NOTICE: All slip opinions and orders are subject to formal 

revision and are superseded by the advance sheets and bound 

volumes of the Official Reports. If you find a typographical 

error or other formal error, please notify the Reporter of 

Decisions, Supreme Judicial Court, John Adams Courthouse, 1 

Pemberton Square, Suite 2500, Boston, MA, 02108-1750; (617) 557-

1030; SJCReporter@sjc.state.ma.us

SJC-12076

COMMONWEALTH vs. ADALBERTO MARTINEZ.

Bristol. October 6, 2016. - February 7, 2017.

Present: Gants, C.J., Botsford, Lenk, Hines, Gaziano, Lowy, & 

Budd, JJ.

Obscenity, Child pornography. Constitutional Law, Search and 

seizure. Search and Seizure, Computer. Evidence, 

Information stored on computer.

Complaint received and sworn to in the Fall River Division 

of the District Court Department on May 9, 2012.

A pretrial motion to suppress evidence was heard by Kevin 

J. Finnerty, J., and the case was tried before him.

The Supreme Judicial Court on its own initiative 

transferred the case from the Appeals Court.

Michelle A. Dame for the defendant.

Soshana E. Stern, Assistant District Attorney, for the 

Commonwealth.

BOTSFORD, J. The defendant, Adalberto Martinez, appeals 

from his conviction of possessing child pornography in violation 

of G. L. c. 272, § 29C. He challenges the denial of his motion 
2

to suppress computer evidence obtained pursuant to a search 

warrant. The gravamen of the defendant's claim is that the

police needed to do more to link the defendant to the place 

searched and the items seized before a warrant could validly 

issue. We affirm the denial of the motion to suppress and the 

conviction.

Background. 1. IP addresses. All computers that connect 

to the Internet identify each other through a unique string of 

numbers known as an Internet protocol address (IP address). See 

Internet Corporation for Assigned Names and Numbers, Beginner's 

Guide to Internet Protocol (IP) Addresses 2, 4 (2011) (ICANN 

Guide). In general, when a subscriber purchases Internet 

service from an Internet service provider (ISP), the ISP selects 

from a roster of IP addresses under its control and assigns a 

unique IP address to the subscriber at a particular physical 

address. See id. at 4, 6; United States v. Kearney, 672 F.3d 

81, 89-90 & n.6 (1st Cir. 2012). See also Office of Legal 

Education, United States Department of Justice, Searching and 

Seizing Computers and Obtaining Electronic Evidence in Criminal 

Investigations 65 (2009) (DOJ, Searching and Seizing Computers). 

The IP address assigned to a particular subscriber may change 

over time, but the ISP keeps a log of which IP address is

assigned to each subscriber at any given moment in time. See 

Kearney, supra; DOJ, Searching and Seizing Computers, supra.
3

In the early days of the Internet, when a residential 

Internet subscriber went online using only a home computer

connected to a hard-wired Internet connection, there was a very 

strong correlation between an IP address assigned to a 

subscriber and a particular computer. Now, however, many 

subscribers use a wireless Internet router, which allows 

multiple devices within the range of the router to connect to 

the Internet simultaneously. See United States v. McLellan, 792 

F.3d 200, 213–214 (1st Cir.), cert. denied, 136 S. Ct. 494 

(2015), and cases cited. To the outside world, all of these 

devices will share a single public IP address -- the one that 

the ISP has assigned to its subscriber. See id. But 

internally, the router will identify each connected device by 

the device's own identifying number in order to channel data to 

and from the appropriate device. See id. See also ICANN Guide,

supra at 4. As a result, the correlation between an Internet 

subscriber's assigned IP address and any one particular 

Internet-enabled device may often be weaker than it once was. 

However, the correlation between an IP address and a physical 

address can still be strong, at least when the ISP has verified

its assignment of a particular IP address to a subscriber at a 

specific physical address at a specific point in time. See DOJ, 

Searching and Seizing Computers, supra at 65-66; Mackey, Schoen, 

& Cohn, Unreliable Informants: IP Addresses, Digital Tips and 
4

Police Raids 8-10 (Sept. 2016), available at https://www.eff.

org/files/2016/09/22/2016.09.20_final_formatted_ip_address_white

_paper_0.pdf [https://perma.cc/Y42U-C5TG] (EFF, Unreliable 

Informants).

