pornography were properly joined under Rule 8(a), Fed.R.Crim.P., and if so, whether they should be severed before trial under Rule 14.

On February 5, 1999, FBI agents executed a search warrant at defendant's home in Arlington, Virginia in connection with an investigation of unauthorized computer intrusions at the National Institute of Health's National Library of Medicine ("NLM"). Four computers belonging to defendant were seized and removed from defendant's home. At the FBI office, Special Agent Arthur Ehuan, of the Computer Analysis Response Team ("CART") made copies of the contents of the computers' electronic storage media, or hard drives. These copies, which Agent Ehuan made on magneto-optical disks, were in digital form. To translate the stored information into readable form, Agent Ehuan planned to make a series of CD-ROMs, so that the case agent, Special Agent Craig Sorum, could read and access defendant's files.

Prior to making the CD-ROMs. Agent Ehuan created, and gave to Agent Sorum, a separate CD-ROM containing a list of the directory structures of the hard drives on each of the four computers. Using this disc, Agent Sorum then performed a text string search of the file structures and identified which computers, of the four seized, appeared to contain the text strings most closely associated with the NLM items listed in the search warrant. Agent Sorum then asked Agent Ehuan to concentrate first on making readable CD-ROMs for this computer.

Before making the CD-ROMs, Agent Ehuan opened many of the directories and subdirectories on the targeted hard drive to determine the size of the files and to gauge how many directories would fit on a single CD-ROM, which can store only 650 megabytes, far less than the capacity of the magneto-optical disks. After determining which directories could be copied onto a particular CD-ROM, Agent Ehuan began the copying process. While information was being copied onto the CD-ROMs, a process that consumed approximately 45 minutes to an hour, Agent Ehuan, pursuant to CART routine practice, opened and looked briefly at each of the files contained in the directories and subdirectories being copied. CART agents routinely perform such preliminary reviews, opening files as they are being copied onto CD-ROMs to look for the materials listed in the search warrant in the hope that they might facilitate the case agent's search.^[3]

Following this procedure, Agent Ehuan continued opening files and subdirectories until the copying process was completed, at which point he began storing information *527 on the next CD-ROM. In this way, Agent Ehuan was able to open approximately 80% of the files from the targeted hard drive. To open the directory files, Agent Ehuan used a program called CompuPic. When Agent Ehuan opened a file using CompuPic, thumbnail-sized images of all of the items contained within that file, pictures or text documents, would appear on the screen. This program enabled Agent Ehuan, upon opening a file, to see instantly the nature of the material contained within that file.^[4]

As Agent Ehuan was preparing to copy material onto the eighth CD-ROM, he opened a directory entitled "BBS," which is a common abbreviation for "Bulletin Board System/Service," in order to see the list of the individual files and subdirectories contained in that directory. He then selected which of the subdirectories and files from BBS could be transferred to the CD-ROM by estimating how many of them, added together, would aggregate to 650 megabytes of information. Next, he began transferring files to the CD-ROM. While this was underway, Agent Ehuan, pursuant to his normal practice, opened most of the files contained within the BBS directory, some of which contained adult pornography, some of which were text files. In the course of opening the files in the BBS directory, Agent Ehuan opened a subdirectory entitled "Teen," which contained several files with the suffix "jpg," which commonly denotes a picture file.^[5] Like a number of others, this subdirectory contained pornographic pictures, but these, Agent Ehuan thought, might also include images of minors in sexually explicit poses. Yet, he could not be certain, and, as the subdirectory did not contain any of the materials identified in the warrant, or other obvious evidence of a crime, Agent Ehuan continued his search of the BBS directory pursuant to the warrant. There-after, he saw a subdirectory entitled "Tiny Teen." The name of this subdirectory caused Agent Ehuan to wonder if the subdirectory contained child pornography. He testified, however, that he opened the "Tiny Teen" subdirectory not because he believed it might contain child pornography, but rather because it was the next subdirectory listed and he was opening all of the subdirectories as part of his routine search for the items listed in the warrant.

When he opened the "Tiny Teen" subdirectory, Agent Ehuan discovered yet another series of pornographic pictures, this time, however, he believed some of the pictures contained images of minors. He then asked another CART agent to view the pictures displayed on his computer screen. On doing so, this agent agreed the pictures appeared to be of minors. Agent Ehuan then notified Agent Sorum of his discovery, who after viewing the same images, also concluded that they contained child pornography. Agent Ehuan testified that, at that point, he may have returned to the subdirectory "Teen" to see if that directory indeed contained pornographic images of minors. After the brief return to the "Teen" subdirectory, however, Agent Ehuan ceased his search and he, *528 based on what he had already discovered, obtained a second warrant authorizing a search of defendant's computer files for child pornography. This search disclosed additional images of child pornography, which, together with the images that triggered the application for the warrant, are the subject of defendant's motion to suppress.

