United States District Court, D. Vermont
OPINION AND ORDER
WILLIAM K. SESSIONS, III, District Judge.
Defendant Richard Cyr was initially charged with one count of using the internet to persuade a minor, K.S., to engage in illegal sexual activity and one count of attempting to commit that offense. See 18 U.S.C. § 2422(b). On November 14, 2014 the Court issued an Opinion and Order (the "November Order") denying Defendant's first motion to suppress a state search warrant related to those alleged crimes. ECF No. 63. The government later filed a Second Superseding Indictment that added new charges against Mr. Cyr, including offenses related to child pornography.
Mr. Cyr now moves to suppress all evidence procured from searching hard drives and electronic media seized under the warrant he previously challenged. Mr. Cyr argues that the evidence was obtained in violation of his rights under the Fourth Amendment to the United States Constitution. ECF No. 90. For the reasons described below, Mr. Cyr's motion is denied.
I. Relevant Background
The Court presumes familiarity with the recitation of the facts in the November Order and incorporates them by reference herein. Additional evidence related to the present motion was developed at an evidentiary hearing on July 30, 2015.
The hard drives and computers seized during the search of Mr. Cyr's residence and car were turned over to the Vermont Internet Crimes Task Force Computer Forensic Laboratory for analysis. Deb Jasinski was tasked with investigating the contents of the seized evidence. Before she began her analysis, Ms. Jasinski consulted the state warrant signed by Judge Robert P. Gerety, which Mr. Cyr challenged in his initial motion to suppress. According to the application for the search warrant, the only offenses for which probable cause to search existed were sexual assault, luring a child, and contributing to juvenile delinquency. ECF No. 90-2 at 5. Ms. Jasinski testified that she was aware that these were the three crimes described in the warrant.
Ms. Jasinski also spoke to Special Agent ("SA") Michelle Delpha, one of the lead investigators handling the case, by telephone. SA Delpha provided additional details regarding the investigation. They spoke generally about the nature of the case and reviewed specific facts that were of interest to Ms. Jasinski's analysis. SA Delpha explained that Mr. Cyr had allegedly created a Facebook profile under the name Ann Clancy which he used to reach out to young women in the area under the guise of becoming their friend. She also told Ms. Jasinski that Ann Clancy had contacted K.S. in this way, that K.S. had met a man the investigators believed to be Mr. Cyr, and that some sexual contact had taken place. SA Delpha gave Ms. Jasinski particular filenames relevant to the investigation. One or more of the filenames were linked to images of Mr. Cyr's penis. Ms. Jasinski could not remember where SA Delpha had gotten the names of the relevant files but she knew they were a product of the investigation.
Ms. Jasinksi was also made aware that K.S. told investigators that she had sent a "headshot" to Mr. Cyr. SA Delpha described what K.S. looked like as well as additional physical evidence seized from Mr. Cyr's residence indicating that there might have been another victim with whom Mr. Cyr had been communicating. Finally, SA Delpha gave Ms. Jasinski a list of email addresses connected to the case.
Based on all of this background information, page 2 of Ms. Jasinski's report summarizing her investigation describes the "Scope of Request (truncated and paraphrased)" to include "search for keywords related to investigation of reported sexual assault, " "search for evidence of possession of child pornography, " and "search for evidence of attempting to entice other minors using electronic means." ECF No. 90-3 at 3. At first glance it might appear that Ms. Jasinski thought she was authorized to generally search for child pornography, but her testimony revealed that this was not the case. Ms. Jasinski explained that this section of her report was her own interpretation of her authority to search based on her conversation with SA Delpha and her understanding of the search warrant. Ms. Jasinski believed the warrant allowed her to search for child pornography because the warrant included the crime of luring minors using the internet. Her prior case work and experience to date led her to believe that criminal defendants charged with luring frequently use images of child pornography to attempt to groom and normalize sexual behavior for their intended victims and to attempt to build a sense of intimacy between the perpetrator and the potential target. Ms. Jasinski explained that child lurers use child pornography in several ways, including downloading images from the internet and exchanging personal photographs back and forth. Ms. Jasinski testified that she had searched for child pornography in prior child luring cases.
Ms. Jasinski began her investigation by making a forensic copy of the hard drive. This copy was an identical bit for bit image of the drive and enabled her to examine its contents while keeping the evidence itself pristine. She used a program called Forensic Toolkit ("FTK") throughout her investigation. Before beginning any searching, Ms. Jasinski created an index using FTK. The software combed through the forensic copy of the hard drive and made note of each word and group of numbers. The index is essentially a record of the frequency of words and other groups of letters and numbers. It allowed Ms. Jasinski to search for filenames and other keywords of interest.
Ms. Jasinksi was particularly interested in searching for various kinds of photographs including: child pornography indicative of luring, photos with the filenames provided by SA Delpha, photos related to the Ann Clancy Facebook account, photos related to the location where Mr. Cyr allegedly met K.S. or K.S.'s home, photos of K.S., and photos of other potential victims. An investigator cannot tell the content of a picture file just by looking at its name or extension. Both easily can be changed to conceal a file's true contents and picture files can be stored in virtually any area of the hard drive. The only way to ensure that all photographic evidence related to those categories was found was to examine all image files on the computer.
Mr. Cyr's motion to suppress seems to be focused on one file tree of evidentiary significance. In particular, Ms. Jasinski found significant evidence in the "Porn" folder located in the Dell drivers folder. Ms. Jasinski testified that this was not an intuitive place to find images. Drivers typically house pieces of software that allow a computer to interact with peripheral devices, such as a printer. The "Porn" folder contained a subfolder labeled "kim the slut." This latter folder contained photos from Facebook of an underage girl identified by investigators as K.P. In some K.P. is nude and posed in sexually provocative poses. The "Porn" folder also contained a subfolder called "babykatie, " containing fully-clothed pictures of K.S. that were saved to the computer from Facebook, and "Me(s), " containing images of Mr. Cyr and an additional subfolder called "Red7745." The "Red7745" subfolder contained images of a girl with red hair, one of which is the profile picture connected with the Ann Clancy Facebook account that Mr. Cyr allegedly used to lure his victims. In some the girl pictured is completely nude and the Report describes the photos of her as "possible child pornography." ECF No. 90-3 at 6. The age of the red head in these photos has not yet been determined.
Ms. Jasinski testified that she found the "Porn" folder in one of two ways but she could not remember which route first led her there. The first potential route was through the filenames SA Delpha provided. She used the index in FTK to run a search for those files and FTK displayed the search hits returned. Given the fact she knew the file she was searching for was a photo, Ms. Jasinski focused on the graphics category of search hits. From there she was able to view the image where it was located within the folder tree. This took her to the "Me(s)" subfolder.
The other route by which Ms. Jasinski came to the "Porn" folder was by searching for images of K.S., possibly the headshot that she knew K.S. had sent to the Ann Clancy Facebook account. Ms. Jasinski used a function in FTK that pulled all the images on the hard drive together in one place for review. She then scrolled through thumbnails of the photos and looked for any of interest. Eventually she came across images of a young girl that met the description of K.S. provided by SA Delpha. She also confirmed that the filenames of these images were consistent with Facebook ...