Case No. 2:17-cr-00073-APG-GWF
ORDER ACCEPTING AND MODIFYING MAGISTRATE JUDGE'S FINDINGS AND RECOMMENDATION AND DENYING MOTION TO SUPPRESS
(ECF Nos. 41, 146)
Defendants Justin Anthony Fisher and Joshua Ray Fisher filed a motion to suppress evidence seized during the November 21, 2016 search of the residence at 10432 Burkehaven Avenue, in Las Vegas. ECF No. 41. Magistrate Judge Foley conducted an evidentiary hearing, after which he recommended that the motion to suppress be denied. ECF No. 146. The defendants filed an Objection to that recommendation (ECF No. 147) and the Government filed a Response that also objected to some of Judge Foley's findings (ECF No. 149). Pursuant to Local Rule IB 3-2(b), I have conducted a de novo review of the motion to suppress and related papers. I agree with Judge Foley's recommendation to deny the motion to suppress, but on different grounds. Therefore, I will modify Judge Foley's Findings and Recommendation and deny the motion to suppress.
I. FACTUAL BACKGROUND
The parties are familiar with the facts and procedural posture of this case (and those are detailed in the briefs), so I will not repeat them here except where necessary for context.
On May 26, 2016, the National Center for Missing and Exploited Children (NCMEC) sent Cybertip #10001179 to the Las Vegas Metropolitan Police Department, reporting that Tumblr had reported the upload of apparent child pornography. ECF No. 47-1. The Cybertip reported the user as:
Email Address: firstname.lastname@example.org
Screen/User Name: mcw
Profile URL: mcw.tumblr.com
IP Address: 184.108.40.2064 (Other)
The Cybertip included additional information about IP addresses that appeared related to that user name, including 220.127.116.11.
Detective Scott Miller conducted an investigation of the Cybertip, including serving a search warrant on Tumblr. ECF No. 47-2. Based on his investigation, Det. Miller applied for a search warrant for the house located at 10432 Burkehaven; he submitted an affidavit in support of that search warrant request summarizing his investigation. ECF No. 47-4. Justice of the Peace Suzan Baucum issued the search warrant. The defendants challenge the contents of Det. Miller's warrant affidavit and seek to suppress items seized as a result of the warrant.
Magistrate Judge Foley conducted a Franks hearing and recommended that I deny the motion to suppress. ECF No. 146. The defendants objected to that recommendation and the Government's response includes objections to some of Judge Foley's findings.
II. LEGAL STANDARDS
Under Local Rule IB 3-2(b), I "must conduct a de novo review of those portions of the specified findings or recommendations to which objections have been made. [I] may accept, reject or modify, in whole or in part, the magistrate judge's findings or recommendations." See also 28 U.S.C. § 636(b)(1)(c) (same).
The Government objects (ECF No. 149 at 10-13) to Judge Foley's order (ECF No. 59) granting a Franks hearing. The Government contends, among other things, that the defendants did not meet the standard under Franks to warrant a hearing. I agree, and I would not have conducted a hearing.
The Government previously moved Judge Foley to reconsider his order granting the evidentiary hearing. ECF No. 79. Judge Foley denied that motion in his Findings and Recommendation that is the subject of this order. See ECF No. 146 at 14:19-21.
A defendant challenging a search warrant affidavit is entitled to an evidentiary hearing "where the defendant makes a substantial preliminary showing that a false statement knowingly and intentionally, or with reckless disregard for the truth, was included by the affiant in the warrant affidavit, and [that] the allegedly false statement is necessary to the finding of probable cause.. . ." Franks v. Delaware, 438 U.S. 154, 155-56 (1978). The defendant must show "that the affidavit purged of those falsities and supplemented by the omissions would not be sufficient to support a finding of probable cause." United States v. Stanert, 762 F.2d 775, 782 (9th Cir.), amended, 769 F.2d 1410 (9th Cir. 1985) (citing Franks, 438 U.S. at 171-72). "The effect of the misrepresentations and omissions on the existence of probable cause is considered cumulatively." Id. (citation omitted). I "must determine, therefore, whether the affidavit, once corrected and supplemented, would provide a magistrate with a substantial basis for concluding that probable cause existed." Id.