Defendant moves to suppress the evidence gained from Agent Ehuan's search of the "Teen" and "Tiny Teen" subdirectories on the ground that the search of these subdirectories was beyond the scope of the warrant authorizing a search for NLM documents and hacker materials.

The primary rules governing search warrants are too well-established to be disputed. The Fourth Amendment requires that a search warrant describe the things to be seized with sufficient particularity to prevent a general exploratory rummaging in a person's belongings. See Coolidge v. New Hampshire, 403 U.S. 443, 467, 91 S. Ct. 2022, 29 L. Ed. 2d 564 (1971). To prevent such rummaging, therefore, a "warrant must enable the executing officer to ascertain and identify with reasonable certainty those items that the magistrate has authorized him to seize." United States v. George, 975 F.2d 72, 75 (2d Cir. 1992). In some searches, however, it is not immediately apparent whether or not an object is within the scope of a search warrant; in such cases, an officer must examine the object simply to determine whether or not it is one that he is authorized to seize. See United States v. Slocum, 708 F.2d 587, 604 (11th Cir. 1983). Searches of records or documents present a variant of this principle, as documents, unlike illegal drugs or other contraband, may not appear incriminating on their face. As a result, in any search for records or documents, "innocuous records must be examined to determine whether they fall into the category of those papers covered by the search warrant." United States v. Kufrovich, 997 F. Supp. 246, 264 (D.Conn.1997) (citing Andresen v. Maryland, 427 U.S. 463, 482 n. 11, 96 S. Ct. 2737, 49 L. Ed. 2d 627 (1976)). Although care must be taken to minimize the intrusion, records searches require that many, and often all, documents in the targeted location be searched because "few people keep documents of their criminal transactions in a folder marked `crime records.'" United States v. Hunter, 13 F. Supp. 2d 574, 582 (D.Vt.1998) (internal quotation marks omitted). Thus, agents authorized by warrant to search a home or office for documents containing certain specific information are entitled to examine all files located at the site to look for the specified information. See United States v. Heldt, 668 F.2d 1238, 1267 (D.C.Cir.1981). So it is not surprising, then, that in the course of conducting a lawful search pursuant to a search warrant, law enforcement agents often discover evidence of criminal activity other than that which is the subject of the warrant. If an agent sees, in plain view, evidence of criminal activity other than that for which she is searching, this does not constitute an unreasonable search under the Fourth Amendment, for "[v]iewing an article that is already in plain view does not involve an invasion of privacy." United States v. Jackson, 131 F.3d 1105, 1108 (4th Cir.1997). Further, such evidence may be seized under the "plain view" exception to the warrant requirement,^[6] provided that "(1) the officer is lawfully in a place from which the object may be plainly viewed; (2) the officer has a lawful right of access to the object itself; and (3) the object's incriminating character is immediately apparent." Jackson, 131 F.3d at 1109. These principles applied in the context of a document or record search means that, if an agent searching files pursuant to a search warrant discovers a document that contains evidence of another crime, *529 that document can be seized under the "plain view" exception to the warrant requirement.

These principles are also dispositive of the instant case,^[7] as searches of computer files "present the same problem as document searches the intermingling of relevant and irrelevant materials but to a heightened degree" because of the massive storage capacity of modern computers. Hunter, 13 F. Supp. 2d at 583; see also Raphael Winick, "Searches and Seizures of Computers and Computer Data," 8 Harv.J.L. & Tech. 75, 78 (Fall 1994). Thus, although care must be taken to ensure a computer search is not overbroad, searches of computer records "are no less constitutional than searches of physical records, where innocuous documents may be scanned to ascertain their relevancy." Hunter, 13 F. Supp. 2d at 584.

It follows, then, that Agent Ehuan's search of the "Teen" and "Tiny Teen" subdirectories was not beyond the scope of the search warrant. In searching for the items listed in the warrant, Agent Ehuan was entitled to examine all of defendant's files to determine whether they contained items that fell within the scope of the warrant. In the course of doing so, he inadvertently discovered evidence of child pornography, which was clearly incriminating on its face. As Agent Ehuan was lawfully searching the "Teen" and "Tiny Teen" subdirectories pursuant to the first warrant when he saw the illegal pornography, viewing that evidence did not constitute an unreasonable search under the Fourth Amendment. See Jackson, 131 F.3d at 1108.

