Opinion ID: 612581
Heading Depth: 5
Heading Rank: 1

Heading: Materiality as to the Search Warrants

Text: [10] While there is no “numerically precise degree of certainty corresponding to probable cause, . . . it is clear that only the probability, and not a prima facie showing, of criminal activity is the standard of probable cause.” Illinois v. Gates, 462 U.S. 213, 235 (1983) (citing Spinelli v. United States, 393 U.S. 410, 419 (1969)) (internal quotation marks omitted). The Supreme Court has declined to articulate a “neat set of legal rules” for evaluating probable cause, id. at 232, and instead has instructed magistrate judges to determine probable cause by considering the “totality-of-the-circumstances,” id. at 230. In issuing a search warrant, the magistrate judge simply must determine whether there is a “fair probability” that evidence of a crime will be found. Id. at 238, 246. [11] Our probable cause analysis is guided by United States v. Gourde, 440 F.3d 1065 (9th Cir. 2006) (en banc), a recent case involving the search of a criminal defendant’s computer for images of child pornography. In Gourde, we held that three key pieces of evidence, considered together, were sufficient to establish probable cause to believe Gourde’s computer contained images of child pornography: (1) that the accessed website “was a child pornography site whose primary content was in the form of images”; (2) that as a subscriber to the website, “Gourde had access and wanted access to these illegal images”; and (3) that “[h]aving paid for multi-month access to a child pornography site,” and owing to the “long memory of computers,” Gourde’s computer was likely to contain evidence of a crime. Id. at 1070-71. In other words, we looked for evidence in the affidavit: (1) that a crime was committed; (2) that it was Gourde who committed the crime; and (3) that evidence of the crime would be found in the place to be searched. In light of this “triad of solid facts,” we concluded that “the reasonable inference that CHISM v. WASHINGTON STATE 16325 Gourde had received or downloaded [child pornographic] images easily meets the ‘fair probability’ test.” Id. at 1071. We use this framework to determine whether Gardner’s affidavit would have supported probable cause if it had presented a truthful description of the evidence she collected during her investigation of Todd Chism. [12] Like the website at issue in Gourde, the parties do not dispute that the qem and foel websites here contained images of child pornography. Therefore, Gardner’s affidavit meets the first prong of the Gourde inquiry: it presents evidence that a crime was committed. We also assume without deciding that Gardner’s affidavit satisfied the third prong of the Gourde framework by presenting evidence that a computer used to upload child pornographic images would contain evidence of a crime.11 The remaining prong of the Gourde inquiry requires us to consider whether a truthful version of Gardner’s affidavit would have provided a “fair probability” that Todd Chism committed a crime. [13] A truthful version of Gardner’s affidavit would have indicated that the sole evidence connecting Todd Chism to the child pornographic images was the fact that the credit card he shared with Nicole was charged three times for hosting the websites that contained child pornographic images. This connection is a far cry from the facts presented in the affidavit, which stated that Todd “downloaded” and “purchase[d]” child pornography.12 A supplemented version of Gardner’s affidavit 11 Specifically, Gardner’s affidavit stated that “in [her] experiences and from [her] conversations with computer forensic examiners, computer evidence can remain stored on computers for extended periods of time,” and can be recovered from a computer even if it is deleted by the user.” The affidavit also stated that “[p]ersons involved in sending or receiving child pornography tend to retain it for long periods of time.” The Chisms do not challenge these assertions. 12 The Dissent downplays the significance of the affidavit’s misstatements. We agree with the Dissent that the affidavit’s use of the word 16326 CHISM v. WASHINGTON STATE also would have informed the magistrate judge that the IP addresses used to register the websites were traced to people other than the Chisms, and that the Yahoo! user accounts associated with the websites contained nonsensical identifying information. In considering all of the information available to the officers, we do not think it sufficient to establish a fair probability that evidence of a crime would be found at the Chisms’ home or Todd Chism’s office. [14] We find it particularly significant that the IP addresses from which the qem and foel websites were created were traced to internet subscribers hundreds of miles away from the Chisms’ home in Nine Mile Falls, Washington. We have explained that a computer that is connected to the internet can be uniquely identified by its IP number, much like a land-line phone can be uniquely identified by its phone number. See Forrester, 512 F.3d at 510 n.5. Moreover, we have repeatedly recognized the utility of using IP address information to investigate child pornography offenders. See United States v. Craighead, 539 F.3d 1073, 1080-81 (9th Cir. 2008) (holding that probable cause existed where the IP address from which child pornographic images were shared was traced to the defendant); United States v. Hay, 231 F.3d 630, 634-35 (9th Cir. 2000) (holding that an affidavit demonstrated probable cause