E.D.Va.: Use of Peer Spectre program to trace IP address not a search or a wiretap

The Peer Spectre program is not a wiretap, and its use does not violate the Fourth Amendment. United States v. Willard, 2010 U.S. Dist. LEXIS 98216 (E.D. Va. September 20, 2010):

In 2009, Special Agent Howell analyzed the pen data using the Wyoming Toolkit database. fn1 The database uses an automated software program called Peer Spectre which reads publicly available information from computers identified as sharing child pornography images. Special Agent Howell queried Wyoming Toolkit regarding the IP addresses that communicated with Defendant’s IP address in October and November 2008, and found that more than 2,200 of those IP addresses had been previously identified by Peer Spectre as advertising child pornography files available for sharing.

1 The Wyoming Toolkit database was developed by the Wyoming Internet Crimes Against Children (“ICAC”) Task Force. Whenever an investigator identifies child pornography that is shared over a peer-to-peer file-sharing network, the observation is recorded into the Wyoming Toolkit database. The database record contains: (1) the date and time of the observation; (2) the SHA1 value of the files; and (3) the name of the files and the IP address sharing the files. SHA1 stands for Secure Hash Algorithm 1. It is essentially a fingerprint of a digital file. By comparing the SHA1 values of two files, investigators can determine whether the files are identical with precision greater than 99.9999 percent certainty.

. . .

Defendant argues in the instant case that the Government’s use of Wyoming Toolkit and Peer Spectre to determine the nature of his computer files was analogous to installing a wiretap and went beyond the scope of the pen register orders. As such, Defendant argues, the officers should have obtained a search warrant based on probable cause.

The Court finds that the use of Peer Spectre did not constitute a wiretap because the software does not intercept electronic communications. The functions performed by Peer Spectre and Wyoming Toolkit are more akin to mining data. The term “intercept” as used in the Wiretap Act requires that the acquisition of contents be contemporaneous with the transmission of such contents. See Konop v. Hawaiian Airlines, Inc., 302 F.3d 868, 878 (9th Cir. 2002) (“Congress … accepted and implicitly approved the judicial definition of ‘intercept’ as acquisition contemporaneous with transmission. We therefore hold that for a website … to be ‘intercepted’ in violation of the Wiretap Act, it must be acquired during transmission, not while it is in electronic storage.”). Peer Spectre does not acquire communications contemporaneously with the transfer of data from one IP address to another. Instead, it reads publicly available advertisements from computers identified as offering images of child pornography for distribution and identifies their IP addresses.

This entry was posted in Uncategorized. Bookmark the permalink.

Comments are closed.