1

Filed 10/27/16 CERTIFIED FOR PUBLICATION

IN THE COURT OF APPEAL OF THE STATE OF CALIFORNIA

FIRST APPELLATE DISTRICT

DIVISION ONE

THE PEOPLE, Plaintiff and Respondent,

v. RICHARD PATRICK EVENSEN, Defendant and Appellant. A145162
(Napa County Super. Ct. No s . CR165642, CR168007)

Defendant Richard Patrick Evensen pleaded guilty to various sex crimes after the
trial court denied his motion to suppress evidence

. The e vidence leading to his arrest was obtained when police used soft ware that target s peer

- to

- peer file

- sharing networks to identify Internet Protocol (IP) address es associated with known digital files of child pornography. A public website re vealed one such identified IP address to be registered
with Comcast , and the execution of a se arch warrant on Comcast showed th e subscriber
of the IP address to be Evensen’s mother. A second search warrant was then exe cuted on the mother ’s home , where Evensen lived, and further inculpatory evidence was found

. After Evensen was arrest ed , more evidence of wrongdoing , some involv ing different
victims , came to light

. Evensen argues that the trial court wrongly denied his motion to suppress because all of the evidence against him emanated from the police’s use of the software that targets

peer

- to

- peer networks

. A ccording to him, the use of th is software violated his Fourth Amendment rights by infringing on his reasonable expectation of priva cy in his computer

. W e reject t h e argument and affirm.2 I. B ACKGROUND By using a set of so ftware tools known as RoundUp, p olice learned that an IP address, 1 later determined to be assigned to Evensen’s mother
, had downloaded child pornography. RoundUp enables law enforcement officials to detect child pornography on

peer

- to

- peer file

- sharing networks . Peer

- to

- peer networks allow users to share digital
files over the Internet. To access the se networks , user s need only download onto their computer s a fre e software program. The program allows a network user to upload a file onto his or her computer , and it then allows other users to access and download the file
onto their own devices. A u ser who buy s a music CD , for example, can convert it into a digital file and upload it onto the peer

- to

- peer network, thereby allo wing other users to
access and download the file

. When a network user uploads a file , it is placed in a “shared folder” on the user’s computer

. Other users can find files in shared fo lders by using a keyword search. When a user finds a desired file, the user can download it from one or multiple hosts. Using multiple hosts accelerate s the download. A u ser c ould , for example, take the beginning
of a video file from a computer in San F rancisco, the middle from a computer in Berlin,
and the end from a computer in Sydney. The peer

- to

- peer software reassembles the pieces into a single file. In this case, Evensen used a peer

- to

- peer network called eDonkey, which he accessed through a program called eMule

. Th e program creates a shared folder on each user’s comput er, and downloaded files are automatically place d in it. T he s hared folder
is accessible to all other users un less t he downloading user changes th e default setting by selecting an option called “Nobody

. ” Another way a downloading user c an prevent

1 “[ A]n IP address .

. . is a unique number identifying the location of an end[

- ] user’s computer. When an end

- user logs onto a[n] internet service provider, the user is assigned a unique IP number that will be used for that entire .

. . session. Only one computer can use a particular IP address at any specific date and time.” ( United States v. Henderson (10th Cir. 2010) 595 F.3d 1198, 1199, fn. 1.)3

others from accessing a file is to transfer it elsewhere on his or her computer and delete the copy in the shared folder.
Evensen used eMule between September 9, 2011 , and December 16, 2012 . At the hearing on his motion to suppress, Evensen testified that he took several measures to prevent other users from a ccess ing his files. To begin with, he modified e Mule’s default setting s by selecting the “Nobody” option

. But , as Evensen acknowledged , the feature did not always work or he did not always activate it. One time, he saw another user downloading a pornographic file from his computer , and he canceled the download

. Evensen testified that h e also transferred files from his shared folder to other

p laces on his computer that were in accessible to other net work users. H e admitted , however, that he did not always transfer the m immediately. He testified: “At times when I was downloading I would usually move all of them, but sometimes I wouldn’t move all of ‘em due to the file progress. The files not actually being what they say they would be. They would be either viruses or zip folders

