United States District Court, N.D. California, San Jose Division
AMENDED ORDER DENYING DEFENDANT'S MOTIONS TO
SUPPRESS RE: DKT. NOS. 183, 184
H. KOH, UNITED STATES DISTRICT JUDGE
order vacates and supersedes ECF No. 207, which was filed on
August 29, 2019.
federal grand jury indicted Defendant Johnny Ray Wolfenbarger
(“Defendant”) on one count of attempted
production of child pornography, in violation of 18 U.S.C.
§ 2251(c) and (e); one count of attempted coercion and
enticement of minors, in violation of 18 U.S.C. §
2422(b); and one count of receipt of child pornography, in
violation of 18 U.S.C. § 2252(a)(2). ECF No. 1.
the Court are two motions to suppress filed by Defendant. In
one, Defendant seeks to suppress evidence seized from
Defendant's Yahoo email account on the basis that Yahoo
acted as a government agent pursuant to the Fourth Amendment
and United States v. Walther, 652 F.2d 788 (9th Cir.
1981). In the other, Defendant seeks to suppress all evidence
pursuant to Franks v. Delaware, 438 U.S. 154 (1978).
The Court held an evidentiary hearing on July 12, 2019 and
July 23, 2019. See ECF Nos. 199, 203. Having
considered the briefs and declarations, the testimony from
the evidentiary hearing, the relevant law, and the record in
this case, the Court DENIES both of Defendant's motions
Yahoo's Enforcement of its Terms of Service
is an Internet service provider (“ISP”). Although
Verizon purchased Yahoo in 2017 and renamed the company
Verizon Media, the parties and witnesses all refer to the
company as Yahoo. Moreover, many of the events in question
occurred before Verizon purchased Yahoo, and the witnesses
and exhibits frequently refer to the company as Yahoo rather
than Verizon Media. The Court follows suit.
Zadig, Senior Director of Cyber Defense at Verizon Media, has
worked at Yahoo since 2014 and testified about Yahoo's
operations. Tr. at 163:19-25. Prior to his current role,
Zadig was the team lead for Yahoo's E-Crime Investigation
Team (“ECIT”). Tr. at 165:1-7. Zadig testified
that ECIT was formed “to investigate abuse on our user
platforms, primarily violations of our terms of
service.” Id. at 170:16-18. A user must agree
to those terms of service (“TOS”) when the user
creates a Yahoo account. Id. at 172:21-24.
Yahoo's TOS states: “By accessing and using the
Yahoo Services, you accept and agree to be bound by the terms
and provision [sic] of the TOS.” Ex. Q at 8.
December 18, 2013, Defendant created the Yahoo user account
jrwolfen02. Tr. at 168:23-169:2. Under the TOS in effect on
that date, any user creating an account agreed not to
transmit unlawful or obscene conduct over Yahoo's
services: “You agree to not use the Yahoo Services to:
a. upload, post, email, transmit, or otherwise make available
any Content that is unlawful, harmful, threatening, abusive,
harassing, tortious, defamatory, vulgar, obscene, libelous,
invasive of another's privacy, hateful, or racially,
ethnically, or otherwise objectionable.” Ex. Q at 10. A
user also agreed not to use Yahoo's services to
“harm minors in any way.” Id.
user registers for certain Yahoo services, such as Yahoo
Messenger, the user must agree to terms of service specific
to those services. Tr. at 177:11-16. Yahoo Messenger's
additional terms of service (“ATOS”) provide that
“the user agrees not to use the services in any
unlawful manner, for any unlawful purpose, or in any manner
inconsistent with the ATOS or the TOS.” Ex. Q at 25.
Accordingly, Zadig testified that Yahoo's TOS and the
Messenger ATOS prohibit child pornography and child sexual
abuse materials. Tr. at 180:17-21. Yahoo's TOS provides
that Yahoo may screen content stored in user accounts to
“comply with legal process” or “enforce the
TOS, ” among other reasons. Ex. Q at 11, 19.
offered multiple reasons why Yahoo prohibits child sexual
abuse materials on its services. First, Yahoo “seek[s]
to create a safe place for our users to engage in online
conduct and to communicate with each other, to post and
exchange ideas, ” but child pornography creates an
unsafe environment for Yahoo's users, especially
potential minor users. Id. at 182:20-22; 182:23-25.
