Commonwealth v. Martinez ( 2017 )

NOTICE: All slip opinions and orders are subject to formal
revision and are superseded by the advance sheets and bound
volumes of the Official Reports. If you find a typographical
error or other formal error, please notify the Reporter of
Decisions, Supreme Judicial Court, John Adams Courthouse, 1
Pemberton Square, Suite 2500, Boston, MA, 02108-1750; (617) 557-
1030; SJCReporter@sjc.state.ma.us
SJC-12076
COMMONWEALTH vs. ADALBERTO MARTINEZ.
Bristol. October 6, 2016. - February 7, 2017.
Present: Gants, C.J., Botsford, Lenk, Hines, Gaziano, Lowy, &
Budd, JJ.
Obscenity, Child pornography. Constitutional Law, Search and
seizure. Search and Seizure, Computer. Evidence,
Information stored on computer.
Complaint received and sworn to in the Fall River Division
of the District Court Department on May 9, 2012.
A pretrial motion to suppress evidence was heard by Kevin
J. Finnerty, J., and the case was tried before him.
The Supreme Judicial Court on its own initiative
transferred the case from the Appeals Court.
Michelle A. Dame for the defendant.
Soshana E. Stern, Assistant District Attorney, for the
Commonwealth.
BOTSFORD, J. The defendant, Adalberto Martinez, appeals
from his conviction of possessing child pornography in violation
of G. L. c. 272, § 29C. He challenges the denial of his motion
2
to suppress computer evidence obtained pursuant to a search
warrant. The gravamen of the defendant's claim is that the
police needed to do more to link the defendant to the place
searched and the items seized before a warrant could validly
issue. We affirm the denial of the motion to suppress and the
conviction.
Background. 1. IP addresses. All computers that connect
to the Internet identify each other through a unique string of
numbers known as an Internet protocol address (IP address). See
Internet Corporation for Assigned Names and Numbers, Beginner's
Guide to Internet Protocol (IP) Addresses 2, 4 (2011) (ICANN
Guide). In general, when a subscriber purchases Internet
service from an Internet service provider (ISP), the ISP selects
from a roster of IP addresses under its control and assigns a
unique IP address to the subscriber at a particular physical
address. See id. at 4, 6; United States v. Kearney, 672 F.3d
81, 89-90 & n.6 (1st Cir. 2012). See also Office of Legal
Education, United States Department of Justice, Searching and
Seizing Computers and Obtaining Electronic Evidence in Criminal
Investigations 65 (2009) (DOJ, Searching and Seizing Computers).
The IP address assigned to a particular subscriber may change
over time, but the ISP keeps a log of which IP address is
assigned to each subscriber at any given moment in time. See
Kearney, supra; DOJ, Searching and Seizing Computers, supra.
3
In the early days of the Internet, when a residential
Internet subscriber went online using only a home computer
connected to a hard-wired Internet connection, there was a very
strong correlation between an IP address assigned to a
subscriber and a particular computer. Now, however, many
subscribers use a wireless Internet router, which allows
multiple devices within the range of the router to connect to
the Internet simultaneously. See United States v. McLellan, 792
F.3d 200, 213–214 (1st Cir.), cert. denied, 136 S. Ct. 494
(2015), and cases cited. To the outside world, all of these
devices will share a single public IP address -- the one that
the ISP has assigned to its subscriber. See id. But
internally, the router will identify each connected device by
the device's own identifying number in order to channel data to
and from the appropriate device. See id. See also ICANN Guide,
supra at 4. As a result, the correlation between an Internet
subscriber's assigned IP address and any one particular
Internet-enabled device may often be weaker than it once was.
However, the correlation between an IP address and a physical
address can still be strong, at least when the ISP has verified
its assignment of a particular IP address to a subscriber at a
specific physical address at a specific point in time. See DOJ,
Searching and Seizing Computers, supra at 65-66; Mackey, Schoen,
& Cohn, Unreliable Informants: IP Addresses, Digital Tips and
4
Police Raids 8-10 (Sept. 2016), available at https://www.eff.
org/files/2016/09/22/2016.09.20_final_formatted_ip_address_white
_paper_0.pdf [https://perma.cc/Y42U-C5TG] (EFF, Unreliable
Informants).
