State v. Helland

2005 SD 121, 707 N.W.2d 262, 2005 S.D. LEXIS 184

• Court: South Dakota Supreme Court
• Decided: December 7, 2005
• Docket: None
• Status: Published

Opinions

GILBERTSON, Chief Justice.

[¶ 1.] Charles Edwin Helland (Helland) filed a motion in circuit court to suppress evidence obtained in a search of his computer and office at his employer’s place of business. The circuit court judge suppressed the evidence, holding the affidavit was misleading because of the omission of material information. We reverse.

FACTS AND PROCEDURE

[¶ 2.] On June 11, 2004, Kevin Elsing, vice-president of Elbo Computing Resources and a computer technician by trade, was called to service Helland’s computer at his employer’s place of business. Elsing noticed Helland minimized the computer screen when Elsing entered the office. When Elsing began working on the computer, he was able to see that the screen Helland had minimized was a web page dealing with people’s first experience with incest. Elsing loaded antivirus¹ and antispyware² software on Helland’s computer and concluded the service call.

[IT 3.] Elsing’s next contact with Hel-land occurred on November 22, 2004, after receiving an email requesting service on Helland’s computer. The email stated Helland’s computer had lost access to the office network, was not printing properly and was not accessing Microsoft Word. Elsing arrived at Helland’s office the morning of November 23, 2004, and began his work by updating the previously installed antivirus and antispyware software and removing spyware from the system. Elsing removed several spyware files from the system to determine if these files were the cause of the software errors. Elsing then began a scan of the system using a web-based scan engine called house-call.trendmicro.com. The scan was taking a long time to complete, and to speed up the process Elsing decided to delete the contents of the “temporary internet files” folders on Helland’s computer. Elsing noticed that the deletion was taking a long time and the system did not seem to be deleting the temporary internet files as requested. Elsing then decided to look into the “temporary internet files” folders to see if files were being deleted.

[¶ 4.] Upon opening the “temporary internet files” folders, Elsing found dozens of suggestive and suspicious graphic file names such as “hot boys” and “teen boys.” Elsing opened some of these temporary internet files and found images of young nude males. Elsing noted that one image depicted two boys approximately eight to ten years of age, naked, sitting on the shore of a lake or stream, side by side, hands behind them, with their legs spread. Shocked and in disbelief about what he was seeing, Elsing began opening other files that contained similarly disturbing images. Fearing he was deleting the temporary internet files, Elsing stopped the deletion process and created a new folder called “older” and copied the index.dat³ file and a few of the temporary internet files into this newly created folder. Elsing left without finishing the service call, but planned to return later that afternoon.

[¶ 5.] Alarmed by what he saw, Elsing returned to Elbo Computing to discuss the details with his business partner. Elsing felt his discoveries might have triggered the provisions of SDCL 22-22-24.18,⁴ the mandatory reporter statute that requires computer repair technicians to report suspected violations of child pornography laws. Ultimately, Elsing decided that the mandatory reporter provisions in SDCL 22-22-24.18 required him to contact the police given his discovery of images of child pornography in the temporary internet files oh Helland’s computer.

[¶ 6.] Later that afternoon, Elsing contacted Marvin D. Thorstenson, a detective with the Minnehaha County Sheriffs Office assigned to the Internet Crimes Against Children Task Force. Elsing told Detective Thorstenson about the images of child pornography contained in the temporary internet files and the incest web page incident. Elsing also told Detective Thor-stenson that Helland had previously told Elsing that he was a Boy Scout Troop Leader and that he had an older fax machine at the Boy Scout Troop building that was great for printing off still images. Finally, Elsing told Detective Thorstenson that Helland had several floppy disks near the computer work station, a disk drive, and a compact disk burner attached to the computer that would allow files to be transferred from the computer to compact disks. Elsing then returned to Helland’s office and finished the service call by reloading printer drivers.

[¶ 7.] Detective Thorstenson applied for a search warrant based on this information. In his affidavit, Detective Thor-stenson provided a large amount of background information concerning how the internet is used to facilitate crimes against children. The affidavit included a section on collateral evidence that law enforcement officers expect to find during a search of the computer of an individual suspected of possession of child pornography, a section on how a computer serves as a repository of evidence in such cases, another section on the need to remove the computer from the scene in order to search it with sophisticated software programs, and finally a section on the need to seize programs and peripherals to assist in the evaluation of the data contained on the computer. In all, the background material comprised eleven paragraphs of the affidavit, almost three full pages of the five and one-half page document.

