Defendant James Johnston is charged in a superseding indictment filed May 19, 2011, with (1) conspiracy to produce visual depictions of minors engaged in sexually explicit conduct in violation of 18 U.S.C. § 2251(c) and (e); (2) receipt of visual depictions of minors engaged in sexually explicit conduct in violation of 18 U.S.C. § 2252(a)(2); (3) possession of one or more matters containing depictions of minors engaged in sexually explicit conduct in violation of 18 U.S.C. § 2252(a)(4)(B); and (4) conspiracy to travel with intent to engage in illicit sexual conduct in violation of 18 U.S.C. § 2423(b) and (e). (ECF 75.)*fn1
On February 27, 2012, defendant filed several motions, including a motion to suppress that the court has not previously resolved. The government filed an opposition to the motion to suppress on March 19, 2012. The court heard argument on the motion on March 28, 2012, and then set the matter for an evidentiary hearing, which occurred on April 3, 2012. At the conclusion of the evidentiary hearing, counsel made closing arguments. At all proceedings on the motion to suppress, defendant has been represented by Tom Johnson and defendant has personally appeared, out of custody; the government has been represented by Kyle Reardon.
For the reasons that follow, the court DENIES defendant's motion to suppress.
In October 2005, federal investigatory agents located an illegal child pornography website identified by the name "Illegal CP." (ECF 92-1 at 20.) On December 23, 2005, a United States District Judge in New Jersey authorized the interception of communications pertaining to the Illegal CP website. (Id. at 23.) On or about February 12, 2006, the operator of the e-mail account firstname.lastname@example.org sought a subscription to the Illegal CP website, listing his name as that of the defendant, James Johnston. (Id. at 29-30.) On February 13, 2006, ICE agents intercepted an e-mail message to email@example.com informing the recipient of access to the Illegal CP website. (Id. at 31.) After confirming that the e-mail address firstname.lastname@example.org belonged to a James Johnston, and otherwise confirming information related to Johnston including his residential address, (id. at 31-33), agents sought and obtained a warrant to search defendant's residence, which they did on September 6, 2006. The search warrant, issued by a U.S. magistrate judge on September 5, 2006, authorized seizure of "evidence of violations of 18 U.S.C. 2252(a)(4)(B) and 2252A(a)(5)(B), which make it a crime to possess child pornography, and violations of 18 U.S.C. 2252(a)(2) and 2252A(a)(2), which make it a crime to receive child pornography in interstate commerce by computer." (Id. at 3.) Specifically, the warrant identified the following items for seizure, among others: "[computer] hard drive, any other computer-related operation equipment," "correspondence pertaining to the possession, receipt, distribution, or advertisement of visual depictions of minors engaged in sexually explicit conduct . . . transmitted or received using a computer," "electronic mail, chat logs, and electronic messages, offering to transmit . . . visual depictions of minors engaged in sexually explicit conduct," and "records evidencing occupancy or ownership of the premises [to be searched]" and "ownership or use of computer equipment found in the . . . residence." Id. at 41-42.
During execution of the search warrant, agents found two computers; on one an agent located fifteen video clips depicting minors engaged in sexually explicit conduct. (ECF 92-2 at 1.) Agents also found information related to travel documents and money order receipts. (ECF 106-2.) Before concluding the search, agents seized the computer and created a copy of the hard drive. (Id.) Agents conducted a first search of a mirror image of the hard drive between September 15, 2006, and October 23, 2006, searching for "images depicting minors engaged in sexually explicit conduct." (ECF 92-2 at 2.) During this first search, Special Agent Brian A. Cardwell found seven still photographic images and 304 video clips depicting minors engaged in sexually explicit conduct. (Id. at 2-3.) He also found 302 videos of the same kind in the computer's recycle folder. (Id. at 3.) A search for e-mails containing images or videos depicting minors engaged in sexually explicit conduct yielded no results, but some "emails of interest" and chat logs were located; the agent created a CD copy of the chat logs but did not review them in detail at the time. (Id. at 4.) Based on this information, on September 20, 2007, the government filed an indictment against defendant, charging possession of one or more matters containing depictions of minors engaged in sexually explicit conduct in violation of 18 U.S.C. § 2252(a)(4)(B). (ECF 1.)
A second search of a mirror image of defendant's computer was completed between April 18 and June 14, 2011. (ECF 92-4.) During this search, Agent Cardwell discovered 80 thumbnail images containing child pornography, and 285 link files, several of them containing child pornography. (Id. at 5.) A search for the e-mail address email@example.com resulted in 97527 hits,*fn2 including a copy of a webpage at which defendant had used the "brestogen" e-mail address to book a flight from Sacramento to Bangkok; no year for the flight was evident. (Id. at 6.)
