Searching over 5,500,000 cases.


searching
Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

United States v. Sigouin

United States District Court, S.D. Florida

December 18, 2019

UNITED STATES OF AMERICA, Plaintiff,
v.
BRIAN SIGOUIN, Defendant.

          Rosenberg, Judge

          AMENDED REPORT AND RECOMMENDATION ON MOTIONS TO SUPPRESS [1] [DES 20, 21, 22, 32]

          BRUCE REINHART, UNITED STATES MAGISTRATE JUDGE

         Brian Sigouin is charged by indictment with one count of receiving child pornography and three counts of possessing child pornography. He moves to suppress physical evidence seized pursuant to a search warrant as well as post-Miranda statements he made to FBI agents on the day of the search. This matter was referred to me by the Hon. Robin L. Rosenberg. DE 6. I have reviewed the Motions to Suppress, the Government's Responses, and Mr. Sigouin's Replies. I conducted an evidentiary hearing on December 9 and December 16, 2019. I am fully advised and the matter is ripe for decision. For the reasons stated herein, it is RECOMMENDED that the motions to suppress be DENIED.

         BACKGROUND

         On May 15, 2018, I issued a search warrant for the residence located at 22809 Horseshoe Way, Boca Raton, Florida (“the Target Residence”). DE 26-1 at 24-27. The affidavit in support of the warrant alleged that there was probable cause to believe that an IP address associated with the Target Residence was being used to access child pornography from a publicly-accessible, distributed peer-to-peer online network (“the Network”).[2] Id. 1-21 (hereinafter “Affidavit”). Incorporated into the Affidavit was a peer-reviewed academic article discussing the use of statistical methods to detect a person downloading child pornography over a distributed peer-to-peer computer network. DE 26-5; Aff 23 & n. 4

         The Affidavit and the Peer Reviewed Article

         The Affidavit explained that any person could join the Network by downloading and installing publicly available software. Aff. ¶ 7. When users join the Network, they connect their computer to other computers running the same software, such that each computer becomes a node in the larger Network. DE 26-5 at 2. Each computer/node becomes a “peer” of the other computer/nodes. Id. Each computer/node contributes a portion of its local hard drive to be used as storage by the Network. Id.; Aff. ¶ 8. A node can operate in “opennet” or “darknet” mode. In “opennet” mode, anyone who joins the Network can connect to the node in question, including persons who are not known to the owner of the node. In “darknet” mode, only persons who are preapproved by the owner of the node can access it. Aff. ¶ 14; DE 26-5 at 2.

         When a file (including digital images of child pornography) is uploaded to the Network, the file is divided into encrypted “blocks.” Aff. ¶ 9; DE 26-5 at 2. The encryption process assigns a unique alphanumeric value to each block, which is called the block's “hash” value. DE 26-5 at 2. The blocks are then distributed to hard drives on multiple nodes on the Network. Id.; Aff ¶ 11. The hard drive may be on a peer computer connected directly to the uploading node, or it may be connected indirectly through other nodes. Aff. ¶ 11. A list of the hash values for all the blocks necessary to reconstruct the image is stored in a “manifest”, which is a separately-encrypted file that is stored on the Network. Id. ¶ 9; DE 26-5 at 2. The Network assigns a unique public address to the manifest. Aff. ¶¶ 16-17; DE 26-5 at 2. Anyone who obtains the unique public address can locate the manifest, decrypt it, and then request the blocks (by hash value) necessary to reconstruct the image. DE 26-5 at 2. These public addresses are listed in various locations on the Network. Aff. ¶¶ 16-18.