2. Search warrant affidavit. The affidavit in support of 

the contested search warrant and related materials aver the 

following. On March 9, 2012, State police Sergeant Michael Hill 

was investigating the use of "peer-to-peer" file sharing 

programs to possess and distribute child pornography. One such 

file-sharing program, Ares, allows a user to connect to another 

user's computer via the Internet and then download digital files 

that are stored locally on the other user's computer. Ares is 

an open-source software that any person can download for free 

via the Internet. There is a special version of the Ares 

program for law enforcement agencies that allows them to monitor 

and investigate individuals suspected of using Ares to share 

digital files of child pornography. Using the law enforcement 

version of Ares to download a file from another Ares user, 

investigators can determine (1) the user's IP address, (2) 

whether the user possesses and is sharing a particular file, (3) 

the "hash value" associated with a particular file,1 (4) the 

user's Ares username, and (5) the version of Ares software that 

 

1 Each file shared through Ares is identified by its "hash 

value" -- a string of numbers that, for all practical purposes, 

uniquely identifies a digital file.
5

the user's computer is operating. Because the law enforcement 

version of Ares displays both the IP addresses of Ares users and 

the hash values of files being shared, when police identify a 

file as one that contains child pornography, police can 

determine with a high degree of confidence when that child 

pornography file is being shared through a specific IP address.

In this case, Hill discovered that a computer using the IP 

address 65.96.142.191 and displaying the username 

"datflypapi@Ares" was sharing suspected child pornography via

the Ares network. Through an online mapping tool (several of 

which exist on publicly accessible Web sites), Hill determined 

that this IP address was likely associated with a computer in 

Massachusetts. The computer using this IP address was sharing a 

total of ten files via the network. Hill found that a majority 

of these files had names containing terms commonly associated

with child pornography. Over approximately thirty minutes, Hill 

downloaded and viewed four video files from the suspect computer 

and concluded that these files were child pornography. While 

downloading the files, Hill used another program that confirmed 

that a computer associated with the IP address 65.96.142.191 was 

connected to his computer.

By conducting an Internet search, Hill determined that the 

IP address in question was associated with Comcast Cable

(Comcast), a major cable company and ISP. Based on the above
6

information, the district attorney for the Berkshire district 

issued an administrative subpoena to Comcast asking to whom the 

IP address 65.96.142.191 was assigned during the thirty-minute 

period on March 9, 2012, during which Hill downloaded the four 

suspected child pornography video files from datflypapi@Ares. 

Comcast responded to the subpoena on March 15, 2012, and 

provided information that the IP address was assigned to a 

subscriber named "Angel Martinez" at a certain address in Fall 

River (apartment). Hill then referred the investigation to 

Detective Steven Washington of the Fall River police department. 

On April 2, 2012, Washington went to the apartment, which is 

part of a housing development. Washington discovered that Maria 

Avilez2 leased the apartment. On April 3, 2012, Washington 

sought and received, from the Fall River Division of the

District Court, a warrant to search the apartment for computers 

and related items connected to the suspected possession and 

distribution of child pornography.

3. Execution of the search warrant. Washington and two 

other officers executed the warrant on April 5, 2012. According 

to Washington's trial testimony, when the officers first knocked 

 

2 The search warrant and supporting affidavit identify one 

of the occupants of the apartment as "Maria Avilez." The trial 

transcript refers to her as "Maria Alvarez" or "Maria Avelez." 

In this opinion, we use the name on the search warrant. The 

search warrant affidavit also refers to Avilez as the mother of 

Angel Martinez. At trial, she was identified as the grandmother 

of both Angel Martinez and the defendant, Adalberto Martinez.
7

on the door of the apartment, no one answered.

3 Washington then 

heard someone say, "Hey, he just ran out that way," and saw a 

"large male" running down a side street away from the apartment. 

The officers eventually entered the apartment. Inside they

encountered the defendant's girl friend, Ruth Pereira, holding 

her infant child. Both Avilez and Angel Martinez, the 

defendant's cousin, arrived at the apartment while officers were 

conducting the search, but the defendant was not present.

During the search, Washington noticed two laptop computers 

underneath a basket of laundry. After some initial testing

(which was not described in detail in the trial record), the 

officers seized the two computers and brought them back to the 

police station.4 Upon further inspection at the station,

officers discovered five video files of child pornography on one 

of the defendant's laptop computers. It is not clear from the 

record whether any of these video files were among those

observed by Hill during his Ares surveillance on March 9, 2012.

4. Procedural history. A complaint issued charging the 

defendant with one count of distribution of material depicting a 

child engaged in a sexual act, in violation of G. L. c. 272, 

 

3 The pretrial hearing on the defendant's motion to suppress 

evidence seized during the search of the apartment was 

nonevidentiary.

4 The defendant's girl friend, Ruth Pereira, testified at 

trial that the two computers belonged to the defendant. The 

defendant does not challenge the accuracy of this testimony.
8

§ 29B (b), and one count of possession of child pornography, in 

violation of G. L. c. 272, § 29C. Prior to trial, the defendant 

moved to suppress the evidence obtained in executing the search 

warrant described above. He argued that the search warrant 

affidavit did not establish probable cause that the contraband 

being sought would be present in the apartment, and therefore

the search violated his rights under the Fourth Amendment to the 

United States Constitution and art. 14 of the Massachusetts 

Declaration of Rights. After a hearing, a District Court judge 

denied the motion. The judge ruled that the affidavit and 

accompanying exhibits provided probable cause to believe 

evidence of specific criminal activity would be found at the 

apartment.

The defendant was tried before and convicted by a jury in 

the District Court on the charge of possession of child 

pornography; the Commonwealth filed a nolle prosequi of the 

distribution charge. The defendant timely appealed from his 

conviction, and we transferred the appeal to this court on our 

own motion.

Discussion. The sole issue on appeal is the validity of 

the search warrant issued for the apartment. Detective 

Washington's affidavit in support of the search warrant averred 

that a particular IP address was used to share child pornography 

and that this IP address had been assigned at the time in 
9

question to an Internet subscriber at the specific physical 

address to be searched. The central question is whether these

averments were sufficient to establish probable cause for the 

search, even though the named subscriber was neither listed as, 

nor confirmed to be, living in the unit, and even though police

had no information before the search linking the defendant to 

the residence. We conclude that the affidavit in this case did 

establish probable cause to search the apartment for computer 

evidence related to the suspected possession or distribution of 

child pornography.

"Under the Fourth Amendment and art. 14, a search warrant 

may issue only on a showing of probable cause."5 Commonwealth v. 

 

5 The defendant is correct that, in certain circumstances, 

art. 14 of the Massachusetts Declaration of Rights provides more 

substantive protection to criminal defendants than the Fourth 

Amendment to the United States Constitution. See, e.g., 

Commonwealth v. Rodriguez, 472 Mass. 767, 776 (2015). Here, we 

conclude that there was probable cause for the search warrant 

under both art. 14 and the Fourth Amendment. As for the Fourth 

Amendment, our conclusion accords with the decisions of several 

Federal courts that have found probable cause in similar factual 

settings. See, e.g., United States v. Valley, 755 F.3d 581, 587 

(7th Cir.), cert. denied, 135 S. Ct. 461 (2014) (probable cause 

existed when investigators downloaded child pornography from IP 

address, then traced IP address to residence defendant shared 

with his mother); United States v. Vosburgh, 602 F.3d 512, 526 

(3d Cir. 2010), cert. denied, 563 U.S. 905 (2011) (noting that 

"several Courts of Appeals have held that evidence that the user 

of a computer employing a particular IP address possessed or 

transmitted child pornography can support a search warrant for 

the physical premises linked to that IP address," and so 

holding); United States v. Perez, 484 F.3d 735, 740 (5th Cir.), 

cert. denied, 552 U.S. 952 (2007) (probable cause based on 

information in affidavit that child pornography was viewed by 
10

Anthony, 451 Mass. 59, 68 (2008). "The probable cause necessary 

to support the issuance of a search warrant does not require 

definitive proof of criminal activity." Id. at 69. Rather, a 

warrant may issue if a magistrate finds "a substantial basis on 

which to conclude that the articles or activity described are 

probably present or occurring at the place to be searched"

(emphasis in original). Id. To determine whether probable 

cause exists, our inquiry "always begins and ends with the four 

corners of the affidavit." Id. at 68, quoting Commonwealth v. 

O'Day, 440 Mass. 296, 297 (2003). For probable cause to arise, 

the facts contained in an affidavit, plus the reasonable 

inferences that may be drawn from them, must allow the 

magistrate to determine that "the items sought are related to 

the criminal activity under investigation, and that they 

reasonably may be expected to be located in the place to be 

searched at the time the search warrant issues." Commonwealth

v. McDermott, 448 Mass. 750, 767, cert. denied, 552 U.S. 910 

(2007), quoting Commonwealth v. Cinelli, 389 Mass. 197, 213, 

cert. denied, 464 U.S. 860 (1983). See Anthony, supra at 68. 

 

computer using particular IP address and that this IP address 

was assigned to user at specific physical address; noting that 

although "it was possible that the transmissions originated 

outside of the residence to which the IP address was assigned, 

it remained likely that the source of the transmissions was 

inside that residence"); United States v. Grant, 218 F.3d 72, 75 

(1st Cir.), cert. denied, 531 U.S. 1025 (2000) (probable cause 

existed even discounting for possibility that someone other than 

Internet account registrant was using account).
11

"[S]earch warrant affidavits are to be interpreted in a 

realistic and commonsense manner," not "subjected to 

hypercritical analysis" (citation omitted). Id. at 69.

The probable cause inquiry in this case asks whether the 

facts averred in Washington's affidavit showed a sufficient 

nexus between the suspected criminal activity (possessing or 

distributing child pornography), the items sought (computers and 

related materials), and the place to be searched (the 

apartment). See McDermott, 448 Mass. at 768-769. To that end, 

the nexus between the suspected criminal activity, the items 

sought, and the place to be searched may be based on, among 

other things, the type of crime, the extent of the suspect's 

opportunity for concealment, and normal inferences about where a 

criminal would be likely to hide evidence of the suspected 

crime. See id. at 768.

Here, the affidavit described how Sergeant Hill had

observed a computer associated with the IP address 65.96.142.191 

that contained, and was sharing, child pornography via the Ares 

network. An Internet search revealed that this IP address had 

been issued to Comcast, the ISP. The district attorney for the 

Berkshire district then issued a subpoena to the ISP, which 

revealed that the IP address in question had been assigned

during the relevant time period to a subscriber at the physical 
12

address of the apartment.

6 The temporal and geographical links

between the target IP address and the physical address to be 

searched provided a substantial basis for concluding that 

evidence sought (computers and related items) was connected to 

the suspected crime (possessing or sharing child pornography) 

and likely would be found at the specified premises (the 

apartment), and therefore gave rise to a sufficient nexus

between the suspected criminal activity and the residence. See

Commonwealth v. Augustine, 472 Mass. 448, 455 (2015);

Commonwealth v. Foster, 471 Mass. 236, 241–242 (2015).

Of course, the ISP also provided a name associated with the 

service address and officers took subsequent steps to determine 

who actually lived at the apartment. In many cases, those 

pieces of information can serve a useful confirmatory role. But

in the present case, we conclude that there was probable cause 

to search for evidence related to sharing child pornography 

based on the information police obtained through their Ares 

surveillance and the administrative subpoena, independent of 

whose name was on the Internet account or in the housing 

 

6 We note that the administrative subpoena is generally a 

more reliable method of connecting an IP address with a physical 

address, as compared to certain IP address mapping services. 

See Mackey, Stanton, Schoen, & Cohn, Electronic Frontier 

Foundation, Unreliable Informants: IP Addresses, Digital Tips 

and Police Raids 8-9 (Sept. 2016), available at https://www.eff.

org/files/2016/09/22/2016.09.20_final_formatted_ip_address_white

_paper_0.pdf [https://perma.cc/Y42U-C5TG] (discussing error 

rates of some IP address mapping services).
13

development's records. The probable cause showing necessary for 

issuance of a search warrant is "only a fair probability that 

evidence of such a crime would be found in particular 

locations," not "a prima facie showing that the defendant 

possessed child pornography." Anthony, 451 Mass. at 72. Police 

met that threshold here.