. . . . So when I us ed that I didn’t have time or I didn’t want to take the time to unzip those folders that I downloaded of those files
and so they’d sit in my sh ared folder.” Finally, Evensen testified that he “max [ ed ] out” his download speed at 999 downloads, mean ing he c ould download material from 999 sources at once , and reduce d
to “one” the speed by which another user could download his files

. Th ese settings apparently accelerated the speed by which Evensen could download a file , and they
restricted other users to downloading only o ne file at a time from his shared folder. T he
full e xtent to which these settings impeded other users’ ability to access his files is
unclear from the record

. At the suppression hearing, O fficer Daniel Ichige 2 also testified, and he ex plained how RoundUp works. He described how it retrieves information from peer

- to

- peer

2 Officer Ichige is a police officer with the San Jose Police Department’s Child Exploitation Detail

— Internet Crimes Against Children Task Force. He is also a certified instructor in the use of the Gnutella network RoundUp tool. He has had about 90 hours of training with RoundUp tools, 20 hours of which was specific to eMule.4

networks, upload s the information onto a server , and makes the information available to
law enforcement officials

. Officer Ichige explained that RoundUp is specifically used to
search for known and verified digital files of child pornography. Each digital photograph
has a “hash,” a digital fingerprint or serial number , which, according to Officer Ichige, is

more distinctive than DNA. L aw enforcement off icers feed RoundUp a set of hashes of known child pornography files, and RoundUp then searches peer

- to

- peer networks for
th em

. Officer Ichige explained that RoundUp compiles information from files stored in network users’ share d folders but not from files stored elsewhere on users’ c omputers. Apparently, RoundUp runs unat tended and c onstantly search es peer

- to

- peer network s for
files with hash es matching known child pornography. By using the program, law
enforcement officers avoid the ne ed to search networks with keywords, identify

susp icious files, download those files, and confirm whether they depict child pornography.
T he RoundUp website reports IP addresses of computers that have downloaded
files with hash es of known child pornograp hy

. Law enforcement officers can focus their RoundUp searches on IP addresses that are likely to be associated with computers physically located in the officers’ jurisdiction. Officer Ichige explained that RoundUp
can show the “ history ” of an IP address , starting “ [ f ] rom the time that the first child

por nography file was made apparent ” to the program. In this case, O fficer Darlene Elia of the Napa Police Department used the RoundUp website in February 2013 to look for Napa County IP addresses used to
d ownload or share child pornography . She searched all available peer

- t o

- peer networks

. The search returned an IP address , eventually dete rmined to be Evensen’s mother’s, that

was first seen using eMule on September 9, 2011 , and last seen on December 16, 2012. RoundUp flags files known to be child pornography by coding them in red. Looking at RoundUp ’s historical list for this particular IP address, Officer Elia saw ove r 200 red flags

. Using a public website, Officer Elia determined that t he IP address was registered
to Comcast. Officer Elia then obtained and executed a search warrant for Comcast5

records and discovered that on December 16, 2012, the subscriber for the IP address was
Evensen ’s mother. Officer Elia then obtained a second se arch warrant for the mother’s
home. Evensen was present when Officer Elia executed the warrant on the morning of April 11, 2013

. After searching Evensen ’s room, Officer Elia arrested Evensen and read
him his Miranda 3 rights.
Evensen told Officer Elia he had been viewing child pornography for some time
and w ould generally watch i t one to two hours per day. He confirmed that all of the computers and hard drives in his room were his , and he estimated that he had about 30 gigabytes of child pornograp hy on his hard drives. He s aid he obtained child

porn ography primarily by u sing peer

- to

- peer file

- sharing software. A forensic examination uncovered over 200 videos and images of child pornography on Evensen ’s laptop and external hard drives.
Evensen ’s arrest was made public , and evidence of more sex crimes came to light. After hearing of the arrest, Jane Doe 1 came forward and claimed that Evensen had raped
her and performed other sex acts on her while she slept. Jane Doe 2, who m police identified from images on one of Evensen’s external hard drive s , revealed that she had, at Evensen’s request, sent sexually explicit images of herself to him when she was 16 years
old. A nd J ane Doe 3 , who was identified by Jane Doe 1 from a n image seized from
Evensen ’s home
, told police Evensen had performed various sex acts on her while she slept

. In his motion to suppress, Evensen argued that the use of the RoundUp program
amounted to an unconstitutional search and that all of the evidence against hi m should be suppressed because all of it emanated from this search

