Opinion
2039/2016.
10-02-2017
The PEOPLE of the State of New York, Plaintiff, v. Joseph HAYON, Defendant.
Eric Gonzalez, Acting District Attorney, Kings County, Brooklyn, (Albert W. Suh, of counsel), for the People. Douglas B. Appel, Brooklyn, for Defendant.
Eric Gonzalez, Acting District Attorney, Kings County, Brooklyn, (Albert W. Suh, of counsel), for the People.
Douglas B. Appel, Brooklyn, for Defendant.
MATTHEW J. D'EMIC, J.The defendant moves to controvert three search warrants and seeks to suppress "any items seized or statements made pursuant to [their] execution." The People oppose the motion.
Following the execution of these search warrants at his home and places of business, the defendant was arrested and criminally charged for possessing multiple images of children engaging in sexual conduct. The defendant was originally accused of eight counts of Promoting a Sexual Performance by a Child (PL § 263.15) and sixty-five counts of Possessing a Sexual Performance by a Child (PL § 263.16) under Indictment No. 8001/2015. Subsequently, the People re-presented this case to the Grand Jury and a new, superseding indictment, No. 2039/2016 was issued, charging the defendant with the original charges and an additional 30 counts of possession of a sexual performance by a child. However, following its inspection of the Grand Jury minutes, the court dismissed all eight "Promoting" counts and one possession count (August 18, 2016; Foley, J.), leaving the defendant currently charged with 94 counts under Penal Law § 263.16.
In moving to controvert, the defendant contends that the application for the search warrants did not provide the court with sufficient probable cause to support the issuance of the warrants. He attributes this deficiency to four factors: that all of the subpoenaed information referred to in the warrant application was not shown to be connected to child pornography; that only one alleged pornographic image was viewed by the affiant; that the omission of accurate information about the ability of others to access an unsecure internet connection misled the court; and that the information in the warrant application is stale.
The court has considered the papers submitted, the warrant application and the three signed search warrants at issue as well as the two previous search warrants in this case. For the following reasons defendant's motion is denied.
Background
On February 16, 2015, the New York City Police Department (NYPD) was notified by the National Center for Missing and Exploited Children Cyber Tipline (NCMEC) that a suspected image of child pornography had been uploaded onto an email account, A-----@juno.com, provided by Internet Service Provider (ISP) Juno Online Services. The parent company of Juno, United Online Communications, had reported the upload the day it occurred, December 26, 2014, and that the image came from a particular Internet Protocol Address (IP address), 96.246.26.49. Police Officer Anthony Santilli, who was assigned to the Computer Crime Squad and who applied for the search warrants at issue here, viewed the image and determined that it fell within the definition of child pornography. He used the American Registry for Internet Numbers (ARIN) to learn that Verizon was the ISP that assigned the IP address used to upload the image. He subpoenaed Verizon and discovered the name of the subscriber to the email account and the address of the subscriber, a business, Pink Label, with a Brooklyn, New York address. The particular customer who signed onto the computer at the time was identified as "Joseph H". Through another subpoena served on United Online, Santilli found subscriber information about the account, that it had been opened the day before the uploading, the member name, and that it was connected to the IP address originally reported. He also gained access to the connection logs which showed the time during which five additional IP addresses were connected to the internet, the amount of data that was transferred, and the identification numbers of additional IP addresses used. With this information Santilli subpoenaed Verizon again and learned that one of the five additional IP addresses was assigned to Pink Label and the other four were associated with defendant, Joseph Hayon, at his home address in Brooklyn, New York.
This accumulated information enabled Santilli to obtain a search warrant on March 23, 2015, authorizing a search of all activity relating to the Juno email account (Tomei, J.). According to his affidavit for the instant search warrant, Santilli stated that as a result of this first search warrant,"I am informed by the records of United Online that there were multiple e-mail messages sent and received containing additional Child Pornography." A subsequent subpoena to Verizon uncovered six additional IP addresses, one assigned to Pink Label and five assigned to defendant at his home address. The officer affirmed that these six IP addresses "were used to facilitate the trade of Child Pornography in that the IP Addresses were used to send messages to other individuals with whom the owner of the Juno Account of A-----@juno.com was actively exchanging Child Pornography, in that the content of these messages confirmed and discussed this type of exchange."
