United States v. Rosenow, CASE NO. 17CR3430 WQH
| Decision Date | 20 November 2018 |
| Docket Number | CASE NO. 17CR3430 WQH |
| Court | U.S. District Court — Southern District of California |
| Parties | UNITED STATES OF AMERICA, Plaintiff, v. CARSTEN IGOR ROSENOW, Defendant. |
The matters before the Court are the motion to suppress evidence (ECF No. 29) and the motion to dismiss indictment (ECF No. 34) filed by Defendant Carsten Igor Rosenow.
Background facts
On or about September 19, 2014, Yahoo, Inc. ("Yahoo") was alerted by Xoom.com ("Xoom"), an on-line money transfer service, that a number of Yahoo accounts were involved in buying and selling child pornography. Zoom indicated to Yahoo that individuals from Zoom had seen child pornography activities on the Yahoo platform. Zoom reported to Yahoo ten email addresses that Zoom personnel believed had been engaged in the sale of child exploitation materials over Yahoo instant messenger.
Yahoo E-Crime Investigations Team (ECIT) initiated an investigation of the ten Yahoo accounts identified by Zoom in order to determine whether the accounts were engaged in activity that violated the Yahoo acceptable use policy or needed to be reported to the National Center for Missing and Exploited Children ("NCMEC'). The Yahoo investigation was lead by Sean Zadig, a senior manager for the Yahoo ECIT with supervisory responsibilities over investigations. Zadig is a former law enforcement agent.
The Yahoo ECIT conducts investigations involving the abuse of the terms of service of the Yahoo operating platforms. The Yahoo ECIT investigates activities prohibited by the Yahoo acceptable use policy and criminal activity on the Yahoo platform. Yahoo has policies against activities which the company does not want on Yahoo products, such as harassment, cyber intrusion, and child pornography. Yahoo privacy policies notify users that Yahoo will not share personal information unless "[w]e believe it is necessary to share information in order to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of Yahoo's terms of use, or as otherwise required by law." (ECF No. 49-4 at 3). Yahoo ECIT started with the ten accounts provided by Zoom. Yahoo ECIT looked at user information, contact lists for a particular user, subject lines of emails, snipets of chat conversations, and open source information, including Facebook and public records. Yahoo ECIT did not consult any outside agency or law enforcement agency in the investigation.
On October 3, 2014, Yahoo ECIT filed a supplement to an existing CyberTip with the NCMEC containing findings from the initial investigation of the seller and buyer accounts identified by Zoom to be engaged in the sale of child exploitation material. Yahoo ECIT made the initial report in order to provide information to NCMEC as quickly as possible because of the discovery of active child abuse. The report indicated that Yahoo ECIT found approximately 115 Yahoo accounts, operated from the Philippines, which were believed to be selling images, video, and live-streamed child exploitation materials via Yahoo mail and Yahoo messenger. Yahoo reported that the images were reviewed by Yahoo personnel and queued for reporting to NCMEC. Yahoo reported that a number of sellers had child sexual abuse images astheir Messenger profile picture and the seller accounts appeared to be broadcasting video on commercial "camgirl" websites. Yahoo reported that Yahoo reviewed the header metadata and not the mail content on the buyer accounts. Yahoo reported that based upon the header analysis, some of the buyer accounts appeared to be traveling to the Philippines. Aside from the information provided by Zoom and open source information, Yahoo ECIT did not use any information provided by any outside agency in the October 2014 report.
Following the submission of the October CyberTip to NCMEC, Yahoo ECIT contacted the Federal Bureau of Investigation (FBI), and the Department of Homeland Security (DHS) to notify these agencies that there was a supplement for their review at NCMEC. Zadig testified that Yahoo wanted to be sure that law enforcement was aware of their investigation. Zadig testified that the investigation had determined that children were being actively exploited and that some users were traveling to abuse children. Zadig testified that there are hundreds or even thousands of Cybertips reported per month and that Yahoo wanted to be sure that law enforcement knew that there were children in danger and would prioritize the Yahoo report.
On October 6, 2014, representatives of Yahoo met with representatives of NCMEC, the FBI, and Homeland Security Investigations (HSI) in Alexandria, Virginia to discuss the initiation of the Yahoo investigation, provide an overview of the Yahoo investigation, and advise law enforcement of the Yahoo process for legal service.
