Home -> Law Blog Directory -> Academic Blogs -> CYB3RCRIM3

Academic

: CYB3RCRIM3

Kyllo and "A Forensic Software Program"

In a 2008 post, I talked about the U.S. Supreme Court?s decision in Kyllo v. U.S., 533 U.S. 27 (2001). I reviewed the holding in the case ? which involved law enforcement?s using a thermal imager to detect heat radiating from Danny Kyllo?s home.

As I noted in that post, the Supreme Court found it was a search for a federal agent to stand across the street from the garage and use the thermal imager to detect heat signatures emanating from the garage. The Court held that it is a 4^th Amendment ?search? to (i) use technology that is not in general public usage (ii) to detect information from inside a home. (Since the garage was, I believe, attached to Kyllo?s home, that made it part of the home for 4^th Amendment purposes.)

The Kyllo decision came down in 2001. I noted in 2008 that I was waiting for a case to apply the Kyllo (Nearly all of the cases involving the Kyllo standard deal with whether or not it applies to the use of drug detection dogs.) I finally found one. holding to the use of computer technology, including computer forensic software.

The case is U.S. v. Borowy, 2010 WL 537501 (U.S. Court of Appeals for the 9^th Circuit 2010) and here, according to the Court of Appeals, is how it arose:

On May 3, 2007, Special Agent Byron Mitchell logged onto LimeWire, a . . . peer-to-peer file-sharing computer program, to monitor trafficking in child pornography. Agent Mitchell conducted a keyword search in LimeWire using the term `Lolitaguy,? a term known to be associated with child pornography. From the list of results returned by this search, Agent Mitchell identified known images of child pornography using a software program that verifies the `hash marks? of files and displays a red flag next to known images of child pornography. At least one of these files was shared through what was later determined to be [Charles] Borowy's IP address.

Using the `browse host? feature of LimeWire, Agent Mitchell viewed a list of the names of all of the approximately 240 files being shared from Borowy's IP address, several of which were explicitly suggestive of child pornography and two of which were red-flagged. Agent Mitchell downloaded and viewed seven files from Borowy's IP address, four of which were child pornography. Prior to downloading the files, Agent Mitchell did not have access to the files' contents. Execution of a search warrant resulting from Agent Mitchell's investigation led to the seizure of Borowy's laptop computer, CDs, and floppy disks. Forensic examination of these items revealed more than six hundred images of child pornography, including seventy-five videos.

U.S. v. Borowy, supra. Borowy was indicted for distributing and possessing child pornography in violation of 18 U.S. Code § 2252A. Appellant?s Opening Brief, U.S. v. Borowy, 2009 WL 2898223. After being indicted, Borowy moved to suppress the evidence seized from his home, claiming that Mitchell?s

locating and downloading the files from LimeWire constituted a warrantless search and seizure without probable cause that violated Borowy's Fourth Amendment rights. Borowy argued that because he had purchased and installed a version of LimeWire that allows the user to prevent others from downloading or viewing the names of files on his computer and because he attempted to engage this feature, he had a reasonable expectation of privacy in the files. However, for whatever reason, this feature was not engaged when Mitchell downloaded the seven files from Borowy's computer, and there was no restriction on Mitchell's accessing those files. The district court refused to suppress the evidence, finding Mitchell's conduct was not a search under the Fourth Amendment and that Mitchell had probable cause to download the files.

U.S. v. Borowy, supra. Borowy pled guilty to possessing child pornography in violation of 18 U.S. Code § 2252A(a)(5)(B), but reserved his right to appeal the district court?s denial of his motion to suppress. U.S. v. Borowy, supra. The primary issue on appeal, therefore, was whether Mitchell?s accessing and downloading the files constituted a 4^th Amendment ?search.?

As I?ve explained in earlier posts, the standard courts use to determine if conduct constituted a search under the 4^th Amendment is the standard the Supreme Court articulated in Katz v. U.S., 389 U.S. 347 (1967). For law enforcement activity to constitute a ?search? under Katz it must violate an individual?s ?reasonable expectation of privacy? in a place or thing. To have a reasonable expectation of privacy under Katz, I must subjectively believe a place is private and society must accept my belief as objectively reasonable. If you want to read more about the application of the Katz standard, check out this post.

Lots of cases ? including lots of computer search cases ? involve the applicability of the Katz standard. That isn?t what makes the Borowy case interesting (and, ultimately, aggravating): What makes it interesting is that Borowy invoked the Supreme Court?s decision in Kyllo, along with Katz. What makes it aggravating is that the Kyllo argument wasn?t particularly well-developed.

Under Rule 28 of the Federal Rules of Appellate Procedure, three briefs (excluding any amicus briefs) are filed in an appeal from a decision of a federal district court: The first is the Appellant?s Brief, i.e., the brief filed by the party initiating the appeal; the second is the Appellee?s Brief, which is filed by the party who won below. The third and final brief is the Appellant?s Reply Brief, in which the Appellant responds to the arguments the Appellee made in its Reply Brief.

