Hugo D. Pachas-Luna v. State

ACCEPTED 01-14-00516-CR FIRST COURT OF APPEALS HOUSTON, TEXAS

Nos. 01-14-00516-CR, 01-14-00517-CR, 01-14-00518-CR 4/20/2015 10:16:35 AM CHRISTOPHER PRINE

01-14-00519-CR, 01-14-00520-CR CLERK

In the Court of Appeals FILED IN For the 1st COURT OF APPEALS HOUSTON, TEXAS First District of Texas 4/20/2015 10:16:35 AM At Houston CHRISTOPHER A. PRINE ♦ Clerk

Nos. 1370904, 1370905, 1370906, 1370907, 1370908 In the 230th District Court Of Harris County, Texas ♦ HUGO PACHAS-LUNA Appellant v. THE STATE OF TEXAS Appellee ♦ State’s Appellate Brief ♦

DEVON ANDERSON District Attorney Harris County, Texas

STEPHEN DRIVER KATHRYN KAHLE Assistant District Attorneys Harris County, Texas

CLINTON A. MORGAN Assistant District Attorney Harris County, Texas State Bar No. 24071454 morgan_clinton@dao.hctx.net

1201 Franklin, Suite 600 Houston, Texas 77002 Tel: (713) 755-5826 FAX: (713) 755-5809

Counsel for the Appellee

Oral Argument Not Requested

Statement Regarding Oral Argument

The appellant requested oral argument, though he gave no particular reason why. The State believes the briefs in this case adequately apprise this Court of the issues and the law, and any marginal benefit from oral argument does not justify the considerable amount of time that preparation for oral argument requires of the parties and the Court. Therefore, the State does not request oral argument.

i

Identification of the Parties Counsel for the State:

Devon Anderson  District Attorney of Harris County

Stephen Driver & Kathryn Kahle — Assistant District Attorneys at trial

Clinton A. Morgan  Assistant District Attorney on appeal

Appellant:

Hugo Pachas-Luna Counsel for the Appellant:

Connie Williams — Counsel at trial

Alexander Bunin & Sarah V. Wood — Counsel on appeal

Trial Judge:

Brad Hart  Presiding judge

ii

Table of Contents

Page

Statement Regarding Oral Argument .......................................................... i Identification of the Parties ........................................................................ ii Table of Contents .......................................................................................... iii Index of Authorities ....................................................................................... v Statement of the Case ................................................................................... 1 Statement of Facts ......................................................................................... 1 Reply to the Appellant’s Sole Point of Error Most of the appellant’s complaints are minor or completely meritless. His one legitimate complaint — the possible discrepancy between when the IP address was sharing child pornography and when the IP address was connected to the appellant — is unpreserved, and a matter of first impression that this Court should refrain from addressing. Given the deferential standard of review in warrant cases, this Court should defer to the magistrate’s determination of probable cause. ................................................... 2 I. Appellate courts review warrant affidavits by reading them in a common-sense manner, and giving deference to both the trial court and the issuing magistrate. ....................................................................................................... 2 II. A fair reading of the affidavit shows that it is not nearly so bad as the appellant makes it seem.................................................................................................... 4 A. Corporal Lee’s Background Knowledge ........................................................ 5 1. Lee’s Training ......................................................................................................... 5 2. Lee’s Knowledge of Peer-to-Peer Networks .............................................. 6 3. Lee’s Software, and “Hash Values”................................................................. 7 B. This Investigation ................................................................................................... 8 1. The Child Pornography Files............................................................................ 8 2. Connecting the IP to the Appellant ............................................................ 10 3. “People who have a sexual interest in children …” .............................. 12

iii

III. All but one of the appellant’s complaints are without merit, and on that issue there is a sufficient basis in the affidavit that the trial court’s ruling was not an abuse of discretion. ..................................................................... 12 A. The name of the online database was not necessary to show probable cause............................................................................................................... 12 B. Lee adequately described his investigative software........................... 14 C. The missing verb is apparent from context clues. ................................. 15 D. The affidavit elsewhere describes in detail some of the child pornography found on the suspect IP address, thus whether the phrase “labeled as child notables” was “conclusory and uncredited” is irrelevant, as it was not necessary for the probable-cause determination. ............................................................................................................... 17 E. There was information regarding only one IP address; the “different” IP address mentioned in the affidavit was obviously a typo, as the trial court determined................................................................................... 18 F. The appellant’s sole legitimate complaint — regarding the imprecise connection between the suspect IP address and the appellant’s residence — is unpreserved. If this Court addresses it, it is a question of first impression and this Court should defer to the inferences drawn by the magistrate and the trial court. ............................. 20 G. The appellant’s complaint about Lee’s “method” of comparing hash values is irrelevant. ...................................................................................................... 23 H. The information in the affidavit connecting child pornography to the appellant’s residence was not stale. ............................................................. 25 Conclusion .................................................................................................... 29 Certificate of Compliance and Service ..................................................... 30