A person as young as 13 years old can create a Yahoo account.
Id. at 186:6-8.
child pornography threatens Yahoo's advertising revenue
stream. Id. at 183:1-4. Zadig testified that after
Google detected child pornography on several blogs on
Tumblr-which Yahoo owns-Google threatened to suspend Tumblr
from Google's Adsense network. Id. at 184:9-14.
In December 2018, Apple also temporarily blocked Tumblr's
app from the Apple App Store “because Apple had
detected child pornography on one single blog within the
Tumblr ecosystem.” Id. at 184:15-20. Both
actions posed a significant threat to Yahoo. Without a
presence in the App Store, for example, no new mobile user
could access Tumblr and view ads on Tumblr. Id. at
185:21-25. Yahoo's investigations of violations of its
TOS and attempts to remove child pornography are factors that
“allowed Apple to let us relist the Tumblr app on the
App Store.” Id. at 367:19-25. Zadig also
testified that advertisers had boycotted other ISPs as a
result of child sex abuse material on those ISPs'
services. Id. at 185:6-11.
enforce Yahoo's TOS, Yahoo's moderation team
proactively scans accounts for child sexual abuse materials
and reviews user-submitted reports of abuse. Id. at
186:21-187:1. After its review, the moderation team may, if
required by statute, file a CyberTipline Report
(“CyberTip”) with the National Center for Missing
and Exploited Children (“NCMEC”). Id. at
187:1-3. Yahoo's ECIT reviews the submitted CyberTips for
four criteria: (1) a child in imminent danger; (2) a user in
a position of authority, such as a pastor, doctor, or school
teacher; (3) a user with access to children; or (4) a user
that is a sex offender with prior contact offenses.
Id. at 191:14-21. If any of those four criteria are
met, ECIT conducts a supplemental investigation of that
account, related accounts, and publicly available information
about the user. Id. at 191:22-192:1. Yahoo will also
deactivate an account when Yahoo files a CyberTip.
Id. at 331:15-19.
NCMEC CyberTips Process
the organization to whom Yahoo sends CyberTips, is a
non-governmental organization in Alexandra, Virginia. Tr. at
373:17-21. By statute, any ISP like Yahoo is required to send
CyberTips to NCMEC to report both “apparent” or
“imminent” violations of child pornography
statutes. 18 U.S.C. § 2258A(a). Zadig testified that not
all child pornography-related information is reportable to
NCMEC. For example, a request for children to perform sex
acts over webcam is not, alone, reportable as a CyberTip. Tr.
at 302:24-303:6. By contrast, images or video in an account,
or text conversations regarding travel for the purpose of
child abuse must be reported. Id. at 302:10-23.
turn, after NCMEC reviews the CyberTip, NCMEC must make
CyberTips available to law enforcement, including
“[a]ny Federal law enforcement agency that is involved
in the investigation of child sexual exploitation.” 18
U.S.C. § 2258A(c)(1). An ISP's “knowing and
willful failure to make a report” is punishable by a
fine of up to $300, 000. Id. at § 2258A(e).
According to FBI Special Agent Scott Schelble, NCMEC received
approximately 1.5 million CyberTips each month while Schelble
was detailed to NCMEC between 2013 and 2015. Tr. at 375:3-12.
and other federal agencies have law enforcement agents
stationed as liaisons at NCMEC. Id. at 393:11-17.
Schelble testified that at NCMEC, the FBI assists NCMEC with
identifying the victims in child pornography images because a
victim must be identified for a federal prosecution to
proceed. Id. at 375:22-376:10. The FBI also performs
a “deconfliction” function to ensure that
multiple federal agencies are not investigating the same
target. Id. at 378:4-13.
Yahoo's First Investigation of Webcam Sexual Abuse on
August 2014, Xoom, an online payment processing service,
notified Yahoo that Xoom had identified ten Yahoo Messenger
accounts in the Philippines with profile pictures of child
pornography. Tr. at 193:24-194:8. Xoom told Yahoo that the
ten Yahoo Messenger accounts appeared to be receiving
payments “indicative of web streaming.”
