United States v. McLellan

• Decision Date: 06 July 2015
• Docket Number: No. 14–1561.,14–1561.
• Citation: 792 F.3d 200
• Parties: UNITED STATES of America, Appellee, v. David McLELLAN, Defendant, Appellant.
• Court: U.S. Court of Appeals — First Circuit

792 F.3d 200

UNITED STATES of America, Appellee

v.David McLELLAN, Defendant, Appellant.

No. 14–1561.

United States Court of Appeals, First Circuit.

July 6, 2015.

Judith H. Mizner, Assistant Federal Public Defender, Federal Public Defender Office, for appellant.

Crystal S. Yang, Special Assistant United States Attorney, with whom Carmen M. Ortiz, United States Attorney, was on brief, for appellee.

Before TORRUELLA, SELYA, and LYNCH, Circuit Judges.

Opinion

TORRUELLA, Circuit Judge.

On February 19, 2010, law enforcement officers executed a federal search warrant at 180 High Street in Taunton, Massachusetts as part of an investigation into an individual using the online usernames “babylick” and “a35scott” to trade child pornography. After speaking with one of the co-owners (who was also an occupant), the officers searched the entire single-family residence, including the bedroom of Appellant David McLellan, who was renting a bedroom in the residence. In McLellan's bedroom, officers seized numerous electronics containing more than 6.3 million images and videos of child pornography and files depicting McLellan sexually abusing an infant. McLellan was subsequently indicted on one count of sexual exploitation of children under 18 U.S.C. § 2251(a) and one count of transporting child pornography under 18 U.S.C. § 2252(a)(1). Following the denial of his request for a Franks hearing and for suppression of the evidence seized during the search, McLellan pleaded guilty, specifically reserving his right to appeal the district court's rulings. Finding no error with these rulings, we affirm.

I. Background

This investigation began in February 2008, when Canadian authorities alerted the Federal Bureau of Investigation (“FBI”) that an individual in or near Boston, Massachusetts was using the username babylick to post images of child pornography to an online bulletin board system. A few months later, in June 2008, the FBI obtained from Yahoo! the user information for the username a35scott. They learned that a35scott self-identified as Adam Scott from Medford, Massachusetts and that he had logged into Yahoo! from seven different IP addresses between January and May of 2008.¹ Three of the IP addresses were linked to Verizon accounts assigned to Dennis Truso in Boston, Massachusetts, one was linked to a Comcast account assigned to Greg Little in East Boston, Massachusetts, and the other two were linked to accounts in Boston, Massachusetts, and Cambridge, Massachusetts. Notably, one of the IP addresses linked to Dennis Truso matched the IP address provided by the Canadian authorities in relation to babylick, thus suggesting that the two usernames belonged to the same individual.

The FBI continued investigating a35scott, and by March 2009, it had issued a report identifying him as an active member in the Multiply.com e-group² “YOUCANTSEEMETOO,” where he was observed posting and trading child pornography. Though the zipcode associated with a35scott's Multiply.com account was in California, the IP addresses were once again traced to the internet accounts of Dennis Truso and Greg Little. The report noted, however, that a35scott was not necessarily Dennis Truso or Greg Little, but might be another member of the Truso or Little household, or another person entirely.

For reasons unclear from the record, the investigation into a35scott appears to have gone quiet from March 2009 through December 2009. The investigation resumed on December 1, 2009, however, when FBI Special Agent Raj Patel, acting in an undercover capacity, logged on to Gigatribe.com, a peer-to-peer (“P2P”) file-sharing network. Like other P2P networks such as Napster, Kazaa, and Limewire, Gigatribe allows a user who has downloaded the service's software to directly connect to other users' computers in order to search and download files that other users have designated for sharing. Unlike the traditional P2P network, however, the Gigatribe system requires a user to already know another user's username and to be accepted by that other user before contact and file-sharing can occur. The Gigatribe files are also encrypted when they are exchanged. Because of these added layers of security, Gigatribe has become a preferred P2P system for trafficking child pornography.

When Agent Patel logged in to Gigatribe on December 1, he observed a35scott logged in as well. Agent Patel proceeded to browse a35scott's shared directory and discovered numerous files with names indicative of child pornography, such as “!-baby unsorted” and “7yo private, cbaby and dea (5yo).” He selected three files to download, but, midway through the downloads, a35scott blocked Agent Patel's access. As a result, two of the three files were only partially downloaded and could not be opened. The third file, however, titled “Boner0170 (Thai boys).jpg,” was fully downloaded (the “December 1 Download”). This file contained a collage of twenty-five images of child pornography, mostly consisting of two prepubescent boys either partially clothed or naked with a focus on their genitals.

