United States v. Gregory James Grant

218 F.3d 72, 2000 U.S. App. LEXIS 16952, 2000 WL 960700

• Court: Court of Appeals for the First Circuit
• Decided: July 17, 2000
• Docket: 99-2332
• Status: Published

Opinion

STAHL, Circuit Judge.

The resolution of this appeal hinges on a September 1, 1998 affidavit executed by United States Customs Service (“Customs Service”) Special Agent Karen Booke (the “Booke Affidavit”) and submitted to a United States Magistrate Judge in support of a search warrant application. Based on the affidavit’s allegations, the magistrate judge granted a warrant allowing authorities to search defendant-appellant Gregory James Grant’s home for evidence of child pornography. Grant argues that the affidavit did not support the requisite probable cause finding and claims that the magistrate judge and district court erred' in denying him a hearing before determining that evidence derived from the search would be admissible against him. We 'affirm.

Background

I. The Booke Affidavit’s Allegations

The Booke Affidavit alleged, in pertinent part, the following facts: In May 1996, the Customs Service began to investigate the internet-based child pornography trading activities of Ronald Riva. Riva and associates utilized an internet “chat channel” known as the “Orchid Club” to traffic in digital images of child pornography, including images depicting child molestation. The investigation into the Orchid Club resulted in the discovery, by cooperating British law enforcement-agents, of a chat channel called “# wOnderland,” which also was devoted to the distribution of child pornography. According to evidence obtained by British authorities during and following the arrest of Ian Baldock, a Briton who belonged to both the Orchid Club and # wOnderland, membership in the latter required the possession of 10,000 images of pre-teen children engaging in explicit sexual activity and the capacity to store these images on a server accessible to other members for electronic transfer via the popular File Transfer Protocol (“FTP”). The document stating these requirements noted that “exceptions [would] be made for exceptional collections etc.” Admission to # wOnderland required acceptance by a “membership committee.” Only after admission would an individual be told of the channel’s secret internet address. Authorities also found on Bal-dock’s computer equipment approximately 42,000 computer images of child pornography. Finally, forensic analysis of Bal-dock’s computer revealed the existence of other channels similar to # wOnderland, including one entitled “# ourplace.”

Further investigation into # wOnderland revealed the “screen names” of 197 users in eighteen countries. 1 British authorities shared this information with these countries’ law enforcement agencies, including the United States Customs Service. It was determined that one of the screen names, “sassybabe,” had been used to access # wOnderland on April 1,1998, at 7:14 p.m. Information identifying the account associated with the screen name “sassy-babe” showed that the individual using that screen name also had used the screen name “sassywork,” and had connected to the internet using a modem-based service provided by IBM Global Network Services (“IBM”). According to IBM records, at the time the screen name “sassybabe” was used to access the #wOnderland channel, it was associated with an internet access account registered to Grant. IBM’s records indicated that Grant resided in Skow-hegan, Maine, but a search of automobile and telephone records revealed that Grant had moved to South Portland, Maine in or around August 1998. Grant’s IBM internet account remained active, and was used, through the end of that month.

During August 1998, Grant also maintained a Road Runner Pro (“Road Runner”) internet account with Time Warner Cable. Road Runner is a cable-based internet service through which an individual can maintain an “always-on,” high-speed internet connection. Road Runner records revealed that Grant’s account was used as an FTP server — the type of file-transfer server required for #wOnderland membership.

On August 28, 1998, in relation to another child pornography investigation, the United States District Court of Maine approved a Customs Service application to tap a telephone line not associated with Grant. On August 30, between 9:15 p.m. and 11:30 p.m., Agent Booke observed the targeted individual logging into the secret # ourplace channel. There, Booke was able to observe information identifying other # ourplace users who were, at the same time, also logged into the channel. These users included an individual with the screen name “sassylsassy-gall4@slipl66-72-215-109.va.us.ibm.net.” The “slipl66-72-215-109.va.us.ibm.net” portion of the user’s identity constitutes a “port address.” This particular port address was, at the time, assigned to Grant’s IBM account. Contemporaneous Customs Service surveillance revealed that Grant’s car, and his wife’s, were both parked at their residence in Portland during the evening of August 30.