iv

Index of Authorities

Cases Barrett v. State 367 S.W.3d 919 (Tex. App.— Amarillo 2012, no pet.) ....................................................................................................... 21 Champion v. State 919 S.W.2d 816 (Tex. App.— Houston [14th Dist.] 1996, pet. ref’d) ................................................................... 16, 19 Gardner v. State 433 S.W.3d 93 (Tex. App.— Houston [1st Dist.] 2014, pet. ref’d).............................................................................. 22 Hereford v. State 339 S.W.3d 111 (Tex. Crim. App. 2011) .......................................................................... 4 Illinois v. Gates 462 U.S. 213 (1983) ................................................................................................................. 3 Pair v. State 184 S.W.3d 329 (Tex. App.— Fort Worth 2006, no pet.) .................................................................................................. 24 Reyes v. State 02-11-00327-CR, 2013 WL 1338023 (Tex. App.— Fort Worth Apr. 4, 2013, no pet.) (mem. op. not designated for publication) ................................................................. 16 Rodriguez v. State 232 S.W.3d 55 (Tex. Crim. App. 2007) .......................................................................... 23 Rothstein v. State 267 S.W.3d 366 (Tex. App.— Houston [14th Dist.] 2008, pet. ref’d) ................................................................. passim Sanders v. State 191 S.W.3d 272 (Tex. App.— Waco 2006, pet. ref’d) ......................................................................................................... 28

v

Serrano v. State 123 S.W.3d 53 (Tex. App.— Austin 2003, pet. ref’d) .......................................................................................................... 3 State v. Cotter 360 S.W.3d 647 (Tex. App.— Amarillo 2012, no pet.) ....................................................................................................... 28 State v. Delagarza 158 S.W.3d 25 (Tex. App.— Austin 2005, no pet.)............................................................................................................... 3 State v. Jordan 342 S.W.3d 565 (Tex. Crim. App. 2011) .......................................................................... 3 Tucker v. State 369 S.W.3d 179 (Tex. Crim. App. 2012) .......................................................................... 4 United States v. Bervaldi 226 F.3d 1256 (11th Cir. 2000)................................................................................. 26, 27 United States v. Diecidue 603 F.2d 535 (5th Cir. 1979) ............................................................................................. 27 United States v. Hay 231 F.3d 630 (9th Cir. 2000) ............................................................................................. 28 United States v. Morales-Aldahondo 524 F.3d 115 (1st Cir. 2008).............................................................................................. 28 United States v. Vosburgh 602 F.3d 512 (3d Cir. 2010)............................................................................................... 21

vi

Statement of the Case

The appellant was charged in five indictments with different charges of possession of child pornography. (1 CR 13; 2 CR 13; 3 CR 13; 4 CR 13; 5 CR 13).1 The appellant waived his right to a jury trial and pled not guilty to the trial court. (2 RR 4-8). The trial court found him guilty as charged. (4 RR 130-31). After a pre-sentence investigation, the trial court assessed punishment for each case at eight years’ confinement, with the sentences to run consecutively. (5 RR 18; 1 CR 87-88; 2 CR 88-89; 3 CR 88-89; 4 RR 86-87; 5 RR 80-81). The appellant filed timely notices of appeal and the trial court certified his right of appeal. (1 CR 92, 94).

Statement of Facts

A Harris County Precinct Four Constable’s Deputy conducted an investigation into online child-pornography file sharing and discovered a computer sharing child pornography from an internet account associated with the appellant. (Def.’s Ex. 1). The deputy obtained a warrant for the appellant’s house, and when the warrant was served police found numerous hard drives

1 The State will refer to the clerk’s records in the different causes as though they were sequential volumes. Thus the record for 01-14-00516- CR will be 1 CR, the record for 01- 14-00517-CR will be 2 CR, and so on, in numerical order. If the same document appears in all the records, the State will cite to the copy in 1 CR.

containing, in total, more than 18,000 images and videos of child pornography, including the four images and one video for which he was charged in this case. (4 RR 103-16).

Reply to the Appellant’s Sole Point of Error

Most of the appellant’s complaints are minor or completely meritless. His one legitimate complaint — the possible discrepancy between when the IP address was sharing child pornography and when the IP address was connected to the appellant — is unpreserved, and a matter of first impression that this Court should refrain from addressing. Given the deferential standard of review in warrant cases, this Court should defer to the magistrate’s determination of probable cause.

The appellant filed a pre-trial motion to suppress alleging, inter alia, that the warrant affidavit in this case did not contain probable cause to believe contraband would be found in the appellant’s home, thus the evidence was obtained illegally. (1 CR 79-81). The trial court held a hearing on the motion to suppress at the beginning of the appellant’s bench trial and denied the motion. (3 RR 129-31). In his sole point of error, the appellant claims that the trial court erred in denying his motion to suppress.

I. Appellate courts review warrant affidavits by reading them in a common-sense manner, and giving deference to both the trial court and the issuing magistrate.

Probable cause exists if, under the totality of the circumstances set forth in the affidavit before the magistrate, there is a fair probability that *3 contraband or evidence of a crime will be found in a particular place at the time the warrant is issued. State v. Jordan, 342 S.W.3d 565, 568-69 (Tex. Crim. App. 2011). The magistrate may interpret the affidavit in a non-technical, common-sense manner and may draw reasonable inferences from the facts and circumstances contained within its four corners. Id. at 569.