It is not persuasive to argue, as defendant does, that Agent Ehuan knew the two subdirectories did not contain NLM documents or hacker materials when he searched them because many of the files were tagged with the "jpg" suffix, indicating a picture file, and none of the materials covered by the warrant were believed to be pictures. While the ".jpg" suffix generally denotes a picture file, there is no requirement that it do so, and, as a result. Agent Ehuan could not be certain that files with the ".jpg" suffix did not contain the materials for which he was authorized to search. Indeed, Agent Ehuan would have been remiss not to search files with a ".jpg" suffix simply because such files are generally pictures files, and he believed the NLM documents and hacker materials were more likely to be text files. He knew from his experience that computer hackers often intentionally mislabel files, or attempt to bury incriminating files within innocuously named directories. Indeed, in the course of his search of defendant's computer files, Agent Ehuan found some text files mixed in with picture files. This serves to underscore the soundness of the conclusion that Agent Ehuan was not required to accept as accurate any file name or suffix and limit his search accordingly.^[8]

*530 Defendant further argues that Agent Ehuan, having been alerted by the names of the "Teen" and "Tiny Teen" subdirectories, was looking for child pornography when he opened the two subdirectories. Agent Ehuan testified persuasively to the contrary; he stated that, while the names of the subdirectories were suspicious to him, he opened the "Teen" and "Tiny Teen" subdirectories in the course of a systematic search of the BBS directory. In other words, Agent Ehuan did not target those particular subdirectories because of their names, and, at all times, he was searching for the materials that were the subject of the search warrant.

The Tenth Circuit's recent decision in United States v. Carey,^[9] on which defendant chiefly relies, does not compel a different result; it is, in an important way, factually distinguishable, and ultimately supportive of the result reached here. In Carey, police accidentally discovered child pornography on the defendant's computer while conducting a search for evidence of drug transactions, and then, without obtaining another warrant, abandoned the search for drug trafficking evidence, and proceeded instead to download and view over 200 similarly labeled files in a search, successfully as it turns out, for further images of child pornography. See Carey, 172 F.3d at 1271. The Tenth Circuit held that, while the first image of child pornography was discovered inadvertently,^[10] the officer had exceeded the scope of the search warrant because, after the accidental discovery of illegal pornography in the ".jpg" files, when the officer opened subsequent ".jpg" files, "he expected to find child pornography and not material related to drugs." Id. at 1273. As a result, the panel concluded that the officer had temporarily abandoned his search for drug trafficking evidence and intentionally commenced a search for more child pornography, which search was not authorized by the existing warrant. See id.

The Carey court's reasoning actually confirms the result reached here. First, Carey held that the first illegal pornographic image, which was discovered inadvertently, was not subject to suppression because it was found in "plain view" in the course of the authorized search. Similarly, the child pornography images Agent Ehuan saw in the "Tiny Teen" subdirectory were discovered inadvertently during the course of a lawful search, and thus, consistent with Carey, are not subject to suppression. Second, the Carey court suppressed all the remaining images because the officer there, unlike Agent Ehuan, testified that, when he thereafter searched the ".jpg" files, he was looking for more child pornography, and not drug-related material. By contrast, Agent Ehuan testified that at all times, he was looking for the NLM documents and hacker materials that were the subject of the warrant. Significantly, Agent Ehuan never abandoned his original search; he was not commencing a new search when he opened the "Teen" and "Tiny Teen" subdirectories, rather, he was continuing his systematic search of the BBS directory without regard to file names or suffixes because he was aware that the materials that were the subject of the warrant could be hidden *531 anywhere in defendant's files.^[11] In summary, the seized images of alleged child pornography may not be suppressed because the search was within the scope of the warrant, and reasonable under the Fourth Amendment.

Defendant also seeks severance of Count 7 of the indictment, the child pornography count, from Counts 1-6, the unauthorized access counts. He claims that the charges were not properly joined under Rule 8(a), Fed.R.Crim.P., and, even assuming arguendo, joinder was appropriate under Rule 8, the charges should be severed pursuant to Rule 14, Fed.R.Crim.P., for unfair prejudice. Both positions are well taken.

