ACCEPTED 01-14-00516-CR FIRST COURT OF APPEALS HOUSTON, TEXAS
Nos. 01-14-00516-CR, 01-14-00517-CR, 01-14-00518-CR 4/20/2015 10:16:35 AM CHRISTOPHER PRINE
01-14-00519-CR, 01-14-00520-CR CLERK
In the Court of Appeals FILED IN For the 1st COURT OF APPEALS HOUSTON, TEXAS First District of Texas 4/20/2015 10:16:35 AM At Houston CHRISTOPHER A. PRINE ♦ Clerk
Nos. 1370904, 1370905, 1370906, 1370907, 1370908 In the 230th District Court Of Harris County, Texas ♦ HUGO PACHAS-LUNA Appellant v. THE STATE OF TEXAS Appellee ♦ State’s Appellate Brief ♦
DEVON ANDERSON District Attorney Harris County, Texas
STEPHEN DRIVER KATHRYN KAHLE Assistant District Attorneys Harris County, Texas
CLINTON A. MORGAN Assistant District Attorney Harris County, Texas State Bar No. 24071454 morgan_clinton@dao.hctx.net
1201 Franklin, Suite 600 Houston, Texas 77002 Tel: (713) 755-5826 FAX: (713) 755-5809
Counsel for the Appellee
Oral Argument Not Requested Statement Regarding Oral Argument
The appellant requested oral argument, though he gave no particular
reason why. The State believes the briefs in this case adequately apprise this
Court of the issues and the law, and any marginal benefit from oral argument
does not justify the considerable amount of time that preparation for oral
argument requires of the parties and the Court. Therefore, the State does not
request oral argument.
i Identification of the Parties
Counsel for the State:
Devon Anderson District Attorney of Harris County
Stephen Driver & Kathryn Kahle — Assistant District Attorneys at trial
Clinton A. Morgan Assistant District Attorney on appeal
Appellant:
Hugo Pachas-Luna
Counsel for the Appellant:
Connie Williams — Counsel at trial
Alexander Bunin & Sarah V. Wood — Counsel on appeal
Trial Judge:
Brad Hart Presiding judge
ii Table of Contents
Page
Statement Regarding Oral Argument .......................................................... i Identification of the Parties ........................................................................ ii Table of Contents .......................................................................................... iii Index of Authorities ....................................................................................... v Statement of the Case ................................................................................... 1 Statement of Facts ......................................................................................... 1 Reply to the Appellant’s Sole Point of Error Most of the appellant’s complaints are minor or completely meritless. His one legitimate complaint — the possible discrepancy between when the IP address was sharing child pornography and when the IP address was connected to the appellant — is unpreserved, and a matter of first impression that this Court should refrain from addressing. Given the deferential standard of review in warrant cases, this Court should defer to the magistrate’s determination of probable cause. ................................................... 2 I. Appellate courts review warrant affidavits by reading them in a common-sense manner, and giving deference to both the trial court and the issuing magistrate. ....................................................................................................... 2 II. A fair reading of the affidavit shows that it is not nearly so bad as the appellant makes it seem.................................................................................................... 4 A. Corporal Lee’s Background Knowledge ........................................................ 5 1. Lee’s Training ......................................................................................................... 5 2. Lee’s Knowledge of Peer-to-Peer Networks .............................................. 6 3. Lee’s Software, and “Hash Values”................................................................. 7 B. This Investigation ................................................................................................... 8 1. The Child Pornography Files............................................................................ 8 2. Connecting the IP to the Appellant ............................................................ 10 3. “People who have a sexual interest in children …” .............................. 12
iii III. All but one of the appellant’s complaints are without merit, and on that issue there is a sufficient basis in the affidavit that the trial court’s ruling was not an abuse of discretion. ..................................................................... 12 A. The name of the online database was not necessary to show probable cause............................................................................................................... 12 B. Lee adequately described his investigative software........................... 14 C. The missing verb is apparent from context clues. ................................. 15 D. The affidavit elsewhere describes in detail some of the child pornography found on the suspect IP address, thus whether the phrase “labeled as child notables” was “conclusory and uncredited” is irrelevant, as it was not necessary for the probable-cause determination. ............................................................................................................... 17 E. There was information regarding only one IP address; the “different” IP address mentioned in the affidavit was obviously a typo, as the trial court determined................................................................................... 18 F. The appellant’s sole legitimate complaint — regarding the imprecise connection between the suspect IP address and the appellant’s residence — is unpreserved. If this Court addresses it, it is a question of first impression and this Court should defer to the inferences drawn by the magistrate and the trial court. ............................. 20 G. The appellant’s complaint about Lee’s “method” of comparing hash values is irrelevant. ...................................................................................................... 23 H. The information in the affidavit connecting child pornography to the appellant’s residence was not stale. ............................................................. 25 Conclusion .................................................................................................... 29 Certificate of Compliance and Service ..................................................... 30
