United States v. Tolbert

92 F.4th 1265

• Court: Court of Appeals for the Tenth Circuit
• Decided: February 20, 2024
• Docket: 22-2085
• Status: Published

Opinion

Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 1

FILED United States Court of Appeals PUBLISH Tenth Circuit

UNITED STATES COURT OF APPEALS February 20, 2024 Christopher M. Wolpert FOR THE TENTH CIRCUIT Clerk of Court _________________________________

UNITED STATES OF AMERICA,

Plaintiff - Appellee,

v. No. 22-2085

DONALD ALVIN TOLBERT,

Defendant - Appellant. _________________________________

Appeal from the United States District Court for the District of New Mexico (D.C. No. 1:14-CR-03761-JCH-1) _________________________________

Todd B. Hotchkiss, Albuquerque, New Mexico, for Defendant-Appellant Donald Alvin Tolbert.

Alexander M.M. Uballez, U.S. Attorney, and Kristopher N. Houghton, Assistant U.S. Attorney (with him on the brief), Albuquerque, New Mexico, for Plaintiff-Appellee United States of America. _________________________________

Before HARTZ, EBEL, and CARSON, Circuit Judges. _________________________________

EBEL, Circuit Judge. _________________________________

In this direct criminal appeal, Defendant Donald Alvin Tolbert challenges the

district court’s denial of his motion to suppress. In 2012, Tolbert sent seven emails Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 2

with attachments containing child pornography using three different America Online

(AOL) accounts. AOL used software to screen these emails which detected

suspected child pornography, so AOL submitted the emails and attachments, along

with other information about the incident, in CyberTips to the National Center for

Missing and Exploited Children (NCMEC). NCMEC analysts opened the emails and

attachments and determined they likely contained child pornography. After further

investigation by law enforcement—first by the state of New Mexico, then the federal

government—Tolbert was charged with, and pled guilty to, receipt, distribution, and

possession of child pornography, as well as committing a felony while registered as a

sex offender. Before pleading guilty, Tolbert moved to suppress the evidence

obtained as a result of NCMEC opening his emails and attachments. The district

court denied that motion and Tolbert’s subsequent motion to reconsider. Tolbert now

appeals those decisions.

We conclude that the inevitable discovery exception to exclusion applies, and

therefore we need not address whether NCMEC violated the Fourth Amendment by

opening Tolbert’s emails and attachments or whether the good faith exception to

exclusion would apply. The evidence before the district court established by a

preponderance of the evidence that the investigation into the CyberTips would

inevitably have proceeded in the same manner even if the emails and attachments had

not been opened by NCMEC. Based on the routine practices of analysts at NCMEC

and the New Mexico Attorney General’s Office (NMAGO), Internet Crimes Against

Children (ICAC) division, we conclude, even if the emails and attachments had not

2 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 3

been opened, those agencies would have investigated the CyberTips using

information unrelated to the examination of the emails and attachments—such as IP

addresses and email addresses—to link the CyberTips to Tolbert at two addresses in

Albuquerque, New Mexico, and to find other evidence which raised suspicion of

child pornography. It was routine practice for NCMEC analysts to report such tips to

law enforcement, which, in this case, led the tips to agents at NMAGO and Homeland

Security Investigations (HSI). These agents used the information from the

investigation, which was largely developed through open-source searches on public

databases, to obtain search warrants. These warrants would have been obtained

during the ongoing investigation even if the challenged emails and attachments had

not been opened—as evinced by the fact that police later obtained a search warrant

for computers used by Tolbert, without relying on the contents of the emails and

attachments.

Therefore, we conclude that the government has established by a

preponderance of the evidence that the evidence against Tolbert inevitably would

have been discovered even if NCMEC had not opened Tolbert’s emails and

attachments without an authorizing warrant. Having jurisdiction under 28 U.S.C. §

1291, therefore, we AFFIRM the district court’s denial of Tolbert’s motion to

suppress and motion to reconsider.

3 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 4

I. BACKGROUND 1

a. The Investigation of Tolbert

Tolbert was convicted in 2006 in state court for criminal sexual contact of a

child. He was released on probation and parole in 2009, reincarcerated after

violating the terms of his probation and parole in 2010, then later released again on

probation. Upon his second release, Tolbert agreed to various conditions as part of

his probation. He was then a registered sex offender, which subjected him to further

conditions. These conditions included: probation officers could visit his home or

workplace at any time; probation officers could search him without a warrant if they

reasonably suspected a probation violation; he had to provide his probation officer

with his email addresses, usernames, and passwords; and any computer or electronic

device used by Tolbert could be accessed and reviewed at any time for inappropriate

content, including child pornography.

Between July and September 2012, Tolbert sent emails through three different

accounts on America Online (AOL). AOL uses a system called “image detection

filtering process” (IDFP) to detect suspected child pornography in users’ emails.

When emails are sent, AOL uses software to scan the emails and attachments and

create a “hash value,” or unique 32-character string of numbers and letters, for each

photograph or video. AOL maintains a database of hash values generated from

photographs or videos containing suspected child pornography, and it uses IDFP to

1 These facts come from the district court’s order denying Tolbert’s motion to suppress. See (I R. 383-408). 4 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 5

detect emails with hash values matching those in its database. Utilizing this system,

AOL detected suspected child pornography in seven emails sent by Tolbert.