Id. at 194:3-5. According to Yahoo's Sean Zadig,
Yahoo conduced a limited review and confirmed that the
accounts “appeared to be engaged in the sale of live
stream sexual abuse of children over Yahoo Messenger - Yahoo
Messenger had a webcam feature which permitted this - as well
as the sale of still photographs and videos, all of which
appeared to be produced from the Philippines.”
Id. at 194:22-195:2.
also determined that the ten Yahoo Messenger accounts were
interacting with other Yahoo Messenger users who were
attempting to buy the material:
So the sellers, or what we call people in the Philippines
offering material for sale, they were saying that they had
children of certain ages who could engage in sex shows via
the Yahoo Messenger webcam feature. And we observed the
buyers negotiating prices or asking for specific ages of
children, some extremely young, some, you know, three, four,
five, or even younger, as well as requesting that specific
acts be, sexual acts be taken.
Id. at 196:19-197:1. Zadig testified that Yahoo was
concerned that its services were being used for realtime
abuse of children:
We were extremely concerned that - and upset that there was
this live streamed realtime abuse of children happening
essentially right now. We - that was - that's clearly not
what the product had been envisioned to do. It had been
envisioned to let people communicate with friends and family
and share ideas and sort of do good things, and were rather
upset that this was being used in such a horrible manner.
Id. at 198:22-199:4.
September 2014 and early October 2014, Yahoo sent NCMEC
CyberTips for the ten accounts that Xoom identified and other
accounts that met NCMEC's reporting requirements.
Id. at 199:5-14. Yahoo also sent NCMEC a
supplemental report that described the relationship between
the buyer and seller accounts. See ECF No. 119, Ex.
KK. Zadig testified that Yahoo created the supplemental
report, even though NCMEC did not require it, because
“there are significant brand reputational and financial
impacts that could affect the company if the disclosure of
this activity became, you know, became public, ” such
as users fleeing Yahoo services or advertisers choosing not
to run ads. Id. at 200:1-8. Yahoo also
“believed that children were being abused in realtime
and we wanted to hurry and provide that quickly.”
Id. at 200:11-13.
supplemental report referenced the Yahoo CyberTips and stated
that Yahoo determined that approximately 115 accounts were
sellers. Id. at 407. Yahoo's first supplemental
report referred to approximately 203 “buyer”
accounts that “appeared to be buying imagery, video, or
live streams from the sellers.” Id. Yahoo then
provided charts listing the seller accounts and buyer
accounts. Id. at 408-14.
October 3, 2014, after Yahoo submitted its first batch of
CyberTips on Philippines webcam child pornography to NCMEC,
Yahoo contacted NCMEC and law enforcement to set up a
meeting. ECF No. 147-3 (“Schelble Decl.”), ¶
6. Because NCMEC receives CyberTips on an individual basis,
and the Yahoo reports concerned “multiple users in
multiple locations engaged in realtime abuse of children,
” Zadig testified that Zadig wanted to provide NCMEC
and law enforcement “a full picture of what was
happening” on Yahoo's platforms. Tr. at
October 6, 2014, Yahoo met with NCMEC officials, FBI Special
Agent Schelble, and Special Agent Neil O'Callaghan of
Homeland Security Investigations (“HSI”) at
NCMEC's offices. Schelble Decl. ¶ 6. At the meeting,
Zadig provided hard copies of Yahoo's supplemental report
and explained how Yahoo Messenger and its webcam feature
function. Tr. at 202:10-24.
FBI Opens Operation Swift Traveler
the October 6, 2014 meeting, Schelble and O'Callaghan
agreed that the information in the Yahoo CyberTips and
supplemental report to NCMEC warranted law enforcement
investigation. Schelble Decl. ¶ 8; Tr. at 385:3-13. The
FBI referred the matter to the FBI's Major Case
Coordination Unit (“MCCU”). Id. FBI
Special Agent Jeffrey Yesensky was assigned to the MCCU from
approximately August 2014 to October 2017. Tr. at 7:3-6. On
November 13, 2014, Yesensky opened Operation Swift Traveler
(“OST”) to investigate Philippines webcam child
pornography. ECF No. 119, Ex. X; Tr. at 14:3-7. Yesensky was
MCCU's case agent on OST from November 2014 until October
2017. Id. at 13:20-22. Yesensky testified that
during OST, he “had assistance at times from, I would
say, one or at most two agents.” Id. at
“a unit within FBI headquarters that conducts large
scale international child exploitation investigations for the
bureau, ” such as investigations involving multiple
subjects or those that are resource intensive. Id.