iv Index of Authorities
Cases Barrett v. State 367 S.W.3d 919 (Tex. App.— Amarillo 2012, no pet.) ....................................................................................................... 21 Champion v. State 919 S.W.2d 816 (Tex. App.— Houston [14th Dist.] 1996, pet. ref’d) ................................................................... 16, 19 Gardner v. State 433 S.W.3d 93 (Tex. App.— Houston [1st Dist.] 2014, pet. ref’d).............................................................................. 22 Hereford v. State 339 S.W.3d 111 (Tex. Crim. App. 2011) .......................................................................... 4 Illinois v. Gates 462 U.S. 213 (1983) ................................................................................................................. 3 Pair v. State 184 S.W.3d 329 (Tex. App.— Fort Worth 2006, no pet.) .................................................................................................. 24 Reyes v. State 02-11-00327-CR, 2013 WL 1338023 (Tex. App.— Fort Worth Apr. 4, 2013, no pet.) (mem. op. not designated for publication) ................................................................. 16 Rodriguez v. State 232 S.W.3d 55 (Tex. Crim. App. 2007) .......................................................................... 23 Rothstein v. State 267 S.W.3d 366 (Tex. App.— Houston [14th Dist.] 2008, pet. ref’d) ................................................................. passim Sanders v. State 191 S.W.3d 272 (Tex. App.— Waco 2006, pet. ref’d) ......................................................................................................... 28
v Serrano v. State 123 S.W.3d 53 (Tex. App.— Austin 2003, pet. ref’d) .......................................................................................................... 3 State v. Cotter 360 S.W.3d 647 (Tex. App.— Amarillo 2012, no pet.) ....................................................................................................... 28 State v. Delagarza 158 S.W.3d 25 (Tex. App.— Austin 2005, no pet.)............................................................................................................... 3 State v. Jordan 342 S.W.3d 565 (Tex. Crim. App. 2011) .......................................................................... 3 Tucker v. State 369 S.W.3d 179 (Tex. Crim. App. 2012) .......................................................................... 4 United States v. Bervaldi 226 F.3d 1256 (11th Cir. 2000)................................................................................. 26, 27 United States v. Diecidue 603 F.2d 535 (5th Cir. 1979) ............................................................................................. 27 United States v. Hay 231 F.3d 630 (9th Cir. 2000) ............................................................................................. 28 United States v. Morales-Aldahondo 524 F.3d 115 (1st Cir. 2008).............................................................................................. 28 United States v. Vosburgh 602 F.3d 512 (3d Cir. 2010)............................................................................................... 21
vi Statement of the Case
The appellant was charged in five indictments with different charges of
possession of child pornography. (1 CR 13; 2 CR 13; 3 CR 13; 4 CR 13; 5 CR
13).1 The appellant waived his right to a jury trial and pled not guilty to the
trial court. (2 RR 4-8). The trial court found him guilty as charged. (4 RR 130-
31). After a pre-sentence investigation, the trial court assessed punishment for
each case at eight years’ confinement, with the sentences to run consecutively.
(5 RR 18; 1 CR 87-88; 2 CR 88-89; 3 CR 88-89; 4 RR 86-87; 5 RR 80-81). The
appellant filed timely notices of appeal and the trial court certified his right of
appeal. (1 CR 92, 94).
Statement of Facts
A Harris County Precinct Four Constable’s Deputy conducted an
investigation into online child-pornography file sharing and discovered a
computer sharing child pornography from an internet account associated with
the appellant. (Def.’s Ex. 1). The deputy obtained a warrant for the appellant’s
house, and when the warrant was served police found numerous hard drives
1 The State will refer to the clerk’s records in the different causes as though they were sequential volumes. Thus the record for 01-14-00516- CR will be 1 CR, the record for 01- 14-00517-CR will be 2 CR, and so on, in numerical order. If the same document appears in all the records, the State will cite to the copy in 1 CR.
1 containing, in total, more than 18,000 images and videos of child pornography,
including the four images and one video for which he was charged in this case.
(4 RR 103-16).
Reply to the Appellant’s Sole Point of Error
Most of the appellant’s complaints are minor or completely meritless. His one legitimate complaint — the possible discrepancy between when the IP address was sharing child pornography and when the IP address was connected to the appellant — is unpreserved, and a matter of first impression that this Court should refrain from addressing. Given the deferential standard of review in warrant cases, this Court should defer to the magistrate’s determination of probable cause.
The appellant filed a pre-trial motion to suppress alleging, inter alia, that
the warrant affidavit in this case did not contain probable cause to believe
contraband would be found in the appellant’s home, thus the evidence was
obtained illegally. (1 CR 79-81). The trial court held a hearing on the motion to
suppress at the beginning of the appellant’s bench trial and denied the motion.
(3 RR 129-31). In his sole point of error, the appellant claims that the trial
court erred in denying his motion to suppress.
I. Appellate courts review warrant affidavits by reading them in a common-sense manner, and giving deference to both the trial court and the issuing magistrate.
Probable cause exists if, under the totality of the circumstances set forth
in the affidavit before the magistrate, there is a fair probability that 2 contraband or evidence of a crime will be found in a particular place at the
time the warrant is issued. State v. Jordan, 342 S.W.3d 565, 568-69 (Tex. Crim.
App. 2011). The magistrate may interpret the affidavit in a non-technical,
common-sense manner and may draw reasonable inferences from the facts
and circumstances contained within its four corners. Id. at 569.