II. Procedural History

On September 1, 1998, on the basis of the Booke Affidavit, a United States Magistrate Judge issued a search warrant authorizing Customs Service agents to search Grant’s residence for computer equipment and other evidence relating to the transmission, receipt or possession of child pornography. The agents executed the warrant that day, seizing computer equipment containing digital images of child pornography. The following day, Grant was charged with possession and distribution of child pornography that had been transported in interstate commerce, in violation of 18 U.S.C. § 2252A(a)(2), (5)(B).

On April 2, 1999, Grant moved to suppress all evidence resulting from the search of his residence and sought an evi-dentiary hearing on the suppression motion pursuant to the Supreme Court’s decision in Franks v. Delaware, 438 U.S. 154, 98 S.Ct. 2674, 57 L.Ed.2d 667 (1978). On June 7, 1999, the magistrate judge denied the motion requesting a Franks hearing and recommended denial of the suppression motion. Grant appealed both the suppression recommendation and the Franks ruling. The district court, however, adopted the recommendation to deny suppression and affirmed the Franks hearing denial. On October 4, 1999, Grant entered a conditional plea of guilty, reserving his right to challenge the two adverse eviden-tiary rulings. This appeal followed.

Discussion

Grant claims that the district court improperly ruled that evidence gathered during the search of his home would be admissible against him at trial and improperly denied him an evidentiary hearing on his motion to suppress that evidence. We address these arguments in turn.

1. Suppression of Evidence

Grant argues that the Booke Affidavit contained insufficient information to establish probable cause to search his residence, and that the district court therefore erred in failing to suppress evidence collected during that search. We accord “great deference” to a lower court’s determinations regarding probable cause. United States v. Sawyer, 144 F.3d 191, 193 (1st Cir.1998); United States v. Procopio, 88 F.3d 21, 26 (1st Cir.1996).

“[P]robable cause need not be tantamount to proof beyond a reasonable doubt.... Probability is the touchstone.” United States v. Khounsavanh, 113 F.3d 279, 283 (1st Cir.1997) (quoting United States v. Aguirre, 839 F.2d 854, 857 (1st Cir.1988)) (alteration in original). The probable cause standard does not require any showing that an officer’s belief that evidence will be found in the searched premises “be correct or more likely true than false.” Texas v. Brown, 460 U.S. 730, 742, 103 S.Ct. 1535, 75 L.Ed.2d 502 (1983) (citation and internal quotation marks omitted). Rather, probable cause to search Grant’s home existed so long as the Booke Affidavit contained information showing a “fair probability” that evidence of a crime would be found there. Illinois v. Gates, 462 U.S. 213, 238, 103 S.Ct. 2317, 76 L.Ed.2d 527 (1983); see also Khounsavanh, 113 F.3d at 283; Procopio, 88 F.3d at 25.

Grant first faults the Booke Affidavit for failing to prove that it was in fact he, and not an imposter, who was using his IBM account to traffic in child pornography. There is, as Grant urges, always reason to question whether a screen name is actually being used by the individual to whom it is registered. But, as Grant has acknowledged, use of a password-protected account does require, at the least, .that the user know the password associated with a given screen name. Though the evidence demonstrates that an individual other than an account’s registrant might access that account illicitly, there is no evidence suggesting that on any given occasion, the user is not likely in fact to be the registrant. Thus, even discounting for the possibility that an individual other than Grant may have been using his account, there was a fair probability that Grant was the user and that evidence of the user’s illegal activities would be found in Grant’s home. We therefore reject Grant’s argument that evidence of a screen name’s activity is, in all cases, per se insufficient to establish probable cause with respect to the registrant. 2

