Facts
- A detective reviewing information in the police department’s child-protection system saw that a particular Internet protocol (IP) address was generating query-hit results for known child-pornography files.
- The detective determined the IP address was associated with a Comfort Inn and inferred that someone was using the hotel’s wireless network and Shareaza (a peer-to-peer client) on the Gnutella network.
- To locate the wireless device, the detective obtained a court order authorizing use of pen-register and trap-and-trace devices to obtain dialing, routing, addressing, and signaling information for wireless communications in the vicinity of the Comfort Inn.
- The detective configured a monitoring device to search for “Gnutella” and “Shareaza,” and not to search for explicit file-name terms (e.g., “preteen hardcore”).
- The device generated hits and sent the detective emails containing routing and signaling information associated with the detected communications.
- A second device detected the addresses of the wireless network adapters involved in the communications, which led officers to a van parked near the Comfort Inn.
- Officers observed a laptop computer running on the van’s seat and obtained a warrant to search the van.
- The search resulted in seizure of two computers and four external storage drives that contained child-pornography files.
- John C. Saville, the occupant of the van, was charged with receiving child pornography.
- Saville moved to suppress the evidence, arguing the pen-trap operation captured “content” (not permitted under the pen-trap statute) and therefore was an unlawful, warrantless search under the Fourth Amendment that tainted the later warrant and seizure.
- Saville presented expert testimony that the emails sent to the detective contained a “header” (routing/signaling) and a “payload” (content), and that “Gnutella” appeared in the payload.
- The detective testified that what was captured related to the initial connection between computers and amounted only to dialing, routing, addressing, and signaling information.
Issues
- Whether the information captured under the pen-register/trap-and-trace order—triggered by “Gnutella” and “Shareaza”—was “content” of an electronic communication rather than permissible dialing, routing, addressing, and signaling information.
- If the capture was content, whether the government conducted an unreasonable search under the Fourth Amendment requiring suppression.
- Whether the warrant search of the van and resulting seizures were suppressible as fruit of any unlawful pen-trap collection.
Decision
- The court denied Saville’s motion to suppress.
- The court concluded the pen-register/trap-and-trace operation, as configured and used, captured only dialing, routing, addressing, and signaling information and did not intercept communication content.
- Because the pen-trap collection was lawful, the later search warrant was not tainted, and the evidence seized from the van was admissible.
Legal Principles
- The federal pen-register/trap-and-trace statute authorizes collection of dialing, routing, addressing, and signaling information, and does not authorize interception of communication contents.
- “Content” means information concerning the substance, purport, or meaning of a communication; courts look to what the information represents in the communication process, not simply where it appears in a packet (such as “header” versus “payload”).
- Identifiers associated with establishing or identifying a peer-to-peer session (including protocol/client identifiers used during initial communications) may be treated as signaling or addressing information when they do not reveal the substance of what was communicated.
- When the government’s collection fits within a valid pen-trap order and does not capture content, suppression is not warranted on statutory or Fourth Amendment grounds.
- If the initial collection is lawful, later warrants supported by that collection are not invalid as derivative evidence, and the fruit-of-the-poisonous-tree doctrine does not require suppression.
Conclusion
United States v. John C. Saville denied suppression where officers used a pen-register/trap-and-trace order near a hotel’s Wi‑Fi to capture Gnutella/Shareaza-related signaling and adapter-address information that led them to Saville’s van; the court treated the captured data as non-content routing/signaling information, found no Fourth Amendment violation, and allowed the evidence seized under the subsequent van search warrant to be used in the prosecution for receipt of child pornography.