Aguilar is a Soldier stationed at Ft. Campbell, Kentucky; but this case was not handled by the military, rather the State took the case since the crime occurred off-post, in Clarksville Tennessee. It is a typical peer-to-peer case, and the appellate issues are predictable, however the affidavit and subsequent trial testimony by the Investigator is exceptional and for that reason it warrants discussion here as a case to be emulated. Additionally (though not specifically covered in this synopsis) the trial testimony of the digital forensic examiner (covered in the appellate opinion) is a great education for those prosecutors not familiar with how the examination process works.
Facts: In January 2011, an ICAC Investigator was conducting a proactive investigation on the gnutella network and came across appellant’s computer, which had videos and images of suspected child pornography for sharing. The Investigator downloaded three images and confirmed the SHA-1 hash for each. The Investigator obtained the IP address for the computer sharing the files. AT&T was the Internet Service Provider for this IP address. Based on these images a subpoena was served on AT&T which provided the name of appellant as well as his address. The Investigator also did a real estate search, which showed that appellant was the owner of the house where the IP address was assigned. Additionally a Drivers License check revealed that appellant claimed that particular address. After this information was obtained and verified, a search warrant was requested before a magistrate.
Attack on the Search Warrant on Probable Cause Grounds: Appellant contends that the affidavit, which the search warrant was based upon did contain enough facts to establish probable cause. A trial court’s factual findings on a motion to suppress are conclusive on appeal unless the evidence preponderates against them. State v. Binette, 33 S.W.3d 215, 217 (Tenn.2000); State v. Odom, 928 S.W.2d 18, 23 (Tenn.1996). When the defendant seeks suppression of evidence on the basis of a defective search warrant, he bears the burden of establishing, by a preponderance of the evidence, “the existence of a constitutional or statutory defect in the search warrant or the search conducted pursuant to the warrant.” State v. Henning, 975 S.W.2d 290, 298 (Tenn.1998).
In this case, Investigator Cereceres submitted a 27–page affidavit in support of his application for a warrant to search the defendant’s residence. In that affidavit, Investigator Cereceres detailed his extensive training and experience in the investigation of internet crimes against children. He then provided a “glossary of terms” to familiarize the magistrate with the terminology used in this area of investigation and to define and explain each of these terms. Included in this glossary were definitions and explanations for the following terms: internet service provider, internet, IP address, Gnutella Network, peer-to-peer file sharing, Limewire, and SHA 1 Hash. Investigator Cereceres explained that peer-to-peer file sharing software “is designed to allow users to trade files through a worldwide network that is formed by linking computers together.” He noted that he knew “from training and experience that peer to peer networks are frequently used in the receipt and distribution of child pornography ” and that the “Gnutella” network in particular “is being used to trade digital files, including still image and movie files, of child pornography.” He explained the process for searching and downloading files within the peer-to-peer network. Investigator Cereceres also provided background information on the use of the internet to traffic in child pornography as well as the common behaviors of the users and traffickers of child pornography. He provided significant detail in the area of child pornography trafficking via peer-to-peer file sharing, how such file sharing is routinely monitored by law enforcement personnel, and how child pornography files are identified within the file sharing networks. Investigator Cereceres observed that seizure of all computers and related electronic media is generally necessary to perform a thorough search for child pornography files. He explained that “the search of computers and retrieval of data from computer systems and related media, often require agents to seize all electronic storage devices (along with related peripherals) to be searched later by a qualified computer expert in a laboratory or other controlled environment.”
There was also an attempt at a staleness issue here (19 days between observation and application of warrant). That issue did not go far. Not only did the court find that appellant waived the issue (by not arguing it at trial), but that case law supports that this type of evidence is typically hoarded, and even if the material is deleted it can still be accessed by a trained examiner. United States v. Estey, 595 F.3d 836, 840 (8th Cir.2010) (citing United States v. Horn, 187 F.3d 781, 786–87 (8th Cir1999) (holding that warrant not stale three or four months after child pornography information was developed).
Practitioner Notes: This is a good example of why we spend so much time working on our affidavits. While page length isn’t necessarily dispositive, the more information the better in these types of cases. We should never assume that a magistrate has any knowledge of these types of cases or this type of technology. When the facts don’t look good for the Defendant, they will always go for the low-hanging fruit (read: Search Warrant).