good morning your honour's maybe please the court i'm wendy over myer with the federal public defender for the appellant joseph prasco and i'd like five minutes for rebuttal by the search warrant affidavit in this case and countless others rest entirely on untested forensic software of unknown reliability and capabilities and the affidavit here represents a pattern of these affidavits that we see over and over again in these types of cases and we s of this untested software by asking the district court and the motion to compel for the software which the district court denied and by testing the software prasco had an expert ready and waiting to test the software to see a number of unknowns to see if he was unconstitutionally investigated whether the software is reliable whether the evidence may be tainted somehow by the investigative software whether it can manipulate data on his computer or o with how a user would try and disable sharing now admittedly it was not set all the way to zero in this case it was said i believe down to about one instead of zero so that's an extremely low bandwidth setting and i'm not a forensic expert but it's an extremely low bandwidth setting when the setting is set that low so there's a question of how here than the basket department of justice could have downloaded so many images from his computer given the computer and evidence that would suggest that there was a problem i think my question is what is in this record that we could  w the ability for you to have this information in a why did more than just a conclusive room with i get to look at it yes in this case again it goes back to those shared settings that were reduced almost zero and that limited bandwidth and and the ability to upload their download i guess is the correct term so many images from prasco as computer that was the question here prasco always deny distribution in this case tonight  in his plea it also a sentencing that was a major point of contention receipt was generally admitted to so it's that issue of distribution which is similar to be busy i have a different software of the software that was used but but the issues are similar with the shared settings being reduced a significant amount or almost to zero but your client doesn't receive correct correct he pled so he admitted to receive so doesn't the government have those images through their own mechanism and they charged there's an issue about the numbers of pictures x hundred or more or not but if the government has them then wouldn't there be the possibility of distribution and again i'm not an expert in this area either so i apologize for lack of technical terms here but wouldn't there be the possibility that putting them on the shared file would mean that anybody could get them because after all the government got them i think it's important to distinguish the images that the government found on the computer after it was seized and images that the government claims to have downloaded during the time before they obtained the search warrant in the case and he was convicted primarily on the images that were on the computer found on the computer when it was seized when the warrant was executed you're claiming that there was a false statement in the affidavit or you were claiming there was a reckless disregard for the truth by omitting information in the affidavit and first and most importantly is the name of the software defense counsel were unable to even look up the name of the software to see if other courts have reviewed it has this software been found to be reliable by another court we're completely without any information to verify the government's claims of reliability for the software they don't name it but they make all kinds of claims for reliability and pages i think is eleven to thirteen of agent sexton's x affidavit he claims that sixteen li reliable nearly every case is verified and has an extremely high degree of accuracy it only reports what's available to the general public and we're unable to determine if those claims are true or  not and there's another number of other unknowns there's no peer review of this software there is no known error rate there's no statistics of use there's we don't know the information how it's maintained how agents are trained if age and sex and they had the training to use the software all of those are unknowns we weren't given hearings we weren't given any type of discovery and it practically guarantees convictions in these cases because there's nothing the defendants can do to challenge the  and then once the warrants are executed obviously the evidence is found and it's very difficult to go to trial you know with that with that type of evidence particularly in these types of cases very difficult to go to trial do you know what pictures the government had before they undertook the search a few are listed specifically in the affidavit i think they set out five maybe five to seven i can't say offhand but they list the fact that they got about forty images they don't list out forty by name or with the file you know the file name where they list out the whole address where they found it on the computer but they did list about five or seven  i believe i may be mixing up cases there is a similar case i did want to let this court know there is a similar case pending right now it's paul schumacher it's fourteen three five seven six there  going to be an argument tomorrow it was cancelled before a different panel but it is the same issue where there's in this court in this court where there's an issue of suppression issues and to do with the software so i just want to make sure distribution yes and that's correct isn't it that's correct ok so so tell me what the argument really address materiality yes ok for materiality the charges here whether they're received or distribution they their premised on the software functioning in the way the government claimed in its affidavit they wouldn't have had the evidence of receipt had they not tracked him had they not gone into his computer without a warrant through this direct connection of this unknown software they would not have had the evidence they had for receipt had they not use the software the entire case is premised on this initial use of the software by age and sex and to track prasco over  weeks at these various locations so it's material because all of the evidence obtained with the software of the software that led to prasco being in the motel room all of that would be admissible at trial images in evidence obtained through the use of peer spector software that's the kind of a suite of programs that the software belongs to has been deemed admissible in these cases so if that software is functioning differently than what they proclaim that isn't an issue for