On May 1, 2015, Santilli applied for and was granted a search warrant for a Facebook account that he had learned was linked to the Juno email account (Gary, J.). He explained to the court reviewing his second warrant application that the underlying reason for seeking access to the Facebook account was that Facebook users commonly used it as a platform to transfer images and videos of child pornography. The results of the Facebook search warrant were not received at the time of this motion.
The search warrant application at issue here involved three distinct locations and resulted in the granting of three separate search warrants on May 15, 2015 (Simpson, J.). Officer Santilli listed defendant's residence as "subject location 1," the offices of Pink Label as "subject location 2," and the "rear office" as "subject location 3." Both of the previous search warrant applications were incorporated by reference and were available to the court for review. On April 20, 2015, Santilli had visited the second location, the office of Pink Label, under the guise of a fictional investigation and met with the owner of Pink Label who called her financial manager, "Joe," from the third location, his office in a distinct but attached "rear office" also at Pink Label's street address. Santilli was introduced to defendant, who voluntarily led him to his "Management Office" where Santilli observed two laptop computers.
With regard to the first location, Santilli established through public and utility records that this address was the defendant's residence. The response to two Verizon subpoenas reflected that nine IP addresses were assigned to a customer, Joseph Hayon, at that location. Santilli also learned through his investigation that a business, Homework Helper Institute, LLC, was registered at that location as well. Upon telephoning defendant's residence he was informed by a female that the Homework Helper Institute tutored children individually at their homes.
On May 21, 2015, the three search warrants were executed, leading to the recovery of laptop computers, desktop computers, cellular phones, and assorted devices from both the defendant's home and from the business locations. The defendant was also arrested on that date and, in statements to the police, he admitted he was the owner of the subject email account and that he used the Facebook account to meet people to facilitate trades of images. The defendant further stated that he was the owner of the computers seized from his apartment and that he used the computers at the subject business premises. He also provided the police with the Juno email and Facebook passwords.
Legal Analysis
A presumption of validity attaches to a search warrant approved by a magistrate who reviews the underlying application and finds sufficient evidence of probable cause ( People v. Castillo, 80 N.Y.2d 578, 585, 592 N.Y.S.2d 945, 607 N.E.2d 1050 [1992], cert. denied 507 U.S. 1033, 113 S.Ct. 1854, 123 L.Ed.2d 477 [1993] ; People v. Hanlon, 36 N.Y.2d 549, 558, 369 N.Y.S.2d 677, 330 N.E.2d 631 [1975] ; People v. Leggio, 84 A.D.3d 1116, 1117, 923 N.Y.S.2d 188 [2d Dept.2011] ). "Probable cause does not require proof sufficient to warrant a conviction beyond a reasonable doubt but merely information sufficient to support a reasonable belief ... that evidence of a crime may be found in a certain place" ( People v. Bigelow, 66 N.Y.2d 417, 423, 497 N.Y.S.2d 630, 488 N.E.2d 451 [1985] ). The application for the search warrant "must provide the magistrate with information sufficient to support a reasonable belief that evidence of illegal activity will be present at the specific time and place of the search" ( People v. Edwards, 69 N.Y.2d 814, 816, 513 N.Y.S.2d 960, 506 N.E.2d 530 [1987] ; People v. Williams, 249 A.D.2d 343, 344, 670 N.Y.S.2d 893 [2d Dept.1998] ). The warrant application should "be considered in the clear light of everyday experience and accorded all reasonable inferences" with the magistrate evaluating the facts alleged, the nature of the crime, the sources of the information, the manner the information is acquired, the expertise of the officers, and the extent to which the information is verified ( Hanlon at 559, 369 N.Y.S.2d 677, 330 N.E.2d 631 ). Where the magistrate conducts a measured and comprehensive examination the determination of probable cause will be given great deference on review ( Spinelli v. United States, 393 U.S. 410, 419, 89 S.Ct. 584, 21 L.Ed.2d 637 [1969] ; Hanlon at 558, 369 N.Y.S.2d 677, 330 N.E.2d 631 ).
