United States v. Wolfenbarger
| Decision Date | 29 August 2019 |
| Docket Number | Case No. 16-CR-00519-LHK-1 |
| Court | U.S. District Court — Northern District of California |
| Parties | UNITED STATES OF AMERICA, Plaintiff, v. JOHNNY RAY WOLFENBARGER, Defendant. |
A federal grand jury indicted Defendant Johnny Ray Wolfenbarger ("Defendant") on one count of attempted production of child pornography, in violation of 18 U.S.C. § 2251(c) and (e); one count of attempted coercion and enticement of minors, in violation of 18 U.S.C. § 2422(b); and one count of receipt of child pornography, in violation of 18 U.S.C. § 2252(a)(2). ECF No. 1.
Before the Court are two motions to suppress filed by Defendant. In one, Defendant seeks to suppress evidence seized from Defendant's Yahoo email account on the basis that Yahoo acted as a government agent pursuant to the Fourth Amendment and United States v. Walther, 652 F.2d 788 (9th Cir. 1981). In the other, Defendant seeks to suppress all evidence pursuant to Franks v. Delaware, 438 U.S. 154 (1978). The Court held an evidentiary hearing on July 12, 2019 and July 23, 2019. See ECF Nos. 199, 203. Having considered the briefs and declarations, the testimony from the evidentiary hearing, the relevant law, and the record in this case, the Court DENIES both of Defendant's motions to suppress.
Yahoo is an Internet service provider ("ISP"). Although Verizon purchased Yahoo in 2017 and renamed the company Verizon Media, the parties and witnesses all refer to the company as Yahoo. Moreover, many of the events in question occurred before Verizon purchased Yahoo, and the witnesses and exhibits frequently refer to the company as Yahoo rather than Verizon Media. The Court follows suit.
Sean Zadig, Senior Director of Cyber Defense at Verizon Media, has worked at Yahoo since 2014 and testified about Yahoo's operations. Tr. at 163:19-25. Prior to his current role, Zadig was the team lead for Yahoo's E-Crime Investigation Team ("ECIT"). Tr. at 165:1-7. Zadig testified that ECIT was formed "to investigate abuse on our user platforms, primarily violations of our terms of service." Id. at 170:16-18. A user must agree to those terms of service ("TOS") when the user creates a Yahoo account. Id. at 172:21-24. Yahoo's TOS states: "By accessing and using the Yahoo Services, you accept and agree to be bound by the terms and provision [sic] of the TOS." Ex. Q at 8.
On December 18, 2013, Defendant created the Yahoo user account jrwolfen02. Tr. at 168:23-169:2. Under the TOS in effect on that date, any user creating an account agreed not to transmit unlawful or obscene conduct over Yahoo's services: "You agree to not use the Yahoo Services to: a. upload, post, email, transmit, or otherwise make available any Content that is unlawful, harmful, threatening, abusive, harassing, tortious, defamatory, vulgar, obscene, libelous, invasive of another's privacy, hateful, or racially, ethnically, or otherwise objectionable." Ex. Q at 10. A user also agreed not to use Yahoo's services to "harm minors in any way." Id.
When a user registers for certain Yahoo services, such as Yahoo Messenger, the user must agree to terms of service specific to those services. Tr. at 177:11-16. Yahoo Messenger'sadditional terms of service ("ATOS") provide that "the user agrees not to use the services in any unlawful manner, for any unlawful purpose, or in any manner inconsistent with the ATOS or the TOS." Ex. Q at 25. Accordingly, Zadig testified that Yahoo's TOS and the Messenger ATOS prohibit child pornography and child sexual abuse materials. Tr. at 180:17-21. Yahoo's TOS provides that Yahoo may screen content stored in user accounts to "comply with legal process" or "enforce the TOS," among other reasons. Ex. Q at 11, 19.
Zadig offered multiple reasons why Yahoo prohibits child sexual abuse materials on its services. First, Yahoo "seek[s] to create a safe place for our users to engage in online conduct and to communicate with each other, to post and exchange ideas," but child pornography creates an unsafe environment for Yahoo's users, especially potential minor users. Id. at 182:20-22; 182:23-25. A person as young as 13 years old can create a Yahoo account. Id. at 186:6-8.