at 7:8-21. MCCU conducts initial investigations of potential
child sexual abuse and then often refers the investigation to
the relevant FBI field office. Id. at 8:10-20. MCCU
also acts as a liaison with domestic and foreign law
enforcement officials, as well as private organizations
involved in preventing child sexual abuse. Id. at
9:10-20. Yesensky testified that discussions with private
companies help the FBI understand how to seek information
from those companies through legal process. Id. at
launched, the FBI reviewed the accounts referenced in the
Yahoo CyberTips and supplemental report. Id. at
15:4-17. Given OST's small staff, the FBI prioritized
subjects that the FBI determined to be “exigent,
” such as prior offenders or those in a position of
trust. Id. at 20:23-21:4. The FBI also prioritized
seller accounts and buyer accounts with conduct that was
recent and actionable. Id. at 21:15-22:1. The MCCU
then developed a “lead package, ” which included
any content observed in the accounts, and sent the
information to the FBI field office where the target was
located, or to a relevant international agency. Id.
at 22:2-8. The FBI field office would then conduct the
investigation, although Yesensky and the MCCU remained
available to assist. Id. at 32:16-25. After the
first set of Yahoo CyberTips to NCMEC, the FBI obtained
approximately 30 search warrants-27 for sellers and 3 for
buyers. Id. at 79:19-80:3.
occasionally reached out to Yahoo's Sean Zadig to clarify
information around Yahoo's processes. ECF No. 119, Ex. Y.
For example, in a phone call, Yesensky asked Zadig whether a
Yahoo user is automatically assigned a Yahoo Messenger
account. Id. at 1555-56.
Yahoo's Second Investigation of Webcam Sexual Abuse on
continued to investigate Philippines webcam child sexual
abuse on Yahoo's services. Zadig testified that Yahoo
wanted to determine “if there was a rather large sort
of ring or nest of this type of activity that we were unaware
of and that could be lurking and pose a significant risk for
our company.” Tr. at 204:1-7. Principally, Yahoo's
second investigation sought to determine whether the buyers
identified in Yahoo's first investigation were in
communication with additional sellers-which they were.
Id. at 205:7-14. After Yahoo found those new
sellers, Yahoo identified new buyers and “tried to
enumerate out as best as we could all the people involved in
this type of conduct.” Id. at 205:15-20.
the second Yahoo investigation, Yahoo filed additional sets
of CyberTips in late November 2014 and December 2014.
Id. at 23:12-17. Yahoo prepared a second
supplemental report to describe relationships between the
buyer and seller accounts. Id. at 206:17-24. The
second supplemental report listed 267 seller accounts and 347
buyer accounts, for a total of 614 accounts. ECF No. 119, Ex.
December 10, 2014, Zadig emailed Yesensky to request a
meeting with the FBI and NCMEC. Ex. RR at 1693. Zadig
testified that he requested the meeting “to make sure
that law enforcement understood how the investigation was
initiated, how it was conducted, and then we had a legal
representative so they could discuss how legal process could
be served.” Id. at 207:19-22. Yahoo also
wanted to ensure that law enforcement knew that in some
cases, there was “imminent travel that was going to be
occurring, or individuals who had traveled previously to
abuse children personally.” Id. at
December 12, 2014, Yahoo gave NCMEC its second supplemental
report. Ex. RR at 2029. Zadig emailed Yesensky to inform him
that Yahoo had submitted the second supplemental report, but
stated that “our official data disclosure mechanism is
through NCMEC so please contact them to get the data we
December 16, 2014, Yesensky and other federal law enforcement
officials met with Zadig and Yahoo Legal Director Chris
Madsen at NCMEC. ECF No. 119, Ex. DD. Zadig provided an
overview of the CyberTips and second supplemental report that
Yahoo had already submitted to NCMEC. Id. at
1561-62, 1573. The second supplemental report stated that the
347 buyer accounts “appear to be purchasing images,
video, or live streams from the above seller accounts.”
