Searching over 5,500,000 cases.

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

United States v. Wolfenbarger

United States District Court, N.D. California, San Jose Division

December 10, 2019




         This order vacates and supersedes ECF No. 207, which was filed on August 29, 2019.

         A federal grand jury indicted Defendant Johnny Ray Wolfenbarger (“Defendant”) on one count of attempted production of child pornography, in violation of 18 U.S.C. § 2251(c) and (e); one count of attempted coercion and enticement of minors, in violation of 18 U.S.C. § 2422(b); and one count of receipt of child pornography, in violation of 18 U.S.C. § 2252(a)(2). ECF No. 1.

         Before the Court are two motions to suppress filed by Defendant. In one, Defendant seeks to suppress evidence seized from Defendant's Yahoo email account on the basis that Yahoo acted as a government agent pursuant to the Fourth Amendment and United States v. Walther, 652 F.2d 788 (9th Cir. 1981). In the other, Defendant seeks to suppress all evidence pursuant to Franks v. Delaware, 438 U.S. 154 (1978). The Court held an evidentiary hearing on July 12, 2019 and July 23, 2019. See ECF Nos. 199, 203. Having considered the briefs and declarations, the testimony from the evidentiary hearing, the relevant law, and the record in this case, the Court DENIES both of Defendant's motions to suppress.

         I. BACKGROUND

         A. Factual Background

         1. Yahoo's Enforcement of its Terms of Service

         Yahoo is an Internet service provider (“ISP”). Although Verizon purchased Yahoo in 2017 and renamed the company Verizon Media, the parties and witnesses all refer to the company as Yahoo. Moreover, many of the events in question occurred before Verizon purchased Yahoo, and the witnesses and exhibits frequently refer to the company as Yahoo rather than Verizon Media. The Court follows suit.

         Sean Zadig, Senior Director of Cyber Defense at Verizon Media, has worked at Yahoo since 2014 and testified about Yahoo's operations. Tr. at 163:19-25. Prior to his current role, Zadig was the team lead for Yahoo's E-Crime Investigation Team (“ECIT”). Tr. at 165:1-7. Zadig testified that ECIT was formed “to investigate abuse on our user platforms, primarily violations of our terms of service.” Id. at 170:16-18. A user must agree to those terms of service (“TOS”) when the user creates a Yahoo account. Id. at 172:21-24. Yahoo's TOS states: “By accessing and using the Yahoo Services, you accept and agree to be bound by the terms and provision [sic] of the TOS.” Ex. Q at 8.

         On December 18, 2013, Defendant created the Yahoo user account jrwolfen02. Tr. at 168:23-169:2. Under the TOS in effect on that date, any user creating an account agreed not to transmit unlawful or obscene conduct over Yahoo's services: “You agree to not use the Yahoo Services to: a. upload, post, email, transmit, or otherwise make available any Content that is unlawful, harmful, threatening, abusive, harassing, tortious, defamatory, vulgar, obscene, libelous, invasive of another's privacy, hateful, or racially, ethnically, or otherwise objectionable.” Ex. Q at 10. A user also agreed not to use Yahoo's services to “harm minors in any way.” Id.

         When a user registers for certain Yahoo services, such as Yahoo Messenger, the user must agree to terms of service specific to those services. Tr. at 177:11-16. Yahoo Messenger's additional terms of service (“ATOS”) provide that “the user agrees not to use the services in any unlawful manner, for any unlawful purpose, or in any manner inconsistent with the ATOS or the TOS.” Ex. Q at 25. Accordingly, Zadig testified that Yahoo's TOS and the Messenger ATOS prohibit child pornography and child sexual abuse materials. Tr. at 180:17-21. Yahoo's TOS provides that Yahoo may screen content stored in user accounts to “comply with legal process” or “enforce the TOS, ” among other reasons. Ex. Q at 11, 19.

         Zadig offered multiple reasons why Yahoo prohibits child sexual abuse materials on its services. First, Yahoo “seek[s] to create a safe place for our users to engage in online conduct and to communicate with each other, to post and exchange ideas, ” but child pornography creates an unsafe environment for Yahoo's users, especially potential minor users. Id. at 182:20-22; 182:23-25. A person as young as 13 years old can create a Yahoo account. Id. at 186:6-8.