         Once a person has the manifest, he can download the corresponding digital images of child pornography. Aff. ¶ 11; DE 26-5 at 2. To do so, the person's computer sends out a request (using the relevant hash values) for all the blocks associated with that image. This request first goes to the computers/nodes directly connected to the requesting computer (the first-generation neighbors). If a first-generation neighbor has the requested block, the Network software on that computer sends the block to the requestor. If a first-generation neighbor does not have a requested block, the Network software on that computer forwards the request to the computers/nodes connected to it (the second-generation neighbors). If the second-generation neighbor has the requested block, it sends the block to the first-generation neighbor, who then passes it to the requestor. If the second-generation neighbor does not have the requested block, the request is forwarded to the computers/nodes connected to the second-generation neighbor (the third-generation neighbor). This process continues until the earlier of (1) all the blocks are retrieved or (2) a fixed number of generations has been queried.[3] For each iteration, the Network's software forwards the requests and/or returns the blocks automatically, without the knowledge of the owners of the non-requesting nodes. See generally, Aff. ¶¶ 11-13; DE 26-5 at 2.

         The software “warns its users in multiple ways that it does not guarantee anonymity: when the software is initially installed; within the log file each time [the Network] is started; and via [the Network's] publicly accessible website.” Aff. ¶ 15. Additionally, the “fact that [the Network] does not mask IP addresses is explained on its publicly available website. [The Network] also acknowledges on its publicly available website that, for users who use the Opennet mode, it can be statistically shown that a particular user more likely than not requested a file (as opposed to having merely forwarded the request of another peer) based on factors including the portion of the pieces of a file requested by a user and the number of nearby pieces.” Id.

         The Affidavit further explained that, without judicial prior approval, the FBI had set up a computer as one of the nodes on the Network (“the FBI node”), which allowed the FBI to monitor requests for child pornography as they flowed across the Network. The computer on the FBI node ran a version of the Network software that had been modified to filter and log certain information. Specifically, for a user connected to the FBI node, the modified software logged “the IP addresses of the user's peers; the number of peers those peers report to have; a unique identifier assigned by the software (referred to as the computer's [the Network] “location”); the remaining number of times a request for a piece of a file may be forwarded; the date/time of requests received from a peer; and the digital hash value of a requested piece.” Id. ¶ 19. The FBI node did not collect any information that was unavailable to other peers of the user. Id.

         The FBI had compiled a list of hash values associated with blocks known to contain child pornography (“files of interest”). Id. ¶ 21. If the FBI node detected a request for a block whose hash value corresponded to a file of interest and whose HTL value was 17 or 18, further investigation was conducted using a mathematical algorithm to identify whether there was a reliable circumstantial inference that a particular node was requesting known images of child pornography (as opposed to passively forwarding a request by someone else). Id. ¶¶ 21-22. The most relevant information incorporated into the algorithm was (1) the total number of blocks in the manifest for the digital image, (2) the number of blocks requested by the target node, (3) the time period during which those blocks were requested, and (4) the number of first generation neighbors for the target node. DE 26-5 at 3. The theory behind the algorithm was: if, during a condensed period of time, a node connected directly to the FBI node requested a particular percentage of the total blocks needed to reconstruct a known digital image of child pornography, there is a circumstantial inference that the connected node is the original requestor seeking the digital image. Id.

         The Affidavit stated, “The academic paper's detailed evaluation finds that a formal mathematical formula based on this reasoning is highly accurate (specifically, it has a high true positive rate and a low false negative rate).” Aff ¶ 23. The affiant also swore that evidence of child pornography crimes had been found in dozens of searches derived from using this algorithm to identify IP addresses that were seeking child pornography over the Network. Id. ¶ 24. The authors of the peer-reviewed article tested the algorithm three ways: statistically, by running simulations, and by testing it against real data from the Network. See generally, DE 26-5. The false positive rate for real data testing was approximately 2%. Id. at 7.

         The Affidavit further stated that, using this methodology, the FBI had identified IP address 75.74.45.172 (“the target IP address”) as a node that had requested images of child pornography from the Network on three occasions. Aff. ¶¶ 25-29. Further investigation revealed that, on each of those occasions, this IP address was accessed from the Target Residence. Id. ¶ 33. The affiant, an experienced investigator of child pornography cases, opined that based on his training and experience the person using the target IP address was a collector of child pornography. Id. ¶ 41. He also opined that it was “highly likely” that the person had obtained child pornography through other means and was currently in possession of child pornography. Id. In conclusion, the Affidavit asserted that there was probable cause to believe that evidence of federal child pornography crimes would be found at the Target Residence. Id. ¶ 58.[4]

         The warrant authorized the FBI to search the Target Residence. DE 26-1 at 25 (Attachment A to search warrant). It authorized the seizure of numerous items, including storage media, computers, records of occupancy, and photographs. Id. at 26-27 (Attachment B to search warrant).

