Opinion ID: 6327348
Heading Depth: 3
Heading Rank: 1

Heading: Nexus between the scheme and the place to be

Text: searched “A warrant must be supported by probable cause— meaning a ‘fair probability that contraband or evidence of a crime will be found in a particular place based on the totality of circumstances.’” United States v. King, 985 F.3d 702, 707 (9th Cir. 2021) (quoting United States v. Diaz, 491 F.3d 1074, 1078 (9th Cir. 2007)). The magistrate’s probable cause determination “should be paid great deference by reviewing courts.” Id. (quoting Illinois v. Gates, 462 U.S. 213, 236 (1983)). Review “is limited to ensuring that the 6 Kvashuk also challenges the search of his car, but the only evidence from the car introduced at trial was Kvashuk’s employee badge. Since it was undisputed that Kvashuk worked at Microsoft, and the evidence had no other significance, any error from the district court’s refusal to suppress it was harmless beyond a reasonable doubt. See United States v. Job, 871 F.3d 852, 865 (9th Cir. 2017). UNITED STATES V. KVASHUK 13 magistrate had a ‘substantial basis’ for concluding that probable cause existed.” Id. at 708 (quoting Gates, 462 U.S. at 238). Kvashuk does not dispute that there was probable cause to suspect him of crimes in connection with the stolen CSV. Rather, he argues that the warrant affidavit failed to “establish a nexus between the unlawful activities and the places to be searched.” It is true that “[p]robable cause to believe that a suspect has committed a crime is not by itself adequate to secure a search warrant for the suspect’s home.” United States v. Ramos, 923 F.2d 1346, 1351 (9th Cir. 1991), overruled on other grounds by United States v. Ruiz, 257 F.3d 1030, 1032 (9th Cir. 2001) (en banc). But “the nexus between the items to be seized and the place to be searched” can rest on “normal inferences as to where a criminal would be likely to hide” evidence of his crimes. United States v. Spearman, 532 F.2d 132, 133 (9th Cir. 1976) (per curiam) (quoting United States v. Lucarz, 430 F.2d 1051, 1055 (9th Cir. 1970)). While we have not directly addressed the nexus issue, our cases confirm that the nature of cybercrime— specifically, its reliance on computers and personal electronic devices—is relevant to probable cause for searching the suspect’s residence. See United States v. Adjani, 452 F.3d 1140, 1145 (9th Cir. 2006) (holding that evidence of the suspect’s “extortion scheme . . . requiring the use of a computer” justified a search warrant for any computers found at the suspect’s home); United States v. Gourde, 440 F.3d 1065, 1071 (9th Cir. 2006) (en banc) (holding that evidence the suspect maintained membership in a website with child pornography supported search of the computer at his residence); see also United States v. Green, 14 UNITED STATES V. KVASHUK 954 F.3d 1119, 1123 (8th Cir. 2020); United States v. Jones, 942 F.3d 634, 639–40 (4th Cir. 2019); Peffer v. Stephens, 880 F.3d 256, 272–73 (6th Cir. 2018); United States v. Joubert, 778 F.3d 247, 252–53 (1st Cir. 2015); United States v. Watzman, 486 F.3d 1004, 1007–08 (7th Cir. 2007). Here, the warrant affidavit explained in detail how Kvashuk committed the suspected crimes “almost entirely via digital devices.” Such devices “were used to access . . . Microsoft’s online store, set up and access email accounts, conduct online research in furtherance of the scheme, purchase and redeem CSV, communicate with one or more tax preparers, and conduct bitcoin transactions.” The affidavit also pointed out that “many people generally keep their cell phones and other digital devices . . . in their home” and provided extensive evidence that Kvashuk did so here. For example, the affidavit noted that (1) Kvashuk was a software engineer; (2) his house had internet service; (3) the IP address assigned to his house was used in 2018 and 2019 to access his Coinbase and Gmail accounts, both of which were involved in his scheme; 7 (4) he emailed his tax preparer 7 To the extent Kvashuk maintains that the search of his Gmail account lacked probable cause because he did not use it to purchase or redeem tokens, we disagree. In December 2017, Kvashuk accessed the Universal Store from an account linked to his Gmail account at least nine times, and accessed his Coinbase account once, from various IP addresses later used by the test accounts to steal CSV. Although other Microsoft employees used the same IP addresses, which belonged to a commercial VPN, Kvashuk was specifically linked to the stolen CSV transactions through the fuzzy device ID used to access his v-vokvas, pikimajado, and xidijenizo accounts. Moreover, Coinbase records showed communications with Kvashuk’s Gmail account. The IRS agent who prepared the affidavit attested that such communications “may be evidence of financial transactions conducted using the proceeds of the fraud, and therefore be evidence of money laundering.” And there was UNITED STATES V. KVASHUK 15 in February 2019 regarding the preparation of his false 2018 return; and (5) based on the affiant’s training and experience, “people often keep personal, financial, and tax records in their home,” including Bitcoin private keys (essentially, passwords necessary to control their Bitcoin). All of this evidence, taken together, was enough to reasonably establish a nexus between the digital devices to be seized and Kvashuk’s home. Kvashuk argues that “it is chronologically impossible for the theft at issue to be committed by way of a digital device inside the [lakefront] house” given that Microsoft disabled the test accounts before he moved there in April 2018. But this is irrelevant. “[P]robable cause to believe that a person conducts illegal activities in the place where he is to be searched is not necessary; the proper inquiry is whether there was probable cause to believe that evidence of illegal activity would be found in the search.” United States v. Elliott, 322 F.3d 710, 716 (9th Cir. 2003). The affidavit contained evidence that the house had internet service and that the IP address associated with the house was used to access Kvashuk’s Gmail and Coinbase accounts. It was thus reasonable for the magistrate to infer that Kvashuk brought his digital devices with him— including those used to perpetrate the theft—when he moved from the apartment to the house. See United States v. Richardson, 607 F.3d 357, 371 (4th Cir. 2010) (rejecting contention that “that there must be some ‘specific’ allegation that [the suspect] . . . was using the same computer at the new residence”). Moreover, Kvashuk’s use of the test accounts to order digital gift cards was only the first step of a clear pattern of deposits into Kvashuk’s Coinbase account that followed redemption of the stolen CSV. 16 UNITED STATES V. KVASHUK his scheme, which continued until he transferred the proceeds from his Coinbase account into his Wells Fargo bank account. According to the affidavit, Kvashuk continued making these transfers through May 2018. Considering “the totality of [the] circumstances,” King, 985 F.3d at 707 (quoting Diaz, 491 F.3d at 1078), the search warrant affidavit shows a fair probability that evidence of Kvashuk’s crimes would be found on a computer at his residence. Therefore, there was an adequate nexus between the unlawful activities and the place to be searched.