trial that can make evidence more or less likely as to distribution or a receipt to a certain extent i suppose if he was receiving things online or was he getting it from another source and then putting on his computer you know that those are all issues to hold to the recently period and distribution and distribution is a big issue for sentencing as well it can add five levels to a sentence which is significant i mean these these sentences are already so high you know given the guidelines and so that's distribution is a common fight that's at sentencing in these types of cases so if if your client had not pleaded guilty and had gone to trial are you saying then that trial you would be able to examine the government government witnesses and force them to disclose the software error rate and so forth i think that's certainly something we would try and do a trial but more often we were trying to that pretrial which is what we did here and resolve the issues before it's necessary to go to trial and and to save those resources for where it's really needed here it's best done pretrial because we if we have the software we can examine it and see is that affidavit truthful is it does it do the things that they're saying it can do and does it do things you know they're saying it can't do these things a b c will tend to do any of those things we don't know all we have here is the affidavit of the software's creator and so he's obviously a little bit of a biased source and he doesn't also cite any studies about the government's argument that people who are engaged in computer sharing of child pornography are tech savvy and that once they know this information that you're seeking that they will be able to find ways around being discovered and so there's a need for what might be called a qualified privilege i think the government's concerns can be first of all satisfied by a protective order a protection order that would seal the information about the software and just keep it within in the party itself as for you to allow the defendant to know the information and assume yes yes we information and i think it's a base a these people are very tech savvy yet they still keep going on you know these peer to peer networks where it's known that the government is also going on these peer to peer networks and catching people so it's not you know people know that they're going on there to catch people but they still continue to do it so i don't know that they're quite as tech savvy as the government would make out so the case was the information that was required to be disclosed is that available to you the information that was required about the computer software did you were you able actually to get access to that computer software in the issue was living gated a little bit further and they dropped the distribution counts and he pled to i believe possession and was given time served thank you thank you the morning honors may please the court my name is laura fort i'm here on behalf of the united states and i'd like to begin by addressing a point that judge moore and just ranch have raised with respect to the issue about receipt  as attorney has acknowledged that he generally admitted that and that's significant because the booty a case there was not receipt at issue in that case he was only church with the distribution under twenty two fifty two paragraph eighty two and as judge drenches recognized under that statute you can have a receipt or distribution you don't have to have both you can but there is an independent basis for conviction in this for the distribution he did under rule sixteen i would say no because the lichens case that we cited discusses that material to the defense means that it's  addresses the government's case in chief so i would take that to mean that doesn't mean that that is relevant to sentencing but why is it relevant to the having five levels for distribution and wouldn't you be able to discover things that are material to a sentencing issue your honor i'm not really familiar with with discovery rule with respect to sentencing  problem of this case is prasco is focusing on everything he didn't get rather than focusing on the significance of what he did receive including the activity logs which would show that's automatically generated that shows the activity between the computers and that w dispel any question about whether there's any type of potential for modification in this case he didn't have to take the software developers word for it or the agent that was using the software because you have the activity logs in this case you have his admission essentially that he didn't reduce that slot down to zero and the plain language of the settings page that he was on said that to turn off the sharing you have to reduce it down to zero and even at sentencing his attorney admitted page id seven fifty five that he could have reduced it down to zero he didn't he had it won and you also if you reduce it to zero then you're no longer doing sharing right and i apologize for my lack of knowledge here so how could he be getting material through file sharing but not sharing it back wouldn't he be thrown off of the sharing group i think the government's serious case was that he was trying to preserve the ability to download for himself but not make a lot of vailable and i think there's a consistent pattern the the investigator in the complaint  i'm sorry the search warrant talks about how he had a consistent pattern of having very little of vailable for sharing and then towards the end of the session he'd have some of vailable and so the government's theory in his case was that he's essentially was trying to preserve everything for himself while making a minimal amount of vailable for sharing in this case well suppose hypothetically that the government's methods are are pretty faulty let's say hypothetically how would a defendant such as this defendant be able to present enough evidence to compel discovery of the program and other matters well i think the activity logs would reflect if there was any type of tampering which was not supported in this case he also had access to his own harddrive which would show the file creation modification dates would have the geo id number that was assigned by this file sharing software and i guess that's another distinction with the bootsy i case is the court noted noted that there was evidence in that case that possibly this different software overrode the defendant settings but year we have a defendant who's admitted that his setting still permitted a minimal amount of distribution in this case and and all the cases that he cites not one of them helps him the case is is distinguishable because you  have a defendant here who is charged with receipt which is an independent