Monday, November 01, 2010

Dynamic IP Address and Probable Cause

This post examines a recent Connecticut case in which the defendant claimed a search warrant application was invalid because it did not indicate that the IP address linked to child pornography was “most likely dynamic”. State v. Shields, 124 Conn. App. 584, ___ A.3d ___, 2010 WL 4069147 (Connecticut Court of Appeals 2010).

This is how the issue arose:

[O]n November 4, 2005, [Officer] Grillo [of the Southbury police department] received a call from Brian Sprinkle, a detective with the Ferguson Township police department in State College. . . . Sprinkle [said] that through his investigation of Brian Gayan . . . he learned of an online conversation between Gayan and Jerome Cariaso, of 141 Rocky Mountain Road. . . . Cariaso made comments regarding sexual contact between him and his eight year old son. . . . Grillo confirmed that Cariaso resided at the address provided by Sprinkle.

On November 10, Grillo received a letter from Sprinkle that revealed that Trooper Brad of the Pennsylvania state police executed search warrants at Gayan's place of residence and place of employment. A search of his computers revealed that Gayan, using the screen name `Centralpamaster,’ had contact with seventy-five screen names belonging to minors or suspects who had spoken with him about abusing . . . children. . . . Sprinkle obtained a court order, which asked Yahoo . . . to provide log-in Internal protocol (IP) addresses for the screen name `Bi06488.’ Yahoo . . . revealed there was a recent log of IP addresses listed under that screen name. . . . [T]he IP addresses were owned by Charter Communications, and, on November 4, 2005, Charter Communications indicated that Cariaso, of 141 Rocky Mountain Road, Southbury, was the subscriber for the IP address of, the IP address in question.

Additionally, Sprinkle provided Grillo with a transcript of a Yahoo messenger conversation between `Centralpamaster’ and `Bi06488,’ in which `Bi06488” asked `Centralpamaster’ for pornographic photographs of `Centralpamaster's’ son. The person using the `Bi06488’ screen name informed `Centralpamaster’ they could not swap photographs because he did not currently have pornographic photographs of his son on his computer.

On November 14, Grillo obtained land records from the Southbury assessor's office indicating that the property at 141 Rocky Mountain Road was owned by Cariaso and Rosalie Shields. . . . . Grillo submitted a search warrant application seeking to search the subject residence.

State v. Shields, supra. (The opinion notes that “[p]ostal records show[ed] that” Robert Shields, Rosalie Shields and Carlaso all received mail at 141 Rocky Mountain Road. State v. Shields, supra.)

A judge issued the warrant, which authorized officers a search of “computer systems” for evidence of possession of child pornography and other crimes. State v. Shields, supra. Officers “seized numerous computer systems” which were later examined by computer forensics experts; the examination “revealed extensive evidence that the computers were used by” Robert Shields, not Carlaso. State v. Shields, supra. So Shields was charged with possessing and importing child pornography in violation of Pennsylvania law. State v. Shields, supra.

He moved to suppress the evidence seized from the residence, claiming the “search was unlawful because the warrant failed to establish probable cause to believe child pornography was located within the subject residence. [Shields] argued that the affidavit attached to the warrant failed to establish a connection between the screen name `Bi06488,’ the IP address and” 141 Rocky Mountain Road. State v. Shields, supra.

The trial judge denied his motion, Shields was convicted “following his conditional plea of nolo contendere” to the charge of possessing child pornography and appealed to the Connecticutt Court of Appeals. State v. Shields, supra. The opinion doesn’t make this clear, but I’m assuming he pled guilty on the condition that he could challenge the trial court’s ruling on his motion to suppress. State v. Shields, supra. (He actually filed, and appealed from the denial of, two motions to suppress, but we’re only concerned with one of them.)

On appeal, Shields renewed his argument that because the search warrant affidavit

failed to link the IP address,, to the subject residence at the exact time `Bi06488’ had the incriminating conversation with `Centralpamaster’ on July 1, 2005, the affidavit could not support a finding of probable cause. Specifically, he argues that the information provided by Charter Communications, that he was the subscriber to the IP address, failed to show there was a direct connection between the IP address and the subject residence at the exact time the incriminating conversation occurred. [Shields] argues that the affiants also failed to inform the court that the IP address was most likely dynamic and subject to change, thus rendering the affidavit insufficient to establish probable cause.