When reviewing whether a warrant should have issued, courts — whether at the trial or appellate level — are not to determine whether there actually was probable cause. State v. Delagarza, 158 S.W.3d 25, 29 (Tex. App.— Austin 2005, no pet.). The test at the trial court is: considering the totality of the circumstances before the issuing magistrate, was there a substantial basis to believe that probable cause existed. Ibid.; Illinois v. Gates, 462 U.S. 213, 268 (1983). On appellate review, then, the appropriate test is: did the trial court abuse its discretion in finding that the magistrate had a substantial basis to believe that probable cause existed. “The resolution of doubtful or marginal cases should largely be determined by the preference to be accorded to warrants.” Delagarza, 158 S.W.3d at 29. On appeal, the sufficiency of a warrant affidavit is generally determined by looking at the affidavit itself, without regard to extrinsic evidence. Serrano v. State, 123 S.W.3d 53, 58 (Tex. App.— Austin 2003, pet. ref’d).

In reviewing a trial court’s ruling on a motion to suppress, appellate courts give almost total deference to the trial court’s factual determinations, even when those determinations are based on affidavit, but review de novo the trial court’s application of the law of search and seizure. Tucker v. State, 369 S.W.3d 179, 184 (Tex. Crim. App. 2012). The record should be viewed in the light most favorable to the trial court’s decision, and the trial court’s decision should be upheld so long as it is reasonable in light of the record. Hereford v. State, 339 S.W.3d 111, 18 (Tex. Crim. App. 2011).

II. A fair reading of the affidavit shows that it is not nearly so bad as the appellant makes it seem.

In his brief, the appellant engages in a persnickety reading of certain sections of the affidavit. He focuses, at times, on what the affidavit does not say rather than what it does. He seems befuddled by certain phrases in the affidavit that are explained clearly enough in other parts. And he demands descriptions and definitions of ordinary notions that any magistrate of common intelligence would have understood.

The State will grant that Corporal Lee is unlikely to be nominated for any literary prizes based on this affidavit, but appellate review is not about critiquing stylistic and typographical errors. Rather, this Court is to examine the whole document and determine whether it was reasonable for the trial *5 court to conclude that the affidavit gave the issuing magistrate a substantial basis to find probable cause that there would be evidence of a crime at the searched address. What follows is an attempt to read through the affidavit for its relevant parts and to place them in the order that makes the most sense.

A. Corporal Lee’s Background Knowledge

1. Lee’s Training

The affidavit begins with the qualifications of the affiant. (Def.’s Ex. 1 at 4-5). Corporal Jeffrey Lee is employed as a peace officer by the Harris County Precinct Four Constable, and he has been a law enforcement officer for more than a decade. “[H]is duties include the investigation of technologically advanced offenses including … Child Pornography.” (Def’s. Ex. 1 at 4). He is certified “in Basic Cybercrime Investigation.”

Lee has spoken with others in the law enforcement community who know about the ways of those who trade and collect child pornography. Moreover, he “has been personally involved in the investigation, arrest, and prosecution of numerous persons involved in child sexual exploitation.” (Def’s Ex. 1 at 4). Lee is a member of the Houston Metro Internet Crimes Against Children Task Force, a federally funded initiative.

2. Lee’s Knowledge of Peer-to-Peer Networks

Through his training and experience, Lee is aware that “the trade of child pornography through the internet is extensive and one of the main methods of distribution for this type of contraband.” (Def.’s Ex. 1 at 4). Lee is aware that the use of peer-to-peer (P2P) networks is “one of the most pervasive methods for the distribution of child pornography through the internet.” (Def.’s Ex. 1 at 4). Lee knows that P2P file sharing is accomplished by downloading software and listing certain files and folders as being “shared,” and then those files and folders are indexed by an “ultra-peer,” through which other users can search the shared files and folders and select which ones to download. (Def.’s Ex. 1 at 5). Once a user chooses to download a file from another user, those computers are then connected through an internet protocol (IP) address. (Def.’s Ex. 1 at 5). The sending and receiving computers record each others’ IP addresses in order to facilitate the file sharing. (Def.’s Ex. 1 at 5).

An IP address is “a unique four-byte number assigned to a computer when that computer accesses the Internet.” (Def.’s Ex. 1 at 17). Every computer on the internet has an IP address that is assigned to it by its internet service provider when it logs on. (Def.’s Ex. 1 at 17). An IP address “is unique in the sense that no two users can have the exact same IP address at the same *7 time.” (Def.’s Ex. 1 at 17). Internet service providers generally keep records that allow them to know which subscriber was using a particular IP address at a particular time. (Def.’s Ex. 1 at 8-9, 17).

3. Lee’s Software, and “Hash Values”

Lee has received “specialized training” for the investigation of P2P networks using “a specialized program developed to allow investigators to access a variety of [P2P] networks.” (Def.’s Ex. 1 at 5). Lee “is trained and licensed to use this software.” (Def.’s Ex. 1 at 5). The software allows investigators to “search the variety of networks for digital material from users connecting to the [P2P] Networks and download files that the users ‘share’ with the network…” (Def.’s Ex. 1 at 5).

The software allows investigators to narrow their searches in a couple of ways. One way is that they can narrow their searches so that they only return results from specified geographic areas, “such as Harris County, the City of Houston, or City of Pasadena.” (Def.’s Ex. 1 at 5).