. After a hearing, t he trial court
denied the motion , and Evensen then pleaded no contest to one count of advertising for sale obscene matter depicting a minor (Pen. Code, § 311.10), three counts of oral copulation of an unconscious person ( id

. , § 288a, subd. (f)), one count of rape of an unconscious person ( id

. , § 261, subd. (a)(4)), two counts of using a minor for sex acts

3 Miranda v. Arizona (1966) 384 U.S. 436.6

( id

. , § 311.4, subd. (c)), and two counts of sodomy of an unconscio us person ( id

. , § 286, subd. (f)). He was sentenced to fifteen years, eight m onths in prison.
II. D ISCUSSION
Evens e n maintains that the use of the RoundUp program violated his Fourth Amendment rights “because he had a subjective expectation of privacy i n his computer, which was objectively reasonable.” (Capitalization omitted.) We are not persuaded. We begin with the applicable standard s of review. In ruling on a motion to suppress, the trial court “(1) finds the historical facts, (2) selects the applicable rule of law, and (3) applies the latter to the former to determine whether the rule of law as applied to the established facts is or is not violated.” ( People v. Williams (1988) 45 Cal.3d 1268, 1301.) “The court’s resolution of the first inquiry, which involves questions of fact, is reviewed under the deferential substantial

- evidence standard. [Citations.] Its
decision on the secon d, which is a pure question of law, is scrutinized under the standard of independent review. [Citations.] Finally, its ruling on the third, which is a mixed fact

law question that is however predominantly one of law, viz., the reasonableness of the
chall enged police conduct, is also subject to independent review. [Citations.]” ( Ibid .) With these standards in mind, we turn to the governing law. “ ‘The Fourth Amendment protects an individual’s reasonable expectation of privacy against
unreasonable intrusion on the part of the government.’ ” ( People v. Hughston (2008) 168 Cal.App.4th 1062, 1068.) It “protects people, not places. What a person knowingly exposes to the public, even in his [or her] own home or office, is not a subject of Fourth
Amend ment protection. [Citations

. ] But what he [or she] seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected.” ( Katz v.
United States (1967) 389 U.S. 347, 351.) “A person seeking to invoke the protection of the Fourth Amendment must demonstrate both that he [or she] harbored a subjective expectation of privacy and that the expectation was objectively reasonable. [Citation.] An objectively reasonable expectation of privacy is ‘one society is willing to re cognize as reasonable.’ [Citation.]” ( People v. Hughston , at p. 1068.)7

Computer users generally have an objectively reasonable expectation of privacy in
the contents of their personal computer s . ( United States v. Ganoe ( 9th Cir. 2008) 538 F.3d 1117, 1127 ( Ganoe ).) But there are exceptions to thi s general rule, and one of them
is that computer users have no reasonable expectation of privacy in the contents of a file
that ha s been download ed to a public ly accessible folder through file

- shar ing software. 4 ( Ibid

. ) T he Ninth Circuit Court of Appeal s ’s decision s in Ganoe and United States v. Borowy (9th Cir. 2010) 595 F.3d 1045 ( Borow y ) are instructive.
T he defendant in Ganoe shared child pornography through LimeWire, a public ly
available peer

- to

- peer file

- sharing program. ( Ganoe , supra , 538 F.3d at p. 1119. ) A law
enforcement officer used the same program to download a movie depicting child pornography from the defendant ’s computer. ( Ibid. ) After downloading additional child pornograph y files from th is computer , the officer obtained a warrant and searched the
defendant ’s home. ( Ibid. ) On appeal, the Ninth Circuit affirmed the district court’s
denial of the defendant ’s motion to suppress. ( Id. at p. 1127.) The Ninth Circuit h eld
that the defendant could not have had a reasonable expectation of privacy once he decided “ to install and use file

- sharing software, thereby opening his computer to anyone else with the same freely available program.” ( Ibid. ) The court also rejected the
defe ndant ’s contention that his expectation of privacy was reasonable because he did not
know that other users w ould be able to access files stored on his computer: “To argue

4 Computer users also have no reasonable expectation of privacy in electronic data that is not itself content. (See, e.g., In re Zynga Pr ivacy Litig. (9th Cir. 2014) 750 F.3d 1098, 1108

