United States v. Ortega, Case No. CR415-134
| Decision Date | 30 October 2015 |
| Docket Number | Case No. CR415-134 |
| Court | U.S. District Court — Southern District of Georgia |
| Parties | UNITED STATES OF AMERICA v. GERALD MICHAEL ORTEGA |
Defendant, charged with the receipt and possession of child pornography, has moved to suppress all evidence seized from his residence and personal computer pursuant to a search warrant issued by a magistrate judge for Effingham County, Georgia, as well as all statements he made to law enforcement thereafter. Doc. 29. He contends that a state detective illegally obtained the information central to the probable cause basis for the search warrant, and thus that the search violated his "Fourth Amendment right to the privacy of his confidential information." Id. at 3.
During the month of June 2015, Effingham County Sherriff's Deputy Joe Heath investigated child pornography via "peer-to-peer" computer networks. Doc. 30-1 at 4. On June 15, 2015 he applied for a warrant to search 15 Walnut Way Rincon, Georgia 31326, and seize images of and electronic equipment used to download child pornography. Doc. 30-1 at 8-10. The affidavit supporting the warrant application stated that, on June 8, 2015, Comcast Cable replied to a subpoena from Heath and revealed defendant as the subscriber for IP address 98.244.162.133 from April 21, 2015 - June 8, 2015. Id. at 5.
On June 14, 2015, Heath observed a computer operating at 98.244.162.133 offering for download "at least one image file" that he had seen in previous investigations and that he believed "contain[ed] child pornography." Id. at 4. He unsuccessfully tried to download the suspect file after connecting to the remote host computer at 98.244.162.133, but was able to obtain the file's unique "MD5 hash value,"1 which matched the value of a child pornography file he downloaded in a previous investigation. Id. He reviewed that investigation's digital file, found that it matched the hash value of the file 98.244.162.133 offered, and so was "able to confirm it to be" child pornography. Id. at 4-5.
Agents of the Southeast Georgia Child Exploitation Task Force executed the warrant at Ortega's Rincon home on June 16, 2015. They seized a computer, on which they located images and videos of child pornography. Defendant's indictment followed less than a month later. Doc. 1 (filed July 8, 2015).
In his initial motion, defendant argued that the subpoena Heath used to obtain the subscriber information for 98.244.162.133 violated the Electronic Communications Privacy Act (ECPA), and defendant's Fourth Amendment rights. See doc. 29 at 3. At the October 6, 2015 evidentiary hearing, he argued that the subpoena violated state subpoena law and the ECPA, and thus the Fourth Amendment. Now, in supplemental briefing, defendant additionally argues that Heath "knowingly and intentionally made a false statement" in his warrant affidavit by listing defendant's residence as the search location when nothing connected his computer with 98.244.162.133 on June 14, 2015. Doc. 37 at 5.2
At the suppression hearing, defendant argued that (1) Heath failed to comply with a state statute governing the issuance of subpoenas,3 and thus also the ECPA,4 and (2) the subpoena failed to qualify under the ECPA as a "court order" issued by a "court of competent jurisdiction" since it was signed only by a magistrate, not superior court, judge.5 Defendant contends that without the "unlawfully-obtained" information from Comcast regarding the physical location of the IP address under investigation, the search warrant affidavit fails to establish probable cause for the search of his residence. Doc. 29 at 3.
A defendant made a similar argument recently in United States v. Torres, 2015 WL 179075 at * 3 (S.D. Ga. Jan. 14, 2015). Rejecting it, this Court reasoned that:
the unstated but implicit assumption that the judicially-crafted exclusionary rule -- designed to remedy violations of a defendant's constitutional rights -- applies to information gained in violation of state statutory provisions pertaining to the issuance of subpoenas [undergirds defendant's arguments]. But as the Eighth Circuit recently held, a law enforcement officer's failure to comply with a state statute authorizing an administrative subpoena for subscriber information of an IP address used to distribute child pornography 'would not warrant suppression of the evidence gained because federal courts in a federal prosecution do not suppress evidence that is seized by state officers in violation of state law, so long as the search complied with the Fourth Amendment.' Wheelock, 772 F.3d at 830; see also 1 WAYNE R. LAFAVE, Search and Seizure § 1.5(c) at 228-30 (5th ed 2012) ('if either federal or state officers conduct a search that is illegal under the law of the state where undertaken, the fruits thereof are not constitutionally barred from evidence in the federal courts.'). Because the acquisition of the subscriber information from Comcast violated none of defendant's Fourth Amendment rights, the agents' alleged noncompliance with the technical requirements of the Georgia subpoena statutes does not warrant the application of the exclusionary rule.