When reviewing whether a warrant should have issued, courts —
whether at the trial or appellate level — are not to determine whether there
actually was probable cause. State v. Delagarza, 158 S.W.3d 25, 29 (Tex. App.—
Austin 2005, no pet.). The test at the trial court is: considering the totality of
the circumstances before the issuing magistrate, was there a substantial basis
to believe that probable cause existed. Ibid.; Illinois v. Gates, 462 U.S. 213, 268
(1983). On appellate review, then, the appropriate test is: did the trial court
abuse its discretion in finding that the magistrate had a substantial basis to
believe that probable cause existed. “The resolution of doubtful or marginal
cases should largely be determined by the preference to be accorded to
warrants.” Delagarza, 158 S.W.3d at 29. On appeal, the sufficiency of a warrant
affidavit is generally determined by looking at the affidavit itself, without
regard to extrinsic evidence. Serrano v. State, 123 S.W.3d 53, 58 (Tex. App.—
Austin 2003, pet. ref’d).
3 In reviewing a trial court’s ruling on a motion to suppress, appellate
courts give almost total deference to the trial court’s factual determinations,
even when those determinations are based on affidavit, but review de novo the
trial court’s application of the law of search and seizure. Tucker v. State, 369
S.W.3d 179, 184 (Tex. Crim. App. 2012). The record should be viewed in the
light most favorable to the trial court’s decision, and the trial court’s decision
should be upheld so long as it is reasonable in light of the record. Hereford v.
State, 339 S.W.3d 111, 18 (Tex. Crim. App. 2011).
II. A fair reading of the affidavit shows that it is not nearly so bad as the appellant makes it seem.
In his brief, the appellant engages in a persnickety reading of certain
sections of the affidavit. He focuses, at times, on what the affidavit does not say
rather than what it does. He seems befuddled by certain phrases in the
affidavit that are explained clearly enough in other parts. And he demands
descriptions and definitions of ordinary notions that any magistrate of
common intelligence would have understood.
The State will grant that Corporal Lee is unlikely to be nominated for
any literary prizes based on this affidavit, but appellate review is not about
critiquing stylistic and typographical errors. Rather, this Court is to examine
the whole document and determine whether it was reasonable for the trial
4 court to conclude that the affidavit gave the issuing magistrate a substantial
basis to find probable cause that there would be evidence of a crime at the
searched address. What follows is an attempt to read through the affidavit for
its relevant parts and to place them in the order that makes the most sense.
A. Corporal Lee’s Background Knowledge
1. Lee’s Training
The affidavit begins with the qualifications of the affiant. (Def.’s Ex. 1 at
4-5). Corporal Jeffrey Lee is employed as a peace officer by the Harris County
Precinct Four Constable, and he has been a law enforcement officer for more
than a decade. “[H]is duties include the investigation of technologically
advanced offenses including … Child Pornography.” (Def’s. Ex. 1 at 4). He is
certified “in Basic Cybercrime Investigation.”
Lee has spoken with others in the law enforcement community who
know about the ways of those who trade and collect child pornography.
Moreover, he “has been personally involved in the investigation, arrest, and
prosecution of numerous persons involved in child sexual exploitation.” (Def’s
Ex. 1 at 4). Lee is a member of the Houston Metro Internet Crimes Against
Children Task Force, a federally funded initiative.
5 2. Lee’s Knowledge of Peer-to-Peer Networks
Through his training and experience, Lee is aware that “the trade of
child pornography through the internet is extensive and one of the main
methods of distribution for this type of contraband.” (Def.’s Ex. 1 at 4). Lee is
aware that the use of peer-to-peer (P2P) networks is “one of the most
pervasive methods for the distribution of child pornography through the
internet.” (Def.’s Ex. 1 at 4). Lee knows that P2P file sharing is accomplished by
downloading software and listing certain files and folders as being “shared,”
and then those files and folders are indexed by an “ultra-peer,” through which
other users can search the shared files and folders and select which ones to
download. (Def.’s Ex. 1 at 5). Once a user chooses to download a file from
another user, those computers are then connected through an internet
protocol (IP) address. (Def.’s Ex. 1 at 5). The sending and receiving computers
record each others’ IP addresses in order to facilitate the file sharing. (Def.’s
Ex. 1 at 5).
An IP address is “a unique four-byte number assigned to a computer
when that computer accesses the Internet.” (Def.’s Ex. 1 at 17). Every
computer on the internet has an IP address that is assigned to it by its internet
service provider when it logs on. (Def.’s Ex. 1 at 17). An IP address “is unique
in the sense that no two users can have the exact same IP address at the same
6 time.” (Def.’s Ex. 1 at 17). Internet service providers generally keep records
that allow them to know which subscriber was using a particular IP address at
a particular time. (Def.’s Ex. 1 at 8-9, 17).
3. Lee’s Software, and “Hash Values”
Lee has received “specialized training” for the investigation of P2P
networks using “a specialized program developed to allow investigators to
access a variety of [P2P] networks.” (Def.’s Ex. 1 at 5). Lee “is trained and
licensed to use this software.” (Def.’s Ex. 1 at 5). The software allows
investigators to “search the variety of networks for digital material from users
connecting to the [P2P] Networks and download files that the users ‘share’
with the network…” (Def.’s Ex. 1 at 5).
The software allows investigators to narrow their searches in a couple of
ways. One way is that they can narrow their searches so that they only return
results from specified geographic areas, “such as Harris County, the City of
Houston, or City of Pasadena.” (Def.’s Ex. 1 at 5).
The second way in which this software allows investigators to limit their
searches is that the software can be set to return results for “confirmed images
of child pornography.” (Def.’s Ex. 1 at 5). It does this through the use of “hash
values.” All digital files can be processed through a Secure Hash Algorithm to
7 produce an identifying hash value that will be the same for any two duplicate
files, but which will be different if the files differ in any way. (Def.’s Ex. 1 at 7).
