Internet Accounts and Probable Cause to Search a Home:
In the last few years, a number of courts have considered when and how information relating to an Internet account can create probable cause to search a home for evidence. In these cases, the police know that an Internet account was used in a particular way potentially related to criminal activity. The police then use that knowledge to get a warrant authorizing them to search a physical place for evidence of the crime.
The issue has come up most recently in a series of federal cases involving membership in child pornography-related groups. The basic fact pattern is that the government shuts down a listserv or business relating to child pornography, and manages to obtain a subscriber list of e-mail addresses. The feds then go to the ISP that hosts a particular e-mail address and get account records from the ISP, and particularly who signed up for the account and where they live. The feds then use this information to get probable cause for a warrant to search the suspect's home. The feds execute the search and find child pornography. The defendant then moves to suppress the evidence on the ground that the warrant did not provide probable cause to believe ex ante that the evidence would be located there.
So far, at least, courts have struggled with these cases. The Ninth Circuit recently voted to rehear en banc one such case, United States v. Gourde, and just today a Second Circuit panel in United States v. Coreas expressed its strong disagreement with a panel from two weeks ago on the same question. (Hat tip: AL&P.) Given the legal uncertainty on the question, I thought it might be interesting to explore why it is uncertain, as well as what the key analytical steps should be to resolve these questions.
The uncertainty is relatively easy to explain. Legal disputes about probable cause are about estimating the chances that fact B exists given known fact A. We make these estimates based on our human experience, common sense, and shared understandings. For example, imagine that a 5'3" man with a mask robs a bank, and then the next day a 5'3" man named Joe Smith brags to his coworkers in an office across town that he robbed a bank the day before, and produces five fresh $100 bills to prove it. Does this scenario create probable cause to search Smith's home for evidence? The question boils down to a series of inferences based on your own experience. How unusual is it for a man to be 5'3" or to have five fresh $100 bills? How likely is it that someone would brag about a crime but actually be uninvolved in it? How likely is it that a bank robber would store evidence at his home?.
For the most part, judges can address these questions because they have an intuitive sense of the answers. Most people recognize the key questions to ask, and have at least a vague sense of the answers. Cases involving Internet accounts are more difficult because judges generally don't have much experience with the technology. To most judges, there is this Internet thing out there, and people do stuff on that Internet thing, and they don't have much of a sense of how to go from fact A to inference B. (If there are any judges reading this, I should say that you are of course an exception; it's the other judges that I have in mind.)
So what are the key questions that a court should ask when determining whether use of an account to join a child pornography-related listserv creates probable cause search a home for evidence? Here is a somewhat oversimplifed list:
1) How likely is it that the defendant is the one who controlled the account when it was used to join the group? People can sign up for accounts using fake names and/or fake addresses. They also can use hacked accounts belonging to other people. As a result, judges can't simply assume that the defendant was the person who controlled the account.
2) How likely is it that the defendant signed up with the service with the intent to get illegal images? The law generally prohibits knowing receipt and possession; several courts have interpreted possession to require intentional reaching out to control images. We can quibble with the details of the substantive law, especially in the case of the precise meaning of "possession" of a digital file, but as a rule this means that a person who accidentally receives images of child pornography may not be guilty of an offense.
3) How likely is it that the defendant actually did receive images? The list or group may not have distributed contraband images during the period that the suspect was a mamber.
4) How likely is it that the defendant initially received the images in his home? In the past, it has been quite likely that people who are using the net to obtain contraband child pornography images are doing so from their home. This may be changing, though. For example, a person might drive across town, find an unsecured wireless network, and use that network to download the images straight on to their laptop.
5) And finally, how likely is it that the images are presently in the home? There is lots of caselaw on this question, actually. Several courts of appeals have noted that collectors of child pornography generally keep the images they obtain instead of deleting them. At the same time, there is always at least a possibility that an image present in the home one day may not be present in the home another day. Finally, it's worth noting that (depending on the specific language contained in the warrant) it may not be necessary to find the actual images. For example, if a suspect downloaded images one day and deleted them a month later, evidence showing that the defendant knowingly received the images on the first day could be stored on the defendant's computer even if the images themselves are not present.