ECF No. 89, Ex. E at 913.
note, Yahoo's second supplemental report identified
Defendant's jrwolfen02 account as a buyer account
connected to “John Wolfenbarger” in Morgan Hill,
California. Id. at 1574. Zadig testified that Yahoo
determined that Defendant's account was in communication
with two seller accounts, and that Defendant “was
inquiring about, to my recollection, about the sale of child
sex shows via webcam Messenger.” Tr. at 206:3-11.
However, Yahoo filed no separate CyberTip for jrwolfen02, as
Yahoo had not observed reportable conduct. Id. at
106:7-17. Zadig testified that a request for children to
perform sex acts over webcam is not, alone, reportable as a
CyberTip. Id. at 302:24-303:6.
testified that based on the information in the second
supplemental report that the FBI received from NCMEC,
Defendant was not high on the FBI's priority list.
Id. at 158:18-159:1. Rather, the FBI again targeted
seller accounts and priority buyers, or those engaged in
recent and actionable conduct. Id. at 27:18-25.
Through that process, the FBI acquired 68 more seller search
warrants, which took approximately a year for the FBI to
review because Yesensky had assistance from at most two other
law enforcement agents from time to time. Id. at
Yahoo's Third Investigation of Child Sexual Abuse on
2015, Yahoo began a third investigation of child sexual abuse
on its services. Yahoo launched the investigation after an
FBI agent in Texas informed Zadig that a buyer identified in
a previous Yahoo CyberTip had been arrested and “had
spent approximately $50, 000 on child sex shows over the
course of a few years.” Tr. at 213:20-25. Because most
shows cost $50, Zadig and Yahoo were “concerned that
that amount of money might indicate that there was an even
greater webcam or sex trafficking problem on Yahoo
Messenger” than Yahoo had thought after its second
investigation. Id. at 214:5-8. For the third
investigation, Yahoo started by reviewing accounts that had
interacted with the Texas buyer and discovered hundreds of
accounts in the Philippines, many of which were
“engaged in the sale of live streamed child abuse or
images or video.” Id. at 214:10-18. Through
that process, Yahoo determined that Defendant's
jrwolfen02 email account contained potential child
pornography, and ECIT received authorization from Yahoo's
legal team to review the contents of jrwolfen02 emails for
the few days in which the account contained the child
pornography images. Id. at 217:2-10.
that review, ECIT determined that Defendant had committed two
violations of Yahoo's TOS: “The first was chat
conversations describing an intent to purchase child abuse
or, you know, web streamed child abuse; and the second was
actually mail content in the user's mailbox containing
actual child pornography.” Id. at 220:3-6. On
November 30, 2015, Yahoo submitted CyberTip 7405007 on
Defendant, along with the eight images identified in
Defendant's account. ECF No. 28, Ex. D. Yahoo deactivated
Defendant's Yahoo account in December 2015. Tr. at
sent NCMEC CyberTips from its third investigation in November
and December 2015. Id. at 224:23-25. Yahoo also sent
NCMEC a third supplemental report about the connections
between buyers and sellers, and Yahoo “highlighted the
ones where we thought there was travel occurring, travel to
the Philippines by the buyers.” Id. at
January 5, 2016, Zadig emailed Yesensky to request a meeting.
Ex. RR at 1647. On January 21, 2016, Zadig emailed Yesensky
to inform him that Yahoo had submitted its third supplemental
report to NCMEC, and that Yesensky should obtain the report
from NCMEC. Ex. RR at 2063. On February 3, 2016, Yesensky and
other law enforcement agents met with Zadig at NCMEC. Ex. HH.
Zadig testified that at the meeting, Zadig again described
how Yahoo conducted its investigation and Yahoo's more
in-depth review of certain email accounts, which resulted in
additional CyberTips. Tr. at 226:13-21. Because the third set
of Yahoo CyberTips and third supplemental report that the FBI
received from NCMEC identified approximately 250 buyer
accounts and approximately 50 seller accounts, Yesensky
testified the FBI again prioritized investigation of accounts
engaged in recent and actionable conduct. Id. at
The FBI Prioritizes Defendant
testified that the FBI first became specifically aware of
Defendant in February 2016 based on CyberTip 7405007. Tr. at
39:15-20; 44:15-19. The CyberTip stated that the incident
type was “Child Pornography (possession, manufacture,
and distribution)” and that Yahoo had observed and
reviewed eight images of child pornography in an email dated
December 2, 2013. ECF No. 28, Ex. D at 1073-75.
