COMMONWEALTH vs. ADALBERTO MARTINEZ.
Bristol.
Supreme Judicial Court of Massachusetts
February 7, 2017
476 Mass. 410 (2017)
October 6, 2016. — February 7, 2017. Present: GANTS, C.J., BOTSFORD, LENK, HINES, GAZIANO, LOWY, & BUDD, JJ.
A District Court judge properly denied the defendant‘s pretrial motion to suppress computer evidence obtained pursuant to a search warrant, where the averments in the affidavit in support of the search warrant application (i.e., that a particular Internet protocol address was used to share child pornography and that this Internet protocol address had been assigned at the time in question to an Internet subscriber at the specific physical address to be searched) were sufficient to establish probable cause for the search, even though the named subscriber was neither listed as, nor confirmed to be, living in the apartment searched, and even though police had no information before the search linking the defendant to the residence. [414-424]
COMPLAINT received and sworn to in the Fall River Division of the District Court Department on May 9, 2012.
A pretrial motion to suppress evidence was heard by Kevin J. Finnerty, J., and the case was tried before him.
The Supreme Judicial Court on its own initiative transferred the case from the Appeals Court.
Michelle A. Dame for the defendant.
Shoshana E. Stern, Assistant District Attorney, for the Commonwealth.
BOTSFORD, J. The defendant, Adalberto Martinez, appeals from his conviction of possessing child pornography in violation of
Background. 1. IP addresses. All computers that connect to the Internet identify each other through a unique string of numbers known as an Internet protocol address (IP address). See Internet Corporation for Assigned Names and Numbers, Beginner‘s Guide
In the early days of the Internet, when a residential Internet subscriber went online using only a home computer connected to a hard-wired Internet connection, there was a very strong correlation between an IP address assigned to a subscriber and a particular computer. Now, however, many subscribers use a wireless Internet router, which allows multiple devices within the range of the router to connect to the Internet simultaneously. See United States v. McLellan, 792 F.3d 200, 213-214 (1st Cir.), cert. denied, 136 S. Ct. 494 (2015), and cases cited. To the outside world, all of these devices will share a single public IP address — the one that the ISP has assigned to its subscriber. See id. But internally, the router will identify each connected device by the device‘s own identifying number in order to channel data to and from the appropriate device. See id. See also ICANN Guide, supra at 4. As a result, the correlation between an Internet subscriber‘s assigned IP address and any one particular Internet-enabled device may often be weaker than it once was. However, the correlation between an IP address and a physical address can still be strong, at least when the ISP has verified its assignment of a particular IP address to a subscriber at a specific physical address at a specific point in time. See DOJ, Searching and Seizing Computers, supra at 65-66; Mackey, Schoen, & Cohn, Unreliable Informants: IP Addresses, Digital Tips and Police Raids 8-10 (Sept. 2016), available at https://www.eff.org/files/2016/09/22/2016.09.20_final_formatted_ip_address_white_paper_0.pdf [https://perma.cc/Y42U-C5TG ] (EFF, Unreliable Informants).
2. Search warrant affidavit. The affidavit in support of the contested search warrant and related materials aver the following.
In this case, Hill discovered that a computer using the IP address 65.96.142.191 and displaying the username “datflypapi@Ares” was sharing suspected child pornography via the Ares network. Through an online mapping tool (several of which exist on publicly accessible Web sites), Hill determined that this IP address was likely associated with a computer in Massachusetts. The computer using this IP address was sharing a total of ten files via the network. Hill found that a majority of these files had names containing terms commonly associated with child pornography. Over approximately thirty minutes, Hill downloaded and viewed four video files from the suspect computer and concluded that these files were child pornography. While downloading the files, Hill used another program that confirmed that a computer associated with the IP address 65.96.142.191 was connected to his computer.
By conducting an Internet search, Hill determined that the IP address in question was associated with Comcast Cable (Comcast), a major cable company and ISP. Based on the above information, the district attorney for the Berkshire district issued an adminis-
3. Execution of the search warrant. Washington and two other officers executed the warrant on April 5, 2012. According to Washington‘s trial testimony, when the officers first knocked on the door of the apartment, no one answered.3 Washington then heard someone say, “Hey, he just ran out that way,” and saw a “large male” running down a side street away from the apartment. The officers eventually entered the apartment. Inside they encountered the defendant‘s girl friend, Ruth Pereira, holding her infant child. Both Avilez and Angel Martinez, the defendant‘s cousin, arrived at the apartment while officers were conducting the search, but the defendant was not present.
During the search, Washington noticed two laptop computers underneath a basket of laundry. After some initial testing (which was not described in detail in the trial record), the officers seized the two computers and brought them back to the police station.4 Upon further inspection at the station, officers discovered five video files of child pornography on one of the defendant‘s laptop
4. Procedural history. A complaint issued charging the defendant with one count of distribution of material depicting a child engaged in a sexual act, in violation of
The defendant was tried before and convicted by a jury in the District Court on the charge of possession of child pornography; the Commonwealth filed a nolle prosequi of the distribution charge. The defendant timely appealed from his conviction, and we transferred the appeal to this court on our own motion.
