Case Information
*1 142
Argued and submitted October 30, 2019, pretrial order reversed and remanded March 18, 2020
STATE OF OREGON, Plaintiff-Appellant, v.
SCOTT MICHAEL McNUTT II, Defendant-Respondent.
Washington County Circuit Court
17CR52858; A167963
Pretrial order reversed and remanded.
Andrew Erwin, Judge.
Christopher A. Perdue, Assistant Attorney General, argued the cause for appellant. Also on the briefs were Ellen F. Rosenblum, Attorney General, and Benjamin Gutman, Solicitor General.
Adam L. Dean argued the cause and filed the brief for respondent.
Before DeHoog, Presiding Judge, and Mooney, Judge, and Kistler, Senior Judge.
KISTLER, S. J.
Pretrial order reversed and remanded. KISTLER, S. J.
The state appeals from a pretrial order granting defendant’s motion to suppress evidence obtained pursuant to a search warrant. The trial court ruled that the affidavit filed in support of the warrant did not establish probable *2 cause that the files on defendant’s computer contained child pornography. We reverse the trial court’s order.
We take the facts from the affidavit filed in sup port of the warrant. BitTorrent is a peer-to-peer (P2P) file- sharing network that allows persons to share pictures and videos over the internet. “P2P file sharing networks, includ ing the BitTorrent network, are frequently used to trade digital files of child pornography.” A BitTorrent user will begin the process of sharing files by creating a “torrent.” The torrent does not contain the file being shared; rather, it typically contains a name or description of the file and identifies computers in the BitTorrent network where the file may be found.
A person looking for a particular subject on the BitTorrent network can conduct a keyword search to find torrents that describe files of potential interest. The affiant explained:
“For example, a person interested in obtaining child pornographic images on the BitTorrent network would open the BitTorrent client application on his/her computer and conduct a keyword search for files using a term such as ‘preteen sex.’ * * * The results of the torrent search are typ- ically returned to the user’s computer by displaying them on the torrent hosting website. The hosting website will typically display information about the torrent, which can include the name of the torrent file, the name of the file(s) referenced in the torrent file, the file(s) size, and the ‘info- hash’ SHA-1 value of the torrent file. The user then selects a torrent of interest to download to their computer.” are sharing the file described in the torrent. The BitTorrent program permits users to download the entire file from a single computer or constituent parts of a file from multiple computers, and it uses a unique “info-hash” or “SHA-1” value for each file to ensure that the constituent parts form a single file. A torrent ordinarily uses “trackers” to identify peers on the network who In this case, two Oregon detectives were investi- gating the BitTorrent network to identify persons sharing child pornography in Oregon. One detective focused on a particular computer located in Oregon “because it was asso- ciated with a torrent” that referred to “a file of investigative interest to child pornography investigations.” Based on the information contained in the torrent, the detective “directly connected” to the computer and downloaded the following file from that computer: “Cp 9Yo Dad Cum Face Dee And Desi Zadoom Pedo Cumshot 9.mpg.”
Two days later, the detective investigated another torrent that “was identified as being a file of investigative interest to child pornography investigations.” That torrent was associated with the same computer, and the detective downloaded the following file from that computer: “11yo - girl - Preteen girl just wants to Fuck & Suck (Sound).avi.” At approximately the same time, the other detective learned that the computer from which those two files were down loaded was located in defendant’s home in Washington County. During a 30-day period, the detectives downloaded approximately 300 files from a computer in defendant’s *3 home. [3]
The detectives transferred all the downloaded files to Detective Kiurski in the Washington County Sheriff’s Office. Kiurski has substantial training and experience in investigating child sex crimes. [4] He “briefly looked at some of th[e] files [downloaded from the computer in defendant’s home] and verified that there were over 300 files downloaded between 1/2/17 and 2/3/17 from the [computer in defendant’s home] to [the detectives’ computer] and that those files did contain child pornography.”
home. They knew only its unique internet protocol address. Later, the detectives learned that the computer’s internet protocol address had been assigned to a computer in defendant’s home. [2] Neither detective knew initially that the computer was in defendant’s 2017. They downloaded more than 300 files from defendant’s computer between January 2 and February 3, 2017. [3] The detectives downloaded the two named files on January 6 and January 8, tion of sex crimes and child abuse when he investigated this case. Additionally, for approximately the last five years, he had devoted all his time as a detective to investigating crimes against children. Kiurski had received over 400 hours of training relating to the investiga- Based on that and other information, Kiurski con- cluded that he had
“probable cause to believe that one or more of the occupants residing at [defendant’s home between August 2016 and January 25, 2017] used a computer(s), cell phone(s), tablet(s) or mobile electronic device, that more likely than not is located [at defendant’s home] to engage in Encouraging Child Sexual Abuse in the First Degree in violation of ORS 163.684 and Encouraging Child Sexual Abuse in the Second Degree in violation of ORS 163.686.” Kiurski requested a warrant authorizing the seizure and search of computers and related electronic devices for evi- dence of the crimes of first- and second-degree encouraging child sexual abuse. See ORS 163.684 (defining first-degree encouraging child sexual abuse); ORS 163.686 (defining second-degree encouraging child sexual abuse). Having con cluded that there was probable cause to seize and search those devices, the magistrate issued the warrant.
