D.Mont.: Gatekeeper program that acts as a pen register on computers and captures the “handshake” information not “search”

Gatekeeper program that acts as a pen register on computers and captures the “handshake” information about IP addresses and “payload” without capturing any content, including any keywords, is not a Fourth Amendment search. United States v. Saville, 2013 U.S. Dist. LEXIS 89281 (D. Mont. May 20, 2013):

Saville takes the position that the Gatekeeper captured content when it hit on the search term “Gnutella.” In doing so, Saville focuses on the ten emails the Gatekeeper delivered to Detective McNeil. Each email contained a “packet” of information, which was made up of two parts — a “header” and a “payload.” Saville’s computer expert, Ken Michael, testified that a packet header contains all of the routing and signaling information associated with a particular communication, including such things as the source and destination IP addresses, MAC addresses, transmission control protocol, and size of the entire packet in bytes. According to Michael, the content of a communication is found exclusively in the payload. As Michael explained it, anything that is contained in the packet payload is properly characterized as content. Because it is undisputed that the keyword “Gnutella” was found in the payload portion of the packets delivered by the Gatekeeper, Michael testified that it must necessarily be characterized as content. In other words, it was Michael’s opinion that “Gnutella” must be considered content simply by virtue of the fact that it appeared in the payload.

While Michael’s view of what constitutes content may be a legitimate one in some contexts, it is not the definition that controls here. As it applies to the use of pen registers, the term “content” has a specific meaning. “[C]ontent” of a wire, oral, or electronic communication is statutorily defined to include “any information concerning the substance, purport, or meaning of that communication.” 18 U.S.C. § 2510(8). To be considered content, the term “Gnutella” as captured in the payload must have conveyed something about the substance, purport, or meaning of Saville’s electronic communications. But Michael never considered this definition, and failed to explain how the term “Gnutella” as it appeared in the payload conveyed anything at all about the substance or meaning of Saville’s communications.

Detective McNeil testified convincingly as to why it did not. He explained that all of information captured by the Gatekeeper related to what he described as the initial “handshake” that takes place between two computers as they negotiate a protocol for communicating and before any data is actually exchanged. Detective McNeil made clear that packets exchanged during this initial “handshake” contain nothing more than dialing, routing, and signaling information, even in the payload. The packets captured by the Gatekeeper fall into this category.

While Detective McNeil agreed that, in theory, the Gatekeeper could have alerted to the keyword “Gnutella” if Saville had entered it as a search query, he stated that did not happen here. Detective McNeil deliberately avoided searching for commonly used content-laden terms like “pthc” (an acronym for “preteen hardcore”), which might have been more likely to hit on the content of a search query or the secure hash algorithm (SHA) value of a known child pornography file. In doing so, Detective McNeil complied with his statutory duty to use the technology available to him “so as to not include the contents of any wire or electronic communications.” 18 U.S.C. § 3121(c).

The term “Gnutella” as it appeared in the payload was automatically generated by Saville’s computer before any exchange of information had taken place between his computer and any other computer using the Gnutella network. It said nothing about the substance, meaning, or purpose of any communication by Saville, and so cannot be considered “content” within the meaning of the Pen-Trap statute. See In re iPhone Application Litigation, 844 F. Supp. 2d 1040, 1061 (N.D. Cal. 2012) (data that is “generated automatically, rather than through the intent of the user “does not constitute content). Because the Gatekeeper did not capture anything more than the routing, addressing, and signaling information transmitted by Saville’s computer, there was no Fourth Amendment search.