Second, child pornography threatens Yahoo's advertising revenue stream. Id. at 183:1-4. Zadig testified that after Google detected child pornography on several blogs on Tumblr—which Yahoo owns—Google threatened to suspend Tumblr from Google's Adsense network. Id. at 184:9-14. In December 2018, Apple also temporarily blocked Tumblr's app from the Apple App Store "because Apple had detected child pornography on one single blog within the Tumblr ecosystem." Id. at 184:15-20. Both actions posed a significant threat to Yahoo. Without a presence in the App Store, for example, no new mobile user could access Tumblr and view ads on Tumblr. Id. at 185:21-25. Yahoo's investigations of violations of its TOS and attempts to remove child pornography are factors that "allowed Apple to let us relist the Tumblr app on the App Store." Id. at 367:19-25. Zadig also testified that advertisers had boycotted other ISPs as a result of child sex abuse material on those ISPs' services. Id. at 185:6-11.
To enforce Yahoo's TOS, Yahoo's moderation team proactively scans accounts for child sexual abuse materials and reviews user-submitted reports of abuse. Id. at 186:21-187:1. After its review, the moderation team may, if required by statute, file a CyberTipline Report ("CyberTip") with the National Center for Missing and Exploited Children ("NCMEC"). Id. at 187:1-3. Yahoo's ECIT reviews the submitted CyberTips for four criteria: (1) a child in imminent danger;(2) a user in a position of authority, such as a pastor, doctor, or school teacher; (3) a user with access to children; or (4) a user that is a sex offender with prior contact offenses. Id. at 191:14-21. If any of those four criteria are met, ECIT conducts a supplemental investigation of that account, related accounts, and publicly available information about the user. Id. at 191:22-192:1. Yahoo will also deactivate an account when Yahoo files a CyberTip. Id. at 331:15-19.
NCMEC, the organization to whom Yahoo sends CyberTips, is a non-governmental organization in Alexandra, Virginia. Tr. at 373:17-21. By statute, any ISP like Yahoo is required to send CyberTips to NCMEC to report both "apparent" or "imminent" violations of child pornography statutes. 18 U.S.C. § 2258A(a). Zadig testified that not all child pornography-related information is reportable to NCMEC. For example, a request for children to perform sex acts over webcam is not, alone, reportable as a CyberTip. Tr. at 302:24-303:6. By contrast, images or video in an account, or text conversations regarding travel for the purpose of child abuse must be reported. Id. at 302:10-23.
In turn, after NCMEC reviews the CyberTip, NCMEC must make CyberTips available to law enforcement, including "[a]ny Federal law enforcement agency that is involved in the investigation of child sexual exploitation." 28 U.S.C. § 2258A(c)(1). An ISP's "knowing and willful failure to make a report" is punishable by a fine of up to $300,000. Id. at § 2258A(e). According to FBI Special Agent Scott Schelble, NCMEC received approximately 1.5 million CyberTips each month while Schelble was detailed to NCMEC between 2013 and 2015. Tr. at 375:3-12.
The FBI and other federal agencies have law enforcement agents stationed as liaisons at NCMEC. Id. at 393:11-17. Schelble testified that at NCMEC, the FBI assists NCMEC with identifying the victims in child pornography images because a victim must be identified for a federal prosecution to proceed. Id. at 375:22-376:10. The FBI also performs a "deconfliction" function to ensure that multiple federal agencies are not investigating the same target. Id. at 378:4-13.
In August 2014, Xoom, an online payment processing service, notified Yahoo that Xoom had identified ten Yahoo Messenger accounts in the Philippines with profile pictures of child pornography. Tr. at 193:24-194:8. Xoom told Yahoo that the ten Yahoo Messenger accounts appeared to be receiving payments "indicative of web streaming." Id. at 194:3-5. According to Yahoo's Sean Zadig, Yahoo conduced a limited review and confirmed that the accounts "appeared to be engaged in the sale of live stream sexual abuse of children over Yahoo Messenger - Yahoo Messenger had a webcam feature which permitted this - as well as the sale of still photographs and videos, all of which appeared to be produced from the Philippines." Id. at 194:22-195:2.
Yahoo also determined that the ten Yahoo Messenger accounts were interacting with other Yahoo Messenger users who were attempting to buy the material:
So the sellers, or what we call people in the Philippines offering material for sale, they were saying that they had children of certain ages who could engage in sex shows via the Yahoo Messenger webcam feature. And we observed the buyers negotiating prices or asking for specific ages of children, some extremely young, some, you know, three, four, five, or even younger, as well as requesting that specific acts be, sexual acts be taken.
Id. at 196:19-197:1. Zadig testified that Yahoo was concerned that its services were being used for realtime abuse of children:
We were extremely concerned that - and upset that there was this live streamed realtime abuse of children happening essentially right now. We - that was - that's clearly not what the product had been envisioned to do. It had been envisioned to let people communicate with friends and family and share ideas and sort of do good things, and were rather upset that this was being used in such a horrible manner.
Id. at 198:22-199:4.
In late September 2014 and early October 2014, Yahoo sent NCMEC CyberTips for...
To continue reading
Request your trial