[¶ 8.] The remaining pages of the affidavit included a detailed account of the information provided to Detective Thor-stenson by Elsing, organized into seventeen enumerated paragraphs. In paragraph nine (9), Detective Thorstenson identified the files being worked on by Elsing as “temporary internet files.” The same descriptor was used in paragraphs ten (10), and twelve (12). However, in paragraphs eleven (11) and thirteen (13), Detective Thorstenson refers to “some files” and “these files” when discussing the images observed in the temporary internet files opened by Elsing.

[¶ 9.] Based on the affidavit, a search warrant was issued by a circuit court judge for evidence of the commission of the crime of possession and distribution of child pornography including contraband, the fruits of crime, or things otherwise criminally possessed, and things designed or intended for use in, or which were used as a means of, committing the offense of possession and distribution of child pornography. The scope of the search was limited to Helland’s office at his employer’s place of business for “[a]ll computer systems to include programs used to create the text or capture & modify images, all programs found near the computer system, data files, removable media such as data tape, magneto optical disks or similar storage, passwords and access codes written on pieces of paper near the computer.” The search revealed “a tremendous amount of child pornography” in two different desk drawers in Helland’s office. Based on the evidence seized, Helland was indicted on twenty counts of Possession of Child Pornography in violation of SDCL 22-22-24.2(3).⁵ None of the indictments were for the images originally found by Elsing in the temporary internet file folders.

[¶ 10.] Helland filed a motion to suppress the evidence and a hearing was held on the matter. The suppression court granted Helland’s motion, holding that the affidavit in support of the search warrant failed in two respects. First, the suppression court found that the affidavit failed to explain the nature of temporary internet files. Second, the court held that the affidavit failed to set forth the fact that the files observed by Elsing were all temporary internet files. The suppression court held that the affidavit should have specified that temporary internet files may not be user created, but rather may result from actions taken by the computer without the user’s knowledge. In addition, the suppression court held the affidavit should have stated that the evidence discovered by Elsing consisted exclusively of temporary internet files. The suppression court found Detective Thorstenson recklessly misled the issuing court by omitting the background material on temporary internet files and by failing to state that all files viewed by Elsing were temporary internet files. The suppression court held that once the affidavit was supplemented with the omitted material, there was insufficient probable cause for issuance of the search warrant. As a consequence, the suppression court ordered all evidence seized from Helland’s office suppressed.

[¶ 11.] The State appeals from the order suppressing the evidence obtained from Helland’s computer and desk drawer raising three issues:

1. Whether the suppression court erred when it held that the issuing court had insufficient probable cause to issue the search warrant.

2. Whether Detective Thorstenson recklessly made false or misleading statements in his affidavit, or recklessly withheld material information from the affidavit, so as to invalidate the search warrant.

3. Whether the good faith exception to the exclusionary rule applies when officers reasonably rely upon a search warrant that is later deemed invalid as a result of insufficient probable cause.

STANDARD OF REVIEW

[¶ 12.] Our standard of review for a challenge to the sufficiency of the evidence supporting a search warrant requires us to look “at the totality of the circumstances to decide if there was at least a ‘substantial basis’ for the issuing judge’s finding of probable cause.” State v. Schwartz, 2004 SD 123, ¶ 21, 689 N.W.2d 430, 436 (quoting State v. Jackson, 2000 SD 113, ¶ 8, 616 N.W.2d 412, 416 (citing Illinois v. Gates, 462 U.S. 213, 238-39, 103 S.Ct. 2317, 2332, 76 L.Ed.2d 527 (1983))). On review, our inquiry is limited to determining whether the information provided to the issuing court in the warrant application was sufficient for the judge to make a “ ‘common sense’ determination that there was a ‘fair probability’ that the evidence would be found on the person or at the place to be searched.” Jackson, 2000 SD 113, ¶ 8, 616 N.W.2d at 416. On review, we are limited to an examination of the facts as contained within the four corners of the affidavit. Id. ¶ 11, 616 N.W.2d at 416 (quoting State v. Lodermeier, 481 N.W.2d 614, 622 (S.D.1992) (quoting State v. Iverson, 364 N.W.2d 518, 522 (S.D.1985); State v. Smith, 281 N.W.2d 430, 433 (S.D.1979))). Furthermore, we review the issuing court’s probable cause determination independently of any conclusion reached by the judge in the suppression hearing. Jackson, 2000 SD 113, ¶ 8, 616 N.W.2d at 416 (citing United States v. Hibbard, 963 F.2d 1100, 1101 (8thCir.1992); United States v. Anderson, 933 F.2d 612, 614 (8thCir.1991)).