For each email flagged through IDFP, AOL submitted the email and other

information in a “CyberTip” to the National Center for Missing and Exploited

Children (NCMEC). 2 The CyberTips included:

(1) the email addresses of both the senders and the recipients of the emails, (2) the subjects of the emails, along with all of their attachments; (3) identification of the specific attachments which had been hash value matched as child pornography; and (4) the IP address corresponding to the email sender for all five emails.

(I R. 385). AOL’s CyberTip process was automated, so no person at AOL viewed or

opened the emails before the tips were submitted. 3 Additionally, AOL’s software

2 AOL was required by law to report the suspected child pornography to NCMEC. 18 U.S.C. § 2258A(a)(1)(A). NCMEC is a nonprofit entity endowed by statute with various law-enforcement-related duties. See 34 U.S.C. § 11293(b) (providing for funds to be granted annually to NCMEC to be used in various ways, including operating a tipline for reports of child pornography and reporting tips to law enforcement). NCMEC is statutorily authorized to receive and review child pornography, which allows NCMEC to fulfill its duty as a “clearinghouse” of child pornography tips. 18 U.S.C. § 2258A(a), (b)(4), (c). We have held, in a case decided after the operative offense in this case, that the Fourth Amendment is implicated by NCMEC’s conduct, either because NCMEC is a “governmental entity,” or because it acts as the government’s agent. United States v. Ackerman, 831 F.3d 1292, 1297, 1301 (10th Cir. 2016) (“Ackerman I”). In Ackerman I, we left open the question whether NCMEC’s opening and viewing photos and videos constitutes a Fourth Amendment “search.” Id. at 1304-05. 3 The district court found that an AOL employee in fact opened and viewed the emails and attachments after AOL submitted the CyberTips. Tolbert argues there is no evidence to support this conclusion. Instead, the evidence before the district court merely established that it was AOL’s general practice to open the emails after submitting CyberTips—not that the emails at issue here were actually opened by AOL. This fact does not affect our legal analysis in this case. 5 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 6

automatically prevented the emails from reaching the intended recipients, saved

snapshots of the sender’s account, and then terminated the sender’s account.

AOL submitted the first CyberTip to NCMEC on July 18, 2012, which concerned

a single email sent from the address “dat666@aol.com” with the affiliated username

“Donnie T.” (Id. at 385, 407). It submitted the second CyberTip on August 8, 2012,

which concerned a single email from the address “abc123ddt@aol.com.” (Id. at 407). 4

AOL then submitted CyberTips concerning five emails with fifteen total attachments sent

on September 1 from the address “ddt123abc@aol.com.” (Id. at 384). Three of the

emails were sent to a separate address allegedly belonging to Tolbert,

“donnieisagod@aol.com,” while two were sent to an address not associated with Tolbert,

“widd2703@web.de.” (Id.).

On September 5, NCMEC, acting without a warrant, opened and viewed the five

emails and respective attachments from September 1. By doing so, NCMEC determined

the attachments appeared to contain child pornography. NCMEC then used information

submitted by AOL in the CyberTips, such as the sender’s IP address 5 and two of the

email addresses—“ddt123abc@aol.com” (the sender’s) and “donnieisagod@aol.com” (a

4 It is not clear when NCMEC investigated the July 18 and August 8 CyberTips. Tolbert argues that these tips were not investigated by NCMEC until after the September emails were opened and confirmed to contain child pornography, and therefore the first two CyberTips were tainted by NCMEC’s “search” of the September emails. The timing of the investigation of the July 18 and August 8 CyberTips does not affect our analysis, as we conclude that the investigations in this case would inevitably have proceeded in the same manner even if NCMEC never opened the emails in the September CyberTips. 5 An IP address helps to identify the geographic location from which a computer accesses the internet. (I R. 385). 6 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 7

recipient’s)—to search publicly available databases. These searches led NCMEC to

discover the Albuquerque address of Margaret Tolbert—the Defendant’s mother—

and eventually to discover Tolbert’s name, address, and date of birth.

After conducting its own investigations, NCMEC forwarded the tips, emails,

attachments, and Tolbert’s information to the New Mexico Attorney General’s Office

(NMAGO), Internet Crimes Against Children (ICAC) division. This division is the

clearinghouse for CyberTips with a connection to New Mexico. An analyst at ICAC

reviewed the CyberTips and images and searched open sources to determine that the

sender’s IP address was connected to a location in New Mexico. The analyst then

referred this information to the Special Agent in Charge, who assigned the case to Special

Agent Owen Pena at the NMAGO. Agent Pena conducted his own open-source searches

to confirm the IP address was connected to a location in Albuquerque, New Mexico. He

then used that information to obtain grand jury subpoenas duces tecum for information

from CenturyLink regarding the IP address and from AOL regarding the two email

addresses associated with Tolbert, “ddt123abc@aol.com” and “donnieisagod@aol.com.”

