Nos. 01-14-00516-CR, 01-14-00517-CR, 01-14-00518-CR

01-14-00519-CR, 01-14-00520-CR

In the

Court of Appeals

For the

First District of Texas

At Houston

♦

Nos. 1370904, 1370905, 1370906, 1370907, 1370908

In the 230th District Court

Of Harris County, Texas

♦

HUGO PACHAS-LUNA

Appellant

v.

THE STATE OF TEXAS

Appellee

♦

State’s Appellate Brief

♦

DEVON ANDERSON

District Attorney

Harris County, Texas

STEPHEN DRIVER

KATHRYN KAHLE

Assistant District Attorneys 

Harris County, Texas

CLINTON A. MORGAN

Assistant District Attorney

Harris County, Texas

State Bar No. 24071454

morgan_clinton@dao.hctx.net

1201 Franklin, Suite 600

Houston, Texas 77002

Tel: (713) 755-5826

FAX: (713) 755-5809

Counsel for the Appellee

Oral Argument Not Requested

ACCEPTED

01-14-00516-CR

FIRST COURT OF APPEALS

HOUSTON, TEXAS

4/20/2015 10:16:35 AM

CHRISTOPHER PRINE

CLERK

 FILED IN 1st COURT OF APPEALS HOUSTON, TEXAS 4/20/2015 10:16:35 AM CHRISTOPHER A. PRINE Clerk
Statement Regarding Oral Argument

The appellant requested oral argument, though he gave no particular 

reason why. The State believes the briefs in this case adequately apprise this 

Court of the issues and the law, and any marginal benefit from oral argument 

does not justify the considerable amount of time that preparation for oral 

argument requires of the parties and the Court. Therefore, the State does not 

request oral argument. 

i
Identification of the Parties

Counsel for the State:

Devon Anderson 

 District Attorney of Harris County

Stephen Driver & Kathryn Kahle

— Assistant District Attorneys at trial

Clinton A. Morgan

 Assistant District Attorney on appeal

Appellant:

Hugo Pachas-Luna

Counsel for the Appellant:

Connie Williams

— Counsel at trial

Alexander Bunin & Sarah V. Wood

— Counsel on appeal

Trial Judge:

Brad Hart

 Presiding judge

ii
Table of Contents

Page

Statement Regarding Oral Argument.......................................................... i

Identification of the Parties ........................................................................ ii

Table of Contents .......................................................................................... iii

Index of Authorities .......................................................................................v

Statement of the Case ................................................................................... 1

Statement of Facts ......................................................................................... 1

Reply to the Appellant’s Sole Point of Error

Most of the appellant’s complaints are minor or completely meritless. His 

one legitimate complaint — the possible discrepancy between when the IP 

address was sharing child pornography and when the IP address was 

connected to the appellant — is unpreserved, and a matter of first 

impression that this Court should refrain from addressing. Given the 

deferential standard of review in warrant cases, this Court should defer to 

the magistrate’s determination of probable cause. ................................................... 2

I. Appellate courts review warrant affidavits by reading them in a 

common-sense manner, and giving deference to both the trial court and 

the issuing magistrate........................................................................................................ 2

II. A fair reading of the affidavit shows that it is not nearly so bad as the 

appellant makes it seem.................................................................................................... 4

A. Corporal Lee’s Background Knowledge........................................................5

1. Lee’s Training......................................................................................................... 5

2. Lee’s Knowledge of Peer-to-Peer Networks..............................................6

3. Lee’s Software, and “Hash Values”.................................................................7

B. This Investigation................................................................................................... 8

1. The Child Pornography Files............................................................................8

2. Connecting the IP to the Appellant ............................................................ 10

3. “People who have a sexual interest in children ...”.............................. 12

iii
III. All but one of the appellant’s complaints are without merit, and on 

that issue there is a sufficient basis in the affidavit that the trial court’s 

ruling was not an abuse of discretion. ..................................................................... 12

A. The name of the online database was not necessary to show 

probable cause............................................................................................................... 12

B. Lee adequately described his investigative software........................... 14

C. The missing verb is apparent from context clues.................................. 15

D. The affidavit elsewhere describes in detail some of the child 

pornography found on the suspect IP address, thus whether the phrase 

“labeled as child notables” was “conclusory and uncredited” is 

irrelevant, as it was not necessary for the probable-cause 

determination. ............................................................................................................... 17

E. There was information regarding only one IP address; the 

“different” IP address mentioned in the affidavit was obviously a typo, 

as the trial court determined................................................................................... 18

F. The appellant’s sole legitimate complaint — regarding the 

imprecise connection between the suspect IP address and the 

appellant’s residence — is unpreserved. If this Court addresses it, it is a 

question of first impression and this Court should defer to the 

inferences drawn by the magistrate and the trial court. ............................. 20

G. The appellant’s complaint about Lee’s “method” of comparing hash 

values is irrelevant....................................................................................................... 23

H. The information in the affidavit connecting child pornography to 

the appellant’s residence was not stale. ............................................................. 25

Conclusion .................................................................................................... 29

Certificate of Compliance and Service..................................................... 30

iv
Index of Authorities

Cases

Barrett v. State

367 S.W.3d 919 (Tex. App.—

Amarillo 2012, no pet.)....................................................................................................... 21

Champion v. State

919 S.W.2d 816 (Tex. App.—

Houston [14th Dist.] 1996, pet. ref’d)...................................................................16, 19

Gardner v. State

433 S.W.3d 93 (Tex. App.—

Houston [1st Dist.] 2014, pet. ref’d).............................................................................. 22

Hereford v. State

339 S.W.3d 111 (Tex. Crim. App. 2011)..........................................................................4

Illinois v. Gates

462 U.S. 213 (1983)................................................................................................................. 3

Pair v. State

184 S.W.3d 329 (Tex. App.—

Fort Worth 2006, no pet.).................................................................................................. 24

Reyes v. State

02-11-00327-CR, 2013 WL 1338023 (Tex. App.—

Fort Worth Apr. 4, 2013, no pet.) 