The warrant application submitted to the court on May 15, 2015 was thoroughly detailed and provided ample evidence to conclude that probable cause existed for the issuance of the search warrants. In his affidavit Officer Santilli described his training, experience, and expertise in investigating crimes involving child pornography. He conveyed his knowledge of the dissemination, collection, and storage of such images and materials as well as his understanding of the ability of forensic experts to find deleted or hidden information in the computer's residual memory. He explained that an IP address acts as a unique identifier assigned to a computer connected to the internet and that the IP address can change, when it is assigned based on availability at the time of internet log-on. Santilli also used his experience to explain certain common propensities among individuals interested in child pornography that further bolstered the expectation that incriminating evidence would be found. Finally, because of the unique nature of child pornography investigations, he provided an expansive list of property to be seized with sufficient particularity.
Defendant's first argument, that unnecessary, unconnected information was a distraction for the court, is belied by the well-structured progression of the investigation, specifically, how one discovery led to the next in a step-by-step methodical approach. He maintains that the eleven IP addresses gathered through the Verizon subpoenas were never directly or conclusively tied to the transmission or collection of particular images and that this diminished their importance. They were, however, shown to link the email account, A---- @juno.com, to "Joseph H." at defendant's place of business and to the defendant directly at his residence, thereby establishing the true owner of the account. Because the activity on the email account was the central focus of the investigation, gathering information about the IP addresses was essential to an understanding of the trail of evidence and to the discovery that child pornography was being actively exchanged. Defendant next claims that Officer Santilli personally viewed only the single image of child pornography received from NCMEC and suggests that a single image is insufficient as a basis for probable cause. He contends that Santilli's statement referencing the first search warrant and resulting information, that he was "informed by the records of United Online" of "at least ten images" depicting naked girls, means that someone other than Santilli, without his expertise, evaluated the content, thereby lessening the quality of evidence required for a finding of probable cause. The People assert that Santilli's explanation of what he learned from the first search warrant and subsequent subpoenas "supports the inference" that he personally viewed all the emails and images contained in the email account.
While the meaning of "I am informed" in paragraph nineteen of the warrant application is uncertain, it is ultimately irrelevant. For purposes of probable cause, the viewing of the single image of child pornography was just the beginning of the investigation with much more to follow. What is clear from a reading of the complete paragraph is that "I am informed" referred only to the records Officer Santilli received from United Online about the traffic in the Juno account since its inception until the time the subpoena was answered. Santilli went on to explain to the court that he had then obtained the records of additional IP addresses that were used by defendant, the owner of the Juno account, to send messages to others with whom he was "actively exchanging Child Pornography." Santilli also declared that "the content of these messages confirmed and discussed this type of exchange." This last statement can only be understood to mean that Officer Santilli had personal knowledge of the second set of messages.
Defendant has thus failed to establish that Officer Santilli's personal knowledge of the crimes alleged was limited to the viewing of the initial illicit image. Even if he had merely read a report from United Online and had never actually read the specific email messages, he would have learned from the report that the email account associated with defendant was an active site exchanging child pornography. Such information was valuable as a bridge in a trail of evidence reflecting continuing criminal activity and eliminating the possibility that the initial uploading was inadvertent.
Defendant's claim that the warrant application is deficient because it failed to explain to the court the "realistic possibility" that someone other than defendant, such as a "neighbor, a visitor or someone outside the premises" could have used defendant's unsecured IP address is extremely weak. His argument rests on the idea that because anything is possible, the warrant court must exclude every alternative theory to a certainty, a view that is inconsistent with the meaning of probable cause. In an often-quoted description of probable cause, the United States Supreme Court bluntly stated, "[i]n dealing with probable cause, however, as the very name implies, we deal with probabilities" ( Brinegar v. United States, 338 U.S. 160, 175, 69 S.Ct. 1302, 93 L.Ed. 1879 [1949] ). "The affidavit need not contain information providing certainty that the objects sought will be found in the search ... but rather whether the facts and circumstances taken as whole gave the magistrate probable cause to believe that the desired items would be found in the search" ( United States v. Brinklow, 560 F.2d 1003, 1006 [10th Cir.1977], cert. denied 434 U.S. 1047, 98 S.Ct. 893, 54 L.Ed.2d 798 [1978] ).