2. Search warrant affidavit. The affidavit in support of
the contested search warrant and related materials aver the
following. On March 9, 2012, State police Sergeant Michael Hill
was investigating the use of "peer-to-peer" file sharing
programs to possess and distribute child pornography. One such
file-sharing program, Ares, allows a user to connect to another
user's computer via the Internet and then download digital files
that are stored locally on the other user's computer. Ares is
an open-source software that any person can download for free
via the Internet. There is a special version of the Ares
program for law enforcement agencies that allows them to monitor
and investigate individuals suspected of using Ares to share
digital files of child pornography. Using the law enforcement
version of Ares to download a file from another Ares user,
investigators can determine (1) the user's IP address, (2)
whether the user possesses and is sharing a particular file, (3)
the "hash value" associated with a particular file,1 (4) the
user's Ares username, and (5) the version of Ares software that
1
Each file shared through Ares is identified by its "hash
value" -- a string of numbers that, for all practical purposes,
uniquely identifies a digital file.
5
the user's computer is operating. Because the law enforcement
version of Ares displays both the IP addresses of Ares users and
the hash values of files being shared, when police identify a
file as one that contains child pornography, police can
determine with a high degree of confidence when that child
pornography file is being shared through a specific IP address.
In this case, Hill discovered that a computer using the IP
address 65.96.142.191 and displaying the username
"datflypapi@Ares" was sharing suspected child pornography via
the Ares network. Through an online mapping tool (several of
which exist on publicly accessible Web sites), Hill determined
that this IP address was likely associated with a computer in
Massachusetts. The computer using this IP address was sharing a
total of ten files via the network. Hill found that a majority
of these files had names containing terms commonly associated
with child pornography. Over approximately thirty minutes, Hill
downloaded and viewed four video files from the suspect computer
and concluded that these files were child pornography. While
downloading the files, Hill used another program that confirmed
that a computer associated with the IP address 65.96.142.191 was
connected to his computer.
By conducting an Internet search, Hill determined that the
IP address in question was associated with Comcast Cable
(Comcast), a major cable company and ISP. Based on the above
6
information, the district attorney for the Berkshire district
issued an administrative subpoena to Comcast asking to whom the
IP address 65.96.142.191 was assigned during the thirty-minute
period on March 9, 2012, during which Hill downloaded the four
suspected child pornography video files from datflypapi@Ares.
Comcast responded to the subpoena on March 15, 2012, and
provided information that the IP address was assigned to a
subscriber named "Angel Martinez" at a certain address in Fall
River (apartment). Hill then referred the investigation to
Detective Steven Washington of the Fall River police department.
On April 2, 2012, Washington went to the apartment, which is
part of a housing development. Washington discovered that Maria
Avilez2 leased the apartment. On April 3, 2012, Washington
sought and received, from the Fall River Division of the
District Court, a warrant to search the apartment for computers
and related items connected to the suspected possession and
distribution of child pornography.
3. Execution of the search warrant. Washington and two
other officers executed the warrant on April 5, 2012. According
to Washington's trial testimony, when the officers first knocked
2
The search warrant and supporting affidavit identify one
of the occupants of the apartment as "Maria Avilez." The trial
transcript refers to her as "Maria Alvarez" or "Maria Avelez."
In this opinion, we use the name on the search warrant. The
search warrant affidavit also refers to Avilez as the mother of
Angel Martinez. At trial, she was identified as the grandmother
of both Angel Martinez and the defendant, Adalberto Martinez.
7
on the door of the apartment, no one answered.3 Washington then
heard someone say, "Hey, he just ran out that way," and saw a
"large male" running down a side street away from the apartment.