         Second, child pornography threatens Yahoo's advertising revenue stream. Id. at 183:1-4. Zadig testified that after Google detected child pornography on several blogs on Tumblr-which Yahoo owns-Google threatened to suspend Tumblr from Google's Adsense network. Id. at 184:9-14. In December 2018, Apple also temporarily blocked Tumblr's app from the Apple App Store “because Apple had detected child pornography on one single blog within the Tumblr ecosystem.” Id. at 184:15-20. Both actions posed a significant threat to Yahoo. Without a presence in the App Store, for example, no new mobile user could access Tumblr and view ads on Tumblr. Id. at 185:21-25. Yahoo's investigations of violations of its TOS and attempts to remove child pornography are factors that “allowed Apple to let us relist the Tumblr app on the App Store.” Id. at 367:19-25. Zadig also testified that advertisers had boycotted other ISPs as a result of child sex abuse material on those ISPs' services. Id. at 185:6-11.

         To enforce Yahoo's TOS, Yahoo's moderation team proactively scans accounts for child sexual abuse materials and reviews user-submitted reports of abuse. Id. at 186:21-187:1. After its review, the moderation team may, if required by statute, file a CyberTipline Report (“CyberTip”) with the National Center for Missing and Exploited Children (“NCMEC”). Id. at 187:1-3. Yahoo's ECIT reviews the submitted CyberTips for four criteria: (1) a child in imminent danger; (2) a user in a position of authority, such as a pastor, doctor, or school teacher; (3) a user with access to children; or (4) a user that is a sex offender with prior contact offenses. Id. at 191:14-21. If any of those four criteria are met, ECIT conducts a supplemental investigation of that account, related accounts, and publicly available information about the user. Id. at 191:22-192:1. Yahoo will also deactivate an account when Yahoo files a CyberTip. Id. at 331:15-19.

         2. NCMEC CyberTips Process

         NCMEC, the organization to whom Yahoo sends CyberTips, is a non-governmental organization in Alexandra, Virginia. Tr. at 373:17-21. By statute, any ISP like Yahoo is required to send CyberTips to NCMEC to report both “apparent” or “imminent” violations of child pornography statutes. 18 U.S.C. § 2258A(a). Zadig testified that not all child pornography-related information is reportable to NCMEC. For example, a request for children to perform sex acts over webcam is not, alone, reportable as a CyberTip. Tr. at 302:24-303:6. By contrast, images or video in an account, or text conversations regarding travel for the purpose of child abuse must be reported. Id. at 302:10-23.

         In turn, after NCMEC reviews the CyberTip, NCMEC must make CyberTips available to law enforcement, including “[a]ny Federal law enforcement agency that is involved in the investigation of child sexual exploitation.” 18 U.S.C. § 2258A(c)(1). An ISP's “knowing and willful failure to make a report” is punishable by a fine of up to $300, 000. Id. at § 2258A(e). According to FBI Special Agent Scott Schelble, NCMEC received approximately 1.5 million CyberTips each month while Schelble was detailed to NCMEC between 2013 and 2015. Tr. at 375:3-12.

         The FBI and other federal agencies have law enforcement agents stationed as liaisons at NCMEC. Id. at 393:11-17. Schelble testified that at NCMEC, the FBI assists NCMEC with identifying the victims in child pornography images because a victim must be identified for a federal prosecution to proceed. Id. at 375:22-376:10. The FBI also performs a “deconfliction” function to ensure that multiple federal agencies are not investigating the same target. Id. at 378:4-13.

         3. Yahoo's First Investigation of Webcam Sexual Abuse on Yahoo's Services

         In August 2014, Xoom, an online payment processing service, notified Yahoo that Xoom had identified ten Yahoo Messenger accounts in the Philippines with profile pictures of child pornography. Tr. at 193:24-194:8. Xoom told Yahoo that the ten Yahoo Messenger accounts appeared to be receiving payments “indicative of web streaming.” Id. at 194:3-5. According to Yahoo's Sean Zadig, Yahoo conduced a limited review and confirmed that the accounts “appeared to be engaged in the sale of live stream sexual abuse of children over Yahoo Messenger - Yahoo Messenger had a webcam feature which permitted this - as well as the sale of still photographs and videos, all of which appeared to be produced from the Philippines.” Id. at 194:22-195:2.