The second way in which this software allows investigators to limit their searches is that the software can be set to return results for “confirmed images of child pornography.” (Def.’s Ex. 1 at 5). It does this through the use of “hash values.” All digital files can be processed through a Secure Hash Algorithm to *8 produce an identifying hash value that will be the same for any two duplicate files, but which will be different if the files differ in any way. (Def.’s Ex. 1 at 7). Lee knows that by comparing the hash value of two files, he can determine whether two files are identical “with a precision that greatly exceeds 99.9999 percent certainty.” (Def.’s Ex. 1 at 7). Because of how hash values are produced, “there has never been a documented occurrence of two different files being found on the Internet having different contents while sharing the same [hash] value.” (Def.’s Ex. 1 at 7).

Lee’s investigative software uses hash values to limit its search. The software can take the hash values of files that have been determined to be child pornography and return search results only from computers that are sharing known child pornography. (Def.’s Ex. 1 at 5). Lee is aware that through the use of this software and of the methods in which has been trained, “hundreds of [P2P] cases have been successfully investigated throughout the United States.” (Def.’s Ex. 1 at 6).

B. This Investigation

1. The Child Pornography Files

On August 9, 2012, Lee conducted an investigation using an “online database.” (Def.’s Ex. 1 at 6). “The software allows licensed investigators to *9 track [IP addresses] in order to determine specifically what the individual or computer has downloaded over a specific … time frame.” (Def.’s Ex. 1 at 6). That afternoon, Lee conducted a search limited to Harris County and discovered that IP address 98.194.180.10 was sharing 2 more than twenty files that were “child notables,” meaning that “they are files that have been observed by other law enforcement officers as being ‘child pornography.’” (Def.’s Ex. 1 at 6). That computer was sharing “numerous other files” that “had titles which were indicative of child porn.” (Def.’s Ex. 1 at 6). Lee conducted additional checks of this IP address, and it repeatedly showed up as sharing what appeared to be child pornography.3 (Def.’s Ex. 1 at 6).

2 As the appellant correctly notes in his brief, this portion of the affidavit is missing a verb. The affidavit states that Lee “located IP address 98.194.180.106 which several unique files….” (Def.’s Ex. 1 at 6). The appellant believes this renders the affidavit incomprehensible. (See Appellant’s Brief at 21-22). However, later in the same paragraph of the affidavit, Lee states that a later search of the IP address showed that it “continued to have files within its share folder and those files all have files which are indicative of being child pornographic and nature ….” (Def.’s Ex. 1 at 6). Using context clues, it is apparent that the missing verb must be “was sharing” or something similar.

3 As the appellant also correctly notes, in a single instance the affidavit specifies an IP address that differs by one numeral from the other references to an IP address in the affidavit. In three instances the affidavit refers to IP 98.194.180.106; it once, however, refers to 98.194.180.196. (Def.’s Ex. 1 at 6-7). From the context clues this must be regarded as a typographical error. The affidavit refers to an “additional check” of IP address 98.194.180.196, and states that this “additional check” shows that the IP address “continue[d]” to share child pornography, when the only check previously mentioned in the affidavit was of IP 98.194.180.106. (Def.’s Ex. 1 at 6). Additionally, the affidavit states that Lee requested information from Comcast “based upon the dates and times the IP address was seen downloading” child pornography, indicating that Lee meant to refer only to a single IP address in the affidavit. The State’s appellate counsel will also note that the numerals 9 and 0 are directly next to each other on a standard keyboard.

Lee then took the hash values of the files that were being shared from this IP address and asked other investigators whether they had seen files with those hash values. (Def.’s Ex. 1 at 7). Lee knows this method of matching files “has proven to be extremely reliable,” and he has used hash values to match “thousands of files and has never found two files with different contents but the same” hash value. (Def.’s Ex. 1 at 7). On August 17, 2012, Lee procured from other investigators copies of three video files that matched the hash values of files being shared by the suspect IP address. (Def.’s Ex. 1 at 7-8). One involved a girl between the ages of 5 and 8 being raped; the second involved four girls between 11 and 14 engaging in sex with each other and with the male cameraman; the third involved a girl between the ages of 13 and 16 engaging in oral and vaginal sex with a male. (Def.’s Ex. 1 at 8).

2. Connecting the IP to the Appellant

Lee knows that “absent fraud or intentional deception, an [IP] address is an accurate method to find the method of internet connection for an individual accessing the internet.” (Def.’s Ex. 1 at 8). Internet service providers “keep accurate records that can be traced back to specific accounts if the [service providers] are provided with accurate dates and times of [internet] use.” (Def.’s Ex. 1 at 9).

After identifying the suspect IP address as being from a block of IP addresses used by Comcast, Lee sent a grand jury subpoena to Comcast requesting information regarding “the subscriber assigned to that IP address, based upon … the dates and time the IP address was seen downloading what are believed to be child pornographic images or videos.” (Def.’s Ex. 1 at 6). On August 20, 2012, Lee received a response from Comcast. It stated that on April 4, 2012, at 8:57 pm, and on August 5, 2012 at 8:42 pm, IP address 98.194.180.106 was being used by an the appellant’s account, the address for which was 18107 Fairhope Oak Street, Houston. (Def.’s Ex. 1 at 7). The account was created on August 7, 2009, and was still active at the time of the grand jury subpoena. (Def.’s Ex. 1 at 7).

