OPINION OF THE COURT
The defendant moves to controvert three search warrants and seeks to suppress “any items seized or statements made pursuant to [their] execution.” The People oppose the motion.
Following the execution of these search warrants at his home and places of business, the defendant was arrested and criminally charged for possessing multiple images of children engaging in sexual conduct. The defendant was originally accused of eight counts of promoting a sexual performance by a child
In moving to controvert, the defendant contends that the application for the search warrants did not provide the court with sufficient probable cause to support the issuance of the warrants. He attributes this deficiency to four factors: that all of the subpoenaed information referred to in the warrant application was not shown to be connected to child pornography; that only one alleged pornographic image was viewed by the affiant; that the omission of accurate information about the ability of others to access an unsecure Internet connection misled the court; and that the information in the warrant application is stale.
The court has considered the papers submitted, the warrant application and the three signed search warrants at issue as well as the two previous search warrants in this case. For the following reasons defendant’s motion is denied.
Background
On February 16, 2015, the New York City Police Department was notified by the National Center for Missing and Exploited Children Cyber Tipline (NCMEC) that a suspected image of child pornography had been uploaded onto an email account, A_@juno.com, provided by Internet service provider (ISP) Juno Online Services. The parent company of Juno, United Online, had reported the upload the day it occurred, December 26, 2014, and that the image came from a particular Internet protocol address (IP address), xx.xxx.xx.49. Police Officer Anthony Santilli, who was assigned to the Computer Crime Squad and who applied for the search warrants at issue here, viewed the image and determined that it fell within the definition of child pornography. He used the American Registry for Internet Numbers to learn that Verizon was the ISP that as
This accumulated information enabled Santilli to obtain a search warrant on March 23, 2015, authorizing a search of all activity relating to the Juno email account (Tomei, J.). According to his affidavit for the instant search warrant, Santilli stated that as a result of this first search warrant, “I am informed by the records of United Online that there were multiple e-mail messages sent and received containing additional Child Pornography.” A subsequent subpoena to Verizon uncovered six additional IP addresses, one assigned to Pink Label and five assigned to defendant at his home address. The Officer affirmed that these six IP addresses
“were used to facilitate the trade of Child Pornography in that the IP Addresses were used to send messages to other individuals with whom the owner of the Juno Account ofA___@juno.com was actively exchanging Child Pornography, in that the content of these messages confirmed and discussed this type of exchange.”
On May 1, 2015, Santilli applied for and was granted a search warrant for a Facebook account that he had learned was linked to the Juno email account (Gary, J.). He explained to the court reviewing his second warrant application that the underlying reason for seeking access to the Facebook account was that Facebook users commonly used it as a platform to transfer images and videos of child pornography. The results of
The search warrant application at issue here involved three distinct locations and resulted in the granting of three separate search warrants on May 15, 2015 (Simpson, J.). Officer Santilli listed defendant’s residence as “subject location 1,” the offices of Pink Label as “subject location 2,” and the “rear office” as “subject location 3.” Both of the previous search warrant applications were incorporated by reference and were available to the court for review. On April 20, 2015, Santilli had visited thе second location, the office of Pink Label, under the guise of a fictional investigation and met with the owner of Pink Label who called her financial manager, “Joe,” from the third location, his office in a distinct but attached “rear office” also at Pink Label’s street address. Santilli was introduced to defendant, who voluntarily led him to his “Management Office” where Santilli observed two laptop computers.
With regard to the first location, Santilli established through public and utility records that this address was the defendant’s residence. The response to two Verizon subpoenas reflected that nine IP addresses were assigned to a customer, Joseph Hayon, at that location. Santilli also learned through his investigation that a business, Homework Helper Institute, LLC, was registered at that location as well. Upon telephoning defendant’s residence he was informed by a female that the Homework Hеlper Institute tutored children individually at their homes.
On May 21, 2015, the three search warrants were executed, leading to the recovery of laptop computers, desktop computers, cellular phones, and assorted devices from both the defendant’s home and from the business locations. The defendant was also arrested on that date and, in statements to the police, he admitted he was the owner of the subject email account and that he used the Facebook account to meet people to facilitate trades of images. The defendant further stated that he was the owner of the computers seized from his apartment and that he used the computers at the subject business premises. He also provided the police with the Juno email and Facebook passwords.
Legal Analysis
A presumption of validity attaches to a search warrant approved by a magistrate who reviews the underlying application
The warrant application submitted to the court on May 15, 2015 was thoroughly detailed and provided ample evidence to conclude that probable cause existed for the issuance of the search warrants. In his affidavit Officer Santilli described his training, experience, and expertise in investigating crimes involving child pornography. He conveyed his knowledge of the dissemination, collection, and storage of such images and materials as well as his understanding of the ability of forensic experts to find deleted or hidden information in the computer’s residual memory. He explained that an IP address acts as a unique identifier assigned to a computer connected to the Internet and that the IP address can change, when it is assigned based on availability at the time of Internet log-on. San-tilli also used his experience to explain certain common propensities among individuals interested in child pornography that further bolstered the expectation that incriminating evidence would be found. Finally, because of the unique nature of child pornоgraphy investigations, he provided an expansive list of property to be seized with sufficient particularity.
Defendant’s first argument, that unnecessary, unconnected information was a distraction for the court, is belied by the
Defendant next claims that Officer Santilli personally viewed only the single image of child pornography received from NCMEC and suggests that a single image is insufficient as a basis for probable cause. He contends that Santilli’s statement referencing the first search warrant and resulting information, that he was “informed by the records of United Online” of “at least ten images” depicting naked girls, means that someone other than Santilli, without his expertise, evaluated the content, thereby lessening the quality of evidence required for a finding of probable cause. The People assert that Santilli’s explanation of what he learned from the first search warrant and subsequent subpoenas “supports the inference” that he personally viewed all the emails and images contained in the email account.
