State v. Jereczek
| Decision Date | 06 April 2021 |
| Docket Number | Appeal No. 2019AP826-CR |
| Citation | 961 N.W.2d 70,2021 WI App 30 |
| Court | Wisconsin Court of Appeals |
| Parties | STATE of Wisconsin, Plaintiff-Respondent, v. Kevin M. JERECZEK, Defendant-Appellant. |
On behalf of the defendant-appellant, the cause was submitted on the briefs of Erica L. Bauer, Appleton.
On behalf of the plaintiff-respondent, the cause was submitted on the brief of Joshua L. Kaul, attorney general, and Sarah L. Burgundy, assistant attorney general.
Before Stark, P.J., Hruz and Seidl, JJ.
¶1 Kevin Jereczek appeals a judgment convicting him of a single count of possession of child pornography as a party to the crime. Jereczek argues the circuit court erroneously denied his suppression motion, in which he alleged that law enforcement had exceeded the scope of consent he had given to search their family computer. Specifically, Jereczek and the State stipulated that he had told officers they could search only his son's user account on the computer.
¶2 We conclude law enforcement exceeded the scope of that consent when they began their forensic examination of the computer's hard drive by examining the drive's recycle bin container, which aggregated the deleted files of all of the computer's users, including Jereczek. When a person limits his or her consent to search to a particular user account on an electronic device, a reasonable person would interpret that consent as being limited to only those files accessible from that account's user interface. In other words, and contrary to the State's argument, Jereczek's consent did not authorize a search of all files in any shared areas in the computer where data associated with the son's user profile might be found. It authorized a search of only those areas and files visible when one operates within a particular user's account—here, the son's.
¶3 The law enforcement analyst in this case testified that a particular user, while operating within his or her own account, cannot view the deleted files of another user. The analyst also testified that he knew he was likely to encounter the files of other users in the computer's recycle bin while using his forensic software to search the computer. The search of the entire recycle bin was therefore unlawful, and the evidence derived from that search should have been suppressed. We reverse and remand for the circuit court to grant Jereczek's suppression motion and for further proceedings consistent with this opinion.
¶4 A criminal complaint and an Information charged Jereczek with eleven counts of possession of child pornography as a party to the crime. The complaint alleged that Jereczek's son was a suspect in a sexual assault investigation, and police believed that the family computer the son used may have had pornography on it related to the assault. Police met with Jereczek, who gave a desktop computer to police for forensic analysis with the instruction that police were to limit their analysis to the son's user account.
¶5 As described in more detail below, police discovered images appearing to be child pornography when they began their forensic review of the computer's hard drive—specifically, of its recycle bin. Based on these findings, police obtained a warrant to search the entire hard drive. Jereczek filed a motion to suppress the images discovered during the initial forensic analysis and during the subsequent warrant search, asserting that the scope of the initial search exceeded the consent Jereczek had given insomuch as it included the review of files outside of the son's user account.
¶6 At the hearing on Jereczek's motion, he and the State reached a stipulation regarding the scope of consent he had given to search the computer.1 Specifically, the parties agreed that Jereczek had given limited consent that allowed police to search only his son's user account. The evidentiary portion of the hearing was held to ascertain whether the initial, pre-warrant forensic analysis of the hard drive occurred within the scope of that consent. The only witness to testify was Tyler Behling, the computer forensic crime analyst who had analyzed the hard drive for the Brown County Sheriff's Department.
¶7 Behling testified he had received the computer from an officer with instructions to locate images of child pornography on the son's user account. Behling removed the hard drive, which had the Windows 7 operating system installed, and connected it to a "write blocker" to prevent modifying the data on the hard drive disc. He also used software called EnCase to examine the contents of the file system on the drive. Behling testified that the software shows law enforcement the file system and data structure of the hard drive, and it "allows us an overview of the entire contents of the disc."
¶8 Behling explained that he began his search in the computer's recycle bin container, at which time he discovered that it contained child pornography that had been deleted from two user accounts.2 Based upon this discovery, Behling applied for a search warrant for the entire contents of the hard drive. According to Behling, the recycle bin is "a container to temporar[ily] hold files that a user would delete." The recycle bin is a shared container on the hard drive into which any user on a multi-user operating system is able to place discarded files.