ANALYSIS AND DECISION

[¶ 13.] 1. Whether the suppression court erred when it held that the issuing court had insufficient probable cause to issue the search warrant.

[¶ 14.]The text of the Fourth Amendment provides:

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

US Const. amend. IV. The Fourth Amendment’s prohibition against unreasonable searches “generally require searches of persons and places to be authorized by warrant and require such warrants to be based on probable cause to believe that the search will yield contraband or other evidence of a crime.” State v. Shearer, 1996 SD 52, ¶ 10, 548 N.W.2d 792, 795 (citing State v. Zachodni, 466 N.W.2d 624, 627 (S.D.1991)).

[¶ 15.] There is no “formulaic solution” for determining the amount of evidence required to form probable cause. Jackson, 2000 SD 113, ¶ 22, 616 N.W.2d at 420 (citing People v. Fino, 14 N.Y.2d 160, 250 N.Y.S.2d 47, 199 N.E.2d 151, 153 (1964)). Rather, “[p]robable cause lies somewhere between mere suspicion and the trial standard of beyond a reasonable doubt.” Heib v. Lehrkamp, 2005 SD 98, ¶ 21, 704 N.W.2d 875, 884 (citing Beck v. Ohio, 379 U.S. 89, 91, 85 S.Ct. 223, 225-26, 13 L.Ed.2d 142 (1964); and Charles H. Whitebread Christopher Slobogin, Criminal Procedure 3.03 (4th ed 2000)). It is a fluid concept that requires an “assessment of probabilities in particular contexts[,]” and must be evaluated by balancing “the government’s need to enforce the law with a citizen’s right to privacy[.]” Jackson, 2000 SD 113, ¶ 22, 616 N.W.2d at 420.

[¶ 16.] We have previously articulated the standard for determining the existence of probable cause sufficient to support the issuance of a search warrant:

There need not be a prima facie showing of legal evidence of a suspected act. The standard of probable cause for the issuance of a search warrant is a showing of probability of criminal activity. [State v. Gerber, 241 N.W.2d 720 (SD 1976); and State v. Haron, 88 S.D. 397, 220 N.W.2d 829 (S.D.1974) ]. In addition to the reasonable ground to believe that some violation of the law exists, probable cause for a search warrant necessarily implies that there is a violation in respect to some property located on some premises, or on some person, which can be identified expressly or by reasonable inference from the information given in the affidavit so as to be capable of being particularly described in the warrant. See State v. Hermandson, 84 S.D. 208, 169 N.W.2d 255 (1969).

State v. Kaseman, 273 N.W.2d 716, 723 (S.D.1978) (emphasis added). On review, this Court limits its inquiry to whether the information contained in the affidavit presented to the issuing court was sufficient for that judge to arrive at a “common sense” conclusion that there was a “fair probability” that a crime had been committed and that the evidence named in the affidavit would be found on the person or at the place to be searched. Jackson, 2000 SD 113, ¶ 8, 616 N.W.2d at 416.

[¶ 17.] When reviewing a challenge to the sufficiency of a search warrant, we will not consider evidence that was not before the issuing court at the time the warrant was issued. Id. ¶ 11 (citing Smith, 281 N.W.2d at 433 (citing Gerber, 90 S.D. 432, 241 N.W.2d 720)). Our examination is limited to the four corners of the affidavit. State v. Raveydts, 2004 SD 134, ¶ 9, 691 N.W.2d 290, 293. “Reviewing courts are not empowered to conduct an after-the-fact de novo probable cause determination; on the contrary, the issuing court’s legal basis for granting the warrant is examined with ‘great deference.’ ” Jackson, 2000 SD 113, ¶ 9, 616 N.W.2d at 416 (citing Gates, 462 U.S. at 236, 103 S.Ct. at 2331, 76 L.Ed.2d at 527). Furthermore, we will draw every reasonable inference possible in support of the issuing court’s determination of probable cause to support the warrant. State v. Habbena, 372 N.W.2d 450, 456 (S.D.1985) (citing State v. Wellner, 318 N.W.2d 324, 327 (S.D.1982)). This deferential standard “is appropriate to further the Fourth Amendment’s strong preference for searches conducted pursuant to a warrant.” Jackson, 2000 SD 113, ¶ 9, 616 N.W.2d at 416 (citing Massachusetts v. Upton, 466 U.S. 727, 733, 104 S.Ct. 2085, 2088, 80 L.Ed.2d 721, 727 (1984)).