Of course, how these questions play out depends on the facts of specific cases. Probable cause is necessarily a fact-specific inquiry, and it depends on an assessment of the likelihood in each individual warrant affidavit. At the very least, though, I think these are the key questions that the courts should be asking.
The issue has come up most recently in a series of federal cases involving membership in child pornography-related groups. The basic fact pattern is that the government shuts down a listserv or business relating to child pornography, and manages to obtain a subscriber list of e-mail addresses. The feds then go to the ISP that hosts a particular e-mail address and get account records from the ISP, and particularly who signed up for the account and where they live. The feds then use this information to get probable cause for a warrant to search the suspect's home. The feds execute the search and find child pornography. The defendant then moves to suppress the evidence on the ground that the warrant did not provide probable cause to believe ex ante that the evidence would be located there.
So far, at least, courts have struggled with these cases. The Ninth Circuit recently voted to rehear en banc one such case, United States v. Gourde, and just today a Second Circuit panel in United States v. Coreas expressed its strong disagreement with a panel from two weeks ago on the same question. (Hat tip: AL&P.) Given the legal uncertainty on the question, I thought it might be interesting to explore why it is uncertain, as well as what the key analytical steps should be to resolve these questions.
The uncertainty is relatively easy to explain. Legal disputes about probable cause are about estimating the chances that fact B exists given known fact A. We make these estimates based on our human experience, common sense, and shared understandings. For example, imagine that a 5'3" man with a mask robs a bank, and then the next day a 5'3" man named Joe Smith brags to his coworkers in an office across town that he robbed a bank the day before, and produces five fresh $100 bills to prove it. Does this scenario create probable cause to search Smith's home for evidence? The question boils down to a series of inferences based on your own experience. How unusual is it for a man to be 5'3" or to have five fresh $100 bills? How likely is it that someone would brag about a crime but actually be uninvolved in it? How likely is it that a bank robber would store evidence at his home?.
For the most part, judges can address these questions because they have an intuitive sense of the answers. Most people recognize the key questions to ask, and have at least a vague sense of the answers. Cases involving Internet accounts are more difficult because judges generally don't have much experience with the technology. To most judges, there is this Internet thing out there, and people do stuff on that Internet thing, and they don't have much of a sense of how to go from fact A to inference B. (If there are any judges reading this, I should say that you are of course an exception; it's the other judges that I have in mind.)
So what are the key questions that a court should ask when determining whether use of an account to join a child pornography-related listserv creates probable cause search a home for evidence? Here is a somewhat oversimplifed list:
1) How likely is it that the defendant is the one who controlled the account when it was used to join the group? People can sign up for accounts using fake names and/or fake addresses. They also can use hacked accounts belonging to other people. As a result, judges can't simply assume that the defendant was the person who controlled the account.
2) How likely is it that the defendant signed up with the service with the intent to get illegal images? The law generally prohibits knowing receipt and possession; several courts have interpreted possession to require intentional reaching out to control images. We can quibble with the details of the substantive law, especially in the case of the precise meaning of "possession" of a digital file, but as a rule this means that a person who accidentally receives images of child pornography may not be guilty of an offense.
3) How likely is it that the defendant actually did receive images? The list or group may not have distributed contraband images during the period that the suspect was a mamber.
4) How likely is it that the defendant initially received the images in his home? In the past, it has been quite likely that people who are using the net to obtain contraband child pornography images are doing so from their home. This may be changing, though. For example, a person might drive across town, find an unsecured wireless network, and use that network to download the images straight on to their laptop.
5) And finally, how likely is it that the images are presently in the home? There is lots of caselaw on this question, actually. Several courts of appeals have noted that collectors of child pornography generally keep the images they obtain instead of deleting them. At the same time, there is always at least a possibility that an image present in the home one day may not be present in the home another day. Finally, it's worth noting that (depending on the specific language contained in the warrant) it may not be necessary to find the actual images. For example, if a suspect downloaded images one day and deleted them a month later, evidence showing that the defendant knowingly received the images on the first day could be stored on the defendant's computer even if the images themselves are not present.
Of course, how these questions play out depends on the facts of specific cases. Probable cause is necessarily a fact-specific inquiry, and it depends on an assessment of the likelihood in each individual warrant affidavit. At the very least, though, I think these are the key questions that the courts should be asking.