AOL provided information linking “donnieisagod@aol.com” with the name “Donald

Tolbert” and an address in Albuquerque. CenturyLink provided information linking the

IP address with the name “Margaret Tolbert” and an address in Albuquerque. Having

connected the information in the CyberTips with Donald Tolbert, Agent Pena called

Tolbert’s probation officer and confirmed he was registered as a sex offender and on

probation in New Mexico.

7 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 8

Through further investigation, Agent Pena found that an email address or the IP

address in the CyberTips was associated with an account named “YUNGMUFFMAN” on

IMGSRC, a Russian file uploading website. The account owner’s name was listed as

“Donnie,” with the email address “ddt666abc@gmail.com.” A statement on the account

read, “I love girls between 8-15. Someone told on me got my other 2 email accounts

cancelled. AOL has something that reads your emails.” (Id. at 387-88) The account also

contained pictures of young girls and naked adults.

Agent Pena met with Christina Altamirano, a Homeland Security Investigations

(HSI) agent who specialized in internet crimes against children and sexual exploitation

crimes, to review the evidence he had regarding Tolbert—information provided by

CenturyLink, AOL, and NCMEC, including the emails and attachments. Agent

Altamirano used this evidence to obtain search warrants for AOL regarding the

“ddt123abc@aol.com” and “donnieisagod@aol.com” email addresses. Additionally,

Agent Pena obtained warrants for Tolbert’s residence and Tolbert’s mother’s residence.

The AOL warrants contained subscriber information, IP addresses, and times and dates

when the accounts were used. Police seized two computers from Tolbert’s mother’s

residence, which were later examined and discovered to contain child pornography.

Tolbert’s mother told police that she and Tolbert were the only users of those computers.

After this court decided Ackerman I—which held that NCMEC is a

“governmental entity” and subject to the requirements of the Fourth Amendment—

police obtained a new search warrant for the computers without using the emails and

8 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 9

attachments. 831 F.3d at 1297. A subsequent search revealed child pornography on the

computers.

On June 14, 2016, Tolbert was charged by superseding indictment with: notice and

advertisement of child pornography in violation of 18 U.S.C. §§ 2251(d)(1)(A),

(d)(2)(A), and (B), 2251(e), 2256, and 3359(e); receipt of child pornography in violation

of 18 U.S.C. §§ 2252(a)(2), 2252(b)(1), and 2256; distribution of child pornography in

violation of 18 U.S.C. §§ 2252(a)(2), 2252(b)(1), and 2256; possession of child

pornography in violation of 18 U.S.C. §§ 2252(a)(4)(B), 2252(b)(2), and 2256; and

committing a felony while required to be registered as a sex offender in violation of 18

U.S.C. § 2260A.

b. Tolbert’s Motion to Suppress

On October 27, 2017, Tolbert moved to suppress “any and all evidence obtained

either directly or indirectly as a result of the illegal actions by NCMEC and law

enforcement in the investigation of the emails and attachments involving email addresses

‘ddt123abc@aol.com’ and ‘donnieisagod@aol.com’ and any seizure of evidence related

to or pursuant to those searches.” (I R. 33). The district court held evidentiary hearings on

the motion on April 24-25 and June 12, 2018.

The district court heard testimony from Gregory Phillips, who worked as a Senior

Technical Security Investigator for AOL in 2012. Phillips explained AOL’s use of IDFP:

emails are scanned when sent, a unique hash value is created for images and videos, and

the hash values of sent items are compared to the hash values in AOL’s database of

“apparent child pornography.” (II R. 123-24, 128-29) (explaining when a sent item’s hash

9 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 10

value matches a hash in the database, “[t]hat means that it is child pornography”). 6 The

database was created over years with hash values of images that were reviewed by

graphics analysts at AOL and determined to be child pornography. Another AOL

employee, Mark Ludlow, testified that the “ISP industry” has “come up collectively with

a set of criterion (sic) that [it] use[s] to determine” if an image or video depicts child

pornography, but that the determination has a “degree of subjectivity.” (Id. at 398, 431).

He testified that AOL’s process of reviewing content and developing the database was

not perfectly accurate, and he approximated that about eighty percent of images and

videos in the database contained child pornography. 7

John Shehan, the vice president of the Exploited Children’s Division at NCMEC,

testified about NCMEC’s process regarding CyberTips. He testified that NCMEC

analysts in 2012 had discretion when determining whether to conduct open-source

searches using information in CyberTips. He also testified that when an IP address is

included in a CyberTip, NCMEC analysts “try to use that information to help . . .

determine a location.” (Id. at 183). NCMEC makes every CyberTip available to law

enforcement. If an IP address is included in a tip and NCMEC identifies the location of

the reported activity, NCMEC sends that tip to the law enforcement agency responsible

for that location. Shehan also testified about the specific process used by NCMEC with

respect to the CyberTips at issue here: NCMEC analysts viewed the photo and video

The second volume of the record is sealed. 6

Ludlow was not responsible for reviewing images in 2012, and he was 7

unfamiliar with the training received by those who reviewed images for AOL in 2012. 10 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 11

attachments, used publicly available sources to search the email addresses and discover

information about Tolbert—including his address and registration as a sex offender in

New Mexico—used publicly available sources to search the IP address, discovered the

emails were likely sent from Albuquerque, New Mexico, and reported the information to

law enforcement in New Mexico.

