United States v. Kight
| Decision Date | 11 March 2020 |
| Docket Number | CRIMINAL CASE NO. 1:18-cr-00169-TWT-RGV |
| Parties | UNITED STATES OF AMERICA v. CHRISTIAN WILLIAM KIGHT |
| Court | U.S. District Court — Northern District of Georgia |
Defendant Christian William Kight ("Kight") is charged with one count of extortion, in violation of 18 U.S.C. § 1951; one count of computer fraud and abuse, in violation of 18 U.S.C. § 1030(a)(5)(A); one count of computer fraud and abuse, in violation of 18 U.S.C. § 1030(a)(7)(C); one count of extortion by interstate communication, in violation of 18 U.S.C. § 875(d); and five counts of wire fraud, in violation of 18 U.S.C. § 1343. [Doc. 1].1 Kight has filed a motion to suppress evidence resulting from execution of search warrants,2 [Doc. 20], which the government opposes, [Doc. 25], and he has filed a reply in support of his motion, [Doc. 27]. Kight also has filed a motion to suppress statements made to lawenforcement, [Doc. 21], and following an evidentiary hearing on November 9, 2018,3 the parties submitted post-hearing briefs on this motion, see [Docs. 35, 40 & 41]. For the reasons that follow, it is RECOMMENDED that both motions to suppress, [Docs. 20 & 21], be DENIED.
On January 24, 2018, the Federal Bureau of Investigation ("FBI") began investigating an unauthorized intrusion into the computer network of a business (the "victim-company") located in the Northern District of Georgia. [Doc. 20-2 at 14 ¶ 4, 15 ¶ 6]; see also [Doc. 25-2]; (Tr. at 3).4 The victim-company reported to the FBI that sensitive data had been exfiltrated through the unauthorized intrusion into their computer network. [Doc. 20-2 at 15 ¶ 6]. The investigation revealed that someone using the email address drillo@tuta.io began communicating with the victim-company's CEO on January 23, 2018, about the unauthorized computer intrusion. [Id. at 17-19 ¶¶ 11-17]. Those emails confirmed the intrusion, that the writer hadexfiltrated files belonging to the victim-company, sought an offer of payment in exchange for the return of the stolen data files, and threatened to disseminate the stolen data files as well as send reputation-harming letters to the victim-company's clients. [Id.]. The victim-company tracks internet users through "cookies," which are small data files sent to a user's web browser upon accessing a website, [id. at 15-16 ¶¶ 7-10 (internal marks omitted)], and sells anonymized data, gathered from these cookies, to marketing companies for the purpose of targeting specific types of customers. [Id. at 17 ¶ 10c]. Once sent to the user's computer, the cookie generally remains on the user's computer system until it is deleted, thus tracking and logging the websites later visited by the user. [Id.]. The cookie also logs the IP addresses of the user. [Id. at 22 ¶ 24]. Each cookie is unique, which the victim-company refers to as a "visitor_id." [Id. at 21 ¶ 22 (internal marks omitted)].
The victim-company determined that the intruder had gained access to their computer network through an internal user credential, "desktop-nexus." [Id. at 19-20 ¶ 18]. That login, "desktop-nexus," had significant privileges within the victim-company's computer network, which allowed the intruder to access multiple servers and databases containing sensitive information. [Id.]. Between January 17, 2018, and January 24, 2018, three (3) IP addresses appeared in the victim-company's connection logs for the compromised credential "desktop-nexus." [Id. at 20-21 ¶¶19-20]. Of those three attacker IP addresses, the victim-company happened to have several unique "visitor_id" cookies linked to two of them; most importantly, to IP address 104.238.45.78. [Id. at 21-22 ¶¶ 21-23].
One cookie in particular ( the "subject cookie") revealed the user accessing the victim-company's websites from multiple IP addresses, including 104.238.45.78. [Id. at 22-23 ¶¶ 23-24]. IP address 104.238.45.78 resolved to a virtual private network ("VPN"), which is a remote location address sometimes used to obscure the true location of a user. [Id. at 20-21 ¶ 19, 22-23 ¶¶ 24, 27]. However, the subject cookie that had accessed the victim-company's website from that IP address also accessed the victim-company's website from other IP addresses. [Id. at 22-23 ¶ 24]. One of those other IP addresses resolved to a residence located at 3150 Inclinado, San Clemente, California ("the residence"), owned by L.K., Kight's mother. [Id. at 23-25 ¶¶ 27-28, 31c]. Subsequent investigation revealed that Kight and another individual, Tak Cheong ("Cheong"), also resided at the residence with L.K.5 [Id. at 24 ¶ 30].