(mem. op. not designated for publication)................................................................. 16

Rodriguez v. State

232 S.W.3d 55 (Tex. Crim. App. 2007).......................................................................... 23

Rothstein v. State

267 S.W.3d 366 (Tex. App.—

Houston [14th Dist.] 2008, pet. ref’d)................................................................. passim

Sanders v. State

191 S.W.3d 272 (Tex. App.—

Waco 2006, pet. ref’d)......................................................................................................... 28

v
Serrano v. State

123 S.W.3d 53 (Tex. App.—

Austin 2003, pet. ref’d).......................................................................................................... 3

State v. Cotter

360 S.W.3d 647 (Tex. App.—

Amarillo 2012, no pet.)....................................................................................................... 28

State v. Delagarza

158 S.W.3d 25 (Tex. App.—

Austin 2005, no pet.)............................................................................................................... 3

State v. Jordan

342 S.W.3d 565 (Tex. Crim. App. 2011)..........................................................................3

Tucker v. State

369 S.W.3d 179 (Tex. Crim. App. 2012)..........................................................................4

United States v. Bervaldi

226 F.3d 1256 (11th Cir. 2000).................................................................................26, 27

United States v. Diecidue

603 F.2d 535 (5th Cir. 1979)............................................................................................. 27

United States v. Hay

231 F.3d 630 (9th Cir. 2000)............................................................................................. 28

United States v. Morales-Aldahondo

524 F.3d 115 (1st Cir. 2008).............................................................................................. 28

United States v. Vosburgh

602 F.3d 512 (3d Cir. 2010)............................................................................................... 21

vi
Statement of the Case

The appellant was charged in five indictments with different charges of 

possession of child pornography. (1 CR 13; 2 CR 13; 3 CR 13; 4 CR 13; 5 CR 

13).1 The appellant waived his right to a jury trial and pled not guilty to the 

trial court. (2 RR 4-8). The trial court found him guilty as charged. (4 RR 130-

31). After a pre-sentence investigation, the trial court assessed punishment for 

each case at eight years’ confinement, with the sentences to run consecutively. 

(5 RR 18; 1 CR 87-88; 2 CR 88-89; 3 CR 88-89; 4 RR 86-87; 5 RR 80-81). The 

appellant filed timely notices of appeal and the trial court certified his right of 

appeal. (1 CR 92, 94). 

Statement of Facts

A Harris County Precinct Four Constable’s Deputy conducted an 

investigation into online child-pornography file sharing and discovered a 

computer sharing child pornography from an internet account associated with 

the appellant. (Def.’s Ex. 1). The deputy obtained a warrant for the appellant’s 

house, and when the warrant was served police found numerous hard drives 

1 The State will refer to the clerk’s records in the different causes as though they were 

sequential volumes. Thus the record for 01-14-00516- CR will be 1 CR, the record for 01-

14-00517-CR will be 2 CR, and so on, in numerical order. If the same document appears in 

all the records, the State will cite to the copy in 1 CR. 

1

 
containing, in total, more than 18,000 images and videos of child pornography, 

including the four images and one video for which he was charged in this case. 

(4 RR 103-16).

Reply to the Appellant’s Sole Point of Error

Most of the appellant’s complaints are minor or completely meritless. 

His one legitimate complaint — the possible discrepancy between when 

the IP address was sharing child pornography and when the IP address 

was connected to the appellant — is unpreserved, and a matter of first 

impression that this Court should refrain from addressing. Given the 

deferential standard of review in warrant cases, this Court should defer 

to the magistrate’s determination of probable cause.

The appellant filed a pre-trial motion to suppress alleging, inter alia, that 

the warrant affidavit in this case did not contain probable cause to believe 

contraband would be found in the appellant’s home, thus the evidence was 

obtained illegally. (1 CR 79-81). The trial court held a hearing on the motion to 

suppress at the beginning of the appellant’s bench trial and denied the motion. 

(3 RR 129-31). In his sole point of error, the appellant claims that the trial 

court erred in denying his motion to suppress.

I. Appellate courts review warrant affidavits by reading them in a 

common-sense manner, and giving deference to both the trial 

court and the issuing magistrate. 

Probable cause exists if, under the totality of the circumstances set forth 

in the affidavit before the magistrate, there is a fair probability that 

2
contraband or evidence of a crime will be found in a particular place at the 

time the warrant is issued. State v. Jordan, 342 S.W.3d 565, 568-69 (Tex. Crim.

App. 2011). The magistrate may interpret the affidavit in a non-technical, 

common-sense manner and may draw reasonable inferences from the facts 

and circumstances contained within its four corners. Id. at 569.