Lee knows that by comparing the hash value of two files, he can determine
whether two files are identical “with a precision that greatly exceeds 99.9999
percent certainty.” (Def.’s Ex. 1 at 7). Because of how hash values are produced,
“there has never been a documented occurrence of two different files being
found on the Internet having different contents while sharing the same [hash]
value.” (Def.’s Ex. 1 at 7).
Lee’s investigative software uses hash values to limit its search. The
software can take the hash values of files that have been determined to be
child pornography and return search results only from computers that are
sharing known child pornography. (Def.’s Ex. 1 at 5). Lee is aware that through
the use of this software and of the methods in which has been trained,
“hundreds of [P2P] cases have been successfully investigated throughout the
United States.” (Def.’s Ex. 1 at 6).
B. This Investigation
1. The Child Pornography Files
On August 9, 2012, Lee conducted an investigation using an “online
database.” (Def.’s Ex. 1 at 6). “The software allows licensed investigators to
8 track [IP addresses] in order to determine specifically what the individual or
computer has downloaded over a specific … time frame.” (Def.’s Ex. 1 at 6).
That afternoon, Lee conducted a search limited to Harris County and
discovered that IP address 98.194.180.10 was sharing 2 more than twenty files
that were “child notables,” meaning that “they are files that have been
observed by other law enforcement officers as being ‘child pornography.’”
(Def.’s Ex. 1 at 6). That computer was sharing “numerous other files” that “had
titles which were indicative of child porn.” (Def.’s Ex. 1 at 6). Lee conducted
additional checks of this IP address, and it repeatedly showed up as sharing
what appeared to be child pornography.3 (Def.’s Ex. 1 at 6).
2 As the appellant correctly notes in his brief, this portion of the affidavit is missing a verb. The affidavit states that Lee “located IP address 98.194.180.106 which several unique files….” (Def.’s Ex. 1 at 6). The appellant believes this renders the affidavit incomprehensible. (See Appellant’s Brief at 21-22). However, later in the same paragraph of the affidavit, Lee states that a later search of the IP address showed that it “continued to have files within its share folder and those files all have files which are indicative of being child pornographic and nature ….” (Def.’s Ex. 1 at 6). Using context clues, it is apparent that the missing verb must be “was sharing” or something similar.
3 As the appellant also correctly notes, in a single instance the affidavit specifies an IP address that differs by one numeral from the other references to an IP address in the affidavit. In three instances the affidavit refers to IP 98.194.180.106; it once, however, refers to 98.194.180.196. (Def.’s Ex. 1 at 6-7). From the context clues this must be regarded as a typographical error. The affidavit refers to an “additional check” of IP address 98.194.180.196, and states that this “additional check” shows that the IP address “continue[d]” to share child pornography, when the only check previously mentioned in the affidavit was of IP 98.194.180.106. (Def.’s Ex. 1 at 6). Additionally, the affidavit states that Lee requested information from Comcast “based upon the dates and times the IP address was seen downloading” child pornography, indicating that Lee meant to refer only to a single IP address in the affidavit. The State’s appellate counsel will also note that the numerals 9 and 0 are directly next to each other on a standard keyboard. 9 Lee then took the hash values of the files that were being shared from
this IP address and asked other investigators whether they had seen files with
those hash values. (Def.’s Ex. 1 at 7). Lee knows this method of matching files
“has proven to be extremely reliable,” and he has used hash values to match
“thousands of files and has never found two files with different contents but
the same” hash value. (Def.’s Ex. 1 at 7). On August 17, 2012, Lee procured
from other investigators copies of three video files that matched the hash
values of files being shared by the suspect IP address. (Def.’s Ex. 1 at 7-8). One
involved a girl between the ages of 5 and 8 being raped; the second involved
four girls between 11 and 14 engaging in sex with each other and with the
male cameraman; the third involved a girl between the ages of 13 and 16
engaging in oral and vaginal sex with a male. (Def.’s Ex. 1 at 8).
2. Connecting the IP to the Appellant
Lee knows that “absent fraud or intentional deception, an [IP] address is
an accurate method to find the method of internet connection for an individual
accessing the internet.” (Def.’s Ex. 1 at 8). Internet service providers “keep
accurate records that can be traced back to specific accounts if the [service
providers] are provided with accurate dates and times of [internet] use.”
(Def.’s Ex. 1 at 9).
10 After identifying the suspect IP address as being from a block of IP
addresses used by Comcast, Lee sent a grand jury subpoena to Comcast
requesting information regarding “the subscriber assigned to that IP address,
based upon … the dates and time the IP address was seen downloading what
are believed to be child pornographic images or videos.” (Def.’s Ex. 1 at 6). On
August 20, 2012, Lee received a response from Comcast. It stated that on April
4, 2012, at 8:57 pm, and on August 5, 2012 at 8:42 pm, IP address
98.194.180.106 was being used by an the appellant’s account, the address for
which was 18107 Fairhope Oak Street, Houston. (Def.’s Ex. 1 at 7). The account
was created on August 7, 2009, and was still active at the time of the grand
jury subpoena. (Def.’s Ex. 1 at 7).