State v. Shields, supra. Shields relied, in part, on the fact that newly discovered

evidence provided that the incriminating conversation between `Bi06488’ and `Centralpamaster’ occurred on May 5, 2005, not on July 1 or August 3, 2005. It was further revealed that July 1, 2005, was the date the conversation was decoded and recorded. . . . [and] that the IP address of was dynamic and not static. Additionally, Charter Communications confirmed that the IP address was leased to Cariaso on July 15, 2005, and also on August 3, 2005. Also, when Charter Communications leased IP addresses, it was possible that the leases could continue for several months in duration.

State v. Shields, supra. In making this argument, Shields was relying on the Supreme Court’s holding in Franks v. Delaware, 438 U.S. 154 (1978). In Franks, the Court dealt with the consequences of an officer’s including a false statement in an affidavit used to obtain a search warrant. The Franks Court held that when a defendant makes a

substantial . . . showing that a false statement knowingly and intentionally, or with reckless disregard for the truth, was included . . . in the warrant affidavit, and [that] the allegedly false statement is necessary to the finding of probable cause, the Fourth Amendment requires that a hearing be held at the defendant's request. In the event that at that hearing the allegation of perjury or reckless disregard is established by the defendant by a preponderance of the evidence, and, with the affidavit's false material set to one side, the affidavit's remaining content is insufficient to establish probable cause, the search warrant must be voided and the fruits of the search excluded to the same extent as if probable cause was lacking on the face of the affidavit.

Franks v. Delaware, supra. Lower courts have held that the Franks standard applies to information omitted from a search warrant application, as well as to false statements. U.S. v. Scott, 610 F.3d 1009 (U.S. Court of Appeals for the 8th Circuit 1010). So Shields was claiming that not including the information about the dynamic IP address in the warrant triggered the Franks requirements.

The Connecticut Court of Appeals, however, didn’t buy his argument. It held, first, that as to Shields’ argument that the affidavit

inaccurately suggested the . . . conversation took place on a date other than May 5, 2005, the trial court determined that `it may have been a bit misleading, but it wasn't an inaccuracy. The affidavit indicated that the conversation was decoded on July 1 [2005], not that [it] occurred on July 1 [2005]. And July 1 [2005] was the date [o]n which . . . police were able to seize the computer and review the conversation. So, it wasn't inaccurate, though it may have implied that the conversation took place on that date. But even with respect to that information, it's not material, one way or the other, whether the conversation, in fact, took place on May 5 [2005], or July 1 [2005], but I don't find it to be an inaccuracy.’

State v. Shields, supra. With regard to Shields’ argument that the failure to tell the judge that the IP address

was dynamic and . . . obtained for the date of August 3, 2005, not May 5, 2005, the trial court . . . did not `find the . . . . omission . . . was reckless or made the warrant misleading. . . . The fact there was a dynamic IP address doesn't necessarily mean that the person using the computer on August 3 [2005] was different than the person using the computer on May 5 [2005]. And, . . . evidence . . . indicates they were . . . the same person. . . . [T]hat evidence includes the Yahoo [Inc.] document . . . which indicates that on May 5 [2005] the IP address at issue here,, that the user of that IP address was a person using the screen name Bi06488, that that's the same IP address that was used on May 5 [2005] and on August 3, 2005. The Charter Communications documents indicate that. And the Charter Communications documents also indicate that Charter Communications leased its IP address -- its dynamic IP addresses for a significant period of time, for months. . . . And so the fact that it was a dynamic IP address . . . is not dispositive of anything. I also find telling that . . . [Shields] made no offer of proof that the IP addresses were . . . or the user of the IP address on May 5 [2005] was . . . different from the user of the IP address on August 3 [2005]. . . .

[T]he fact that it was a dynamic IP address, the fact that they asked for the IP address for a different day than the offending conversation . . . were not material. . . . [I]t’s still reasonable . . . given that Charter Communications leased its IP addresses for months at a time, given that the user on May 5 [2005] was the same screen name as the user on August 3 [2005. . . all of those . . . facts [make it] reasonable to infer that it was the same user on those two dates, and if the judge had before . . . him the information [Shields] claims was omitted, it would still be reasonable to infer that they were the same person and to find probable cause to search [the residence] and to seize the computer. . . . ‘

State v. Shields, supra.

No comments: