State v. Helland

2005 SD 121 STATE OF SOUTH DAKOTA, Plaintiff and Appellant, v. CHARLES EDWIN HELLAND, Defendant and Appellee. No. 23705 Supreme Court of South Dakota. Considered On Briefs on October 3, 2005 Opinion Filed December 7, 2005 DAVID R. NELSON, Minnehaha County State's Attorney, HOPE OKERLUND MATCHAN, Chief Deputy State's Attorney, Minnehaha County, Sioux Falls, South Dakota, LAWRENCE E. LONG, Attorney General, SHERRI SUNDEM WALD, Assistant Attorney General, Pierre, South Dakota, Attorneys for plaintiff and appellant. MICHAEL J. BUTLER, Butler Law Office, P.C., Sioux Falls, South Dakota, Attorney for defendant and appellee. GILBERTSON, Chief Justice [¶1.] Charles Edwin Helland (Helland) filed a motion in circuit court to suppress evidence obtained in a search of his computer and office at his employer's place of business. The circuit court judge suppressed the evidence, holding the affidavit was misleading because of the omission of material information. We reverse. FACTS AND PROCEDURE [¶2.] On June 11, 2004, Kevin Elsing, vice-president of Elbo Computing Resources and a computer technician by trade, was called to service Helland's computer at his employer's place of business. Elsing noticed Helland minimized the computer screen when Elsing entered the office. When Elsing began working on the computer, he was able to see that the screen Helland had minimized was a web page dealing with people's first experience with incest. Elsing loaded antivirus[1] and antispyware[2] software on Helland's computer and concluded the service call. [¶3.] Elsing's next contact with Helland occurred on November 22, 2004, after receiving an email requesting service on Helland's computer. The email stated Helland's computer had lost access to the office network, was not printing properly and was not accessing Microsoft Word. Elsing arrived at Helland's office the morning of November 23, 2004, and began his work by updating the previously installed antivirus and antispyware software and removing spyware from the system. Elsing removed several spyware files from the system to determine if these files were the cause of the software errors. Elsing then began a scan of the system using a web-based scan engine called housecall.trendmicro.com. The scan was taking a long time to complete, and to speed up the process Elsing decided to delete the contents of the "temporary internet files" folders on Helland's computer. Elsing noticed that the deletion was taking a long time and the system did not seem to be deleting the temporary internet files as requested. Elsing then decided to look into the "temporary internet files" folders to see if files were being deleted. [¶4.] Upon opening the "temporary internet files" folders, Elsing found dozens of suggestive and suspicious graphic file names such as "hot boys" and "teen boys." Elsing opened some of these temporary internet files and found images of young nude males. Elsing noted that one image depicted two boys approximately eight to ten years of age, naked, sitting on the shore of a lake or stream, side by side, hands behind them, with their legs spread. Shocked and in disbelief about what he was seeing, Elsing began opening other files that contained similarly disturbing images. Fearing he was deleting the temporary internet files, Elsing stopped the deletion process and created a new folder called "older" and copied the index.dat[3] file and a few of the temporary internet files into this newly created folder. Elsing left without finishing the service call, but planned to return later that afternoon. [¶5.] Alarmed by what he saw, Elsing returned to Elbo Computing to discuss the details with his business partner. Elsing felt his discoveries might have triggered the provisions of SDCL 22-22-24.18,[4] the mandatory reporter statute that requires computer repair technicians to report suspected violations of child pornography laws. Ultimately, Elsing decided that the mandatory reporter provisions in SDCL 22-22-24.18 required him to contact the police given his discovery of images of child pornography in the temporary internet files on Helland's computer. [¶6.] Later that afternoon, Elsing contacted Marvin D. Thorstenson, a detective with the Minnehaha County Sheriff's Office assigned to the Internet Crimes Against Children Task Force. Elsing told Detective Thorstenson about the images of child pornography contained in the temporary internet files and the incest web page incident. Elsing also told Detective Thorstenson that Helland had previously told Elsing that he was a Boy Scout Troop Leader and that he had an older fax machine at the Boy Scout Troop building that was great for printing off still images. Finally, Elsing told Detective Thorstenson that Helland had several floppy disks near the computer work station, a disk drive, and a compact disk burner attached to the computer that would allow files to be transferred from the computer to compact disks. Elsing then returned to Helland's office and finished the service call by reloading printer drivers. [¶7.] Detective Thorstenson applied for a search warrant based on this information. In his