When Lee ran an additional check on the IP address on December 7,
2012 using his investigative software, he saw that the IP address had been
active on one P2P network for roughly a year predating the investigation, from
August 27, 2011 through September 3, 2012. (Def.’s Ex. 1 at 6). While using
that network, the IP address had been seen using software with two Globally
Unique Identifiers (GUIDs). (Def.’s Ex. 1 at 6). While it is possible for a
computer’s IP address to change, the GUIDs used by a particular program will
remain the same unless the program is updated or uninstalled. (Def.’s Ex. 1 at
6). 11 3. “People who have a sexual interest in children …”
Based on his training and experience, Lee believes the individual at
18107 Fairhope Oak Street who was downloading and sharing child
pornography had “a sexual interest in children.” (Def.’s Ex. 1 at 12). Lee is
aware of several characteristics of such individuals. They “often collect
sexually explicit materials … depicting children, which they use for their own
sexual gratification and fantasy. (Def.’s Ex. 1 at 12). They “rarely, if ever,
dispose of their sexually explicit materials … and those materials are treated as
prized possessions.” (Def.’s Ex. 1 at 12-13).
III. All but one of the appellant’s complaints are without merit, and on that issue there is a sufficient basis in the affidavit that the trial court’s ruling was not an abuse of discretion.
The appellant raises eight specific complaints about the warrant in his
brief. The State will address them one by one.
A. The name of the online database was not necessary to show probable cause.
In his first complaint, the appellant points out that the “online database”
mentioned once in the affidavit is not named in the affidavit. (Appellant’s Brief
at 16-17). This observation is true, as far as it goes.
12 The State’s first response is that this argument is not preserved because
it was not presented to the trial court either in the appellant’s motion to
suppress (1 CR 79-81) or in his arguments to the trial court (3 RR 83-88). See
Rothstein v. State, 267 S.W.3d 366, 373 (Tex. App.—Houston [14th Dist.] 2008,
pet. ref’d) (where defendant filed generic motion to suppress and presented
certain specific arguments to trial court, other specific arguments not
presented to trial court were not preserved).
Second, the appellant gives away the insignificance of this point when he
notes that, aside from a single insubstantial reference, “this online database …
is not mentioned or described anywhere else in the voluminous affidavit ….”
(Appellant’s Brief at 16). The appellant is correct. All of the evidence
connecting the appellant to the child pornography was discovered using the
investigative software described by Lee; the importance of the “online
database” and its relation to the software are not obvious from the affidavit. If
this Court were to completely disregard anything in the affidavit relating to an
online database, it would not affect the quantum of evidence present to
support probable cause.
13 B. Lee adequately described his investigative software.
The appellant next complains that the software used by Lee “is Not
Credited within the Affidavit.” (Appellant’s Brief at 17-20). The appellant
seems confused by the fact that the affidavit describes two types of software.
First, the affidavit gives a description of the sort of software commonly used
for P2P sharing. (Def.’s Ex. 1 at 4-5). Later, the affidavit describes the
investigative software for which Lee has received specialized training and that
was used in the investigation of this case. (Def.’s Ex. 1 at 5-6).
First, this matter was not raised in the appellant’s motion to suppress or
in his arguments to the trial court, thus, on abuse-of-discretion review, it
should play no role in this Court’s decision. Rothstein, 267 S.W.3d at 373.
On the merits, though, the State does not believe the affidavit is
confusing in the least on this point. In its discussion of P2P file sharing, the
affidavit mentions the publicly-available software, stating that Lee “learned
that computer users can choose to install publicly available software that
facilitates the trading of images.” (Def.’s Ex. 1 at 5). Later, the affidavit states
that Lee “has received specialized training regarding the investigations of
[P2P] Networks in which a specialized software program developed to allow
investigators to access a variety of [P2P] Networks is used.” (Def.’s Ex. 1 at 5).
The affidavit then states that Lee “is trained and licensed to use this software”;
14 this is followed by further descriptions of the capabilities of “this software.”
(Def.’s Ex. 1 at 5-6). There is no indication anywhere in the affidavit that Lee
used any “software” other than the investigative software he described with
some detail.
Perhaps the affidavit could have been clearer had Lee used the specific
name of his investigative software, but, in light of Lee’s descriptions of its
capabilities, the name of the program would neither add to nor detract from
its reliability.
C. The missing verb is apparent from context clues.
The third complaint raised by the appellant is that there is a missing
verb in one sentence: “Your Affiant located IP address 98.194.180.106 which
several unique files, over twenty of them being labeled as child notables,
meaning they are files that have been observed by other law enforcement
officers as being ‘child pornography.’” (Def.’s Ex. 1 at 6). According to the
appellant, it is “impossible” to determine the meaning of this sentence.
(Appellant’s Brief at 21).
This matter was not raised in the appellant’s motion to suppress or at
the trial court. That indicates two things: First, neither trial counsel nor the
trial court had any apparent difficulty deciphering the meaning of this
15 sentence; second, the matter is not preserved for this Court’s review.
Rothstein, 267 S.W.3d at 373.
The appellant’s failure to raise this matter in the trial court has further
significance, because, while the sufficiency of an affidavit is normally
determined by what is contained within its four corners, a typographical error
in an affidavit can be explained through testimony at a motion-to-suppress
hearing. See Champion v. State, 919 S.W.2d 816, 818 (Tex. App.—Houston
[14th Dist.] 1996, pet. ref’d) (citing Green v. State, 799 S.W.2d 756, 760 (Tex.
