Opinion
No. CR-15-00894-JGZ (LCK)
09-28-2016
United States of America, Plaintiff, v. Bryan Rusnak, Defendant.
REPORT AND RECOMMENDATION
Pending before the Court is Defendant's Motion to Suppress (Doc. 39). Defendant argues that all evidence seized from his house should be suppressed because the facts supporting the search warrant lacked probable cause and were stale. The government filed its response on July 21, 2016 (Doc. 49), and Defendant replied on July 28, 2016 (Doc. 50). This matter came before the Court for a hearing and a report and recommendation as a result of a referral, pursuant to LRCrim 57.6. Evidence and argument were heard on September 14, 2016. (Docs. 54, 55.) Having now considered the matter, the Magistrate Judge recommends that the District Court, after its independent review, deny Defendant's motion to suppress.
I. FACTUAL BACKGROUND
Defendant Bryan Rusnak was indicted on May 13, 2015, with one count of distribution of child pornography in violation of 18 U.S.C. Section 2252(a)(2) and (b)(1) and two counts of knowing access with intent to view child pornography in violation of 18 U.S.C. Section 2252A(a)(5)(B) and (b)(2). (Doc. 1.) A superseding indictment was filed on July 13, 2016, adding a count of possession of child pornography in violation of 18 U.S.C. Section 2252A(a)(5)(B) and (b)(2). (Doc. 46.) Trial is currently scheduled for October 25, 2016. (Doc. 51.)
On October 1, 2014, Magistrate Judge Bruce Macdonald found probable cause for agents to search a residence located at 13258 E. Mineta Ridge Drive in Vail, Arizona (later determined to be Defendant Rusnak's residence) for evidence of possession and distribution of child pornography including any computers on the premises. (Exs. 1, 2.) All information necessary to show probable cause for the issuance of a search warrant must be contained within "the four corners" of the written affidavit. United States v. Gourde, 440 F.3d 1065, 1067 (9th Cir. 2006) (en banc) (citing United States v. Anderson, 453 F.2d 174, 175 (9th Cir. 1971)). In the instant case, the affidavit in support of search warrant provided information that FBI Special Agent (SA) Jimmie John Daniels, as part of his investigation, initiated the use of software designed to search a specific peer to peer (P2P) network for Internet Protocol (IP) addresses sharing files depicting child pornography. (Ex. 2 at 17.) The software compares hash values of files possessed by other P2P users with hash values of suspected child pornography files previously identified by law enforcement officers through other investigations. (Id.) When a hash value match indicating suspected child pornography is found, the software notes the IP address of the computer possessing the files and attempts to download suspected child pornography files. (Id.) The software establishes a direct connection with the computer using the suspect IP address. (Id.)
"P2P file sharing is a method of communication available to Internet users through the use of special software . . . that allows for the sharing of digital files between users on the network . . . P2P software allows the user to designate file(s) on a computer to be shared with others worldwide running compatible P2P software . . . The download of a file is achieved through a direct connection between the computer requesting the file and the computer(s) hosting the file. * * * The software is designed only to allow files that have been selected to be downloaded. * * * A person that includes child pornography files in his/her 'shared' folder is hosting child pornography and is thereby promoting, presenting, and potentially distributing child pornography." (Ex. 2 at 8-9.)
"A P2P file transfer is accomplished by reference to an Internet Protocol (IP) address. This address, expressed as four groups of numbers separated by decimal points, is unique to a particular computer during an online session. The IP address provides a unique location making it possible for data to be transferred between computers. Software is available to identify the IP address of the P2P computer sending the file." (Id at 9.)
"IP addresses can be dynamic, meaning that the Internet Service Provider (ISP) assigns a different unique number to a subscriber's computer at varying intervals at the discretion of the ISP. IP addresses might also be static meaning an ISP assigns a user's computer a specific IP address which is used each time the computer accesses the Internet." (Ex. 2 at 5.)
"Hash value refers to a value generated after data has been subjected to a cryptographic mathematical algorithm. A hash value is akin to a digital fingerprint in that dissimilar data will not produce the same hash value after being subjected to the same hash algorithm. Therefore, a hash value is particular to the data from which the hash value was generated. Known hash values can be used to search for identical data stored on various digital devices and/or media as identical data will have the same hash value. * * * As hash values are more reliable than DNA evidence, it can be concluded that a file made available for download on a P2P network with a hash value matching previously identified child pornography, is in fact, child pornography. " (Ex. 2 at 6, 10.)