The officers eventually entered the apartment. Inside they
encountered the defendant's girl friend, Ruth Pereira, holding
her infant child. Both Avilez and Angel Martinez, the
defendant's cousin, arrived at the apartment while officers were
conducting the search, but the defendant was not present.
During the search, Washington noticed two laptop computers
underneath a basket of laundry. After some initial testing
(which was not described in detail in the trial record), the
officers seized the two computers and brought them back to the
police station.4 Upon further inspection at the station,
officers discovered five video files of child pornography on one
of the defendant's laptop computers. It is not clear from the
record whether any of these video files were among those
observed by Hill during his Ares surveillance on March 9, 2012.
4. Procedural history. A complaint issued charging the
defendant with one count of distribution of material depicting a
child engaged in a sexual act, in violation of G. L. c. 272,
3
The pretrial hearing on the defendant's motion to suppress
evidence seized during the search of the apartment was
nonevidentiary.
4
The defendant's girl friend, Ruth Pereira, testified at
trial that the two computers belonged to the defendant. The
defendant does not challenge the accuracy of this testimony.
8
§ 29B (b), and one count of possession of child pornography, in
violation of G. L. c. 272, § 29C. Prior to trial, the defendant
moved to suppress the evidence obtained in executing the search
warrant described above. He argued that the search warrant
affidavit did not establish probable cause that the contraband
being sought would be present in the apartment, and therefore
the search violated his rights under the Fourth Amendment to the
United States Constitution and art. 14 of the Massachusetts
Declaration of Rights. After a hearing, a District Court judge
denied the motion. The judge ruled that the affidavit and
accompanying exhibits provided probable cause to believe
evidence of specific criminal activity would be found at the
apartment.
The defendant was tried before and convicted by a jury in
the District Court on the charge of possession of child
pornography; the Commonwealth filed a nolle prosequi of the
distribution charge. The defendant timely appealed from his
conviction, and we transferred the appeal to this court on our
own motion.
Discussion. The sole issue on appeal is the validity of
the search warrant issued for the apartment. Detective
Washington's affidavit in support of the search warrant averred
that a particular IP address was used to share child pornography
and that this IP address had been assigned at the time in
9
question to an Internet subscriber at the specific physical
address to be searched. The central question is whether these
averments were sufficient to establish probable cause for the
search, even though the named subscriber was neither listed as,
nor confirmed to be, living in the unit, and even though police
had no information before the search linking the defendant to
the residence. We conclude that the affidavit in this case did
establish probable cause to search the apartment for computer
evidence related to the suspected possession or distribution of
child pornography.
"Under the Fourth Amendment and art. 14, a search warrant
may issue only on a showing of probable cause."5 Commonwealth v.
5
The defendant is correct that, in certain circumstances,
art. 14 of the Massachusetts Declaration of Rights provides more
substantive protection to criminal defendants than the Fourth
Amendment to the United States Constitution. See, e.g.,
Commonwealth v. Rodriguez, 472 Mass. 767, 776 (2015). Here, we
conclude that there was probable cause for the search warrant
under both art. 14 and the Fourth Amendment. As for the Fourth
Amendment, our conclusion accords with the decisions of several
Federal courts that have found probable cause in similar factual
settings. See, e.g., United States v. Valley, 755 F.3d 581, 587
(7th Cir.), cert. denied, 135 S. Ct. 461 (2014) (probable cause
existed when investigators downloaded child pornography from IP
address, then traced IP address to residence defendant shared
with his mother); United States v. Vosburgh, 602 F.3d 512, 526
(3d Cir. 2010), cert. denied, 563 U.S. 905 (2011) (noting that
"several Courts of Appeals have held that evidence that the user
of a computer employing a particular IP address possessed or
transmitted child pornography can support a search warrant for
the physical premises linked to that IP address," and so
holding); United States v. Perez, 484 F.3d 735, 740 (5th Cir.),
cert. denied, 552 U.S. 952 (2007) (probable cause based on
information in affidavit that child pornography was viewed by
10
Anthony, 451 Mass. 59, 68 (2008). "The probable cause necessary
to support the issuance of a search warrant does not require
definitive proof of criminal activity." Id. at 69. Rather, a
warrant may issue if a magistrate finds "a substantial basis on
which to conclude that the articles or activity described are
probably present or occurring at the place to be searched"
(emphasis in original). Id. To determine whether probable
cause exists, our inquiry "always begins and ends with the four
corners of the affidavit." Id. at 68, quoting Commonwealth v.