The defendant advances, in essence, three arguments about 

why investigators needed to do more to establish probable cause. 

We address each in turn.

First, he points out that before applying for the search 

warrant, the police were unable to verify that the subscriber 

named by the ISP -- Angel Martinez -- lived at the apartment,

and also were unable to rule out the possibility that someone 

other than the named subscriber was responsible for using the IP 

address assigned to the apartment at the time in question. 

Therefore, the defendant argues, it was possible that a new (and 

innocent) person had moved into the apartment while Angel 

Martinez, living at a different address altogether, continued to 

pay the Internet bill, or that a new occupant merely took over 

the Internet payments without changing the name on the account. 

To support his position, the defendant cites several cases in 

which investigators obtained more information linking an 

individual suspect to a specific physical address before 

applying for a search warrant. See, e.g., United States v. 
14

Elbe, 774 F.3d 885, 887–888 (6th Cir. 2014), cert. denied, 135 

S. Ct. 1573 (2015) (agents observed person matching child 

pornography suspect's driver's license photograph sitting on 

porch of target residence); United States v. Stults, 575 F.3d 

834, 838 (8th Cir. 2009), cert. denied, 559 U.S. 915 (2010)

(public records check using LexisNexis, postal service mail 

delivery check, and motor vehicle registration check all 

confirmed that named Internet subscriber actually resided at 

target residence).

It is true that investigators had no direct information 

that Angel Martinez personally had used, was using, or would 

ever use the IP address in question. However, in this 

particular case, the name of the Internet account holder did not 

defeat probable cause. See Commonwealth v. Molina, 476

Mass. , (2017). The question before the magistrate was 

whether the apartment located at a certain address likely 

contained evidence of criminal activity -- period. The question 

was not whether that address likely contained evidence of 

criminal activity on the part of Angel Martinez (or on the part 

of Avilez for that matter).

To that end, Detective Washington's supporting search 

warrant affidavit spelled out a relatively direct link between 

(1) the downloading and sharing of child pornography video 

files, (2) a specific IP address, and (3) a specific physical 
15

address to which that IP address had been assigned. From a 

technological standpoint, an IP address can be assigned to only 

one service address at any given point in time. See United 

States v. Vosburgh, 602 F.3d 512, 527 & n.14 (3d Cir. 2010), 

cert. denied, 563 U.S. 905 (2011), and cases cited (noting 

"unique nature of the IP address assigned" to defendant on 

particular date made Internet activity on that date "fairly 

traceable" to specific ISP account and associated physical 

address); DOJ, Searching and Seizing Computers, supra at 65. 

Taken together, these facts gave rise to a reasonable inference 

that evidence related to possession or distribution of child 

pornography via the Internet likely would be found at the 

apartment -- the one place, according to the ISP's records, to 

which the IP address in question was assigned during the 

relevant time period.

Once this nexus was established, the name of the account 

holder was essentially incidental. See Molina, 476 Mass. at 

. Although information showing that the named subscriber was 

also the person suspected of possessing or sharing the child 

pornography might have increased the likelihood that the soughtafter evidence would be located at the service address, the lack 

of such information does not necessarily defeat probable cause. 

See United States v. Grant, 218 F.3d 72, 75 (1st Cir.), cert. 

denied, 531 U.S. 1025 (2000). This is so precisely because an 
16

IP address can be assigned to only one service address at any 

given time -- regardless of whose name is on the account.7 See 

Vosburgh, 602 F.3d at 527 & n.14.

Second, the defendant points out that investigators did not 

determine whether the Internet connection at the apartment used 

a wireless router and, if so, whether the wireless network 

required a password. This left open the possibility that 

someone other than the subscriber, located at a different 

physical address, was "joyriding" on an unsecured wireless 

network based out of the apartment. See Snow, Accessing the 

Internet Through the Neighbor's Wireless Internet Connection:

Physical Trespass in Virtual Reality, 84 Neb. L. Rev. 1226, 

1227-1229 (2006). The defendant argues that this concern is 

especially acute in the present case because investigators knew 

that the apartment was part of a housing development, in which 

multiple residences were in close proximity to the target 

physical address.

