State v. Gerard
State v. Gerard
Opinion
Defendant appeals an order denying his motion to suppress and judgments convicting him of six counts of third degree sexual exploitation of a minor. The trial court erred in basing its determination upon the good faith exception under North Carolina General Statute § 15A-974 but reached the correct result by denying the motion to suppress, since the search warrant application and affidavit provided sufficient information for the magistrate to make an independent and neutral determination that probable cause existed for the issuance of the warrant which led to the search of defendant's computer and discovery of child pornography. Therefore, we affirm.
I. Background
The background of this case was summarized by this Court in
State v. Gerard
,
was indicted on 7 June 2010 for six counts of third-degree sexual exploitation of a minor. Detective C.E. Perez ("Detective Perez"), of the Charlotte-Mecklenburg Police Department, obtained a search warrant on 14 April 2010 to conduct a search of Defendant's residence. Defendant filed a motion on 3 April 2013 to suppress evidence seized during the 14 April 2010 search of his residence.
This Court dismissed defendant's appeal because defendant had "failed to give notice of his intention to appeal[.]"
II. Motion to Suppress
Defendant first contends that "the trial court erred in denying Mr. Gerard's motion to suppress on the ground that probable cause existed to issue a search warrant." (Original in all caps.) Relying primarily on North Carolina General Statutes §§ 15A-244 and 245, defendant argues that the information in the affidavit supporting the search warrant application did not include sufficiently detailed facts and circumstances to support a determination that probable cause existed for issuance of the warrant.
In ruling upon a motion to suppress evidence, the trial court must set forth in the record its findings of fact and conclusions of law. The general rule is that the trial court should make findings of fact to show the bases of its ruling. The standard of review in evaluating the denial of a motion to suppress is whether competent evidence supports the trial court's findings of fact and whether the findings of fact support the conclusions of law. Conclusions of law are reviewed de novo .
State v. McCrary
,
Defendant does not challenge the trial court's findings of fact. The State has not presented any proposed issue challenging any of the trial court's findings of fact as an alternative basis under North Carolina Rule of Appellate Procedure 10(c) to affirm the ruling, although the State does note
that the trial court's finding of fact [27] regarding the sufficiency of the information set forth in the warrant ... is more termed a conclusion of law, and appears to conflict with its actual finding of fact regarding a reasonable reading as a whole of the facts set forth in the affidavit.
(Quotation marks and footnote omitted)).
The trial court's first 17 findings of fact set forth in detail Detective Perez's extensive training and experience as a police officer and certified computer forensics examiner; a description of the Operation Peer Precision internet operation to identify child pornography; how SHA1 values are used to identify child pornography files on the internet; how Detective Perez identified the particular IP address as sharing known child pornography files; his download and review of some of the images and comparisons of SHA1 values to confirm that the files were child pornography; his identification of the address to which the IP address was registered; and his preparation of the search warrant application. Many of the details in findings of fact 1-17 were based upon Detective Perez's testimony.
The remaining findings of fact essentially explain where Detective Perez's affidavit was lacking as compared to his testimony:
18. The search warrant application and affidavit of probable cause presented to the magistrate on April 14, 2010, had significantly less detailed information than the foregoing 17 Findings of Fact. The application did name the officer applying for the warrant and the items to be seized. It described the premises to be searched and gave an address for the premises. The application suggests that the search will produce evidence of the crime of third-degree sexual exploitation of a minor as defined in N.C.G.S. 14-190.17A. The basic requirements for applying for the warrant are met.
19. The probable-cause affidavit did not describe Detective Perez's training and experience as a certified computer forensics examiner or even his basic training as a police officer.
*595 20. The affidavit never defines "known child pornography" or use[s] the statutory language set forth in N.C.G.S. 14-190.17A.
21. The affidavit does not indicate that Detective Perez used Peer Spectre and GnuWatch to identify the seventeen files as child pornography. The affidavit never says that Perez actually opened any of the seventeen files and looked at the images or data. Nor does it describe any of the data or images in the seventeen files.