Defendant moved to suppress the evidence discov- ered as a result of executing the warrant. His argument in support of the motion was narrow. He did not challenge any of the facts recited in the affidavit, nor did he dispute that the affidavit established probable cause that all the down loaded files (the two named files and the approximately 300 unnamed files) would be found on a computer in his home and related electronic devices. He did not contend that the warrant was overbroad, nor did he argue that the officers exceeded the scope of the warrant in executing it. Rather, his argument focused on one issue: He argued that the war- rant failed to establish probable cause that any file on his computer contained child pornography.
On that issue, defendant began from the prem- ise that Kiurski’s affidavit reduced to a conclusory asser tion that some of the files downloaded from a computer in *4 defendant’s home contained “child pornography.” Defendant contended that, to establish probable cause, the affidavit search when they downloaded files that were publicly available on the BitTorrent network; that is, he does not argue that the state unconstitutionally obtained the evidence on which it based its probable cause argument. Defendant also does not argue that the officers engaged in an impermissible needed either to attach copies of the downloaded files to the affidavit, describe specifically the contents of the down loaded files, or include more inculpatory circumstances than Kiurski’s affidavit had. Defendant reasoned that a conclusory assertion that the files contained child pornog raphy did not provide a sufficient basis for the magistrate to make an independent determination that the files, in fact, depicted children engaged in sexual conduct. The state responded that not only did the affidavit establish that a detective who was experienced in investigating child sex crimes had viewed the files and determined that they con tained child pornography, but the attendant circumstances set out in the affidavit corroborated Kiurski’s determina tion. It followed, the state argued, that the magistrate rea- sonably concluded that the affidavit established probable cause.
After carefully considering the parties’ arguments, the trial court ruled in defendant’s favor. It accordingly granted his motion to suppress and entered a pretrial order suppressing the evidence discovered as a result of the war- rant. The state appeals from that order.
On appeal, the parties reiterate the positions they
asserted below. Additionally, defendant argues that the trial
court’s ruling may be affirmed on an alternative ground. He
argues for the first time on appeal that, even if the affidavit
was sufficient to establish probable cause, the warrant did
not comply with
State v. Mansor
,
I. PROBABLE CAUSE
A. Article I, section 9
As noted above, defendant does not controvert or
otherwise challenge any of the facts set out in the affidavit.
We accordingly accept those facts as true, as well as any
inferences that the magistrate reasonably could have drawn
from them.
See State v. Webber
,
In answering that question, we use the phrase
“child pornography” in this opinion as a shorthand way of
describing the material that ORS 163.684 and ORS 163.686
prohibit—namely, visual recordings of sexually explicit
conduct involving a child. Additionally, in determining
whether Kiurski’s affidavit established probable cause that
the files on defendant’s computer contained child pornogra phy, we are mindful that “[t]he standard is one of probabil-
ity, not certainty,” and that “the facts articulated in support
of probable cause must be assessed in a commonsense and
realistic fashion.”
State v. Foster
,
With those considerations in mind, we turn to three
sets of facts set out in the affidavit that, we conclude, collec tively establish probable cause that the files on a computer
in defendant’s home contained child pornography: (1) the two named files that were downloaded from a computer in
defendant’s home; (2) an experienced detective’s assessment
after viewing some of the 300 files downloaded from the
same computer that those files contained child pornogra phy; and (3) defendant’s use of a network that is commonly
employed to share child pornography over the internet.
or simulated sexual intercourse, oral-genital contact, anal-genital contact, and
“[l]ewd exhibition of sexual or other intimate parts.” ORS 163.665(3).
The phrase “sexually explicit conduct” means, among other things, actual
We focus initially on the two named files down loaded from the computer in defendant’s home. One file was
titled, “Cp 9Yo Dad Cum Face Dee And Desi Zadoom Pedo
Cumshot 9.mpg.” The magistrate reasonably could have
inferred that “Cp” was an abbreviation for child pornogra-
phy.
See Bray
,
The title of the second file is equally telling: “11yo - girl - Preteen girl just wants to Fuck & Suck (Sound). avi.” That title leaves little doubt as to the age of the child (preteen), her gender, or the sexual activities depicted. The titles of those two files permitted the magistrate reasonably to infer that both files contained, as the title for one of those files explicitly stated, “Cp” or child pornography.