O'Day, 440 Mass. 296, 297 (2003). For probable cause to arise,
the facts contained in an affidavit, plus the reasonable
inferences that may be drawn from them, must allow the
magistrate to determine that "the items sought are related to
the criminal activity under investigation, and that they
reasonably may be expected to be located in the place to be
searched at the time the search warrant issues." Commonwealth
v. McDermott, 448 Mass. 750, 767, cert. denied, 552 U.S. 910
(2007), quoting Commonwealth v. Cinelli, 389 Mass. 197, 213,
cert. denied, 464 U.S. 860 (1983). See Anthony, supra at 68.
computer using particular IP address and that this IP address
was assigned to user at specific physical address; noting that
although "it was possible that the transmissions originated
outside of the residence to which the IP address was assigned,
it remained likely that the source of the transmissions was
inside that residence"); United States v. Grant, 218 F.3d 72, 75
(1st Cir.), cert. denied, 531 U.S. 1025 (2000) (probable cause
existed even discounting for possibility that someone other than
Internet account registrant was using account).
11
"[S]earch warrant affidavits are to be interpreted in a
realistic and commonsense manner," not "subjected to
hypercritical analysis" (citation omitted). Id. at 69.
The probable cause inquiry in this case asks whether the
facts averred in Washington's affidavit showed a sufficient
nexus between the suspected criminal activity (possessing or
distributing child pornography), the items sought (computers and
related materials), and the place to be searched (the
apartment). See McDermott, 448 Mass. at 768-769. To that end,
the nexus between the suspected criminal activity, the items
sought, and the place to be searched may be based on, among
other things, the type of crime, the extent of the suspect's
opportunity for concealment, and normal inferences about where a
criminal would be likely to hide evidence of the suspected
crime. See id. at 768.
Here, the affidavit described how Sergeant Hill had
observed a computer associated with the IP address 65.96.142.191
that contained, and was sharing, child pornography via the Ares
network. An Internet search revealed that this IP address had
been issued to Comcast, the ISP. The district attorney for the
Berkshire district then issued a subpoena to the ISP, which
revealed that the IP address in question had been assigned
during the relevant time period to a subscriber at the physical
12
address of the apartment.6 The temporal and geographical links
between the target IP address and the physical address to be
searched provided a substantial basis for concluding that
evidence sought (computers and related items) was connected to
the suspected crime (possessing or sharing child pornography)
and likely would be found at the specified premises (the
apartment), and therefore gave rise to a sufficient nexus
between the suspected criminal activity and the residence. See
Commonwealth v. Augustine, 472 Mass. 448, 455 (2015);
Commonwealth v. Foster, 471 Mass. 236, 241–242 (2015).
Of course, the ISP also provided a name associated with the
service address and officers took subsequent steps to determine
who actually lived at the apartment. In many cases, those
pieces of information can serve a useful confirmatory role. But
in the present case, we conclude that there was probable cause
to search for evidence related to sharing child pornography
based on the information police obtained through their Ares
surveillance and the administrative subpoena, independent of
whose name was on the Internet account or in the housing
6
We note that the administrative subpoena is generally a
more reliable method of connecting an IP address with a physical
address, as compared to certain IP address mapping services.
See Mackey, Stanton, Schoen, & Cohn, Electronic Frontier
Foundation, Unreliable Informants: IP Addresses, Digital Tips
and Police Raids 8-9 (Sept. 2016), available at https://www.eff.
org/files/2016/09/22/2016.09.20_final_formatted_ip_address_white
_paper_0.pdf [https://perma.cc/Y42U-C5TG] (discussing error
rates of some IP address mapping services).
