On November 25, 2020, the Eleventh Circuit Court of Appeals decided the United States v. Trader[i], in which the court examined whether the third-party doctrine allows law enforcement to obtain internet protocol (IP) addresses and email account information without a warrant. The facts of Trader are as follows:
For years, Scott Trader recorded videos of himself sexually abusing his daughters and distributed the videos on the internet. The abuse occurred while one daughter was a preteen and the other was a toddler. When abusing his own children was not enough, Trader used messaging apps to send child pornography to other young girls and to solicit nude photos and videos from them. He exchanged child pornography with more than forty minors and engaged in sexually explicit conversations with more than a hundred apparent minors. And he took other opportunities when they presented themselves, like recording a video of himself exposing his daughter’s young friend during a sleepover.
Trader came to the attention of the Department of Homeland Security on May 30, 2017, when a parent in North Carolina discovered that someone had sent his nine-year-old daughter child pornography and solicited nude photos from her. The conversation occurred on an app called SayHi, and the perpetrator’s username was “Scott.” The parent reported the conversation to his local police department, which referred the report to Homeland Security.
Homeland Security agents examined the nine-year-old’s device and learned that “Scott” sent her a sexually explicit video that he said depicted himself and his daughter. He also sent a photo of his face. The agents observed that Scott’s profile on SayHi disclosed his username on another messaging app, Kik. The associated Kik profile photo matched the photos of “Scott” on SayHi.
The investigation unfolded quickly. Because SayHi was based abroad but Kik was domestic, agents thought Kik would be more responsive to requests for information about the user. The agents sent Kik an emergency disclosure request seeking information about the user. Kik provided the user’s email address and recently used internet protocol addresses. The email address associated with the account was “[email protected].” And the user had repeatedly logged into Kik from a cell phone using a particular internet protocol address over the last month.
Homeland Security next traced the internet protocol address to the internet service provider, Comcast. Agents sent Comcast an emergency disclosure request for the subscriber records associated with the repeated internet protocol address. Comcast obliged. The account was registered to Shelly Trader and located at an address on Edinburgh Drive in Port St. Lucie, Florida.
State records revealed that a person named Scott Trader had a driver’s license associated with the mailing address, and his driver’s license photo matched the photos from SayHi and Kik. A criminal records check revealed that Trader had been charged in December 2016 with molesting a victim younger than 12. And property records revealed that Shelly Trader-Bonanno and Leon Bonanno owned the Edinburgh Drive house, and Trader-Bonanno’s age was consistent with her being Trader’s mother.
Homeland Security used that information to apply for a warrant to search the Edinburgh Drive house. The warrant affidavit recited the steps of the investigation. It explained that “there were logons to the [Kik] account from” the internet protocol address associated with Trader’s residence “starting 1 May 2017, through 31 May 2017, at 06:36 UTC.” The warrant affidavit also explained that child pornography distributors and collectors “almost always possess and maintain their material . . . in the privacy and security of their homes” and that traces of child pornography could likely be found through forensic examination of devices that had been used to access child pornography.
A federal magistrate judge issued the warrant shortly before midnight on May 31. Law enforcement executed the warrant that same night. They found a stash of electronic devices hidden behind a loose board under a storage cabinet in Trader’s bedroom. Forensic examination of the devices revealed years’ worth of videos of Trader sexually abusing his daughters, along with thousands of images and videos of child pornography Trader had downloaded from the internet, plus archived messages in which Trader shared child pornography with others and solicited nude images and videos from young girls. The devices also contained conversations in which Trader described in graphic detail his abuse of his daughters and his plans to escalate that abuse in the future. He also encouraged two women to ignore their feelings of guilt, participate in abusing his daughters, and abuse their own daughters.
Officers arrested Trader.[ii]
Trader was indicted under federal law for enticing a minor to engage in sexual activity, enticing a minor to produce explicit videos, and possession and distribution of child pornography. He filed a motion to suppress the evidence on the grounds that the agents violated his rights under the Fourth Amendment. The district court denied the motion, and Trader pled guilty with the right to appeal the denial of the motion to suppress. He then filed an appeal with the Eleventh Circuit Court of Appeals.
Issue One: Did Carpenter v. U.S. require the agents to obtain a warrant for information regarding his IP address and email account information?