When Lee ran an additional check on the IP address on December 7, 2012 using his investigative software, he saw that the IP address had been active on one P2P network for roughly a year predating the investigation, from August 27, 2011 through September 3, 2012. (Def.’s Ex. 1 at 6). While using that network, the IP address had been seen using software with two Globally Unique Identifiers (GUIDs). (Def.’s Ex. 1 at 6). While it is possible for a computer’s IP address to change, the GUIDs used by a particular program will remain the same unless the program is updated or uninstalled. (Def.’s Ex. 1 at 6).

3. “People who have a sexual interest in children …”

Based on his training and experience, Lee believes the individual at 18107 Fairhope Oak Street who was downloading and sharing child pornography had “a sexual interest in children.” (Def.’s Ex. 1 at 12). Lee is aware of several characteristics of such individuals. They “often collect sexually explicit materials … depicting children, which they use for their own sexual gratification and fantasy. (Def.’s Ex. 1 at 12). They “rarely, if ever, dispose of their sexually explicit materials … and those materials are treated as prized possessions.” (Def.’s Ex. 1 at 12-13).

III. All but one of the appellant’s complaints are without merit, and on that issue there is a sufficient basis in the affidavit that the trial court’s ruling was not an abuse of discretion.

The appellant raises eight specific complaints about the warrant in his brief. The State will address them one by one.

A. The name of the online database was not necessary to show probable cause.

In his first complaint, the appellant points out that the “online database” mentioned once in the affidavit is not named in the affidavit. (Appellant’s Brief at 16-17). This observation is true, as far as it goes.

The State’s first response is that this argument is not preserved because it was not presented to the trial court either in the appellant’s motion to suppress (1 CR 79-81) or in his arguments to the trial court (3 RR 83-88). See Rothstein v. State, 267 S.W.3d 366, 373 (Tex. App.—Houston [14th Dist.] 2008, pet. ref’d) (where defendant filed generic motion to suppress and presented certain specific arguments to trial court, other specific arguments not presented to trial court were not preserved).

Second, the appellant gives away the insignificance of this point when he notes that, aside from a single insubstantial reference, “this online database … is not mentioned or described anywhere else in the voluminous affidavit ….” (Appellant’s Brief at 16). The appellant is correct. All of the evidence connecting the appellant to the child pornography was discovered using the investigative software described by Lee; the importance of the “online database” and its relation to the software are not obvious from the affidavit. If this Court were to completely disregard anything in the affidavit relating to an online database, it would not affect the quantum of evidence present to support probable cause.

B. Lee adequately described his investigative software.

The appellant next complains that the software used by Lee “is Not Credited within the Affidavit.” (Appellant’s Brief at 17-20). The appellant seems confused by the fact that the affidavit describes two types of software. First, the affidavit gives a description of the sort of software commonly used for P2P sharing. (Def.’s Ex. 1 at 4-5). Later, the affidavit describes the investigative software for which Lee has received specialized training and that was used in the investigation of this case. (Def.’s Ex. 1 at 5-6).

First, this matter was not raised in the appellant’s motion to suppress or in his arguments to the trial court, thus, on abuse-of-discretion review, it should play no role in this Court’s decision. Rothstein, 267 S.W.3d at 373.

On the merits, though, the State does not believe the affidavit is confusing in the least on this point. In its discussion of P2P file sharing, the affidavit mentions the publicly-available software, stating that Lee “learned that computer users can choose to install publicly available software that facilitates the trading of images.” (Def.’s Ex. 1 at 5). Later, the affidavit states that Lee “has received specialized training regarding the investigations of [P2P] Networks in which a specialized software program developed to allow investigators to access a variety of [P2P] Networks is used.” (Def.’s Ex. 1 at 5). The affidavit then states that Lee “is trained and licensed to use this software”; *15 this is followed by further descriptions of the capabilities of “this software.” (Def.’s Ex. 1 at 5-6). There is no indication anywhere in the affidavit that Lee used any “software” other than the investigative software he described with some detail.

Perhaps the affidavit could have been clearer had Lee used the specific name of his investigative software, but, in light of Lee’s descriptions of its capabilities, the name of the program would neither add to nor detract from its reliability.

C. The missing verb is apparent from context clues.

The third complaint raised by the appellant is that there is a missing verb in one sentence: “Your Affiant located IP address 98.194.180.106 which several unique files, over twenty of them being labeled as child notables, meaning they are files that have been observed by other law enforcement officers as being ‘child pornography.’” (Def.’s Ex. 1 at 6). According to the appellant, it is “impossible” to determine the meaning of this sentence. (Appellant’s Brief at 21).

This matter was not raised in the appellant’s motion to suppress or at the trial court. That indicates two things: First, neither trial counsel nor the trial court had any apparent difficulty deciphering the meaning of this *16 sentence; second, the matter is not preserved for this Court’s review. Rothstein, 267 S.W.3d at 373.

