United States v. Thomas Owens ( 2021 )


Menu:
  •                                In the
    United States Court of Appeals
    For the Seventh Circuit
    ____________________
    No. 20-3189
    UNITED STATES OF AMERICA,
    Plaintiff-Appellee,
    v.
    THOMAS J. OWENS,
    Defendant-Appellant.
    ____________________
    Appeal from the United States District Court for the
    Eastern District of Wisconsin.
    No. 18-cr-00157 — William C. Griesbach, Judge.
    ____________________
    ARGUED SEPTEMBER 28, 2021 — DECIDED NOVEMBER 19, 2021
    ____________________
    Before FLAUM, KANNE, and SCUDDER, Circuit Judges.
    FLAUM, Circuit Judge. It is criminal “distribut[ion]” of child
    pornography within the meaning of 
    18 U.S.C. § 2252
    (a)(2) to
    knowingly make a file containing child pornography availa-
    ble for others to access and download via a peer-to-peer file-
    sharing network. See United States v. Ryan, 
    885 F.3d 449
    , 453
    (7th Cir. 2018). The government has developed an investiga-
    tive practice where it employs a confidential software pro-
    gram to participate in the peer-to-peer network and detect
    2                                                  No. 20-3189
    and download child pornography files shared therein. Once
    a file is downloaded and its illicit contents verified, the gov-
    ernment ascertains the IP address of the sharing user, contacts
    the Internet service provider to identify the residence associ-
    ated with the IP address, obtains a search warrant, and seizes
    the suspect’s electronics. Often, the downloaded file is then
    located on the suspect’s device, and the government can ver-
    ify that the file was indeed made available for downloading.
    Yet sometimes the file cannot be located on the device or there
    are questions about the defendant’s sharing settings.
    In the case before us now, Thomas Owens was arrested
    and charged with the distribution and possession of child
    pornography after a government investigator used such a
    program, Torrential Downpour Receptor (“TDR”), to down-
    load a video file containing child pornography from a folder
    shared via the BitTorrent network at an IP address later asso-
    ciated with Owens. Nonetheless, a forensic search of Owens’s
    computer at the time he was arrested failed to locate the file
    on his computer. Owens moved to compel the production of
    information relating to the government’s download of the file
    pursuant to Federal Rule of Criminal Procedure 16. The dis-
    trict court held an evidentiary hearing and denied the motion;
    Owens now appeals that decision after entering a guilty plea
    preserving that right.
    Given that we review a district court’s Rule 16 decision
    only for abuse of discretion, we reverse only if a defendant
    can demonstrate that the pretrial disclosure of the disputed
    evidence would have enabled the defendant “to substantially
    alter the quantum of proof in his favor.” United States v.
    Orzechowski, 
    547 F.2d 978
    , 984–85 (7th Cir. 1976) (quoting
    No. 20-3189                                                     3
    United States v. Marshall, 
    532 F.2d 1279
    , 1285 (9th Cir. 1976)).
    Because Owens falls short of meeting that burden, we affirm.
    I.    Background
    A. The BitTorrent Network and Torrential Downpour
    Receptor
    BitTorrent is a peer-to-peer file sharing network that is
    used to distribute large amounts of data over the Internet,
    such as movies, videos, music, and images. In contrast to a
    centralized network, which relies on a single server to provide
    an entire file directly to each user, peer-to-peer networks like
    BitTorrent enable users to download portions of a file from
    numerous other users simultaneously. In this way, BitTorrent
    users can avoid slow download speeds that occur as a result
    of the sharing server’s restricted upload bandwidth. As the
    defense expert explained to the district court, because most
    individual Internet users’ accounts provide for faster file
    download (using, for example, 200 megabits per second to
    stream Netflix on several TVs at once) than upload (using 30
    to 50 megabits per second to, say, transfer photos to an online
    drive), the rate at which a file is downloaded from a single
    server is limited by the rate the file is uploaded from that
    server—and the upload rate is usually slow. Peer-to-peer net-
    works circumvent this problem through multi-source down-
    loads.
    To download and share files over the BitTorrent network,
    a user must first install a BitTorrent software “client”—a pro-
    gram that allows the user to interface with the BitTorrent net-
    work. Then, as the district court pointed out, a user seeking a
    particular file on the BitTorrent network can search the Inter-
    net for a “torrent,” which is a “text-file containing instructions
    4                                                             No. 20-3189
    on how to find, download, and assemble the pieces of the im-
    age or video files the user wishes to view.” See United States v.
    Gonzales, No. CR-17-01311, 
    2019 WL 669813
    , at *1 (D. Ariz.
    Feb. 19, 2019). Owens’s expert also described a “torrent” as a
    “recipe for obtaining and assembling a given set of contents.”