Crim. App. 1990)); see also Reyes v. State, 02-11-00327-CR, 2013 WL 1338023,
at *3 (Tex. App.—Fort Worth Apr. 4, 2013, no pet.) (mem. op. not designated
for publication) (collecting cases). Had the appellant raised this matter in the
trial court, the parties could have questioned Lee as to what the missing word
was.
As a final note on this point, as the State observed in Footnote 2 of this
brief, the context in which this sentence occurs makes apparent that the
missing verb was “was sharing” or something similar. Two sentences later the
affidavit notes that “an additional check” of the IP address “show[ed] the IP
has continued to have files within its shared folders and those files all have
files [sic.] which are indicative of being child pornographic in nature. ….” (Def.’s
Ex. 1 at 6). In this context (and, indeed, in the larger context of the affidavit 16 itself, which is seeking to establish probable cause that a particular IP address
associated with the appellant was sharing child pornography), it would be
passingly strange if the missing verb were something that did not indicate the
suspected IP address was sharing child pornography.
D. The affidavit elsewhere describes in detail some of the child pornography found on the suspect IP address, thus whether the phrase “labeled as child notables” was “conclusory and uncredited” is irrelevant, as it was not necessary for the probable-cause determination.
The appellant’s next complaint is that the affidavit’s use of the phrase
“labeled as child notables” “is conclusory and uncredited. (Appellant’s Brief at
22). The State’s first response, again, is that this complaint was not made
either in the appellant’s motion to suppress or in his argument to the trial
court, thus it should not factor into this Court’s determination of whether the
trial court abused its discretion. Rothstein, 267 S.W.3d at 373.
Second, this part of the affidavit is merely describing the investigation
and is not essential for determining probable cause. Later in the affidavit, Lee
went into graphic detail regarding three of the files that were being shared by
the suspected IP address, and that should be more than sufficient to show
probable cause even if this Court disregards the “labeled-as-child-notables”
line.
17 E. There was information regarding only one IP address; the “different” IP address mentioned in the affidavit was obviously a typo, as the trial court determined.
In his fifth complaint, the appellant notes that in three instances the
affidavit refers to IP address 98.194.180.106, but in one instance in the middle
of these references the affidavit refers to IP address 98.194.180.196.
(Appellant’s Brief at 23-24). The appellant presented this argument at the
motion-to-suppress hearing, and the trial court determined that the reference
to 98.194.180.196 was a typo and should have read 98.194.180.106. (3 RR 93-
94).
Lee testified at the hearing before the trial court, and while he did not
explicitly state that the reference to 98.194.180.196 was a typo, it could easily
be inferred from his testimony, from the nature of the questioning, and from
the affidavit itself. Lee testified that in this case he investigated IP address
98.194.180.106. (3 RR 21). Throughout the hearing the parties questioned Lee
about this IP address, and in seemingly every instance the questioning was
phrased in the singular (i.e. the investigation involved only one IP address),
and Lee responded, likewise, in the singular. (See, e.g., 3 RR 33 (Defense
Counsel: “Is that the day you found out who the IP belonged to and what
address it was coming from?” Lee: “That’s the date I found out that the IP
address was assigned to that account.”)). Most tellingly, at one point the
18 prosecutor asked Lee “how many dates did you verify that child pornography
was available for trade from that particular IP address you mentioned earlier,”
and Lee responded: “Two days.” (3 RR 55). The affidavit mentions viewing
child pornography on an IP address on two dates, but it refers to different IP
addresses for each date. (Def.’s Ex. 1 at 6). Thus, Lee’s testimony that on two
dates he viewed child pornography on the same IP address is, effectively,
testimony that the reference to IP 98.194.180.196 was a typo.
The conclusion that the reference to 98.194.180.196 was a typo is also
supported by the affidavit itself. When IP address 98.194.180.196 is
mentioned, it follows a mention to a check performed on IP 98.194.180.106
and states that an “additional check” was performed on 98.194.180.196,
which “continued to have” child pornography available for sharing. (Def.’s Ex.
1 at 6). Reading the reference to IP 98.194.180.196 as a typo makes sense of
the paragraph. Reading it, as the appellant does, as a reference to a second IP
address renders half the paragraph nonsensical. It is obvious from the
surrounding context that this was a typo, and the trial court had testimony
supporting its conclusion that it was a typo. See Champion, 919 S.W.2d at 818.
This Court should defer to the trial court’s determination that this was a typo
and not a wholly nonsensical paragraph.
19 F. The appellant’s sole legitimate complaint — regarding the imprecise connection between the suspect IP address and the appellant’s residence — is unpreserved. If this Court addresses it, it is a question of first impression and this Court should defer to the inferences drawn by the magistrate and the trial court.
The most serious problem with this affidavit is that it does not explicitly
connect the appellant to the suspected IP address at the precise moments
when the IP address was sharing child pornography. The appellant raises this
matter in his brief. (See Appellant’s Brief at 25-29). At trial, however, the
appellant’s only argument related to IP addresses was that the appellant’s IP
address could have changed between the date that Lee subpoenaed Comcast
and the date the warrant issued. (3 RR 86 (“[W]hat I’m getting to, this does not
refer to the fact that at a certain time it belonged to him and necessarily
belonged to him in December or in November.”), 92-93). That is a different
(and irrelevant) issue. This Court should disregard this appellate complaint as
unpreserved, particularly because the record shows that the trial court
labored under an incorrect interpretation of the affidavit that could have been
corrected had trial counsel pointed it out. See Rothstein, 267 S.W.3d at 373.