¶9 Behling provided further details about how a recycle bin functions. If a user logged into a particular account deletes a file (thereby placing the file in the recycle bin), that user would be able to view the deleted file from his or her account, but other users logged into different accounts would not be able to see it. Because Behling's forensic software read data directly from the hard drive disc and did not use the operating system's user interface, Behling could view the aggregate files placed in the recycle bin by all of the computer's users. In other words, under the approach Behling used, the files appearing in the recycle bin were not separated by user account. Behling was aware when he accessed the recycle bin that he would likely find files deleted by other user accounts.
¶10 When Behling initially discovered that there were files containing child pornography in the recycle bin, he did not know the user account or accounts from which they had come. He used other software to examine registry data—which is external to any user account—to identify "artifacts about the user account," including the groups to which the user belongs, the user's security identifier, and the user's last log-in date. Using a globally unique identifier associated with each of the deleted files, Behling was able to connect the deleted images to particular user accounts, at which point he applied for the warrant. Behling stated that prior to obtaining the warrant, he did not believe he had accessed any particular user account.
¶11 Behling also provided additional testimony about the scope of consent provided in relation to his forensic examination. Behling was aware that Windows by default includes multiple user accounts, that there were in fact multiple user accounts on the operating system, and that he was supposed to limit his analysis to the son's user account. Behling testified there are "difficulties" with targeting a specific user profile when conducting a forensic search of a multi-user device, and for this reason he would typically "just start with a warrant" for such devices. Nonetheless, Behling stated that he did not explain to the referring detective any of his concerns regarding his technical ability to adhere to the scope of consent.
¶12 Moreover, Behling conceded that he could have limited his search of the hard drive in a way that was consistent with the scope of consent. Although he initially testified it was impractical to restrict a search to a particular user's profile, he subsequently clarified that it was "not impossible" to do so, "but your exam would not be complete." Instead, using the EnCase software, Behling could select to view all the user data under a single user profile. This type of analysis would be confined to the user's "home profile path," which is the file structure for each profile and includes "downloads, your documents, music, pictures, that type of material." But Behling testified that such an analysis would exclude the recycle bin, something he "would never exclude" when looking for evidence of child pornography.
¶13 The circuit court denied the suppression motion. It began its decision by emphasizing some of Behling's testimony—in particular, that Behling usually started his analysis with the recycle bin because, in his experience, people would often delete illegal files after viewing them. The court also emphasized Behling's testimony that he would never exclude the recycle bin from a search for child pornography and that he would eventually look at the files located there. After highlighting Behling's testimony regarding the difficulties with limiting a forensic search to a particular user account, the court determined Behling did not exceed the scope of consent.3
¶14 Specifically, the circuit court concluded that even if Behling had started with the user data on the son's account, Behling "would have followed the information into the recycle bin where he would have seen the multiple child porn images from the multiple user accounts."4 The court applied the "inevitable discovery" doctrine as articulated in Nix v. Williams , 467 U.S. 431, 104 S.Ct. 2501, 81 L.Ed.2d 377 (1984), and State v. Weber , 163 Wis. 2d 116, 471 N.W.2d 187 (1991), to conclude that Behling "would have eventually discovered the evidence of the crime in the recycle bin and then asked for a search warrant."
¶15 Following the suppression ruling, Jereczek entered a no-contest plea to a single count of possession of child pornography as a party to the crime. The remaining counts were dismissed outright. The parties agreed to jointly recommend a sentence...
To continue reading
Request your trial
-
Schwab v. Schwab
... ... required QDRO, however, because from the time of their divorce until the law was amended in 1998, Wisconsin law prohibited the assignment of state pension benefits via a QRDO. Id. , 6. Upon learning in 2010 that Masters had retired a year earlier, Johnson filed a QDRO. When Masters refused to ... ...
-
State v. Mefford
... ... consent to determine the permissible scope of the search ... See, e.g. , United States v. Lopez-Cruz , 730 ... F.3d 803, 811 (9th Cir. 2013) (holding that consent to search ... a cell phone does not extend to answering incoming calls on ... the cell phone); Wisconsin v. Jereczek , 961 N.W.2d ... 70, 72 (Wis. Ct. App. 2021) (forensic extraction of ... computer's hard drive exceeded the scope of ... defendant's consent, which was limited to a search of ... only his son's user account); Maine v. Bailey , ... 989 A.2d 716, 725 (Me. 2010) (consent to search a computer ... ...
-
State v. Mefford
...that consent to search a cell phone does not extend to answering incoming calls on the cell phone); Wisconsin v. Jereczek , 398 Wis.2d 226, 961 N.W.2d 70, 72 (Wis. Ct. App. 2021) (forensic extraction of computer's hard drive exceeded the scope of defendant's consent, which was limited to a ......