22. The affidavit does not name the seventeen files or their SHA 1 values. It does not say the detective actually compared the SHA 1 values of the IP address to known child pornography and that they were an exact match. The affidavit also fails to explain why SHA value comparison is reliable in cyber investigations.
23. The affidavit does not contain any facts to explain the source of Detective Perez's knowledge relating to the SHA values of previously identified child pornography.
24. However, upon reviewing the affidavit as a whole, a reasonable conclusion can be drawn that the way in which Detective Perez knew that the files contained known child pornography was by an SHA value comparison of the SHA values of "previously identified child pornography" and the SHA values of the 17 files on Defendant's computer that were alleged child pornography.
25. The affidavit goes on to explain that based upon the Detective's training and experience, he knows that those who have Internet access often possess computers and other devices capable of storing electronic media.
26. There is no evidence on the face of the application for the search warrant that the magistrate sought additional information from Detective Perez or that he provided any information other than what appears on the face of the document.
Because neither party has challenged any of these findings of fact, even if we tend to disagree with the trial court's description of portions of the affidavit, we must accept the findings of fact as true.
See
Alexvale Furniture v. Alexander & Alexander
,
27. The Court finds that there was insufficient information in the warrant application and the Detective's affidavit from which the magistrate could make an independent and neutral determination that probable cause existed for the issuance of a warrant. However, the Detective acted in good faith when he and other officers executed the warrant.
Because the last "finding of fact" is actually a conclusion of law, we will review it accordingly.
Westmoreland v. High Point Healthcare, Inc.
,
We must therefore consider de novo whether the trial court properly concluded, based upon its findings of fact, that the search warrant application and affidavit did not present sufficient information "from which the magistrate could make an independent and neutral determination that probable cause existed for the issuance of a warrant."
See
McCrary
,
In so doing, we note that the parties do not challenge the superior court's findings of fact. Therefore, the scope of our inquiry is limited to the superior court's conclusions of law, which are fully reviewable on appeal.
As this Court acknowledged in State v. Beam , when addressing whether a search warrant is supported by probable cause, a reviewing court must consider the totality of the circumstances. In applying the totality of the circumstances test, this Court has stated that an affidavit is sufficient if it establishes reasonable cause to believe that the proposed search probably will reveal the presence upon the described premises of the items sought and that those items will aid in the apprehension or conviction of the offender. Probable cause does not mean actual and positive cause nor import absolute certainty. Thus, under the totality of the circumstances test, a reviewing court must determine "whether the evidence as a whole provides a substantial basis for concluding that probable cause exists.
In adhering to this standard of review, we are cognizant that great deference should be paid a magistrate's determination of probable cause and that after-the-fact scrutiny should not take the form of a de novo review. We are also mindful that:
A grudging or negative attitude by reviewing courts toward warrants is inconsistent with the Fourth Amendment's strong preference for searches conducted pursuant to a warrant; courts should not invalidate warrants by interpreting affidavits in a hypertechnical, rather than a commonsense, manner. The resolution of doubtful or marginal cases in this area should be largely determined by the preference to be accorded to warrants.
Most importantly, we note that a magistrate is entitled to draw reasonable inferences from the material supplied to him by an applicant for a warrant. To that end, it is well settled that whether probable cause has been established is based on factual and practical considerations of everyday life on which reasonable and prudent persons, not legal technicians, act. Probable cause is a flexible, common-sense standard. It does not demand any showing that such a belief be correct or more likely true than false. A practical, nontechnical probability is all that is required.
State v. Sinapi
,
Defendant insists that Detective Perez's affidavit did not contain sufficient information for a magistrate to determine there was probable cause, and the trial court agreed, as it concluded that "there was insufficient information in the warrant application and the Detective's affidavit from which the magistrate could make an independent and neutral determination that probable cause existed for the issuance of a warrant." The State argues that "the warrant application was sufficient for both probable cause, and thus-under the proper standard of deference-to support the magistrate's issuance of the warrant under the statute."