[¶ 18.] In the instant case, the issuing court was presented with information indicating that Elsing had personally seen dozens of suspicious files with names such as “hot boys” and “teen boys” in the temporary internet file folders on Helland’s computer. The affidavit also indicated that Elsing had seen several photographic images of nude young males contained in files on the computer, and specifically described one in which two nude eight-or ten-year-old male children were sitting side by side with their legs spread, facing the camera. The affidavit clearly indicated that Elsing was looking at. temporary internet files contained in temporary internet file folders when he made the initial discovery of suspicious files names, although it does not state with specificity that each and every image of child pornography found by Elsing was located in a temporary internet file.

[¶ 19.] It is also clear from the affidavit that Elsing told Detective Thorstensen that Helland’s employer owned the computer in question. The affidavit also states that Elsing personally knew from his work at the employer’s place of business that this particular computer had been located in Helland’s office for the previous twelve months, and that it was connected to the internet. The affidavit also noted that Helland’s computer was attached to a printer, a CD burner and had a disk drive.

[¶ 20.] Helland argued at the suppression hearing that there was nothing in the affidavit for the issuing court to conclude that Helland had caused the images of child pornography to be stored on the temporary internet file folders, and was therefore not in knowing possession of child pornography in violation of SDCL 22-22-24.2(3). Helland argued that the images could have been sent through pop-up ads while he was accessing legal websites that did not contain child pornography. Under this theory, the images of child pornography contained in the pop-ups would have recorded themselves in the temporary internet files without any action on the part of Helland as the computer user.

[¶ 21.] At the hearing, the suppression court questioned Elsing as to the nature of temporary internet files and how such files are created on a computer. When Elsing failed to include in his explanation that pop-up ads could generate temporary internet files without any knowledge or action on the part of the user, the suppression court excused Elsing from the witness stand, stating that Elsing had no credibility with the court.

[¶ 22.] During the suppression hearing, Detective Thorstenson was also asked about his knowledge of temporary internet files and how such files may be generated by the computer user or by the actions of pop-up ads. Thorstenson conceded that the files could be created by both methods, and that he did not recall asking Elsing if he had seen user created files containing child pornography on Helland’s computer. Thorstenson also conceded that determining how the files came to be on the computer would be relevant in determining if Helland had committed the crime of knowing possession of child pornography.

[¶ 23.] In its findings of fact and conclusions of law, the suppression court included a lengthy explanation of temporary internet files and how such files can be created through active conduct on the part of a computer user as well as by pop-up ads. "The suppression court concluded as a matter of law that the affidavit should have included an explanation of temporary internet files, and should have stated in each reference to “files,” that the files in question were “temporary internet files,” because “any reasonable person would have known that an explanation of temporary internet files was necessary to thoroughly inform the issuing court.” The suppression court theorized that without the information concerning pop-up ads, the issuing court could not determine whether the child pornography images were placed on Helland’s computer by his own actions or by the computer’s own independent reactions to pop-up ads. Finally, the suppression court held that where the images were found on the computer and how the images came to be on the computer were issues determinative of whether probable cause existed to issue the search warrant.

[¶ 24.] We have never required an affidavit in support of a search warrant to state with particularity how contraband materials such as child pornography came to be at the location to be searched in order to support a finding of probable cause. That level of particularity does not apply to the search of a place where contraband or fruits or instrumentalities of a crime are believed to be located. See Zurcher v. Stanford Daily, 436 U.S. 547, 555, 98 S.Ct. 1970, 1976, 56 L.Ed.2d 525 (1978).⁶ The standard for a search warrant does not require such particularity with regard to who obtained the contraband, because “[s]earch warrants are not directed at persons; they authorize the search of ‘places’ and the seizure of ‘things,’ and as a constitutional matter they need not even name the person from whom the things will be seized.” Id. (citing United States v. Kahn, 415 U.S. 143, 155, n.15, 94 S.Ct. 977, 984, n.15, 39 L.Ed.2d 225, n.15 (1974)). Therefore, who placed the child pornography into the temporary internet files on Helland’s computer, and how they were placed there are issues immaterial to a finding of probable cause.

