## Facts

- A detective reviewing information in the police department’s child-protection system saw that a particular Internet protocol (IP) address was generating query-hit results for known child-pornography files.
- The detective determined the IP address was associated with a Comfort Inn and inferred that someone was using the hotel’s wireless network and Shareaza (a peer-to-peer client) on the Gnutella network.
- To locate the wireless device, the detective obtained a court order authorizing use of pen-register and trap-and-trace devices to obtain dialing, routing, addressing, and signaling information for wireless communications in the vicinity of the Comfort Inn.
- The detective configured a monitoring device to search for “Gnutella” and “Shareaza,” and not to search for explicit file-name terms (e.g., “preteen hardcore”).
- The device generated hits and sent the detective emails containing routing and signaling information associated with the detected communications.
- A second device detected the addresses of the wireless network adapters involved in the communications, which led officers to a van parked near the Comfort Inn.
- Officers observed a laptop computer running on the van’s seat and obtained a warrant to search the van.
- The search resulted in seizure of two computers and four external storage drives that contained child-pornography files.
- John C. Saville, the occupant of the van, was charged with receiving child pornography.
- Saville moved to suppress the evidence, arguing the pen-trap operation captured “content” (not permitted under the pen-trap statute) and therefore was an unlawful, warrantless search under the Fourth Amendment that tainted the later warrant and seizure.
- Saville presented expert testimony that the emails sent to the detective contained a “header” (routing/signaling) and a “payload” (content), and that “Gnutella” appeared in the payload.
- The detective testified that what was captured related to the initial connection between computers and amounted only to dialing, routing, addressing, and signaling information.

## Issues

1. Whether the information captured under the pen-register/trap-and-trace order—triggered by “Gnutella” and “Shareaza”—was “content” of an electronic communication rather than permissible dialing, routing, addressing, and signaling information.
2. If the capture was content, whether the government conducted an unreasonable search under the Fourth Amendment requiring suppression.
3. Whether the warrant search of the van and resulting seizures were suppressible as fruit of any unlawful pen-trap collection.

## Decision

- The court denied Saville’s motion to suppress.
- The court concluded the pen-register/trap-and-trace operation, as configured and used, captured only dialing, routing, addressing, and signaling information and did not intercept communication content.
- Because the pen-trap collection was lawful, the later search warrant was not tainted, and the evidence seized from the van was admissible.

## Legal Principles

- The federal pen-register/trap-and-trace statute authorizes collection of dialing, routing, addressing, and signaling information, and does not authorize interception of communication contents.
- “Content” means information concerning the substance, purport, or meaning of a communication; courts look to what the information represents in the communication process, not simply where it appears in a packet (such as “header” versus “payload”).
- Identifiers associated with establishing or identifying a peer-to-peer session (including protocol/client identifiers used during initial communications) may be treated as signaling or addressing information when they do not reveal the substance of what was communicated.
- When the government’s collection fits within a valid pen-trap order and does not capture content, suppression is not warranted on statutory or Fourth Amendment grounds.
- If the initial collection is lawful, later warrants supported by that collection are not invalid as derivative evidence, and the fruit-of-the-poisonous-tree doctrine does not require suppression.

## Conclusion

United States v. John C. Saville denied suppression where officers used a pen-register/trap-and-trace order near a hotel’s Wi‑Fi to capture Gnutella/Shareaza-related signaling and adapter-address information that led them to Saville’s van; the court treated the captured data as non-content routing/signaling information, found no Fourth Amendment violation, and allowed the evidence seized under the subsequent van search warrant to be used in the prosecution for receipt of child pornography.


United States v. John C. Saville, 2013 U.S. Dist. LEXIS 89281 (2013)