When reviewing whether a warrant should have issued, courts —

whether at the trial or appellate level — are not to determine whether there 

actually was probable cause. State v. Delagarza, 158 S.W.3d 25, 29 (Tex. App.—

Austin 2005, no pet.). The test at the trial court is: considering the totality of 

the circumstances before the issuing magistrate, was there a substantial basis 

to believe that probable cause existed. Ibid.; Illinois v. Gates, 462 U.S. 213, 268 

(1983). On appellate review, then, the appropriate test is: did the trial court 

abuse its discretion in finding that the magistrate had a substantial basis to 

believe that probable cause existed. “The resolution of doubtful or marginal 

cases should largely be determined by the preference to be accorded to 

warrants.” Delagarza, 158 S.W.3d at 29. On appeal, the sufficiency of a warrant 

affidavit is generally determined by looking at the affidavit itself, without 

regard to extrinsic evidence. Serrano v. State, 123 S.W.3d 53, 58 (Tex. App.—

Austin 2003, pet. ref’d).

3
In reviewing a trial court’s ruling on a motion to suppress, appellate 

courts give almost total deference to the trial court’s factual determinations, 

even when those determinations are based on affidavit, but review de novo the 

trial court’s application of the law of search and seizure. Tucker v. State, 369 

S.W.3d 179, 184 (Tex. Crim. App. 2012). The record should be viewed in the 

light most favorable to the trial court’s decision, and the trial court’s decision 

should be upheld so long as it is reasonable in light of the record. Hereford v. 

State, 339 S.W.3d 111, 18 (Tex. Crim. App. 2011). 

II. A fair reading of the affidavit shows that it is not nearly so bad as 

the appellant makes it seem.

In his brief, the appellant engages in a persnickety reading of certain 

sections of the affidavit. He focuses, at times, on what the affidavit does not say 

rather than what it does. He seems befuddled by certain phrases in the 

affidavit that are explained clearly enough in other parts. And he demands 

descriptions and definitions of ordinary notions that any magistrate of 

common intelligence would have understood.

The State will grant that Corporal Lee is unlikely to be nominated for 

any literary prizes based on this affidavit, but appellate review is not about 

critiquing stylistic and typographical errors. Rather, this Court is to examine 

the whole document and determine whether it was reasonable for the trial 

4
court to conclude that the affidavit gave the issuing magistrate a substantial 

basis to find probable cause that there would be evidence of a crime at the 

searched address. What follows is an attempt to read through the affidavit for 

its relevant parts and to place them in the order that makes the most sense.

A. Corporal Lee’s Background Knowledge

1. Lee’s Training

The affidavit begins with the qualifications of the affiant. (Def.’s Ex. 1 at 

4-5). Corporal Jeffrey Lee is employed as a peace officer by the Harris County 

Precinct Four Constable, and he has been a law enforcement officer for more 

than a decade. “[H]is duties include the investigation of technologically 

advanced offenses including ... Child Pornography.” (Def’s. Ex. 1 at 4). He is 

certified “in Basic Cybercrime Investigation.” 

Lee has spoken with others in the law enforcement community who 

know about the ways of those who trade and collect child pornography. 

Moreover, he “has been personally involved in the investigation, arrest, and 

prosecution of numerous persons involved in child sexual exploitation.” (Def’s 

Ex. 1 at 4). Lee is a member of the Houston Metro Internet Crimes Against 

Children Task Force, a federally funded initiative. 

5
2. Lee’s Knowledge of Peer-to-Peer Networks

Through his training and experience, Lee is aware that “the trade of 

child pornography through the internet is extensive and one of the main 

methods of distribution for this type of contraband.” (Def.’s Ex. 1 at 4). Lee is 

aware that the use of peer-to-peer (P2P) networks is “one of the most 

pervasive methods for the distribution of child pornography through the 

internet.” (Def.’s Ex. 1 at 4). Lee knows that P2P file sharing is accomplished by 

downloading software and listing certain files and folders as being “shared,” 

and then those files and folders are indexed by an “ultra-peer,” through which 

other users can search the shared files and folders and select which ones to 

download. (Def.’s Ex. 1 at 5). Once a user chooses to download a file from 

another user, those computers are then connected through an internet 

protocol (IP) address. (Def.’s Ex. 1 at 5). The sending and receiving computers 

record each others’ IP addresses in order to facilitate the file sharing. (Def.’s 

Ex. 1 at 5). 

An IP address is “a unique four-byte number assigned to a computer 

when that computer accesses the Internet.” (Def.’s Ex. 1 at 17). Every 

computer on the internet has an IP address that is assigned to it by its internet 

service provider when it logs on. (Def.’s Ex. 1 at 17). An IP address “is unique 

in the sense that no two users can have the exact same IP address at the same 

6
time.” (Def.’s Ex. 1 at 17). Internet service providers generally keep records 

that allow them to know which subscriber was using a particular IP address at 

a particular time. (Def.’s Ex. 1 at 8-9, 17). 

3. Lee’s Software, and “Hash Values”

Lee has received “specialized training” for the investigation of P2P 

networks using “a specialized program developed to allow investigators to 

access a variety of [P2P] networks.” (Def.’s Ex. 1 at 5). Lee “is trained and 

licensed to use this software.” (Def.’s Ex. 1 at 5). The software allows 

investigators to “search the variety of networks for digital material from users 

connecting to the [P2P] Networks and download files that the users ‘share’ 

with the network...” (Def.’s Ex. 1 at 5). 

The software allows investigators to narrow their searches in a couple of 

ways. One way is that they can narrow their searches so that they only return 

results from specified geographic areas, “such as Harris County, the City of 

Houston, or City of Pasadena.” (Def.’s Ex. 1 at 5).

The second way in which this software allows investigators to limit their 

searches is that the software can be set to return results for “confirmed images 

of child pornography.” (Def.’s Ex. 1 at 5). It does this through the use of “hash 

values.” All digital files can be processed through a Secure Hash Algorithm to 

7
produce an identifying hash value that will be the same for any two duplicate 

files, but which will be different if the files differ in any way. (Def.’s Ex. 1 at 7). 