[¶ 25.] How the child pornography came to be on Helland’s computer is relevant to determining whether Helland was in knowing possession in violation of SDCL 22-22-24.2(3), as knowledge is an element of the crime of possession of child pornography. As such, the State must prove the existence of knowledge on Hel-land’s part beyond a reasonable doubt at trial in order to obtain a conviction,⁷ A pop-up defense goes to the issue of whether a defendant was in knowing possession of child pornography, because the pop-up defense is designed to show the computer obtained the images without the operator’s knowledge. See Ty E. Howard, Don’t Cache Out Your Case: Prosecuting Child Pornography Possession Laws Based on Images Located in Temporary Internet Files, 19 Berkeley Tech. L.J., 1227 (2004). While such a defense may be relevant at trial in disputing the element of knowledge, the place and time for that consideration is at trial and not at a suppression hearing.

[¶ 26.] The information in the affidavit made it clear that dozens of pornographic images of children were found in the temporary internet files on Helland’s computer, a fact Helland does not dispute.⁸ It was reasonable for the issuing court to infer from the existence of these images that someone had committed the crime of possession or distribution of child pornography. However, at the point in time that the issuing court approved the search warrant it was not necessary for it to have legal evidence establishing how the images came to be on the computer or whose actions had caused the images to be on Helland’s computer. The issuing court had all the facts that it needed to establish that it was “fairly probable” that someone had committed the crime of possession of child pornography, thus satisfying the first inquiry under the probable cause standard for issuing a search warrant.

[¶ 27.] It was also reasonable for the issuing court to conclude there was a “fair probability” based on the dozens of suspicious file names in the temporary internet file folders and the images viewed by Els-ing that those same images would still be located in the computer’s temporary internet files and be discovered during the search. Finally, it was reasonable for the issuing court to infer that additional images of child pornography might be contained on the computer or on disks, CDs or in printed form in the office, as Hel-land’s computer was attached to a printer, a CD burner and had a disk drive that were available to further manipulate, view, store or print out the images.

[¶ 28.] The suppression court erred when it considered evidence not contained in the affidavit to conclude there was insufficient probable cause to issue the warrant. The suppression court entered into its findings of fact and conclusions of law a substantial amount of information on the nature of temporary internet files that was not before the issuing court. The suppression court also erred when it elevated the issuing court’s evidentiary standard by requiring that the affidavit contain facts that indicated how the images of child pornography came to be on the computer.

[¶ 29.] All the issuing court and suppression court needed to consider was whether the presence of dozens of images of child pornography in the temporary internet file folders on Helland’s computer, as attested to in the affidavit, constituted sufficient probable cause to conclude that there was a fair probability that the crime of possession of child pornography had been committed and that the search of Helland’s computer and office would reveal evidence of the crime. Based on the information as contained in Detective Thorsten-son’s affidavit, we conclude it was reasonable for the issuing court to determine that there was probable cause to conclude that the crime of possession of child pornography had been committed, and that evidence of that crime would be found either on Helland’s computer or in his office. We therefore hold the warrant was supported by probable cause and that the evidence obtained in the search should not be suppressed.

[¶ 30.] 2. Whether Detective Thor-stenson recklessly made false or misleading statements in his affidavit, or recklessly withheld material information from the affidavit, so as to invalidate the search warrant.

[¶ 31.] The suppression court concluded Detective Thorstenson recklessly withheld material information from the affidavit that amounted to misleading statements. The suppression court based its conclusion on Thorstenson’s 1) failure to specify that the evidence discovered by Elsing consisted exclusively of temporary internet files, and 2) failure to include a description of temporary internet files that informed the issuing court that “temporary internet files may not be user created, but rather may result from actions taken by the computer without -the user’s knowledge.” The suppression court did not find that Detective Thorstenson recklessly made false statements.