Grant also challenges the Booke Affidavit’s implications regarding the August 30, 1998, visit to # ourplace. Grant acknowledges that the numbers “166-72-215-109” in the identity “sassy!sassygall4@slipl66-72-215-109.va.us.ibm.net” were assigned to his IBM account during Booke’s August 30, 1998, observation of the # ourplace channel. He notes, however, that the “va. us.ibm.net” portion of the address indicates that the point of entry through which “sassy!sassygall4” was accessing the internet was in Virginia, whereas he was in Maine at the time. But none of the evidence — including that furnished by Grant — suggests that these two facts are incompatible. First, in opposition to Grant’s motion to suppress evidence, the government submitted the affidavit of Robert Frederick, the Manager of Security for the IBM division that provided internet services. Frederick testified that he was “intimately familiar” with IBM’s address naming format, and that the letters “va” in the address at issue do identify Virginia as the “point of presence” or the “access point” from which “sassylsas-sygall4” had connected with the internet. All this meant according to Frederick, however, was that “sassy!sassygall4” dialed into an IBM telephone line located in Virginia. “If the subscriber were willing to incur toll charges, the subscriber could have called the Virginia point of presence from anywhere in the world and established a successful link to the Internet Service.” In addition, Grant’s own expert witness, Fletcher Kittredge, testified that Grant, while in Maine, could have accessed the Virginia point of presence either (1) by calling from a home modem to the Virginia number or (2) by using his Road Runner account to communicate with a computer based elsewhere and instructing that computer to use its modem to call the Virginia number. Kittredge suggested that only “a computer and networking expert could accomplish” the latter task, but Grant, in his own affidavit, asserted that he is an expert in “computer science” and “Internet Technologies.” Grant further testified that he teaches courses regarding the internet and that he has maintained internet computer networks. Thus, there is no evidence to rebut the valid assumption that Grant either used his modem to call a Virginia-based IBM point of presence or used his Road Runner account to do so via another computer. 3

Viewing the Booke Affidavit’s contentions in concert, in light of the standards described above, there was probable cause to issue a warrant for the search of Grant’s residence. In addition to the evidence regarding the August 30, 1998 connection to # ourplace, the Booke Affidavit contained the following evidence supporting a finding of probable cause: (1) on April 1, 1998, an individual using the screen name “sassy-babe” was logged into # wOnderland, a secret internet channel dedicated exclusively to the distribution of child pornography; (2) access to # wOnderland generally required the possession of at least 10,000 images of children engaging in sexually explicit conduct and access to an FTP server on which those images could be made available to other members; (3) the user “sassybabe” was connected through IBM; (4) at that time, the name “sassy-babe” was registered to Grant’s account with IBM; (5) Grant also maintained during the month of August 1998 a Road Runner account that was configured as an FTP server; and (6) the search of another # wOnderland member’s home had resulted in the discovery of about 42,000 images of child pornography on the sort of computer storage devices that might be found at an individual’s residence. The affidavit therefore created probable cause to believe that authorities would find similar evidence of criminal activity in Grant’s home. We will not overturn the district court’s decision to admit the evidence found there. 4

II. Franks Hearing

Grant also contends that pursuant to the Supreme Court’s ruling in Franks v. Delaware, 438 U.S. 154, 171-72, 98 S.Ct. 2674, 57 L.Ed.2d 667 (1978), he was entitled to an evidentiary hearing — a so-called “Franks hearing” — to challenge the Booke Affidavit’s validity. We review the denial of such a hearing for clear error. See, e.g., United States v. Owens, 167 F.3d 739, 747 (1st Cir.1999); United States v. Parcels of Land, 903 F.2d 36, 46 (1st Cir.1990).

An affidavit submitted in support of a search warrant application is presumed valid, see Franks, 438 U.S. at 171, 98 S.Ct. 2674; United States v. Spinosa, 982 F.2d 620, 626 (1st Cir.1992) (quoting Franks), but that presumption may be surmounted by a showing that it contains either (1) a “false statement [made] knowingly and intentionally, or with reckless disregard for the truth,” Franks, 438 U.S. at 155, 98 S.Ct. 2674, or (2) “technically accurate statements” that “have been rendered misleading by material omissions,” United States v. Scalia, 993 F.2d 984, 987 (1st Cir.1993). Grant claims that the affidavit’s comments regarding the August 30 # ourplace visit contained such a misleading omission. 5 “The primary omission,” he asserts, “is [Agent Booke’s] failure to realize and convey to the magistrate that the IBM Global Services account ... was being utilized from an initial point of presence in Virginia, and not Maine, where the appellant resided at the time of the alleged access.” But Grant’s initial premise is deeply flawed. As described above, it is undisputed that the Virginia location was not necessarily an “initial point of presence.” Rather, as Grant’s own expert witness acknowledged, there were two distinct ways in which Grant could have accessed the IBM account from his home in Maine via the Virginia access point. 6 We agree that in light of the Booke Affidavit’s omissions, one could have inferred that Grant could have accessed “slipl66-72-215-109.va.us.ibm.net” from Maine. 7 Given that this inference would have been factually correct, however, it was not misleading. 8 The district court thus committed no clear error in denying Grant’s request for a Franks hearing.