The appellant’s appellate complaint, though unpreserved, is well taken.
Reading it in the light most favorable to the trial court’s findings, the affidavit
states that Lee observed IP 98.194.180.106 sharing and/or downloading child
20 pornography on August 9, November 13, and December 7. (Def.’s Ex. 1 at 6). It
then states that Lee subpoenaed Comcast regarding which subscriber was
using that IP address “based upon … the dates and time the IP address was
seen downloading what are believed to be child pornographic images or
videos.” (Def.’s Ex. 1 at 6). Comcast responded to this subpoena stating that the
suspect IP address was being used by the appellant at particular times on
April 4 and August 5. (Def.’s Ex. 1 at 6).
Had the affidavit connected the IP address to the appellant’s account at
the precise time the IP address was sharing or downloading child
pornography, the caselaw is clear that this would have been adequate to
establish probable cause. See, e.g., United States v. Vosburgh, 602 F.3d 512, 518,
527 (3d Cir. 2010) (so holding, and collecting cases). What is not clear, though,
is how close in time the affidavit must connect the IP address to the suspect.
The Texas cases the State can find have determined that probable cause
existed if the IP address is “associated” with the suspect, or if it has been
“assigned” to the suspect, but those cases have not specified whether the
evidence showed that the IP address was “associated” with or “assigned” to
the suspect at the precise moment illegal activity was observed. See, e.g.,
Barrett v. State, 367 S.W.3d 919, 923 (Tex. App.—Amarillo 2012, no pet.) (IP
address “associated” with suspect); Gardner v. State, 433 S.W.3d 93, 100 (Tex. 21 App.—Houston [1st Dist.] 2014, pet. ref’d) (IP address “assigned to” suspect).
The State can find no case, either in Texas or in the federal courts, where an
affidavit connected the suspect to the offending IP address but not at the
precise moment the illegal activity occurred, and the appellant has cited to no
such case.
At the motion-to-suppress hearing, the trial court focused on the next
paragraph of the affidavit, which stated that the appellant’s Comcast account
“was created on 07/09/2009 and is currently active on [August 20, 2012].”
(Def.’s Ex. 1 at 7). The trial court believed this meant that the appellant had
had the same IP address for the entire period his account was active: “[T]he
information in the search warrant that the officer got from the grand jury
subpoena from Comcast shows that this IP address was created on July 9th of
2009 for this defendant at this address and remained with him at least up
until the point of, I guess, August 9th of 2012.” (3 RR 89-90).
Nothing in the affidavit directly supports or refutes this belief. Trial
counsel did not apprise the trial court that this belief was incorrect.
There is still a substantial basis in the affidavit for a magistrate to find
that the appellant had the offending IP address at the time it was seen
downloading and/or sharing child pornography. First, the affidavit states that
Lee subpoenaed Comcast for subscriber information “based upon the dates 22 and time the IP address was seen downloading what are believed to be child
pornographic images or videos.” (Def.’s Ex. 1 at 6). It is a fair inference from
these facts that Lee had observed this IP address downloading child
pornography on April 4 and August 5 but had not mentioned it explicitly in his
affidavit.4 See Rodriguez v. State, 232 S.W.3d 55, 62 (Tex. Crim. App. 2007)
(“The inquiry for reviewing courts, including the trial court, is whether there
are sufficient facts, coupled with inferences from those facts, to establish a ‘fair
probability’ that evidence of a particular crime will likely be found at a given
location.”). Certainly this inference is at least as fair as inferring that Lee had
subpoenaed information for relevant dates but Comcast had replied with
more-or-less random information.
G. The appellant’s complaint about Lee’s “method” of comparing hash values is irrelevant.
In his brief, the appellant complains that Lee “did not use valid
techniques to compare the hash values” of the files found on the appellant’s
computer to known child pornography. (Appellant’s Brief at 29-31). In the
trial court, most of the appellant’s arguments related to the hash value
comparison. (3 RR 83-85, 87-88).
4 Lee testified to as much at the motion-to-suppress hearing. (3 RR 56).
23 The appellant’s complaint is both meritless and irrelevant. In his brief,
the appellant bases his complaint on a statement in the affidavit where Lee
states that his software “allows investigators to compare the digital hash
values of the offered files to the hash values of known child pornography
provided by the National Center for Missing and Exploited Children, which
acts as a clearinghouse for images and videos of Child Pornography.” (Def.’s Ex.
1 at 6). From this statement, the appellant draws the conclusion that
comparing hash values to images from the National Center for Missing and
Exploited Children is the only appropriate method to determine from a file’s
hash values if it contains child pornography. (Appellant’s Brief at 29-30). This
conclusion has no basis in the affidavit and is facially absurd, as it suggests
that no one other than the National Center for Missing and Exploited Children
is capable of determining whether a file contains child pornography.
The affidavit clearly lays out Lee’s method in this case and his basis for
believing it was reliable. He obtained the hash values of files that were being
shared by the appellant’s computer. He then asked other law officers if they
had seen files with those hash values. He obtained copies of three files that
matched those hash values. See Pair v. State, 184 S.W.3d 329, 338 (Tex. App.—
Fort Worth 2006, no pet.) (when law enforcement officer swears out affidavit
and describes getting information from other officers, that information is 24 presumed credible). He stated that, to his knowledge, there have never been
two files with the same hash values but different content. He also stated that
he had personally matched up “thousands” of files by using their hash values.