    Once a user downloads the torrent corresponding to the
    file he is seeking, the user can open the torrent using the Bit-
    Torrent software client, and the BitTorrent network will
    match the initiating user with other users who have the same
    torrent. Upon being matched, the computers will engage in a
    “handshake” and exchange the “info hash” 1 associated with
    the torrent to confirm that it is the same one. Once that is ver-
    ified, the initiating user’s client software will download pieces
    of the target file from the other users and assemble them, pro-
    ducing the complete file. The client software then makes the
    now-complete file accessible to other BitTorrent users in a
    shared folder on the user’s computer; it also “seeds” the file,
    querying the BitTorrent network and making outbound con-
    nections to IP addresses that are in need of the data just down-
    loaded.
    The BitTorrent client software used by the government in
    this case, TDR, is a modified version of the BitTorrent proto-
    col. As the district court explained:
    TDR [was] … developed by law enforcement in
    conjunction  with    the    University   of
    1 The info hash is a string of letters and numbers that precisely and
    uniquely identifies the torrent. Each piece of the file also has its own “hash
    value” that must be matched to the information in the torrent before it is
    downloaded to the initiating user. Both the government’s expert and Ow-
    ens’s agreed that if the hash value of two files matches up, then the
    chances are “astronomically small” that the two files are different.
    No. 20-3189                                                    5
    Massachusetts at Amherst. TDR acts as a Bit-
    Torrent user and searches the Internet for [IP]
    addresses offering torrents for known child por-
    nography files. When such an IP address is
    found, the program connects to that address
    and attempts to download the child pornogra-
    phy. The program generates detailed logs of the
    activity and communications between the pro-
    gram and the IP address.
    (citation and internal quotation marks omitted). Crucially, the
    district court noted, “[u]nlike traditional BitTorrent pro-
    grams, TDR is designed to download files only from a single
    IP address—rather than downloading pieces of files from
    multiple addresses—and does not share those files with other
    BitTorrent users.”
    The software’s capacity for single-source downloads is im-
    portant because if the government “only downloaded frag-
    ments of child pornography files,” it is “‘more likely’ that [the
    defendant] did not knowingly distribute any complete child
    pornography files.” See United States v. Budziak, 
    697 F.3d 1105
    ,
    1112 (9th Cir. 2012) (citation omitted).
    B. The Investigation into Owens’s BitTorrent Activity
    In May 2018, an investigator from the Oshkosh police de-
    partment employed TDR to determine that Owens’s IP ad-
    dress was associated with a torrent corresponding to a partic-
    ular child pornography video. The investigator used TDR to
    perform a single-source download of the video two times:
    first on May 21 and again on May 22.
    Another investigator viewed the downloaded video and
    verified that it contained child pornography. The filename of
    6                                                   No. 20-3189
    the video is long, explicit, and accurately describes the content
    of the video. The government identified Owens as the owner
    of the suspect IP address, then obtained a search warrant on
    Owens’s residence. During the search, which was carried out
    on June 28, agents found thousands of depictions of child por-
    nography but were unable to locate the particular video file
    that had been twice downloaded.
    The download of that file nevertheless forms the basis of
    the distribution charge against Owens. Owens was also
    charged with two counts of possession based on other files
    recovered during the search of his home.
    C. Owens’s Motion to Compel Discovery
    Owens argues that the government’s failure to locate the
    file on his computer is evidence that he may never have pos-
    sessed or distributed that file. To gather ammunition to prove
    this theory, Owens filed a motion under Rule 16(a)(1)(E) to
    compel the government to produce TDR, its source code, and
    all supporting documents, such as user manuals, technical
    specifications, and white papers. Rule 16 requires the govern-
    ment to permit a defendant to inspect items within its posses-
    sion, custody, or control if, as Owens asserts here, “the item is
    material to preparing the defense.” Fed. R. Crim. P.
    16(a)(1)(E).
    The government produced logs generated by TDR that de-
    scribed the two downloads, as well as details about the inves-
    tigating officer’s training and experience with TDR. However,
    it opposed Owens’s motion for additional information, assert-
    ing that the items requested were not material, and even so,
    they were properly excluded from discovery under the law
    enforcement investigatory privilege. See Dellwood Farms, Inc.
    No. 20-3189                                                    7
    v. Cargill, Inc., 
    128 F.3d 1122
    , 1125 (7th Cir. 1997) (explaining
    that the law enforcement investigatory privilege balances
    “the need of the litigant who is seeking privileged investiga-
    tive materials … against the harm to the government if the
    privilege is lifted”). The government argued that disclosure
    would result in irreversible harm to pending and ongoing
    criminal investigations.
    1. Evidence Submitted
    The district court held an evidentiary hearing on Owens’s
    motion to compel. The court heard testimony from Owens’s
    expert, Peyton Engel, an attorney at a law firm in Madison,
    Wisconsin, who has specialized in computer security for over
    a decade. Engel’s past work included conducting forensic in-
    vestigations and incident response. He testified in state court
    as an expert witness on at least ten occasions, and he previ-
    ously worked with both the defense bar and law enforcement.