NMAGO ICAC Agent Pena testified about ICAC’s practices regarding

investigation of NCMEC CyberTips. When asked whether ICAC would have

investigated the five September 1 CyberTips if they received “no information about

NCMEC ever opening any image or the e-mail itself”—in other words, the tips would

have indicated only that AOL identified a hash value match and provided the email

addresses, IP address, and other header information—Pena answered affirmatively.

(Id. at 347). He also testified that ICAC would have investigated the July 18 and

August 8 CyberTips, even if the September 1 CyberTips did not exist and no photos or

videos were opened. Agent Pena stated it is ICAC’s current practice to pursue such tips,

even when the photos and videos remain unopened. He testified that, now that it is known

that NCMEC’s conduct implicates the Fourth Amendment, if ICAC receives a tip with

unopened photos or videos from NCMEC, ICAC obtains subpoenas and search warrants

to authorize opening and viewing them. The district court found Agent Pena’s testimony

credible.

HSI Agent Altamirano testified about her process investigating the CyberTips.

She testified that, if she had received the CyberTips without the information that the

photos or videos had been opened—and even if she only received an IP address and

11 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 12

the fact that AOL identified a hash value match—HSI still would have investigated

the tips. 8 When asked why, she stated:

Because we are still required to investigate the case. So even if I just had an IP address and hash values, that is still enough for me to work with to continue on my case to get information from the Internet service provider for the IP address, it is still enough, you know, there is a hash value there so I just have some probable cause to believe that this person is either viewing or downloading child pornography, so I would continue to work my case from there.

(II R. 464). 9 Agent Altamirano then explained how she investigated the tips using the IP

address and email addresses: she sought search warrants for AOL and CenturyLink

regarding the email addresses and IP address in the tip; she received an Albuquerque

address associated with the IP address from CenturyLink; she searched the address in a

law enforcement database and found the names Margaret Tolbert and Donald Tolbert;

and then she searched Donald Tolbert’s name in a database and found his New Mexico

criminal history and probation officer. The name “Donnie Tolbert” was also included in

an attachment by NCMEC to the July 18 CyberTip, and Agent Altamirano testified that

she used publicly available sources to search this name and to discover Tolbert was a

registered sex offender in New Mexico—and would have done so even if the photos

and videos had never been opened. Finally, Agent Altamirano testified that one of the

tips she reviewed provided information about the “YUNGMUFFMAN” IMGSRC

account, which she suspected could contain child pornography, and therefore she

8 Agent Altamirano admitted that she had only ever received and investigated NCMEC tips where the photos and videos had previously been opened. (II R. 481). 9 Agent Altamirano testified “[b]ased on training and experience” that an AOL hash value match indicates “child pornography or child erotica, known child exploitation evidence.” (II R. 471). 12 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 13

investigated that account—and would have done so even if the photos and videos had

never been opened. The district court found her testimony credible.

c. The district court’s decisions

The district court denied Tolbert’s motion to suppress. The district court did not

initially decide whether NCMEC violated the Fourth Amendment by opening Tolbert’s

emails and attachments. Instead, the court concluded, “the evidence should not be

suppressed because both the good faith and the inevitable discovery exceptions” to

exclusion apply. (I R. 390).

Tolbert filed a motion to reconsider, which was denied by the district court.

The court relied on the good faith exception to exclusion. The court also explained,

in a footnote, that Tolbert lacked a reasonable expectation of privacy in his emails

because he agreed to AOL’s terms of service, which notified Tolbert that he was

required to comply with the law and that AOL could take action to enforce those

terms and report illegal activity to law enforcement. The court provided this as “an

additional, alternate reason why Tolbert’s motion to reconsider should be denied.” (Id. at

448-49 n.3).

After the denial of his motions, Tolbert entered a conditional guilty plea,

reserving his right to appeal the district court’s denial of his motion to suppress and

motion to reconsider. The district court sentenced Tolbert to 420 months in prison

with 10 years of supervised release. Tolbert now appeals the denial of his motion to

13 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 14

II. STANDARD OF REVIEW

“When reviewing the district court's denial of a motion to suppress, we view the

evidence in the light most favorable to the government and accept the district court's

factual findings unless they are clearly erroneous.” United States v. Grimmett, 439

F.3d 1263, 1268 (10th Cir. 2006). “We review legal questions de novo.” United

States v. Neugin, 958 F.3d 924, 929 (10th Cir. 2020).