Discussion. The sole issue on appeal is the validity of the search warrant issued for the apartment. Detective Washington‘s affidavit in support of the search warrant averred that a particular IP address was used to share child pornography and that this IP address had been assigned at the time in question to an Internet subscriber at the specific physical address to be searched. The central question is whether these averments were sufficient to establish probable cause for the search, even though the named subscriber was neither listed as, nor confirmed to be, living in the unit, and even though police had no information before the search linking the defendant to the residence. We conclude that the affidavit in this case did establish probable cause to search the apartment for computer evidence related to the suspected possession or distribution of child pornography.
“Under the Fourth Amendment and art. 14, a search warrant may issue only on a showing of probable cause.”5 Commonwealth v. Anthony, 451 Mass. 59, 68 (2008). “The probable cause nec-
The probable cause inquiry in this case asks whether the facts averred in Washington‘s affidavit showed a sufficient nexus be-
Here, the affidavit described how Sergeant Hill had observed a computer associated with the IP address 65.96.142.191 that contained, and was sharing, child pornography via the Ares network. An Internet search revealed that this IP address had been issued to Comcast, the ISP. The district attorney for the Berkshire district then issued a subpoena to the ISP, which revealed that the IP address in question had been assigned during the relevant time period to a subscriber at the physical address of the apartment.6 The temporal and geographical links between the target IP address and the physical address to be searched provided a substantial basis for concluding that evidence sought (computers and related items) was connected to the suspected crime (possessing or sharing child pornography) and likely would be found at the specified premises (the apartment), and therefore gave rise to a sufficient nexus between the suspected criminal activity and the residence. See Commonwealth v. Augustine, 472 Mass. 448, 455 (2015); Commonwealth v. Foster, 471 Mass. 236, 241-242 (2015).
Of course, the ISP also provided a name associated with the service address and officers took subsequent steps to determine who actually lived at the apartment. In many cases, those pieces of information can serve a useful confirmatory role. But in the present case, we conclude that there was probable cause to search for evidence related to sharing child pornography based on the information police obtained through their Ares surveillance and the administrative subpoena, independent of whose name was on the Internet account or in the housing development‘s records. The
The defendant advances, in essence, three arguments about why investigators needed to do more to establish probable cause. We address each in turn.
First, he points out that before applying for the search warrant, the police were unable to verify that the subscriber named by the ISP — Angel Martinez — lived at the apartment, and also were unable to rule out the possibility that someone other than the named subscriber was responsible for using the IP address assigned to the apartment at the time in question. Therefore, the defendant argues, it was possible that a new (and innocent) person had moved into the apartment while Angel Martinez, living at a different address altogether, continued to pay the Internet bill, or that a new occupant merely took over the Internet payments without changing the name on the account. To support his position, the defendant cites several cases in which investigators obtained more information linking an individual suspect to a specific physical address before applying for a search warrant. See, e.g., United States v. Elbe, 774 F.3d 885, 887-888 (6th Cir. 2014), cert. denied, 135 S. Ct. 1573 (2015) (agents observed person matching child pornography suspect‘s driver‘s license photograph sitting on porch of target residence); United States v. Stults, 575 F.3d 834, 838 (8th Cir. 2009), cert. denied, 559 U.S. 915 (2010) (public records check using LexisNexis, postal service mail delivery check, and motor vehicle registration check all confirmed that named Internet subscriber actually resided at target residence).
It is true that investigators had no direct information that Angel Martinez personally had used, was using, or would ever use the IP address in question. However, in this particular case, the name of the Internet account holder did not defeat probable cause. See Commonwealth v. Molina, 476 Mass. 388, 395-396 (2017). The question before the magistrate was whether the apartment located at a certain address likely contained evidence of criminal activity — period. The question was not whether that address likely contained evidence of criminal activity on the part of Angel Martinez (or on the part of Avilez for that matter).
To that end, Detective Washington‘s supporting search warrant affidavit spelled out a relatively direct link between (1) the
Once this nexus was established, the name of the account holder was essentially incidental. See Molina, 476 Mass. at 395-396. Although information showing that the named subscriber was also the person suspected of possessing or sharing the child pornography might have increased the likelihood that the sought-after evidence would be located at the service address, the lack of such information does not necessarily defeat probable cause. See United States v. Grant, 218 F.3d 72, 75 (1st Cir.), cert. denied, 531 U.S. 1025 (2000). This is so precisely because an IP address can be assigned to only one service address at any given time — regardless of whose name is on the account.7 See Vosburgh, 602 F.3d at 527 & n.14.
