NOTICE: All slip opinions and orders are subject to formal

revision and are superseded by the advance sheets and bound volumes of the Official Reports. If you find a typographical error or other formal error, please notify the Reporter of Decisions, Supreme Judicial Court, John Adams Courthouse, 1 Pemberton Square, Suite 2500, Boston, MA, 02108

- 1750; (617) 557

- 1030; SJCReporter@sjc.state.ma.us
SJC

- 1 20 76
COMMONWEALTH vs . ADALBERT O MARTINEZ .

Bristol. October 6, 2016.

- Febr uary 7 , 2017. Present: Gants, C.J., Botsford, Lenk, Hines, Gaziano, Lowy, & Budd, JJ.
Obscenity , Child pornography. Constitutional Law , Search and seizure. Search and Seizure , Computer. Evidence , Information stored on computer.

C omplaint received and sworn to in the Fall River Division of the District Court Department on May 9, 2012. A pretrial motion to suppress evidence was heard by Kevin J. Finnerty , J. , and the case was tried before him. The Supreme Judicial Court on its own initiative transferred the case from the Appeals Court.

Michelle A
. Dame for the defendant. Soshana E. Stern , Assistant District Attorney, for the Commonwealth
.
BOTSFORD, J. The defendant , Adalberto Martinez , appeals from his conviction of possessing child pornography in violation of G. L. c. 272, § 29C
. He challenges the denial of his motion2

to suppress computer evidence obtained pursuant to a search warrant. The gravamen of the defendant's claim is that th e police needed to do more to link the defendant to the place searched and the items seized before a warrant could validly issue. W e affirm the denial of the motion to suppress and the conviction
. Background
. 1
. IP addresses
. All computers that connect to the Internet identify each other through a unique string of numbers known as an Internet p rotocol address (IP address). See Internet Corporation for Assigned Names and Numbers, Beginner's Guide to Internet Protocol (IP) Addresse s 2, 4 (2011) (ICANN Guide). In general, when a subscriber purchases Internet service from an Internet s ervice p rovider (ISP), the ISP selects from a roster of IP addresses under its control and assigns a unique IP address to the subscriber at a particula r physical address
. See id . at 4, 6; United States v. Kearney , 672 F.3d 81, 89

- 90 & n.6 (1st Cir. 2012) . See also Office of Legal Education, U nited S tates Department of Justice, Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations 65 ( 2009 ) ( DOJ, Searching and Seizing Computers )
. The IP address assigned to a particular subscriber may change over time, but the ISP kee ps a log of which IP address is assigned to each subscriber at any given moment in time
. See Kearney , supra ; DOJ, Searching and Seizing Computers, supra .3

In the early days of the Internet , when a residential
Internet subscriber w ent online using only a home computer connected to a hard

- wired Internet connection , there was a very strong correlation between an IP address assigned to a subscriber and a particular computer. Now, however, many subscribers use a wireless Internet router, which allows multipl e devices within the range of the router to connect to the Internet simultaneously. See United States v. McLellan , 792 F.3d 200, 213

– 2 14 (1st Cir.), cert. denied, 136 S. Ct. 494 (2015), and cases cited . To the outside world, all of these devices will sha re a single public IP address

-- the one that the ISP has assigned to its subscriber. See i d . But internally, the router will identify each connected device by the device's own identifying number in order to channel data to and from the appropriate devic e. See i d
. See also ICANN Guide,
supra at 4
. As a result, the correlation between an Internet subscriber's assigned IP address and any one particular
Internet

- enabled device may often be weaker than it once was. However, the correlation between an IP address and a physical address can still be strong, at least when the ISP has verified its assignment of a particular IP address to a subscriber at a specific physical address at a specific point in time . See DOJ, Searching and Seizing Computers , supra at 65

- 66 ; Mackey , Schoen,

& Cohn, Unreliable Informants: IP Addresses, Digital Tips and4

Police Raids 8

- 10 ( Sept. 2016), available at https://www.eff. org/files/2016/09/22/2016.09.20_final_formatted_ip_a ddress_white _paper_0.pdf [ https://perma.cc/Y42U