Defendant, however, discounts the significance of those two file names. He argues that the affidavit stated only that those two files were “of ‘investigative interest to child pornography investigations.’ It did not allege that [the] files were ‘child pornography.’ ” In our view, defendant misperceives what the affidavit said. The part of the affi davit that defendant quotes describes why the detectives focused on the torrents that led them to download the two named files. It does not purport to preclude the magistrate from considering the names of those two downloaded files in determining whether they contained child pornography. See Foster , 350 Or at 169 (reminding courts to consider reasonably could have inferred that the file names set out in the affidavit were taken from the two files downloaded from defendant’s computer rather than from the description of those files in the torrents. Not only is that a permissible read ing of the affidavit, but it is the more reasonable reading based on the sentence structure. Although the affidavit is not completely clear on this point, the magistrate 149 the “totality of the circumstances” in assessing probable cause).
We need not decide whether the magistrate could
have relied solely on the names of the two files downloaded
from a computer in defendant’s home in finding probable
cause that those files contained child pornography.
See
United States v. Miknevich
,
Defendant argues that an assertion that an image
or video is “child pornography” is a subjective determination
that is entitled to little or no weight in determining prob-
*7
able cause. As noted above, however, the magistrate rea-
sonably could have inferred that Kiurski determined that
the files he viewed contained child pornography in violation
essarily establish that the files depicted “sexually explicit conduct” with a child.
For example, he argued that the second file could have merely portrayed an
11-year-old girl who was excited about engaging in the named activities and that
it did not necessarily follow from the file name that the file actually depicted her
engaging in those activities. Suffice it to say that the affidavit should be read in
“a commonsense and realistic fashion” and that “probability, not certainty,” is the
standard for probable cause.
See Foster
,
To be sure, other cases may turn on more subjective prohibitions and thus require more explicit descriptions of the images to establish probable cause that those images are pornographic. For example, in United States v. Brunette , 256 F3d 14 (1st Cir 2001), the court considered whether there was probable cause that an image constituted a “las- civious exhibition of [a child’s] genitals” in violation of a fed- eral statute. Id. at 17-18. The court explained that it had adopted a six-factor test to determine when a picture would be considered a “lascivious exhibition” and that an affida vit that merely parroted the statutory prohibition was not sufficient to establish probable cause that the picture was pornographic. [11] See id. at 17-19.
marily lists conduct that can be assessed objectively (sexual intercourse, oral-
genital conduct, masturbation, and the like), one listed act—“[l]ewd exhibition
of sexual or other intimate parts”—may entail a more subjective assessment. In
this case, Kiurski did not rely explicitly on “[l]ewd exhibition” in concluding that
the files he viewed constituted child pornography in violation of ORS 163.684
and ORS 163.686. And the titles of the two files set out in the affidavit permitted
the magistrate to infer that the files Kiurski viewed were not limited to “[l]ewd
exhibition” but included other sexually explicit conduct listed in ORS 163.665(3),
that can be assessed objectively.
Although the definition of sexually explicit conduct in ORS 163.665(3) pri
c.
*8
sexual response in the viewer. the image suggests sexual coyness, and whether the image is designed to elicit a
propriate attire, whether the child is clothed, partially clothed, or nude, whether
is sexually suggestive, whether the child is depicted in an unnatural pose or inap-
child’s genitals or pubic area is the focal point of the image, whether the setting
to distinguish putti from pornography, the First Circuit considers whether a
1500). Presumably,
,
We note one final consideration. The magistrate rea sonably could have inferred that, during a one-month period,
defendant shared over 300 files on a P2P network that is
“frequently used to trade digital files of child pornography.”
In
State v. Martin
, 327 Or 17, 22, 956 P2d 956 (1998), the
Supreme Court explained that a defendant’s repeated pres-
ence at a location known for continuous drug sales gave an
officer probable cause that the defendant’s late night, hand-
to-hand transaction constituted distribution of a controlled
substance. As we later made clear, however, the context in
which that act occurs will shed light on its meaning.
See
State v. Jacobs
,
We do not place undue weight on defendant’s use of
the BitTorrent network. Rather, it is simply another piece
of the puzzle that, considered in conjunction with the two
named files downloaded from a computer in defendant’s
home and Kiurski’s assessment that the downloaded files he
viewed contained child pornography, established probable
*9
cause that officers would find child pornography in violation
of ORS 163.684 and ORS 163.686 on a computer in defen-
dant’s home. Indeed, this affidavit contains more evidence
that the files in defendant’s home contained child pornog raphy than the affidavit that we found sufficient in
State v.
Tropeano
,
B. Fourth Amendment
Defendant argues that, even if Kiurski’s affidavit
was sufficient to establish probable cause under Article I,
section 9, the Fourth Amendment requires more than a
“bare conclusio[n]” that the files he viewed were child por nography.