Lee knows that by comparing the hash value of two files, he can determine 

whether two files are identical “with a precision that greatly exceeds 99.9999 

percent certainty.” (Def.’s Ex. 1 at 7). Because of how hash values are produced, 

“there has never been a documented occurrence of two different files being 

found on the Internet having different contents while sharing the same [hash] 

value.” (Def.’s Ex. 1 at 7). 

Lee’s investigative software uses hash values to limit its search. The 

software can take the hash values of files that have been determined to be 

child pornography and return search results only from computers that are 

sharing known child pornography. (Def.’s Ex. 1 at 5). Lee is aware that through

the use of this software and of the methods in which has been trained, 

“hundreds of [P2P] cases have been successfully investigated throughout the 

United States.” (Def.’s Ex. 1 at 6).

B. This Investigation

1. The Child Pornography Files

On August 9, 2012, Lee conducted an investigation using an “online 

database.” (Def.’s Ex. 1 at 6). “The software allows licensed investigators to 

8
track [IP addresses] in order to determine specifically what the individual or 

computer has downloaded over a specific ... time frame.” (Def.’s Ex. 1 at 6). 

That afternoon, Lee conducted a search limited to Harris County and 

discovered that IP address 98.194.180.10 was sharing2 more than twenty files 

that were “child notables,” meaning that “they are files that have been 

observed by other law enforcement officers as being ‘child pornography.’” 

(Def.’s Ex. 1 at 6). That computer was sharing “numerous other files” that “had 

titles which were indicative of child porn.” (Def.’s Ex. 1 at 6). Lee conducted 

additional checks of this IP address, and it repeatedly showed up as sharing 

what appeared to be child pornography.

3 (Def.’s Ex. 1 at 6). 

2 As the appellant correctly notes in his brief, this portion of the affidavit is missing a verb. 

The affidavit states that Lee “located IP address 98.194.180.106 which several unique 

files....” (Def.’s Ex. 1 at 6). The appellant believes this renders the affidavit 

incomprehensible. (See Appellant’s Brief at 21-22). However, later in the same paragraph of 

the affidavit, Lee states that a later search of the IP address showed that it “continued to 

have files within its share folder and those files all have files which are indicative of being 

child pornographic and nature ....” (Def.’s Ex. 1 at 6). Using context clues, it is apparent that 

the missing verb must be “was sharing” or something similar. 

3 As the appellant also correctly notes, in a single instance the affidavit specifies an IP 

address that differs by one numeral from the other references to an IP address in the 

affidavit. In three instances the affidavit refers to IP 98.194.180.106; it once, however, 

refers to 98.194.180.196. (Def.’s Ex. 1 at 6-7). From the context clues this must be regarded 

as a typographical error. The affidavit refers to an “additional check” of IP address 

98.194.180.196, and states that this “additional check” shows that the IP address 

“continue[d]” to share child pornography, when the only check previously mentioned in the 

affidavit was of IP 98.194.180.106. (Def.’s Ex. 1 at 6). Additionally, the affidavit states that

Lee requested information from Comcast “based upon the dates and times the IP address 

was seen downloading” child pornography, indicating that Lee meant to refer only to a 

single IP address in the affidavit. The State’s appellate counsel will also note that the 

numerals 9 and 0 are directly next to each other on a standard keyboard.

9

 
Lee then took the hash values of the files that were being shared from 

this IP address and asked other investigators whether they had seen files with 

those hash values. (Def.’s Ex. 1 at 7). Lee knows this method of matching files 

“has proven to be extremely reliable,” and he has used hash values to match 

“thousands of files and has never found two files with different contents but 

the same” hash value. (Def.’s Ex. 1 at 7). On August 17, 2012, Lee procured 

from other investigators copies of three video files that matched the hash 

values of files being shared by the suspect IP address. (Def.’s Ex. 1 at 7-8). One 

involved a girl between the ages of 5 and 8 being raped; the second involved

four girls between 11 and 14 engaging in sex with each other and with the 

male cameraman; the third involved a girl between the ages of 13 and 16 

engaging in oral and vaginal sex with a male. (Def.’s Ex. 1 at 8). 

2. Connecting the IP to the Appellant

Lee knows that “absent fraud or intentional deception, an [IP] address is 

an accurate method to find the method of internet connection for an individual 

accessing the internet.” (Def.’s Ex. 1 at 8). Internet service providers “keep 

accurate records that can be traced back to specific accounts if the [service 

providers] are provided with accurate dates and times of [internet] use.” 

(Def.’s Ex. 1 at 9). 

10
After identifying the suspect IP address as being from a block of IP 

addresses used by Comcast, Lee sent a grand jury subpoena to Comcast 

requesting information regarding “the subscriber assigned to that IP address, 

based upon ... the dates and time the IP address was seen downloading what 

are believed to be child pornographic images or videos.” (Def.’s Ex. 1 at 6). On 

August 20, 2012, Lee received a response from Comcast. It stated that on April 

4, 2012, at 8:57 pm, and on August 5, 2012 at 8:42 pm, IP address 

98.194.180.106 was being used by an the appellant’s account, the address for 

which was 18107 Fairhope Oak Street, Houston. (Def.’s Ex. 1 at 7). The account 

was created on August 7, 2009, and was still active at the time of the grand

jury subpoena. (Def.’s Ex. 1 at 7). 