- C5TG] (EFF, Unreliab le Informants ). 2
. Search warrant affidavit
. T he affidavit in support of the contested search warrant and related materials aver the following. On March 9, 2012, State police Sergeant Michael Hill was investigating the use of " peer - to

- peer " file sharing programs to possess and distribute child pornography. One such file

- sharing program, Ares, allows a user to connect to another user's computer via the Internet and then download digital files that are stored locally on the other user's compu ter. Ares is
an open - source software that any person can download for free via the Internet. There is a special version of the Ares program for law enforcement agencies that allows them to monitor and investigate individuals suspected of using Ares to sh are digital files of child pornography. Using the law enforcement version of Ares to download a file from another Ares user, investigators can determine (1) the user's IP address , (2) whether the user possesses and is sharing a particular file, (3) the " h ash value " associated with a particular file, 1 (4) the user's Ares username, and (5) the version of Ares software that

1 Each file shared through Ares is identified by its "hash value"

-- a string of numbers that, for all practical purposes, uniquely identifies a digital file.5

the user's computer is operating. B ecause the law enforcement version of Ares displays both the IP addresses of Ares users and the hash values of files being shared, when police identify a file as one that contain s child pornography, police can determine with a high degree of confidence when that child pornography file is being shared through a specific IP address. In this case, Hill disc overed that a computer using the IP address 65.96.142.191 and displaying the username "datflypapi@Ares" was sharing suspected child pornography via the Ares network
. Through a n online mapping tool (several of which exist on publicly accessible W eb sites), Hill determined that this IP address was likely associated with a computer in Massachusetts. The computer using this IP address was sharing a total of ten files via the network. Hill found that a majority of these files had names containing terms commonly associated with child pornography. Over approximately thirty minutes, Hill downloaded and viewed four video files from the suspect computer and concluded that these files were child pornography. While downloading the files, Hill used another pr ogram that confirmed that a computer associated with the IP address 65.96.142.191 was connected to his computer. By conducting an Internet search, Hill determine d that the IP address in quest ion was associated with Comcast Cable (Comcast), a major cable company and ISP . Based on the above6

information, the d istrict a ttorney for the Berkshire d istrict issued an administrative subpoena to Comcast asking to whom the IP address 65.96.142.191 was assigned during the thirty

- minute period on March 9, 2012 , during which Hill downloaded the four suspected child pornography video files from datflypapi@Ares.
Comcast responded to the subpoena on March 15, 2012 , and provided information that the IP address was assigned to a subscriber named " Angel Martinez " at a certain address in Fall River (apartment) . Hill then referred the investigation to
Det ective Steven Washington of the Fall River p olice d epartment. On April 2, 2012, Washington went to the apartment , which is part of a h ousing d evelopment. Washington discovered that Maria Avilez 2 leased the apartment . O n April 3, 2012, Washington sought and received , from the Fall River Division of the District Court, a warrant to search the apartment for computers and related items connected to the suspected possessi on and distribution of child pornography. 3
. Execution of the search warrant
. Washington and two other officers executed the warrant o n April 5, 2012. According
to Washington ' s trial testimony, when the officers first knocked

2 The search warrant and supporting affidavit identify one of the occupant s of the apartment as "Maria Avilez." The trial transcript refers to her as "Maria Alvarez" or "Maria Avelez." In this opinion, we use the name on the search warrant. The search warrant affidavit also refers to Avilez as the mother of Angel Martinez. At trial, she was identified as the grandmother of both Angel Martinez and the defendant , Ad alberto Martinez.7