- 1109 [ “c ourts have long distinguished between the contents of a communication (in which a person may have a reasonable expectation of privacy) and record information about those communications (in which a pe rson does not have a reasonable expectation of privacy)”]; United States v. Forrester (9th Cir. 2008) 512 F.3d 500, 510 [ computer users have no reasonable expectation of privacy in “to/from addresses of their messages or [] IP addresses of [] websites they visit”].) Here, without opening or viewing any pornographic file, the police used RoundUp to learn that a public folder on a computer associated with Evensen’s mother’s IP address had contained known digital images of child pornography. The parties have not addressed, and we therefore do not decide, whether Evensen had a reasonable expectation of privacy in the electronic data RoundUp analyzed in tying his IP address to child pornography.8

that Ganoe lacked the technical savvy or good sense to configure LimeWire to prevent access to his pornography files is like saying that he did not know enough to close his drapes.” ( Ibid. )
T he Ninth Circuit reached a similar decision in Borowy , supra , 595 F.3d 1045. In that case, an officer used LimeWire to search for a term known to be associated with child pornography. ( Id. at p. 1046.) From the list of hits, t he officer identified known child pornography images using a software program “that verifies the ‘hash marks’ of files and displays a red flag next to known images of child pornography.” ( Ibid. ) At least one of the pornographic files was shared through w hat w as later determined to be
the defendant ’s IP address. ( Ibid .) Based on the results of this investigation, the officer
obtained a search warrant for the defendant ’s re sidence and foun d more than 600 images of child pornography. ( Id. at p. 1047

. ) Citing Ganoe , supra , 538 F.3d 1117 , the Ninth Circuit held that the defendant did not have a reasonable expectation of privacy because he used a peer

- to

- peer file sharing

prog ram

. ( Borowy , supra , 59 5 F

. 3d at pp. 1047

- 1048.) The defendant argued that Ganoe was distinguishable because , unlike the defendant in Ganoe , he at least made efforts to prevent LimeWire from sharing his files. ( Borowy , at p. 1048 .) The Ninth Circuit disagreed

. “Despite his efforts, Borowy’s files were still entirely exposed to public view; anyone with access to LimeWire could download and view his f iles without hindrance. Borowy’ s subjective intention not to share his files did not create an objecti vely reasonable expectation of privacy in the face of such widespread public access.” ( Ibid. ) The Ninth Circuit also rejected the defendant ’s contention that the search was unlawful because the police use d a “ ‘forensic software program’ ” that was unava ila ble to the public to confirm his files contained child pornography. The court explained that “Borowy had alre ady exposed the entirety of the contents of his files to the public, negating any reasonable expectation of privacy in those files.” ( I bi d. )
Evensen argues that, unlike the defendants in Ganoe and Borowy , he took several measures to keep the contents of his computer private , including transferring files from his public folder to inaccessible locations, changing the default setting to prevent others9

from accessing his shared public folder, and prevent ing more than one other user from
down loading his files from his shared drive at any given time

. But substantial evidence was presented from which the trial court could properly find that , notwith standing these

measures, Evensen had no reasonable expectation of privacy. As we have mentioned,
Evensen testified that he did not always immediately move files out of his shared folder
and that another network user once partially downloaded one of his po rnographic files. He cannot claim that his shared folder was private at all times or that he believed it to be. Moreover, RoundUp would not have even detected Evensen’s files if they had never been publicly accessible . According to Officer Ichige, Round Up compiles information from files stored in network users’ shared folders and cannot search files stored elsewhere on users’ computers. Evensen argues that it somehow matters that no evidence established that any of
his files of child pornography could be downloaded from his shared drive by the time
O fficer Elia began her investigation in February 2013. He argues that the evidence
showed only that child pornography files had at one time been in a shared folder on a computer with an IP address matching that of the computer he was using . But whether
Officer Elia could view the child pornography in February is not determinative

. RoundUp reported that known digital images of child pornography had been downloaded to Evensen’s computer, and Evensen does not point to any evidence suggest ing that the report was inaccurate. Th e information in this report constituted probable cause for the
issuance of the ensuing search warrants. ( Illinois v. Gates (1983) 462 U.S. 213, 238; People v. Camarella (1991) 54 Cal.3d 592, 601 [p robable cause for a warrant present where “there is a fair probability that contraband or evidence of a crime will be found in [the] place [to be searched ]” ].) 5