When Lee ran an additional check on the IP address on December 7, 

2012 using his investigative software, he saw that the IP address had been 

active on one P2P network for roughly a year predating the investigation, from 

August 27, 2011 through September 3, 2012. (Def.’s Ex. 1 at 6). While using 

that network, the IP address had been seen using software with two Globally 

Unique Identifiers (GUIDs). (Def.’s Ex. 1 at 6). While it is possible for a 

computer’s IP address to change, the GUIDs used by a particular program will 

remain the same unless the program is updated or uninstalled. (Def.’s Ex. 1 at 

6). 

11
3. “People who have a sexual interest in children ...”

Based on his training and experience, Lee believes the individual at 

18107 Fairhope Oak Street who was downloading and sharing child 

pornography had “a sexual interest in children.” (Def.’s Ex. 1 at 12). Lee is 

aware of several characteristics of such individuals. They “often collect 

sexually explicit materials ... depicting children, which they use for their own 

sexual gratification and fantasy. (Def.’s Ex. 1 at 12). They “rarely, if ever, 

dispose of their sexually explicit materials ... and those materials are treated as 

prized possessions.” (Def.’s Ex. 1 at 12-13). 

III. All but one of the appellant’s complaints are without merit, and 

on that issue there is a sufficient basis in the affidavit that the 

trial court’s ruling was not an abuse of discretion.

The appellant raises eight specific complaints about the warrant in his 

brief. The State will address them one by one.

A. The name of the online database was not necessary to 

show probable cause.

In his first complaint, the appellant points out that the “online database” 

mentioned once in the affidavit is not named in the affidavit. (Appellant’s Brief 

at 16-17). This observation is true, as far as it goes. 

12
The State’s first response is that this argument is not preserved because 

it was not presented to the trial court either in the appellant’s motion to 

suppress (1 CR 79-81) or in his arguments to the trial court (3 RR 83-88). See 

Rothstein v. State, 267 S.W.3d 366, 373 (Tex. App.—Houston [14th Dist.] 2008, 

pet. ref’d) (where defendant filed generic motion to suppress and presented 

certain specific arguments to trial court, other specific arguments not 

presented to trial court were not preserved).

Second, the appellant gives away the insignificance of this point when he 

notes that, aside from a single insubstantial reference, “this online database ... 

is not mentioned or described anywhere else in the voluminous affidavit ....” 

(Appellant’s Brief at 16). The appellant is correct. All of the evidence 

connecting the appellant to the child pornography was discovered using the 

investigative software described by Lee; the importance of the “online 

database” and its relation to the software are not obvious from the affidavit. If 

this Court were to completely disregard anything in the affidavit relating to an 

online database, it would not affect the quantum of evidence present to 

support probable cause. 

13
B. Lee adequately described his investigative software.

The appellant next complains that the software used by Lee “is Not 

Credited within the Affidavit.” (Appellant’s Brief at 17-20). The appellant 

seems confused by the fact that the affidavit describes two types of software. 

First, the affidavit gives a description of the sort of software commonly used 

for P2P sharing. (Def.’s Ex. 1 at 4-5). Later, the affidavit describes the 

investigative software for which Lee has received specialized training and that 

was used in the investigation of this case. (Def.’s Ex. 1 at 5-6). 

First, this matter was not raised in the appellant’s motion to suppress or

in his arguments to the trial court, thus, on abuse-of-discretion review, it 

should play no role in this Court’s decision. Rothstein, 267 S.W.3d at 373. 

On the merits, though, the State does not believe the affidavit is

confusing in the least on this point. In its discussion of P2P file sharing, the 

affidavit mentions the publicly-available software, stating that Lee “learned 

that computer users can choose to install publicly available software that 

facilitates the trading of images.” (Def.’s Ex. 1 at 5). Later, the affidavit states 

that Lee “has received specialized training regarding the investigations of 

[P2P] Networks in which a specialized software program developed to allow 

investigators to access a variety of [P2P] Networks is used.” (Def.’s Ex. 1 at 5).

The affidavit then states that Lee “is trained and licensed to use this software”; 

14
this is followed by further descriptions of the capabilities of “this software.” 

(Def.’s Ex. 1 at 5-6). There is no indication anywhere in the affidavit that Lee 

used any “software” other than the investigative software he described with 

some detail.

Perhaps the affidavit could have been clearer had Lee used the specific 

name of his investigative software, but, in light of Lee’s descriptions of its 

capabilities, the name of the program would neither add to nor detract from 

its reliability. 

C. The missing verb is apparent from context clues.

The third complaint raised by the appellant is that there is a missing 

verb in one sentence: “Your Affiant located IP address 98.194.180.106 which 

several unique files, over twenty of them being labeled as child notables, 

meaning they are files that have been observed by other law enforcement 

officers as being ‘child pornography.’” (Def.’s Ex. 1 at 6). According to the 

appellant, it is “impossible” to determine the meaning of this sentence. 

(Appellant’s Brief at 21). 

This matter was not raised in the appellant’s motion to suppress or at 

the trial court. That indicates two things: First, neither trial counsel nor the 

trial court had any apparent difficulty deciphering the meaning of this 

15
sentence; second, the matter is not preserved for this Court’s review. 

Rothstein, 267 S.W.3d at 373. 

The appellant’s failure to raise this matter in the trial court has further 

significance, because, while the sufficiency of an affidavit is normally 

determined by what is contained within its four corners, a typographical error 

in an affidavit can be explained through testimony at a motion-to-suppress 

hearing. See Champion v. State, 919 S.W.2d 816, 818 (Tex. App.—Houston 

[14th Dist.] 1996, pet. ref’d) (citing Green v. State, 799 S.W.2d 756, 760 (Tex.

