E.D.Wis.: Where a business and the apt over it shared an IP address, SW for business was overbroad, but saved by GFE

Where the evidence showed that a business and an apartment shared an IP address, the affidavit for the search warrant for the business for child pornography traced back to that IP lacked probable cause. However, the good faith exception saves the search anyway. United States v. Link, 2015 U.S. Dist. LEXIS 19764 (E.D. Wis. February 18, 2015):

Link argues that the affidavit submitted by Sergeant Waterstreet fails to establish probable cause. He contends that paragraph three of the affidavit, the only paragraph that even purports to connect child pornography to an IP address associated with Link, is “so cryptic and confusing as to be nearly incomprehensible.” (ECF No. 21 at 5.) Link notes that the affidavit states that Sergeant Waterstreet was notified by Lieutenant Valley of an IP address that “became the target of an online child pornography investigation on the Emule network.” No explanation is given, however, as to how the IP address became a target of an investigation, why it became a target, or even who determined it was a target. The affidavit also fails to explain what an Emule network is or why that fact is significant. The paragraph goes on to say that the IP address was associated with a particular MD5 hash value, but does not explain what is meant by “associated with” or what an MD5 hash value is or who made this determination. The paragraph then refers to a “file” and states that “a part of this file was identified as being a file of investigative interest to child pornography investigations,” but fails to say why the file was of investigative interest and what being of investigative interest means. Finally, the paragraph includes a description of “a view of the file downloaded” but fails to say who viewed the file and is offering the description.

The problem is compounded by the facts that there is no indication when the file was downloaded from the listed IP address, assuming it was downloaded from that IP address, and the location shown for the IP address is an apartment on the second floor of 18 N. 3rd Avenue, yet the warrant authorizes a search of a book store which, while in the same building, is located on the first floor and has a separate address. Link contends that there is no evidence in the affidavit that the bookstore has internet access or contains computers or other devices that can access the internet.

The fact that Sergeant Waterstreet detected a secure wifi network on the sidewalk in front of the bookstore, absent evidence that the store was connected to the network, is irrelevant. And because the affidavit fails to state when the IP address “was associated with” the file containing child pornography or when the file was downloaded from that IP address, there is no basis for concluding that evidence of the crime would still be there. In other words, there is no reason to believe the evidence was not stale.

The government concedes, as it must, that the affidavit could have been better written, but argues that it is nevertheless sufficient to establish probable cause. While not a model of clarity, the government argues that a common sense reading of the affidavit leads to the conclusion that in the course of a child pornography investigation, law enforcement had downloaded a digital file containing child pornography from a particular IP address for a computer located in Apartment 2 of 18 N. 3rd Avenue in Surgeon Bay, Wisconsin. Charter Communications, the internet service provider, identified Link at the same address as the account holder. The affidavit also identified Link as the sole owner/operator of a used book store located in the same building directly below the apartment. In addition to the same occupant or owner, both the bookstore and the apartment also shared the same telephone number, suggesting that they were connected to each other. Finally, the affidavit noted that the bookstore had its own website, untitledandrarebooks.com, which at least suggested that it had an internet presence, and included Link’s online profile at a social media site in which he describes himself as a former Charter Communications Divisional Operations Analyst capable of getting “any raw data format he wanted out of any database regardless of complexity.”

The government’s reading of the affidavit is not a common sense reading. Instead, it is a reading informed by technical knowledge of how child pornography investigations are conducted that
allows it to cut through the cryptic jargon Sergeant Waterstreet employed in his affidavit and make sense out of what otherwise one might find hopelessly confusing. For this reason alone, I conclude that probable cause was lacking. Moreover, having failed to indicate when the file containing child pornography was downloaded from Link’s IP address, it is impossible to determine whether the evidence was stale. The Seventh Circuit has noted that it is rare that evidence of child pornography being uploaded to or downloaded from a computer will be stale. This is because “[c]omputers and computer equipment are ‘not the type of evidence that rapidly dissipates or degrades.'” United States v. Seiver, 692 F.3d 774, 777 (7th Cir. 2012) (quoting United States v. Vosburgh, 602 F.3d 512, 529 (3d Cir. 2010)). Still, with evidence of only a single download and no indication when it occurred set forth in the affidavit, no probable cause was shown. See United States v. Prideaux-Wentz, 543 F.3d 954, 959 (7th Cir. 2008) (“The four year gap, without more recent evidence, undermines the finding that there was probable cause that the images would be found during the search. Therefore, we find that the evidence relied on to obtain the warrant here was stale, and the warrant lacked probable cause.”).

A further problem with the warrant was the lack of a nexus between the evidence sought-the child pornography, and the bookstore owned by Link. It is true that Link was both the owner of the account with the internet service provider and the bookstore. But the IP address linked to the child pornography was for an account with a billing address of 18 N. 3rd Avenue, Apartment 2, Sturgeon Bay, Wisconsin. An IP addresss is unique to a specific computer and is generally considered a fairly unique identifier so that it can ordinarily be relied upon to show probable cause as to the residence to which the IP address was assigned. United States v. Vosburgh, 602 F.3d 512, 526 (3d Cir. 2010) (noting that courts have held that “evidence that the user of a computer employing a particular IP address possessed or transmitted child pornography can support a search warrant for the physical premises linked to that IP address”). Here, the government argues that because Link was both the owner of the account and the owner of the bookstore, a wifi network was detected immediately outside the bookstore, and because both the apartment and the bookstore had the same telephone number, a sufficient nexus was shown, especially given Link’s claimed knowledge and experience as a former Charter Communications Divisional Operations Analyst.

This entry was posted in Overbreadth, Probable cause. Bookmark the permalink.

Comments are closed.