13
development's records. The probable cause showing necessary for
issuance of a search warrant is "only a fair probability that
evidence of such a crime would be found in particular
locations," not "a prima facie showing that the defendant
possessed child pornography." Anthony, 451 Mass. at 72. Police
met that threshold here.
The defendant advances, in essence, three arguments about
why investigators needed to do more to establish probable cause.
We address each in turn.
First, he points out that before applying for the search
warrant, the police were unable to verify that the subscriber
named by the ISP -- Angel Martinez -- lived at the apartment,
and also were unable to rule out the possibility that someone
other than the named subscriber was responsible for using the IP
address assigned to the apartment at the time in question.
Therefore, the defendant argues, it was possible that a new (and
innocent) person had moved into the apartment while Angel
Martinez, living at a different address altogether, continued to
pay the Internet bill, or that a new occupant merely took over
the Internet payments without changing the name on the account.
To support his position, the defendant cites several cases in
which investigators obtained more information linking an
individual suspect to a specific physical address before
applying for a search warrant. See, e.g., United States v.
14
Elbe, 774 F.3d 885, 887–888 (6th Cir. 2014), cert. denied, 135
S. Ct. 1573 (2015) (agents observed person matching child
pornography suspect's driver's license photograph sitting on
porch of target residence); United States v. Stults, 575 F.3d
834, 838 (8th Cir. 2009), cert. denied, 559 U.S. 915 (2010)
(public records check using LexisNexis, postal service mail
delivery check, and motor vehicle registration check all
confirmed that named Internet subscriber actually resided at
target residence).
It is true that investigators had no direct information
that Angel Martinez personally had used, was using, or would
ever use the IP address in question. However, in this
particular case, the name of the Internet account holder did not
defeat probable cause. See Commonwealth v. Molina, 476
Mass. , (2017). The question before the magistrate was
whether the apartment located at a certain address likely
contained evidence of criminal activity -- period. The question
was not whether that address likely contained evidence of
criminal activity on the part of Angel Martinez (or on the part
of Avilez for that matter).
To that end, Detective Washington's supporting search
warrant affidavit spelled out a relatively direct link between
(1) the downloading and sharing of child pornography video
files, (2) a specific IP address, and (3) a specific physical
15
address to which that IP address had been assigned. From a
technological standpoint, an IP address can be assigned to only
one service address at any given point in time. See United
States v. Vosburgh, 602 F.3d 512, 527 & n.14 (3d Cir. 2010),
cert. denied, 563 U.S. 905 (2011), and cases cited (noting
"unique nature of the IP address assigned" to defendant on
particular date made Internet activity on that date "fairly
traceable" to specific ISP account and associated physical
address); DOJ, Searching and Seizing Computers, supra at 65.
Taken together, these facts gave rise to a reasonable inference
that evidence related to possession or distribution of child
pornography via the Internet likely would be found at the
apartment -- the one place, according to the ISP's records, to
which the IP address in question was assigned during the
relevant time period.
Once this nexus was established, the name of the account
holder was essentially incidental. See Molina, 476 Mass. at
. Although information showing that the named subscriber was
also the person suspected of possessing or sharing the child
pornography might have increased the likelihood that the sought-
after evidence would be located at the service address, the lack
of such information does not necessarily defeat probable cause.
See United States v. Grant, 218 F.3d 72, 75 (1st Cir.), cert.
denied, 531 U.S. 1025 (2000). This is so precisely because an
16
IP address can be assigned to only one service address at any
given time -- regardless of whose name is on the account.7 See
Vosburgh, 602 F.3d at 527 & n.14.
Second, the defendant points out that investigators did not
determine whether the Internet connection at the apartment used
a wireless router and, if so, whether the wireless network
required a password. This left open the possibility that
someone other than the subscriber, located at a different
physical address, was "joyriding" on an unsecured wireless
network based out of the apartment. See Snow, Accessing the
Internet Through the Neighbor's Wireless Internet Connection:
Physical Trespass in Virtual Reality, 84 Neb. L. Rev. 1226,
1227-1229 (2006). The defendant argues that this concern is
especially acute in the present case because investigators knew
that the apartment was part of a housing development, in which
multiple residences were in close proximity to the target
physical address.