on the door of the apartment , no one answered
. 3 Washington then heard someone say , " H ey, he just ran out that way , " and saw a "large male" running down a side street away from the apartment
. The officers eventually entered the apartment . I nside they encountered the defendant's girl friend , Ruth Pereira , holding her infant child
. Both Avilez and Angel Martinez , the defendant's cousin , arrived at the apartment while officers were conducting the search , but the defendant was not present
. During the search, Washington noticed two laptop computers underneath a basket of laundry
. After some initial testing (which was not described in detail in the trial record) , the officers seized the two computers and brought them back to the police station. 4 U pon f urther inspection at the station, officers discovered five video files of child pornography on one of the defendant's laptop computers . It is not clear from the record whether any of the se video files were among those observed by Hill during his Ares surveillance on March 9, 2012
. 4
. Procedural history
. A complaint issued charging t he defendant with one count of distribution of material depicting a child engaged in a sexual act, in violation of G. L. c. 272,

3 The pretrial hearing on the defendant's motion to suppress evidence seized during the search of the apartment was n onevidentiary.

4 The defendant's girl friend, Ruth Pereira, testified at trial that the two computers belonged to the defendant. The defendant does not challenge the accuracy of this testimony.8

§ 29B ( b ) , and one count of possess ion of child pornography, in violation of G. L. c. 272, § 29C. Prior to trial, the defendant moved to suppress the evidence obtained in executing the search warrant described above. He argued that the search warrant affidavit did not establish probable c ause that the contraband being sought would be present in the apartment , and therefore the search violated his rights under the Fourth Amendment to the United States Constitution and art
. 14 of the Massachusetts Declaration of Rights. After a hearing, a D istrict Court judge denied the motion. The judge ruled that the affidavit and accompanying exhibits provided probable cause to believe evidence of specific criminal activity would be found at the apartment . The defendant was tried before and convicted by a jury in the District Court on the charge of possession of child pornography; the Commonwealth filed a nolle prosequi of the distribution charge. Th e defendant timely appealed from his conviction, and we tr ansferred the appeal to this court on our own motion. Discussion
. The sole issue on appeal is the validity of the search warrant issued for the apartment . Detective Washington's affidavit in support of the search warrant averred that a particular IP address was used to share child pornography and that this IP address had been assigned at the time in9

question to an Internet subscriber at the specific physi cal address to be searched. The central question is whether the se averments were sufficient to establish probable cause for the search, even though the named subscriber was neither listed as ,

nor confirmed to be , living in the unit , and even though police had no information before the search linking the defendant to the residence
. We conclude that the affidavit in this case did establish probable cause to search the apartment for computer evidence related to the suspected possession or distribution of child pornography. "Under the Fourth Amendment and art. 14, a search warrant may issue only on a showing of probable cause." 5 Commonwealth v.

5 The defendant is correct that, in certain circumstances, art . 14 of the Massachusetts Declaration of Rights provides more substantive protection to criminal defendants than the Fourth Amendment to the United States Constitution. See, e.g., Commonwealth v . Rodriguez , 472 Mass. 767, 776 (2015). Here, we conclude that there was probable cause for the search warrant under both art. 14 and the Fourth Amendment. As for the Fourth Amendment, our conclusion accords with the decisions of several Federal courts t hat have found probable cause in similar factual settings. See, e.g., United States v. Valley , 755 F.3d 581, 587 (7th Cir.) , cert. denied, 135 S. Ct. 461 (2014) (probable cause existed when investigators downloaded child pornography from IP address, then traced IP address to residence defendant shared with his mother); United States v. Vosburgh , 602 F.3d 512, 526 (3d Cir. 2010) , cert. denied, 563 U.S. 905 (2011) (noting that "several Courts of Appeals have held that evidence that the user of a computer emp loying a particular IP address possessed or transmitted child pornography can support a search warrant for the physical premises linked to that IP address," and so holding); United States v. Perez , 484 F.3d 735, 740 (5th Cir. ), cert. denied, 552 U.S. 952 ( 2007) (probable cause based on information in affidavit that child pornography was viewed by10

Anthony , 451 Mass. 59, 68 (2008). "The probable cause necessary to support the i ssuance of a search warrant does not require definitive proof of criminal activity." Id . at 69. Rather, a warrant may issue if a magistrate finds "a substantial basis on which to conclude that the articles or activity described are probably present or oc curring at the place to be searched " (emphasis in original). Id . To determine whether probable cause exists, our inquiry "always begins and ends with the four corners of the affidavit
. " Id . at 68, quoting Commonwealth v. O'Day , 440 Mass. 296, 297 (2003) . For probable cause to arise, the facts contained in an affidavit, plus the reasonable inferences that may be drawn from them, must allow the magistrate to determine that "the items sought are related to the criminal activity under investigation, and tha t they reasonably may be expected to be located in the place to be searched at the time the search warrant issues." Commonwealth

v. McDermott , 448 Mass. 750, 767 , cert. denied, 552 U.S. 910 (2007), quoting Commonwealth v. Cinelli , 389 Mass. 197, 213,

ce rt. denied, 464 U.S. 860 (1983). See Anthony , supra at 68.
computer using particular IP address and that this IP address was assigned to user at specific physical address; noting that although "it was possible that the tra nsmissions originated outside of the residence to which the IP address was assigned, it remained likely that the source of the transmissions was inside that residence"); United States v. Grant , 218 F.3d 72, 75 (1st Cir. ), cert. denied, 531 U.S. 1025 ( 2000) (probable cause existed even discounting for possibility that someone other than Internet account registrant was using account).11

"[S]earch warrant affidavits are to be interpreted in a realistic and commonsense manner," not "subjected to hypercritical analysis" (citation omitted). Id
. at 69. The probable cause inquiry in this case asks whether the facts averred in Washington's affidavit showed a sufficient nexus between the suspected criminal activity (possessing or distributing child pornography), the items sought (computers and related materials) , and the place to be se arched ( the apartment ) . See McDermott , 448 Mass. at 768

- 769 . To that end, the nexus between the suspected criminal activity, the items sought , and the place to be searched may be based on, among other things, the type of crime, the extent of the suspect' s opportunity for concealment, and normal inferences about where a criminal would be likely to hide evidence of the suspected crime. See i d
. at 768. Here, the affidavit described how Sergeant Hill had observed a computer associated with the IP address 65.96.142.191 that contained, and was sharing, child pornography via the Ares network
. An Internet search revealed that this IP address had been issued to Comcast, the ISP. The district attorney for the
B erkshir e district th en issued a subpoena to the ISP, which revealed that the IP address in question had been assigned during the relevant time period to a subscriber at the physical12

address of the apartment
. 6 Th e temporal and geographical link s between the target IP address and the physical address to be searched provided a substantial basis for concluding that evidence sought (computers and related i tems) was connected to the suspected crime (possessing or sharing child pornography) and likely would be foun d at the specified premises ( the apartment ), and therefore gave rise to a sufficient nexus between the suspected criminal activity and the residence. See Commonwealth v. Augustine , 472 Mass. 448, 455 (2015); Commonwealth v. Foster , 471 Mass. 236, 241

– 242 (2015). Of course, the ISP also provided a name associated with the service address and officers took subsequent steps to determine who actually lived at the apartment . In many cases, those pieces of information can serve a useful confirmatory role. But in the present case , we conclude that there was probable cause to search for evidence related to sharing child pornography based on the information police obtained through their Ares surveillance and the administrative subpoena, independent of whose name was on the Internet account or in the housing

6 We note that the administrative subpoena is generally a more reliable method of connecting an IP address with a physical ad dress, as compared to certain IP address mapping services. See Mackey, Stanton, Schoen, & Cohn, Electronic Frontier Foundation, Unreliable Informants: IP Addresses, Digital Tips and Police Raids 8

- 9 ( Sept. 2016), available at https://www.eff. org/files/2016/09/22/2016.09.20_final_formatted_ip_a ddress_white _paper_0.pdf [ https://perma.cc/Y42U

- C5TG] (discussing error rates of some IP address mapping services).13

development's records . T he probable cause showing necessary for issuance of a search warrant is "only a fair probability that evidence of such a crime would be found in particular locations ," not " a prima facie showing that the defend ant possessed child pornography
. " Anthony , 451 Mass. at 72. Police met that threshold here. The defendant advances , in essence, three arguments about why investigators needed to do more to establish probable cause. We addre ss each in turn. First, he points out that before applying for the search warrant, the police were unable to verify that the subscriber named by the ISP

-- Angel Martinez

-- lived at the apartment , and also were unable to rule out the possibility that som eone other than the named subscriber was responsible for using the IP address assigned to the apartment at the time in question
. Therefore, the defendant argues, it was possible that a new (and innocent) person had moved into the apartment while Angel
Mar tinez, living at a different address altogether, conti nued to
pay the Internet bill, or that a new occupant merely took over the Internet payments without changing the name on the account. To support his position, the defendant cites several cases in whic h investigators obtai ned more information linkin g an individual suspect to a specific physical address before applyin g for a search warrant. See, e.g., United States v.14

Elbe , 774 F.3d 885, 887

– 8 88 (6th Cir. 2014), cert. denied, 135 S. Ct. 1573 (2015) (agents observed person matching child pornography suspect's driver's license photograph sitting on porch of target residence); United States v. Stults , 575 F.3d 834, 838 (8th Cir. 2009) , cert. denied, 559 U.S. 915 (2010) ( public records check using LexisN exis, postal service mail delivery check, and motor vehicle registration check all confirmed that named Internet subscriber actually resided at target residence). It is true that investigators had no direct information that Angel Martinez personally had u sed, was using, or would ever use the IP address in question. However, in this particular case, the name of the Internet account holder did not defeat probable cause
. See Commonwealth v. Molina , 476
Mass. , (2017)
. The question before the magistrate was whether the apartment located at a certain address likely contained evidence of criminal activity

-- period. The question

was not whether that address likely contained evidence of criminal activity on the part of Ang el Martinez (or on the part of Avilez for that matter). To that end, Detective Washington ' s supporting search
warrant affidavit spelled out a relatively direct link between (1) the downloading and sharing of child pornography video files , (2) a specific IP address, and (3) a specific physical15

address to which that IP address had been assigned
. F rom a technological standpoint, an IP address can be assigned to only

one service address at any given point in time. See United
States v. Vosbu rgh , 602 F.3d 512, 527 & n.14 (3d Cir. 2010) , cert. denied, 563 U.S. 905 (2011) , and cases cited (noting "unique nature of the IP address assigned" to defendant on particular date made Internet activity on that date "fairly traceable" to specific ISP accou nt and associated physical address); DOJ, Searching and Seizing Computers , supra at 65. Taken together, these facts gave rise to a reasonable inference that evidence related to possessi on or distributi on of child pornography via the Internet likely would be found at the apartment

-- the one place, according to the ISP's records, to which the IP address in question was assigned du ring the relevant time period. Once this nexus was established, t he name of the account holder was ess entially incidental. See Molina , 476 Mass. at

. Although information showing that the named subscriber was also the person suspected of possessing or sharing the child pornography might have increased the likelihood that the sought

after evidence would be located at the service address, the lack of such information does not necessarily defeat probable cause.
See United States v. Grant , 218 F.3d 72, 75 (1st Cir. ), cert. denied, 531 U.S. 1025 ( 2000). This is so precisely because an16

IP address can b e assigned to only one service address at any given time

-- regardless of whose name is on the account. 7 See Vosburgh , 602 F.3d at 527 & n.14. Second, the defendant points out that investigators did not determine whether the Internet connection at the ap artment used a wireless router and , if so, whether the wireless network required a password. This left open the possibility that

so meone other than the subscriber , located at a different physical address, was "joyriding" on an unsecured wireless network b ased out of the apartment
. See Snow, Accessing the Internet Through the Neighbor's Wireless Internet Connection: Physical Trespass in Virtual Reality, 84 Neb. L. Rev. 1226, 1227