Rule 8(a), Fed.R.Crim.P., states that two or more offenses may be charged in the same indictment if the offenses are of similar character, are based on the same act or transaction, or constitute part of a common scheme or plan.^[12] It is settled that this rule is to be broadly construed in favor of initial joinder. See United States v. Park, 531 F.2d 754, 761 (5th Cir.1976). Yet, even if different counts may properly be subject to joinder in a single indictment under Rule 8(a), that does not necessarily mean the counts should be tried together. See United States v. Cole, 857 F.2d 971, 974 (4th Cir.1988). Rule 14, Fed.R.Crim. P., states that if it appears that a defendant or the government is prejudiced by a joinder of offenses in an indictment, or by trying two or more offenses together, the court may order a separate trial of the different counts.^[13] The decision whether to sever under Rule 14 rests within the sound discretion of the trial court. See Cole, 857 F.2d at 974. In determining whether to sever charges under Rule 14, the trial court must balance any possible prejudice to the accused against the interests of the efficient administration of justice. See id. In addition, the possibility of prejudice to a defendant from being charged with multiple counts is greatly diminished where "the evidence of the joined crimes would be mutually admissible for legitimate purposes in separate trials for each offense." Id. (quoting United States v. Jamar, 561 F.2d 1103, 1106 (4th Cir.1977)) (internal quotation marks omitted).

Analysis properly begins with the question whether it was permissible for the government to join the child pornography and unauthorized access charges in the same indictment. It was not; the acts are not of the same character, they are not based on the same transaction, and do not constitute part of a common scheme or plan. See Rule 8(a), Fed.R.Civ.P. While it is true that both offenses were probably committed by using the Internet to download and copy files onto a home computer, the illegal actions themselves are of a completely *532 different character. Unauthorized access into a government computer is analogous to breaking and entering in the physical world; possession of child pornography on a computer is analogous, in the physical world, to possession of pictures of child pornography. Breaking and entering and possession of child pornography are not crimes of similar character. Thus, it is clear that charges of unauthorized access into a government computer and possession of child pornography are not properly joined under Rule 8(a) as crimes of a similar nature.

Nor were the actions that form the basis of the charges part of the same transaction within the meaning of Rule 8(a). On one or more occasions, defendant, without authorization, allegedly accessed the NLM's computer and downloaded information onto his home computer. On one or more unrelated occasions, defendant allegedly accessed pictures of child pornography on the Internet and downloaded them onto his home computer. The government has not argued that these actions are connected temporally or as part of a common scheme or plan. Thus, if one looks at the defendant's conduct alone, it is clear that these crimes did not occur as part of the same transaction.

Citing Park, the government claims that the crimes are part of the same transaction for purposes of Rule 8(a) because they were discovered in the course of one search. See Park, 531 F.2d at 761. This search, the government argues, is "the same act or transaction" that Rule 8(a) requires for joinder. This argument is unpersuasive. It is flatly contradicted by the terms of the Rule itself, which make clear that it is a defendant's "offenses," not any governmental act, that must be part of the "same act or transaction" to permit joinder. And, the soundness of the Rule in this respect is plain; the justification for joinder efficiency balanced by fairness has nothing to do with governmental acts, but everything to do with the similar nature of, and relationship among, a defendant's offenses. To the extent Park suggests otherwise, it is unpersuasive.

Even assuming arguendo the propriety of joinder under Rule 8(a), the resulting prejudice to defendant requires severance and separate trials pursuant to Rule 14, Fed.R.Crim.P. Three sources of prejudice justify granting severance under Rule 14:(1) the jury may confuse and cumulate the evidence, (2) a defendant may be confounded in presenting defenses, or (3) the jury may conclude that a defendant is guilty of one crime and then find him guilty of the other because of his criminal disposition. See United States v. Foutz, 540 F.2d 733, 736 (4th Cir.1976). The second and third sources of prejudice seem applicable here. Given the highly inflammatory nature of a charge of possessing child pornography, it is easy to imagine that defendant may wish to testify on his own behalf on the charges of unauthorized access of a government computer, yet be reluctant to do so on the charge of possessing child pornography. The government argues, in opposition to the motion, that some of the evidence Rule 404(b), Fed.R.Evid., evidence for example might be common to both types of charges and that would greatly diminish the possibility of the third type of prejudice from joinder. See Cole, 857 F.2d at 974. But, the prospect of mutually admissible evidence does not diminish the possibility that defendant may be confounded in presenting his defenses were the charges to be tried together. Thus, even assuming that the charges were properly joined under Rule 8(a), they should be severed under Rule 14 to prevent unfair prejudice to defendant.

In conclusion, the motion to suppress must be denied and the motion to sever must be granted.

An appropriate order has issued.

[1] Prior to the trial of the unlawful access charges, the three counts of the indictment charging that the unlawful access caused damage in violation of 18 U.S.C. § 1030(a) (5) (C) were dismissed at the government's request.

[2] At the evidentiary hearing on the motion to suppress, the government presented testimony from Agent Arthur Ehuan of the FBI's Computer Analysis Response Team ("CART"), and defendant presented no evidence. The matter was taken under advisement and a second hearing was set for further oral argument. At the second hearing, defendant proffered testimony from a computer expert. The facts recounted here are based on the testimony, the proffered testimony, the exhibits offered at the hearing, and the arguments of counsel. They are the Court's findings pursuant to Rule 12, Fed.R.Crim.P.

