Searching over 5,500,000 cases.


searching
Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

United States v. Owens

United States District Court, E.D. Wisconsin

December 18, 2019

UNITED STATES OF AMERICA, Plaintiff,
v.
THOMAS J. OWENS, Defendant.

          ORDER DENYING MOTION TO COMPEL

          William C. Griesbach, District Judge

         Defendant Thomas J. Owens has been charged by a Grand Jury with Distribution and Possession of Child Pornography in violation of 18 U.S.C. § 2252A(a)(2) and (5)(B). The charges grew out of an investigation conducted by the Oshkosh Police Department over the BitTorrent Network where individuals are known to share child pornography. In conducting its investigation, Oshkosh police officers used an investigative software program called “Torrential Downpour Receptor” (TDR), which is designed to connect to the BitTorrent Network and identify IP addresses for computers that make available shared folders containing files with hash values known to be associated with child pornography. After TDR detected and downloaded targeted hash values depicting child pornography at an IP address later identified with Owens' residence, a search warrant was executed, during which officers obtained thousands of depictions of child pornography. Notwithstanding the discovery of numerous other depictions of child pornography on Owens' computer, law enforcement was unable to locate the child pornography video that it downloaded from his computer and that forms the basis of the distribution charge against him. Owens argues this is evidence that he never possessed that video and that TDR is defective.

         Presently before the court is the defendant's motion to compel the government to disclose to the defense “copies of (or other satisfactory access to) all investigative software programs used in the case, including all supporting documents such as user's manuals, technical specifications and white papers related to any software used.” Dkt. No. 19. Owens contends that copies of the investigative software programs used by law enforcement are necessary for him to conduct his defense. More specifically, Owens notes that the child pornography he is alleged to have distributed to the undercover agent was not found on his computer. He suggests that evidence of the software program and how it operates may assist his expert in explaining how law enforcement may have erroneously concluded that he was distributing such material. Owens also contends that the information requested is necessary in order for him to assess whether there was any intrusion of his personal property, in violation of the Fourth Amendment, leading to the discovery of evidence that provided the basis of the warrant utilized to search his home and computers. For these and other reasons, Owens requests that the government be directed to disclose the investigative BitTorrent software TDR, as well as related documents.

         The government opposes Owens' motion on the ground that the information sought is not material to the defense and is protected under the law enforcement investigatory privilege. The law enforcement investigatory privilege is a qualified, common law privilege protecting law enforcement investigatory files from discovery. Dellwood Farms, Inc. v. Cargill, Inc., 128 F.3d 1122, 1126 (7th Cir. 1997). “The purpose of this privilege is to prevent disclosure of law enforcement techniques and procedures, to preserve the confidentiality of sources, to protect witness and law enforcement personnel, to safeguard the privacy of individuals involved in an investigation, and otherwise to prevent interference with an investigation.” In re Dept. of Inv. of City of N.Y., 856 F.2d 481, 484 (2d Cir. 1988); see also United States v. Winner, 641 F.2d 825, 831 (10th Cir. 1981) (“The law enforcement investigative privilege is based primarily on the harm to law enforcement efforts which might arise from public disclosure of . . . investigatory files.”). The government contends that disclosure of the information Owens seeks in this case would result in irreversible harm to pending and ongoing criminal investigations. The government further contends that the likely harm to its investigative ability far outweighs any benefit Owens might receive from disclosure of the information.

         Finding itself unable to decide Owens' motion without a more complete development of the record, the court held an evidentiary hearing on the motion on August 14, 2019, at which it heard testimony from both the defense and the government technical witnesses. The parties have also submitted post hearing briefs arguing their respective positions. Having considered the evidence and arguments offered by the parties, the court concludes that the defendant's motion should be denied.

         BACKGROUND

         BitTorrent is a peer-to-peer (P2P) file sharing network that is used to distribute large amounts of data over the Internet, such as movies, videos, and music. “Instead of relying on a single server to provide an entire file directly to another computer, which can cause slow download speeds, BitTorrent users can download portions of the file from numerous other BitTorrent users simultaneously, resulting in faster download speeds.” United States v. Gonzales, No. CR-17-01311-001-PHX-DGC, 2019 WL 669813, at *1 (D. Ariz. Feb. 19, 2019). BitTorrent is well known by law enforcement to be used to obtain and distribute child pornography throughout this country and the world. The court explained how the program generally works in Gonzales:

To download and share files over the BitTorrent network, a user must install a BitTorrent software “client” on his computer and download a “torrent” from a torrent-search website. A torrent is a text-file containing instructions on how to find, download, and assemble the pieces of the image or video files the user wishes to view. The client software reads the instructions in the torrent, finds the pieces of the target file from other BitTorrent users who have the same torrent, and downloads and assembles the pieces, producing a complete file. The client software also makes the file accessible to the other BitTorrent users in a shared folder on the user's computer.