affidavit, Detective Thorstenson provided a large amount of background information concerning how the internet is used to facilitate crimes against children. The affidavit included a section on collateral evidence that law enforcement officers expect to find during a search of the computer of an individual suspected of possession of child pornography, a section on how a computer serves as a repository of evidence in such cases, another section on the need to remove the computer from the scene in order to search it with sophisticated software programs, and finally a section on the need to seize programs and peripherals to assist in the evaluation of the data contained on the computer. In all, the background material comprised eleven paragraphs of the affidavit, almost three full pages of the five and one-half page document. [¶8.] The remaining pages of the affidavit included a detailed account of the information provided to Detective Thorstenson by Elsing, organized into seventeen enumerated paragraphs. In paragraph nine (9), Detective Thorstenson identified the files being worked on by Elsing as "temporary internet files." The same descriptor was used in paragraphs ten (10), and twelve (12). However, in paragraphs eleven (11) and thirteen (13), Detective Thorstenson refers to "some files" and "these files" when discussing the images observed in the temporary internet files opened by Elsing. [¶9.] Based on the affidavit, a search warrant was issued by a circuit court judge for evidence of the commission of the crime of possession and distribution of child pornography including contraband, the fruits of crime, or things otherwise criminally possessed, and things designed or intended for use in, or which were used as a means of, committing the offense of possession and distribution of child pornography. The scope of the search was limited to Helland's office at his employer's place of business for "[a]ll computer systems to include programs used to create the text or capture & modify images, all programs found near the computer system, data files, removable media such as data tape, magneto optical disks or similar storage, passwords and access codes written on pieces of paper near the computer." The search revealed "a tremendous amount of child pornography" in two different desk drawers in Helland's office. Based on the evidence seized, Helland was indicted on twenty counts of Possession of Child Pornography in violation of SDCL 22-22-24.2(3).[5] None of the indictments were for the images originally found by Elsing in the temporary internet file folders. [¶10.] Helland filed a motion to suppress the evidence and a hearing was held on the matter. The suppression court granted Helland's motion, holding that the affidavit in support of the search warrant failed in two respects. First, the suppression court found that the affidavit failed to explain the nature of temporary internet files. Second, the court held that the affidavit failed to set forth the fact that the files observed by Elsing were all temporary internet files. The suppression court held that the affidavit should have specified that temporary internet files may not be user created, but rather may result from actions taken by the computer without the user's knowledge. In addition, the suppression court held the affidavit should have stated that the evidence discovered by Elsing consisted exclusively of temporary internet files. The suppression court found Detective Thorstenson recklessly misled the issuing court by omitting the background material on temporary internet files and by failing to state that all files viewed by Elsing were temporary internet files. The suppression court held that once the affidavit was supplemented with the omitted material, there was insufficient probable cause for issuance of the search warrant. As a consequence, the suppression court ordered all evidence seized from Helland's office suppressed. [¶11.] The State appeals from the order suppressing the evidence obtained from Helland's computer and desk drawer raising three issues: 1. Whether the suppression court erred when it held that the issuing court had insufficient probable cause to issue the search warrant. 2. Whether Detective Thorstenson recklessly made false or misleading statements in his affidavit, or recklessly withheld material information from the affidavit, so as to invalidate the search warrant. 3. Whether the good faith exception to the exclusionary rule applies when officers reasonably rely upon a search warrant that is later deemed invalid as a result of insufficient probable cause. STANDARD OF REVIEW [¶12.] Our standard of review for a challenge to the sufficiency of the evidence supporting a search warrant requires us to look "at the totality of the circumstances to decide if there was at least a `substantial basis' for the issuing judge's finding of probable cause." State v. Schwartz, 2004 SD 123, ¶21, 689 NW2d 430, 436 (quoting State v. Jackson, 2000 SD 113, ¶8, 616 NW2d 412, 416 (citing Illinois v. Gates, 462 US 213, 238-39, 103 SCt 2317, 2332, 76 LEd2d 527 (1983))). On review, our inquiry is limited to determining whether the information provided to the issuing court in the warrant application was sufficient for the judge to make a "`common sense' determination that there was a `fair probability' that the evidence would be found on the person or at the place to be searched." Jackson, 2000 SD 113, ¶8, 616 NW2d at 416. On review, we are limited to an examination of the facts as contained within the four corners of the affidavit. Id. ¶11, 616 NW2d at 416 (quoting State v. Lodermeier, 481 NW2d 614, 622 (SD 1992) (quoting State v. Iverson, 364 NW2d 518, 522 (SD 1985); State v. Smith, 281 NW2d 430, 433 (SD 1979))). Furthermore, we review the issuing court's probable cause determination independently of any conclusion reached by the judge in the suppression hearing. Jackson, 2000 SD 13, ¶8, 616 NW2d at 416 (citing United States v. Hibbard, 963 F2d 1100, 1101 (8thCir 1992); United States v. Anderson, 933 F2d 612, 614 (8thCir 1991)). ANALYSIS AND DECISION [¶13.] 1. Whether the suppression court erred when it held that the issuing court had insufficient probable cause to issue the search warrant. [¶14.] The text of the Fourth Amendment provides: The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized. US Const. amend. IV. The Fourth Amendment's prohibition against unreasonable searches "generally require searches of persons and places to be authorized by warrant and require such warrants to be based on probable cause to believe that the search will yield contraband or other evidence of a crime." State v. Shearer, 1996 SD 52, ¶10, 548 NW2d 792, 795 (citing State v. Zachodni, 466 NW2d 624, 627 (SD 1991)). [¶15.] There is no "formulaic solution" for determining the amount of evidence required to form probable cause. Jackson, 2000 SD 113, ¶22, 616 NW2d at 420 (citing People v. Fino, 199 NE2d 151, 153 (NY 1964)). Rather, "[p]robable cause lies somewhere between mere suspicion and the trial standard of beyond a reasonable doubt." Heib v. Lehrkamp, 2005 SD 98, ¶21, 704 NW2d 875, 884 (citing Beck v. Ohio, 379 US 89, 91, 85 SCt 223, 225-26, 13 LEd2d 142 (1964); and Charles H. Whitebread & Christopher Slobogin, Criminal Procedure § 3.03 (4th ed 2000)). It is a fluid concept that requires an "assessment of probabilities in particular contexts[,]" and must be evaluated by balancing "the government's need to enforce the law with a citizen's right to privacy[.]" Jackson, 2000 SD 113, ¶22, 616 NW2d at 420. [¶16.] We have previously articulated the standard for determining the existence of probable cause sufficient to support the issuance of a search warrant: There need not be a prima facie showing of legal evidence of a suspected act. The standard of probable cause for the issuance of a search warrant is a showing of probability of criminal activity. [State v. Gerber, 241 NW2d 702 (SD 1976); and State v. Haron, 88 SD 397, 220 NW2d 829 (SD 1974)]. In addition to the reasonable ground to believe that some violation of the law exists, probable cause for a search warrant necessarily implies that there is a violation in respect to some property located on some premises, or on some person, which can be identified expressly or by reasonable inference from the information given in the affidavit so as to be capable of being particularly described in the warrant. See State v. Hermandson, 84 SD 208, 169 NW2d 255 (1969). State v. Kaseman, 273 NW2d 716, 723 (SD 1978) (emphasis added). On review, this Court limits its inquiry to whether the information contained in the affidavit presented to the issuing court was sufficient for that judge to arrive at a "common sense" conclusion that there was a "fair probability" that a crime had been committed and that the evidence named in the affidavit would be found on the person or at the place to be searched. Jackson, 2000 SD 113, ¶8, 616 NW2d at 416. [¶17.] When reviewing a challenge to the sufficiency of a search warrant, we will not consider evidence that was not before the issuing court at the time the warrant was issued. Id. ¶11 (citing Smith, 281 NW2d at 433 (citing Gerber, 90 SD 432, 241 NW2d 720)). Our examination is limited to the four corners of the affidavit. State v. Raveydts, 2004 SD 134, ¶9, 691 NW2d 290, 293. "Reviewing courts are not empowered to conduct an after-the-fact de novo probable cause determination; on the contrary, the issuing court's legal basis for granting the warrant is examined with `great deference.' " Jackson, 2000 SD 113, ¶9, 616 NW2d at 416 (citing Gates, 462 US at 236, 103 SCt at 2331, 76 LEd2d at 527). Furthermore, we will draw every reasonable inference possible in support of the issuing court's determination of probable cause to support the warrant. State v. Habbena, 372 NW2d 450, 456 (SD 1985) (citing State v. Wellner, 318 NW2d 324, 327 (SD 1982)). This deferential standard "is appropriate to further the Fourth Amendment's strong preference for searches conducted pursuant to a warrant." Jackson, 2000 SD 113, ¶9, 616 NW2d at 416 (citing Massachusetts v. Upton, 466 US 727, 733, 104 SCt 2085, 2088, 80 LEd2d 721, 727 (1984)). [¶18.] In the instant case, the issuing court was presented with information indicating that Elsing had personally seen dozens of suspicious files with names such as "hot boys" and "teen boys" in the temporary internet file folders on Helland's computer. The affidavit also indicated that Elsing had seen several photographic images of nude young males contained in files on the computer, and specifically described one in which two nude eight- or ten-year-old male children were sitting side by side with their legs spread, facing the camera. The affidavit clearly indicated that Elsing was looking at temporary internet files contained in temporary internet file folders when he made the initial discovery of suspicious files names, although it does not state with specificity that each and every image of child pornography found by Elsing was located in a temporary internet file. [¶19.] It is also clear from the affidavit that Elsing told Detective Thorstensen that Helland's employer owned the computer in question. The affidavit also states that Elsing personally knew from his work at the employer's place of business that this particular computer had been located in Helland's office for the previous twelve months, and that it was connected to the internet. The affidavit also noted that Helland's computer was attached to a printer, a CD burner and had a disk drive. [¶20.] Helland argued at the suppression hearing that there was nothing in the affidavit for the issuing court to conclude that Helland had caused the images of child pornography to be stored on the temporary internet file folders, and was therefore not in knowing possession of child pornography in violation of SDCL 22-22-24.2(3). Helland argued that the images could have been sent through pop-up ads while he was accessing legal websites that did not contain child pornography. Under this theory, the images of child pornography contained in the pop-ups would have recorded themselves in the temporary internet files without any action on the part of Helland as the computer user. [¶21.] At the hearing, the suppression court questioned Elsing as to the nature of temporary internet files and how such files are created on a computer. When Elsing failed to include in his explanation that pop-up ads could generate temporary internet files without any knowledge or action on the part of the user, the suppression court excused Elsing from the witness stand, stating that Elsing had no credibility with the court. [¶22.] During the suppression hearing, Detective Thorstenson was also asked about his knowledge of temporary internet files and how such files may be generated by the computer user or by the actions of pop-up ads. Thorstenson conceded that the files could be created by both methods, and that he did not recall asking Elsing if he had seen user created files containing child pornography on Helland's computer. Thorstenson also conceded that determining how the files came to be on the computer would be relevant in determining if Helland had committed the crime of knowing possession of child pornography. [¶23.] In its findings of fact and conclusions of law, the suppression court included a lengthy explanation of temporary internet files and how such files can be created through active conduct on the part of a computer user as well as by pop-up ads. The suppression court concluded as a matter of law that the affidavit should have included an explanation of temporary internet files, and should have stated in each reference to "files," that the files in question were "temporary internet files," because "any reasonable person would have known that an explanation of temporary internet files was necessary to thoroughly inform the issuing court." The suppression court theorized that without the information concerning pop-up ads, the issuing court could not determine whether the child pornography images were placed on Helland's computer by his own actions or by the computer's own independent reactions to pop-up ads. Finally, the suppression court held that where the images were found on the computer and how the images came to be on the computer were issues determinative of whether probable cause existed to issue the search warrant. [¶24.] We have never required an affidavit in support of a search warrant to state with particularity how contraband materials such as child pornography came to be at the location to be searched in order to support a finding of probable cause. That level of particularity does not apply to the search of a place where contraband or fruits or instrumentalities of a crime are believed to be located. See Zurcher v. Standford Daily, 436 US 547, 555, 98 SCt 1970, 1976, 56 LEd2d 525 (1978).[6] The standard for a search warrant does not require such particularity with regard to who obtained the contraband, because "[s]earch warrants are not directed at persons; they authorize the search of `places' and the seizure of `things,' and as a constitutional matter they need not even name the person from whom the things will be seized." Id. (citing United States v. Kahn, 415 US 143, 155 n15, 94 SCt 977, 984, 39 LEd2d 225 (1974)). Therefore, who placed the child pornography into the temporary internet files on Helland's computer, and how they were placed there are issues immaterial to a finding of probable cause. [¶25.] How the child pornography came to be on Helland's computer is relevant to determining whether Helland was in knowing possession in violation of SDCL 22-22-24.2(3), as knowledge is an element of the crime of possession of child pornography. As such, the State must prove the existence of knowledge on Helland's part beyond a reasonable doubt at trial in order to obtain a conviction.