Data provided by the victim-company from the logs of the subject cookie revealed other websites visited by the intruder, in addition to the victim-company sites. [Id. at 26 ¶ 33]. One of those websites was www.up-4ever.com, which is a file sharing site that allows users to post files online. [Id. at 26 ¶ 34]. The specificwebpage identified by the subject cookie linked to a posting by a user with the screenname "sourzombie." [Id. at 26 ¶¶ 33-34 (internal marks omitted)]. Additional investigation of the screenname "sourzombie" identified several other websites with users posting under that name. [Id. at 27 ¶ 35]. In one public post, "sourzombie" claimed to be proficient in computer programming and database administration, and listed the age of 26, the same age as Kight at the time of the post. [Id.]. Another website with a post from "sourzombie" offered for sale a gold pen with a photo link. [Id. at 28 ¶¶ 36-37]. Clicking on the link revealed that the publicly listed owner of the photo account is Cheong. [Id. at 28 ¶ 37].
On April 16, 2018, FBI Special Agent Beverly Mayo ("SA Mayo") applied for a search warrant for Kight's residence in California. [Doc. 20-2 at 2-40]. A United States Magistrate Judge for the Central District of California signed the search warrant that day, [Doc. 20-1 at 2], and agents executed the warrant the following day, [id. at 3]. Around 6:00 a.m. on April 17, 2018, an FBI SWAT team approached and entered the residence pursuant to the search warrant and was responsible for clearing the house of occupants and securing the location for execution of the warrant. (Tr. at 5-6, 28). The SWAT team used flash bangs in order to distract and disorient the occupants so that the residence could be secured without incident. (Tr. at 6-7, 35, 38). The four occupants of the house, Kight, his mother, Cheong, and aboarder, were handcuffed and removed from the residence. (Tr. at 8-9, 13). After the SWAT team secured the scene, they contacted the case agent, FBI Special Agent Tyson Fowler ("SA Fowler"), who was not involved in the initial approach to the residence, but instead waited at a nearby location, and he arrived at the residence at approximately 6:15 to 6:20 a.m. (Tr. at 8-9).
When SA Fowler arrived, the occupants of the residence were sitting on a low wall along the driveway, either without handcuffs or in the process of being uncuffed. (Tr. at 9, 13). Kight was sitting along this wall, wrapped in a blanket and holding his dog. (Tr. at 9-10, 13). The weather was clear and the temperature was approximately in the fifties. (Tr. at 9). SA Fowler introduced himself to Kight and asked if he needed anything, such as a blanket, shoes, or water, but they did not talk about the case at this time. (Tr. at 12-13). SA Fowler observed that Kight was physically okay and lucid. (Tr. at 13). Between approximately 15 to 25 agents entered the residence after it was secured by the SWAT team to begin executing the search warrant. (Tr. at 10).
About an hour after arriving at the scene, SA Fowler began an interview of Kight in the master bathroom of the residence. (Tr. at 12-14, 16, 38-39, 48-49). SA Mayo also was present for the interview, which was recorded and lasted about twohours. (Tr. at 14-15, 18-19, 23); see also (Gov't Ex. 3).6 Because the search of the residence was underway, the door to the bathroom was closed at some point to accommodate the recording of the interview by minimizing noise from the ongoing search. (Tr. at 19-20). SA Fowler testified that the bathroom was larger than most interview rooms he had used at the FBI office. (Tr. at 18; Gov't Exs. 5, 6, & 7). Kight sat on a stool in the middle of the bathroom, and SA Fowler and SA Mayo sat on the tiled edge of the tub. (Tr. at 18-20). Kight's dog was in the bathroom with him, and Kight was not handcuffed during the interview, nor was his access to the door blocked by the agents. (Tr. at 18-19). The interview was later moved to a second location because the search team was ready to search the bathroom. (Tr. at 21). The second portion of the interview took place in what SA Fowler described as a craft room. (Tr. at 21-22; Gov't Exs. 8 & 9). Again, Kight and the two agents were the only people present for the interview, and the agents were seated in front of the closet door, over by the craft table, and Kight sat in the middle of the room on a stool, and his access to the door was not blocked. (Tr. at 22; Gov't Ex. 9).7 The agents were armed,but neither unholstered their weapons at any time, nor did they touch Kight in an aggressive manner.8 (Tr. at 19).
SA Fowler testified that Kight, who was approximately 27 years old at the time, appeared to be intelligent and was articulate and coherent during the interview, and there were no signs of intoxication. (Tr. at 13-14). The agents afforded Kight a bathroom break, as well as one for his dog, and water breaks. (Tr. at 20-21). The tone of the interview was conversational and neither agent raised their voice or threatened Kight. (Tr. at 20; Gov't Ex. 3). SA Fowler told Kight multiple times during the interview that the interview was voluntary and that he was free to leave. (Tr. at 20; Gov't Ex. 4 at 5-7, 32, 102, 126). Kight was on state parole at the time of the interview, and SA Fowler had been in touch with his parole officer to gather information about...
To continue reading
Request your trial