Second, the defendant points out that investigators did not determine whether the Internet connection at the apartment used a wireless router and, if so, whether the wireless network required a password. This left open the possibility that someone other than the subscriber, located at a different physical address, was “joy-riding” on an unsecured wireless network based out of the apartment. See Snow, Accessing the Internet Through the Neighbor‘s
The defendant‘s argument is misdirected. A showing of probable cause to search a place (as opposed to arrest a person) need not identify a specific criminal suspect — although frequently it does. See Zurcher v. Stanford Daily, 436 U.S. 547, 555-557 & n.6 (1978). See also Molina, 476 Mass. at 395-396. Indeed, “[t]he critical element in a reasonable search is not that the owner of the property is suspected of crime but that there is reasonable cause to believe that the specific ‘things’ to be searched for and seized are located on the property to which entry is sought.” Zurcher, supra at 556. In other words, police need only demonstrate a sufficient nexus between the criminal activity under investigation, the items sought, and a place to be searched where the items may reasonably be expected to be located — independent of whether they have identified a specific criminal suspect.8 See McDermott, 448 Mass. at 767-768; O‘Day, 440 Mass. at 302-304. Certainly police may have an easier time demonstrating a sufficient nexus if they can link a specific suspect (e.g., the named Internet account holder) to the criminal activity. However, such a link is not always required.
The search warrant affidavit in this case demonstrated that child pornography was being shared via the Internet from a specific IP address. This IP address, in turn, had been assigned to a specific physical address during the time when the child pornography was being shared. These facts provided a substantial basis from which to conclude that evidence of downloading and sharing child pornography via the Internet would be located at the apartment, even if it turned out that an unauthorized user was “joyriding”
The defendant is correct, from a technological standpoint, that if an Internet subscriber at the apartment set up an unsecured wireless Internet network, a computer outside of this physical address (in a neighboring unit, perhaps) could have used the targeted IP address to access the Internet and share child pornography.10 This point misses the mark, because probable cause
Finally, the defendant argues that, in a case like this, probable cause cannot arise until police show one of three things: (1) that the target IP address has not been linked to a wireless Internet service; (2) that the target IP address is linked to a wireless Internet service, but it is a secure connection requiring a password; or (3) that no one outside the target physical address could be accessing the network. The defendant urges that, without these showings, the likelihood of someone outside the target physical address using the target IP address is substantial enough to defeat probable cause. By and large, these proposals simply restate the defendant‘s arguments urging that the police, in order to show probable cause, should have been required to rule out the possibility that persons outside the apartment may have been “joy-riding” on the IP address assigned to that location at the time in question. To the extent that is the case, we reject these proposals for the reasons already mentioned.
Moreover, as the Commonwealth points out, it is not clear whether it would be technologically feasible for investigators to do what the defendant asks. With respect to the first proposal, there is nothing in the record showing that a third party (like an ISP, for instance) would be able to determine whether a subscriber‘s connection to the Internet is through a hard-wired or wireless connection at any given point in time. With respect to the second, in the case of a subscriber who uses a wireless router, it is not clear how investigators would be able to ascertain whether the network is password-protected without first learning the name of that subscriber‘s wireless network. And regarding the third proposal, even assuming investigators knew that a target IP address was associated with an unprotected wireless network that had
We end with a cautionary note. Our decision today should not be read to mean that probable cause always exists any time investigators link illegal computer activity to an IP address and then link that IP address to a physical address. For one, police should (as they did in this case) connect the IP address with a physical address through a reliable method, such as an administrative subpoena to the ISP, rather than relying solely on a po-
At the very least, certain cases may require police to disclose in a search warrant affidavit the possibility that one of these technologies is, or may be, in play based on facts known or reasonably knowable to investigators at the time. See EFF, Unreliable Informants, supra at 18. If such technologies become more common, it is entirely possible that we would require police to proceed in multiple steps, obtaining subpoenas related to each intermediary IP address or warrants to search each location hosting those IP addresses. Alternatively, some cases may require the police to examine forensically a wireless router to determine which devices were connected to it, and when, before they search particular computers. See Stanley, 753 F.3d at 115-117 (describing police investigation based on information obtained by examining innocent Internet user‘s unprotected wireless Internet router that had been “hijacked” by neighbor-defendant to share child pornography).
Such possibilities demonstrate why the probable cause analysis rarely, if ever, lends itself to bright-line rules. See Escalera, 462 Mass. at 643 (“No bright-line rule can establish whether there is a nexus” between suspected criminal activity and defendant‘s home). This is especially so when, as here, the analysis hinges on fluid and rapidly changing technologies. Cf. Commonwealth v. Dorelas, 473 Mass. 496, 502 & n.11 (2016) (noting that “what might have been an appropriate limitation [on searches] in the physical world becomes a limitation without consequence in the virtual one“); id. at 505 (Lenk, J., dissenting) (transposing protections of art. 14 and Fourth Amendment to digital contexts “is an ongoing and challenging task“); Commonwealth v. Phifer, 463 Mass. 790, 797 (2012) (noting that developments in cellular telephone technology “present novel and important questions about the relationship between the modern doctrine of search
Conclusion. The order denying the motion to suppress and the defendant‘s conviction are affirmed.
So ordered.
Notes
Q.: “Now when you execute a warrant like this . . . are you conducting . . . [the search] for a person or for a device?”
A.: “A device.”
Q.: “Okay. And why is that?”
A.: “Because I have no clue who is behind that device.”