Id.

         TDR is a modified version of the BitTorrent protocol developed by law enforcement in conjunction with the University of Massachusetts at Amherst. TDR acts as a BitTorrent user and searches the Internet for Internet protocol (IP) addresses offering torrents for known child pornography files. “When such an IP address is found, the program connects to that address and attempts to download the child pornography. The program generates detailed logs of the activity and communications between the program and the IP address. Unlike traditional BitTorrent programs, TDR is designed to download files only from a single IP address - rather than downloading pieces of files from multiple addresses - and does not share those files with other BitTorrent users.” Id.

         At the evidentiary hearing, the court heard from Detective Robert Erdely, one of the developers of the TDR program who is retired from the Pennsylvania State Police. Dkt. No. 25, Tr. at 49-123. Detective Erdely has numerous certifications in the computer related field and has worked extensively with law enforcement and universities in developing tools to investigate the exploitation of children on the Internet. Exhibit 1. TDR, which appears to be the culmination of his efforts, is used by law enforcement in over 60 countries to locate, investigate, and prosecute child predators. Id. Detective Erdely credibly testified that TDR is a simple program that has little chance of malfunctioning. Any malfunction that did occur, Detective Erdely explained, would result not in a false positive, as Owens argued, but in no data at all. It would shut the program down. Tr. at 88:09-89:11.

         Detective Erdely first explained in detail how the BitTorrent program works. He explained that the torrent file, which is a set of instructions for how to get the actual files they describe, is obtained by searching outside websites. The torrent is then loaded into the BitTorrent program which then sends it out to the BitTorrent network. The network then lists IP addresses that are associated with the same torrent. The different computers then engage in what Detective Erdely metaphorically described as “conversations” where “some handshaking goes on” in which they verify that they are talking about the same torrent which is identified by what is called an info hash, a lengthy digital identifier as unique as DNA. Tr. at 53:14-62:25. As Detective Erdely explained, TDR does not invade the shared space of the computer that connects to it; it only downloads what the sharing computer makes available. Id. at 102:17-103:13.

         With TDR, law enforcement inputs torrents from its database that are known to be associated with child pornography. The torrent is loaded into the BitTorrent program and then the investigator simply waits for another member of the network to respond. Unlike the BitTorrent program, TDR connects with only a single IP address. When an IP address is found, the program connects to that address and downloads the child pornography. The program generates a detailed log of the activity and communications between the program and the IP address. In describing how TDR operated in this case, Detective Erdely highlighted the pertinent sections of the detailed logs that were generated on May 21, and again on May 22, 2018, when the downloads from Owens' computer occurred. Id. at 65:6-73:14; Exhibits 2 and 3. The two logs detail the download of a 226 piece file from Owens' computer on each occasion. And as for why the downloaded video was not found on Owens' computer after it was seized by law enforcement in execution of a search warrant, Detective Erdely explained that Owens had simply deleted the file after viewing it. From his own viewing of the mirror image of Owens' computer, Detective Erdely was able to identify evidence in three different areas that the file had been on Owens' computer prior to law enforcement's execution of the search warrant. Tr. at 77:14-83:25; Exhibits 4, 5, and 6.

         Finally, Detective Erdely testified that disclosure of the TDR program to defense witnesses or allowing independent testing would jeopardize ongoing and future child pornography investigations. It would expose “each and every torrent file we're investigating.” Tr. at 84:13. Detective Erdely testified that it had taken eight years to build up the hash values of known child pornography files, which are key to the operation of TDR. Allowing defense witnesses access to their program exposes the files and hash values law enforcement investigates, the contact information for law enforcement and the IP addresses they are actively investigating. He compared allowing defense experts and attorneys access to “dropping a civilian in the mix of a raid.” Moreover, Detective Erdely could think of no benefit a defendant would obtain from access to TDR beyond what he would know from familiarity with the BitTorrent program. Id. ...


Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.