An Overview
Persons charged with child pornography (“CP”) face a myriad of legal issues and potentially drastic and life-altering consequences. Not only are the risks of incarceration significant, particularly in federal investigations, but the requirements and consequences of sexual offender registration will, in most cases, last well beyond the terms of any criminal sentence – and may last a lifetime.
Recently it appears that there is a renewed push by law enforcement on CP investigations and prosecutions. While CP investigations employ a variety of investigative techniques to identify individuals in possession of and distributing child pornography, one of the most common investigative methods is one where CP investigators join peer-to-peer networks and then search for CP on the computers of individuals/computers logged in as part of the network. When such images or videos are located, copies are “grabbed” (retrieved) and then the IP address of the offending computer is identified and, based upon that information a search warrant is executed at the physical location of the IP address and any computers and related storage media seized and inspected. Often in those instances where, by the time the search warrant has been executed, the CP may have been deleted, there is still trace evidence of prior CP activity in the cache or browser history or in the deleted or slack space of the computer’s hard drive. Even where such evidence cannot be recovered, investigators still have the evidence from the peer-to-peer “grab.”
One of the often unknown or unrealized issues associated with those who are part of a peer-to-peer network occurs when they join the network and install the peer-to-peer program. Many programs, by default, not only permit the person installing the program to access other files on the network but also let other members of the network have access that person’s shared folder files. If the “do not share” function is available on the program and is activated that would block others from accessing the user’s shared folder. In those instances where the “share” feature is not de-activated and where images or videos have been “grabbed” by investigators – that passive act by the user of allowing, intentionally or otherwise, access to images or videos on the user’s computer has been found to be sufficient by many courts to support a conviction for distribution of child pornography – even though there was no actual action by the user to send out or distribute the images or videos “grabbed” by investigators.
Internet Service Providers are required to notify law enforcement when there is evidence of their services being used to acquire or distribute CP. As an example, if a person sets up a personal Dropbox account to save CP in the cloud, Dropbox is likely to identify it and report it to law enforcement.
In most of the instances in the dozens of federal and state CP cases that I’ve handled, the subject of the investigation waives his Miranda rights and agrees to speak to investigators and gives damning admissions that, together with even a limited amount of CP evidence, provides a strong case for the prosecution. In some instances, where the subject does not speak and the evidence of CP is limited and there are others who may have had access to the computer(s) at issue, there may be issues of evidentiary sufficiency.
More than one of my clients has expressed shock at the severity of the consequences of viewing CP, even where the CP is simply viewed and not saved or where it is immediately deleted. Federal court mandatory minimum sentences of 5 years for the act of just receiving/downloading images and/or videos, plus federal sentencing guidelines in excess of 5 years for the same conduct and lifetime sexual offender registration is common. If there is evidence of production of CP by the subject, mandatory minimum sentences of 15 years apply.
In Maryland state court there are no mandatory minimum sentences for possession and distribution of CP, but sexual offender registration of 15 years is required unless one receives probation before judgment and the court orders that registration is not required.
Fone v. State
Challenges to the search warrants executed to recover computers and related storage media suspected of containing CP are seldom successful. Once the IP address of the computer is identified, the probable cause threshold is generally easily met. The issue of whether there can be a “staleness” challenge even when some time, even years, may have passed from the original evidence showing that CP was acquired or possessed, was recently addressed in Fone v. State, No. 962, Sept. Term, 2016, 2017 WL 2438484, at 6-8 (Md. Ct. Spec. App. June 6, 2017).
Fone also provides a good overview of one the investigative techniques utilized by law enforcement to discover the location of CP. Fone reviews the issue of probable cause “staleness” in the context of a search warrant for CP and concludes noting that even if fresh probably cause was lacking, the “good faith” exception saved the warrant. The following is the analysis from Fone:
“One of the factors in the ‘probable cause puzzle’ concerns the staleness of the information contained in an affidavit supporting a search warrant application.” Behrel v. State, 151 Md.App. 64, 88, 823 A.2d 696 (2003) (quoting West v. State, 137 Md.App. 314, 327-28, 768 A.2d 150 (2001)). “There is no ‘bright-line’ rule for determining the ‘staleness’ of probable cause; rather, it depends upon the circumstances of each case, as related in the affidavit for the warrant.” Connelly v. State, 322 Md. 719, 733, 589 A.2d 958 (1991). In making that assessment, the court considers whether “the ‘event[s] or circumstance[s] constituting probable cause, occurred at … [a] time … so remote from the date of the affidavit as to render it improbable that the alleged violation of law authorizing the search was extant at the time[.]’ ” Patterson v. State, 401 Md. 76, 92, 930 A.2d 348 (2007) (quoting Peterson v. State, 281 Md. 309, 314, 379 A.2d 164 (1977)). That assessment turns on the particular facts of the case:
The ultimate criterion in determining the degree of evaporation of probable cause, however, is not case law but reason. The likelihood that the evidence sought is still in place is a function not simply of watch and calendar but of variables that do not punch a clock: the character of the crime (chance encounter in the night or regenerating conspiracy?), of the criminal (nomadic or entrenched?), of the thing to be seized (perishable and easily transferable or of enduring utility to its holder?), of the place to be searched (mere criminal forum of convenience or secure operational base?), etc. The observation of a half smoked marijuana cigarette in an ashtray at a cocktail party may well be stale the day after the cleaning lady has been in; the observation of the burial of a corpse in a cellar may well not be stale three decades later. The hare and the tortoise do not disappear at the same rate of speed. Andresen v. State, 24 Md.App. 128, 172, 331 A.2d 78 (1975) (emphasis added).