5 At oral argument, Evensen’s counsel argued that the search was also illegal because the search warrant was not executed until April 2013, four months after Evensen was last seen on the peer

- to

- peer network. Counsel argued that by the time the warrant was executed the police had no reason to believe any contraband sti ll remained on the premises. We are not persuaded. First, as a matter of procedure, Evensen forfeited this argument by failing to make it below or in his briefing. Second, on the merits, we10

Evensen contends that this case is analogous to Kyllo v. United States (2001) 533
U.S. 27 because the RoundU p program is enhanced technology

. In Kyllo , the police used a thermal imager to scan the defendant’s home and detect high

- intensity lamps typically used for indoor marijuana growth. ( Id. at pp. 29

- 30.) Based in part on information gathered from the thermal scan, the police obtained a warrant to search the defendant’s home and found an indoor growing operation. ( Id. at p. 30.) The Supreme Court held
that the use of the thermal imager constituted an unlawful search. ( Id. at p. 40.) The court reasoned that where the government uses sense

- enhancing technology that is not in general public use “to explore details of the home that would previously have been unknowable without physical intrusion, the surveillance is a ‘s earch’ and is presumptively unreasonable without a warrant.” ( Id. at pp. 35, 40) Kyllo v. United States , supra, 533 U.S. 27 does not control here. While it is true,

as Evensen points out, that RoundUp may be sophisticated and only available to law enforcement officials, the software does not search for otherwise unknowable evidence of illegality

. Instead, it monitor s only activities on a public peer

- to

- peer network, a space
where , as we have discussed, Evensen had no reasonable exp ectation of privacy.
Evensen ’s reliance on U

nited S tates v. Ahrndt (D. Or. Jan. 17, 2013, No. 3:08

- CR

0046 8

- KI) 2013 WL 179326 is also misplaced. In that case, the defendant unknowingly,
and through a program default , shared content in his LimeWire f older over his home wireless network. ( Id. at p. *7.) The d efendant’s neighbor inadvertently accessed the defendant’s wireless network and alerted the police after seeing a list of file names on the defendant’s computer suggest ing the presence of child p ornography . ( Id. at pp. *1

- 2.)
The district court held that there was no Fourth Amendment violation when the police looked at data on the network that the neighbor, a private citizen, had previously searched. ( Id. at p. *6.) At the same time, the court held that there was a Fourth Amendment violation when the police opened images the neighbor had not viewed. ( Id.

disagree that the passage of four months rendered the informati on too stale to support the search warrant’s execution . (See, e.g., United States v. Hay (9th Cir. 2000) 231 F.3d 630, 636.)11

at p. *8.) It reached this holding because there was no evidence the defendant “intentionally enabled sharing of his files over hi s wireless network, and there [was] no evidence he knew or should have known that others could access his files by connecting to his wireless network.” ( I d. at pp. * 6

- 7

. ) In contrast, here the police did not violate any
reasonable expectation of privacy because, u nlike the defendant in Ahrndt , Evensen intentionally used a public l y accessible peer

- to

- peer network

. In short, we reject E vensen’s Fourth Amendment claim because Evensen had no
reasonab le expectation of privacy in his s hared folder associated with the peer

- to

- peer network. In light of this conclusion, we need and do not decide whether Evensen would have had a reasonable expectation of privacy if he had been able to successfully prevent other users from accessing his shared folders or if he had downloa ded the digital pornographic material by means other than using a peer

- to

- peer network.
III. D ISPOSITION The judgment is affirmed.

_________________________ Humes, P.J.

We concur:

_________________________ Margu l i es, J.

_________________________ Dondero, J.12

Trial Court: Napa County Superior Court

– Main
Trial Judge: Honorable Mark Boessenecker
Counsel for Appellant: Paul Richard Kleven , First District Appellate Project
Counsel for Respondent: Kamala D. Harris, Attorney General Gerald A. Engler, Chief Assistant Attorney General Jeffrey M. Laurence, Senior Assistant Attorney General René A. Chacón, Supervising Deputy Attorney General Bruce Ortega, Deputy Attorney Gene ral

People v. Evensen ( A145162)