Crim. App. 1990)); see also Reyes v. State, 02-11-00327-CR, 2013 WL 1338023, 

at *3 (Tex. App.—Fort Worth Apr. 4, 2013, no pet.) (mem. op. not designated 

for publication) (collecting cases). Had the appellant raised this matter in the 

trial court, the parties could have questioned Lee as to what the missing word 

was.

As a final note on this point, as the State observed in Footnote 2 of this 

brief, the context in which this sentence occurs makes apparent that the 

missing verb was “was sharing” or something similar. Two sentences later the 

affidavit notes that “an additional check” of the IP address “show[ed] the IP 

has continued to have files within its shared folders and those files all have 

files [sic.] which are indicative of being child pornographic in nature. ....” (Def.’s 

Ex. 1 at 6). In this context (and, indeed, in the larger context of the affidavit 

16
itself, which is seeking to establish probable cause that a particular IP address 

associated with the appellant was sharing child pornography), it would be 

passingly strange if the missing verb were something that did not indicate the 

suspected IP address was sharing child pornography. 

D. The affidavit elsewhere describes in detail some of the 

child pornography found on the suspect IP address, thus 

whether the phrase “labeled as child notables” was 

“conclusory and uncredited” is irrelevant, as it was not 

necessary for the probable-cause determination. 

The appellant’s next complaint is that the affidavit’s use of the phrase 

“labeled as child notables” “is conclusory and uncredited. (Appellant’s Brief at 

22). The State’s first response, again, is that this complaint was not made 

either in the appellant’s motion to suppress or in his argument to the trial 

court, thus it should not factor into this Court’s determination of whether the 

trial court abused its discretion. Rothstein, 267 S.W.3d at 373.

Second, this part of the affidavit is merely describing the investigation 

and is not essential for determining probable cause. Later in the affidavit, Lee 

went into graphic detail regarding three of the files that were being shared by 

the suspected IP address, and that should be more than sufficient to show 

probable cause even if this Court disregards the “labeled-as-child-notables”

line.

17
E. There was information regarding only one IP address; the 

“different” IP address mentioned in the affidavit was 

obviously a typo, as the trial court determined. 

In his fifth complaint, the appellant notes that in three instances the 

affidavit refers to IP address 98.194.180.106, but in one instance in the middle 

of these references the affidavit refers to IP address 98.194.180.196. 

(Appellant’s Brief at 23-24). The appellant presented this argument at the 

motion-to-suppress hearing, and the trial court determined that the reference 

to 98.194.180.196 was a typo and should have read 98.194.180.106. (3 RR 93-

94). 

Lee testified at the hearing before the trial court, and while he did not 

explicitly state that the reference to 98.194.180.196 was a typo, it could easily 

be inferred from his testimony, from the nature of the questioning, and from 

the affidavit itself. Lee testified that in this case he investigated IP address 

98.194.180.106. (3 RR 21). Throughout the hearing the parties questioned Lee 

about this IP address, and in seemingly every instance the questioning was 

phrased in the singular (i.e. the investigation involved only one IP address), 

and Lee responded, likewise, in the singular. (See, e.g., 3 RR 33 (Defense 

Counsel: “Is that the day you found out who the IP belonged to and what 

address it was coming from?” Lee: “That’s the date I found out that the IP 

address was assigned to that account.”)). Most tellingly, at one point the 

18
prosecutor asked Lee “how many dates did you verify that child pornography 

was available for trade from that particular IP address you mentioned earlier,” 

and Lee responded: “Two days.” (3 RR 55). The affidavit mentions viewing 

child pornography on an IP address on two dates, but it refers to different IP 

addresses for each date. (Def.’s Ex. 1 at 6). Thus, Lee’s testimony that on two 

dates he viewed child pornography on the same IP address is, effectively, 

testimony that the reference to IP 98.194.180.196 was a typo.

The conclusion that the reference to 98.194.180.196 was a typo is also 

supported by the affidavit itself. When IP address 98.194.180.196 is 

mentioned, it follows a mention to a check performed on IP 98.194.180.106 

and states that an “additional check” was performed on 98.194.180.196, 

which “continued to have” child pornography available for sharing. (Def.’s Ex. 

1 at 6). Reading the reference to IP 98.194.180.196 as a typo makes sense of 

the paragraph. Reading it, as the appellant does, as a reference to a second IP 

address renders half the paragraph nonsensical. It is obvious from the 

surrounding context that this was a typo, and the trial court had testimony 

supporting its conclusion that it was a typo. See Champion, 919 S.W.2d at 818.

This Court should defer to the trial court’s determination that this was a typo 

and not a wholly nonsensical paragraph.

19
F. The appellant’s sole legitimate complaint — regarding the 

imprecise connection between the suspect IP address and 

the appellant’s residence — is unpreserved. If this Court 

addresses it, it is a question of first impression and this 

Court should defer to the inferences drawn by the 

magistrate and the trial court.

The most serious problem with this affidavit is that it does not explicitly 

connect the appellant to the suspected IP address at the precise moments 

when the IP address was sharing child pornography. The appellant raises this 

matter in his brief. (See Appellant’s Brief at 25-29). At trial, however, the 

appellant’s only argument related to IP addresses was that the appellant’s IP 

address could have changed between the date that Lee subpoenaed Comcast 

and the date the warrant issued. (3 RR 86 (“[W]hat I’m getting to, this does not 

refer to the fact that at a certain time it belonged to him and necessarily 

belonged to him in December or in November.”), 92-93). That is a different 

(and irrelevant) issue. This Court should disregard this appellate complaint as 

unpreserved, particularly because the record shows that the trial court 

labored under an incorrect interpretation of the affidavit that could have been 

corrected had trial counsel pointed it out. See Rothstein, 267 S.W.3d at 373. 