    The government also presented an expert witness, Detective
    Robert Erdely, who assisted in the creation of TDR (although
    he did not write its source code) and retired from the Penn-
    sylvania State Police Computer Crime Unit. In addition to de-
    veloping TDR, Erdely has numerous certifications in com-
    puter systems and forensics. Both experts explained how Bit-
    Torrent works, as well as how TDR interacts with the Bit-
    Torrent network, and each opined on the likelihood that the
    downloaded file had existed on Owens’s computer. The gov-
    ernment also offered exhibits based on the forensic search of
    Owens’s computer.
    Owens’s expert explained why it would be “material to
    preparing [his] defense” to verify how TDR operates. Engel
    testified that all software has “bugs,” and so without inde-
    pendent verification, he could not rule out the possibility that
    8                                                     No. 20-3189
    TDR could produce a “false positive.” In other words, TDR
    could have reported that it detected and downloaded a file
    containing child pornography from Owens’s IP address
    when, in fact, it did not.
    Several facts presented at the hearing raise concerns about
    a possible false positive in this case. First and foremost, the
    parties agree that the downloaded file was never located on
    Owens’s devices. Additionally, Detective Erdely testified that
    TDR identifies a computer as “associated with” a contraband
    file if it possesses the torrent for that file, but that is not the
    same as possessing the file itself. Furthermore, Detective
    Erdely conceded that TDR is a “set it and forget it” program—
    after an investigator sets initial parameters, such as which tor-
    rent to search for, it runs on its own. Engel analogized this
    case to one involving a radar gun or breathalyzer, where de-
    fense attorneys are permitted to verify that the instruments
    were properly calibrated and operated correctly when such
    evidence forms the basis of a prosecution.
    Engel also noted that TDR’s download of the target file
    from Owens’s IP address was faster than he would expect if
    TDR had truly conducted a single source download. Engel ex-
    plained that, in his experience reviewing TDR logs, it was not
    uncommon for the logs to describe a single-source download
    that took hours, or even more than a day. Here, however, each
    download of the target file was very quick, “on the order of
    less than a minute or maybe even seconds.” This raised the
    question whether TDR had actually engaged in a normal,
    multi-source download of the file.
    The government introduced evidence to counter these
    facts. Detective Erdely testified that TDR is an exceedingly
    simple program, which makes it less likely to have buggy
    No. 20-3189                                                  9
    code. He testified that TDR only had one bug in its lifetime
    relating to file downloads, and it was that the program did
    not account for filenames that exceeded 260 characters. In-
    stead of resulting in a false positive, that issue simply shut
    down the program, and it was promptly fixed. Erdely also
    dismissed Engel’s concern about the download speed, ex-
    plaining that Owens’s Internet service provider, AT&T U-
    verse, is known to have an extraordinarily large upload band-
    width, and the file at issue is relatively small.
    The government also presented circumstantial evidence
    that the file was, in fact, on Owens’s device at the time TDR
    performed the two downloads. First, logs produced by TDR
    indicate that the suspect computer was running the Bit-
    Torrent client software “BitComet 1.50,” and the forensic ex-
    amination of Owens’s computer revealed that it installed
    BitComet 1.50 the day before TDR downloaded the file at is-
    sue. Second, the forensic examination of Owens’s computer
    shows that twenty minutes after BitComet was installed, a
    torrent with an info hash matching the torrent of the file at
    issue was downloaded and loaded into Owens’s BitComet
    program. And third, the “most recently used” folder on Ow-
    ens’s computer lists the filename of the video at issue. As
    noted above, this filename is long, explicit, and describes the
    file’s content. The “most recently used” folder also reflects
    that the file was “used” during the time when investigators
    were downloading the file from Owens’s IP address using
    TDR.
    Detective Erdely also stated that a false positive would be
    practically impossible in this case, where the TDR program
    had logged matching info hashes relating to the torrent, as
    well as a hash value match for every downloaded piece of the
    10                                                   No. 20-3189
    226-piece video file. Additionally, Erdely explained that, un-
    like an operator of a radar gun or breathalyzer, an investiga-
    tor can only configure two settings in TDR, neither of which
    could generate a false positive. The investigator can (1) ensure
    that TDR will only connect with IP addresses from a particu-
    lar geographical jurisdiction, and (2) determine which illicit
    torrents TDR will detect.
    As for the investigative privilege invoked by the govern-
    ment, Detective Erdely testified that if a user is given a license
    to TDR, it will “expose[] each and every torrent file [the gov-
    ernment is] investigating,” a database that it has taken over
    eight years to compile. He also asserted that access to TDR
    would expose investigators’ contact information and IP ad-
    dresses that are the subject of active investigations.