- 1229 (2006). The defendant argues that this concern is especially acute in the present case because investigators knew that the apartment was part of a housing development, in which multiple residences were in close proximity to the target physical address. The defendant's argument is misdirected. A showing of probable cause to search a place (as opposed to arrest a person )

7 The defendant does not now claim that the information in the police affidavit had bec ome stale. The defendant's motion to suppress did include a passing reference to staleness. However, this theory was not advanced at the suppression motion hearing, and the defendant's brief does not make such an argument. Any staleness issue, therefore , is waived. See Commonwealth v. Wood , 389 Mass. 552, 554 n.3 (1983), citing Mass. R. A. P. 16 (a) (4) , as amended, 367 Mass. 919 (1975).17

need not identify a specific criminal suspect

-- al though frequently it does
. See Zurcher v. Stanford Daily , 436 U.S. 547, 555

– 557 & n.6 (1978)
. See also Molina , 476 Mass. at
. Indeed, "[t] he critical element in a reasonable search is not that the owner of the property is suspected of crime but that there is reasonable cause to believe that the specific 'things' to be searched for and seized are located on the property to which entry is sought
. " Zurche r , supra a t 556. In other words , police need only demonstrat e a sufficient nexus between the criminal activi ty under investigation, the items sought, and a place to be searched where the items may reasonably be expected to be located

-- independent of whe ther they have identified a specific criminal suspect
. 8 See McDermott , 448 Mass. at 767

- 768; O'Day , 440 Mass. at 302

- 304 . Certainly police may have an easier time demonstrating a sufficient nexus if they can link a specific s uspect (e.g., the named Internet account holder) to

8 To this point, the prosecutor and Detective Steven Washington had the following colloquy at trial: Q .: "Now when you execute a warrant like this . . . are you conducting
. . . [the search] for a person or for a device?"
A . : "A device." Q . : "Okay. And why is that?"
A . : "Because I have no clue who is behind that device."18

the criminal activity. However, such a link is not always required. The search warrant affidavit in this case demonstrated that child pornography was being shared via the Internet from a specific IP address. This IP address, in turn , had been assigned to a specific physical address during the time when the child pornography was being shared. These facts provided a substantial basis from which to conclude that evidence of downloading and sharing child pornography via the Inter net would be located at the apartment , even if it turned out that an unauthorized user was " joyriding " using the targeted IP address
. See Augustine , 472 Mass. at 455; Commonwealth v. Escalera , 462 Mass. 636, 645 (2012), quoting 2 W.R. LaFave, Search and Seizure § 3.7(d), at 420

– 421 (4th ed. 2004) (police do not need to provide definitive proof that evidence of suspected criminal activity will be located at targeted residence, only facts supporting reasonable inference that such evidence "probably" would b e located there) . S ee also Grant , 218 F.3d at 75 ( even discounting for possibility that individual other than subscriber may have been using account, there was fair probability that subscriber was user and that evidence of user's illegal activities would be found in subscriber's home). 9

9 This close nexus also distinguishes a case like Commonwealth v. Kaupp , 453 Mass. 102 (2009). In that case, we19

The defendant is correct, from a technological standpoint, that if an Internet subscriber at the apartment set up an unsecured wireless Internet network, a computer outside of this
p hysical address (in a neighboring unit , perhaps) could have used the targeted IP address to access the Interne t and share child pornography. 10 This point misse s the mark , because

held that police lacked probable cause to search a specific computer for evidence of child pornography. Id . at 113

- 114. However, in the Kaupp case , there was no indication that a specific IP address had been used to download or share child pornography. Instead, police essentially relied on the fact that the targeted computer may have shared another , nonpornographic file with a computer that did con tain child pornography, and that these two computers were connected in a way that made it possible for them to share other files. See id . at 111

- 112. The nexus in this case

-- where an officer directly observed child pornography being transmitted through the targeted IP address, which could only be assigned to one physical address at the time in question

-- is substantially stronger.