The defendants contend that Det. Miller omitted critical facts from his warrant affidavit. They argue that if the affidavit is supplemented with the following five statements it would no longer support a finding of probable cause.
Defendants' proposed addition #1 : "Tumblr provided CyberTipline Report #10001179, reporting a user with IP address 18.104.22.168, uploading eight images to a blog, two of which are possible child pornography."
This proposed addition is not specifically correct. The alleged uploading of child pornography occurred on April 19, 2016 at 14:13:00 UTC. See ECF No. 47-1 at 3 (Bates 00030). The NCMEC report identified the IP address for the user or person being reported as "22.214.171.124 (Other)." ECF No. 47-1 at 4 (Bates 00031). But Tumblr's later response to Det. Miller's search warrant indicates that IP address 126.96.36.199 was logged in at the time the alleged child pornography was uploaded. See ECF No. 47-2 at 16-18 (Bates 74-76).
Det. Miller stated in the Synopsis section of his warrant affidavit that NCMEC received a report from Tumblr of a possible uploading of child pornography. ECF No. 47-4 at 5 (Bates 107). That is a correct statement. But he went on to write that Tumblr reported a user ("mcw") with "an IP address of 188.8.131.52 uploaded 8 child exploitation images on their Tumblr account." ECF No. 47-4 at 5 (Bates 107). Id. Because this sentence came immediately after the sentence about the NCMEC report (and before the statement about the Tumblr search warrant), it could be incorrectly interpreted as saying the NCMEC report stated that Tumblr had reported IP address 184.108.40.206 as the one that uploaded child pornography, which is technically incorrect.
In his Probable Cause Offering section that immediately followed his Synopsis, Det. Miller provided more detail, stating that Tumblr had provided the following IP addresses to NCMEC: 220.127.116.11 and 18.104.22.168. Id. at 6 (Bates 108). In reality, the NCMEC report initially says that Tumblr reported the IP address as "22.214.171.124 (Other)." ECF No. 47-1 at 3-4 (Bates 00030-31). Immediately below that, the NCMEC report lists "additional information submitted by the reporting ESP," which includes the "suspect's last logins" under both of the IP addresses Miller listed in his Probable Cause Offering: 126.96.36.199 and 188.8.131.52. Miller's subsequent investigation—especially the Tumblr response to the search warrant—confirmed that IP address 184.108.40.206 was tied to the incident and uploaded the subject images. See ECF No. 47-2 at 16-18 (Bates 74-76).
Det. Miller's warrant affidavit could be incorrectly interpreted as stating that the NCMEC report identified the IP address of 220.127.116.11 as the one that uploaded the child pornography. But considered in its entirety, the affidavit was not misleading. Det. Miller summarized the chain of his investigation, including the results of the search warrants and subpoena he obtained. That investigation supported probable cause to issue the search warrant for the Burkehaven house.
But even if I find that the misstatements discussed above were misleading, at most I would supplement the affidavit with the following changes. In the Synopsis section, I would change page 5 (Bates 107) to say: On or about April 27, 2016, the National Center for Missing and Exploited Children (NCMEC) received a report from Tumblr reference a possible transmission of child pornography. Tumblr reported a user "mcw," screen/user name of mcw, and an IP address of <18.104.22.168>
22.214.171.124, uploaded 8 child exploitation images on their Tumblr account. In the Probable Cause Offering section, I would change page 6 (Bates 108) to say:
On or about April 27, 2016, the National Center for Missing and Exploited Children (NCMEC) received a report from Tumblr reference a possible transmission of child pornography. Tumblr reported the user uploaded 8 images/videos of child sexual exploitation. Tumblr provided the following information regarding the user:
IP Address: 126.96.36.199 <(Other)>
Date of Incident: April 19, 2016 at 14:14:00 UTC
Email Address: email@example.com
Screen/User Name: mcw
Profile URL: https://mcw.tumblr.com
This report was documented under NCMEC Cybertip #10001179 and forwarded on May 26, 2016 to the Las Vegas Metropolitan Police Department for follow up investigation.