[¶ 32.] An affidavit that is purported to contain recklessly and intentionally misleading information or material omissions is reviewed under the two-part analysis in Franks v. Delaware, 438 U.S. 154, 98 S.Ct. 2674, 57 L.Ed.2d 667 (1978). State v. Brings Plenty, 459 N.W.2d 390, 401 (S.D.1990) (citing Habbena, 372 N.W.2d 450). “First, the defendant must show by a preponderance of the evidence that a ... statement knowingly and intentionally, or with reckless disregard for the truth, was [omitted] ... by the affiant in the warrant affidavit. Second, the allegedly [omitted] ... statement must be necessary to the finding of probable cause.” Id. (citing Habbena, 372 N.W.2d at 456). Omissions will only be considered misrepresentation for purposes of the analysis, when the omissions cast doubt on the existence of probable cause. Id. (citing United States v. Dennis, 625 F.2d 782, 791 (8thCir.l980)). However, we do not read a warrant affidavit in a hyperteehnical manner. Habbena, 372 N.W.2d at 456 (citing United States v. Ventresca, 380 U.S. 102, 85 S.Ct. 741, 13 L.Ed.2d 684 (1965)); State v. Kaseman, 273 N.W.2d 716 (S.D.1978); Gerber, 90 S.D. 432, 241 N.W.2d 720; Haron, 88 S.D. 397, 220 N.W.2d 829; and State v. Kietzke, 85 S.D. 502, 186 N.W.2d 551 (1971). Instead, “we read each affidavit as a whole and interpret each in a common sense and realistic manner.” Id.

[¶ 33.] Helland argues that Detective Thorstenson knowingly and intentionally, or with reckless disregard for the truth, omitted the words “temporary internet” before the word “file” from paragraphs eleven (11) and thirteen (13) of the affidavit when describing the files containing images of child pornography as discovered by Elsing. The suppression court agreed that the omission was knowing and intentional.

[¶ 34.] However, our reading of the affidavit as a whole indicates that the references to “temporary internet files” in paragraphs nine (9), ten (10) and twelve (12), make it clear that the entire affidavit is describing the contents and names of tern-porary internet files. The shortening of the descriptor from “temporary internet files” to “some files” and “these files” in paragraphs eleven (11) and (13) is apparent as no other file location is specified for the images containing child pornography.

[¶ 35.] Therefore, we conclude that Helland has failed to satisfy the first prong of the analysis as there is no evidence that an omission exists. Even if we were to conclude that an omission was committed by Thorstenson and proceed to the second prong of the Franks v. Delaware test, there is no evidence in the affidavit or in the suppression hearing transcript to support a finding that the omission was done recklessly or intentionally to mislead the issuing court.

[¶ 36.] Helland has failed to satisfy the Franks v. Delaware test for recklessly and intentionally misleading information or material omissions in an affidavit. There was no material omission in the affidavit. Therefore, there cannot be any reckless or intentional conduct on the part of Detective Thorstenson that prejudiced Helland.

[¶ 37.] Based on our holdings in Issues 1 and 2, there is no need to address the good faith exception to the exclusionary rule in Issue 3. We reverse.

[¶ 38.] SABERS, KONENKAMP and ZINTER, Justices, concur. [¶ 39.] MEIERHENRY, Justice, concurs in result.

1 . Antivirus software is designed to protect a computer from viruses, worms, Trojan horses, and other programs designed to attack a computer and perform malicious acts such as deleting files, accessing personal data, or using the computer to attack other computers. http://www.micros oft.com/athome/security/protect/antivirus.mspx (last visited December 5, 2005).

2 . Spyware is software that installs itself onto a user’s computer and performs specific and usually unwanted tasks without the user’s consent. These functions include delivering unwanted advertising or collecting personal information about the user. Signs of spyware infection include pop-up ads, the alteration of internet settings such as home page or search page settings, the sudden appearance of additional software and tool bars. Antispyware is software designed to remove these harmful programs. http://www.micro-soft.com/athome/security/spy-ware/default.mspx and http://www.micro-soft.com/athome/security/spy-ware/spywaresigns.mspx (last visited December 5, 2005).

3 .The index.dat file is located in the Temporary Internet Files folder. It serves as a cache file for Internet Explorer 4.0.

When [a computer user] visit[s] a Web page, Internet Explorer assigns the [page’s] Web address a unique identification number and searches the [index.dat] file for that identification number. If the Web page's identification number is found, the contents of the Web page are stored locally on [the] computer’s hard disk and Internet Explorer uses the locally stored content instead of downloading the information from the- Internet. If the Web page’s identification number is not found, the contents of the Web page must be downloaded from the Internet. This occurs if [the user has] not visited the Web page before, the Web page has changed, or the Web page's identification number has expired. When the Web page’s content has been downloaded to the hard disk, the [index.dat] file is updated with the Web page’s identification number. http://support.microsoft.com/de-fault.aspx?scid=kb;en-us;178702 (last visited December 5, 2005).