basis the neal case that he cites there is a question about whether there was a partial file downloads we don't have that here and i think it's significant that even after the court ordered redacted discovery redacted product manual in this case the court ultimately denied the suppression motion and that's found under united states versus thomas where the court denied suppression for neil and two other defendants and found that there was no evidence that this same software suite gleaned anything other than that was available for file sharing also the a casio case involving exist again the same software might encourage the court to take a look at the docket in that case because about ten days after ordering discovery and of the sop of the source code in that case the court ultimately denied the suppression motion  and that is a western district of texas case that docket numbers three cohen eleven c r twenty seven twenty eight its record entry number one sixty three page eight the court finds that armed even with the source code the defendant could not show that this software was accessing private files or using or that the use of it violated the fourth amendment the only thing in the same is true here the only thing that is accessing is information that perasso has made available through sharing and i would suggest of the court that if there was a false positive on this software there would not have been files available to download and so there's absolutely no case that pr co has cited where a court has suppressed evidence based on alleged concerns with this software in the bush on the basis of the government privilege it is this this the government the core reason is that the government claimed a privilege in this in the programming is that is that correct that's the basis of the defense against the request for discovery well number one we contend that he doesn't meet materiality particularly given everything that was already available to him and significantly he's never shown he's never argued that that there was actual manipulation in this case and he concedes that there was receipt but yes there we also secondly argued that there is a law enforcement privilege in this case because it was providing the software would open the floodgates to circumvention of this rodeo case recognize that these users are fairly tech savvy and this software basically what it does is it gives it makes single source downloading the default but the gable case that prasco sites as a really nice discussion about everything that is available on the file sharing network to the general public they have that you ids they have the ip address they have the option of doing single source downloading what they don't have is this universe of hash values that law enforcement has identified as child notable and providing that if the defense has access to that then defendants could decide to trade other files they could change the hash values and enforcement the other side of the issue that the defendant rights is is how do i know this program does what it says it's doing and how do i know it's in the that it's not doing something else and obtaining from a a number of different computers composite image that was not on my computer so it's also tied to the problems of ownership i'm struggling with understanding why the government has a privilege if it doesn't the software if the code is not it's if this if i can get the wording correct the source code if not it's the licensing agreement is all that they have rather than ownership you can understand the problem here because if it were just the government's complete ownership then they should and would know how that computer investigation functions but if it's just some computer expert out there who's created a new problem and put in an affidavit that says it works it works it works then how can someone defend against say do you understand my question that i had to you hold the privilege for what is not your own and what happens if it is not your own and a defendant can't find a way to understand what it's doing and you've raised a number of issues in that question your honor and please let me know if i thought address all of them starting up at all start well with respect to there's an easy way for the defendant to be able  to be able to present some evidence you have those logs that show exactly what happened between the computers that show that you're getting this information from the shared folder you have access to the screenshots of the defendant of what  what his settings were and you also have access that you're going to give the defendant access to his computer so he can see the file creation dates modification dates with respect to the issue about the government not having to zeshan of the source code that's significant to the rule sixteen claim but i would suggest that the fact that that is held by a company and is proprietary does not in any way diminish our concern with the subpoena in that case where the government did make a claim and i believe that was the pennsylvania state police made the claim that look we don't have this in the court did grant the motion aquash based on law enforcement privilege so it and under rule seventeen now the corps ultimately did not decide whether or not pennsylvania had the source code but i would suggest to the court the it doesn't in any way diminish the government's interest and i think there's a lot of analogies to title three cases you know the interception equipment might be created by a third party but that doesn't mean that they get discovery of that in a title three case they get the calls and they get the logs but they don't get the mechanics for how that interception equipment functions and they haven't cited any cases where that has occurred where they've gotten discovery with that title three case that you would recommend as the best case to support your position here i think the band her case is instructive in in that context i do want to address the issue of why a protective order doesn't work in this case it has now there has been discovery in a couple of cases and i think it's significant that the courts in those cases ultimately have found the defend his claims meritless on fourth amendment grounds but the reason why it's not adequate to protect the government's interest is be because we cannot be made whole through court ordered sanctions this isn't like a copyright or patent infringement case where perhaps that the company can be made whole through monetary damages if the information is leaked it's over the defendants know what hash value that we are looking for and it suggests this this defendant squarely fits into the type of defendant who is fairly tech savvy and that's reflective of the fact that he has very small amounts available