Several federal courts addressing staleness of probable cause in the context of child pornography stored on digital devices have reasoned that because digital images have a “potentially infinite lifespan,” United States v. Elbe, 774 F.3d 885, 891 (6th Cir. 2014), cert. denied, — U.S. —-, 135 S.Ct. 1573, 191 L.Ed.2d 656 (2015), ” ‘the passage of time alone’ cannot demonstrate staleness.” United States v. Burkhart, 602 F.3d 1202, 1206 (10th Cir. 2010) (quoting United States v. Mathis, 357 F.3d 1200, 1207 (10th Cir. 2004)). In Seiver, 692 F.3d at 775-76, for example, the Seventh Circuit held that a seven-month delay from the date that child pornography images were downloaded from the internet to the defendant’s computer to the date a search warrant for the defendant’s computer was applied for did not render the information stale. The court opined:
“Staleness” is highly relevant to the legality of a search for a perishable or consumable object, like cocaine, but rarely relevant when it is a computer file. Computers and computer equipment are “not the type of evidence that rapidly dissipates or degrades.” United States v. Vosburgh, 602 F.3d 512, 529 (3d Cir. 2010). Because of overwriting, it is possible that the deleted file will no longer be recoverable from the computer’s hard drive. And it is also possible that the computer will have been sold or physically destroyed. And the longer the interval between the uploading of the material sought as evidence and the search of the computer, the greater these possibilities. But rarely will they be so probable as to destroy probable cause to believe that a search of the computer will turn up the evidence sought; for probable cause is far short of certainty-it “requires only a probability or substantial chance of criminal activity, not an actual showing of such activity,” Illinois v. Gates, 462 U.S. 213, 244 n. 13, 103 S.Ct. 2317, 76 L.Ed.2d 527 (1983), and not a probability that exceeds 50 percent (“more likely than not”), either. Hanson v. Dane County, 608 F.3d 335, 338 (7th Cir. 2010).
Id. at 777 (emphasis in original).
The Seiver court recognized that after a very long time, the likelihood that the defendant still has [a particular] computer, and if he does that the file hasn’t been overwritten, or if he’s sold it that the current owner can be identified, drops to a level at which probable cause to search the suspect’s home for the computer can no longer be established. Id. (emphasis in original). Seven months was far too short a period of time for that to occur, however. See also United States v. Carroll, 750 F.3d 700, 704-05 (7th Cir. 2014) (five-year gap between date victim alleged she was molested by defendant, at which time he showed her images of child pornography and took digital images of her genitals, and date of warrant application was not so remote as to render probable cause to search the defendant’s home and seize cameras and other digital devices stale); Burkhart, 602 F.3d at 1206-07 (information pertaining to an email between child pornography distributor and the defendant two years and four months before issuance of a search warrant not stale); United States v. Morales-Aldahondo, 524 F.3d 115, 119 (1st Cir. 2008) (lapse of three years between the defendant’s purchase of digital child pornography images and warrant application did not render search warrant stale); but see United States v. Greathouse, 297 F.Supp.2d 1264, 1272-73 (D. Ore. 2003) (information that child pornography was distributed from a computer f: drive 13 months before a search warrant was applied for was stale, so search warrant was not supported by probable cause).
In the case at bar, the March 18, 2015 warrant application showed that Google made its disclosure to the NCMEC about ten weeks earlier, on January 2, 2015. NCMEC then reported the information from Google to the MCPD, which engaged in the investigation set forth in the affidavit. Google gave the information to NCMEC pursuant to a federal statute mandating ISPs to notify the NCMEC of suspected child pornography “as soon as reasonably possible.” We agree with the suppression court that, given that statutory mandate, the judge to whom the warrant application was presented rationally could infer that the image of suspected child pornography was attached to an email on a day reasonably close in time to January 2, 2015, and certainly within a few years. In this case, in which the lapse between the report from Google and the issuance of the search warrant was only three months and the lapse between the emails of August 24 and the warrant was only seven months, Detective Pallas’s averments about the habits of possessors of child pornography and the ability of the police “to recover files and data from computer media [even] after it has been deleted” gave rise to a substantial basis for the issuing judge’s probable cause determination. See Behrel, 151 Md.App. at 90, 823 A.2d 696 (“In analyzing the issue of staleness, ‘the expertise and experience of the officer are to be taken into account in applying the Fourth Amendment probable cause test,’ even if ‘the officer would not qualify as an expert witness on the subject.’ ” (quoting 2 LaFave, § 3.2(c), at 38-39, 38 n.70)).