4 . SDCL 22-22-24.18 provides:

Any commercial computer repair technician who has knowledge of or observes, within the scope of the technician's professional capacity or employment, a film, photograph, video tape, negative, slide or other visual depiction of a minor whom the technician knows or reasonably should know to be under the age of eighteen, engaged in prohibited sexual acts or in the simulation of prohibited sexual acts, shall report the depiction to an appropriate law enforcement agency as soon as reasonably possible. The computer repair technician need not report to law enforcement depictions involving mere nudity of the minor, but shall report visual depictions involving prohibited sexual acts. This section may not be construed to require a computer repair technician to review all data, disks, or tapes delivered to the computer repair technician within the computer repair technician's professional capacity or employment.

A violation of this section is a Class 1 misdemeanor. However, a violation of this section does not constitute grounds for a civil action for damages against any person.

5 . SDCL 22-22-24.2(3) provides in relevant part: "A person is guilty of possessing, manufacturing, or distributing child pornography if the person:

(3) Knowingly possesses, distributes, or otherwise disseminates any visual depiction of a minor engaging in a prohibited sexual act, or in the simulation of such an act.”

6 . In Zurcher v. Stanford Daily, university students and staff members argued the Fourth Amendment prevented a state from issuing a search warrant for the student newspaper’s premises for negatives, films, and pictures revealing the identities of demonstrators who assaulted police officers. 436 U.S. at 550-51, 98 S.Ct. at 1973-74, 56 L.Ed.2d at 525. Plaintiffs alleged the warrant was deficient because it authorized the search of a third party's premises, but there was no probable cause to believe that the owners or the possessors of the premises were implicated in a crime that had occurred or was occurring. Id. at 552-53, 98 S.Ct. at 1974-75, 56 L.Ed.2d at 525. The Supreme Court held that in the context of a third party search when there is probable cause to believe the fruits or instru-mentalities of a crime are in a specific location, the Fourth Amendment does not require that the occupant, owner or possessor of the premises must also be reasonably suspected of crime and be subject to arrest before a search warrant may issue. Id. at 559, 98 S.Ct. at 1978, 56 L.Ed.2d at 525.

7 . Our state code is filled with crimes that require the State to prove knowing possession on the part of the accused. See SDCL 22-42-6 (“No person may knowingly possess marijuana.”) (emphasis added.); SDCL 22-42-5 (“No person may knowingly possess a controlled drug or substance") (emphasis added.); SDCL 22-42-8 ("Any person who knowingly obtains possession of a controlled drug or substance by theft, misrepresentation, forgery, fraud, deception, or subterfuge is guilty of a Class 4 felony.”) (emphasis added.); and SDCL 22-14-23 ("Except as provided in § 22-14-24, any person who knowingly possesses or causes to be present a firearm or other dangerous weapon, in any county courthouse, or attempts to do so, is guilty of a Class 1 misdemeanor.)” (emphasis added). See also SDCL 22-14A-4 (knowingly possesses a destructive device) (emphasis added.); SDCL 58-4A-2(l) (knowingly possess fraudulent insurance policies) (emphasis added.); SDCL 10-50-21 (knowingly possess counterfeit stamp) (emphasis added.); SDCL 22-11-27 (knowing possession of property with altered serial number) (emphasis added.); and SDCL 22-42-9 (knowing possession of equipment for making counterfeit controlled substance) (emphasis added). However, we require the State to prove up the knowledge requirement at trial. See State v. McDonald, 500 N.W.2d 243 (S.D.1993) (defendant who was arrested and charged with knowing possession of controlled substance under SDCL 22-42-5 used defense of lack of knowledge at trial).

8 . Helland stated at oral argument that the images identified by Elsing as child pornography were of nude children, and therefore did not meet the definition of pornography under SDCL 22-22-24.2(3), which makes illegal the possession, distribution and dissemination of images that are a "visual depiction of a minor engaging in a prohibited sexual act, or in the simulation of such an act.” However, that argument was not made at the suppression hearing, and therefore is not addressed by this Court. See Knudson v. Hess, 1996 SD 137, ¶ 8, 556 N.W.2d 73, 75 (holding parties must have presented the issue to the court below and obtained a ruling before it will be permitted to be raised on appeal) (quoting Klinker v. Beach, 1996 SD 56, ¶ 17 n. 3, 547 N.W.2d 572, 576; and Hawkins v. Peterson, 474 N.W.2d 90, 95 (S.D.1991)).