With those changes, the affidavit still supports a finding of probable cause because of the other information obtained from the search warrants and subpoena that linked the child pornography to IP address 188.8.131.52. Defendants' proposed addition #2 : "IP address 184.108.40.206 resolves to an unknown person in San Jose."
The NCMEC report's "Geo-Lookup" resolves to a location in San Jose but no person or entity is identified. But even if this proposed language was included in the affidavit, it would not be material because the NCMEC report also identified IP address 220.127.116.11 as related to the incident and noted that it resolved to Las Vegas. Even the NCMEC reporter believed that the IP address 18.104.22.168 was not material because, after reviewing the relevant information, the reporter concluded: "Based on IP 22.214.171.124, I will place this report on the VPN for the NV ICAC." See ECF No. 47-1 at 9 (Bates No. 36). The report was sent to the Las Vegas Metropolitan Police Department but not to any authorities in San Jose. Id. at 11 (Bates No. 38). That confirms that NCMEC believed the suspect IP address was 126.96.36.199, not 188.8.131.52. The defendants' complained-of omission and proposed addition about San Jose are not material. Defendants' proposed addition #3 : "Three separate IP addresses are associated with the username 'mcw' of the blog and have logged in to access the blog from January 1, 2016 and April 19, 2016."
Again, the NCMEC report reviewed the information regarding "mcw" and "mcwarson" and concluded that the suspect IP address was 184.108.40.206. See ECF No. 47-1 at 7-9 (Bates 34-36). Also, Tumblr's response to the search warrant reported that IP address 220.127.116.11 was logged in on the day and time of the incident. See ECF No. 47-2 at 16-18 (Bates 74-76). No other IP address was logged in at that time. Tumblr also indicated that from April 19, 2016 to July 2, 2016, 40 more images of child pornography were uploaded by "mcw," and that the last login for "mcw" from April 19, 2016 to July 2, 2016 was from IP address 18.104.22.168. ECF No. 47-4 at 7 (Bates 109). Thus, the complained-of omission is not material, and the defendants' proposed addition would not alter the analysis of probable cause. Defendants' proposed addition #4 : "Tumblr does not know when blogs are accessed, only when there is a login made."
The defendants do not explain the difference, if any, between "accessed" and "login," and I do not see a material difference in the context of this case. Defendants' proposed addition #5 : "It is unknown which IP addresses may have viewed or uploaded the photographs of the blog."
This proposal would be misleading as it ignores that Tumblr reported that the IP address 22.214.171.124 was logged in on the day and time the child pornography was uploaded. See ECF No. 47-2 at 16-18 (Bates 74-76). No other IP address was logged in at that time. Based on the circumstances, there is more than a reasonable probability that the alleged child pornography was uploaded from IP address 126.96.36.199.
The defendants have not shown that Det. Miller was reckless or that he deliberately omitted material information in preparing his search warrant affidavit. And the complained-of omissions were not material. At most, I would supplement the affidavit by revising the statements in the Synopsis and Probable Cause Offering sections as discussed above. As supplemented, the affidavit still would have provided probable cause to issue the search warrant. Therefore, I would not have granted the defendants' request for a Franks hearing. Rather, I would have denied the motion to suppress without an evidentiary hearing.
Although Judge Foley felt after the evidentiary hearing that recklessness was "a close call," he did not find that Det. Miller was reckless. And he concluded that "it does not appear that Detective Miller intentionally misled the issuing judge. . . . Detective Miller appeared to be generally credible as a witness." ECF No. 146 at 14.
Magistrate Judge Foley reached a similar conclusion after the evidentiary hearing. ECF No. 146 at 13. --------
IT IS THEREFORE ORDERED that Magistrate Judge Foley's Findings and Recommendation (ECF No. 146) is accepted as to its recommendation to deny the motion to suppress and modified to the extend my reasoning is different than his, as set forth above. The defendants' motion to suppress (ECF No. 41) is denied.
Dated: June 10, 2019.
ANDREW P. GORDON
UNITED STATES DISTRICT JUDGE