And he described in graphic detail the contents of the files that matched the
hash values of the files the appellant was sharing. Nothing in the appellant’s
brief undermines the validity of the hash-value comparison Lee performed in
this case.
H. The information in the affidavit connecting child pornography to the appellant’s residence was not stale.
In his next complaint, the appellant points out that, while the affidavit
connects the appellant and his internet account to 18107 Fairhope Oaks in
August (via the subpoena return from Comcast), the affidavit was not sworn to
until December 10, and nothing in the affidavit indicates that police did
anything to confirm that the appellant was still living at the address in
December. (Appellant’s Brief at 31-32). The appellant claims that this four-
month gap in information renders the affidavit stale.
However, the affidavit, read in the light most favorable to the trial court’s
ruling, includes information that the appellant had had this internet account at
this address for more than three years at the time of the subpoena return.
25 (Def.’s Ex. 1 at 7). This is how the trial court interpreted the affidavit. (3 RR 89-
90).
The State can find no Texas case describing how long information
regarding an individual’s residence remains fresh enough to support a
warrant for that residence, and the appellant does not cite to any. The State
would direct this Court to the case of United States v. Bervaldi, 226 F.3d 1256
(11th Cir. 2000). That case dealt with the execution of an arrest warrant; the
police executed an arrest warrant at a particular address on the basis of
information that the suspect had lived there six months earlier. Bervaldi, 226
F3d 1265. On appeal, Bervaldi complained that the police did not have a
“reasonable belief” — the standard required by the Supreme Court in order to
allow police to serve an arrest warrant at a particular location — that he
would be at that residence. Ibid.
The Eleventh Circuit began its analysis by recognizing that, while
“reasonable belief” was a different standard than “probable cause,” the same
general rules of staleness would apply to both situations. Ibid. The Bervaldi
court compared the situation to cases where affidavits had described ongoing
criminal activity at a location or bullets in the walls of a location and
concluded that, because of the nature of what was described in the affidavit,
probable cause did not dissipate as quickly as it would if the affidavit 26 described a single drug transaction at a location. Id. at 1265 (citing United
States v. Diecidue, 603 F.2d 535, 560 (5th Cir. 1979) (four-month-old
information about bullets in floors and walls of searched location not stale)).
“Residency in a house, like protracted and continuous criminal activity or
projectiles embedded in the house's walls and floors, generally is not
transitory or ephemeral, but instead endures for some length of time.”
Bervaldi, 226 F.3d at 1265.
In this case, the affidavit gave information that the appellant had lived a
particular location for several years. That location, as described in the
affidavit, was not an apartment or vacation rental, but a single-family
suburban home. (Def.’s Ex. 1 at 1). Given those facts, the State believes that
whatever probable cause to believe that the appellant lived at this address in
August had not become stale by the time the warrant issued four months later.
As for the information regarding the child pornography itself, the
affidavit in this case stated that those who download child pornography tend
to collect it and hold it as “prized possessions,” and tend to keep it even if they
move or change computers. (Def.’s Ex. 1 at 12-13). When an affidavit contains
such statements and details the ongoing possession of child pornography, the
information will be “fresh,” for probable-cause purposes, for a lengthy period
of time. See State v. Cotter, 360 S.W.3d 647, 654 (Tex. App.—Amarillo 2012, no 27 pet.) (four months); Sanders v. State, 191 S.W.3d 272, 279 (Tex. App.—Waco
2006, pet. ref’d) (seventeen months); United States v. Hay, 231 F.3d 630, 636
(9th Cir. 2000) (six months); United States v. Morales-Aldahondo, 524 F.3d 115,
119 (1st Cir. 2008) (forty-four months).
In sum, while the appellant may be correct that it might have been
better for Lee to have updated some of his information sometime between
August and December, it is not this Court’s role to determine what he should
have done. The only question on appeal is whether what he did do provided
the magistrate with a substantial basis for finding probable cause. The
caselaw, both of this State and of the federal courts, indicates that the
information Lee provided in his affidavit was still fresh enough to support a
finding of probable cause.
28 Conclusion
The State respectfully submits that under the applicable standard of
review the trial court was within its discretion to deny the motion to suppress,
and this Court should affirm that decision.
DEVON ANDERSON District Attorney Harris County, Texas
/s/ C.A. Morgan CLINTON A. MORGAN Assistant District Attorney Harris County, Texas 1201 Franklin, Suite 600 Houston, Texas 77002-1923 (713) 755-5826 Texas Bar No. 24071454
29 Certificate of Compliance and Service
I certify that, according to Microsoft Word’s word counting function, the
portion of this brief for which Rule of Appellate Procedure 9.4(i)(1) requires a
word count contains 6,380 words.
I also certify that I have requested that efile.txcourts.gov electronically
serve a copy of this brief to:
Sarah V. Wood sarah.wood@pdo.hctx.net
/s/ C.A. Morgan CLINTON A. MORGAN Assistant District Attorney Harris County, Texas 1201 Franklin, Suite 600 Houston, Texas 77002-1923 (713) 755-5826 Texas Bar No. 24071454
Date: April 20, 2015