March 11, 2016, Yesensky sent a lead package on Defendant to
the FBI's San Francisco field office. ECF No. 85, Ex. D.
The lead package included CyberTip 7405007, the images
included in the CyberTip, and records checks that MCCU
conducted to determine that Defendant was the likely user of
jrwolfen02. Id. at 1095; id. at 39:24-40:7.
Later, Yesensky scanned the results of search warrants on OST
seller accounts for the term “jrwolfen02” and
discovered Yahoo Messenger chats between jrwolfen02 and
approximately 11 webcam child pornography seller accounts in
the Philippines. Id. at 40:10-15. Yesensky forwarded
that additional information to the FBI's San Francisco
field office on July 13, 2016. Ex. D at 1097.
2016, FBI Special Agent Chris Marceau was assigned to the San
Francisco field office and specifically to a San Jose unit
that investigated violent crimes against children. Tr. at
402:3-8. Marceau testified that based on the lead package,
the FBI served a search warrant for jrwolfen02 on Yahoo on
May 9, 2016. Id. at 404:23-25; see ECF No.
28, Ex. A (search warrant). The search warrant application
was signed by FBI Special Agent Ann Trombetta, who also
submitted an affidavit with the warrant application.
Id. at 11.
affidavit, Trombetta explained that Yahoo's ECIT had
conducted an investigation of Philippines webcam sexual abuse
on Yahoo's services and had submitted CyberTips and
supplemental reports to NCMEC. Id. ¶¶
35-36. Trombetta attested that the FBI had obtained search
warrants for several seller accounts beginning in February
2015. Id. ¶ 39. As to Defendant, Trombetta
described the eight images in Defendant's account, which
“all appeared to be photographs of two girls who appear
to be under twelve years old, performing sexual acts on
themselves.” Id. ¶ 38. Trombetta attested
that Yahoo had reported the images in Defendant's account
in a CyberTip on November 30, 2015. Id. ¶ 40.
United States Magistrate Judge Nathanael Cousins issued the
search warrant. Id. at 11.
Agent Marceau testified that the search warrant on
Defendant's Yahoo account returned “child
exploitation images, videos, and still pictures, as well as
numerous chats identifying the rape of children, the
exploitation of minors, and numerous instances requesting
more of the same.” Tr. at 405:14-17.
the FBI executed the search warrant, Marceau spoke with
Defendant twice. First, Marceau spoke to Defendant on August
2, 2016 after Defendant arrived at San Francisco
International Airport (“SFO”). Id. at
405:23-406:1. Second, Marceau spoke with Defendant on August
31, 2016 in the parking lot of a coffee shop in Morgan Hill,
California. Id. at 406:6-17. Marceau testified that
Defendant arrived voluntarily and “was helping us
identify his victims so that we can recover those victims
from being exploited by other subjects.” Id.
at 407:17-19. Defendant executed an FD 1086 form with his
consent for the FBI to assume Defendant's online identity
and to search Defendant's Yahoo and AOL accounts.
Id. at 407:21-410:21. However, none of
Defendant's passwords worked, and the FBI was unable to
assume Defendant's online identity. Tr. at 410:5-7.
December 15, 2016, Defendant was indicted. ECF No. 1.
early 2019, OST remains ongoing, although Special Agent Kelly
Clark has taken over for Yesensky. Tr. at 14:19-22. Yesensky
estimated that during his time leading OST, MCCU sent
“close to 200” lead packages to domestic FBI
field offices and to international FBI partners. Id.
Yahoo, ECIT conducted a fourth investigation of Philippines
webcam child pornography on Yahoo services in 2018 after Xoom
notified Yahoo of additional accounts that appeared to be
engaged in webcam child sexual abuse. Id. at
227:2-9. ECIT sent CyberTips related to that investigation to
NCMEC in April 2019. Id.
December 15, 2016, a federal grand jury indicted Defendant on
one count of attempted production of child pornography, in
violation of 18 U.S.C. § 2251(c) and (e); one count of
attempted coercion and enticement of minors, in violation of
18 U.S.C. § 2422(b); and one count of ...