         Yahoo also determined that the ten Yahoo Messenger accounts were interacting with other Yahoo Messenger users who were attempting to buy the material:

So the sellers, or what we call people in the Philippines offering material for sale, they were saying that they had children of certain ages who could engage in sex shows via the Yahoo Messenger webcam feature. And we observed the buyers negotiating prices or asking for specific ages of children, some extremely young, some, you know, three, four, five, or even younger, as well as requesting that specific acts be, sexual acts be taken.

Id. at 196:19-197:1. Zadig testified that Yahoo was concerned that its services were being used for realtime abuse of children:

We were extremely concerned that - and upset that there was this live streamed realtime abuse of children happening essentially right now. We - that was - that's clearly not what the product had been envisioned to do. It had been envisioned to let people communicate with friends and family and share ideas and sort of do good things, and were rather upset that this was being used in such a horrible manner.

Id. at 198:22-199:4.

         In late September 2014 and early October 2014, Yahoo sent NCMEC CyberTips for the ten accounts that Xoom identified and other accounts that met NCMEC's reporting requirements. Id. at 199:5-14. Yahoo also sent NCMEC a supplemental report that described the relationship between the buyer and seller accounts. See ECF No. 119, Ex. KK. Zadig testified that Yahoo created the supplemental report, even though NCMEC did not require it, because “there are significant brand reputational and financial impacts that could affect the company if the disclosure of this activity became, you know, became public, ” such as users fleeing Yahoo services or advertisers choosing not to run ads. Id. at 200:1-8. Yahoo also “believed that children were being abused in realtime and we wanted to hurry and provide that quickly.” Id. at 200:11-13.

         The supplemental report referenced the Yahoo CyberTips and stated that Yahoo determined that approximately 115 accounts were sellers. Id. at 407. Yahoo's first supplemental report referred to approximately 203 “buyer” accounts that “appeared to be buying imagery, video, or live streams from the sellers.” Id. Yahoo then provided charts listing the seller accounts and buyer accounts. Id. at 408-14.

         On October 3, 2014, after Yahoo submitted its first batch of CyberTips on Philippines webcam child pornography to NCMEC, Yahoo contacted NCMEC and law enforcement to set up a meeting. ECF No. 147-3 (“Schelble Decl.”), ¶ 6. Because NCMEC receives CyberTips on an individual basis, and the Yahoo reports concerned “multiple users in multiple locations engaged in realtime abuse of children, ” Zadig testified that Zadig wanted to provide NCMEC and law enforcement “a full picture of what was happening” on Yahoo's platforms. Tr. at 201:21-202:3.

         On October 6, 2014, Yahoo met with NCMEC officials, FBI Special Agent Schelble, and Special Agent Neil O'Callaghan of Homeland Security Investigations (“HSI”) at NCMEC's offices. Schelble Decl. ¶ 6. At the meeting, Zadig provided hard copies of Yahoo's supplemental report and explained how Yahoo Messenger and its webcam feature function. Tr. at 202:10-24.

         5. FBI Opens Operation Swift Traveler

         After the October 6, 2014 meeting, Schelble and O'Callaghan agreed that the information in the Yahoo CyberTips and supplemental report to NCMEC warranted law enforcement investigation. Schelble Decl. ¶ 8; Tr. at 385:3-13. The FBI referred the matter to the FBI's Major Case Coordination Unit (“MCCU”). Id. FBI Special Agent Jeffrey Yesensky was assigned to the MCCU from approximately August 2014 to October 2017. Tr. at 7:3-6. On November 13, 2014, Yesensky opened Operation Swift Traveler (“OST”) to investigate Philippines webcam child pornography. ECF No. 119, Ex. X; Tr. at 14:3-7. Yesensky was MCCU's case agent on OST from November 2014 until October 2017. Id. at 13:20-22. Yesensky testified that during OST, he “had assistance at times from, I would say, one or at most two agents.” Id. at 13:1-5.