Id. (footnote omitted, emphasis in original). The same is true for any violation of the ECPA - it cannot give rise to suppression.6
The Comcast subpoena (and thus the information Comcast provided in response), defendant points out, only asked for subscriber information for 98.244.162.133 from April 21, 2015 to June 8, 2015. Heath's warrant affidavit, on the other hand, states that he observed a computer at 98.244.162.133 offering child pornography on June 14, 2015. Doc. 30-1 at 4. Because Comcast uses "dynamically assigned" IP addresses (doc. 30-1 at 13) -- i.e., a subscriber's IP address changes periodically -- defendant contends that date discrepancy means Heath knew nothing about what subscriber attached to 98.244.162.133 on June 14, 2015, six days beyond the Comcast subpoena's temporal reach. Doc. 37 at 5-6. That, says Ortega, vitiates probable cause and invalidates the warrant. Id.
Actually, responds the government, on or before June 7, 2015 Heath saw a computer connected to 98.244.162.133 offer files he believed to be child pornography, which led him to seek the Comcast subpoena. Doc. 38 at 4-5. The government concedes that Heath's warrant affidavit omits that fact, but it insists that the omission does not negate probable cause. See Franks v. Delaware, 438 U.S. 154 (1978) (). Looking within the four corners of the warrant, including the temporal gap, the government contends that 98.244.162.133 remained sufficiently connected with defendant's physical address on June 14, 2015 to support the warrant's issuance. Doc. 38 at 6-8.
"Probable cause to support a search warrant exists when the totality of the circumstances allow a conclusion that there is a fair probability of finding contraband or evidence at a particular location." United States v. Brundidge, 170 F.3d 1350, 1352 (11th Cir. 1999). It "is a fluid concept -- turning on the assessment of probabilities in particular factual contexts." Illinois v. Gates, 462 U.S. 213, 232 (1983); see also Brinegar v. United States, 338 U.S. 160, 176 (1949) ( ). A magistrate's assessment of those probabilities "should be paid great deference by reviewing courts," who, consequently, "should not invalidate . . . warrant[s] by interpreting affidavit[s] in a hypertechnical, rather than a commonsense, manner." Gates, 462 U.S. at 236.
Heath's affidavit shows that on June 7, 2015, he determined that Comcast owned IP address 98.244.162.133. Doc. 30-1 at 5. That same day, he subpoenaed Comcast's subscriber records for 98.244.162.133 for April 21, 2015 - June 8, 2015. Id. Comcast informed him that defendant, at his Rincon address, was the subscriber for 98.244.162.133 on those dates. Id. at 13.
On June 14, 2015, Heath connected to a peer-to-peer network and observed 98.244.162.133 offer a file for download whose name he recognized from prior investigations as child porn. Id. at 4. Geographic mapping of that IP address indicated a Rincon, Georgia location for the computer. Id. Heath tried to download the file but could not despite connecting directly to the computer at 98.244.162.133. Id. Still, he was able to ascertain the hash value of the file and, after comparing it to a previous investigation's confirmed child porn, found the hash values matched. Id. Finally, after confirming that defendant's address as of June 15, 2015 remained the Rincon address that Comcast provided, Heath described the contents of the file whose hash value 98.244.162.133 offered for download in order to establish that it in fact was child porn. Id. at 5-6.
As the government correctly notes, defendant's argument boils down to "whether it is reasonably likely that the IP address assigned to Ortega by Comcast as of June 8 was still so assigned on June 14." Doc. 38 at 6. To that end, Comcast IP addresses, as Comcast itself disclosed in its subpoena response, are "[d]ynamically [a]ssigned." Doc. 30-1 at 13. That means they change periodically. How periodically matters, because a significant part of Heath's probable cause showing (to secure the search warrant) hinges on the IP address's connection to Ortega's computer.
Defendant attached a 2007 study to his supplemental brief that indicates "the Comcast IP block is relatively static; over 70% observed IPs did not change user within the entire...
To continue reading
Request your trial