Using this software, SA Daniels determined that a computer using an IP address that was later determined to be assigned to Defendant's residence was being used to share files which had been previously identified via their hash values to depict child pornography. (Id.) Specifically, on May 10, 2014, at approximately 1:16 a.m., the undercover computer used by SA Daniels directly connected to a computer using the IP address later determined to be assigned to Defendant's residence. (Id.) Between approximately 1:16 a.m. and 2:25 a.m. (Arizona Time), eight files depicting child pornography were downloaded from that IP address. (Id.) Four of these files were more fully described in the search warrant affidavit. (Id.)
Shortly after the download, SA Daniels conducted a Domain Name System check for the suspect IP address, which indicated that the IP address was registered to CenturyLink. (Ex. 2 at 18.) SA Daniels served an administrative subpoena on CenturyLink requesting subscriber information associated with the IP address during the time of the download. (Id.) CenturyLink records indicated that during the time of the download, the suspect IP address was assigned to Stephanie Rusnak at the address listed in the search warrant. (Id.) A subsequent utility records check with Tucson Electric Power listed the account owner for the address as Bryan Rusnak with a connect date of December 9, 2013. (Id.) Agents conducted surveillance of the address on September 10, 2014, and confirmed that a vehicle in front of the premises was registered to Bryan and Stephanie Rusnak. (Id.) A Thomas Reuters CLEAR National Comprehensive Report likewise listed Bryan and Stephanie Rusnak's most recent address as the search warrant address. (Id.)
On September 23, 2014, the hash values for all eight downloaded files from the suspect IP address were submitted to the National Center for Missing & Exploited Children (NCMEC) and determined to depict a previously identified child victim. (Id.) The affidavit also included background information related to computers, child pornography, peer to peer networks and file sharing, as well as an assessment of computer evidence in child pornography investigations, characteristics of individuals involved in the distribution and possession of child pornography, and the proposed search methodology. (Id. at 3-16.)
II. DISCUSSION
A. Probable Cause Determination
The standards for determining probable cause for a search are set forth in Illinois v. Gates, 462 U.S. 213 (1983), and further discussed relative to cases involving child pornography on computers in Gourde, 440 F.3d at 1069, and United States v. Kelley, 482 F.3d 1047, 1050 (9th Cir. 2007). Probable cause has been defined as a "fair probability" that contraband or evidence is located in a particular place. Kelley, 482 F.3d at 1050 (citing Gates, 462 U.S. at 246; Gourde, 440 F.3d at 1069). A fair probability is dependent on the "totality of the circumstances" and can include reasonable inferences, as well as a "common sense practical" approach. Id. A fair probability is not a certainty or even a preponderance of the evidence. United States v. Schesso, 730 F.3d 1040, 1046 (9th Cir. 2013) (citing Gourde, 440 F.3d at 1069-71). Further, "great deference" should be given to a magistrate judge's determination. Kelley, 482 F.3d at 1050 (citing Gourde, 440 F.3d at 1069 (quoting Gates, 462 U.S. at 236)) (other citations omitted). Moreover, "resolution of doubtful or marginal cases in this area should largely be determined by the preference to be accorded to warrants." Id. at 1051 (citing Gates, 462 U.S. at 237 n.10) (other citations omitted).
Defendant Rusnak argues that "corroborating evidence" is required to show probable cause, and the sharing of child pornography files from an IP address is not enough. To the contrary, Gates does not compel the government to provide more facts than necessary to show a "fair probability." Kelley, 482 F.3d at 1054 (citing Gourde, 440 F.3d at 1071). In fact, as long as the totality of the circumstances set forth in the affidavit support a "fair probability" that child pornography intentionally downloaded will be found on the computer, it does not matter whether additional facts could have been obtained. Id.; see also Gourde, 440 F.3d at 1073 (government does not have to provide more facts than necessary to show fair probability that crime committed and evidence of the crime would be located on the property to be searched).
