Criminal Court of the City of New York, New York County, November 20, 2018

The Legal Aid Society, New York City (Emily Paul and Jerome Greco of counsel), for defendant.

Cyrus R. Vance, Jr., District Attorney, New York City (Jasmine H. Ahmetovic and Emily H. Benjamin of counsel), for plaintiff.

By decision and order dated October 2, 2018, a hearing was ordered to determine the following:

1. Did defendant establish standing to controvert the search warrant issued to Instagram? If so,

2. Who executed the warrant, where it was executed, and when it was executed? and

3. What was recovered and whether the court must suppress any data recovered outside the probable cause confines for date and time.

The defense called no witnesses, instead relying on the People's allegations in the criminal court complaint and search warrant application. The defense entered the following into evidence:

The People called two witnesses, Assistant District Attorney (ADA) Emily Benjamin and Detective Jamel Crawford, who was assigned to the New York City Police Department's (NYPD) 7th Precinct Detective Squad. The court found both witnesses' testimony credible in all respects. The People entered the following into evidence:

In this court's October 2, 2018 decision (People v Sime, 61 Misc 3d 896 [Crim Ct, NY County 2018]), this court held that the defendant failed to meet her burden to show a legitimate privacy expectation in the subject Instagram accounts' data. The court however held the motion to controvert the search warrant in abeyance for the defendant to provide (1) whether the accounts were created or controlled by her, and (2) if so, the privacy settings she maintained for each account (Sime, 61 Misc 3d 896, 904).

In a pre-hearing memorandum to the court, the defendant cited People v Ramirez-Portoreal (88 NY2d 99 [1996]) as controlling authority that the defendant has standing to controvert the search warrant. In Ramirez-Portoreal, the Court of Appeals stated that the defendant must first establish "by defendant's own evidence or by relying on the People's evidence" that she had a legitimate privacy expectation in the place or item that was searched (id. at 109). This is not the same as whether the defendant had a possessory interest in the items seized (id.). First, the court must identify the object of defendant's privacy expectation, determine whether the defendant exhibited an expectation of privacy in it (a subjective component), and then evaluate whether the circumstances would lead society to regard defendant's expectation as reasonable (an objective component) (id. at 108). Also, if the defendant had a legitimate privacy expectation at first, did she abandon it, and did that abandonment result from police activity? (Id. at 110-111.)

The defendant conceded that there is no privacy expectation for the posted photographs, and the defendant's concession was correct. There was no evidence that the defendant exhibited any privacy expectation by posting photographs^[FN1] —allegedly under pseudonyms—to the general public on a software application available to the world. Indeed, the complaining witness was able to see the posts because the defendant took no steps to prevent anyone from accessing the account. And, the defendant did not provide evidence showing what privacy settings she maintained for each account. Nor was there any evidence that would lead the court to believe that society would{**62 Misc 3d at 432} regard the defendant's expectation as reasonable if the defendant had met her burden on the first two analysis steps.

This court's previous order determined, and the People argued, that the defendant would need to provide (1) whether the accounts were created or controlled by her, and (2) if so, the privacy settings she maintained for each account, in order to reach whether she had a privacy expectation. The defense in turn argued that there is a general right to privacy for the Internet Protocol (IP) addresses associated with the person who posted the pictures and the metadata contained in the photographs public posted under the recently decided Carpenter v United States (585 US —, 138 S Ct 2206 [2018]), and that they rely on the People's allegations that it was her data.

There are currently two IP address types: IP version 4 (IPv4) and IP version 6 (IPv6). Both IP address types were associated with the account and posted photographs (People's exhibits 10A, 10B). The simplistic difference between the two is:

(Tony Bradley, PCWorld, IPv6: Five Things You Should Know [June 6, 2012], https://www.pcworld.com/article/257037/ipv6_five_things_you_should_know.html [last accessed Nov. 19, 2018]; IBM Knowledge Center, Comparison of IPv4 and IPv6, https://www.ibm.com/support/knowledgecenter/en/ssw_ibm_i_72/rzai2/rzai2compipv4ipv6.htm [last accessed Nov. 19, 2018]).

Starting in 1976, the US Supreme Court established the third-party doctrine by holding that "a person has no legitimate expectation of privacy in information . . . voluntarily turn[ed] over to third parties . . . even if the information is revealed on the assumption that it will be used only for a limited purpose" (Carpenter v United States, 585 US —, —, 138 S Ct 2206, 2216 [2018] [internal quotation marks omitted], quoting Smith v Maryland, 442 US 735, 743-744 [1979], and United States v Miller, 425 US 435, 443 [1976]). In Carpenter, the Court held that the third-party doctrine was not absolute and declined to extend the rule to cell-site records that convey "a {**62 Misc 3d at 433}detailed and comprehensive record of [a] person's movements" (585 US at —, 138 S Ct at 2217).