In November 2014, the Yahoo ECIT began a second investigation into potential buyers and sellers of child exploitation materials beyond the accounts identified in the initial investigation. Zadig testified that the initial referral in October 2014 contained a small number of individuals directly linked to the ten accounts identified by Zoom. Zadig testified that Yahoo was concerned that there was more activity on the platform and potentially more children in danger. Zadig testified that Yahoo ECIT undertook a second investigation without any direction from the NCMEC or law enforcement in order to go out a few more levels from the initial set of buyers and sellers. The secondinvestigation started with the buyers from the first investigation linked to additional sellers through the same investigatory methods.
Yahoo ECIT used open source information associated with the Yahoo accounts under investigation, including searching public sex offender registries and Facebook. In the second investigation, the Yahoo ECIT identified casandrarophilipps@yahoo.com as a seller account associated either by email address or SMS number to other seller accounts containing child abuse imagery, and europe_120@yahoo.com as a potential traveler to the Philippines for the purpose of child abuse based upon chat snippets.
On December 5, 2014, Yahoo ECIT sent a supplemental report to NCMEC, which outlined the results of the second investigation. Yahoo ECIT reported that it had observed 267 accounts, operated by at least 45 individuals, which appear to be selling child exploitation material. Yahoo indicated that the buyer list included 347 accounts which appeared to be purchasing images, video, or live streams from the seller accounts. Yahoo ECIT reported that 81 of the 347 buyer accounts appeared to be travelers who may be visiting the Philippines to abuse children. The buyer section of the report included information relating to email account europe_120@yahoo.com and included the name "Carsten Rosenow." Id. at 8. Yahoo provided a large batch of information to NCMEC, including subscriber and IP login information for the buyer accounts. Yahoo provided subscriber information for the email addresses europe_120@yahoo.com and crosenow@rocketmail.com. Yahoo identified these accounts as potential buyers traveling to the Philippines from contacts with a Philippines based seller and chat snippets.
No outside agency provided any information included in the Yahoo December 2014 report, and Yahoo did not consult any agency during the investigation. Yahoo ECIT notified the FBI and HSI that there was additional information for their review for the same reasons that Yahoo notified law enforcement agencies of the October 2014 report.
On December 16, 2014, Yahoo ECIT personnel attended a second meeting withNCMEC, the FBI, and HSI in Alexandria, Virginia.
After receiving the information from Yahoo, FBI Major Crimes Coordination Unit (MCCU), and HSI Cyber Crimes Center Child Exploitation Investigations Unit in Washington, D.C. began conducting a joint investigation into child exploitation involving hundreds of users of Yahoo services purchasing child exploitation materials. Agent Yenesky of the FBI testified that the overall investigation, referred to as "Operation Swift Traveler" or "Philippines Webcam," included a number of different individuals. Agent Yenesky testified that the overall investigation originated with the Yahoo reports through NCMEC. Agent Yenesky testified that law enforcement had no role in directing or participating in the Yahoo investigation. Agent Yenesky testified that he spoke to Zadig at Yahoo from time to time and that Zadig would contact him directly in order to make sure that Agent Yenesky was aware of information Yahoo was providing to NCMEC. Agent Yenesky testified that his investigation was separate from the Yahoo investigation, and that the meetings with Yahoo were necessary to review the large amounts of information as efficiently as possible. Agent Yenesky testified that the overall investigators would contact the particular appropriate field offices to investigate as the subjects of the investigation were identified.
Law enforcement served preservation requests on Yahoo accounts in October 2014, December 2014, and June 2015. Law enforcement collected wire transfer information from Western Union, Xoom, and Paypal pursuant to criminal summons issued by HSI for money transaction records associated with the seller accounts identified by Yahoo. This information included three transactions in which the email address crosenow@rocketmail.com transferred ten dollars to one of seller accounts identified by Yahoo. The shipping address listed was for Rosenow at a residential address in San Diego, California.
On February 19, 2015, FBI MCCU advised agents in the San Diego Division and the Chicago Division of the joint investigation and identified Carsten Rosenow as a potential suspect residing in the San Diego area. FBI MCCU summarized theinformation received regarding europe_120@yahoo.com and provided copies of the October and ...
To continue reading
Request your trial