The defendant's argument is misdirected. A showing of
probable cause to search a place (as opposed to arrest a person)
7
The defendant does not now claim that the information in
the police affidavit had become stale. The defendant's motion
to suppress did include a passing reference to staleness.
However, this theory was not advanced at the suppression motion
hearing, and the defendant's brief does not make such an
argument. Any staleness issue, therefore, is waived. See
Commonwealth v. Wood, 389 Mass. 552, 554 n.3 (1983), citing
Mass. R. A. P. 16 (a) (4), as amended, 367 Mass. 919 (1975).
17
need not identify a specific criminal suspect -- although
frequently it does. See Zurcher v. Stanford Daily, 436 U.S.
547, 555–557 & n.6 (1978). See also Molina, 476 Mass. at .
Indeed, "[t]he critical element in a reasonable search is not
that the owner of the property is suspected of crime but that
there is reasonable cause to believe that the specific 'things'
to be searched for and seized are located on the property to
which entry is sought." Zurcher, supra at 556. In other words,
police need only demonstrate a sufficient nexus between the
criminal activity under investigation, the items sought, and a
place to be searched where the items may reasonably be expected
to be located -- independent of whether they have identified a
specific criminal suspect.8 See McDermott, 448 Mass. at 767-768;
O'Day, 440 Mass. at 302-304. Certainly police may have an
easier time demonstrating a sufficient nexus if they can link a
specific suspect (e.g., the named Internet account holder) to
8
To this point, the prosecutor and Detective Steven
Washington had the following colloquy at trial:
Q.: "Now when you execute a warrant like this . . . are
you conducting . . . [the search] for a person or for a
device?"
A.: "A device."
Q.: "Okay. And why is that?"
A.: "Because I have no clue who is behind that device."
18
the criminal activity. However, such a link is not always
required.
The search warrant affidavit in this case demonstrated that
child pornography was being shared via the Internet from a
specific IP address. This IP address, in turn, had been
assigned to a specific physical address during the time when the
child pornography was being shared. These facts provided a
substantial basis from which to conclude that evidence of
downloading and sharing child pornography via the Internet would
be located at the apartment, even if it turned out that an
unauthorized user was "joyriding" using the targeted IP address.
See Augustine, 472 Mass. at 455; Commonwealth v. Escalera, 462
Mass. 636, 645 (2012), quoting 2 W.R. LaFave, Search and Seizure
§ 3.7(d), at 420–421 (4th ed. 2004) (police do not need to
provide definitive proof that evidence of suspected criminal
activity will be located at targeted residence, only facts
supporting reasonable inference that such evidence "probably"
would be located there). See also Grant, 218 F.3d at 75 (even
discounting for possibility that individual other than
subscriber may have been using account, there was fair
probability that subscriber was user and that evidence of user's
illegal activities would be found in subscriber's home).9
9
This close nexus also distinguishes a case like
Commonwealth v. Kaupp, 453 Mass. 102 (2009). In that case, we
19
The defendant is correct, from a technological standpoint,
that if an Internet subscriber at the apartment set up an
unsecured wireless Internet network, a computer outside of this
physical address (in a neighboring unit, perhaps) could have
used the targeted IP address to access the Internet and share
child pornography.10 This point misses the mark, because
held that police lacked probable cause to search a specific
computer for evidence of child pornography. Id. at 113-114.
However, in the Kaupp case, there was no indication that a
specific IP address had been used to download or share child
pornography. Instead, police essentially relied on the fact
that the targeted computer may have shared another,
nonpornographic file with a computer that did contain child
pornography, and that these two computers were connected in a
way that made it possible for them to share other files. See
id. at 111-112. The nexus in this case -- where an officer
directly observed child pornography being transmitted through
the targeted IP address, which could only be assigned to one
physical address at the time in question -- is substantially
stronger.
