United States v. Bebris, 20-3291

• Decision Date: 15 July 2021
• Docket Number: No. 20-3291,20-3291
• Citation: 4 F.4th 551
• Parties: UNITED STATES of America, Plaintiff-Appellee, v. Alexander BEBRIS, Defendant-Appellant.
• Court: U.S. Court of Appeals — Seventh Circuit

4 F.4th 551

UNITED STATES of America, Plaintiff-Appellee,

v.Alexander BEBRIS, Defendant-Appellant.

No. 20-3291

United States Court of Appeals, Seventh Circuit.

Argued May 13, 2021

Decided July 15, 2021

Timothy W. Funnell, Attorney, Office of the United States Attorney, Green Bay, WI, Jonathan H. Koenig, Attorney, Benjamin W. Proctor, Attorney, Office of the United States Attorney, Milwaukee, WI, for Plaintiff-Appellee.

Jason D. Luczak, Attorney, Kathryn A. Keppel, Attorney, Gimbel, Reilly, Guerin & Brown LLP, Milwaukee, WI, for Defendant-Appellant.

Sopen B. Shah, Attorney, Perkins Coie LLP, Madison, WI, for Amicus Curiae.

Before Sykes, Chief Judge, and Scudder and Kirsch, Circuit Judges.

Kirsch, Circuit Judge.

Alexander Bebris sent child pornography over Facebook's private user-to-user messaging system, Facebook Messenger, in 2018. Bebris's conduct was initially discovered and reported by Facebook, which licenses a "hashing" or (in overly simplified layman's terms) image-recognition technology developed by Microsoft called PhotoDNA. PhotoDNA provides the capability to scan images uploaded onto a company's platform and compares the "hash" (or essence) of a photo with a database of known images of child pornography.¹ Thus, through that technology, three of Bebris's messages were flagged by PhotoDNA. Facebook employees reviewed the flagged images and reported them to the CyberTipline of the National Center for Missing and Exploited Children ("NCMEC"), as required by 18 U.S.C. § 2258A(a). NCMEC then reported the images to Wisconsin law enforcement officials, who eventually obtained a warrant and searched Bebris's residence, where they found a computer containing numerous child pornography files. Bebris was charged federally with possessing and distributing child pornography.

Bebris argued before the district court that the evidence against him should be suppressed, specifically contending that Facebook took on the role of a government agent (subject to Fourth Amendment requirements) by monitoring its platform for child pornography and reporting that content. On appeal, Bebris reprises this argument but primarily contends that he was deprived of the opportunity to prove that Facebook acted as a government agent because the district court denied his Federal Rule of Criminal Procedure 17(a) subpoena seeking pre-trial testimony from a Facebook employee with knowledge of Facebook's use of PhotoDNA. The district court, however, properly exercised its discretion in quashing that subpoena, as it sought cumulative testimony to material already in the record. The record included a written declaration from Microsoft and Facebook and live testimony from an executive at NCMEC, which administers the federal reporting system. On the merits, the district court did not err in its conclusion that Facebook did not act as a government agent in this case. Thus, we affirm.

I

Bebris sent messages to a woman via Facebook Messenger, a user-to-user private messaging service that is part of Facebook. PhotoDNA, a program developed by Microsoft and implemented in Facebook Messenger, flagged some of those messages, which contained images that matched known child pornography. PhotoDNA is an "image-mapping" technology that uses a mathematical algorithm to create a unique "hash value" based on the digital essence of a photo. The hash value of images uploaded and sent via Facebook Messenger are automatically compared to a database of the hash values of known child pornography, which is compiled and maintained by NCMEC. If the program returns a presumptive hit for child pornography, Facebook employees review the flagged images and then send the images and certain user information to NCMEC as "CyberTipline Reports," or "CyberTips," in accordance with 18 U.S.C. § 2258A.

In Bebris's case, three images were flagged as suspected child pornography and forwarded to NCMEC, which ultimately forwarded the information to state law enforcement agencies in Wisconsin. The Wisconsin authorities then subpoenaed internet data and identified the IP address that uploaded the photos as belonging to Bebris. They obtained a state search warrant and executed it at Bebris's residence, where they seized numerous electronic devices, including a computer that contained numerous child pornography files.