The appellant’s failure to raise this matter in the trial court has further significance, because, while the sufficiency of an affidavit is normally determined by what is contained within its four corners, a typographical error in an affidavit can be explained through testimony at a motion-to-suppress hearing. See Champion v. State, 919 S.W.2d 816, 818 (Tex. App.—Houston [14th Dist.] 1996, pet. ref’d) (citing Green v. State, 799 S.W.2d 756, 760 (Tex. Crim. App. 1990)); see also Reyes v. State, 02-11-00327-CR, 2013 WL 1338023, at *3 (Tex. App.—Fort Worth Apr. 4, 2013, no pet.) (mem. op. not designated for publication) (collecting cases). Had the appellant raised this matter in the trial court, the parties could have questioned Lee as to what the missing word was.

As a final note on this point, as the State observed in Footnote 2 of this brief, the context in which this sentence occurs makes apparent that the missing verb was “was sharing” or something similar. Two sentences later the affidavit notes that “an additional check” of the IP address “show[ed] the IP has continued to have files within its shared folders and those files all have files [sic.] which are indicative of being child pornographic in nature. ….” (Def.’s Ex. 1 at 6). In this context (and, indeed, in the larger context of the affidavit *17 itself, which is seeking to establish probable cause that a particular IP address associated with the appellant was sharing child pornography), it would be passingly strange if the missing verb were something that did not indicate the suspected IP address was sharing child pornography.

D. The affidavit elsewhere describes in detail some of the child pornography found on the suspect IP address, thus whether the phrase “labeled as child notables” was “conclusory and uncredited” is irrelevant, as it was not necessary for the probable-cause determination.

The appellant’s next complaint is that the affidavit’s use of the phrase “labeled as child notables” “is conclusory and uncredited. (Appellant’s Brief at 22). The State’s first response, again, is that this complaint was not made either in the appellant’s motion to suppress or in his argument to the trial court, thus it should not factor into this Court’s determination of whether the trial court abused its discretion. Rothstein, 267 S.W.3d at 373.

Second, this part of the affidavit is merely describing the investigation and is not essential for determining probable cause. Later in the affidavit, Lee went into graphic detail regarding three of the files that were being shared by the suspected IP address, and that should be more than sufficient to show probable cause even if this Court disregards the “labeled-as-child-notables” line.

E. There was information regarding only one IP address; the “different” IP address mentioned in the affidavit was obviously a typo, as the trial court determined.

In his fifth complaint, the appellant notes that in three instances the affidavit refers to IP address 98.194.180.106, but in one instance in the middle of these references the affidavit refers to IP address 98.194.180.196. (Appellant’s Brief at 23-24). The appellant presented this argument at the motion-to-suppress hearing, and the trial court determined that the reference to 98.194.180.196 was a typo and should have read 98.194.180.106. (3 RR 93-94).

Lee testified at the hearing before the trial court, and while he did not explicitly state that the reference to 98.194.180.196 was a typo, it could easily be inferred from his testimony, from the nature of the questioning, and from the affidavit itself. Lee testified that in this case he investigated IP address 98.194.180.106. (3 RR 21). Throughout the hearing the parties questioned Lee about this IP address, and in seemingly every instance the questioning was phrased in the singular (i.e. the investigation involved only one IP address), and Lee responded, likewise, in the singular. (See, e.g., 3 RR 33 (Defense Counsel: “Is that the day you found out who the IP belonged to and what address it was coming from?” Lee: “That’s the date I found out that the IP address was assigned to that account.”)). Most tellingly, at one point the *19 prosecutor asked Lee “how many dates did you verify that child pornography was available for trade from that particular IP address you mentioned earlier,” and Lee responded: “Two days.” (3 RR 55). The affidavit mentions viewing child pornography on an IP address on two dates, but it refers to different IP addresses for each date. (Def.’s Ex. 1 at 6). Thus, Lee’s testimony that on two dates he viewed child pornography on the same IP address is, effectively, testimony that the reference to IP 98.194.180.196 was a typo.

The conclusion that the reference to 98.194.180.196 was a typo is also supported by the affidavit itself. When IP address 98.194.180.196 is mentioned, it follows a mention to a check performed on IP 98.194.180.106 and states that an “additional check” was performed on 98.194.180.196, which “continued to have” child pornography available for sharing. (Def.’s Ex. 1 at 6). Reading the reference to IP 98.194.180.196 as a typo makes sense of the paragraph. Reading it, as the appellant does, as a reference to a second IP address renders half the paragraph nonsensical. It is obvious from the surrounding context that this was a typo, and the trial court had testimony supporting its conclusion that it was a typo. See Champion, 919 S.W.2d at 818. This Court should defer to the trial court’s determination that this was a typo and not a wholly nonsensical paragraph.

F. The appellant’s sole legitimate complaint — regarding the imprecise connection between the suspect IP address and the appellant’s residence — is unpreserved. If this Court addresses it, it is a question of first impression and this Court should defer to the inferences drawn by the magistrate and the trial court.

The most serious problem with this affidavit is that it does not explicitly connect the appellant to the suspected IP address at the precise moments when the IP address was sharing child pornography. The appellant raises this matter in his brief. (See Appellant’s Brief at 25-29). At trial, however, the appellant’s only argument related to IP addresses was that the appellant’s IP address could have changed between the date that Lee subpoenaed Comcast and the date the warrant issued. (3 RR 86 (“[W]hat I’m getting to, this does not refer to the fact that at a certain time it belonged to him and necessarily belonged to him in December or in November.”), 92-93). That is a different (and irrelevant) issue. This Court should disregard this appellate complaint as unpreserved, particularly because the record shows that the trial court labored under an incorrect interpretation of the affidavit that could have been corrected had trial counsel pointed it out. See Rothstein, 267 S.W.3d at 373.