10
Notably, there was no evidence, either at the suppression
stage or at trial, that the apartment was home to an unsecured
wireless Internet connection or that anyone other than the
defendant used the Internet connection there. Nor was there any
evidence that the defendant did not connect his laptop computers
to the Internet through the IP address assigned to the
apartment. However, even if we accept the defendant's
hypothetical scenario of "joyriding," and it turned out that
none of the defendant's devices contained child pornography,
police still would have had probable cause to seize and search
any Internet modems or routers in order to determine which
devices were connected to the targeted IP address at the time
when police witnessed child pornography being shared via the
targeted IP address. See United States v. Stanley, 753 F.3d
114, 115-117 (3d Cir.), cert. denied, 135 S. Ct. 507 (2014)
(describing how wireless Internet router keeps log of devices
that have connected to it). If those devices, or other
information, then led police to a device at a different physical
address from the one linked to the IP address through the ISP's
20
probable cause does not require investigators to "establish to a
certainty that the items to be seized will be found in the
specified location," nor does it require them to "exclude any
and all possibility that the items might be found elsewhere."
Anthony, 451 Mass. at 70, quoting Commonwealth v. Harmon, 63
Mass. App. Ct. 456, 461 (2005).
Finally, the defendant argues that, in a case like this,
probable cause cannot arise until police show one of three
things: (1) that the target IP address has not been linked to a
wireless Internet service; (2) that the target IP address is
linked to a wireless Internet service, but it is a secure
connection requiring a password; or (3) that no one outside the
target physical address could be accessing the network. The
defendant urges that, without these showings, the likelihood of
someone outside the target physical address using the target IP
address is substantial enough to defeat probable cause. By and
large, these proposals simply restate the defendant's arguments
records, police likely would have needed another warrant. Cf.
United States v. Voustianiouk, 685 F.3d 206, 213-214 (2d Cir.
2012) (where police omitted target's name from application for
warrant to search specific apartment, second warrant was
required once it became clear target lived in different
apartment); United States v. Greathouse, 297 F. Supp. 2d 1264,
1274–1275 (D. Or. 2003) (second warrant required when it became
clear to officers executing warrant that target resided in
rented room within house). But, as illustrated above, that
scenario is several steps removed from what occurred here, where
police quickly located two laptop computers that belonged to the
defendant, one of which contained five video files of child
pornography.
21
urging that the police, in order to show probable cause, should
have been required to rule out the possibility that persons
outside of the apartment may have been "joyriding" on the IP
address assigned to that location at the time in question. To
the extent that is the case, we reject these proposals for the
reasons already mentioned.
Moreover, as the Commonwealth points out, it is not clear
whether it would be technologically feasible for investigators
to do what the defendant asks. With respect to the first
proposal, there is nothing in the record showing that a third
party (like an ISP, for instance) would be able to determine
whether a subscriber's connection to the Internet is through a
hard-wired or wireless connection at any given point in time.
With respect to the second, in the case of a subscriber who uses
a wireless router, it is not clear how investigators would be
able to ascertain whether the network is password-protected
without first learning the name of that subscriber's wireless
network. And regarding the third proposal, even assuming
investigators knew that a target IP address was associated with
an unprotected wireless network that had been accessed by
devices not belonging to the subscriber, these considerations
would not necessarily change the fact that, given the Ares
surveillance conducted in this case, there remained a fair
probability that any computers located at the apartment would
22
contain evidence related to the possession or distribution of
child pornography. See United States v. Stanley, 753 F.3d 114,
115-117 (3d Cir.), cert. denied, 135 S. Ct. 507 (2014) (based on
file-sharing surveillance similar to that conducted in this
case, police obtained valid search warrant for home linked to
target IP address; only after police found no evidence of child
pornography there and learned, in course of their search, that
home deployed wireless Internet network that was not password-
protected did they take subsequent steps to locate true
suspect); United States v. Perez, 484 F.3d 735, 740 (5th Cir.),
cert. denied, 552 U.S. 952 (2007) (although possible that
Internet transmissions originated outside of residence to which
IP address was assigned, it remained likely that source of
transmissions was inside that residence); Grant, 218 F.3d at 75
(similar); United States v. Carter, 549 F. Supp. 2d 1257, 1268–
1269 (D. Nev. 2008) (similar). The defendant's proposals merely
illustrate that different hypothetical scenarios could lead to a
different conclusion regarding probable cause. But those
potentialities do not necessarily defeat probable cause,
especially when they lack any factual underpinning. See
Anthony, 451 Mass. at 70 (discussing nexus requirement).
