United States v. Sherlock, 3:17-cr-00112

In Sept. 2016, AG Cyber Crime Unit used automated searches of P2P networks and identified an IP address allegedly sharing files with filenames indicative of child pornography; SHA-1 hashes matched at least one known illegal file.
Subpoena to Cox Communications linked the IP address to a Gonzales, LA residence.
On Nov. 16, 2016, a state judge issued a search warrant for the residence authorizing seizure of computers and digital media.
During execution, agents seized a computer from Sherlock’s bedroom containing thousands of child‑pornography images; Sherlock, after Miranda warnings, admitted downloading and possessing such images.
Sherlock moved to suppress, arguing the warrant affidavit was “bare bones” (relying only on file names from an automated search) and thus officers could not reasonably rely on it in good faith.
The district court held an evidentiary hearing, found the affidavit included the SHA match and was sufficient for objective good‑faith reliance, and denied the motion to suppress.

Issue	Plaintiff's Argument	Defendant's Argument	Held
Sufficiency of affidavit/probable cause for warrant	Govt: Affidavit and SHA match supported a fair probability contraband would be found	Sherlock: Affidavit was a form document relying on automated P2P filename hits (only a few questionable names) and lacked specific individualized evidence	Court: Affidavit contained enough (including at least one SHA match) for a reasonable inference of likely evidence; not bare bones
Applicability of Leon good‑faith exception	Govt: Even if affidavit were weak, officers reasonably relied on the warrant	Sherlock: Affidavit so lacking that good‑faith exception cannot apply (bare bones)	Court: Good‑faith exception applies; officers’ reliance was objectively reasonable
Whether investigators’ failure to follow described protocol vitiates probable cause	N/A (raised by defense)	Sherlock: Failure to show investigator reviewed downloads or established IP‑to‑file linkage undermines affidavit	Court: Protocol language was permissive; failure to follow it did not negate probable cause or good faith
Exclusion of seized evidence and subsequent confession	N/A	Sherlock: Evidence and confession should be suppressed as fruits of invalid search	Court: Denied suppression; evidence and confession admissible because warrant was supportable and/or reliance was reasonable

United States v. Leon, 468 U.S. 897 (1984) (establishes good‑faith exception to exclusionary rule)
United States v. Perez, 484 F.3d 735 (5th Cir.) (IP address linkage + officer experience can support probable cause in child‑pornography cases)
United States v. Stults, 575 F.3d 834 (8th Cir.) (P2P investigation and file downloads supported probable cause)
United States v. Froman, 355 F.3d 882 (5th Cir.) (practical, common‑sense probable cause standard)
United States v. Brown, 941 F.2d 1300 (5th Cir.) (probable cause/warrant principles)
United States v. Craig, 861 F.2d 818 (5th Cir.) (good‑faith reliance principles)
United States v. Flanders, 468 F.3d 269 (2d Cir.) (child‑pornography affidavit need not show individualized possession)