Multiple federal courts have reached the conclusion that illegal internet activity associated with a particular IP address is a sufficient basis to find a nexus between the unlawful use of the internet at the IP address and a computer possessed by the subscriber assigned that address.
In United States v. Perez, 484 F.3d 735, 740 (5th Cir.2007), cert. denied 552 U.S. 952, 128 S.Ct. 405, 169 L.Ed.2d 266 (2007), the Fifth Circuit held that where the prosecution presented evidence that child pornography had been transmitted by means of a particular IP address that was assigned to the defendant at his home address, "it remained likely that the source of the transmissions was inside of that residence." The court reasoned that proof beyond a reasonable doubt was not required to establish probable cause (id. ). The Third Circuit agreed with Perez, finding that "[t]he unique nature of the IP address assigned to [the defendant] on October 25 made his attempts to access the Link fairly traceable to his Comcast account and the physical address to which that account was registered" ( United States v. Vosburgh, 602 F.3d 512, 527 [3d Cir.2010], cert. denied, 563 U.S. 905, 131 S.Ct. 1783, 179 L.Ed.2d 656 [2011] ). The District Court of the Western District of New York used the same reasoning, finding even if the warrant affidavit "did not prove definitively that [the defendant] was the user who had viewed the pornographic images, it was reasonable to assume that the address associated with the IP address was responsible for activity connected to that IP address; probable cause thus existed that evidence of criminal activity would be found at that address" ( United States v. Chamberlin, 2010 WL 1904500 [W.D.N.Y.2010] ). Other Circuits agree (see United States v. Stults, 575 F.3d 834, 843–844 [8th Cir.2009], cert. denied 559 U.S. 915, 130 S.Ct. 1309, 175 L.Ed.2d 1093 [2010] ; United States v. Wagers, 452 F.3d 534, 539 [6th Cir.2006], cert. denied, 549 U.S. 1032, 127 S.Ct. 596, 166 L.Ed.2d 431 [2006] ; United States v. Hay, 231 F.3d 630, 635–636 [9th Cir.2000], cert. denied, 534 U.S. 858, 122 S.Ct. 135, 151 L.Ed.2d 88 [2001] ).
Defendant's final claim is that probable cause was undermined by the staleness of the information in the warrant application. Defendant states, "[w]ithout more verified current activity, any information that the computers in question were being used after the December date becomes stale." The People respond that the investigation produced additional viable evidence of criminal activity after the initial transmission and that defendant's focus ignores the continuing nature of the possession of child pornography.
While the Criminal Procedure Law does not impose a limit on the time in which the police must apply for a search warrant (see CPL § 690.30 ), the proof supporting the warrant application "must be of facts so closely related to the time of issue of the warrant as to justify a finding of probable cause at that time" ( People v. Padilla, 132 A.D.2d 578, 517 N.Y.S.2d 299 [2d Dept.1987] ; quoting Sgro v. United States, 287 U.S. 206, 210–211, 53 S.Ct. 138, 77 L.Ed. 260 [1932] ). The determination of probable cause is not, however, a function of mechanically counting the days between the acquisition of information and the issuance of the warrant ( People v. Clarke, 173 A.D.2d 550, 551, 570 N.Y.S.2d 305 [2d Dept.1991] ). Rather, " [i]nformation may be acted upon as long as the practicalities dictate that a state of facts existing in the past, which is sufficient to give rise to probable cause, continues to exist at the time the application for a search warrant is made" (id.; People v. Teribury, 91 A.D.2d 815, 816, 458 N.Y.S.2d 85 [3d Dept.1982] ; People v. Rodriguez, 303 A.D.2d 783, 784, 758 N.Y.S.2d 172 [3d Dept.2003] ; Brinklow at 1005).