I don?t know if Borowy raised the Kyllo issue in his motion to suppress, but I suspect he didn?t. The reason I don?t think he raised it at the district court level is that he doesn?t seem to have raised it in his Appellant?s Brief (there?s no citation to Kyllo in that brief). Appellant?s Opening Brief, supra. He raised it in his Reply Brief, as you can see from this excerpt:

The development of tools that allow access to the home or items in the home - that are not available to the general public - exceed what the senses any member of the public could have used to detect the exposed material and thus become a search governed by the Fourth Amendment. The Supreme Court in Kyllo ruled that `[w]here, as here, the Government uses a device that is not in general public use, to explore details of the home that would previously have been unknowable without physical intrusion, the surveillance is a ?search?. . . . ? In Kyllo, the court found that the use of thermal imaging device . . . violated the Fourth Amendment. . . . Without the forensic analysis it is not readily apparent the item is contraband. This was true even though the heat signature via the outside of the home was obviously exposed to the public. The point was that the intrusion revealed intimate details of the home.

Here the agent ran the forensic hashmark program on 240 files. The computer in this case was inside the home. The government intruded by means of a forensic program to which the average member of the public does not have access.

U.S. v. Borowy, supra. The Kyllo argument seems to have been meant to rebut the argument the prosecution made in its Appellee?s Brief (and probably in its opposition to the motion to suppress), i.e., that what Mitchell did wasn?t a 4^th Amendment search because Borowy made the files publicly accessible. As I?ve noted in earlier posts, that argument has, as far as I can tell, consistently succeeded in cases in which officers use P2P software to locate child porn on someone?s computers.

The rather belated Kyllo argument ultimately didn?t help Borowy with his appeal. The 9^th Circuit Court of Appeals brusquely rejected the argument, as such:

Borowy argues that the use of a `forensic software program? that is unavailable to the general public to confirm that the files contained child pornography rendered Mitchell's conduct an unlawful Fourth Amendment search. We disagree. Borowy had already exposed the entirety of the contents of his files to the public, negating any reasonable expectation of privacy in those files. . . . Moreover, the hash-mark analysis appears to disclose only whether the files in the list that Mitchell's keyword search returned were known child pornography. . . . In this context, the hash-mark analysis functioned simply as a sorting mechanism to prevent the government from having to sift, one by one, through Borowy's already publically exposed files.

U.S. v. Borowy, supra. The Court of Appeals noted, however, that it wasn?t closing the door on future Kyllo arguments involving computer forensic software:

We do not rule on whether, if confronted with different facts -- for example, where the information was not already exposed to the public at large, where the hash-mark analysis might reveal more than whether a file is known child pornography, or where the government `vacuumed? vast quantities of data indiscriminately -- we might find a Fourth Amendment violation. Here we are presented only with the limited case of a targeted search of publicly exposed information for known items of contraband.

U.S. v. Borowy, supra. The actual outcome in the case doesn?t really aggravate me; what aggravates me is the cursory treatment Borowy and the Court of Appeals gave the Kyllo argument.

At one level, a Kyllo argument seems a viable option in circumstances like those at issue in the Borowy case because they are analogous to the circumstances at issue in Kyllo, at least in one respect.

In both instances, law enforcement captures information that is being broadcast from inside a home (the most sacrosanct ?place? for 4^th Amendment purposes). The Kyllo Court found, correctly IMHO, that the fact the officer was outside the home when he captured the heat signatures emanating from Kyllo?s home did not prevent his actions from constituting a 4^th Amendment search. Any other result would take us back to the bad old days when Olmstead was the law. (As I?ve noted in other posts, in Olmstead v. U.S. the Supreme Court held it wasn?t a search for federal agents to use a tap on a phone line outside Olmstead?s home to listen in on his phone calls. The Supreme Court reversed Olmstead in Katz.)

I?m not, however, sure a viable Kyllo argument is possible when it?s directed at law enforcement?s using P2P software to access files someone has made available for sharing online. Like other defendants who?ve been caught because they were sharing child porn via P2P networks, Borowy claimed he didn?t realize he was sharing files because he thought he?d disabled the file-sharing feature.

Even if we accept Borowy?s argument at face value, it seems to me the P2P scenario is distinguishable from the scenario at issue in Kyllo in at least one important respect: Danny Kyllo?s broadcasting waste heat into the external atmosphere wasn?t a volitional act. Kyllo?s buying a house with a furnace and/or installing a furnace was a volitional act, just as Borowy?s buying LimeWire was a volitional act, but from there on, IMHO, the two scenarios differ. Borowy had the ability to eliminate his computer?s ability to share files (and file names) via LimeWire but failed to exercise this ability. Like the rest of us, Danny Kyllo didn?t have the ability to prevent his home (and/or garage) from emanating waste heat; as far as I know, there?s no way to prevent a structure from radiating heat, and I gather we wouldn?t want to do that if we could. As I understand it, we?d suffer some unpleasant effects from heat exhaustion, etc.

My point is that Borowy not only knew he was exposing file information online, he was responsible for his computer?s ability to do just that. Since he was, in effect, knowingly broadcasting that information outside his home, I don?t see Borowy can complain when a law enforcement officer picks up on his broadcast. (I?m inferring, maybe extrapolating, knowledge from his having the program installed; I?m assuming he must have noticed, at some point, that the file-sharing function was active.) So I guess I basically agree with the 9^th Circuit; I just wish they?d provided a more detailed analysis of the issue.

And yes, I still think there can be viable Kyllo arguments as to other uses of computer forensic software. I?m still waiting for one.

Full post as published by CYB3RCRIM3 on February 22, 2010 (boomark / email).