I recently blogged about a new Fourth Amendment decision on the use of “MoocherHunter” to find the location of an unauthorized user of a wireless network. Here’s another case with a somewhat similar tool in which the facts led the District Court to grant the defendant’s motion to suppress: United States v. Broadhurst, 2012 WL 5985615 (D. Or. Nov. 28, 2012) (Mosman, J.).
In this case, an investigation into sharing of child pornography over peer-to-peer networks revealed ten different IP addresses in a particular neighborhood that was being used to share thousands of images of child porn. An investigation revealed that the ten IP addresses traced back to six residences that had unsecured wireless networks, suggesting that someone was sharing child porn by hopping on to the unsecured wireless networks in the neighborhood and using several different networks to hide the suspect’s identity. To find out who was behind the conduct, the investigators turned to The Shadow. No, not that Shadow. Rather, a hand-held device that happens to be called the Shadow:
The Shadow is a handheld device about the size of a smartphone that allows the user to observe and locate wireless access points and station devices.
To observe access points and station devices, the Shadow receives wireless radio signals within the immediate area. Access points and station devices emit these signals to facilitate Internet connections. An access point sends out a signal announcing its Internet connection, and a station device sends out a signal to locate available access points. The Shadow scans for these signals within range and displays the results on a touchscreen. The results show the detected access points and station devices and their relative signal strength. The Shadow can also display which station device is connected to a detected access point.
To locate access points and station devices, the Shadow displays the signal strength of a particular access point or station device selected by the user. This signal strength, labeled Received Signal Strength Indicator (“RSSI”), is displayed on the Shadow’s screen in the range of –60 to 6. (Ex. D at 24.) As the Shadow gets physically closer to the selected access point or station device, the signal strength increases and the RSSI displays a higher number. Thus, the Shadow allows the user to locate a particular access point or station device by displaying the access point or station device’s signal strength in real-time to the user.
The device sounds similar to Moocherhunter, except that it’s a hardware device and there is no need to get the cooperation of the owner of the unsecured wireless device.
The investigators ended up using “The Shadow” to trace the signal from the laptop that was connected to an IP address that was being used to upload and download child pornography. By walking around the neighborhood, the officers found the home, and walked up to the front lawn and towards a window, where the strength of the signal from the laptop was very strong. The agents then obtained a search warrant to search the home with the signal apparently emanating from inside, and the search recovered the computer and images of child pornography. The defendant moved to suppress, and the district court granted the suppression motion.
The court reasoned that using The Shadow was itself not a search: It did not violate a reasonable expectation of privacy so long as it was used from a public space or property that did not belong to the suspect:
[T]his case is very similar to those cases recognizing no reasonable expectation of privacy in stolen property. See United States v. Caymen, 404 F.3d 1196, 1200–01 (9th Cir.2005) (“The Fourth Amendment does not protect a defendant from a warrantless search of property that he stole, because regardless of whether he expects to maintain privacy in the contents of the stolen property, such an expectation is not one that society is prepared to accept as reasonable.”) (internal quotations and citation omitted). Here, the Shadow monitored the station device signals through the station device’s connection to unsecured networks and could not have measured the station device signal strength without this connection (Tr. [49] at 126:23–127:7, 141:8–13.) Thus, when the Shadow was used to monitor the station device signals coming from defendant’s computer in his residence, the Shadow relied on the station device’s unauthorized connection to his neighbor’s unsecured network. Because the Shadow monitored the station device signals when the station device had no authorization to be on that network, defendant cannot claim a reasonable expectation of privacy in the signals. To put it more plainly: A defendant who connects to the Internet by hijacking his neighbor’s wireless network does not have a privacy interest in the signals coming from his house that society is prepared to recognize as reasonable.
*5 Second, defendant cannot assert a reasonable expectation of privacy “in information he voluntarily turn[ed] over to third parties.” Smith v. Maryland, 442 U.S. 735, 743–44 (1979). Through the station device, defendant voluntarily sent out a signal to amplify access point signals and attach to third parties’ networks with his computer. Defendant cannot assert a reasonable expectation of privacy in signals he intentionally emitted to connect to unauthorized networks.
Third, from a practical standpoint, defendant’s argument creates inconsistent expectations of privacy based only on the means by which an individual shares child pornography files over the Internet. On the one hand, this defendant would serendipitously receive Fourth Amendment protection because he hijacked another person’s Internet connection to share child pornography files. On the other hand, another individual who uses his own Internet connection to share the same files lacks such protection, merely because the IP addresses would track back to his house. See United States v. Borowy, 595 F.3d 1045, 1047–48 (9th Cir.2010); United States v. Ganoe, 538 F.3d 1117, 1127 (9th Cir.2008). Both individuals are sharing child pornography files over the Internet starting from inside their home; the court should not recognize an expectation of privacy in one case simply because one individual uses a hijacked wireless signal. See United States v. Skinner, 690 F.3d 772, 774 (6th Cir.2012) (“When criminals use modern technological devices to carry out criminal acts and to reduce the possibility of detection, they can hardly complain when the police take advantage of the inherent characteristics of those very devices to catch them.”). Consequently, I conclude defendant lacked a reasonable expectation of privacy in the station device signals and therefore cannot invoke the protection of the Fourth Amendment against the general use of the Shadow.
Despite this, the officers had violated the Fourth Amendment when they had walked on to the suspect’s front lawn and approached his home. This crossed the line from “open fields” to the “curtilage,” amounting to a physical trespass of the suspect’s protected property. As a result, any evidence obtained as a fruit of the unconstitutional trespass had to be suppressed. This required Judge Mosman to excise out the unconstitutional parts of of the affidavit and ask if what was left still amounted to probable cause. It did not, Judge Mosman concluded in part because the affidavit lacked details about the investigation:
[C]onsidering the totality of the circumstances here, the information in the warrant affidavit did not create a fair probability that evidence of child pornography crimes would be found in defendant’s residence. Accordingly, all evidence obtained pursuant to the execution of the search warrant must be suppressed.
This is not to say that officers cannot obtain search warrants in these types of multiple-location investigations. They will be greatly assisted in doing so if they do not trespass on a suspect’s property. In addition, if they correctly include a more complete set of data (here, the correct photograph), and a more thorough explanation of the investigation and the relevant technology, it would allow the court to better assess probable cause. Significantly for my analysis, that was not the case here.