The trial court was correct that Detective Perez's testimony was more detailed than his affidavit, and the additional information makes the existence of probable cause entirely clear, but the fact that Detective Perez gave such detailed testimony about his law enforcement experience and the forensic computer investigations of transmissions of child pornography over the internet does not make his affidavit insufficient. The trial court sets the bar a bit too high by requiring such extensive and detailed information in a search warrant affidavit.
*597
21. The affidavit does not indicate that Detective Perez used Peer Spectre and GnuWatch to identify the seventeen files as child pornography. The affidavit never says that Perez actually opened any of the seventeen files and looked at the images or data. Nor does it describe any of the data or images in the seventeen files.
22. The affidavit does not name the seventeen files or their SHA 1 values. It does not say the detective actually compared the SHA 1 values of the IP address to known child pornography and that they were an exact match. The affidavit also fails to explain why SHA value comparison is reliable in cyber investigations.
23. The affidavit does not contain any facts to explain the source of Detective Perez's knowledge relating to the SHA values of previously identified child pornography.
Yet in some findings which the trial court relied upon in finding good faith, the trial court recognized the common-sense interpretation of the affidavit:
24. However, upon reviewing the affidavit as a whole, a reasonable conclusion can be drawn that the way in which Detective Perez knew that the files contained known child pornography was by an SHA value comparison of the SHA values of "previously identified child pornography" and the SHA values of the 17 files on Defendant's computer that were alleged child pornography.
25. The affidavit goes on to explain that based upon the Detective's training and experience, he knows that those who have Internet access often possess computers and other devices capable of storing electronic media.
Since the SHA1 values are defined and described in detail in the affidavit itself, it is obvious from the affidavit how Detective Perez identified the images as child pornography, even without the more detailed technical information provided by his testimony. The magistrate was "entitled to draw reasonable inferences from the material supplied to him by" Detective Perez, and considering the affidavit in light of "factual and practical considerations of everyday life on which reasonable and prudent persons" act,
The trial court also concluded that "the warrant affidavit was 'purely conclusory' in stating that probable cause existed." In support of this conclusion, defendant relies primarily upon
State v. Campbell,
The Supreme Court noted that
Nowhere in the affidavit is there any statement that narcotic drugs were ever possessed or sold in or about the dwelling to be searched. Nowhere in the affidavit are *598 any underlying circumstances detailed from which the magistrate could reasonably conclude that the proposed search would reveal the presence of illegal drugs in the dwelling. The inference the State seeks to draw from the contents of this affidavit-that narcotic drugs are illegally possessed on the described premises-does not reasonably arise from the facts alleged. Therefore, nothing in the foregoing affidavit affords a reasonable basis upon which the issuing magistrate could conclude that any illegal possession or sale of narcotic drugs had occurred, or was occurring, on the premises to be searched.
Id. at 131,
The affidavit here is much more detailed than the one in
Campbell
, and it does describe the "underlying circumstances upon which [Detective Perez's] belief is based[.]"
Id. at 130-31,
for a judicial official to make an independent determination about whether the images are likely child pornography, the judicial official probably must either view the images or receive a detailed description of the images that allows the judicial official to reach an independent conclusion about the content of the images. A statement from the applicant that the images "are child pornography" is most likely insufficient, as it does not provide factual information that the judicial official can use to determine probable cause....
28. Based on the description as set out in the warrant application, it would be impossible for a reasonable law enforcement officer to determine that any of the files viewed by Det. Perez on December 3, 2009 were actually child pornography. Det. Perez did not include images, videos, or any other files that could have been viewed by the magistrate in order to make a determination of probable cause.
Essentially, defendant argues that identifying the alleged pornographic images as known child pornography based upon the computer information is not enough-the pictures themselves should be provided with the affidavit. The trial court's finding suggest as much, since the trial court found as one of the affidavit's deficiencies that it "never says that Perez actually opened any of the seventeen files and looked at the images or data. Nor does it describe any of the data or images in the seventeen files."