[7] A pop-up defense goes to the issue of whether a defendant was in knowing possession of child pornography, because the pop-up defense is designed to show the computer obtained the images without the operator's knowledge. See Ty E. Howard, Don't Cache Out Your Case: Prosecuting Child Pornography Possession Laws Based on Images Located in Temporary Internet Files, 19 Berkeley Tech. L.J., 1227 (2004). While such a defense may be relevant at trial in disputing the element of knowledge, the place and time for that consideration is at trial and not at a suppression hearing. [¶26.] The information in the affidavit made it clear that dozens of pornographic images of children were found in the temporary internet files on Helland's computer, a fact Helland does not dispute.[8] It was reasonable for the issuing court to infer from the existence of these images that someone had committed the crime of possession or distribution of child pornography. However, at the point in time that the issuing court approved the search warrant it was not necessary for it to have legal evidence establishing how the images came to be on the computer or whose actions had caused the images to be on Helland's computer. The issuing court had all the facts that it needed to establish that it was "fairly probable" that someone had committed the crime of possession of child pornography, thus satisfying the first inquiry under the probable cause standard for issuing a search warrant. [¶27.] It was also reasonable for the issuing court to conclude there was a "fair probability" based on the dozens of suspicious file names in the temporary internet file folders and the images viewed by Elsing that those same images would still be located in the computer's temporary internet files and be discovered during the search. Finally, it was reasonable for the issuing court to infer that additional images of child pornography might be contained on the computer or on disks, CDs or in printed form in the office, as Helland's computer was attached to a printer, a CD burner and had a disk drive that were available to further manipulate, view, store or print out the images. [¶28.] The suppression court erred when it considered evidence not contained in the affidavit to conclude there was insufficient probable cause to issue the warrant. The suppression court entered into its findings of fact and conclusions of law a substantial amount of information on the nature of temporary internet files that was not before the issuing court. The suppression court also erred when it elevated the issuing court's evidentiary standard by requiring that the affidavit contain facts that indicated how the images of child pornography came to be on the computer. [¶29.] All the issuing court and suppression court needed to consider was whether the presence of dozens of images of child pornography in the temporary internet file folders on Helland's computer, as attested to in the affidavit, constituted sufficient probable cause to conclude that there was a fair probability that the crime of possession of child pornography had been committed and that the search of Helland's computer and office would reveal evidence of the crime. Based on the information as contained in Detective Thorstenson's affidavit, we conclude it was reasonable for the issuing court to determine that there was probable cause to conclude that the crime of possession of child pornography had been committed, and that evidence of that crime would be found either on Helland's computer or in his office. We therefore hold the warrant was supported by probable cause and that the evidence obtained in the search should not be suppressed. [¶30.] 2. Whether Detective Thorstenson recklessly made false or misleading statements in his affidavit, or recklessly withheld material information from the affidavit, so as to invalidate the search warrant. [¶31.] The suppression court concluded Detective Thorstenson recklessly withheld material information from the affidavit that amounted to misleading statements. The suppression court based its conclusion on Thorstenson's 1) failure to specify that the evidence discovered by Elsing consisted exclusively of temporary internet files, and 2) failure to include a description of temporary internet files that informed the issuing court that "temporary internet files may not be user created, but rather may result from actions taken by the computer without the user's knowledge." The suppression court did not find that Detective Thorstenson recklessly made false statements. [¶32.] An affidavit that is purported to contain recklessly and intentionally misleading information or material omissions is reviewed under the two-part