III. DISCUSSION

Tolbert argues the district court erred in denying his motion to suppress

because: 1. He had a reasonable expectation of privacy in his emails and attachments,

and therefore the warrantless searches by NCMEC and law enforcement violated the

Fourth Amendment; 2. The good faith exception to the exclusionary rule does not

apply; and 3. The inevitable discovery exception to the exclusionary rule does not

apply. We hold that the inevitable discovery exception applies, and therefore we

need not address whether Tolbert had a reasonable expectation of privacy in his

emails or whether the good faith exception applies. 10 The inevitable discovery

10 The government argues Tolbert lacked a “reasonable expectation of privacy” in his emails, and therefore any access to his emails by NCMEC or law enforcement was not a “search” that implicated the Fourth Amendment. See Smith v. Maryland, 442 U.S. 735, 740 (1979) (explaining two-part inquiry to determine whether a Fourth Amendment “search” occurred: whether an individual has a subjective expectation of privacy in the thing searched; and whether that expectation is objectively reasonable) (citing Katz v. United States, 389 U.S. 347, 361 (1967) (Harlan, J., concurring)). First, the government argues Tolbert lacked a subjective expectation of privacy in his AOL emails, as he posted on his IMGSRC account, “[s]omeone told on me got my other 2 email accounts cancelled. AOL has something that reads your emails.” (I R. 387-88). Second, the government argues any expectation of privacy would be objectively unreasonable because AOL’s terms of service put Tolbert on notice that users could not 14 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 15

analysis that follows simply assumes, without deciding, that Tolbert’s constitutional

rights were violated.

a. Legal Standard

“Subject to a few exceptions, evidence obtained in violation of the Fourth

Amendment will be suppressed under the exclusionary rule.” United States v. Christy,

739 F.3d 534, 540 (10th Cir. 2014). However, under the inevitable discovery

exception to exclusion, “illegally obtained evidence may be admitted if it ‘ultimately

or inevitably would have been discovered by lawful means.’” Id. (citing Nix v.

Williams, 467 U.S. 431, 444 (1984) (“If the prosecution can establish . . . that the

information ultimately or inevitably would have been discovered by lawful means . . .

then the deterrence rationale has so little basis that the evidence should be received”)).

“The government bears the burden of proving by a preponderance of the evidence

that the evidence would have been discovered without the Fourth Amendment

violation.” Id.

Inevitable discovery analysis . . . requires the court to examine each of the contingencies involved that would have had to have been resolved favorably to the government in order for the evidence to have been discovered legally and to assess the probability of the contingencies having occurred. . . The more contingencies there are, and the lower the probability that each would have been resolved in the government’s favor, the lower the probability that the evidence would have been found by lawful means.

use their email accounts for illegal purposes, that AOL could access and disclose the contents of a user’s communications when AOL developed a “good faith belief” that the user was engaging in illegal activity, and that AOL would report illegal activity to law enforcement. (I R. 202-03). We need not resolve this issue here. 15 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 16

United States v. Souza, 223 F.3d 1197, 1205 (10th Cir. 2000).

While we have expressed “reluctan[ce] to apply the inevitable discovery

exception in situations where the government fails to obtain a search warrant and no

exception to the warrant requirement exists,” we will apply the exception where

“demonstrated historical facts” indicate “that an independent and untainted discovery

would inevitably have occurred.” Id. at 1206; United States v. Griffin, 48 F.3d 1147,

1151 (10th Cir. 1995) (quoting United States v. Terzado-Madruga, 897 F.2d 1099,

1114 (11th Cir. 1990) (citation omitted)). The government need not prove the

existence of a second, distinct investigation that would have discovered the evidence

absent the Fourth Amendment violation—it is sufficient to establish that “the first (and

only) investigation would inevitably have discovered the contested evidence by lawful

means.” Christy, 739 F.3d at 541.

Where application of the inevitable discovery exception depends on whether

an investigation would have continued if a prior unlawful search had not occurred,

we have looked at whether the evidence establishes a routine practice of conducting

such investigations under the circumstances. See United States v. White, 326 F.3d

1135, 1139 (10th Cir. 2003) (applying inevitable discovery exception where evidence

established that it was officers’ routine practice to check for outstanding warrants, and

therefore officers would have run a warrant check even if they had not conducted the

unlawful search and discovered illegal drugs before the check); see United States v.

Cooper, 24 F.4th 1086, 1094 (6th Cir. 2022) (stating that the court will apply

inevitable discovery exception based on “routine practices: that an airline would,

16 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 17

pursuant to its official policy, open the defendant’s lost luggage . . . ; that police would

follow standard procedure to inventory a vehicle before having it towed . . . ; or that upon

arresting a suspect, police would routinely search his person, . . . or ask for his name”

(citations omitted)).

b. Analysis

As noted previously, we assume without deciding that NCMEC violated the

Fourth Amendment when its analyst opened Tolbert’s emails and attachments without a

warrant. Therefore, the emails, attachments, and evidence gathered as a result of their

being viewed by NCMEC—including the computers seized from Tolbert’s mother’s

home which contained child pornography—must be excluded unless an exception to

exclusion applies. 11 We agree with the district court that the government has carried its

burden to establish by a preponderance of the evidence that the challenged evidence

would have been discovered absent the Fourth Amendment violation—and therefore the

inevitable discovery exception to exclusion applies.

