Case Information
IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF GEORGIA ATLANTA DIVISION
UNITED STATES OF AMERICA
v. CRIMINAL ACTION NO.
JOHN HAGEN ALLEN, 1:24-cr-00394-LMM-CMS
Defendant.
FINAL REPORT & RECOMMENDATION
This case is before the Court on Defendant John Hagen Allen’s motion to suppress evidence seized pursuant to three search warrants. [Doc. 21]. For the reasons discussed below, I will recommend that this motion be denied.
I. BACKGROUND
On August 26, 2021, FBI Special Agent Megan Perry submitted warrant packages for three search warrants related to the FBI’s investigation of Allen in connection with possession and distribution of child sexual abuse material. The requested warrants were for Allen’s home at 13500 Lexington Plantation Lane, Milton, Georgia (“the Milton Residence”); for his black 2016 Lincoln Navigator (“the Vehicle”); and for Allen himself. [Doc. 23-1, 23-2, 23-3]. [1] Special Agent Perry executed a single affidavit in support of all three warrants. [Doc. 23-1, Aff. of Megan Perry (“Perry Aff”) at 3–24]. She swore out her affidavit on August 26, 2021, before United States Magistrate Judge Russell G. Vineyard, who then signed the three warrants. [ at 32–40].
The warrants identified the things that the officers were allowed to seize, including, but not limited to, images or visual depictions of minors engaged in sexually explicit conduct, records containing child erotica, and files pertaining to child pornography or other activities involving the sexual exploitation of children. [Doc. 23-1 at 35–38]. The warrants authorized law enforcement officers to search for computers, electronic devices, and storage media that may be used in connection with the distribution or possession of child pornography or otherwise used to violate 18 U.S.C. Section 2252. [ at 35]. And the warrants explicitly authorized “[t]he search of such equipment” for particular items pertaining to the possession, receipt, and distribution of child pornography. [ Id. at 35–36, 38].
More than three years later, on December 11, 2024, a federal grand jury returned a three-count indictment against Allen. [Doc. 1, Indictment]. The indictment charged Allen with the following crimes: distribution of child sexual abuse material on August 13, 2019 (Count One); receipt of child sexual abuse material between October 13 and October 21, 2020 (Count Two); and possession of child sexual abuse material on August 27, 2021 (Count Three). [ at 1–2]. In his motion to suppress, Allen argues that the warrants were not supported by probable cause and that the information provided to Judge Vineyard was impermissibly stale. [Doc. 21 at 1, 8–14].
II. FACTS INCLUDED IN THE AFFIDAVIT
In her affidavit, Special Agent Perry provided information about her background [Perry Aff. ¶ 2], the sources of information [ id. ¶ 3], general information about child pornography and people who make it [ id. ¶ 4], the types of electronic information that she was requesting permission to search [ id. ¶¶ 5–17], and background information on how people use computers to view, create, store, and share child pornography [ id. ¶¶ 18–24]. She also included information about the social network platform MeWe [ id. ¶ 25], as well as the current investigation [ id. ¶¶ 26–49]. Below is a summary of the facts that Special Agent Perry included to establish probable cause.
On October 22, 2019, the social network platform MeWe [2] submitted a CyberTip to the National Center for Missing and Exploited Children (“NCMEC”). [Perry Aff. ¶ 26]. In the tip, MeWe reported that on August 13, 2019, the MeWe account “sharing is caring” uploaded seven images of suspected child pornography. [ Id. ]. As part of the tip, MeWe provided 110 Internet Protocol (“IP”) addresses for the “sharing is caring” account for the previous month (September 23 to October 22, 2019). [ Id . ¶ 27]. Five of the IP addresses were owned by AT&T and the rest were owned by T-Mobile. [ Id. ].
NCMEC determined that one of the downloaded images was found in its own “known images” database and had previously been classified as “apparent child pornography.” [Perry Aff. ¶ 26]. In her affidavit, Special Agent Perry provided descriptions of three of the other images, each of which involved minor females with exposed genitalia. [ ].