As a review, in Carpenter v. United States[iii], the Supreme Court held that the third-party doctrine did not apply to law enforcement’s collection of cell site location information (CSLI) for periods of at least seven days. In other words, person had a reasonable expectation of privacy in that information, and law enforcement must obtain a search warrant in order to obtain that information from cellular providers. Specifically, the court stated
In Carpenter, the Court said, “we hold that an individual maintains a legitimate expectation of privacy in the record of his physical movements as captured through CSLI [cell-site location information].” Id. at 2217; see also United States v. Gayden, 977 F.3d 1146, 1151 (11th Cir. 2020) (“[T]he Supreme Court in Carpenter declined to extend the third-party doctrine to cell-site location information . . . .”); United States v. Green, 969 F.3d 1194, 1206 (11th Cir. 2020) (“The Supreme Court recently held in Carpenter . . . that the acquisition of historical cell-site records is a search under the Fourth Amendment, so the government must obtain a warrant to access such records.”). Carpenter did not decide even whether cell-site location information always falls outside the third-party doctrine’s reach. It left open the possibility that the government could obtain less than seven days’ worth of cell-site location information without a warrant. Carpenter, 138 S. Ct. at 2217 n.3.[iv]
The court of appeals also discussed the third-party doctrine and stated
[A] person lacks a reasonable expectation of privacy in information he has voluntarily disclosed to a third party. Smith v. Maryland, 442 U.S. 735, 743-44, 99 S. Ct. 2577, 61 L. Ed. 2d 220 (1979); United States v. Miller, 425 U.S. 435, 443, 96 S. Ct. 1619, 48 L. Ed. 2d 71 (1976). This principle is called the third-party doctrine.[v]
The court of appeals then set out to examine the issue in light of the legal principles above. The court noted that IP addresses and email addresses are not cell phone records and are not location records. While a person can indirectly obtain a street address from an IP address, it takes extra steps, such as contacting the internet provider and obtaining the address to which the account associated with the IP is registered. Further, IP addresses and email addresses are only incidentally associated with cell phones, as other electronic devices also access the internet and email. Lastly, the court of appeals noted that every federal circuit that considered this issue in light of Carpenter has held that the third-party exception to the warrant requirement does apply (so Carpenter does not apply) to IP address and email addresses.[vi]
Therefore the Eleventh Circuit held
Indisputably, email addresses and internet protocol addresses were not at issue in Carpenter. The third-party doctrine applies, so the government did not need a warrant to obtain Trader’s email address or internet protocol addresses from Kik.[vii]
Issue Two: Was the search warrant for Trader’s residence supported by probable cause?
The court first discussed probable cause and stated
Probable cause exists if, “given all the circumstances set forth in the affidavit . . ., there is a fair probability that contraband or evidence of a crime will be found in a particular place.” Illinois v. Gates, 462 U.S. 213, 238, 103 S. Ct. 2317, 76 L. Ed. 2d 527 (1983). To establish probable cause to search a home, a warrant affidavit must “establish a connection between the defendant and the residence to be searched and a link between the residence and any criminal activity.” United States v. Martin, 297 F.3d 1308, 1314 (11th Cir. 2002).[viii]
The court of appeals then examined the evidence in the record that supported probable cause and found the following:
- A SayHi user with the username “Scott” distributed child pornography and solicited its creation on the evening of May 30;
- That user’s profile linked to a profile on Kik;
- The Kik and SayHi profile photos and a photo “Scott” sent on SayHi matched each other;
- The Kik user’s email address was “[email protected];”
- The Kik user logged into Kik from a particular internet protocol address either on the day of the crime—May 30—or within a few hours afterward, earlyon the morning of May 31;
- That internet protocol address was registered to Shelly Trader at the Edinburgh Drive house;
- Scott Trader’s driver’s license photo matched the Kik and SayHi photos, and he listed the Edinburgh Drive house as his mailing address;
- Child pornographers typically keep stashes of child pornography in their houses; and
- Traces of child pornography typically remain present on electronic devices long after files are downloaded or sent.[ix]
The court held that this was “more than enough” evidence to establish probable cause.
Issue Three: Did the warrant affidavit sufficiently establish a connection between Trader and the Edinburgh Drive residence?
The court examined the facts of the case that were relevant to this issue. First, Trader listed the Edinburgh Drive residence as his mailing address. Second, he had access to its internet network. Third, he and the homeowner shared the same last name. Fourth, Trader connected the residence’s internet network within a few hours of exchanging child pornography with a nine-year-old girl. The court held that this evidence “establishes more than a fair probability that Trader had a connection to the” residence.[x] Therefore, there was sufficient probable cause.
As such, the Eleventh Circuit affirmed the denial of the motion to suppress.
____________________________________________________
Citations
[i] No. 17-15611 (11th Cir. Decided November 25, 2020)
[ii] Id. at 2-5
[iii] 138 S. Ct. 2206 (2018)
[iv] Trader at 12-13 (emphasis added)
[v] Id. at 10-11 (emphasis added)
[vi] Id. at 14 (see United States v. Morel, 922 F.3d 1, 9 (1st Cir. 2019); United States v. Contreras, 905 F.3d 853, 857 (5th Cir. 2018); see also United States v. Wellbeloved-Stone, 777 F. App’x 605, 607 (4th Cir. 2019); United States v. VanDyck, 776 F. App’x 495, 496 (9th Cir. 2019).
[vii] Id. at 13
[viii] Id. at 16 (emphasis added)
[ix] Id. at 16-17
[x] Id. at 18