         MCCU is “a unit within FBI headquarters that conducts large scale international child exploitation investigations for the bureau, ” such as investigations involving multiple subjects or those that are resource intensive. Id. at 7:8-21. MCCU conducts initial investigations of potential child sexual abuse and then often refers the investigation to the relevant FBI field office. Id. at 8:10-20. MCCU also acts as a liaison with domestic and foreign law enforcement officials, as well as private organizations involved in preventing child sexual abuse. Id. at 9:10-20. Yesensky testified that discussions with private companies help the FBI understand how to seek information from those companies through legal process. Id. at 10:24-11:3.

         As OST launched, the FBI reviewed the accounts referenced in the Yahoo CyberTips and supplemental report. Id. at 15:4-17. Given OST's small staff, the FBI prioritized subjects that the FBI determined to be “exigent, ” such as prior offenders or those in a position of trust. Id. at 20:23-21:4. The FBI also prioritized seller accounts and buyer accounts with conduct that was recent and actionable. Id. at 21:15-22:1. The MCCU then developed a “lead package, ” which included any content observed in the accounts, and sent the information to the FBI field office where the target was located, or to a relevant international agency. Id. at 22:2-8. The FBI field office would then conduct the investigation, although Yesensky and the MCCU remained available to assist. Id. at 32:16-25. After the first set of Yahoo CyberTips to NCMEC, the FBI obtained approximately 30 search warrants-27 for sellers and 3 for buyers. Id. at 79:19-80:3.

         Yesensky occasionally reached out to Yahoo's Sean Zadig to clarify information around Yahoo's processes. ECF No. 119, Ex. Y. For example, in a phone call, Yesensky asked Zadig whether a Yahoo user is automatically assigned a Yahoo Messenger account. Id. at 1555-56.

         6. Yahoo's Second Investigation of Webcam Sexual Abuse on Yahoo's Services

         Yahoo continued to investigate Philippines webcam child sexual abuse on Yahoo's services. Zadig testified that Yahoo wanted to determine “if there was a rather large sort of ring or nest of this type of activity that we were unaware of and that could be lurking and pose a significant risk for our company.” Tr. at 204:1-7. Principally, Yahoo's second investigation sought to determine whether the buyers identified in Yahoo's first investigation were in communication with additional sellers-which they were. Id. at 205:7-14. After Yahoo found those new sellers, Yahoo identified new buyers and “tried to enumerate out as best as we could all the people involved in this type of conduct.” Id. at 205:15-20.

         After the second Yahoo investigation, Yahoo filed additional sets of CyberTips in late November 2014 and December 2014. Id. at 23:12-17. Yahoo prepared a second supplemental report to describe relationships between the buyer and seller accounts. Id. at 206:17-24. The second supplemental report listed 267 seller accounts and 347 buyer accounts, for a total of 614 accounts. ECF No. 119, Ex. DD.

         On December 10, 2014, Zadig emailed Yesensky to request a meeting with the FBI and NCMEC. Ex. RR at 1693. Zadig testified that he requested the meeting “to make sure that law enforcement understood how the investigation was initiated, how it was conducted, and then we had a legal representative so they could discuss how legal process could be served.” Id. at 207:19-22. Yahoo also wanted to ensure that law enforcement knew that in some cases, there was “imminent travel that was going to be occurring, or individuals who had traveled previously to abuse children personally.” Id. at 208:25-209:4.

         On December 12, 2014, Yahoo gave NCMEC its second supplemental report. Ex. RR at 2029. Zadig emailed Yesensky to inform him that Yahoo had submitted the second supplemental report, but stated that “our official data disclosure mechanism is through NCMEC so please contact them to get the data we provided.” Id.

         On December 16, 2014, Yesensky and other federal law enforcement officials met with Zadig and Yahoo Legal Director Chris Madsen at NCMEC. ECF No. 119, Ex. DD. Zadig provided an overview of the CyberTips and second supplemental report that Yahoo had already submitted to NCMEC. Id. at 1561-62, 1573. The second supplemental report stated that the 347 buyer accounts “appear to be purchasing images, video, or live streams from the above seller accounts.” ECF No. 89, Ex. E at 913.