    Nonetheless, Owens has repeatedly emphasized that he is
    not seeking disclosures of torrents or hash values associated
    with known child pornography files. Owens also elicited tes-
    timony from Erdely that it is possible to run validation testing
    on TDR software using a benign file, that validation demon-
    strations have been performed for defense counsel in some
    cases, and that the FBI performed an independent validation
    of TDR’s single-source download methodology. The govern-
    ment never offered Owens a validation demonstration or ac-
    cess to the FBI’s independent validation.
    2. The District Court’s Denial
    The district court denied Owens’s motion to compel, con-
    cluding that he had not demonstrated materiality. It focused
    on Owens’s assertion that all software has bugs, and it con-
    cluded that the claim boiled down to mere speculation that
    TDR could have logged a false positive in this case. The court
    No. 20-3189                                                  11
    credited Erdely’s testimony that (1) TDR is a simple program
    that is unlikely to have bugs, and (2) if a bug did occur, it
    would not result in a false positive.
    In its materiality analysis, the court also accepted the gov-
    ernment’s circumstantial evidence that the target file had, at
    the time of the downloads, existed on Owens’s computer.
    Given the evidence, the district court concluded that access to
    TDR would not enable Owens to “significantly alter the quan-
    tum of proof in his favor.”
    Turning to the law enforcement investigatory privilege,
    the district court found that providing access to TDR would
    expose thousands of torrents and hash values it has taken law
    enforcement years to amass and give criminals “the key to not
    get caught.” Because it concluded that Owens failed to
    demonstrate materiality, the court concluded that this risk
    clearly weighed against ordering disclosure of TDR’s inner
    workings. The district court did not explicitly consider
    whether there were ways to limit this risk, such as by limiting
    Owens’s expert’s access or entering a protective order.
    The government dismissed the possession charges, and
    Owens entered a conditional guilty plea to the distribution
    charge, which preserved his right to appeal the denial of his
    motion to compel. The district court imposed the mandatory
    five-year minimum sentence of incarceration. See 
    18 U.S.C. § 2252
    (b)(1).
    Owens now appeals.
    12                                                  No. 20-3189
    II.   Discussion
    A. Standard of Review
    Before we can reach the central question of this appeal, we
    must first resolve a dispute about the applicable standard of
    review.
    Rule 16 requires the government to “permit the defendant
    to inspect and to copy … papers, documents, [and] data”
    within the government’s control if they are “material to pre-
    paring the defense.” Fed. R. Crim. P. 16(a)(1)(E). Evidence is
    material to preparing the defense if it would “significantly
    help[] in ‘uncovering admissible evidence, aiding witness
    preparation, corroborating testimony, or assisting impeach-
    ment and rebuttal.’” See United States v. Gaddis, 
    877 F.2d 605
    ,
    611 (7th Cir. 1989) (quoting United States v. Felt, 
    491 F. Supp. 179
    , 186 (D.D.C. 1979)); see also United States v. Naggs, No. 18-
    CR-130, 
    2020 WL 5105792
    , at *1 (E.D. Wis. Aug. 31, 2020). In
    other words, there must be some indication that the disclo-
    sure of the disputed evidence would enable the defendant “to
    substantially alter the quantum of proof in his favor.”
    Orzechowski, 547 F.2d at 984 (citation omitted); see also United
    States v. Baker, 
    453 F.3d 419
    , 425 (7th Cir. 2006) (quoting 2
    Charles Alan Wright, Federal Practice and Procedure § 254
    (3d ed. 2000)) (same). Notably, information may be material
    even if it is not exculpatory. See United States v. Mackin, 
    793 F.3d 703
    , 709–11 (7th Cir. 2015).
    To compel discovery pursuant to Rule 16(a)(1)(E), a “de-
    fendant must make at least a prima facie showing that the re-
    quested items are material to his defense.” United States v.
    Thompson, 
    944 F.2d 1331
    , 1341 (7th Cir. 1991). “This material-
    ity standard normally ‘is not a heavy burden.’” United States
    No. 20-3189                                                    13
    v. Lloyd, 
    992 F.2d 348
    , 351 (D.C. Cir. 1993) (citation omitted);
    see also United States v. Lucas, 
    841 F.3d 796
    , 804 (9th Cir. 2016)
    (explaining that the prima facie showing of materiality is gen-
    erally a “low threshold” (citation omitted)). However, “[n]ei-
    ther a general description of the information sought nor con-
    clusory allegations of materiality suffice; a defendant must
    present facts which would tend to show that the [g]overn-
    ment is in possession of information helpful to the defense.”
    United States v. Clarke, 
    979 F.3d 82
    , 97 (2d Cir. 2020) (quoting
    United States v. Mandel, 
    914 F.2d 1215
    , 1219 (9th Cir. 1990)),
    cert. denied, No. 20-7593, 
    2021 WL 1602723
     (Apr. 26, 2021); see
    also United States v. Caputo, 
    373 F. Supp. 2d 789
    , 793 & n.1
    (N.D. Ill. 2005) (“To make a prima facie showing, a defendant
    cannot rely on general descriptions or conclusory arguments,
    but must convincingly explain how [discovery] will signifi-
    cantly help him uncover admissible evidence, prepare wit-
    nesses, or corroborate, impeach, or rebut testimony.”) (collect-
    ing cases).