The affidavit in this case provided evidence that an undercover computer used by SA Daniels directly connected to a computer using an IP address, later determined to be assigned to Defendant Rusnak's residence, and downloaded multiple images of child pornography from that IP address. (Ex. 2 at 17.) These facts are most similar to Schesso. In that case, there was evidence that during a four-hour period in October 2008, an 18-minute child pornography video was made available for download on a P2P network by someone using a specific IP address which was later determined to be assigned to Schesso. Schesso, 730 F.3d at 1043. Similar to the affidavit in this case, the Schesso affidavit described the storage capacity of computers, the use of the internet to distribute child pornography, the operation of P2P networks, and the known characteristics of child pornography collectors. Id. The court in Schesso held that defendant's affirmative step of uploading and distributing a child pornography video on a P2P network designed for file sharing and trading, provided probable cause for the issuance of a search warrant. Id. at 1045.
Contrary to Defendant Rusnak's argument (Doc. 50 at 5), the probable cause finding was not based on additional evidence (although the Ninth Circuit noted that, in evaluating staleness, the judge that authorized the search could have reasonably inferred that Schesso fit the profile of a child pornography collector). Id. at 1045, 1047. In fact, the Ninth Circuit has stated that arguments based on whether the affidavit establishes that a person falls within the class of persons likely to collect child pornography "misfocus the inquiry, which is whether there was reasonable cause to believe" child pornography files were located on a computer in the identified residence. United States v. Hay, 231 F.3d 630, 635 (9th Cir. 2000). The Ninth Circuit held in Schesso that a review of the record revealed that the facts cited in the affidavit, combined with reasonable inferences drawn from those facts, provided probable cause to search Schesso's computer for evidence of possession of, or dealing in, child pornography. 730 F.3d at 1046. Therefore, the judge issuing the warrant made the "practical, common-sense decision" that "given all the circumstances" in the affidavit there was a "fair probability" that evidence of child pornography would be found on Schesso's computer. Id. (citing Gates, 462 U.S. at 238).
No Ninth Circuit cases undermine this Court's analogy to Schesso. The court concluded in Kelley that it was reasonable to search the defendant's computer based on evidence that the defendant, using two different screen names, received nine emails with attachments "containing the same type of illicit child pornography" found on computers of two other individuals who collected or distributed child pornography. 482 F.3d at 1052-54. While the affidavit offered no external corroboration of Kelley's interest in young boys, the Ninth Circuit concluded that it could be inferred, from the receipt of multiple emails containing similar child pornography over a period of ten months, that those images and others would be found on Kelley's computer. Id. at 1054. In Kelley, there was no direct evidence, as here, that Kelley possessed and shared child pornography images. However, the Kelley court found it was reasonable to infer that the defendant was "part of a network of persons interested in child pornography" who knowingly received the email attachments and was not an accidental recipient of the emails and that it was fairly probable that child pornography would be found on Kelley's computer. 482 F.3d at 1047, 1052-54.
Similarly, in Gourde, the Ninth Circuit held it was reasonable to infer a fair probability that the defendant received or downloaded child pornography images based on the defendant's paid subscription to a mixed child and adult pornography website. 440 F.3d at 1065, 1069-71. In Gourde, there was no evidence of an actual download or upload of images, as is present here, only Gourde's joining of the website and remaining a member for over two months with "the means" to receive and possess images. Id. at 1069-71. The court found that Gourde's intentional steps to become a member of the website were sufficient to support an inference that he viewed or downloaded illicit images. See Kelley 482 F.3d at 1052. Facts provided in the affidavit included language regarding the use of computers by child pornographers and the collector profile which the court found strengthened the inference and helped provide context for the probability that Gourde received or download images. Gourde, 440 F.3d at 1072 (citing Hay, 231 F.3d at 636 (collector profile language "formed the basis upon which the magistrate judge could plausibly conclude that those files were still on the premises")). Similar language was provided in the instant affidavit and it is not unreasonable to make comparable inferences in this case.
In the motion and reply, Defendant Rusnak relies on the three-judge panel opinion in United States v. Gourde, 382 F.3d 1003 (9th Cir. 2004), which suppressed the evidence based on a lack of probable cause. That case was taken en banc and reversed in the decision published at 440 F.3d 1065, which the Court relies upon in this Report and Recommendation. The three-judge panel opinion is of no precedential value.