On December 13, 2019, the Georgia Bureau of Investigation served a subpoena on AT&T for subscriber records for one of the IP addresses that MeWe had provided (99.42.39.8). [Perry Aff. ¶ 30]. The AT&T response showed that the IP address was tied to a person named Stephanie Allen, with the service address of 12285 Broadwell in Alpharetta, Georgia. [ Id. ]. At some point later in the investigation, a law enforcement database search revealed that the defendant, John Allen, had previously lived at the Broadwell address, along with his wife, Stephanie Allen; as of August 2021, however, the couple resided in Milton, Georgia, at the Milton Residence. [ Id. ¶ 31].
On or about March 5, 2021, the above information regarding the tip was provided to the FBI. [Perry Aff. ¶ 32]. On March 9, 2021, the FBI served an administrative subpoena to AT&T for another one of the IP addresses that MeWe had provided (12.155.200.114). [ Id. ¶ 34]. The response showed that the IP address was tied to a business—CSA America Inc.—with the service address of 6215 Shiloh CRSG, in Alpharetta, Georgia. [ Id. ]. A Georgia Department of Labor records search for the defendant, John Allen, returned employment at a business with a similar name, i.e., CSA America Testing Cert LLC. [ ¶ 36]. Special Agent Perry did not include an address for CSA America Testing Cert LLC in her affidavit. [ ].
On April 20, 2021, the FBI served an administrative subpoena to MeWe for subscriber records for the account “sharing is caring.” [Perry Aff. ¶ 28]. The subpoena response revealed that the account was registered on May 22, 2019, and that the last log-in date was October 22, 2019. [ Id. ]. Special Agent Perry later contacted a MeWe representative who advised that MeWe closed the account on October 22, 2019, the same day it made the tip. [ ¶ 29].
Further investigation revealed that between August 13 through October 22, 2019, defendant John Allen’s telephone carrier was T-Mobile and that his current carrier is AT&T. [Perry Aff. ¶ 39].
The affidavit states that “[o]n August 25, 2021, agents conducted surveillance at the location of CSA America Inc. at 6215 Shiloh Crossing, Alpharetta, Georgia 30005.” [Perry Aff. ¶ 45]. During the surveillance, agents observed the Vehicle— defendant John Allen’s 2016 Lincoln Navigator—parked in the parking lot of that business. [ ].
Special Agent Perry stated that based on her review of the IP addresses provided by MeWe, the subpoena returns, and her training and experience, she believed that the user of the MeWe account “sharing is caring” was accessing the account from various locations, including the user’s residence and place of employment. [Perry Aff. ¶ 37]. According to the affidavit, the most frequently utilized IP addresses were T-Mobile mobile IP addresses that could have been used from anywhere the device had an internet connection through its service provider, which suggested that the user may have accessed the accounts from locations other than the user’s residence and workplace. [ ]. Special Agent Perry stated further that based on the information set forth above, as well as her training and experience in working on child pornography cases, she believed that the defendant, John Allen, was the user of the MeWe account “sharing is caring.” [ ¶ 49].
Special Agent Perry went on to state that law enforcement database searches for John Allen, as well as recent FBI surveillance, show that Allen currently resides at the Milton Residence and typically drives the Vehicle. [Perry Aff. ¶¶ 31, 38, 43, 44, 45, 46, 48, 49].
III. DISCUSSION
The Fourth Amendment provides that “no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.” U.S. C ONST . amend. IV.
In reviewing a challenge to probable cause, “the task of a reviewing court is not to conduct a de novo determination of probable cause, but only to determine whether there is substantial evidence in the record supporting the magistrate judge’s decision to issue the warrant.” United States v. Bushay , 859 F. Supp. 2d 1335, 1379 (N.D. Ga. 2012) (citing Massachusetts v. Upton , 466 U.S. 727, 728 (1984)). Probable cause to support a search warrant exists when the “totality of the circumstances allow[s] a conclusion that there is a fair probability of finding contraband or evidence at a particular location.” United States v. Brundidge , 170 F.3d 1350, 1352 (11th Cir. 1999). The search warrant affidavit must “state facts sufficient to justify a conclusion that evidence or contraband will probably be found at the premises to be searched.” United States v. Martin , 297 F.3d 1308, 1314 (11th Cir. 2002) (citation omitted).