The appellant’s appellate complaint, though unpreserved, is well taken. 

Reading it in the light most favorable to the trial court’s findings, the affidavit 

states that Lee observed IP 98.194.180.106 sharing and/or downloading child 

20
pornography on August 9, November 13, and December 7. (Def.’s Ex. 1 at 6). It 

then states that Lee subpoenaed Comcast regarding which subscriber was 

using that IP address “based upon ... the dates and time the IP address was 

seen downloading what are believed to be child pornographic images or 

videos.” (Def.’s Ex. 1 at 6). Comcast responded to this subpoena stating that the 

suspect IP address was being used by the appellant at particular times on 

April 4 and August 5. (Def.’s Ex. 1 at 6).

Had the affidavit connected the IP address to the appellant’s account at 

the precise time the IP address was sharing or downloading child 

pornography, the caselaw is clear that this would have been adequate to 

establish probable cause. See, e.g., United States v. Vosburgh, 602 F.3d 512, 518, 

527 (3d Cir. 2010) (so holding, and collecting cases). What is not clear, though, 

is how close in time the affidavit must connect the IP address to the suspect. 

The Texas cases the State can find have determined that probable cause 

existed if the IP address is “associated” with the suspect, or if it has been 

“assigned” to the suspect, but those cases have not specified whether the 

evidence showed that the IP address was “associated” with or “assigned” to 

the suspect at the precise moment illegal activity was observed. See, e.g.,

Barrett v. State, 367 S.W.3d 919, 923 (Tex. App.—Amarillo 2012, no pet.) (IP 

address “associated” with suspect); Gardner v. State, 433 S.W.3d 93, 100 (Tex. 

21
App.—Houston [1st Dist.] 2014, pet. ref’d) (IP address “assigned to” suspect).

The State can find no case, either in Texas or in the federal courts, where an 

affidavit connected the suspect to the offending IP address but not at the 

precise moment the illegal activity occurred, and the appellant has cited to no 

such case.

At the motion-to-suppress hearing, the trial court focused on the next 

paragraph of the affidavit, which stated that the appellant’s Comcast account 

“was created on 07/09/2009 and is currently active on [August 20, 2012].” 

(Def.’s Ex. 1 at 7). The trial court believed this meant that the appellant had 

had the same IP address for the entire period his account was active: “[T]he 

information in the search warrant that the officer got from the grand jury 

subpoena from Comcast shows that this IP address was created on July 9th of 

2009 for this defendant at this address and remained with him at least up 

until the point of, I guess, August 9th of 2012.” (3 RR 89-90). 

Nothing in the affidavit directly supports or refutes this belief. Trial 

counsel did not apprise the trial court that this belief was incorrect. 

There is still a substantial basis in the affidavit for a magistrate to find 

that the appellant had the offending IP address at the time it was seen 

downloading and/or sharing child pornography. First, the affidavit states that 

Lee subpoenaed Comcast for subscriber information “based upon the dates 

22
and time the IP address was seen downloading what are believed to be child 

pornographic images or videos.” (Def.’s Ex. 1 at 6). It is a fair inference from 

these facts that Lee had observed this IP address downloading child 

pornography on April 4 and August 5 but had not mentioned it explicitly in his 

affidavit.4 See Rodriguez v. State, 232 S.W.3d 55, 62 (Tex. Crim. App. 2007)

(“The inquiry for reviewing courts, including the trial court, is whether there 

are sufficient facts, coupled with inferences from those facts, to establish a ‘fair 

probability’ that evidence of a particular crime will likely be found at a given 

location.”). Certainly this inference is at least as fair as inferring that Lee had 

subpoenaed information for relevant dates but Comcast had replied with 

more-or-less random information.

G. The appellant’s complaint about Lee’s “method” of 

comparing hash values is irrelevant.

In his brief, the appellant complains that Lee “did not use valid 

techniques to compare the hash values” of the files found on the appellant’s 

computer to known child pornography. (Appellant’s Brief at 29-31). In the 

trial court, most of the appellant’s arguments related to the hash value 

comparison. (3 RR 83-85, 87-88).

4 Lee testified to as much at the motion-to-suppress hearing. (3 RR 56). 

23

 
The appellant’s complaint is both meritless and irrelevant. In his brief, 

the appellant bases his complaint on a statement in the affidavit where Lee 

states that his software “allows investigators to compare the digital hash 

values of the offered files to the hash values of known child pornography 

provided by the National Center for Missing and Exploited Children, which 

acts as a clearinghouse for images and videos of Child Pornography.” (Def.’s Ex. 

1 at 6). From this statement, the appellant draws the conclusion that 

comparing hash values to images from the National Center for Missing and 

Exploited Children is the only appropriate method to determine from a file’s 

hash values if it contains child pornography. (Appellant’s Brief at 29-30). This 

conclusion has no basis in the affidavit and is facially absurd, as it suggests 

that no one other than the National Center for Missing and Exploited Children 

is capable of determining whether a file contains child pornography.

The affidavit clearly lays out Lee’s method in this case and his basis for 

believing it was reliable. He obtained the hash values of files that were being 

shared by the appellant’s computer. He then asked other law officers if they 

had seen files with those hash values. He obtained copies of three files that 

matched those hash values. See Pair v. State, 184 S.W.3d 329, 338 (Tex. App.—

Fort Worth 2006, no pet.) (when law enforcement officer swears out affidavit 

and describes getting information from other officers, that information is 

24
presumed credible). He stated that, to his knowledge, there have never been 

two files with the same hash values but different content. He also stated that 

he had personally matched up “thousands” of files by using their hash values. 