"There is a world of difference between the limited types of personal information addressed in Smith and Miller and the exhaustive chronicle of location information casually collected by wireless carriers today. The Government thus is not asking for a straightforward application of the third-party doctrine, but instead a significant extension of it to a distinct category of information" (585 US at —, 138 S Ct at 2219).

Thus, while the Carpenter Court requires the government to obtain a warrant to obtain a person's telephone location for seven or more days, it also made it clear that its decision was a "narrow one" and there was no intention to disturb the third-party doctrine as it applied to other technologies or "other business records that might incidentally reveal location information" (585 US at —, 138 S Ct at 2220). This was due, in part, to the "unique nature of cell phone location information" (id.), in that it provided a "detailed, encyclopedic, and effortlessly compiled" information about a person's past movements and that people have "a reasonable expectation of privacy in the whole of their physical movements" (585 US at —, 138 S Ct at 2216, 2217, citing United States v Jones, 565 US 400, 430 [2012]). The Fifth Circuit held that an IP address associated with an address "had no bearing on any person's day-to-day movement" therefore the defendant "lacked a reasonable expectation of privacy in that information" (United States v Contreras, 905 F3d 853, 857 [5th Cir 2018]; see also United States v Tirado, 2018 WL 3995901, 2018 US Dist LEXIS 141605 [ED Wis, Aug. 21, 2018, No. 16-CR-168] [on reconsideration the court held that Carpenter did not require a different result because pole cameras do not require a warrant]).

Similar to the Carpenter decision is People v Weaver (12 NY3d 433 [2009]). The Weaver Court's stated impetus in creating a new privacy right for Q-ball GPS devices attached to cars was that it was offended that the police could use a GPS device to easily track a person's movement about New York State's public streets. The Court thus determined that a GPS device attached to a car is a telephone or telegraph communication protected by New York State Constitution, article I, § 12, and that the police must obtain a warrant before attaching it to a vehicle (Weaver at 438-439).{**62 Misc 3d at 434}

But, neither IP data nor photograph metadata is GPS data. Obtaining IP data does not provide the police the ability to exhaustively know a defendant's exact position—at best it might incidentally reveal what device was used to post a photograph in the general vicinity of an internet router. In other words, at most it will let the police find a building near the used cell phone or computer device on discrete dates when pictures were uploaded for the public to view, and has no bearing on the defendant's day-to-day movement (Contreras at 857). Similarly, photograph metadata might let you know what camera was used to take a particular picture, and (if it was not already obvious from the picture itself) where that picture was taken. Neither IP nor metadata allows the police to exhaustively determine when and where a person visited "the psychiatrist, the plastic surgeon, the abortion clinic, the AIDS treatment center, the strip club, the criminal defense attorney, the by-the-hour motel, the union meeting, the mosque, synagogue or church, [or] the gay bar" (Weaver at 441-442), unless the poster actually took pictures at these places and/or posted the pictures from those locations, in which case the person would have no privacy interest in this publicly displayed information anyway. IP data and metadata are roughly analogous to telephone billing records, and there is no legal reason to protect this data to the same extent as long-term GPS data and cell-site information (see e.g. Contreras at 857; People v Jiles, 158 AD3d 75 [4th Dept 2017], lv denied 31 NY3d 1149 [2018] [four days of historical cell-site data has no federal or state constitutional protection]).

The burden was on the defendant to establish standing by showing a legitimate privacy expectation in the place searched (see Rakas v Illinois, 439 US 128, 144 [1978]; Ramirez-Portoreal, 88 NY2d at 108; People v Gonzalez, 68 NY2d 950, 951 [1986]; People v Ponder, 54 NY2d 160, 165 [1981]). A subjectively held privacy expectation is legitimate only if it is "one that society is prepared to recognize as reasonable" (Rakas, 439 US at 143-144 n 12 [internal quotation marks omitted]). This court finds that there is no constitutional privacy afforded to the IP data and photograph metadata that the defendant uploaded and shared with the world, nor would a subjectively held privacy expectation be reasonable or one that society is prepared to recognize.

In light of this, and because the defendant did not sustain her burden to demonstrate either that the accounts were created{**62 Misc 3d at 435} or controlled by her, and if so, the privacy settings she maintained for each account, the defendant's motion to controvert is denied.