In deciding whether to sign a warrant, judges are to employ a practical, commonsense approach to the probable cause analysis and should avoid hyper- technical review of the legitimacy of search warrants:
In attempting to ensure that search warrant affidavits comply with the Fourth Amendment’s prohibition against unreasonable searches and seizures resultant from warrants issued without probable cause, the issuing magistrate is simply to make a practical, commonsense decision whether, given all the circumstances set forth in the affidavit. . ., there is a fair probability that contraband or evidence of a crime will be found in a particular place. [P]robable cause deals with probabilities. These are not technical; they are the factual and practical considerations of everyday life on which reasonable and prudent men, not legal technicians, act. Courts reviewing the legitimacy of search warrants should not interpret supporting affidavits in a hypertechnical manner; rather, a realistic and commonsense approach should be employed so as to encourage recourse to the warrant process and to promote the high level of deference traditionally given to magistrates in their probable cause determinations.
United States v. Miller , 24 F.3d 1357, 1361 (11th Cir. 1994) (alterations in original) (internal quotation marks and citations omitted). And in reviewing a previously issued warrant in the context of a motion to suppress, the reviewing courts must accord “great deference” to judicial determinations of probable cause to issue a search warrant. United States v. Leon , 468 U.S. 897, 914 (1984); Martin , 297 F.3d at 1317.
Here, Allen asserts that the three warrants are not supported by probable cause because the information was “amazingly stale,” and “nothing in the affidavit connected John Allen to the MeWe account ‘sharing is caring.’” [Doc. 21 at 8–9]. He points out that the IP logs provided in connection with the tip were for the period of September 23 to October 22, 2019, which was approximately six weeks after August 13, 2019, the date of the offending upload. [ Id. at 9]. He complains that he has not been tied to CSA America Inc. or its service address of 6215 Shiloh CRSG, in Alpharetta, Georgia because the affidavit alleges that he worked for a different entity—CSA America Testing Cert, LLC—with no address provided. [ Id. at 9–10]. He complains that the affidavit does not include any facts about when he might have worked at CSA America Testing Cert, LLC, how many people might have worked there, and any relationship between CSA America Testing Cert, LLC, and CSA America Inc. [ at 10–11]. Finally, he argues that the Government should not reap the benefit of the good faith exception to the exclusionary rule because the information in the affidavit was impermissibly stale. [ at 12–14]. Allen does not argue that the warrants were overbroad or that they were not sufficiently particularized. See generally [Doc. 21].
In making these arguments, Allen glosses over important facts in the affidavit that tie him to the “sharing is caring” account and establish probable cause to believe that he was the person using that account and that evidence of the enumerated crimes would be found at the Milton Residence, in the Vehicle, and on his person.
First, the facts stated in Special Agent Perry’s affidavit establish that during the relevant time period, Allen and his wife lived at an address tied to one of the IP addresses provided in the tip. The 99.42.39.8 IP address was tied to a person named Stephanie Allen and to a home where the defendant, John Allen, had lived with his wife, Stephanie Allen. [Perry Aff. ¶¶ 30–31]. Although the affidavit does not provide the precise dates when the couple resided at the Broadwell address in Alpharetta, information in the law enforcement database indicated that they lived there prior to May 2021, which would include the August 2019 timeframe when the offending download occurred. [ Id . ¶ 31]. Special Agent Perry also averred that individuals who are interested in viewing child sexual abuse material tend to be collectors who store their collection on media and in formats that are easily moved between locations, and the collections are mostly stored in locations where individuals have continual access to the materials. [ Id. ¶ 4]. Additionally, collectors tend to keep their collections close to them. [ Id. ]. It is therefore reasonable to believe that a collector of such material who stores it in their home and changes residences would take that material with them to the new residence. [ Id. ]. These facts show that even though the “sharing is caring” account was accessed from the Broadwell address two years before the warrants were issued, it is reasonable to believe (1) that there was child sexual abuse material at the Broadwell address when the Allens resided there in 2019 and (2) that the owner of the material present at the Broadwell address moved that material to the Milton Residence during the same time frame when the Allens relocated from the Broadwell address to the Milton Residence. [ ].