         Of note, Yahoo's second supplemental report identified Defendant's jrwolfen02 account as a buyer account connected to “John Wolfenbarger” in Morgan Hill, California. Id. at 1574. Zadig testified that Yahoo determined that Defendant's account was in communication with two seller accounts, and that Defendant “was inquiring about, to my recollection, about the sale of child sex shows via webcam Messenger.” Tr. at 206:3-11. However, Yahoo filed no separate CyberTip for jrwolfen02, as Yahoo had not observed reportable conduct. Id. at 106:7-17. Zadig testified that a request for children to perform sex acts over webcam is not, alone, reportable as a CyberTip. Id. at 302:24-303:6.

         Yesensky testified that based on the information in the second supplemental report that the FBI received from NCMEC, Defendant was not high on the FBI's priority list. Id. at 158:18-159:1. Rather, the FBI again targeted seller accounts and priority buyers, or those engaged in recent and actionable conduct. Id. at 27:18-25. Through that process, the FBI acquired 68 more seller search warrants, which took approximately a year for the FBI to review because Yesensky had assistance from at most two other law enforcement agents from time to time. Id. at 28:7-17.

         7. Yahoo's Third Investigation of Child Sexual Abuse on Yahoo's Services

         In July 2015, Yahoo began a third investigation of child sexual abuse on its services. Yahoo launched the investigation after an FBI agent in Texas informed Zadig that a buyer identified in a previous Yahoo CyberTip had been arrested and “had spent approximately $50, 000 on child sex shows over the course of a few years.” Tr. at 213:20-25. Because most shows cost $50, Zadig and Yahoo were “concerned that that amount of money might indicate that there was an even greater webcam or sex trafficking problem on Yahoo Messenger” than Yahoo had thought after its second investigation. Id. at 214:5-8. For the third investigation, Yahoo started by reviewing accounts that had interacted with the Texas buyer and discovered hundreds of accounts in the Philippines, many of which were “engaged in the sale of live streamed child abuse or images or video.” Id. at 214:10-18. Through that process, Yahoo determined that Defendant's jrwolfen02 email account contained potential child pornography, and ECIT received authorization from Yahoo's legal team to review the contents of jrwolfen02 emails for the few days in which the account contained the child pornography images. Id. at 217:2-10.

         Upon that review, ECIT determined that Defendant had committed two violations of Yahoo's TOS: “The first was chat conversations describing an intent to purchase child abuse or, you know, web streamed child abuse; and the second was actually mail content in the user's mailbox containing actual child pornography.” Id. at 220:3-6. On November 30, 2015, Yahoo submitted CyberTip 7405007 on Defendant, along with the eight images identified in Defendant's account. ECF No. 28, Ex. D. Yahoo deactivated Defendant's Yahoo account in December 2015. Tr. at 338:20-22.

         Yahoo sent NCMEC CyberTips from its third investigation in November and December 2015. Id. at 224:23-25. Yahoo also sent NCMEC a third supplemental report about the connections between buyers and sellers, and Yahoo “highlighted the ones where we thought there was travel occurring, travel to the Philippines by the buyers.” Id. at 225:1-3.

         On January 5, 2016, Zadig emailed Yesensky to request a meeting. Ex. RR at 1647. On January 21, 2016, Zadig emailed Yesensky to inform him that Yahoo had submitted its third supplemental report to NCMEC, and that Yesensky should obtain the report from NCMEC. Ex. RR at 2063. On February 3, 2016, Yesensky and other law enforcement agents met with Zadig at NCMEC. Ex. HH. Zadig testified that at the meeting, Zadig again described how Yahoo conducted its investigation and Yahoo's more in-depth review of certain email accounts, which resulted in additional CyberTips. Tr. at 226:13-21. Because the third set of Yahoo CyberTips and third supplemental report that the FBI received from NCMEC identified approximately 250 buyer accounts and approximately 50 seller accounts, Yesensky testified the FBI again prioritized investigation of accounts engaged in recent and actionable conduct. Id. at 31:7-16.

         8. The FBI Prioritizes Defendant

         Yesensky testified that the FBI first became specifically aware of Defendant in February 2016 based on CyberTip 7405007. Tr. at 39:15-20; 44:15-19. The CyberTip stated that the incident type was “Child Pornography (possession, manufacture, and distribution)” and that Yahoo had observed and reviewed eight images of child pornography in an email dated December 2, 2013. ECF No. 28, Ex. D at 1073-75.

