A single access to child pornography from an IP address linked to defendant was not enough to find probable cause that the defendant had child pornography on the computer. The good faith exception, however, was sufficient to sustain the warrant because the officer was merely negligent in his representations to the issuing magistrate. United States v. Raymonda, 2015 U.S. App. LEXIS 3141 (2d Cir. March 2, 2015):
In support of the application, Agent Ouzer included an affidavit disclosing the details of Agent Sajo’s investigation, including Agent Sajo’s discovery of www.coolib.org through a link on www.motherless.com, his acquisition of user logs for the IP address in question, and his confirmation that this IP address was associated with Raymonda. Discussing the content of the IP logs, Agent Ouzer stated that “76 images, the majority of which were images of child pornography, … were accessed by the user of [the] IP address.” While conceding that these logs provided “no record that the user accessed an enlarged (full size) image,” Agent Ouzer concluded that they nevertheless “show more than one incidence of access of thumbnail images by the user.” He also stated that the logs “identified that the user of [the] IP address … successfully viewed suspect child pornography images contained in Directory 55,” and that “the frequency of successful (GET) requests for the suspect images” contained in the log “provide evidence that the user intended to view the content.” Agent Ouzer did not append the full IP log to his warrant application, nor did he state that the time stamps on the log covered a span of seventeen seconds.
. . .
On March 19, 2012, Raymonda filed a motion to suppress all evidence discovered at his home on November 8, 2011, including his statements to Agent Ouzer, arguing that the search warrant was issued without probable cause and that Agent Ouzer had not relied on that warrant in good faith. Specifically, Raymonda argued that Agent Ouzer’s evidence that a user with his IP address allegedly accessed images of child pornography in January 2011 was too stale to suggest that pornographic images would still be found in his home at the time of the search, and that Agent Ouzer’s involvement in United States v. Coon, No. 10-CR-110A, 2011 WL 1871165, (W.D.N.Y. May 16, 2011), an earlier case in which one-year-old evidence of possession had been found too stale to create probable cause, should have alerted him to the deficiency.
In support of his motion, Raymonda introduced the expert testimony of Gerald R. Grant, a forensic investigator with the Federal Public Defender’s office. Grant testified that GET requests for images contained in an IP log do not signal that a user intentionally opened or clicked on individual links, but rather occur automatically whenever a browser opens a web page: “If you’re on the internet browsing, and you click on a web page, and that web page comes up on your screen, that web page is a series of get commands ….” Accordingly, the IP logs obtained for www.coolib.org did not disclose whether the user with Raymonda’s IP address had saved or even viewed all of the images that his browser had accessed, and indeed would have looked exactly the same even if he “simply close[d]” the site immediately after clicking on it. Grant clarified that images automatically downloaded by a user’s web browser are not saved to the user’s hard drive, but only to a temporary Internet cache where they typically remain “two days to a month” before being overwritten. Finally, he noted that all images accessed by the user were downloaded within seventeen seconds, a time span consistent with a web browser loading images on a single page at slightly different speeds.
. . .
In all of these cases, the inference that the suspect was a collector of child pornography did not proceed merely from evidence of his access to child pornography at a single time in the past. Rather, it proceeded from circumstances suggesting that he had accessed those images willfully and deliberately, actively seeking them out to satisfy a preexisting predilection. Such circumstances tend to negate the possibility that a suspect’s brush with child pornography was a purely negligent or inadvertent encounter, the residue of which was long ago expunged. They suggest that the suspect accessed those images because he was specifically interested in child pornography, and thus — as is common among persons interested in child pornography — likely hoarded the images he found. As the Sixth Circuit has observed, “[i]t is not likely that … someone who was innocently surfing the internet … accidentally paid $79.95 for a subscription to [a child pornography] web site.” Frechette, 583 F.3d at 381; see also United States v. Shields, 458 F.3d 269, 279 (3d Cir. 2006) (“[The possibility] that an individual … simply might have stumbled upon the sites … is remote given his registrations … and his subsequent failure to cancel his memberships.”) (internal quotation marks and alteration omitted).
That insight is consistent with our own cases discussing child pornography. While we have never addressed the circumstances under which a suspect’s online access to images of child pornography raises the inference that he will hoard those images so as to defeat a staleness challenge, we have on at least two occasions considered when a suspect’s recent online activity creates probable cause to search his computer for child pornography. See Falso, 544 F.3d 110; United States v. Martin, 426 F.3d 68 (2d Cir. 2005). In Martin, we upheld a warrant to search a suspect’s computer for pornographic images on the grounds that he had recently joined an Internet group devoted to the distribution of child pornography, even absent evidence that he had actually accessed any illicit images through that site. 426 F.3d at 73. In doing so, we stressed that the suspect had voluntarily “joined … and never cancelled his membership” in a website built around facilitating access to child pornography. Id. at 75. Because it was “common sense that an individual who joins such a site would more than likely download and possess such material,” the fact that Martin had deliberately registered an account with the group strongly suggested that he was actively interested in its materials and therefore sought out pornographic files. Id.; see also United States v. Froman, 355 F.3d 882, 890 (5th Cir. 2004) (“[T]he magistrate was entitled to conclude that the overriding reason someone would join [a child pornography] group was to permit him to receive and trade child pornography.”).
. . .
Under those circumstances, absent any indicia that the suspect was a collector of child pornography likely to hoard pornographic files, we hold that a single incident of access does not create a fair probability that child pornography will still be found on a suspect’s computer months after all temporary traces of that incident have likely cleared. We thus conclude that the warrant issued in this case was not supported by probable cause.
II. Good Faith
That the warrant was not supported by probable cause, however, does not necessarily mean that the evidence discovered by the agents at Raymonda’s home must be suppressed.
. . .
Nor are Agent Ouzer’s potential mischaracterizations of the IP logs sufficiently egregious to justify exclusion. As the district court noted, Agent Ouzer did not recklessly or even carelessly include false information in his affidavit, but rather genuinely believed that the GET requests revealed that Raymonda “clicked” to view the thumbnail images. We have no grounds on this record to believe that Agent Ouzer’s misunderstanding amounted to a gross lapse in his expected competence in interpreting computer data. More to the point, while Agent Ouzer did misstate that the IP log “provide[d] evidence that the user intended to view the content,” J. App’x at 50 (emphasis added), his remaining observations that the user of the IP address “accessed,” “obtained,” and “successfully viewed” images of child pornography are arguably consistent with information in the IP logs regarding the browser’s successful downloads of the thumbnails. Absent any finding that he intended to deceive the magistrate judge with these statements, we cannot find gross negligence in Agent Ouzer’s use of technically correct language that had the potential to confuse a reader unfamiliar with IP protocol.
We do not doubt that certain statements in Agent Ouzer’s affidavit may have exaggerated the significance of his evidence, nor that such statements may have contributed to the issuance of an invalid search warrant. But the exclusionary rule is designed not to redress minor overstatements or simple negligence by the police, but to deter deliberate, reckless, or otherwise inexcusable violations. See Davis, 131 S. Ct. at 2426, 2428. Because Agent Ouzer’s oversights in drafting the affidavit fall short of deliberate deception or gross negligence, the good faith exception applies, and precludes suppression of the evidence obtained pursuant to the warrant.