See United States v. Leon,
In similar circumstances, the federal circuits have
held that comparable affidavits established probable cause
that suspect material was child pornography.
See United
States v. Haymond
, 672 F3d 948, 950, 959 (10th Cir),
cert
den
,
To be sure, the Third Circuit distinguished
Miknevich
when the affidavit stated that two coworkers had
reported seeing the defendant “viewing child pornography”
at work, unlike this case where the magistrate reasonably
could have inferred that an experienced officer determined
*10
that the files he viewed depicted sexually explicit conduct
involving a child.
United States v. Pavulak
,
The decisions in
Miknevich
and
Haymond
persuade
us that the magistrate in this case complied with the Fourth
Amendment when she found that the affidavit established
probable cause that a computer in defendant’s home con-
tained child pornography in violation of ORS 163.684 and
ORS 163.686. We also find the decisions in
Brunette
,
Doyle
,
and
Pavulak
distinguishable. Even if those federal decisions
Miknevich
probable cause than the detective’s unexplained statement in based on his personal knowledge and thus provided greater support for finding
statement that the downloaded files he viewed contained child pornography was
explain what he meant by the phrase “child pornography.” In this case, Kiurski’s
at 182-83, nor did he
regard-
id.
hash value.
II. PARTICULARITY
Defendant argues, for the first time on appeal, that
the warrant was not sufficiently particular. Relying on the
Oregon Supreme Court’s decision in
Mansor
, he argues
that we can affirm the trial court’s ruling on an alterna tive ground.
See Outdoor Media Dimensions Inc. v. State of
Oregon
,
“Here, the search warrant failed to comply with the requirements set forth in Mansor * * * [because] it did not describe with particularity ‘what’ law enforcement sought to find and the temporal limitations on such search. The *11 warrant also did not impose limits on the use of informa- tion disclosed in the examination; or limit the search to the information identified in the warrant.” Although defendant asserts that the warrant was deficient in those respects, his brief never explains why that is so, and we conclude that the grounds he identifies are either not well taken or do not provide a basis under Outdoor Media Dimensions Inc. , for upholding the trial court’s order.
Defendant notes initially that the warrant did not
establish “what” law enforcement sought to find. However,
the warrant and the affidavit, whether viewed individually
or collectively, made clear “what” the warrant authorized
officers to look for—evidence of visual recordings of sexu -
ally explicit conduct involving children.
See Mansor
, 363 Or
at 216 (explaining that “a warrant must describe, with as
much specificity as is reasonably possible under the circum -
stances,
what
investigating officers believe will be found on
the electronic devices” and that “the ‘what’ is a description
of the
information
related to the alleged criminal conduct
which there is probable cause to believe will be found on
the computer”) (emphases in original). In that respect, this
case finds support in
State v. Savath
,
Defendant also argues that the warrant lacked a
temporal limit. The state responds that the affidavit iden tified that the investigation began in August 2016 and con tinued through January 2017. It contends that a reasonable
period encompassing those dates provides a sufficient tem poral limitation on the scope of the search. The parties, how-
ever, did not argue below and the trial court did not find
whether the affidavit could be considered in determining the
scope of the search that the warrant permitted.
See Mansor
,
Finally, in asserting that the warrant failed to
impose a limit on the use of information that officers dis covered during the course of executing the warrant, defen-
dant appears either to misperceive what
Mansor
said or
to rely on information that is not part of the record before
us.
Mansor
explained that police officers may come across
information in searching a computer that falls outside the
permissible scope of the warranted search.
In this case, the record developed in the trial court does not disclose what information the state uncovered in executing the warrant. It follows that the record does not disclose whether the state discovered evidence that fell out- side the scope of the warrant, nor does it disclose whether, if the state did discover such evidence, the evidence came within an exception to the warrant requirement. Finally, the record does not disclose whether the state has sought to use such evidence, if it exists. Not only is the use issue that defendant raises premature, but the record is not sufficiently developed for us to consider the final ground for alternative affirmance that defendant identifies. See Outdoor Media Dimensions Inc. , 331 Or at 659-60 (alternative grounds for affirmance not available if the record is not sufficiently developed).
We conclude that the first alternative ground for affirming the trial court’s pretrial order that defendant has identified is not well taken and that the other two alterna tive grounds are not properly before us. We express no opin- ion on any challenges that defendant may properly raise to the warrant when this case is back before the trial court. It is sufficient to resolve this appeal to hold that the affidavit established probable cause that evidence of visual record- ings of sexually explicit conduct involving children would be found on a computer in defendant’s home and that defendant has not identified a viable alternative ground for upholding the trial court’s pretrial order on appeal.
Pretrial order reversed and remanded.