    Ordinarily, “[w]e review a district court’s ruling on a mo-
    tion to compel discovery for abuse of discretion.” United States
    v. Kienast, 
    907 F.3d 522
    , 530 (7th Cir. 2018). Owens neverthe-
    less contends that we must apply a de novo standard of re-
    view here because he raises “issues of constitutional dimen-
    sions.” He argues that his claim is properly analyzed under
    the Sixth Amendment’s Confrontation Clause. In this vein, he
    cites Crawford v. Washington, 
    541 U.S. 36
     (2004), Melendez-Diaz
    v. Massachusetts, 
    557 U.S. 305
     (2009), and Bullcoming v. New
    Mexico, 
    564 U.S. 647
     (2011), for the proposition that he is enti-
    tled to cross-examine the “bias,” “reliability,” and “believabil-
    ity” of TDR. He also analogizes TDR to a confidential inform-
    ant, whose “identity” must be disclosed “whenever the in-
    former’s testimony may be relevant and helpful to the
    14                                                  No. 20-3189
    accused’s defense,” such as when the “informer was the sole
    participant, other than the accused, in the transaction
    charged.” See Roviaro v. United States, 
    353 U.S. 53
    , 61–62, 64
    (1957).
    However, the First, Second, Sixth, Eighth, and Ninth Cir-
    cuits have addressed the precise discovery issue raised by
    Owens over the course of the past decade, and no circuit ap-
    plied a de novo standard of review or used a Confrontation
    Clause framework. Furthermore, Owens fails to persuade us
    that such an approach would be appropriate here, where the
    operator of TDR would be available for cross-examination.
    Accordingly, we review the district court’s denial for abuse of
    discretion.
    B. Other Circuits’ Approaches
    As just noted, several of our sister circuits have considered
    whether a defendant has made an adequate showing of mate-
    riality in similar circumstances, and a review of these cases is
    informative. We begin with United States v. Chiaradio, 
    684 F.3d 265
     (1st Cir. 2012), and United States v. Budziak, 
    697 F.3d 1105
    (9th Cir. 2012), which came first and set the stage for what it
    means to make a prima facie case of materiality in this context.
    In United States v. Chiaradio, the First Circuit affirmed the
    district court’s denial of Chiaradio’s motion to compel access
    to the government’s proprietary software. 684 F.3d at 276–77.
    In that case, the government used an enhanced version of
    LimeWire (another peer-to-peer file-sharing program) called
    “EP2P,” (short for “enhanced peer-to-peer software”) to
    download several child pornography files from an IP address
    registered to Chiaradio, who was then charged with pos-
    sessing and distributing child pornography. Id. at 271–72.
    No. 20-3189                                                    15
    Although the government had already produced “a digi-
    tal file recording the transfer from the defendant’s laptop to
    [the law enforcement agent’s] computer” and “a copy of the
    FBI guide detailing how to reconstruct an EP2P session man-
    ually (using only the recording and publicly available pro-
    grams),” Chiaradio also sought EP2P’s source code. Id. at 277.
    He claimed that “he had to obtain the source code in order to
    determine whether he could credibly challenge the reliability
    of the technology and, thus, block the expert testimony prof-
    fered by the government on the EP2P program and how it im-
    plicated the defendant.” Id.
    The First Circuit took “no view” on whether the defendant
    had demonstrated materiality. But because the defendant
    “neither contradicted nor cast the slightest doubt upon” testi-
    mony indicating that agents had reconstructed and verified
    the file transfer, the court found it “pellucid that the forbidden
    files were located on the defendant’s computers and trans-
    ferred to [the agent].” Id. As such, the court held that any pur-
    ported error in EP2P’s functioning was harmless, and so was
    the denial of the defendant’s motion to compel. Id.
    Owens argues that this case is more like United States v.
    Budziak, where the Ninth Circuit held that the defendant had
    adequately demonstrated materiality and reversed the dis-
    trict court’s decision denying discovery. See 697 F.3d at 1111–
    13. As in Chiaradio, the government used EP2P to download
    child pornography files from the defendant’s shared Lime-
    Wire folder. Id. at 1107. A forensic examination of Budziak’s
    computer revealed multiple child pornography files, includ-
    ing several of the images the FBI had downloaded. Id. The cre-
    ation date of the files, however, post-dated the FBI’s down-
    loads. Id. Budziak was charged with multiple counts of
    16                                                  No. 20-3189
    possessing and distributing child pornography, and he
    moved three times to compel disclosure of the government’s
    EP2P program. Id. at 1108. The district court denied his mo-
    tions, and he was convicted on each count after a jury trial. Id.