The appellant’s appellate complaint, though unpreserved, is well taken. Reading it in the light most favorable to the trial court’s findings, the affidavit states that Lee observed IP 98.194.180.106 sharing and/or downloading child *21 pornography on August 9, November 13, and December 7. (Def.’s Ex. 1 at 6). It then states that Lee subpoenaed Comcast regarding which subscriber was using that IP address “based upon … the dates and time the IP address was seen downloading what are believed to be child pornographic images or videos.” (Def.’s Ex. 1 at 6). Comcast responded to this subpoena stating that the suspect IP address was being used by the appellant at particular times on April 4 and August 5. (Def.’s Ex. 1 at 6).

Had the affidavit connected the IP address to the appellant’s account at the precise time the IP address was sharing or downloading child pornography, the caselaw is clear that this would have been adequate to establish probable cause. See, e.g., United States v. Vosburgh, 602 F.3d 512, 518, 527 (3d Cir. 2010) (so holding, and collecting cases). What is not clear, though, is how close in time the affidavit must connect the IP address to the suspect. The Texas cases the State can find have determined that probable cause existed if the IP address is “associated” with the suspect, or if it has been “assigned” to the suspect, but those cases have not specified whether the evidence showed that the IP address was “associated” with or “assigned” to the suspect at the precise moment illegal activity was observed. See, e.g., Barrett v. State, 367 S.W.3d 919, 923 (Tex. App.—Amarillo 2012, no pet.) (IP address “associated” with suspect); Gardner v. State, 433 S.W.3d 93, 100 (Tex. *22 App.—Houston [1st Dist.] 2014, pet. ref’d) (IP address “assigned to” suspect). The State can find no case, either in Texas or in the federal courts, where an affidavit connected the suspect to the offending IP address but not at the precise moment the illegal activity occurred, and the appellant has cited to no such case.

At the motion-to-suppress hearing, the trial court focused on the next paragraph of the affidavit, which stated that the appellant’s Comcast account “was created on 07/09/2009 and is currently active on [August 20, 2012].” (Def.’s Ex. 1 at 7). The trial court believed this meant that the appellant had had the same IP address for the entire period his account was active: “[T]he information in the search warrant that the officer got from the grand jury subpoena from Comcast shows that this IP address was created on July 9th of 2009 for this defendant at this address and remained with him at least up until the point of, I guess, August 9th of 2012.” (3 RR 89-90).

Nothing in the affidavit directly supports or refutes this belief. Trial counsel did not apprise the trial court that this belief was incorrect.

There is still a substantial basis in the affidavit for a magistrate to find that the appellant had the offending IP address at the time it was seen downloading and/or sharing child pornography. First, the affidavit states that Lee subpoenaed Comcast for subscriber information “based upon the dates *23 and time the IP address was seen downloading what are believed to be child pornographic images or videos.” (Def.’s Ex. 1 at 6). It is a fair inference from these facts that Lee had observed this IP address downloading child pornography on April 4 and August 5 but had not mentioned it explicitly in his affidavit.4 See Rodriguez v. State, 232 S.W.3d 55, 62 (Tex. Crim. App. 2007) (“The inquiry for reviewing courts, including the trial court, is whether there are sufficient facts, coupled with inferences from those facts, to establish a ‘fair probability’ that evidence of a particular crime will likely be found at a given location.”). Certainly this inference is at least as fair as inferring that Lee had subpoenaed information for relevant dates but Comcast had replied with more-or-less random information.

G. The appellant’s complaint about Lee’s “method” of comparing hash values is irrelevant.

In his brief, the appellant complains that Lee “did not use valid techniques to compare the hash values” of the files found on the appellant’s computer to known child pornography. (Appellant’s Brief at 29-31). In the trial court, most of the appellant’s arguments related to the hash value comparison. (3 RR 83-85, 87-88). 4 Lee testified to as much at the motion-to-suppress hearing. (3 RR 56).

The appellant’s complaint is both meritless and irrelevant. In his brief, the appellant bases his complaint on a statement in the affidavit where Lee states that his software “allows investigators to compare the digital hash values of the offered files to the hash values of known child pornography provided by the National Center for Missing and Exploited Children, which acts as a clearinghouse for images and videos of Child Pornography.” (Def.’s Ex. 1 at 6). From this statement, the appellant draws the conclusion that comparing hash values to images from the National Center for Missing and Exploited Children is the only appropriate method to determine from a file’s hash values if it contains child pornography. (Appellant’s Brief at 29-30). This conclusion has no basis in the affidavit and is facially absurd, as it suggests that no one other than the National Center for Missing and Exploited Children is capable of determining whether a file contains child pornography.