The defendant's argument is misdirected. A showing of

probable cause to search a place (as opposed to arrest a person)

 

7 The defendant does not now claim that the information in 

the police affidavit had become stale. The defendant's motion 

to suppress did include a passing reference to staleness. 

However, this theory was not advanced at the suppression motion 

hearing, and the defendant's brief does not make such an 

argument. Any staleness issue, therefore, is waived. See 

Commonwealth v. Wood, 389 Mass. 552, 554 n.3 (1983), citing 

Mass. R. A. P. 16 (a) (4), as amended, 367 Mass. 919 (1975).
17

need not identify a specific criminal suspect -- although 

frequently it does. See Zurcher v. Stanford Daily, 436 U.S. 

547, 555–557 & n.6 (1978). See also Molina, 476 Mass. at . 

Indeed, "[t]he critical element in a reasonable search is not 

that the owner of the property is suspected of crime but that 

there is reasonable cause to believe that the specific 'things' 

to be searched for and seized are located on the property to 

which entry is sought." Zurcher, supra at 556. In other words, 

police need only demonstrate a sufficient nexus between the 

criminal activity under investigation, the items sought, and a 

place to be searched where the items may reasonably be expected 

to be located -- independent of whether they have identified a 

specific criminal suspect.

8 See McDermott, 448 Mass. at 767-768; 

O'Day, 440 Mass. at 302-304. Certainly police may have an 

easier time demonstrating a sufficient nexus if they can link a 

specific suspect (e.g., the named Internet account holder) to 

 

8 To this point, the prosecutor and Detective Steven 

Washington had the following colloquy at trial:

Q.: "Now when you execute a warrant like this . . . are 

you conducting . . . [the search] for a person or for a 

device?"

A.: "A device."

Q.: "Okay. And why is that?"

A.: "Because I have no clue who is behind that device."
18

the criminal activity. However, such a link is not always 

required.

The search warrant affidavit in this case demonstrated that 

child pornography was being shared via the Internet from a 

specific IP address. This IP address, in turn, had been

assigned to a specific physical address during the time when the 

child pornography was being shared. These facts provided a 

substantial basis from which to conclude that evidence of 

downloading and sharing child pornography via the Internet would 

be located at the apartment, even if it turned out that an 

unauthorized user was "joyriding" using the targeted IP address. 

See Augustine, 472 Mass. at 455; Commonwealth v. Escalera, 462 

Mass. 636, 645 (2012), quoting 2 W.R. LaFave, Search and Seizure 

§ 3.7(d), at 420–421 (4th ed. 2004) (police do not need to 

provide definitive proof that evidence of suspected criminal 

activity will be located at targeted residence, only facts 

supporting reasonable inference that such evidence "probably" 

would be located there). See also Grant, 218 F.3d at 75 (even 

discounting for possibility that individual other than 

subscriber may have been using account, there was fair 

probability that subscriber was user and that evidence of user's 

illegal activities would be found in subscriber's home).9

 

9 This close nexus also distinguishes a case like 

Commonwealth v. Kaupp, 453 Mass. 102 (2009). In that case, we 
19

The defendant is correct, from a technological standpoint, 

that if an Internet subscriber at the apartment set up an 

unsecured wireless Internet network, a computer outside of this 

physical address (in a neighboring unit, perhaps) could have 

used the targeted IP address to access the Internet and share 

child pornography.10 This point misses the mark, because 

 

held that police lacked probable cause to search a specific 

computer for evidence of child pornography. Id. at 113-114. 

However, in the Kaupp case, there was no indication that a 

specific IP address had been used to download or share child 

pornography. Instead, police essentially relied on the fact 

that the targeted computer may have shared another,

nonpornographic file with a computer that did contain child 

pornography, and that these two computers were connected in a 

way that made it possible for them to share other files. See 

id. at 111-112. The nexus in this case -- where an officer 

directly observed child pornography being transmitted through

the targeted IP address, which could only be assigned to one 

physical address at the time in question -- is substantially 

stronger.