analysis in Franks v. Delaware, 438 US 154, 98 SCt 2674, 57 LEd2d 667 (1978). State v. Brings Plenty, 459 NW2d 390, 401 (SD 1990) (citing Habbena, 372 NW2d 450). "First, the defendant must show by a preponderance of the evidence that a . . . statement knowingly and intentionally, or with reckless disregard for the truth, was [omitted] . . . by the affiant in the warrant affidavit. Second, the allegedly [omitted] . . . statement must be necessary to the finding of probable cause." Id. (citing Habbena, 372 NW2d at 456). Omissions will only be considered misrepresentation for purposes of the analysis, when the omissions cast doubt on the existence of probable cause. Id. (citing United States v. Dennis, 625 F2d 782, 791 (8thCir 1980)). However, we do not read a warrant affidavit in a hypertechnical manner. Habbena, 372 NW2d at 456 (citing United States v. Ventresca, 380 US 102, 85 SCt 741, 13 LEd2d 684 (1965)); State v. Kasemen, 273 NW2d 716 (SD 1978); Gerber, 90 SD 432, 241 NW2d 720; Haron, 88 SD 397, 220 NW2d 829; and State v. Kietzke, 85 SD 502, 186 NW2d 551 (1971). Instead, "we read each affidavit as a whole and interpret each in a common sense and realistic manner." Id. [¶33.] Helland argues that Detective Thorstenson knowingly and intentionally, or with reckless disregard for the truth, omitted the words "temporary internet" before the word "file" from paragraphs eleven (11) and thirteen (13) of the affidavit when describing the files containing images of child pornography as discovered by Elsing. The suppression court agreed that the omission was knowing and intentional. [¶34.] However, our reading of the affidavit as a whole indicates that the references to "temporary internet files" in paragraphs nine (9), ten (10) and twelve (12), make it clear that the entire affidavit is describing the contents and names of temporary internet files. The shortening of the descriptor from "temporary internet files" to "some files" and "these files" in paragraphs eleven (11) and (13) is apparent as no other file location is specified for the images containing child pornography. [¶35.] Therefore, we conclude that Helland has failed to satisfy the first prong of the analysis as there is no evidence that an omission exists. Even if we were to conclude that an omission was committed by Thorstenson and proceed to the second prong of the Franks v. Delaware test, there is no evidence in the affidavit or in the suppression hearing transcript to support a finding that the omission was done recklessly or intentionally to mislead the issuing court. [¶36.] Helland has failed to satisfy the Franks v. Delaware test for recklessly and intentionally misleading information or material omissions in an affidavit. There was no material omission in the affidavit. Therefore, there cannot be any reckless or intentional conduct on the part of Detective Thorstenson that prejudiced Helland. [¶37.] Based on our holdings in Issues 1 and 2, there is no need to address the good faith exception to the exclusionary rule in Issue 3. We reverse. [¶38.] SABERS, KONENKAMP and ZINTER, Justices, concur. [¶39.] MEIERHENRY, Justice, concurs in result. MEIERHENRY, Justice (concurring in result). [¶40.] I concur in result. The proper review of this case is the two part analysis of Franks v. Delaware, 438 US 154, 98 SCt 2674, 57 LEd2d 667 (1978). First, the defendant must show "that the police omitted facts with the intent to make, or in reckless disregard of whether they thereby made, the affidavit misleading[.]" U.S. v. Jacobs, 986 F2d 1231, 1234 (8thCir 1993) (citing U.S. v. Reivich, 793 F2d 957, 961 (8thCir 1986)). Second, the defendant must further show "that the affidavit if supplemented by the omitted information would not have been sufficient to support a finding of probable cause." Id. (citing Reivich, 793 F2d at 961). [¶41.] The main concern of the trial court was the omission of "explanatory information regarding the nature of the temporary internet files." The trial court determined that "[a]ny reasonable person would have known that an explanation of temporary internet files was necessary to thoroughly inform the issuing judge." The intentionally omitted material, according to the trial court, was "that a temporary internet file may be computer generated without the user knowing that such a file is being created." Further, "no statement in the Affidavit indicates that pop-up windows may also generate temporary internet files without any action by the user." Additionally, the trial court found that "without that explanatory information, the statements referring to `some files' and `other files' were misleading." The trial court found the omission to be recklessly misleading. [¶42.] In the affidavit, the officer explains that the technician first noticed the files while performing a diagnostic scan of defendant's computer. The officer includes the following information: 9. ... [The technician] observed that the scan was taking a very long time and that it was in the temporary internet files for a very long time. 10. [The technician] decided at this point to delete the contents of the temporary internet files. [He] searched for the" content.ie5" folder and began deleting the files. [He] noted that this process seemed to be taking forever, and it didn't seem to him to be deleting the files. [He] then started looking into the folders to see if the contents were being deleted and noted suspicious file names, using words like "hot boys", "teens", etc and [he] did open some of these files at this time. 11. ... upon opening some files he discovered that there were images of young males, depicted in a nude state, with some being clothed. [He] recalls one such image of two boys, guessing them to be 8 to 10 years of age, naked, sitting on the shore of a lake or stream, sitting side by side, hands behind them, with their legs spread. 