Second, the facts show that Allen worked at a location tied to one of the IP addresses provided in the tip. As noted above, the 12.155.200.114 IP address was connected with a business address of 6215 Shiloh CRSG, in Alpharetta, Georgia. [Perry Aff. ¶ 34]. FBI surveillance in 2021 revealed that the Vehicle, Allen’s black 2016 Lincoln Navigator, was observed during work hours at that location. [ ¶ 45]. While the affidavit does not include facts showing where Allen worked at the time of the offending download, the issuing judge could reasonably have deduced that, because Allen worked at a CSA America company at 6215 Shiloh CRSG, in Alpharetta, Georgia, during the time period when the “sharing is caring” account was accessed from that location, Allen therefore used his work IP address to access the “sharing is caring” account. Illinois v. Gates , 462 U.S. 213, 238 (1983). [3]
Finally, Special Agent Perry’s affidavit contained facts showing that in 2019, Allen used a T-Mobile cell phone and that several of the IP addresses that accessed the “sharing is caring” account during the relevant time frame were owned by T- Mobile. [Perry Aff. ¶¶ 27, 37, 39].
In my view, the facts described in the affidavit that connected defendant John Allen to multiple IP addresses where the “sharing is caring” account was accessed established probable cause to believe that (1) Allen was the person who used the “sharing is caring” account during the time period in which the account uploaded child sexual abuse material and (2) evidence related to the violations of 18 U.S.C. § 2252 would be found at the Milton Residence, in the Vehicle, and on Allen’s person. Brundidge , 170 F.3d at 1352.
Both parties provide arguments regarding the good faith exception to the exclusionary rule articulated by the Supreme Court in United States v. Leon , 468 U.S. 897, 922 (1984). [Doc. 21 at 12–13; Doc. 23 at 15–18; Doc. 24 at 7]. In Leon , the Supreme Court held that even if a search warrant is ultimately found to be unsupported by probable cause, the Fourth Amendment will not bar admission of evidence obtained by law enforcement officers if the officers were acting in reasonable reliance upon the search warrant. See Martin , 297 F.3d at 1313 (citing Leon , 468 U.S. at 922). Because I conclude that the warrants were properly supported by probable cause, I have not analyzed these arguments.
IV. CONCLUSION
For the reasons stated, I RECOMMEND that Allen’s motion to suppress [Doc. 21] be DENIED . There are no other pending matters before me in this case. Accordingly, the case is hereby CERTIFIED ready for trial.
This 22nd day of May, 2025.
CATHERINE M. SALINAS United States Magistrate Judge
[1] The Government attached the three warrant packages to its response brief. [Doc. 23-1 (vehicle); Doc. 23-2 (residence); Doc. 23-3 (person)]. The affidavits and the list of items to be seized and searched for are the same for each warrant. For ease of reading, I will cite to only the warrant located at Docket Entry 23-1.
[2] MeWe allows users to communicate with other MeWe users they know both individually and in groups, as well as to locate and communicate with unknown individuals with whom they share common interests. [Perry Aff. ¶ 25]. MeWe users can send photographs, videos, text communications, and use video or voice calling within the program. MeWe uses message encryption for privacy for its users. [ ].
[3] In his motion and in his reply brief, Allen tries to draw a distinction between CSA America Inc. (the party listed on the subpoena response as being associated with the “sharing is caring” account) and CSA America Testing Cert, LLC (the company where Special Agent Perry alleges Allen worked). [Doc. 21 at 9–10; Doc. 24 at 3–6]. The issuing judge is permitted to deduce that a person who works for Company A might access an IP address of a related Company B, where, as here, there are notable similarities in the two companies’ names. And such a deduction is even more appropriate under the facts presented in this case, where Allen’s vehicle was observed in the parking lot associated with the company whose IP address was previously used to download child sexual abuse material. [Perry Aff. ¶¶ 34, 45].