10 Notably, there was no evidence, either at the suppression 

stage or at trial, that the apartment was home to an unsecured 

wireless Internet connection or that anyone other than the 

defendant used the Internet connection there. Nor was there any 

evidence that the defendant did not connect his laptop computers

to the Internet through the IP address assigned to the 

apartment. However, even if we accept the defendant's 

hypothetical scenario of "joyriding," and it turned out that 

none of the defendant's devices contained child pornography, 

police still would have had probable cause to seize and search 

any Internet modems or routers in order to determine which 

devices were connected to the targeted IP address at the time 

when police witnessed child pornography being shared via the 

targeted IP address. See United States v. Stanley, 753 F.3d 

114, 115-117 (3d Cir.), cert. denied, 135 S. Ct. 507 (2014) 

(describing how wireless Internet router keeps log of devices 

that have connected to it). If those devices, or other 

information, then led police to a device at a different physical 

address from the one linked to the IP address through the ISP's 
20

probable cause does not require investigators to "establish to a 

certainty that the items to be seized will be found in the 

specified location," nor does it require them to "exclude any 

and all possibility that the items might be found elsewhere." 

Anthony, 451 Mass. at 70, quoting Commonwealth v. Harmon, 63 

Mass. App. Ct. 456, 461 (2005).

Finally, the defendant argues that, in a case like this,

probable cause cannot arise until police show one of three 

things: (1) that the target IP address has not been linked to a 

wireless Internet service; (2) that the target IP address is 

linked to a wireless Internet service, but it is a secure 

connection requiring a password; or (3) that no one outside the 

target physical address could be accessing the network. The 

defendant urges that, without these showings, the likelihood of 

someone outside the target physical address using the target IP 

address is substantial enough to defeat probable cause. By and 

large, these proposals simply restate the defendant's arguments

 

records, police likely would have needed another warrant. Cf. 

United States v. Voustianiouk, 685 F.3d 206, 213-214 (2d Cir. 

2012) (where police omitted target's name from application for 

warrant to search specific apartment, second warrant was 

required once it became clear target lived in different 

apartment); United States v. Greathouse, 297 F. Supp. 2d 1264, 

1274–1275 (D. Or. 2003) (second warrant required when it became 

clear to officers executing warrant that target resided in 

rented room within house). But, as illustrated above, that 

scenario is several steps removed from what occurred here, where 

police quickly located two laptop computers that belonged to the 

defendant, one of which contained five video files of child 

pornography.
21

urging that the police, in order to show probable cause, should 

have been required to rule out the possibility that persons 

outside of the apartment may have been "joyriding" on the IP 

address assigned to that location at the time in question. To 

the extent that is the case, we reject these proposals for the 

reasons already mentioned.

Moreover, as the Commonwealth points out, it is not clear 

whether it would be technologically feasible for investigators 

to do what the defendant asks. With respect to the first 

proposal, there is nothing in the record showing that a third 

party (like an ISP, for instance) would be able to determine 

whether a subscriber's connection to the Internet is through a 

hard-wired or wireless connection at any given point in time. 

With respect to the second, in the case of a subscriber who uses

a wireless router, it is not clear how investigators would be 

able to ascertain whether the network is password-protected 

without first learning the name of that subscriber's wireless 

network. And regarding the third proposal, even assuming 

investigators knew that a target IP address was associated with 

an unprotected wireless network that had been accessed by 

devices not belonging to the subscriber, these considerations 

would not necessarily change the fact that, given the Ares 

surveillance conducted in this case, there remained a fair 

probability that any computers located at the apartment would 
22

contain evidence related to the possession or distribution of 

child pornography. See United States v. Stanley, 753 F.3d 114, 

115-117 (3d Cir.), cert. denied, 135 S. Ct. 507 (2014) (based on 

file-sharing surveillance similar to that conducted in this 

case, police obtained valid search warrant for home linked to 

target IP address; only after police found no evidence of child 

pornography there and learned, in course of their search, that 

home deployed wireless Internet network that was not passwordprotected did they take subsequent steps to locate true 