for sharing in his modify his settings and in fact if you look at the present it's why doesn't the fact that he has that little bit show that he doesn't know what he's doing that he really meant to take it to zero but he took it to one instead well i think that it shows that he is still trying to preserve the ability to download files because you can't download if your setting is zero i don't know the answer the question i know that a lot many of the file sharing software you have to be sharing in order to download i don't know if that's specifically how this network works but that is common  and this defendant if you look at the pre sentence report previously had child pornography on his computer when he was arrested for the offense in germany and his ex wife spoke to the fact that he had a very sophisticated security system that the german investigators could not crack and i think he squarely fits within the type of tech savvy defendant he knew exactly what he was doing he could have reduced his slot down to one he didn't do that admittedly and i think that diminishes any claim that  did not have files available for downloading for today or is it possible to have a protective order that allows only the lawyer to see the information it is your honor but i still think that there's a  if this information is leaked that again we cannot be whole made whole by court ordered sanctions and i think that certainly goes to the weight of the government's interest in this case and in light of the the evidence in this case that we had the logs that showed that there was no team pairing of any sort that he had is complete he had his computer available to him to examine and the fact that  that he admittedly had a small amount of available for downloading that certainly does not overcome the government's interest in protecting that information in this case thank you thank you  the government's argument raises a number of troubling concerns the first and most important being that the end justifies the means here because they found pornography on his computer it doesn't matter what the affidavit says it doesn't matter how they got there we have evidence of receipt the case is closed it leaves these defendants without i also you know i think we're all struggling with the same thing but they also argues that sufficient information was provided for this defendant to have come forward with evidence that there was a problem and then we would be having a different discussion we would be having a discussion of of a real need to look into this software if there was a problem with it  verses what is a more general request for information without in the back of evidence based on the list of technical terms i'm sorry to say i can't remember everything but the doesn't that point the burden on your client to have done it and have can you show that your client carried this but we did have an expert review all of the evidence given to us by the government the hard drive the logs all of that information and our experts still said that there were unanswerable questions he couldn't answer he couldn't answer how they downloaded these images over a low bandwidth you know he didn't know the amount of time it took him  if there is he couldn't tell what the error rate is he couldn't tell if it can manipulate out on the computer there are many different their opponent is the logs or the key why is that not correct  logs show and my expert could say better night the logs so the sessions where the information was downloaded from the computer but the logs don't show again is the software itself how it's maintained how it's to how people are trained in its usage again the error rate of these things they're claiming it's always you know it's extremely accurate it is an extremely reliable you have the law wouldn't your client have been able to put some evidence into the record that indicated there was an error in he is in the case that was before him and wouldn't that be the kind of evidence that would be necessary for the court to have ordered for their investigation because what our expert told us is that those laws did not give him enough information to use didn't have any basis to say that the logs had errors in correct he said the logs there weren't sufficient information for the questions that we had him to make an evaluation of the error right of usage of the entire program or for you to make a determination of an error right on your client why wouldn't there have been sufficient information for the lack of i don't know offhand the technical reason why i know the error rate is not just with this client but it's  and they're claiming that this is perfect software that this is extremely reliable that this is every case is verified and it's not the net has a problem that's being presented to magistrate judges and it's claiming that the software is better than it percentage it would have to be you know for charges to be based on evidence obtained and if in a forensic way that forensic method has to be deemed reliable and accurate that's that's the basis of our system and here defendants  left without any way to verify the reliability of the software the government hasn't done it themselves i mean they could have independent testing done of the software and publish a study and cite that study and that would be enough  government hasn't done that here there is no alternative for these defendants is there in check this evidence now gee that's possible with dogs sniffs you would make sure that you would reject in terms of rates do you need law there i think you can compare it with both the dog sniff case and then the dogs and case you could get discovery of what's this dog's training what's this has this dog through certification you know it's the handlers training we don't have any of that here we don't know what age and sex and training was we don't know how the dog the software what what avenues it went through you could you could definitely find out what sexton's training was couldn't you by hearings yes and presumably he would be present as the you know as the principal agent in this in this case and as far as protecting this information like we use the comparison with fingerprints is those saying if criminals know that we're using their fingerprints they're going to start wearing gloves but defendants are allowed to test friends of methods they're allowed to verify forensic methods whether it be fingerprints or hair analysis or bite marks or or things of that nature and computer testing should be no different defendant should be allowed to examine and verify the claims made about computer forensic methods otherwise their hands are tied and the adversarial process suffers thank you thank you both for your argument the cues will be submitted and