Conclusion

For the foregoing reasons, we AFFIRM.

1 . A "screen name” is an identity created by a user. It may or may not bear any correlation to the user's real name. Typically, an individual gains access to a screen name by supplying a password associated with that screen name.

2 . Indeed, it appears that in internet child pornography cases such as this one, warrants to search an individual's residence often issue based solely on the activities of the defendant's registered screen name. See, e.g., United States v. Tank, 200 F.3d 627, 629-30 (9th Cir.2000); United States v. Fabiano, 169 F.3d 1299, 1302 (10th Cir.1999); United States v. Hibbler, 159 F.3d 233, 234 (6th Cir.1998).

3 . Although Grant makes conclusory assertions to the contrary, the Booke Affidavit contains no evidence either confirming or denying that his phone line was in use during the August 30 # ourplace visit.

4 . The magistrate judge's opinion — and, by extension, the district court’s — effectively segregated the Booke Affidavit's allegations into two sets: those regarding the August 30, 1998 # ourplace visit and those unrelated to that incident. The magistrate then determined that even if the August 30 evidence were ignored, the remaining evidence would nonetheless have supported a finding of probable cause, and would thus have justified the issuance of a search warrant. Because we see no reason to discount the evidence concerning the events of August 30, we only decide here whether all the evidence, taken together, generated the requisite probable cause. We need not address whether the evidence unrelated to August 30 would, standing alone, have supported a probable cause finding.

5 . Grant accuses Agent Booke of exhibiting a "reckless disregard for the truth," but does not allege that any statement contained in the affidavit was false.

6 . Grant incorrectly asserts that according to the Booke Affidavit, he could access the internet only through his Road Runner account. In fact, the affidavit states that Grant utilized both the cable-based Road Runner account and the modem-based IBM account.

7 . Elsewhere in his brief, Grant suggests that in considering his suppression motion, the magistrate judge improperly relied on the affidavit submitted by IBM's security manager, Robert Frederick. This allegation arises from a footnote in the magistrate judge’s memorandum denying Grant's Franks hearing request in which Frederick's affidavit is cited for the proposition that a user could have originated the August 30, 1998, session from Maine. However, neither the magistrate judge's opinion nor the district court's, which adopted the magistrate judge's reasoning, relied on Frederick’s affidavit for its conclusion. Both ultimately rested on the conclusion that even if all the evidence regarding the August 30 session were ignored, the remaining evidence still justified a probable cause finding. Under these circumstances, a Franks hearing is not warranted. See Franks, 438 U.S. at 171-72, 98 S.Ct. 2674 ("[I]f, when material that is the subject of the alleged falsity or reckless disregard is set to one side, there remains sufficient content in the warrant affidavit to support a finding of probable cause, no hearing is required.”). This ultimate finding rendered any conclusions that the magistrate — or the district court — drew regarding the August 30 session irrelevant.

As explained above, we do accord weight to the events of August 30, with respect to both the suppression question and the Franlcs hearing question. Grant has not, of course, suggested that we are barred from considering Frederick’s affidavit or any other evidence properly before us.

8 .Grant also claims that the Booke Affidavit was misleading because it failed "to establish ... that [his] IBM Global account was being accessed by [Grant] in Maine” by introducing records detailing the usage of his telephone or his Road Runner account during the relevant time period. This alleged failure of proof, however, goes not to whether the affidavit was misleading, but to whether it provided probable cause to search Grant's home. As described above, we believe the magistrate and the district court properly determined that it did.