12. ... [he] could not believe what he was seeing on the defendant's computer and in this state of disbelief, did start opening other folders and images, observing similar images, as described in paragraph 11. [He] realized at this point that the system was still deleting the temporary internet files, so he stopped it from doing so. The affidavit consistently refers to the suspicious files as temporary internet files. It does not appear from the four corners of the affidavit that the officer was attempting to mislead the court about the nature of the suspicious files being anything other than temporary internet files. Nevertheless, an explanation of how content gets placed into temporary internet files would have been helpful to the court's determination of probable cause. "Any reasonable person would have known that this was the kind of thing the judge would wish to know." Jacobs, 986 F2d at 1235. Although an affidavit need not be hypertechnical, information on the workings of the technology may be important for a judge to know, especially when the crime is committed by the use of that technology. Common sense tells us that the affiant needs to provide enough technical information for the judge to assess whether criminal activity is a probability. Consequently, the crucial omission was the officer's failure to explain the nature of temporary internet files to the judge. [¶43.] Under the second part of the analysis, the defendant must show that the omitted information, if added to the affidavit, would defeat a probable cause showing. Here, addition of the information would have informed the issuing court that the alleged child pornography in the temporary internet files may not have been viewed by the defendant and may have been stored in the temporary internet files without the defendant's knowledge. However, adding this information does not defeat a finding of probable cause. [¶44.] The standard of probable cause required for the issuance of a search warrant is a showing of "probability of criminal activity." State v. Kaseman, 273 NW2d 716, 723 (SD 1978) (citing State v. Gerber, 90 SD 432, 241 NW2d 720 (1976); State v. Haron, 88 SD 397, 220 NW2d 829 (1974)). In determining probability, it is not necessary that there be a "prima facie showing of legal evidence of a suspected act." Id. Under this standard, with the added information, there was still a probability of criminal activity, i.e., that there was a probability that someone purposely retrieved the pictures from the internet and viewed them without saving them to a user created file. Consequently, the defendant has failed to meet the second part of the analysis. I would reverse for these reasons. NOTES [1] Antivirus software is designed to protect a computer from viruses, worms, Trojan horses, and other programs designed to attack a computer and perform malicious acts such as deleting files, accessing personal data, or using the computer to attack other computers. http://www.microsoft.com/athome/security/protect/antivirus.mspx (last visited December 5, 2005). [2] Spyware is software that installs itself onto a user's computer and performs specific and usually unwanted tasks without the user's consent. These functions include delivering unwanted advertising or collecting personal information about the user. Signs of spyware infection include pop-up ads, the alteration of internet settings such as home page or search page settings, the sudden appearance of additional software and tool bars. Antispyware is software designed to remove these harmful programs. http://www.microsoft.com/athome/security/spyware/default.mspx and http://www.microsoft.com/athome/security/spyware/spywaresigns.mspx (last visited December 5, 2005). [3] The index.dat file is located in the Temporary Internet Files folder. It serves as a cache file for Internet Explorer 4.0. When [a computer user] visit[s] a Web page, Internet Explorer assigns the [page's] Web address a unique identification number and searches the [index.dat] file for that identification number. If the Web page's identification number is found, the contents of the Web page are stored locally on [the] computer's hard disk and Internet Explorer uses the locally stored content instead of downloading the information from the Internet. If the Web page's identification number is not found, the contents of the Web page must be downloaded from the Internet. This occurs if [the user