"[T]he question of staleness necessarily turns upon the nature of the alleged offense and the degree to which it constitutes an ongoing or continuing activity" ( People v. Manngard, 275 A.D.2d 378, 379, 712 N.Y.S.2d 582 [2d Dept.2000], lv. denied 95 N.Y.2d 966, 722 N.Y.S.2d 483, 745 N.E.2d 404 [2000] ). Stated a bit differently, "[t]he two critical factors in determining staleness are the age of the facts alleged and the ‘nature of the conduct alleged to have violated the law’ " ( United States v. Raymonda, 780 F.3d 105, 114 [2d Cir.2015], quoting United States v. Ortiz, 143 F.3d 728, 732 [2d Cir.1998] ). Also to be considered is that "[t]he significance of the length of time between the point probable cause arose and when the warrant issued depends largely upon the property's nature" (Brinklow at 1006). Thus, depending on the nature of the property the court may conclude that it is reasonable it would still be present in the premises despite the passage of time (see People v. Varas, 110 A.D.2d 646, 646, 487 N.Y.S.2d 577 [2d Dept.1985] [given physician's duty to maintain records it was not unreasonable to believe that the subject records would be present in defendant's office at time of application]; People v. Walker, 285 A.D.2d 660, 662, 727 N.Y.S.2d 731 [3d Dept.2011] [not unreasonable for murder defendant to hide weapons and other evidence in place defendant controls]; People v. Freitag, 148 A.D.2d 544, 545, 538 N.Y.S.2d 872 [2d Dept.1989] [passage of six months did not make warrant information stale considering the nature of the proceeds of burglary] ).
The nature of an investigation into the transmission and collection of child pornography over the internet is distinguished from most other investigations by the subject matter and the nature of the vehicle for the criminal activity. "When a defendant is suspected of possessing child pornography, the staleness determination is unique because it is well known that images of child pornography are likely to be hoarded by persons interested in those materials in the privacy of their homes" ( United States v. Irving, 452 F.3d 110, 125 [2d Cir.2005] [internal quotation marks omitted] ). Thus, "evidence that such persons possessed child pornography in the past supports a reasonable inference that they retain those images—or have obtained new ones—in the present" (Raymonda at 114). "Crucially, however, the value of that inference in any given case depends on the preliminary finding that the suspect is a person ‘interested in’ images of child pornography. The alleged proclivities of collectors of child pornography ... are only relevant if there is probable cause to believe that [a given defendant] is such a collector" (id. [internal quotation marks omitted] ). The Third Circuit was quick to note when considering the compulsion to hoard that "[w]e do not hold, of course, that information concerning child pornography crimes can never grow stale. We observe only that information concerning such crimes has a relatively long shelf life. It has not been, and should not be, quickly deemed stale" (Vosburgh at 529).
The staleness inquiry is also very much colored by the reliance of child pornographers on computers and the internet. "Images stored on computers can be retained almost indefinitely, and forensic examiners can often uncover evidence of possession or attempted possession long after the crime has been completed" (id. ). Moreover, computers and computer equipment are "not the type of evidence that rapidly dissipates or degrades" (id. ). "Therefore, the passage of weeks or months here is less important than it might be in a case involving more fungible or ephemeral evidence" (id. ).In this instance, the information gained as a result of the first search warrant established continuing criminal activity involving the transmission, exchange, and collection of child pornography and showed the court that defendant had not merely accessed illicit images on a single occasion. Because of the trail of evidence contained in the May 15, 2015 warrant application, the court could conclude that defendant "accessed those images because he was interested in child pornography, and thus—as is common among persons interested in child pornography—likely hoarded the images he found" (Raymonda at 114). This finding also reinforced the suspicion that defendant had accessed the initial image willfully and deliberately. The court could therefore conclude that there was sufficient evidence to establish probable cause that defendant was an intentional collector of child pornography expected to retain or maintain rather than destroy pornographic images.
Accordingly, defendant's motion to controvert the three search warrants in this case is denied in its entirety. The court finds no basis to suppress either the evidence recovered pursuant to their execution or the statements as the fruit of the contested warrants. The admissibility of the defendant's statements will be the subject of a Huntley hearing.