If we agreed with the appellant that the information in the warrant application was stale, which we do not, we nevertheless would agree with the suppression court that the good faith exception applied.
Evidence seized without a warrant or based upon a warrant not supported by probable cause may be subject to exclusion. See, e.g., Agurs v. State, 415 Md. 62, 76, 998 A.2d 868 (2010). Unlike a warrantless search, however, “searches pursuant to a warrant will rarely require any deep inquiry into reasonableness, for a warrant issued by a magistrate normally suffices to establish that a law enforcement officer has acted in good faith in conducting the search.” Leon, 468 U.S. at 922, 104 S.Ct. 3405 (citations omitted). Thus, “[i]n the absence of an allegation that the magistrate abandoned his detached and neutral role, suppression is appropriate only if the officers were dishonest or reckless in preparing their affidavit or could not have harbored an objectively reasonable belief in the existence of probable cause.” Id. at 926, 104 S.Ct. 3405 (emphasis added).
The Leon Court outlined four scenarios in which the good faith exception will not apply:
(1) the magistrate was misled by information in an affidavit that the officer knew was false or would have known was false except for the officer’s reckless regard for the truth;
(2) the magistrate wholly abandoned his detached and neutral judicial role;
(3) the warrant was based on an affidavit that was so lacking in probable cause as to render official belief in its existence entirely unreasonable; and
(4) the warrant was so facially deficient, by failing to particularize the place to be searched or the things to be seized, that the executing officers cannot reasonabl[y] presume it to be valid.
Id. at 923, 104 S.Ct. 3405.
The appellant relies only upon the third scenario.
Where, as here, the facts are not in dispute, we review the suppression court’s ruling on “the applicability of the Leon good faith exception to the exclusionary rule … de novo[.]” Patterson, 401 Md. at 104-05, 930 A.2d 348. In assessing whether the warrant application was “so lacking in probable cause as to render official belief in its existence entirely unreasonable,” Leon, 468 U.S. at 923, 104 S.Ct. 3405, we apply an objective test to determine whether “officers, exercising professional judgment, could have reasonably believed that the averments of their affidavit related a present and continuing violation of law, not remote from the date of their affidavit, and that the evidence sought would be likely found at [the place identified in the affidavit].” Connelly, 322 Md. at 735, 589 A.2d 958. As this Court has explained, that reasonable belief test will not be satisfied when the warrant application contains “nothing beyond mere conclusions.” State v. Jenkins, 178 Md.App. 156, 203, 941 A.2d 517 (2008).
What then to do?
Despite the difficulties in CP matters, due diligence is still required in every case. There are instances when the client believes that there is CP on the seized computers and storage media, but the forensic analysis cannot recover it. This seldom occurs, but I have had it occur and no prosecution followed so it is important not to get ahead of the investigation and make admissions or take positions with the prosecutor until you have certainty with respect what evidence exist.
Even where there is certain evidence of CP, the nature and magnitude of the evidence, the frequency of the viewing and the time over which the CP activity has occurred can be factors that the prosecutor considers in deciding whether to have the case handled in state or federal court. If there is going to be a prosecution, it is a major “win” if the matter is handled in state court.
Mitigation preparation should begin promptly. A psycho-sexual evaluation by a certified evaluator is critical. In subsequent discussions with the prosecutor you will want (and hopefully be able to secure) an evaluation that helps explain the CP conduct by the client, and also confirms that the client is not a pedophile nor possessing of pedophiliac tendencies. A successful evaluation will also provide support for your position that there is a low likelihood of the client re-offending. The evaluator should also address the need for counseling and the client should be involved in on-going therapy sessions, including perhaps attendance at sex anonymous meetings. Not only are therapy sessions important in addressing the legal issues, but most of my clients have found them extremely useful in both addressing the underlying circumstances that lead to the CP conduct and useful in helping them cope with uncertain and often frightening uncertainties of what will have when the investigation/prosecution concludes.
There is no sympathy in the general community for CP offenders, until that person is someone close someone in the community. Then understanding and hope for a favorable outcome appear. Most CP offenders have unblemished backgrounds, are productive members of the community, have strong family support and are unlikely to ever again engage in CP conduct. It is unfortunate, particularly in the federal system, that punishment and sexual offender registration consequences are not able to better proportioned to the nature of the offender and the offense. There is a need for reduced penalties and lessened registration requirements for those who are engaged at the lower level of CP activity.
Jurors and many judges do not separate the persons who are simply viewers of CP from those who produce it, distribute it and make money through making it so readily accessible on the internet so when there is a discussion of CP – everyone is lumped together with no consideration of the offender’s individual and personal characteristics. While the position of CP prosecutors that every viewing of an image or video of CP is an additional injury to the child depicted in the video or image is appropriate and understandable, in many instances the persons who are viewing CP are victims as well, albeit of another type. Often at a difficult and vulnerable time in their personal circumstance, their vulnerabilities are exploited by the purveyors of CP for commercial gain and profit.
This CP subject is a complicated and difficult issue and there are many more considerations involved in representing an individual under investigation for CP than can be address in this blog.
Subscribe To This Blog's Feed