has] not visited the Web page before, the Web page has changed, or the Web page's identification number has expired. When the Web page's content has been downloaded to the hard disk, the [index.dat] file is updated with the Web page's identification number. http://support.microsoft.com/default.aspx?scid=kb;en-us;178702 (last visited December 5, 2005). [4] SDCL 22-22-24.18 provides: Any commercial computer repair technician who has knowledge of or observes, within the scope of the technician's professional capacity or employment, a film, photograph, video tape, negative, slide or other visual depiction of a minor whom the technician knows or reasonably should know to be under the age of eighteen, engaged in prohibited sexual acts or in the simulation of prohibited sexual acts, shall report the depiction to an appropriate law enforcement agency as soon as reasonably possible. The computer repair technician need not report to law enforcement depictions involving mere nudity of the minor, but shall report visual depictions involving prohibited sexual acts. This section may not be construed to require a computer repair technician to review all data, disks, or tapes delivered to the computer repair technician within the computer repair technician's professional capacity or employment. A violation of this section is a Class 1 misdemeanor. However, a violation of this section does not constitute grounds for a civil action for damages against any person. [5] SDCL 22-22-24.2(3) provides in relevant part: "A person is guilty of possessing, manufacturing, or distributing child pornography if the person: (3) Knowingly possesses, distributes, or otherwise disseminates any visual depiction of a minor engaging in a prohibited sexual act, or in the simulation of such an act." [6] In Zurcher v. Standford Daily, university students and staff members argued the Fourth Amendment prevented a state from issuing a search warrant for the student newspaper's premises for negatives, films, and pictures revealing the identities of demonstrators who assaulted police officers. 436 US at 550-51, 98 SCt at 1973-74, 56 LEd2d at 525. Plaintiffs alleged the warrant was deficient because it authorized the search of a third party's premises, but there was no probable cause to believe that the owners or the possessors of the premises were implicated in a crime that had occurred or was occurring. Id. at 552-53, 98 SCt at 1974-75, 56 LEd2d at 525. The Supreme Court held that in the context of a third party search when there is probable cause to believe the fruits or instrumentalities of a crime are in a specific location, the Fourth Amendment does not require that the occupant, owner or possessor of the premises must also be reasonably suspected of crime and be subject to arrest before a search warrant may issue. Id. at 559, 98 SCt at 1978, 56 LEd2d at 525. [7] Our state code is filled with crimes that require the State to prove knowing possession on the part of the accused. See SDCL 22-42-6 ("No person may knowingly possess marijuana.") (emphasis added.); SDCL 22-42-5 ("No person may knowingly possess a controlled drug or substance") (emphasis added.); SDCL 22-42-8 ("Any person who knowingly obtains possession of a controlled drug or substance by theft, misrepresentation, forgery, fraud, deception, or subterfuge is guilty of a Class 4 felony.") (emphasis added.); and SDCL 22-14-23 ("Except as provided in § 22-14-24, any person who knowingly possesses or causes to be present a firearm or other dangerous weapon, in any county courthouse, or attempts to do so, is guilty of a Class 1 misdemeanor.) (emphasis added). See also SDCL 22-14A-4 (knowingly possesses a destructive device) (emphasis added.); SDCL 58-4A-2(1) (knowingly possess fraudulent insurance policies) (emphasis added.); SDCL 10-50-21 (knowingly possess counterfeit stamp) (emphasis added.); SDCL 22-11-27 (knowing possession of property with altered serial number) (emphasis added.); and SDCL 22-42-9 (knowing possession of equipment for making counterfeit controlled substance) (emphasis added). However, we require the State to prove up the knowledge requirement at trial. See State v. McDonald, 500 NW2d 243 (SD 1993) (defendant who was arrested and charged with knowing possession of controlled substance under SDCL 22-42-5 used defense of lack of knowledge at trial). [8] Helland stated at oral argument that the images identified by Elsing as child pornography were of nude children, and therefore did not meet the definition of pornography under SDCL 22-22-24.2(3), which makes illegal the possession, distribution and dissemination of images that are a "visual depiction of a minor engaging in a prohibited sexual act, or in the simulation of such an act." However, that argument was not made at the suppression hearing, and therefore is not addressed by this Court. See Knudson v. Hess, 1996 SD 137, ¶8, 556 NW2d 73, 75 (holding parties must have presented the issue to the court below and obtained a ruling before it will be permitted to be raised on appeal) (quoting Klinker v. Beach, 1996 SD 56, ¶17 n3, 547 NW2d 572, 576; and Hawkins v. Peterson, 474 NW2d 90, 95 (SD 1991)).