SOURCE CODE REQUESTS

OVERVIEW

Federal criminal investigations involving internet sex crimes may involve the use of specialized computer programs developed by the Government. These software programs may capture information from users or targets of the investigation without their knowledge. Perhaps the best example of this is the federal investigation “Operation Pacifier” where the FBI secretly took control of a suspected child porn website on the dark web known as “Playpen.” The Government then used a software program to gather information (such as IP addresses) from the website’s users.

In resulting criminal cases, the Government will typically refuse to disclose the source code for these computer programs to the defense, either on grounds that the code is immaterial or otherwise protected from disclosure under federal law. The defense, however, may file a motion to compel the production of the source code, arguing that the code is vital to establishing a defense and to attacking the integrity of the Government’s investigation. Whether a court forces the Government to turn over the source code often depends on the defense’s ability to articulate a need for it.

MOTIONS TO COMPEL

Federal Rule of Criminal Procedure 16(a)(1)(E) requires the government to “permit the defendant to inspect and to copy” documents, data, and objects in its “possession, custody, and control” if the items are (1) material to preparing the defense, (2) the government intends to use them in its case in chief, or (3) the item was obtained from or belongs to the defendant.[1]

The defense may seek to compel the production of the source code for the software program used by law enforcement or other parties in the investigation for various reasons, such as to challenge the reliability of the software, assess its accuracy, or understand the specific methods used during the investigation. The defense may also contend that the search or seizure of digital evidence, facilitated by the software used in the investigation, was conducted in a way that violates their Fourth Amendment rights.

Courts will typically weigh the relevance and materiality of the source code to the case. If the defense can demonstrate that the source code is essential for their argument or defense, they may be more likely to succeed in compelling its production.

The defense must make a “threshold showing of materiality” to compel the discovery, and must “present facts which would tend to show that the Government is in possession of information helpful to the defense.”[2] General descriptions of the information and conclusory allegations of materiality are not sufficient.

It bears mention that the source code for such programs is “purposely kept secret because the government reasonably fears that traders of child pornography (a notoriously computer-literate group) otherwise would be able to use the source code to develop ways either to evade apprehension or to mislead the authorities.” Thus, they are not always subject to peer review, and there is an interest in limiting the disclosure of source code that could compromise sensitive investigative techniques.[3]

If the government lacks access to the source code, it is unlikely that it will be compelled to disclose it. For example, the Sixth Circuit found that a detective’s affidavit supporting a search warrant for child pornography did not omit information material to establish probable cause, despite the detective’s unavailability of the source code for the computer program used in the investigation. Although the defense contended that the absence of the source code made it impossible to verify the detective’s assertions in the search warrant affidavit, the government maintained that the program used by the detective was “part of the Child Rescue Coalition, which is a private non-profit organization, and the source code and program are proprietary and not in the possession of the United States.”[4] Consequently, the government was not compelled to produce the source code.

When the government provides sufficient information on the software program, the government is less likely to require the disclosure of the source code in discovery. For example, the Second Circuit found that the district court’s limitation on the discovery of the software and its source code, used by law enforcement to identify individuals sharing child pornography files using peer-to-peer networks, was not deemed prejudicial to the defendant. In this case, the defendant and an expert claimed that the files stored on the defendant’s computer were not publicly available on the file-sharing network due to their location on an external hard drive. The defense asserted that access to the software and its source code was necessary to show that the government could not have obtained the defendant’s child pornography files over the open network. Despite the software forming the primary basis for the defendant’s conviction on transportation counts and justifying the search warrant that uncovered evidence for every count, the government substantially disclosed information about the program’s operation and demonstrated that the network’s software included an option allowing the defendant to determine where to store the files.[5]

Similarly, the First Circuit held that the defendant failed to establish prejudice resulting from the non-disclosure of the source code for an enhanced peer-to-peer file-sharing program used by the FBI in their investigation leading to the defendant’s prosecution. In this instance, the government provided the defense with a digital file recording the transfer from the defendant’s laptop to the agent’s computer, along with a copy of the FBI guide detailing the manual reconstruction of the program session. Additionally, evidentiary hearing testimony confirmed that agents used these materials to reconstruct the transfer, validating its origin on the defendant’s computer. The defendant “neither contradicted nor cast the slightest doubt upon” the government’s testimony that the disclosed materials verified an FBI agent’s download of files containing child pornography from his computer.[6]

The defense bears the responsibility of demonstrating materiality to compel the government to disclose the source code. For instance, a notable case in the Sixth Circuit involved defendants whose trial defense centered on the claim that third parties accessed their computers, placed pornography on them, and downloaded content from their systems. However, their argument that they should not be required to prove third-party wrongdoing before gaining access to the tools enabling them to demonstrate such misconduct was deemed cursory. The court determined that the defense’s argument was conclusory, lacking the depth necessary to override the government’s interest in maintaining the confidentiality of the generic components of the investigative technique. They found that the defense’s argument did not meet the threshold of materiality required to compel the disclosure of the source code.[7]

It is generally held across circuits that if the source code’s relevance to Fourth Amendment warrant considerations is deemed negligible, district courts are not considered to have abused their discretion by denying a motion compelling the production of the source code. The Seventh Circuit found that even though a defendant asserted a need for the source code to establish the extent of the Fourth Amendment violation, the district court’s decision to deny the motion was upheld, as it determined that the discovery sought was immaterial and would not have affected the good-faith determination.[8] The Eighth Circuit reached a similar conclusion, holding that when experts testify that the source code would have little impact on assessing the reliability and repeatability of law enforcement’s network investigative technique, the district court’s decision not to compel the source code was within its discretion.[9]

[1] Fed. R. Crim. P. 16

[2] United States v. Mandel, 914 F.2d 1215, 1219 (9th Cir. 1990)

[3] United States v. Chiaradio, 684 F.3d 265, 278 (1st Cir. 2012); United States v. Cintolo, 818 F.2d 980, 1002 (1st Cir. 1987)

[4] United States v. Dunning, 857 F.3d 342 (6th Cir. 2017)

[5] United States v. Clarke, 979 F.3d 82 (2d Cir. 2020)

[6] United States v. Chiaradio, 684 F.3d 265, 276 (1st Cir. 2012)

[7] United States v. Collard, 849 F. App’x 523 (6th Cir. 2021) (Unpublished)

[8] United States v. Kienast, 907 F.3d 522, 530 (7th Cir. 2018)

[9] United States v. Cottom, 679 F. App’x 518 (8th Cir. 2017) (Unpublished)