The affidavit clearly lays out Lee’s method in this case and his basis for believing it was reliable. He obtained the hash values of files that were being shared by the appellant’s computer. He then asked other law officers if they had seen files with those hash values. He obtained copies of three files that matched those hash values. See Pair v. State, 184 S.W.3d 329, 338 (Tex. App.— Fort Worth 2006, no pet.) (when law enforcement officer swears out affidavit and describes getting information from other officers, that information is *25 presumed credible). He stated that, to his knowledge, there have never been two files with the same hash values but different content. He also stated that he had personally matched up “thousands” of files by using their hash values. And he described in graphic detail the contents of the files that matched the hash values of the files the appellant was sharing. Nothing in the appellant’s brief undermines the validity of the hash-value comparison Lee performed in this case.

H. The information in the affidavit connecting child pornography to the appellant’s residence was not stale.

In his next complaint, the appellant points out that, while the affidavit connects the appellant and his internet account to 18107 Fairhope Oaks in August (via the subpoena return from Comcast), the affidavit was not sworn to until December 10, and nothing in the affidavit indicates that police did anything to confirm that the appellant was still living at the address in December. (Appellant’s Brief at 31-32). The appellant claims that this fourmonth gap in information renders the affidavit stale.

However, the affidavit, read in the light most favorable to the trial court’s ruling, includes information that the appellant had had this internet account at this address for more than three years at the time of the subpoena return. *26 (Def.’s Ex. 1 at 7). This is how the trial court interpreted the affidavit. (3 RR 89-90).

The State can find no Texas case describing how long information regarding an individual’s residence remains fresh enough to support a warrant for that residence, and the appellant does not cite to any. The State would direct this Court to the case of United States v. Bervaldi, 226 F.3d 1256 (11th Cir. 2000). That case dealt with the execution of an arrest warrant; the police executed an arrest warrant at a particular address on the basis of information that the suspect had lived there six months earlier. Bervaldi, 226 F3d 1265. On appeal, Bervaldi complained that the police did not have a “reasonable belief” — the standard required by the Supreme Court in order to allow police to serve an arrest warrant at a particular location — that he would be at that residence. Ibid.

The Eleventh Circuit began its analysis by recognizing that, while “reasonable belief” was a different standard than “probable cause,” the same general rules of staleness would apply to both situations. Ibid. The Bervaldi court compared the situation to cases where affidavits had described ongoing criminal activity at a location or bullets in the walls of a location and concluded that, because of the nature of what was described in the affidavit, probable cause did not dissipate as quickly as it would if the affidavit *27 described a single drug transaction at a location. Id. at 1265 (citing United States v. Diecidue, 603 F.2d 535, 560 (5th Cir. 1979) (four-month-old information about bullets in floors and walls of searched location not stale)). “Residency in a house, like protracted and continuous criminal activity or projectiles embedded in the house's walls and floors, generally is not transitory or ephemeral, but instead endures for some length of time.” Bervaldi, 226 F.3d at 1265.

In this case, the affidavit gave information that the appellant had lived a particular location for several years. That location, as described in the affidavit, was not an apartment or vacation rental, but a single-family suburban home. (Def.’s Ex. 1 at 1). Given those facts, the State believes that whatever probable cause to believe that the appellant lived at this address in August had not become stale by the time the warrant issued four months later.

As for the information regarding the child pornography itself, the affidavit in this case stated that those who download child pornography tend to collect it and hold it as “prized possessions,” and tend to keep it even if they move or change computers. (Def.’s Ex. 1 at 12-13). When an affidavit contains such statements and details the ongoing possession of child pornography, the information will be “fresh,” for probable-cause purposes, for a lengthy period of time. See State v. Cotter, 360 S.W.3d 647, 654 (Tex. App.—Amarillo 2012, no *28 pet.) (four months); Sanders v. State, 191 S.W.3d 272, 279 (Tex. App.—Waco 2006, pet. ref’d) (seventeen months); United States v. Hay, 231 F.3d 630, 636 (9th Cir. 2000) (six months); United States v. Morales-Aldahondo, 524 F.3d 115, 119 (1st Cir. 2008) (forty-four months).

In sum, while the appellant may be correct that it might have been better for Lee to have updated some of his information sometime between August and December, it is not this Court’s role to determine what he should have done. The only question on appeal is whether what he did do provided the magistrate with a substantial basis for finding probable cause. The caselaw, both of this State and of the federal courts, indicates that the information Lee provided in his affidavit was still fresh enough to support a finding of probable cause.

Conclusion

The State respectfully submits that under the applicable standard of review the trial court was within its discretion to deny the motion to suppress, and this Court should affirm that decision.

DEVON ANDERSON District Attorney Harris County, Texas

/s/ C.A. Morgan CLINTON A. MORGAN Assistant District Attorney Harris County, Texas 1201 Franklin, Suite 600 Houston, Texas 77002-1923 (713) 755-5826 Texas Bar No. 24071454

Certificate of Compliance and Service

I certify that, according to Microsoft Word’s word counting function, the portion of this brief for which Rule of Appellate Procedure 9.4(i)(1) requires a word count contains 6,380 words.

I also certify that I have requested that efile.txcourts.gov electronically serve a copy of this brief to:

Sarah V. Wood sarah.wood@pdo.hctx.net

/s/ C.A. Morgan CLINTON A. MORGAN Assistant District Attorney Harris County, Texas 1201 Franklin, Suite 600 Houston, Texas 77002-1923 (713) 755-5826 Texas Bar No. 24071454

Date: April 20, 2015