Instead, the fundamental question is whether there was a
substantial basis from which to conclude that the items
described in the application were probably present at the place
23
to be searched. See id. at 69. For all of these reasons, we
affirm the denial of the defendant's motion to suppress.11
We end with a cautionary note. Our decision today should
not be read to mean that probable cause always exists any time
investigators link illegal computer activity to an IP address
and then link that IP address to a physical address. For one,
police should (as they did in this case) connect the IP address
with a physical address through a reliable method, such as an
administrative subpoena to the ISP, rather than relying solely
on a potentially unreliable method, such as certain IP address
mapping services. See note 6, supra. Additionally,
technologies that apparently were not at issue in this case may
further erode the connection between an IP address and a
physical address. See EFF, Unreliable Informants, supra at 10-
11 (discussing how Tor exit relays, virtual private networks,
and proxy server connections can mask originating IP addresses
through use of one or more intermediary IP addresses); Vosburgh,
602 F.3d at 527 n.14 (discussing "possibility of mischief and
mistake with IP addresses" such that, in some cases, "value of
11
The defendant does not challenge the reasonableness or
scope of the search of his digital files once police had seized
his computers, nor does he raise the related issue whether
courts should require police to develop minimization techniques
to govern the execution of a digital search. Accordingly, we
need not address those issues here. However, in an appropriate
case, we would consider whether to require some type of digital
search protocol. See Commonwealth v. Molina, 476 Mass. ,
(2017).
24
that IP address for probable cause purposes may be greatly
diminished, if not reduced to zero").
At the very least, certain cases may require police to
disclose in a search warrant affidavit the possibility that one
of these technologies is, or may be, in play based on facts
known or reasonably knowable to investigators at the time. See
EFF, Unreliable Informants, supra at 18. If such technologies
become more common, it is entirely possible that we would
require police to proceed in multiple steps, obtaining subpoenas
related to each intermediary IP address or warrants to search
each location hosting those IP addresses. Alternatively, some
cases may require the police to examine forensically a wireless
router to determine which devices were connected to it, and
when, before they search particular computers. See Stanley, 753
F.3d at 115-117 (describing police investigation based on
information obtained by examining innocent Internet user's
unprotected wireless Internet router that had been "hijacked" by
neighbor-defendant to share child pornography).
Such possibilities demonstrate why the probable cause
analysis rarely, if ever, lends itself to bright-line rules.
See Escalera, 462 Mass. at 643 ("No bright-line rule can
establish whether there is a nexus" between suspected criminal
activity and defendant's home). This is especially so when, as
here, the analysis hinges on fluid and rapidly changing
25
technologies. Cf. Commonwealth v. Dorelas, 473 Mass. 496, 502 &
n.11 (2016) (noting that "what might have been an appropriate
limitation [on searches] in the physical world becomes a
limitation without consequence in the virtual one"); id. at 505
(Lenk, J., dissenting) (transposing protections of art. 14 and
Fourth Amendment to digital contexts "is an ongoing and
challenging task"); Commonwealth v. Phifer, 463 Mass. 790, 797
(2012) (noting that developments in cellular telephone
technology "present novel and important questions about the
relationship between the modern doctrine of search incident to
arrest and individual privacy rights").
Conclusion. The order denying the motion to suppress and
the defendant's conviction are affirmed.
So ordered.