suspect); United States v. Perez, 484 F.3d 735, 740 (5th Cir.), 

cert. denied, 552 U.S. 952 (2007) (although possible that 

Internet transmissions originated outside of residence to which 

IP address was assigned, it remained likely that source of 

transmissions was inside that residence); Grant, 218 F.3d at 75

(similar); United States v. Carter, 549 F. Supp. 2d 1257, 1268–

1269 (D. Nev. 2008) (similar). The defendant's proposals merely 

illustrate that different hypothetical scenarios could lead to a 

different conclusion regarding probable cause. But those 

potentialities do not necessarily defeat probable cause, 

especially when they lack any factual underpinning. See 

Anthony, 451 Mass. at 70 (discussing nexus requirement). 

Instead, the fundamental question is whether there was a 

substantial basis from which to conclude that the items 

described in the application were probably present at the place 
23

to be searched. See id. at 69. For all of these reasons, we 

affirm the denial of the defendant's motion to suppress.11

We end with a cautionary note. Our decision today should 

not be read to mean that probable cause always exists any time

investigators link illegal computer activity to an IP address 

and then link that IP address to a physical address. For one, 

police should (as they did in this case) connect the IP address 

with a physical address through a reliable method, such as an

administrative subpoena to the ISP, rather than relying solely 

on a potentially unreliable method, such as certain IP address 

mapping services. See note 6, supra. Additionally, 

technologies that apparently were not at issue in this case may 

further erode the connection between an IP address and a 

physical address. See EFF, Unreliable Informants, supra at 10-

11 (discussing how Tor exit relays, virtual private networks, 

and proxy server connections can mask originating IP addresses

through use of one or more intermediary IP addresses); Vosburgh, 

602 F.3d at 527 n.14 (discussing "possibility of mischief and 

mistake with IP addresses" such that, in some cases, "value of 

 

11 The defendant does not challenge the reasonableness or 

scope of the search of his digital files once police had seized 

his computers, nor does he raise the related issue whether 

courts should require police to develop minimization techniques 

to govern the execution of a digital search. Accordingly, we 

need not address those issues here. However, in an appropriate 

case, we would consider whether to require some type of digital 

search protocol. See Commonwealth v. Molina, 476 Mass. , 

(2017).
24

that IP address for probable cause purposes may be greatly 

diminished, if not reduced to zero").

At the very least, certain cases may require police to 

disclose in a search warrant affidavit the possibility that one 

of these technologies is, or may be, in play based on facts 

known or reasonably knowable to investigators at the time. See

EFF, Unreliable Informants, supra at 18. If such technologies

become more common, it is entirely possible that we would 

require police to proceed in multiple steps, obtaining subpoenas

related to each intermediary IP address or warrants to search 

each location hosting those IP addresses. Alternatively, some 

cases may require the police to examine forensically a wireless 

router to determine which devices were connected to it, and 

when, before they search particular computers. See Stanley, 753 

F.3d at 115-117 (describing police investigation based on 

information obtained by examining innocent Internet user's 

unprotected wireless Internet router that had been "hijacked" by 

neighbor-defendant to share child pornography).

Such possibilities demonstrate why the probable cause 

analysis rarely, if ever, lends itself to bright-line rules. 

See Escalera, 462 Mass. at 643 ("No bright-line rule can 

establish whether there is a nexus" between suspected criminal 

activity and defendant's home). This is especially so when, as 

here, the analysis hinges on fluid and rapidly changing 
25

technologies. Cf. Commonwealth v. Dorelas, 473 Mass. 496, 502 & 

n.11 (2016) (noting that "what might have been an appropriate 

limitation [on searches] in the physical world becomes a 

limitation without consequence in the virtual one"); id. at 505

(Lenk, J., dissenting) (transposing protections of art. 14 and 

Fourth Amendment to digital contexts "is an ongoing and 

challenging task"); Commonwealth v. Phifer, 463 Mass. 790, 797 

(2012) (noting that developments in cellular telephone 

technology "present novel and important questions about the 

relationship between the modern doctrine of search incident to 

arrest and individual privacy rights").

Conclusion. The order denying the motion to suppress and 

the defendant's conviction are affirmed.

So ordered.