[3] Although he was not the case agent, Agent Ehuan knew what types of materials were the subject of the search, i.e., NLM documents and "hacker" materials, such as source code, and therefore he could focus his search accordingly. In the course of the evidentiary hearing, the term "hacker" was used in a manner consistent with its ordinary colloquial meaning to describe a person who breaks into computer systems.

[4] Defendant proffered testimony from a computer expert to establish (i) that Agent Ehuan did not need to open the hard drives' directories and subdirectories to identify which files would aggregate to 650 megabytes of information, and (ii) that the computer program Agent Ehuan used could be modified or supplemented in such a way that it would have been possible for Agent Ehuan to have determined whether a particular file consisted of pictures or text without viewing the contents of the file. There was no evidence to suggest, however, that Agent Ehuan or CART knew the program could be used in this manner.

[5] The NLM files that were the subject of the search were believed likely to be text files. Agent Ehuan nonetheless opened files that were labeled as picture files because computer files can be misleadingly labeled, particularly if the owner of those files is trying to conceal illegal materials. Indeed, in the course of this search, Agent Ehuan discovered some text files that were, in fact, mixed in with picture files. Moreover, Agent Ehuan did not believe that the warrant foreclosed the possibility that the NLM materials might include pictures.

[6] See Coolidge v. New Hampshire, 403 U.S. 443, 91 S. Ct. 2022, 29 L. Ed. 2d 564 (1971).

[7] The warrant in this case authorized the FBI to search defendant's computer files for evidence of documents and files taken from NLM, and for utilities that would enable defendant to access protected computers without authorization.

[8] Defendant's proffered expert testimony does not change this result. The resolution of the motion to suppress does not turn on whether Agent Ehuan conducted the most technically advanced search possible, but on whether the search, as conducted was reasonable. See Florida v. Jimeno, 500 U.S. 248, 250, 111 S. Ct. 1801, 114 L. Ed. 2d 297 (1991) ("The touchstone of the Fourth Amendment is reasonableness."). Even assuming that the CompuPic program could have been modified to allow the searching agent to determine, without viewing the file, whether it contained pictures or text, as the proffered testimony indicates, Agent Ehuan's search was reasonable under the Fourth Amendment. First, although the FBI believed the files for which they were searching were more likely to be text than pictures, it was certainly possible that the stolen NLM materials might contain pictures, and so it would have been reasonable for Agent Ehuan to examine files containing pictures. Second, there is no evidence that Agent Ehuan, or CART, was aware that the program could be used in this manner, which is significant because, as computer technology changes so rapidly, it would be unreasonable to require the FBI to know of, and use, only the most advanced computer searching techniques. Finally, because he was conducting a records search, Agent Ehuan was entitled to look at all of defendant's files to determine whether or not they fell within the scope of the search warrant. See Hunter 13 F. Supp. 2d at 583. And, as this search targeted computer files, there was a large amount of material to review. Under these circumstances, it was reasonable, within the meaning of the Fourth Amendment, for Agent Ehuan, in his routine preliminary file review, to use a computer program that enabled him to see instantly, upon opening a file, the general nature of the material contained within that file.

[9] 172 F.3d 1268 (1999).

[10] See id. at 1273 n. 4 As a result, this first picture was lawfully found and seized under the "plain view" doctrine and not subject to suppression. See id.

[11] Not presented here is what result would obtain had Agent Ehuan not stopped his search and obtained a warrant after the initial discovery of the child pornography. Arguably, Agent Ehuan could have continued his systematic search of defendant's computer files pursuant to the first search warrant, and, as long as he was searching for the items listed in the warrant, any child pornography discovered in the course of that search could have been seized under the "plain view" doctrine. See Coolidge v. New Hampshire, 403 U.S. 443, 467, 91 S. Ct. 2022, 29 L. Ed. 2d 564 (1971).

[12] Rule 8(a), Fed.R.Crim.P., states:

Two or more offenses may be charged in the same indictment or information in a separate count for each offense if the offense charged, whether felonies or misdemeanors or both, are of the same or similar character or are based on the same act or transaction or on two or more acts or transactions connected together or constituting parts of a common scheme or plan.

[13] Rule 14, Fed.R.Crim.P., states in pertinent part:

If it appears that a defendant or the government is prejudiced by a joinder of offenses ... in an indictment or information or by such joinder for trial together, the court may order an election or separate trials of counts ... or provide whatever other relief justice requires.