         On March 11, 2016, Yesensky sent a lead package on Defendant to the FBI's San Francisco field office. ECF No. 85, Ex. D. The lead package included CyberTip 7405007, the images included in the CyberTip, and records checks that MCCU conducted to determine that Defendant was the likely user of jrwolfen02. Id. at 1095; id. at 39:24-40:7. Later, Yesensky scanned the results of search warrants on OST seller accounts for the term “jrwolfen02” and discovered Yahoo Messenger chats between jrwolfen02 and approximately 11 webcam child pornography seller accounts in the Philippines. Id. at 40:10-15. Yesensky forwarded that additional information to the FBI's San Francisco field office on July 13, 2016. Ex. D at 1097.

         In 2016, FBI Special Agent Chris Marceau was assigned to the San Francisco field office and specifically to a San Jose unit that investigated violent crimes against children. Tr. at 402:3-8. Marceau testified that based on the lead package, the FBI served a search warrant for jrwolfen02 on Yahoo on May 9, 2016. Id. at 404:23-25; see ECF No. 28, Ex. A (search warrant). The search warrant application was signed by FBI Special Agent Ann Trombetta, who also submitted an affidavit with the warrant application. Id. at 11.

         In that affidavit, Trombetta explained that Yahoo's ECIT had conducted an investigation of Philippines webcam sexual abuse on Yahoo's services and had submitted CyberTips and supplemental reports to NCMEC. Id. ¶¶ 35-36. Trombetta attested that the FBI had obtained search warrants for several seller accounts beginning in February 2015. Id. ¶ 39. As to Defendant, Trombetta described the eight images in Defendant's account, which “all appeared to be photographs of two girls who appear to be under twelve years old, performing sexual acts on themselves.” Id. ¶ 38. Trombetta attested that Yahoo had reported the images in Defendant's account in a CyberTip on November 30, 2015. Id. ¶ 40. United States Magistrate Judge Nathanael Cousins issued the search warrant. Id. at 11.

         Special Agent Marceau testified that the search warrant on Defendant's Yahoo account returned “child exploitation images, videos, and still pictures, as well as numerous chats identifying the rape of children, the exploitation of minors, and numerous instances requesting more of the same.” Tr. at 405:14-17.

         After the FBI executed the search warrant, Marceau spoke with Defendant twice. First, Marceau spoke to Defendant on August 2, 2016 after Defendant arrived at San Francisco International Airport (“SFO”). Id. at 405:23-406:1. Second, Marceau spoke with Defendant on August 31, 2016 in the parking lot of a coffee shop in Morgan Hill, California. Id. at 406:6-17. Marceau testified that Defendant arrived voluntarily and “was helping us identify his victims so that we can recover those victims from being exploited by other subjects.” Id. at 407:17-19. Defendant executed an FD 1086 form with his consent for the FBI to assume Defendant's online identity and to search Defendant's Yahoo and AOL accounts. Id. at 407:21-410:21. However, none of Defendant's passwords worked, and the FBI was unable to assume Defendant's online identity. Tr. at 410:5-7.

         On December 15, 2016, Defendant was indicted. ECF No. 1.

         As of early 2019, OST remains ongoing, although Special Agent Kelly Clark has taken over for Yesensky. Tr. at 14:19-22. Yesensky estimated that during his time leading OST, MCCU sent “close to 200” lead packages to domestic FBI field offices and to international FBI partners. Id. at 33:4-11.

         As for Yahoo, ECIT conducted a fourth investigation of Philippines webcam child pornography on Yahoo services in 2018 after Xoom notified Yahoo of additional accounts that appeared to be engaged in webcam child sexual abuse. Id. at 227:2-9. ECIT sent CyberTips related to that investigation to NCMEC in April 2019. Id.

         B. Procedural History

         On December 15, 2016, a federal grand jury indicted Defendant on one count of attempted production of child pornography, in violation of 18 U.S.C. § 2251(c) and (e); one count of attempted coercion and enticement of minors, in violation of 18 U.S.C. § 2422(b); and one count of ...

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.