They say that a picture is worth a thousand words, and it is true that attaching copies of the allegedly pornographic images to the affidavit might make the existence of probable cause immediately obvious. But this affidavit described the alleged child pornography using methods developed by law enforcement agencies to track known images transmitted over the internet, without further harm to the children victimized by the creators and consumers of the pornography by republishing the images. 1 Pictures which fall within the legal definition of child pornography can be difficult to describe, as Justice Stewart of the United States Supreme Court explained,
I imply no criticism of the Court, which in those cases was faced with the task of trying to define what may be indefinable . I have reached the conclusion, which I think is confirmed at least by negative implication in the Court's decisions since Roth and Alberts, that under the First and Fourteenth Amendments criminal laws in this area are constitutionally limited to hard-core pornography. I shall not today attempt further to define the kinds of material I understand to be embraced within that shorthand description; and perhaps I *599 could never succeed in intelligibly doing so. But I know it when I see it ....
Jacobellis v. Ohio
,
The affidavit included detailed definitions of several technical terms as used in the affidavit, including "internet," "IP Address," "online," "peer-2-peer networks," "SHA1," and "Gnutella." Detective Perez averred that the Charlotte Mecklenburg Police Department Cyber Crime Unit had conducted an internet operation "and identified a computer at IP address 174.96.87.196 as actively participating in the receipt and/or distribution of known child pornography." " 'Known' child pornography is an image that has been presented to the National Center for Missing and Exploited Children and the person in the image has actually been identified and determined to be a child." Detective Perez was able to identify the images as "known child pornography" by the SHA1 values of the images. The affidavit defined SHA1 as an algorithm
developed by the National Institute of Standards and Technology (NIST), along with the National Security Agency (NSA), for use with the Digital Signature Standard (DSS) as specified within the Secure Hash Standard (SHS). The United States of America has adopted the SHA-1 hash algorithm described herein as a Federal Information Processing Standard. Basically the SHA1 is an algorithm for computing a condensed representation of a message or data file like a fingerprint.
As Detective Perez averred, the IP address "was utilizing a peer to peer file sharing program identified as 'Limewire' to access and share the files, and that at least 17 files out of the 100 files that were being shared from the computer located at IP address 174.96.87.196 were previously identified as known child pornography." The affidavit noted that "Detective Perez was able to establish a direct connection to the" specific IP address, which was later identified by Time Warner Cable as assigned to John Doe at 123 Main Street in Charlotte. 2 Using the SHA1 information to identify the known images of child pornography eliminated the need to attach copies of the images to the affidavit or to present them to the magistrate. Including copies of the images themselves would further perpetuate the very harm the statutes regarding child pornography were intended to prevent.
Although it appears North Carolina's appellate courts have not addressed how detailed the information regarding child pornography in a search warrant affidavit should be, we find the analysis of similar cases by several federal courts instructive. The Court of Appeals for the Fourth Circuit addressed a similar case in
United States v. Wellman
,
the search warrant authorizing the search of his home was defective, because the warrant application failed to include either an exemplar or a description of an image alleged to be child pornography. He contends that in the absence of such information, the application merely contained the officers' conclusions that the material sought constituted child pornography. According to Wellman , this defect in the warrant application precluded the reviewing judge from making an independent probable cause determination.
We decline to impose a requirement that a search warrant application involving *600 child pornography must include an image of the alleged pornography. While the inclusion of such material certainly would aid in the probable cause determination, we do not impose a fixed requirement or a bright-line rule, because law enforcement officers legitimately may choose to include a variety of information when submitting a search warrant application. Instead, when considering the merits of a judicial officer's probable cause determination, we will review a search warrant application in its entirety to determine whether the application provided sufficient information to support the issuance of the warrant.