First, the government established that NCMEC would have investigated the

information in the September 1 CyberTips from AOL, even if the accompanying emails

and attachments were never opened. Shehan’s testimony established it was routine

11 Tolbert argues, “[e]verything that followed the search” of his emails and attachments “was undertaken only because of the illegal searches by NCMEC,” and therefore all subsequently obtained evidence is “fruit of the poisonous tree” and must be excluded. (Aplt. Br. 42) (citing Wong Sun v. United States, 371 U.S. 471, 488 (1963)). Because we conclude that all challenged evidence would inevitably have been discovered without the allegedly unlawful “searches,” we need not further address this argument. 17 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 18

practice for NCMEC analysts to use IP addresses in CyberTips to conduct open-source

searches and attempt to “determine a location.” (II R. 183). The September 1 CyberTips

contained the IP address corresponding to the sender of the five reported emails.

Therefore, based on Shehan’s testimony, NCMEC analysts would have conducted open-

source searches of the IP address to determine a corresponding geographic location, even

if the emails and attachments were not opened. In fact, that happened in this case—

NCMEC analysts conducted open-source searches of the IP address and discovered

the corresponding geographic location of Albuquerque, New Mexico.

Additionally, Shehan testified, so long as time permits, NCMEC analysts run

open-source searches of the email addresses and other information provided in

CyberTips. (II R. 226-27) (“Certainly [the analysts] are always going to focus on

more of the user or the person that’s being reported.”). The emails in the September

1 CyberTips were sent from the email address, “ddt123abc@aol.com.” NCMEC

analysts conducted open-source searches of this email address and discovered the

suspicious “YUNGMUFFMAN” IMGSCR account, which included the name

“Donnie” and the statement, “I love girls between 8-15.” Open-source searches also led

NCMEC to the name “Don Tolbert,” which an analyst used to search a national sex

offender public website.

Shehan testified that NCMEC makes all CyberTips available to law

enforcement and, when NCMEC analysts can use an IP address to identify the

geographic location of the reported activity, NCMEC sends those tips to law

enforcement in the respective jurisdiction. NMAGO ICAC is the agency where

18 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 19

NCMEC sends tips with a connection to New Mexico. Here, since NCMEC was able

to locate the IP address in Albuquerque, New Mexico, NCMEC sent the September 1

CyberTips, emails, attachments, and related information to NMAGO ICAC.

Ultimately, NCMEC’s routine practices of using IP addresses in CyberTips to

determine a geographic location, conducting open-source searches of other

information in CyberTips when time permitted, and forwarding tips and information

with a connection to New Mexico to NMAGO ICAC are sufficient to establish by a

preponderance of the evidence that NCMEC would have investigated the September

1 CyberTips and sent them to NMAGO ICAC, even if NCMEC never opened the

emails and attachments.

Tolbert argues NCMEC analysts had discretion when determining whether to

investigate the information in CyberTips, and it is impossible to know whether the

analysts here would have exercised their discretion to investigate the September 1

CyberTips if they had not first opened the emails and attachments and confirmed they

contained suspected child pornography. Therefore, in Tolbert’s view, the conclusion

that NCMEC would inevitably have investigated the CyberTips and reported them to

NMAGO ICAC is too speculative to support the inevitable discovery exception. See

United States v. Owens, 782 F.2d 146, 152 (10th Cir. 1986) (refusing to apply

inevitable discovery exception “because of the highly speculative assumption of

‘inevitability’ that would be required”). While the inevitable discovery exception would

be inapplicable if we had no insight into how NCMEC analysts exercised their discretion

when investigating tips, there was evidence before the district court here that, in 2012, it

19 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 20

was the practice of NCMEC analysts to run open-source searches for all CyberTips—

especially when those tips included an IP address. 12 Therefore, we disagree—it is not

“highly speculative” to conclude that NCMEC analysts would have followed routine

practice and conducted open-source searches of the information in the September 1

CyberTips, even if they had not opened the emails and attachments. See White, 326

F.3d at 1139 (applying inevitable discovery exception where district court found it

unclear whether officers would have checked defendant’s name for warrants, but

evidence created a “solid implication that the officers routinely ran” such checks).

Further, the government established that NMAGO ICAC would have

investigated the information provided by NCMEC relating to the September 1

CyberTips—even if the emails and attachments were never opened by anyone at

NCMEC or ICAC. Agent Pena testified that ICAC would have investigated the

information in the September 1 tips based solely on the fact that AOL found a hash

value match. He testified that this is ICAC’s current practice—after Ackerman I,

neither NCMEC or ICAC opens photos or videos without a warrant, yet ICAC

12 See (II R. 168-69) (Question: “Back in 2012, was it the practice then for analysts to be able to perform if the information is there for them to use open source queries and the like on every case that came through”; Answer: “Yes. Generally speaking they should have the time during that period to have been able to do that. They certainly were given discretion to make those decisions on when they wanted to conduct those types of queries, but yes, time was much more affordable [to investigate tips] then compared to now.”); see also (II R. 183) (“So if there is an IP address we are going to try to use that information to help us determine a location.”). 20 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 21

continues to investigate tips from NCMEC—even when no one has opened the

photos or videos. 13

We conclude that the government has established by a preponderance of the

evidence that ICAC would have conducted the same investigation of the September 1

tips if the emails and attachments were never opened: an ICAC analyst reviewed the

information from NCMEC and ran open-source searches of the IP address to confirm

the emails were sent from New Mexico; the analyst referred the tips to the Special