10 Notably, there was no evidence, either at the suppression stage or at trial, that the apartment was home to an unsecure d wireless Internet connection or that anyone other than the defendant used the Internet connection there. Nor was there any evidence that the defendant did not connect his laptop computers to the Internet through the IP address assigned to the apartment . However, even if we accept the defendant's hypothetical scenario of "joyriding," and it turned out that none of the defendant's devices contained child pornography, police still would have had probable cause to seize and search any Internet modems or ro uters in order to determine which devices were connected to the targeted IP address at the time when police witnessed child pornography being shared via the targeted IP address. See United States v. Stanley , 753 F.3d 114, 115

- 117 (3d Cir.), cert. denied, 135 S. Ct. 507 (2014) (describing how wireless Internet router keeps log of devices that have connected to it). If those devices, or other information, then led police to a device at a different physical address from the one linked to the IP address throu gh the ISP's20

probable cause does not require investigators to "establish to a certainty that the items to be seized will be found in the specified location," nor does it require them to "exclude any and all possibility that the items might be found elsewhere." Anthony , 451 Mass. at 70, quoting Commonwealth v. Harmon , 63 Mass. App. Ct. 456, 461 (2005). Finally, the defendant argues that , in a case like this, probable cause cannot arise until police show one of three things : (1) that the target IP address has not been linked to a wireless Internet service; (2) that the target IP address is linked to a wireless Internet service, but it is a secure connection requiring a password; or (3) that no one outside the target physical address could be accessing the network. The defendant urges that, without these showings, th e likelihood of someone outside the target physical address using the target IP address is substantial enough to defeat probable cause. B y and large, these proposals simply restate the defendant's argument s records, police likely would have needed another warrant. Cf. United States v. Voustianiouk , 685 F.3d 206, 213

- 214 (2d Cir. 2012) (where police omitted target's name from application for warrant to search specific apartment, second warrant wa s required once it became clear target lived in different apartment); United States v. Greathouse , 297 F. Supp. 2d 1264, 1274

– 1275 (D. Or. 2003) (second warrant required when it became clear to officers executing warrant that target resided in rented room within house). But, as illustrated above, that scenario is several steps removed from what occurred here, where po lice quickly located two laptop computers that belonged to the defendant, one of which contained five video files of child pornography.21

urging that the police, in order to show probabl e cause, should have been required to rule out the possibility that persons outside of the apartment may have been "joyriding" on the IP address assigned to that location at the time in question. To the extent that is the case, we reject these proposal s f or the reasons already mentioned.
Moreover , as the Commonwealth points out, it is not clear whether it would be technologically feasible for investigators to do what the defendant asks. With respect to the first proposal , there is nothin g in the record s howing that a third party (like an ISP, for instance) would be able to determine whether a subscriber 's connection to the Internet is through a hard

- wired or wireless connection at any given point in time. With respect to the second , in the case of a subscriber who use s a wireless router, it is not clear how investigators would be able to ascertain whether the network is password

- protected without first learn ing the name of that subscriber's wireless network. And regarding the third proposal, even ass uming investigators knew that a target IP address was associated with an unprotected wireless network that had been accessed by devices not belonging to the subscriber, these considerations would not necessarily change the fact that, given the Ares surveil lance conducted in this case, there remained a fair probability that any computers located at the apartment would22

contain evidence related to the possession or distribution of child pornography. See United States v. Stanley , 753 F.3d 114, 115

- 117 (3d Cir. ), cert. denied, 135 S. Ct. 507 (2014) (based on file

- sharing surveillance similar to that conducted in this case, police obtained valid search warrant for home linked to target IP address; only after police found no evidence of child pornography there and learned, in course of their search, that home deployed wireless Internet network that was not password

protected did they take subsequent steps to locate true suspect); United States v. Perez , 484 F.3d 735, 740 (5th Cir. ), cert. denied, 552 U.S. 952 ( 2007) ( although possible that Internet transmissions originated outside of residence to which IP address was assigned, it remained likely that source of transmissions was inside that residence); Grant , 218 F.3d at 75 (similar); United States v. Carter , 549 F. Supp. 2d 1257, 1268