Likewise, in Lacy, the evidence of a download of at least two computer images of child pornography was sufficient to find probable cause that child pornography was actually received and possessed, and to imply a reasonable inference that the defendant had the characteristics of a collector in further support of the search. United States v. Lacy, 119 F.3d 742, 745 (9th Cir. 1997); see also United States v. Grant, 218 F.3d 72, 75 n.2 (1st Cir. 2000) (probable cause to conduct a search of child pornography on suspect's computer found "based solely on the activities of the defendant's registered screen name.").
Defendant also argues that probable cause requires evidence specifically related to Defendant Rusnak and not necessarily to the computer (IP address) at the residence. As set forth in Gates, Gourde, Hay and Kelley, a location (such as a computer in a residence) can be searched for evidence of a crime even when there is no probable cause for arrest of a specific person or even a prima facie showing of criminal activity. Kelley, 482 F.3d at 1055 (citing Gates, 462 U.S. at 235; Gourde, 440 F.3d at 1072-73; Hay, 231 F.3d at 635). The determination is based simply on the totality of the circumstances, whether or not there is a fair probability that based upon the facts set forth, and reasonable inferences made, that child pornography will be found on the computer. Kelley, 482 F.3d at 1055. For example, the Kelley court found that it was "fairly probable" that images of child pornography would be found on Kelley's computer because even though there was no concrete evidence that Kelley actually solicited the e-mails, it appeared likely he did from the facts in the affidavit and reasonable inferences drawn therefrom. Id. at 1052.
Although Defendant Rusnak correctly points out that, in Hay, there was additional evidence of Hay's interest in young children, the Ninth Circuit never held that such corroboration was required. In Hay, 19 computer files containing child pornography had been transferred directly from a known trader of such images to an IP address accessible by Hay from his apartment. 231 F.3d at 632. Hay is distinguishable because, here, the IP address was associated with a single family home and, in Hay, the IP address was assigned to a University of Washington housing facility. The address was associated with a network port wired to a university apartment occupied by Hay. Id. To help determine if Hay was the only user of the computer and his probable interest in child pornography, the University provided agents with information related to Hay's website which showed Hay's interest and involvement with young children's activities, and an undercover interview of Hay was conducted. Id. at 632-33. This additional information, while helpful, was not required. In finding sufficient probable cause, the Hay court concluded that boilerplate language contained in the search warrant affidavit regarding probable practices of individuals involved in possession of child pornography, as well as evidence regarding how child pornography is traded and distributed over the internet and the unique use of computers for distribution of child pornography, allowed the magistrate to draw the reasonable inference that Hay had communicated with the known trader prior to the transfer of files and that the transfers were neither unsolicited nor accidental. Id. at 634-36.
Hay is further distinguished when looking at United States v. Greathouse, 297 F. Supp. 2d 1264 (D. Or. 2003). In Greathouse, agents received information that a user named "cyotee" was offering internet access to files containing child pornography. Id. at 1267. Law enforcement was able to connect to the "cyotee" server and download eight child pornography images and four videos. Id. "Cyotee" utilized a specific IP address that was registered to a certain ISP. Id. Agents traced the user name "cyotee" by checking ISP records and confirming the user identity with motor vehicle and utility records. Id. at 1267, 1271. The defendant in Greathouse relied on Hay (similar to Defendant Rusnak) for the proposition that the search was illegal in the absence of corroborating evidence of the actual user of the computer and its location. The Greathouse court emphasized that Hay involved a computer located somewhere on the University of Washington campus. Id. at 1271 (citing Hay, 231 F.3d at 632). In Greathouse, unlike Hay but similar to the facts and circumstances of this case, the court found that "it was entirely reasonable for the agents to presume, based upon the evidence available, that they were investigating a single computer located in a single family residence. Given those assumptions, the type of further narrowing investigation described in Hay was not constitutionally required." Id. In addition, Greathouse went on to explain that not knowing the actual user of the computer at the time of the search warrant does nothing to diminish probable cause. Id. All that is necessary is probable cause to believe that evidence of child pornography would be found on a computer at the residence. Id.