    On appeal, the Ninth Circuit held that the district court
    abused its discretion when it denied Budziak’s motions to
    compel. It noted that Budziak identified “specific defenses to
    the distribution charge that discovery on the EP2P program
    could potentially help him develop,” and “presented evi-
    dence”—in the form of an affidavit from his expert—”sug-
    gesting that the FBI may have only downloaded fragments of
    child pornography files from his ‘incomplete’ folder, making
    it ‘more likely’ that he did not knowingly distribute any com-
    plete child pornography files.” Id. at 1112 (citation omitted).
    Budziak also submitted evidence “suggesting that the FBI
    agents could have used the EP2P software to override his
    sharing settings.” Id. Based on this evidence, the court found
    that “access to the EP2P software was crucial to Budziak’s
    ability to assess the program and the testimony of the FBI
    agents who used it to build the case against him.” Id.
    The Ninth Circuit also distinguished Chiaradio, because
    unlike the defendant in that case, “Budziak presented argu-
    ments and evidence suggesting that the materials disclosed
    by the FBI did not resolve all questions relevant to his defense.
    Id. at 1112–13 n.1. In discounting the government’s assertion
    that “the computer logs it provided Budziak demonstrated
    that he would not uncover any helpful information through
    discovery of the software,” the Ninth Circuit cautioned dis-
    trict courts not to “merely defer to government assertions that
    discovery would be fruitless” if a defendant made a threshold
    showing of materiality. Id. at 1112–13.
    No. 20-3189                                                           17
    The court went on to warn:
    While we have no reason to doubt the govern-
    ment’s good faith in such matters, criminal de-
    fendants should not have to rely solely on the
    government’s word that further discovery is un-
    necessary. This is especially so where, as here, a
    charge against the defendant is predicated
    largely on computer software functioning in the
    manner described by the government, and the
    government is the only party with access to that
    software.
    Id. at 1113. The Ninth Circuit remanded the case to the district
    court to determine whether the EP2P materials did “in fact
    contain, or would have led to, information that might have
    altered the verdict.” Id. (citation omitted).
    The Second, Sixth, and Eighth Circuits have also recently
    considered this issue, largely following the principles an-
    nounced in Chiaradio and Budziak.
    In United States v. Pirosko, the Sixth Circuit held that the
    defendant failed to demonstrate materiality (and, in any
    event, the law enforcement investigative privilege would op-
    erate to shield production of the software) where the defend-
    ant only supported his motion to compel with a conclusory
    letter from his expert claiming that errors in the program may
    have existed because the government’s disclosures “le[ft] oth-
    erwise answerable questions unanswered.” 
    787 F.3d 358
    , 366
    (6th Cir. 2015). 2 Unlike the defendant in Budziak, the court
    2The Sixth Circuit made this statement when discussing the law en-
    forcement investigative privilege, but because the privilege analysis
    “weigh[s] the government’s concerns against the needs articulated by [the
    18                                                        No. 20-3189
    concluded, “Pirosko has failed to produce any [evidence that
    the program did not operate as described] here, even after re-
    ceiving the government’s computer logs, which included in-
    formation on when law enforcement officials were able to
    connect to his computer and what files they were able to
    download from his shared folder.” 
    Id.
    The Sixth Circuit nonetheless admonished the govern-
    ment that “this conclusion should not be read as giving the
    government a blank check to operate its file-sharing detection
    software sans scrutiny. As a general matter, it is important
    that the government’s investigative methods be reliable, both
    for individual defendants like Pirosko and for the public at
    large.” 
    Id.
     “Still,” the court wrote, “we think that it is im-
    portant for the defendant to produce some evidence of gov-
    ernment wrongdoing.” 
    Id.
    In United States v. Clarke, the Second Circuit recognized
    that,
    when a defendant’s guilt is predicated on the
    government offering proof that a government
    agent downloaded files from the defendant’s
    computer, information about the program by
    which the downloading was accomplished is
    likely to be “material to preparing the defense”
    and therefore subject to disclosure under [Rule]
    16(a)(1)(E)(i), so as to enable the defendant to
    challenge the government’s proof.
    defendant],” see Pirosko, 787 F.3d at 365—in other words, the analysis
    weighs the government’s concerns against the materiality of the evidence
    to the defense—this discussion appropriately informs our materiality
    analysis.
    No. 20-3189                                                              19
    979 F.3d at 97. Nonetheless, the court determined that it “need
    not decide whether the [g]overnment’s reasons for withhold-
    ing disclosure outweighed [the defendant’s] need for it” be-
    cause the defendant was not prejudiced by the nondisclosure.
    Id. at 98.