The FBI was able to trace the file's origin to a single IP address—173.76.210.90. This IP address was registered to Verizon and, according to Verizon's records, was assigned to the residential high speed internet service account of Darryl J. St. Yves, located at 180 High Street in Taunton, Massachusetts. The FBI confirmed St. Yves's residential address with both the Massachusetts Registry of Motor Vehicles (“RMV”) and the United States Postal Service (“USPS”), and agents visibly observed that a single mailbox at 180 High Street listed St. Yves and two other occupants—Keller and Theobold.

Armed with this information, FBI Special Agent John Locke applied for a search warrant for 180 High Street on February 11, 2010. In his affidavit in support of the warrant, Special Agent Locke recounted the investigation by Special Agent Patel linking the Gigatribe download to an IP address belonging to the account of St. Yves, as well as the FBI's subsequent confirmation that St. Yves lived at 180 High Street both at the time of the download and at the time of the affidavit. The affidavit also described how individuals involved in the transportation and possession of child pornography often keep their pornography close by in secure locations and how complicated forensic examinations of electronics are often necessary to discover the hidden files containing child pornography. Accordingly, the affidavit concluded that there was “probable cause to believe that there exists evidence, fruits and instrumentalities” of the crimes of the transportation and possession of child pornography at 180 High Street and that “Darryl J. St. Yves and/or other residents, as yet unknown,” committed those crimes. The magistrate judge agreed and issued the search warrant.

Notably, the affidavit omitted certain information presumably known to Agent Locke. For example, it did not reference either the February 2008 Canadian tip regarding “babylick” or the March 2009 report detailing the FBI's investigation into a35scott's involvement in the YOUCANTSEEMETOO e-group on Multiply.com. It also failed to mention that this activity had been linked to IP addresses traced to Dennis Truso, Greg Little, and two others, and not to Darryl J. St. Yves. The affidavit did, however, state that it did “not contain every fact known to [Special Agent Locke] with respect to this investigation” but rather “it contain[ed] those facts that [he] believe[d] to be necessary to establish probable cause for issuance of a search warrant” for 180 High Street.

The FBI agents executed the warrant on February 19, 2010. When they arrived, both St. Yves and McLellan were present. St. Yves explained to the agents that he and Keller owned—and occupied—the residence and that they had rented a third room—the room formerly occupied by Theobold—to McLellan “approximately” two months prior, on or about December 1, 2009. He added that all three occupants used his Verizon internet service via a router which created a wireless network, but each resident had his own computers and did not share files. The agents then informed St. Yves that they were looking for child pornography and would be examining all the computers to determine who was most likely responsible. St. Yves admitted that he possessed some child pornography but had not actively searched for it; rather, it was downloaded along with adult pornography videos St. Yves had collected. Upon further inquiry, the FBI agents learned that St. Yves claimed to be unfamiliar with the username a35scott, to not use Yahoo!, and to have never used Gigatribe. St. Yves also told the agents that McLellan was “the most knowledgeable about computers” among the three residents.

Following this conversation, the FBI proceeded to search 180 High Street. They seized several computers, 497 CDs and DVDs, five hard drives, one four-gigabyte thumb drive, and three cell phones from McLellan's bedroom. A subsequent forensic examination of these items revealed images and videos of child pornography, including ones of McLellan sexually abusing an infant.³ Accordingly, on August 2, 2012, McLellan was indicted on one count of sexual exploitation of children under 18 U.S.C. § 2251(a) and one count of transporting child pornography under 18 U.S.C. § 2252(a)(1).

On April 23, 2013, McLellan filed a motion attacking the search from two angles. First, he argued that the search was unconstitutional—and thus the seized electronics should be suppressed—because the warrant was insufficiently particular. To support this claim, McLellan alleged that 180 High Street was a “multi-unit dwelling” and the affidavit failed to provide probable cause to search his specific room because there was no evidence to link anyone other than St. Yves to the December 1, 2009, download. Second, McLellan requested a hearing under Franks v. Delaware, 438 U.S. 154, 98 S.Ct. 2674, 57 L.Ed.2d 667 (1978), because, he contended, the affidavit in support...