– 1269 (D. Nev. 2008) (similar ) . The defendant's proposals merely illustrate that different hypothetical scenarios could lead to a different conclusion regarding probable cause . But those potentialities do not necessarily defeat pro bable cause , especially when they lack any factual underpinning
. See Anthony , 451 Mass. at 70 (discussing nexus requirement). Instead, the fundamental question is whether there was a substantial basis from which to conclude that the items described in the application were probably present at the place23

to be searched. See i d
. at 69. For all of these reasons , we affirm the denial of the defendant's motion to suppress. 11
We end with a cautionary note. Our decision today should not be read to mean that probable cause always exists any time investigators link illegal computer activity to an IP address and then link that IP address to a physical address. For one, police should (as they did in this case ) connect the IP address with a physical add ress through a reliable method, such as an admini strative subpoena to the ISP, rather than relying solely on a potentially unreliable method , such as certain IP address mapping service s . See note 6, supra . Additionally , technologies that apparently were not at issue in this case may further erode the connection between an IP address and a physical add ress. See EFF, Unreliable Informants, supra at 10

- 11 (discussing how Tor exit relays, virtual private networks, and proxy server connections can mask or i ginating IP address es through use of one or more intermediary IP addresses) ; Vosburgh , 602 F.3d at 527 n. 14 (discussing "possibility of mischief and mistake with IP addresses" such that, in some cases, "value of

11 The defendant does not challenge the reasonableness or scope of the search of his digital files once police had seized his computers, nor does he raise the related issue whether courts should require police to develop minimization techniques to govern the execution of a digital search. Accordingly, we need not address those issues here. However, in an appropriate case, we wou ld consider whether to require some type of digital search protocol . See Commonwealth v. Molina , 476 Mass. , (2017)
.24

that IP address for probable cause purposes may be greatly diminished, if not reduced to zero "). At the very least, certain cases may require pol ice to disclose in a search warrant affidavit the possibility that one of these technologies is, or may be, in play based on facts known or reasonably knowable to investigators at the time. See EFF, Unreliable Informants , supra at 18. If such technologie s become more common, it is entirely possible that we would require poli ce to proceed in multiple steps, obtaining subpoenas related to each intermediary IP address or warrants to search each location hosting those IP addresses . Alternatively, some

cases may require the police to examine forensically a wireless router to determine which devices were connected to it, and when, before they search particular computers. See Stanley , 753 F.3d at 115

- 117 (describing police investigation based on information obtained by examining innocent Internet user's unprotected wireless Internet router that had been "hijacked" by neighbor

- defendant to share child pornography ). Such possibilities demonstrate why the probable cause analysis rarely, if ever, lends itself to bright

- line rules.
See Escalera , 462 Mass. at 643 ("No bright

- line rule can establish whether there is a nexus" between suspected criminal activity and defendant's home). This is especially so when, as here, the analysis hinges on fluid and rapidly chan ging25

technologies. Cf. Commonwealth v. Dorelas , 473 Mass. 496, 502 & n.11 (2016) (noting that "what might have been an appropriate limitation [on searches] in the physical world becomes a limitation without consequence in the virtual one"); id
. at 505 (Lenk, J., dissenting) (transposing protections of a rt. 14 and Fourth Amendment to digital contexts "is an ongoing and challenging task" ); Commonwealth v. Phifer , 463 Mass. 790, 797 (2012) (noting that developments in cellular telephone technology "presen t novel and important questions about the relationship between the modern doctrine of search incident to arrest and individual privacy rights"). Conclusion
. The order den ying the motion to suppress and the defendant's conviction are affirmed.
So o rdered
.