Agent Cardwell also completed a third search, of a mirror image of defendant's computer, on July 21, 2011. (ECF 106-2.*fn3 ) During this search, the agent reviewed the CD of the chat logs he had created during the first search in 2006, as well as e-mails and internet history files. He also reviewed e-mails, internet activity and used keyword searches to look "for further evidence pertaining to child pornography." During this search, the agent located chat logs of internet chats between the person using the screen name "brestogen" and a person using the screen name "switlass_69," identified as Kim Lacson. (Id. at 2.) The chats reflect, among other things, Lacson asking if her correspondent wanted "young" women and saying she had a friend who was a 15 year old "virgin"; "brestogen" responded "sure" and asked for a picture of the virgin or her vagina. Other chats also involve discussions of young women, including a "12 year old beauty," and defendant's desire to meet them and see photos of them first. (Id. at 3.)
B. Evidentiary Hearing Testimony
At the evidentiary hearing, Agent Cardwell testified regarding the method of searching he used during his examinations of defendant's computer. He said he was present during execution of the search warrant at defendant's residence on September 6, 2006; in preparation for that search he reviewed the warrant and developed a procedure to determine whether evidence pertaining to child pornography was located on any computer that might be found during the search. On one computer, located downstairs in the residence, the agent did locate videos of child pornography, at which point he immediately turned off the computer and took steps to seize the computer for further off site forensic analysis. In conducting his first analysis, beginning on September 15, 2006, Agent Cardwell first used a forensic software product to create a mirror image of the computer, confirming to a 99% measure of accuracy that the image was a true copy of the computer. He then used the software to look for images, including videos, of child pornography. He also conducted word searches, of the words "child porn" and other words he knows are commonly used by those who view child pornography. He reviewed e-mails, chat logs and internet search history. In reviewing e-mails, Agent Cardwell perused all the e-mails captured through a search of the e-mail addresses identified in the search warrant, and found some e-mails that contained images of child pornography. The agent clarified that his primary purpose in searching the e-mails, however, was capturing defendant's e-mail accounts based on information provided in the warrant. He also saved chat logs identified through his searching as potentially relevant because persons who view child pornography often chat about their viewing activities on line. The agent described this first search as a "triage" search during which he did not review a lot of information. Rather once he found a relatively small amount of evidence he provided it to the prosecuting attorney. Based on his experience, the evidence he provided was equivalent to the evidence that in most cases supports the prosecutor's filing of charges and that also results in an early guilty plea.
During his second search beginning on April 18, 2011, Agent Cardwell testified that he found the same information located during his initial search. But at the request of the prosecutor, he conducted a more thorough search of internet history and e-mail correspondence, and he also looked at files to see if images had been opened. He specifically searched for the credit card number and e-mail address associated with the subscription to the child pornography website identified in the original search warrant application. Agent Cardwell testified at all times that his purpose was to look for child pornography.
During his third search of defendant's computer on July 21, 2011, Agent Cardwell again looked for child pornography, and prepared a detailed analysis of the chat logs he had previously saved to a CD. He isolated relevant chats and reviewed their content. During this search he located evidence related to child pornography; in response to the prosecutor's questioning he said that some of this evidence was intermingled with evidence of other crimes. During the third search, the agent again conducted word searches. While he did not recall the specific words searched, he said he assumed he used the words he typically uses for these types of searches, such as "child porn," "lolita," "baby j," "pedo" and "hussyfan." He said he also conducted follow-up searches based on information turned up during his searches, including the nickname "lollipop." When asked if he ever searched for information other than that related to child pornography, the agent said no.
During cross-examination, Agent Cardwell testified that he saved only chat logs and not e-mails to a CD. He said he understood he was authorized to review all e-mails and chats line by line for the purpose of determining if they contained or referenced child pornography. He did in fact review some but not all chat logs line by line. While at one point the agent testified he understood it was acceptable for him to provide a copy of the CD containing every chat log to the lead agent on the case, and to the prosecutor, he also said he did not seize or provide anything to the prosecutor that did not pertain to child pornography. Agent Cardwell confirmed he could not recall exactly which search terms he used during any given search, and conceded he did not create a detailed log or day-to-day report to document every step of his analysis of defendant's computer. Regarding information on air travel retrieved during his search, ...