    Like this case, Clarke involved BitTorrent and a version of
    Torrential Downpour; government investigators down-
    loaded child pornography from the defendant’s shared folder
    on the BitTorrent network, and he was charged with posses-
    sion and transportation. Id. at 86–87. Clark sought a copy of
    the Torrential Downpour program or its source code for test-
    ing and evaluation. Id. at 88. His proffered theory was that the
    allegedly downloaded files were stored only on his external
    hard drive and could not have been accessible to the public
    via the BitTorrent network. Id. Clarke sought to test whether
    Torrential Downpour could access non-public information on
    his computer. Id.
    The government provided Clarke with (1) copies of the
    files downloaded by the agents (as well as forensic images of
    the corresponding data recovered on the defendant’s com-
    puter equipment); (2) over 200 pages of data logs detailing the
    agents’ downloads of files from his computer; (3) a “forensic
    report” of the computer equipment seized; and, crucially, (4)
    an in-person demonstration of how Torrential Downpour op-
    erated. Id. at 97. The government’s expert also “submitted ev-
    idence showing that files downloaded and saved to an exter-
    nal hard drive by a Department of Justice investigative ana-
    lyst, using the same version of uTorrent used by Clarke, were
    accessed by other BitTorrent users.” Id. at 98. 3 The Second
    3 The program uTorrent is a BitTorrent software client. Clarke, 979 F.3d
    at 87.
    20                                                    No. 20-3189
    Circuit held that the district court was entitled to credit this
    evidence over the defendant’s “speculation” that it was not
    possible to download files from an external hard drive over
    the BitTorrent network. Id. Accordingly, the court held that
    “given the extensive disclosures that were made to Clarke,”
    there was “no indication” that “he was in any way prejudiced
    by the district court’s denial of his demand for disclosure of
    the program itself and its source code.” Id. at 98–99.
    Finally, in United States v. Hoeffener, the Eighth Circuit con-
    cluded that the defendant’s request to access the program at
    issue was nothing more than a “fishing expedition.” 
    950 F.3d 1037
    , 1043 (8th Cir. 2020). Hoeffener also involved Torrential
    Downpour and BitTorrent, but there, unlike this case, the de-
    fendant was charged only with receipt and possession of child
    pornography. 
    Id. at 1040
    . The government disclosed:
    (1) a printout of a Powerpoint presentation
    about the installation and use of uTorrent ver-
    sion 2.2.1 (the file-sharing software used by
    Hoeffener at the time of the online investiga-
    tion); (2) a compact disc depicting a simulation
    of how law enforcement personnel use the soft-
    ware program; (3) the log of activity occurring
    during the online investigation of Hoeffener’s
    computer, along with testimony explaining
    these materials from a detective who helped
    create and train law enforcement personnel on
    the use of the software program; (4) the length
    of time the program had been used by the St.
    Louis Metropolitan Police Department; and (5)
    a list of the program’s authorized users.
    No. 20-3189                                                          21
    
    Id. at 1043
    . 4 The Eighth Circuit also noted that the defendant’s
    retained expert had been granted access to Torrential Down-
    pour the prior year by a district court in the District of Arizona
    following Budziak. 
    Id.
     at 1043 n.3.
    In addition to these materials, Hoeffener sought the source
    code and manuals relating to the program to evaluate
    whether there had been a Fourth Amendment violation. 
    Id. at 1043
    . But, the Eighth Circuit concluded, Hoeffener only of-
    fered “mere speculation that the software program could pos-
    sibly access non-public areas of his computer or that there was
    a possibility that it malfunctioned during the officers’ investi-
    gation into Hoeffener’s sharing of child pornography.” 
    Id. at 1044
    . The court held that this was insufficient to meet the
    threshold prima facie showing of materiality.
    These cases show that, in general, a defendant will not be
    able to make a prima facie case that disclosure of the govern-
    ment’s confidential software is material to his defense if he
    cannot present a cogent defense theory, supported by some
    facts, which discovery relating to the software would help de-
    velop. See, e.g., Chiaradio, 684 F.3d at 277; Hoeffener, 950 F.3d at
    1044. Furthermore, a defendant may yet fail to make a prima
    facie showing of materiality if the government presents evi-
    dence based on information produced to the defendant that
    fatally undermines the proffered theory. See, e.g., Clarke, 979
    F.3d at 98. But, where the government’s evidence does not
    “resolve all questions relevant to [the proffered] defense,”
    then discovery is likely appropriate, subject to any privileges
    4 The detective who testified was Detective Erdely, the same witness
    for the government in this case.
    22                                                 No. 20-3189
    the government may prove to be applicable. See Budziak, 697
    F.3d at 1112–13 n.1.
    C. Application to the Instant Case
    Returning to the case before us on appeal, as the district
    court in this case correctly acknowledged, the burden of mak-
    ing a prima facie showing of materiality typically “is not a
    heavy burden.” Lloyd, 
    992 F.2d at 351
    . Rather, a defendant
    must simply present facts indicating that the evidence will
    “play an important role in uncovering admissible evidence,
    aiding witness preparation, corroborating testimony, or as-
    sisting impeachment or rebuttal.” 