Because this is a case of first impression, should a subsequent appellate court somehow find that the defendant had standing to controvert the warrant under some newly created theory, the following are this court's additional findings of fact and conclusions of law:

1. Service Within 10 Days

The People's witness met their burden to show that the warrant was served on Facebook, Instagram's parent company, within 10 days. The warrant was issued on March 16, 2018 (People's exhibit 1). The warrant was served on Facebook (Instagram's parent company) through its online law enforcement portal and via email to Facebook on March 16, 2018 (People's exhibits 2-9).

2. Service Method

The warrant was "executed" in New York County by uploading and emailing it from a computer located in New York State. It was served in a manner that Facebook has voluntarily provided (and prefers) for law enforcement requests pursuant to court orders (People's exhibit 2 ["The following link allows authorized law enforcement officials to securely access our Law Enforcement Online Request System . . . . Requests made through this system may be made only by governmental entities authorized to obtain evidence in connection with official legal proceedings"]; see also Facebook, Law Enforcement Online Requests, www.facebook.com/records ["you may request records from Facebook through this system"] [last accessed Nov. 19, 2018]), and is an acceptable method to serve court orders for Facebook business records (Matter of 381 Search Warrants Directed to Facebook, Inc. [New York County Dist. Attorney's Off.], 29 NY3d 231 [2017]).

3. Execution by Police Officer

The ADA-witness testified that the warrant was served by her uploading the warrant to Facebook's law enforcement records portal, and that no police officer was present when she did so. The defendant argues that the warrant was not "execute[d]" by NYPD officers (CPL 690.25 [2]), and there is no provision in CPL article 690 that allows a private citizen to serve or execute a search warrant.{**62 Misc 3d at 436}

The Stored Communications Act (SCA)'s express language sets out that

"the presence of an officer shall not be required for service or execution of a search warrant issued in accordance with this chapter requiring disclosure by a provider of electronic communications service or remote computing service of the contents of communications or records or other information pertaining to a subscriber to or customer of such service" (18 USC § 2703 [g]).

The defendant claims the SCA does not apply, and even if it did, the SCA cannot override state law.

First, the SCA does apply.

Second, the court notes that an ADA uploading the search warrant is not a favored practice, if only to avoid ADAs being witnesses in their own cases. A prosecutor should have a police officer serve the warrant by uploading it to avoid this problem and unnecessarily having to litigate this issue. Nonetheless, while the defense is correct that the SCA requires the warrant to be "issued using State warrant procedures" (18 USC § 2703 [a] [emphasis added]), it does not state that it must be executed using state warrant procedures. The Court of Appeals has already addressed this issue, and the Court approved Facebook employees "executing" the warrants for the simple fact that "the framework of execution for SCA warrants ensures efficiency and minimizes intrusion into the provider's business while promoting and protecting legitimate law enforcement interests in criminal investigation" (Facebook, 29 NY3d at 244). This warrant was properly issued pursuant to CPL article 690 and executed by Facebook employees pursuant to 18 USC § 2703 (a) and (g) (Facebook at 244).

4. Records Recovered

The warrant limited the images and associated data recovered to after [*2]February 2017, and IP history data from February 12, 2018, through March 16, 2018. The images and data recovered (People's exhibits 10A, 10B) show that all the images and data recovered were:

{**62 Misc 3d at 437}The only record obtained outside this time period was the data showing the information and IP address provided to Instagram when the account was created. The People's application for the warrant provided probable cause to retrieve this subscriber data, regardless of its creation date.

In sum, the records recovered were properly limited to the dates authorized by the warrant.

5. Whether the applicant understood what EXIF data was at the time she signed the search warrant affidavit.

During cross-examination, the defense asked the detective, "What's exif data, E-X-I-F?" and she responded, "I'm not sure. I'm not in computer crimes." During redirect the People asked the following questions and Detective Crawford provided the following answers:

"Q. Detective, at the time that you swore out the search warrant did you understand what kind of information was needed?

"A. Yes, initially.

"Q. And did you understand why it was needed?

"A. Yes.

"Q. And was it in furtherance of the investigation?

"A. Yes."

The search warrant application itself stated,

"Based on my training and experience, I am aware that messages or images maintained in an Instagram account may contain or have associated data files which could assist in determining the geographic location of the individual who posted such items to the account, including geo-graphical location information and EXIF data, which is associated with digital photographs" (search warrant aff ¶ 7 [e]).

While this cross-examination by the defense may go to the detective's credibility at the hearing and at a trial, it was not crucial to the probable cause set out before the issuing judge or the relief sought, as the paragraph itself stated that EXIF^[FN3] data is data associated with digital photographs and would assist{**62 Misc 3d at 438} in determining who posted the photograph and from where it was posted.

The defendant did not meet her burden to establish standing. If the defendant had met her burden, the warrant was properly issued and executed, and the records recovered were within the time span authorized.

The defendant's motion to controvert the search warrant is denied.