         Execution of the Search and Mr. Sigouin's Statements

         On May 17, 2018, the FBI executed the search warrant at the Target Residence. During the execution of the warrant, Mr. Sigouin agreed to speak to the investigating agents. Those conversations occurred in a minivan parked outside the residence. There were three conversations. The first two were tape recorded. Govt. Ex. 7, 8. The third was not recorded but was memorialized in a Report of Interview by the interviewing FBI agent. Govt. Ex. 9. Prior to any questioning, Mr. Sigouin was read his Miranda rights and executed a form indicating he understood and waived those rights. Govt. Ex. 11. As most relevant here, Mr. Sigouin eventually gave the investigators the combination to a safe that was in his bedroom. Inside the safe were computer storage devices containing images of child pornography.[5] Mr. Sigouin also made other statements that indicated his familiarity with networks like the Network and that indicated he was aware that there was child pornography in the residence. He now moves to suppress all physical evidence seized from the Target Residence. He also moves to suppress his statements to the FBI.

         DISCUSSION

         1. Burdens of Proof

         The evidentiary burden at a suppression hearing is a preponderance of the evidence. See United States v. Matlock, 415 U.S. 164, 177 n.14 (1974). On his Motions to Suppress, Mr. Sigouin bears the burdens of proof and persuasion. United States v. Touset, 890 F.3d 1227, 1231 (11th Cir. 2018) (individual challenging a search bears burdens of proof and persuasion). To the extent he alleges his statements to the FBI were taken in violation of his Miranda rights, he bears the burden of proving that he was in custody when he made those statements. United States v. de la Fuente, 548 F.2d 528, 533 (5th Cir. 1977); United States v. Peck, 17 F.Supp.3d 1345 (N.D.Ga. 2014) (collecting cases). The Government bears the burden of proving a knowing, voluntary, and intelligent Miranda waiver. Colorado v. Connelly, 479 U.S. 157, 168 (1986). The Government also bears the burden of establishing the good faith and inevitable discovery exceptions to the exclusionary rule. See, e.g., United States v. Robinson, 336 F.3d 1293, 1297 (11th Cir. 2003) (good faith exception); United States v. Drosten, 819 F.2d 1067, 1070 (11th Cir. 1987) (inevitable discovery exception).

         2. Motion to Suppress Physical Evidence

         Mr. Sigouin argues that he had a reasonable expectation of privacy in the information his computer transmitted to the Network, so that the FBI's warrantless logging of that information through the FBI node was an unconstitutional search and seizure. I find no constitutional violation occurred.

         Expectation of Privacy/Trespass

         There are two complementary theories under which the fourth amendment limits governmental action. United States v. Jones, 565 U.S. 400, 406-07 (2012). One is a property-based theory, under which the government is prohibited from trespassing into a location where a person has a property interest. The other is a privacy-based theory, under which the government cannot invade a location where a person (1) has a subjective expectation of privacy and (2) that privacy expectation is objectively one that society will recognize as reasonable. See, e.g., United States v. Segura-Baltazar, 448 F.3d 1281, 1286 (11th Cir. 2006).

         Binding Eleventh Circuit precedent holds that there is no fourth amendment protection for information that a person freely shares with others on a publicly-accessible peer-to-peer network. United States v. Norman,448 Fed.Appx. 895, 897 (11th Cir. 2011); see also United States v. Dennis, No. 3:13-cr-10-TCB, 2014 WL 1908734, at *7 (N.D.Ga. May 12, 2014) (collecting cases). In Norman, the Government accessed a shared-file folder on the defendant's computer and found child pornography on that computer. The Eleventh Circuit held that the defendant had no objectively reasonable expectation of privacy in the folder because the computer ...


Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.