Agent in Charge, who then assigned the case to Agent Pena; Agent Pena used the IP

address and email addresses in the tips to conduct open-source searches and

determine a geographical connection to Albuquerque, New Mexico; Agent Pena used

this information to obtain grand jury subpoenas duces tecum for information from

CenturyLink and AOL, which revealed information linking one of the email

addresses with “Donald Tolbert” at an address in Albuquerque, New Mexico, and

linking the IP address with “Margaret Tolbert” at a different Albuquerque address;

and Agent Pena, having discovered Tolbert’s name, called Tolbert’s probation officer

and confirmed he was registered as a sex offender and on probation in New Mexico.

This investigation relied entirely on information unrelated to the contents of the

emails and attachments, and Agent Pena’s testimony indicates that this investigation

13 If previously opened by a private party, such as AOL, then it is NCMEC’s practice to open images and videos. The Supreme Court has held that a warrantless “search” does not violate the Fourth Amendment when it merely reveals the same information previously discovered by a private party’s search. United States v. Jacobsen, 466 U.S. 109, 119-20 (1984). 21 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 22

would have been pursued in the same manner if the emails and attachments had never

been opened. The district court concluded, at this point, “NMAGO would have had

ample evidence to support probable cause for a search warrant to open the emails and

their attachments.” (I R. 406). Agent Pena then used the information developed

through this investigation to obtain search warrants for the residences of Tolbert and

his mother. 14

14 Tolbert argues that, without all the evidence tainted by NCMEC’s initial “search,” there was insufficient evidence to support probable cause for the search warrants. He argues that there was no evidence before the district court establishing the reliability of AOL’s hash value match. We reject this argument for three reasons. First, as described throughout our analysis, the investigations by NCMEC and ICAC relied almost entirely on publicly available sources, and therefore the evidence supporting probable cause would have been discovered if the emails and attachments were not opened. There was ample evidence supporting probable cause, even after NCMEC’s open-source investigations, such as Tolbert’s name, which was searched and led to a “hit” on the national sex offender public website, Tolbert’s Albuquerque address, a connection between the sender’s IP address and Albuquerque, and the suspicious “YUNGMUFFMAN” IMGSRC account. Second, there was evidence before the district court supporting the proposition that an AOL hash value match supports probable cause of child pornography: two AOL employees testified about the process used by AOL to build a database of suspected child pornography and detect hash value matches; AOL employee Ludlow testified that AOL employees used criteria developed by the ISP industry to identify suspected child pornography and add it to the database; and HSI Agent Altamirano testified based on training and experience that hash value matches indicated child pornography. Third, after the search warrants were executed on the residences of Tolbert and his mother, we decided Ackerman I, which held that NCMEC is a government entity to which the Fourth Amendment applies. Ackerman I, 831 F.3d at 1297, 1301. Police had seized two computers from Tolbert’s mother’s residence. Given our decision in Ackerman I, police sought a new warrant to search the seized computers without reference to the contents of the opened emails and attachments. Police obtained the warrant and searched the computers, which revealed evidence of child pornography. This post-Ackerman I warrant supports our conclusion that Agent Pena could have, and would have, sought and obtained the search warrants in this case, even if the emails and attachments were not opened. 22 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 23

Tolbert argues that the conclusion that ICAC would have conducted the same

investigation if the emails and attachments remained unopened is too speculative. He

supports this argument by pointing to Agent Pena’s testimony that the ICAC analyst

who first investigated the tips from NCMEC had the power to decide whether an

investigation should be “closed out.” (II R. 313). Therefore, Tolbert suggests, it is

impossible to know whether the analyst would have exercised his discretion to close

out the investigation if no one had opened the emails and attachments. We reject this

argument. Agent Pena testified that the analyst could not decide to withhold a tip

from ICAC’s investigation process—every tip had to be reported to the Special Agent

in Charge. This testimony supports the conclusion that ICAC’s investigation would

have proceeded in the same manner if the emails and attachments were never

opened. 15

Tolbert also argues there is evidence that undermines the conclusion Agent

Pena would have pursued the subpoenas duces tecum for information from

CenturyLink and AOL if the emails and attachments were not opened—Agent Pena

testified that opening the emails and attachments “was the crux for the subpoena.”