And he described in graphic detail the contents of the files that matched the 

hash values of the files the appellant was sharing. Nothing in the appellant’s 

brief undermines the validity of the hash-value comparison Lee performed in 

this case.

H. The information in the affidavit connecting child 

pornography to the appellant’s residence was not stale.

In his next complaint, the appellant points out that, while the affidavit 

connects the appellant and his internet account to 18107 Fairhope Oaks in 

August (via the subpoena return from Comcast), the affidavit was not sworn to 

until December 10, and nothing in the affidavit indicates that police did 

anything to confirm that the appellant was still living at the address in 

December. (Appellant’s Brief at 31-32). The appellant claims that this fourmonth gap in information renders the affidavit stale. 

However, the affidavit, read in the light most favorable to the trial court’s 

ruling, includes information that the appellant had had this internet account at 

this address for more than three years at the time of the subpoena return. 

25
(Def.’s Ex. 1 at 7). This is how the trial court interpreted the affidavit. (3 RR 89-

90). 

The State can find no Texas case describing how long information 

regarding an individual’s residence remains fresh enough to support a 

warrant for that residence, and the appellant does not cite to any. The State 

would direct this Court to the case of United States v. Bervaldi, 226 F.3d 1256 

(11th Cir. 2000). That case dealt with the execution of an arrest warrant; the 

police executed an arrest warrant at a particular address on the basis of 

information that the suspect had lived there six months earlier. Bervaldi, 226 

F3d 1265. On appeal, Bervaldi complained that the police did not have a 

“reasonable belief” — the standard required by the Supreme Court in order to 

allow police to serve an arrest warrant at a particular location — that he 

would be at that residence. Ibid. 

The Eleventh Circuit began its analysis by recognizing that, while 

“reasonable belief” was a different standard than “probable cause,” the same 

general rules of staleness would apply to both situations. Ibid. The Bervaldi

court compared the situation to cases where affidavits had described ongoing 

criminal activity at a location or bullets in the walls of a location and 

concluded that, because of the nature of what was described in the affidavit, 

probable cause did not dissipate as quickly as it would if the affidavit 

26
described a single drug transaction at a location. Id. at 1265 (citing United 

States v. Diecidue, 603 F.2d 535, 560 (5th Cir. 1979) (four-month-old 

information about bullets in floors and walls of searched location not stale)). 

“Residency in a house, like protracted and continuous criminal activity or 

projectiles embedded in the house's walls and floors, generally is not 

transitory or ephemeral, but instead endures for some length of time.” 

Bervaldi, 226 F.3d at 1265.

In this case, the affidavit gave information that the appellant had lived a 

particular location for several years. That location, as described in the 

affidavit, was not an apartment or vacation rental, but a single-family 

suburban home. (Def.’s Ex. 1 at 1). Given those facts, the State believes that 

whatever probable cause to believe that the appellant lived at this address in 

August had not become stale by the time the warrant issued four months later.

As for the information regarding the child pornography itself, the 

affidavit in this case stated that those who download child pornography tend 

to collect it and hold it as “prized possessions,” and tend to keep it even if they 

move or change computers. (Def.’s Ex. 1 at 12-13). When an affidavit contains 

such statements and details the ongoing possession of child pornography, the 

information will be “fresh,” for probable-cause purposes, for a lengthy period 

of time. See State v. Cotter, 360 S.W.3d 647, 654 (Tex. App.—Amarillo 2012, no 

27
pet.) (four months); Sanders v. State, 191 S.W.3d 272, 279 (Tex. App.—Waco 

2006, pet. ref’d) (seventeen months); United States v. Hay, 231 F.3d 630, 636 

(9th Cir. 2000) (six months); United States v. Morales-Aldahondo, 524 F.3d 115, 

119 (1st Cir. 2008) (forty-four months).

In sum, while the appellant may be correct that it might have been 

better for Lee to have updated some of his information sometime between 

August and December, it is not this Court’s role to determine what he should 

have done. The only question on appeal is whether what he did do provided 

the magistrate with a substantial basis for finding probable cause. The 

caselaw, both of this State and of the federal courts, indicates that the 

information Lee provided in his affidavit was still fresh enough to support a 

finding of probable cause.

28
Conclusion

The State respectfully submits that under the applicable standard of 

review the trial court was within its discretion to deny the motion to suppress,

and this Court should affirm that decision.

DEVON ANDERSON

District Attorney

Harris County, Texas

/s/ C.A. Morgan

CLINTON A. MORGAN

Assistant District Attorney

Harris County, Texas

1201 Franklin, Suite 600

Houston, Texas 77002-1923

(713) 755-5826

Texas Bar No. 24071454

29
Certificate of Compliance and Service

I certify that, according to Microsoft Word’s word counting function, the 

portion of this brief for which Rule of Appellate Procedure 9.4(i)(1) requires a 

word count contains 6,380 words.

I also certify that I have requested that efile.txcourts.gov electronically 

serve a copy of this brief to:

Sarah V. Wood

sarah.wood@pdo.hctx.net

/s/ C.A. Morgan

CLINTON A. MORGAN

Assistant District Attorney

Harris County, Texas

1201 Franklin, Suite 600

Houston, Texas 77002-1923

(713) 755-5826

Texas Bar No. 24071454

Date: April 20, 2015

30