    Id.
     (citation omitted). Fur-
    thermore, the evidence need not be exculpatory. See Mackin,
    793 F.3d at 709–11.
    We join our sister circuits in underscoring that the govern-
    ment does not have “a blank check to operate its file-sharing
    detection software sans scrutiny,” Pirosko, 787 F.3d at 366, and
    “criminal defendants should not have to rely solely on the
    government’s word that further discovery is unnecessary,”
    Budziak, 697 F.3d at 1113. We also emphasize that “[i]n cases
    where the defendant has demonstrated materiality,”—and by
    that, we mean simply that the defendant has made a thresh-
    old showing of materiality—“the district court should not
    merely defer to government assertions that discovery would
    be fruitless.” Id. at 1112–13.
    Concerns about materiality aside, we review a district
    court’s discovery ruling for abuse of discretion, and we will
    reverse only where “there is ‘an appreciable risk that preju-
    dice resulted.’” United States v. Bastanipour, 
    697 F.2d 170
    , 177
    (7th Cir. 1982) (quoting United States v. Dioguardi, 
    428 F.2d 1033
    , 1038 (2d Cir. 1970)); see also United States v. Kohli, 847
    No. 20-3189                                                                
    23 F.3d 483
    , 493–94 (7th Cir. 2017) (reviewing the government’s
    failure to disclose material information pursuant to Rule 16
    for harmless error); Orzechowski, 547 F.2d at 985 (holding that
    “we cannot say that these items were material within the
    meaning of Rule 16, or that their exclusion, if error, was not
    harmless”); Pirosko, 787 F.3d at 365 (noting that “[r]eversal [for
    a district court’s Rule 16 error] is appropriate only if the abuse
    was not harmless error” (internal quotation marks and cita-
    tion omitted)). Accordingly, a defendant has a much heavier
    burden on appeal than he does when presenting a Rule 16
    motion to compel to the district court. And where the district
    court has not clearly erred by crediting evidence that a de-
    fendant possessed or distributed an illicit file—irrespective of
    any questions raised about the government's confidential
    software—then an appealing defendant will have an uphill
    battle indeed.
    Here, we hold that Owens suffered no prejudice from the
    district court’s decision, and thus we need not opine on mate-
    riality. The government presented evidence that undermined
    Owens’s proffered “false positive” theory, which the district
    court was entitled to credit. 5 In particular, the district court
    5  Owens maintains that the district court should not have relied on
    Erdely’s testimony about the way TDR functions because it amounted to
    improper “ipse dixit.” See Ipse dixit, Black's Law Dictionary (11th ed. 2019)
    (defining ipse dixit as “[s]omething asserted but not proved”). But Owens’s
    concerns are misplaced. Our caselaw describes an expert’s ipse dixit as oc-
    curring where “there is simply too great an analytical gap between the
    data and the opinion proffered.” See C.W. ex rel. Wood v. Textron, Inc., 
    807 F.3d 827
    , 832 (7th Cir. 2015) (quoting Gen. Elec. v. Joiner, 
    522 U.S. 136
    , 138
    (1997)). To identify improper ipse dixit, “[t]he critical inquiry is whether
    there is a connection between the data employed and the opinion offered;
    it is the opinion connected to existing data ‘only by the ipse dixit of the
    expert’ that is properly excluded under Rule 702.” Gopalratnam v. Hewlett-
    24                                                            No. 20-3189
    did not clearly err when it accepted Erdely’s testimony that
    the torrent relating to the target file had been opened in Ow-
    ens’s BitComet application while the investigation was occur-
    ring, as well as the evidence that a file with the same filename
    as the illicit video was present in Owens’s “most recently
    used” folder. This testimony was based on the forensic anal-
    ysis of Owens’s computer, which the government produced
    to defense counsel.
    Given these facts, Owens cannot demonstrate that access
    to TDR would “substantially alter the quantum of proof in his
    favor.” Orzechowski, 547 F.2d at 984 (citation omitted). Sub-
    stantial evidence indicates that Owens accessed and shared
    the file at issue, which is untainted by any questions raised
    about TDR’s functions. And because Owens was not preju-
    diced as a result of the government’s non-disclosure, we need
    not address whether the district court properly applied the
    law enforcement investigative privilege to the case at hand.
    III.    Conclusion
    For the foregoing reasons, we AFFIRM the judgment of the
    district court.
    Packard Co., 
    877 F.3d 771
    , 781 (7th Cir. 2017) (quoting Manpower, Inc. v. Ins.
    Co. of Pennsylvania, 
    732 F.3d 796
    , 806 (7th Cir. 2013)). Erdely, however, was
    not attempting to create a bridge between raw data and his expert opinion.
    He was testifying about the nature of TDR based on his experience devel-
    oping and working with the program. Therefore, it was not improper for
    the district court to rely on Erdely’s testimony.