15 The government argues that Agent Pena’s statement that the analyst could “close out” an investigation was taken out of context by Tolbert. While one of Agent Pena’s statements does seem to suggest the analyst could “close out” an investigation, Agent Pena also testified that all tips had to go through the Special Agent in Charge, and that certain cases—involving registered sex offenders and juvenile victims—were given high priority by the analyst and reported to the Special Agent in Charge more quickly than other cases. Crucially, when asked specifically whether an analyst could decide “not to put a cyber tip through the [ICAC’s investigative] process,” Agent Pena stated, “[n]o, he cannot. Everything has to go through [the] Special Agent in Charge.” (II R. 315-16). 23 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 24

(II R. 365). We reject this argument. Agent Pena testified that, had he only received

from NCMEC the header information and the fact that AOL found a hash value

match—and had no one at NCMEC or ICAC opened the emails and attachments—he

still would have sought the subpoenas duces tecum to receive information from

CenturyLink and AOL. He then would have used this information to obtain a search

warrant to open the emails and attachments. Agent Pena testified that this is ICAC’s

current practice—obtaining subpoenas to gather information to support probable

cause, then obtaining search warrants to authorize opening photos and videos.

Therefore, Agent Pena’s above statement does not undermine our conclusion that he

would have obtained the subpoenas and continued his investigation if no one had

opened the emails and attachments.

The government also established that HSI Agent Altamirano would have

investigated the September 1 tips and obtained search warrants for the two AOL

email addresses in the September 1 tips, even if the emails and attachments had never

been opened. Agent Pena provided Agent Altamirano with information regarding the

September 1 tips—including the names and addresses provided by CenturyLink and

AOL in response to the subpoenas. Agent Altamirano testified that if she had only

been given the IP address and the fact that AOL found a hash value match, she would

have investigated the tips and sought search warrants “[b]ecause [HSI is] still required

to investigate the case.” (II R. 464). Also, as described above, the district court

concluded that the information obtained through NCMEC’s and ICAC’s open-source

investigations supported probable cause for a warrant to open the emails and attachments,

24 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 25

and the post-Ackerman I warrant—which did not rely on the contents of the emails and

attachments—supports this conclusion. Therefore, even if the emails and

attachments had not been opened by the time the tips reached Agent Altamirano, the

evidence before the district court established that Agent Altamirano would still have

pursued the investigation and obtained the search warrants.

Finally, Tolbert argues that there is insufficient evidence to support the

conclusion that NCMEC, NMAGO ICAC, and HSI would have conducted the same

investigation if the emails and attachments were not opened because the district court

did not hear testimony from: the AOL employees who allegedly opened the emails

and attachments after the CyberTips were sent to NCMEC; any of the NCMEC

analysts who reviewed and investigated the CyberTips; and the NMAGO ICAC

analyst who reviewed and investigated the tips. Instead, the district court relied on

testimony from AOL employees who were not directly involved with the case, a vice

president at NCMEC who did not directly investigate the CyberTips at issue here,

and NMAGO Agent Pena, who did not receive the tips until after the ICAC analyst

finished his investigation. This testimony, Tolbert argues, cannot support a

conclusion that the individuals who investigated the CyberTips inevitably would have

pursued the investigation in the same manner if the emails and attachments were not

opened—in other words, Tolbert argues testimony from each link in the investigative

chain was required. (Aplt. Br. 52) (“Given that the specific identifiable NCMEC

analyst did not testify for each cyber tip, . . . there is no probable way to establish

inevitability.”).

25 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 26

We reject this argument. As described above, the evidence before the district

court was sufficient to establish NCMEC analysts routinely used IP addresses in

CyberTips to identify a location and send the tips to the corresponding law

enforcement agency, and the ICAC analyst routinely reported all cases to the Special

Agent in Charge. This was sufficient to establish by a preponderance of the evidence

that the investigation would have proceeded in the same manner if the emails and

attachments were not opened. Testimony from every link in the investigative chain is

not required—we can instead infer that the individuals involved in the investigations

at issue here would have acted consistent with their agencies’ routine practices. See

White, 326 F.3d at 1139 (applying inevitable discovery exception based on evidence

of routine practice); United States v. Larsen, 127 F.3d 984, 985-86 (10th Cir. 1997)

(relying on testimony by FBI agent that FDIC reports were routinely forwarded to the

FBI and the FDIC report would have been sent to him in that case to support finding

of inevitable discovery).

IV. CONCLUSION

We conclude that the inevitable discovery exception to exclusion applies to all

evidence obtained through investigations by NCMEC, NMAGO ICAC, HSI, and the

search warrants executed on Tolbert’s residence, his mother’s residence, and AOL. 16

16 Tolbert also argues that the “totality of the circumstances” and “special needs” exceptions to exclusion do not apply. (Aplt. Br. 68-71). Neither the government nor the district court relied on these exceptions, and, given our conclusion that the inevitable discovery exception applies, we need not address these other arguments. 26 Appellate Case: 22-2085 Document: 010111002478 Date Filed: 02/20/2024 Page: 27

We need not rely on speculation to reach this conclusion—we instead rely on the

evidence before the district court establishing that, even if the emails and attachments

in the September 1 CyberTips were never opened without a warrant, the routine

practices of NCMEC, ICAC, and HSI would have led all of these agencies to conduct

the same investigation, and gather the same evidence, that occurred in this case. Our

precedents support reliance on routine practice when applying the inevitable

discovery exception. See White, 326 F.3d at 1139; Larsen, 127 F.3d at 985-86.

Therefore, we AFFIRM the district court’s denial of Tolbert’s motion to suppress and

motion to reconsider.