While the court in Greathouse found probable cause, the court ultimately found the critical information giving rise to probable cause was too stale to justify the search 13 months later. 297 F. Supp. 2d at 1273. --------
The affidavit in this case indicates that SA Daniels, initiating the use of software designed to search a specific P2P network for IP addresses sharing files depicting child pornography, determined that a computer using a certain IP address was being used to share child pornography files and that eight files depicting child pornography were downloaded from the same IP address that was later determined to be assigned to Defendant Rusnak's single family residence. Because there was a fair probability that evidence of child pornography would be found on computers in Defendant Rusnak's residence, the facts and information in the affidavit, combined with reasonable inferences drawn from those facts and information, support a finding of probable cause. B. Staleness
The Court further finds that the facts supporting the government's application for the search warrant, which took place 5 months after the P2P download, was not stale especially in light of the nature of the offense, the use of computers, and the characteristics of individuals involved in the distribution and possession of child pornography. A review of the applicable case law provides that "information offered in support of the application for a search warrant is not stale if 'there is sufficient basis to believe, based on a continuing pattern or other good reasons, that the items to be seized are still on the premises.'" Hay, 231 F.3d at 636 (emphasis added) (citing Lacy, 119 F.3d at 745-46 (quoting United States v. Gann, 732 F.2d 714, 722 (9th Cir. 1984))). A search can be properly authorized when there are "good reasons" to believe that child pornography would still exist on the computer. Id. (finding a six-month time period between transmission of child pornography images to internet address accessible by defendant and application of warrant was not stale in light of evidence that possessors of pornography store these materials for long periods of time and files can be retrieved by computer expert even if deleted). With respect to staleness, a mere lapse of time, even a substantial amount of time, is not controlling. Lacy, 119 F.3d at 636 (citing United States v. Dozier 844 F.2d 701, 707 (9th Cir. 1988)). Instead, the court should "evaluate staleness in light of the particular facts of the case and the nature of the criminal activity and property sought." Id. (citing United States v. Pitts, 6 F.3d 1366, 1369 (9th Cir. 1993)). In Lacy, the court found that a ten-month delay did not render the information stale because there was good reason to believe that the items sought would still be found in Lacy's residence. Id. at 746. The Lacy affidavit included information attesting to the agent's training and experience, and explaining characteristics of collectors and distributors of child pornography and the nature of the crime, all of which supported an inference that materials would still be found on the computer. Id. Even a 20-month delay did not render the search warrant application stale in Schesso based on the nature of the offense and the agent's affidavit explaining the characteristics of individuals who possess and distribute child pornography including information that such individuals rarely dispose of images. 730 F.3d at 1047; see also United States v. Allen, 625 F.3d 830, 842-43 (5th Cir. 2010) (18-month delay between when defendant sent child pornography images through a P2P networking site and issuance of search warrant not stale); United States v. Morales-Aldahondo, 524 F.3d 115, 117-19 (1st Cir. 2008) (3-year delay between information that defendant's brother, who shared defendant's residence, had purchased access to child pornography website did not render information stale).
Here, the Court finds that in light of the information and facts provided in the affidavit, a delay of 5 months after the P2P download did not render that evidence stale as there is sufficient basis to believe, based on the nature of the offense, the use of computers, and the characteristics of individuals involved in the distribution and possession of child pornography, that the items to be seized would still be found in Defendant Rusnak's residence. C. Good Faith.
As stated above, the Court finds there was sufficient probable cause to support the issuance of the search warrant. However, even if the warrant was deemed not sufficient, the Court finds the "good faith" exception applies because the agents' reliance on the warrant was objectively reasonable, and the affidavit contained sufficient evidence to justify the agents' reliance on the warrant. Schesso, 730 F.3d at 1050 (citing United States v. Leon, 468 U.S. 897, 922-23 (1984)).
RECOMMENDATION
It is recommended that, after its independent review of the record, the District Court deny Defendant's Motion to Suppress (Doc. 39). Pursuant to Federal Rule of Criminal Procedure 59(b)(2), any party may serve and file written objections within 14 days of being served with a copy of this Report and Recommendation. A party may respond to the other party's objections within fourteen days. No reply brief shall be filed on objections unless leave is granted by the District Court. If objections are not timely filed, they may be deemed waived.
Dated this 28th day of September, 2016.
/s/_________
Honorable Lynnette C. Kimmins
United States Magistrate Judge