Bebris was subsequently charged in federal court with possessing and distributing child pornography in violation of 18 U.S.C. §§ 2252A(a)(2)(A) and (a)(5)(B). He filed a motion to suppress evidence, arguing that Facebook (and NCMEC and law enforcement) violated his Fourth Amendment rights by searching his Facebook messages without a warrant. In support of that theory, Bebris argued that Facebook assumed the role of a government agent by monitoring for and reporting suspected child pornography to NCMEC. Bebris requested an evidentiary hearing and sought to elicit testimony relating to Facebook's cooperation with NCMEC and the government. Bebris additionally sought to elicit testimony from Facebook regarding whether he had an expectation of privacy over his Facebook messages and the scope of Facebook's search of his messages. Bebris argued in the alternative that even if Facebook did not act as a government agent, law enforcement impermissibly expanded Facebook's private search when it viewed images not previously opened by Facebook.²

The district court set the matter for an evidentiary hearing, and Bebris subpoenaed Microsoft, NCMEC, and Facebook, seeking testimony from each pursuant to Federal Rule of Criminal Procedure 17(a). Microsoft agreed to set forth certain facts in a stipulation. NCMEC agreed to make an executive available for the hearing.

The Facebook subpoena, dated October 14, 2019, requested testimony from the "Person Most Knowledgeable of" three topics:

(1) Facebook's use of PhotoDNA, "including but not limited to Facebook's agreement to sublicense the software, Facebook's policies and procedures in utilizing the software, information stored by Facebook which was discovered by use of the software, and Facebook's policies and procedures in reporting any content discovered by the software,"

(2) "ongoing PhotoDNA training offered by Facebook and/or an outside entity," and

(3) "cooperation" among Facebook, Microsoft, or NCMEC.

R. 41, Ex. 2. Following the receipt of the subpoena, Bebris's attorney and Facebook's attorneys attempted to agree on facts Facebook would stipulate to, but no agreement was reached. On November 27, 2019, Facebook filed a declaration from its Project Manager for Safety on the Community Operations team, Michael Francis Xavier Gillin, II. Facebook also filed a motion to quash the subpoena that same day, arguing that Gillin's declaration obviated the need for live testimony, which would be duplicative of those facts in the sworn declaration. At the December 3, 2019 evidentiary hearing, Facebook's attorneys appeared in the district court. The district court stated that it would set a briefing schedule for a response to the motion to quash and, in the event that Bebris prevailed on the motion, would continue the evidentiary hearing with Facebook's testimony at a later date. The government stated that it viewed the declaration as sufficient for the court to rule on the motion to suppress without additional live testimony.

The evidentiary hearing proceeded with testimony from NCMEC Vice President John Shehan, who discussed (1) PhotoDNA and NCMEC's hash value database; (2) CyberTipline Reports; (3) oversight and funding of NCMEC by the United States government; and (4) NCMEC's partnership with Facebook. After the testimony concluded, the district court heard additional argument from Bebris, the government, and Facebook on the motion to quash. An attorney from Facebook stated that the company would be willing to supply a supplemental declaration addressing concerns raised by Bebris's counsel, specifically relating to the level of cooperation and training between NCMEC and Facebook and whether someone at Facebook had viewed the images before sending a report to NCMEC. In his supplemental brief, Bebris requested another evidentiary hearing and listed more than 100 questions he wanted to ask a Facebook witness at that hearing. In its supplemental response, Facebook argued that live testimony was not needed, and it provided a supplemental declaration from the same declarant, Gillin.

Gillin's declarations³ stated, in relevant part, that:

(1) Facebook has an independent business purpose in keeping its platform safe and free from harmful content and conduct, including content that sexually exploits children. As [its] Community Standards explain, "We do not allow content that sexually exploits or endangers children. When we become aware of apparent child exploitation, we report it to the National Center for Missing and Exploited Children (NCMEC), in compliance with applicable law." Our community Standards regarding Child Nudity and Sexual Exploitation of Children are publicly available on our website here: https://www.facebook.com/communitystandards/child_nudity_sexual_exploitation.

(2) Facebook identifies content and conduct that might violate its Community Standards in various ways. [The relevant CyberTipline Reports] were based on images Facebook identified using a software called PhotoDNA, which Facebook did not create but instead licensed directly from Microsoft, another private company. Facebook uses PhotoDNA software to identify potential child exploitation content, as well as to identify other types of violations of its Terms of Service or Community Standards. Information about how PhotoDNA works is publicly available, for example, at https://www.microsoft.com/en-us/photodna. Facebook did not license the software from NCMEC or anyone other than Microsoft directly.

(3) Facebook does not receive training from NCMEC regarding the use or operation of PhotoDNA or its processes for reporting to CyberTipline, meaning Facebook does not receive training from NCMEC on Facebook's

...