Other courts have also addressed the use of SHA1 values in search warrants to identify child pornography which is being transmitted over the internet. Traditional physical searches of papers are entirely different from the digital methods used to identify information transmitted over the internet, not just in investigations of pornography but in many types of investigations:
Hashing is a powerful and pervasive technique used in nearly every examination of seized digital media. The concept behind hashing is quite elegant: take a large amount of data, such as a file or all the bits on a hard drive, and use a complex mathematical algorithm to generate a relatively compact numerical identifier (the hash value) unique to that data. Examiners use hash values throughout the forensics process, from acquiring the data, through analysis, and even into legal proceedings. Hash algorithms are used to confirm that when a copy of data is made, the original is unaltered and the copy is identical, bit-for-bit. That is, hashing is employed to confirm that data analysis does not alter the evidence itself. Examiners also use hash values to weed out files that are of no interest in the investigation, such as operating system files, and to identify files of particular interest.
It is clear that hashing has become an important fixture in forensic examinations.
Richard P. Salgado , Fourth Amendment Search and the Power of the Hash, 119 Harvard Law Review Forum 38, 38 (2006). 3
Overall, courts and judges-who are usually not conversant with the details of digital technology-seem to struggle a bit with reconciling prior cases which addressed searches of paper-and-ink documents or tangible objects such as drugs and weapons with the most recent methods of digital transmission of documents and the highly specialized methods which law enforcement uses to conduct investigations of this sort, but this type of internet investigation has been addressed in some cases:
Here, the magistrate found that the application and affidavit: (1) described a method of communication known as peer-to-peer (P2P) computer file sharing using the worldwide Internet; (2) described how individuals wishing to share child pornography use the P2P method to share and trade digital files containing images of child pornography; (3) described Agent Morral's experience and training in computer usage and investigation of child pornography cases; (4) incorporated details of an investigation by Agent Cecchini who accessed a P2P file designated LimeWire and conducted a search looking for users accessing known child pornography sites; (5) stated that an IP address traced to Stults was identified as accessing child pornography sites; and (6) recounted that shared files from Stults's computer were downloaded and reviewed and were identified as containing numerous images of child pornography.
U.S. v. Stults
,
professional background; describes the general protocol investigating officers use to identify distributors of child pornography, including how officers usually determine that a computer at a given IP address has transferred a video with a particular SHA value; and states that Leazenby "learned" that a computer with the relevant IP address had shared videos with child-pornography-related SHA values. His affidavit, however, does not identify: (1) who informed Leazenby that a computer with the relevant IP address had transferred child pornography; or (2) the method used in this case to establish that a computer at the specified IP address transferred videos with child-pornography-associated SHA values.
But here, the affidavit does identify how Detective Perez determined that the "computer with the relevant IP address[,]"
The trial court also concluded that "[t]he 'good faith' exception applies in this case and therefore the evidence will not be suppressed." Defendant argues that the trial court erred in finding the good faith exception applicable, but we need not address this argument since we have determined that the trial court erred in its conclusion that the affidavit was not sufficient to support a determination of probable cause. While the trial court's reliance on good faith was misplaced, it ultimately came to the correct determination in denying defendant's motion to suppress, and therefore, we affirm the order.
See
Shore v. Brown
,
III. Conclusion
Because we have determined probable cause was established in the search warrant application and affidavit, we need not address *602 defendant's argument regarding good faith. Although the trial court erred in relying upon good faith as the basis for denial of defendant's motion to suppress, since the affidavit was sufficient to support the magistrate's determination of probable cause for issuance of the search warrant, we affirm.
AFFIRMED.
Judges ELMORE and DIETZ concur.
We also note that even if a photograph were attached or described in graphic detail, the magistrate would have no way to determine whether the person depicted is a real person or a computer-generated image or the person's age. The photographs identified by SHA1, "a mathematical algorithm fingerprint of a computer file[,]" as described in the affidavit, have been "previously identified [as] child pornography[.]"
We have used a pseudonym for the name of the owner of the house in which defendant resided and a false address to protect the identity and safety of the homeowner and other residents of the home.
As of 23 August 2016, available at http://federalevidence.com/pdf/2013/02Feb/EE4thAmSearch-Power% 20of% 20Hash.pdf.
Case-law data current through December 31, 2025. Source: CourtListener bulk data.