where the agent carefully detailed how the IP address associated with the child pornographic images was connected to the defendant). Our sister circuits take the same approach. “downloaded” instead of “uploaded” is not material because evidence that Todd Chism had uploaded images of child pornography—if such evidence had existed—would have been just as damaging as evidence that he downloaded child pornography. See Revised Code of Washington 9.68A.050-9.68A.070 (prohibiting possessing, disseminating, and sending child pornography). The problem with the affidavit is not that it uses the word “downloaded” instead of “uploaded,” but rather, that it improperly states that Todd Chism was the perpetrator. As we have explained, this error was significant because there was no evidence that Todd Chism had ever accessed either of the offending websites. CHISM v. WASHINGTON STATE 16327 See, e.g., United States v. Vosburgh, 602 F.3d 512, 526-27 (3d Cir. 2010) (“[S]everal Courts of Appeals have held that evidence that the user of a computer employing a particular IP address possessed or transmitted child pornography can support a search warrant for the physical premises linked to that IP address.”) (footnote omitted); United States v. Stults, 575 F.3d 834, 843-44 (8th Cir. 2009); United States v. Perrine, 518 F.3d 1196, 1205-06 (10th Cir. 2008); United States v. Perez, 484 F.3d 735, 738-40 (5th Cir. 2007); United States v. Wagers, 452 F.3d 534, 539 (6th Cir. 2006)); Hay, 231 F.3d at 635-36; see also United States v. Bynum, 604 F.3d 161, 165 (4th Cir. 2010). [15] Here, the IP address associated with child pornographic images led to locations different from the locations to be searched, and the affidavit did not establish a physical link between the illegal images and the locations to be searched.13 Several inferences would have to be drawn in order to conclude that Todd violated Washington’s laws against child pornography. First, one would have to infer that Todd had used his wife’s name rather than his own to pay the hosting fees for the sites. One would also have to infer that Todd devised a way to access the foel and qem websites with a forged IP address. Finally, one would have to infer from the previous two inferences that Todd was the person who uploaded the child pornographic images from his computer to the websites at an unknown time, date, and location. This convoluted string of inferences reduces the possibility that child pornography 13 We disagree with the Dissent that Gourde is factually indistinguishable from this case. In Gourde, we noted that the FBI was able to “link[ ] the email user—‘gilbert95@yahoo.com,’ a known subscriber to [a child pornographic website]—to Gourde and to his home address in Castle Rock, Washington.” 440 F.3d at 1071. We did not specify in Gourde whether the FBI used IP address information to link the user information to Gourde, nor did any of the evidence in Gourde raise the specter of identity theft. In contrast to Gourde, several pieces of evidence in this case suggested that Todd Chism was not connected to the child pornographic images. 16328 CHISM v. WASHINGTON STATE would be found at Todd Chism’s home and office to far below a “fair probability.” See United States v. Weber, 923 F.2d 1338, 1345 (9th Cir. 1990) (explaining that “with each succeeding inference, the last reached is less and less likely to be true.”).14 Our conclusion also finds support in the WSP’s training materials, which explain: Much, if not all, of the cyber-evidence (the E-mail addresses and IP addresses used) will lead you to an innocent person. That’s why simply identifying which account was used to commit a crime does not provide you with probable cause to get a search or arrest warrant for the name and address on that account. You’ll need to do more investigating to determine if there is a link between the account holder (or other members of the household) with the criminal activity that was committed with that account. The affidavit submitted by Marcus Lawson, the president of a computer forensic company that examined Todd Chism’s computers similarly admonishes: [T]o have any success as an Internet criminal, regardless of whether one was a thief, a hacker or a child pornography collector, it would be incumbent to use other people’s identities to do so. . . . It is primarily for this reason that relying only on informa14 The Dissent argues that “the lack of a match between the IP addresses used for registration and the Chisms’ IP address has no probative value.” Dissent at 16339. We disagree. Where, unlike here, a person’s IP address is used to upload or download child pornography, there is a direct link between that person’s physical location and evidence of a crime. When this direct link is absent, at least one, if not several, additional inferences are necessary to conclude that evidence of a crime will be found at the location to be searched. CHISM v. WASHINGTON STATE 16329 tion provided by the user of a credit card that is associated with criminal activity is inherently unreliable. (emphasis added). [16] We are mindful that “[a] letter-perfect affidavit is not essential.” United States v. Esparza, 546 F.2d 841, 844 (9th Cir. 1976). In this case, however, we do not believe that a reasonable magistrate judge would have issued the search war- rant if she had been apprised of an accurate version of the evidence. We therefore hold that the affidavit’s false statements and omissions were material to the probable cause determination for the search warrants.