While the meaning of “I am informed” in paragraph 19 of the warrant application is uncertain, it is ultimately irrelevant. For purposes of probable cause, the viewing of the single image of child pornography was just the beginning of the investigation with much more to follow. What is clear from a reading of the complete paragraph is that “I am informed” referred only to the records Officer Santilli received from United Online about the traffic in the Juno account since its inception until the time the subpoena was answered. Santilli went on to explain to the court that he had then obtained the records of additional IP addresses that were used by defendant, the owner of the Juno account, to send messages to others with whom he was “actively exchanging Child Pornography.” Santilli also declarеd that “the content of these messages confirmed and discussed this type of exchange.” This last statement can only
Defendant has thus failed to establish that Officer Santilli’s personal knowledge of the crimes alleged was limited to the viewing of the initial illicit image. Even if he had merely read a report from United Online and had never actually read the specific email messages, he would have learned from the report that the email account associated with defendant was an active site exchanging child pornography. Such information was valuable as a bridge in a trail of evidence reflecting continuing criminal activity and eliminating the possibility that the initial uploading was inadvertent.
Defendant’s claim that the warrant application is deficient because it failed tо explain to the court the “realistic possibility” that someone other than defendant, such as a “neighbor, a visitor or someone outside the premises,” could have used defendant’s unsecured IP address is extremely weak. His argument rests on the idea that because anything is possible, the warrant court must exclude every alternative theory to a certainty, a view that is inconsistent with the meaning of probable cause. In an often-quoted desсription of probable cause, the United States Supreme Court bluntly stated, “[i]n dealing with probable cause, however, as the very name implies, we deal with probabilities” (Brinegar v United States,
“The affidavit need not contain information providing certainty that the objects sought will be found in the search . . . The issue is not whether there were other places to which the articles might have been removed, but rather whether the facts and circumstances taken as whole gave the magistrate probable cause to believe that the desired items would be found in the search” (United States v Brinklow, 560 F2d 1003, 1006 [10th Cir 1977], cert denied434 US 1047 [1978]).
Multiple federal courts have reached the conclusion that illegal Internet activity associated with a particular IP address is a sufficient basis to find a nexus between the unlawful use of the Internet at the IP address and a computer possessed by the subscriber assigned that address.
In United States v Perez (
“did not prove definitively that [the defendant] was the user who had viewed the pornographic images, it was reasonable to assume that the address associated with the IP address was responsible for activity conneсted to that IP address; probable cause thus existed that evidence of criminal activity would be found at that address” (United States v Chamberlin,2010 WL 1904500 , *7,2010 US Dist LEXIS 47664 , *22 [WD NY, May 12, 2010, No. 09-CR-6169CJS]).
Other Circuits agree (see United States v Stults,
Defendant’s final claim is that probable cause was undermined by the staleness of the information in the warrant application. Defendant states, “[w]ithout more verified current activity, any information that the computers in question were being used after the December date becomes stale.” The People respond that the investigation produced additional viable evidence of criminal activity after the initial transmission and that defendant’s focus ignores the continuing nature of the possession of child pornography.
While the Criminal Procedure Law does not impose a limit on the time in which the police must apply for a search warrant (see CPL 690.30), the proof supporting the warrant application “must be of facts so closely related to the time of the issue of the warrant as to justify a finding of probable cause at that time” (People v Padilla,
“[T]he question of staleness necessarily turns upon the nature of the alleged offense and the degree to which it constitutes an ongoing or continuing activity” (People v Manngard,
The nature of an investigation into the transmission and collection of child pornography over thе Internet is distinguished from most other investigations by the subject matter and the nature of the vehicle for the criminal activity. “When a defendant is suspected of possessing child pornography, the staleness determination is unique because it is well known that images of child pornography are likely to be hoarded by persons interested in those materials in the privacy of their homes”
“Crucially, however, the value of that inference in any given case depends on the preliminary finding that the suspect is a person ‘interested in’ images of child pornography. The alleged proclivities of collectors of child pornography . . . are only relevant if therе is probable cause to believe that [a given defendant] is such a collector” {id. [internal quotation marks omitted]).
The Third Circuit was quick to note when considering the compulsion to hoard that “[w]e do not hold, of course, that information concerning child pornography crimes can never grow stale. We observe only that information concerning such crimes has a relatively long shelf life. It has not been, and should not be, quickly deemed stale” (Vosburgh at 529).
The staleness inquiry is also very much colored by the reliance of child pornographers on computers and the Internet. “Images stored on computers can be retained almost indefinitely, and forensic examiners can often uncover evidence of possession or attempted possession long after the crime has been completed” (id.). Moreover, computers and computer equipment are “not the type of evidence that rapidly dissipates or degradеs” (id.). “Therefore, the passage of weeks or months here is less important than it might be in a case involving more fungible or ephemeral evidence” (id.).
In this instance, the information gained as a result of the first search warrant established continuing criminal activity involving the transmission, exchange, and collection of child pornography and showed the court that defendant had not merely accessed illicit images on a single occasion. Because of the trail of evidence contained in the May 15, 2015 warrant application, the court could conclude that defendant “accessed those images because he was interested in child pornography, and thus—as is common among persons interested in child pornography—likely hoarded the images he found” (Raymonda at 115). This finding also reinforced the suspicion that defendant had accessed the initial image willfully and deliberately. The court could therefore conclude that there was sufficient evidence to establish probable cause that defendant was an
Accordingly, defendant’s motion to controvert the three search warrants in this case is denied in its entirety. The court finds no basis to suppress either the evidence recovered pursuant to their execution or the statements as the fruit of the contested warrants. The admissibility of the defendant’s statements will be the subject of a Huntley hearing.