The opinion of the court was delivered by: Karen E. Schreier Chief Judge
ORDER ADOPTING REPORT AND RECOMMENDATION
Defendant, Jeremy Vincent Nelson, is charged with one count of possession of child pornography in violation of 18 U.S.C. §§ 2252A(a)(5)(B) and 2256(8). Nelson moves to suppress evidence obtained during a search of his residence and vehicle on or about November 4, 2009, and for a Franks hearing. The court referred Nelson's motion to Magistrate Judge John E. Simko pursuant to 28 U.S.C. § 636(b)(1)(B). After holding an evidentiary hearing, Magistrate Judge Simko recommended that this court grant Nelson's motion to suppress and for a Franks hearing. The government objects to nine of Magistrate Judge Simko's factual and legal findings. Nelson has no objection to Magistrate Judge Simko's report and recommendation. After a de novo review of the report and recommendation and a review of the record, the court adopts the report and recommendation and grants Nelson's motion to suppress and for a Franks hearing.
Under 28 U.S.C. § 636(b)(1), "when a party objects to the report and recommendation of a magistrate judge concerning a dispositive matter, '[a] judge of the court shall make a de novo determination of those portions of the report or specified proposed findings or recommendations to which objection is made.' " United States v. Lothridge, 324 F.3d 599, 600 (8th Cir. 2003) (quoting 28 U.S.C. § 636(b)(1)); see also Fed. R. Civ. P. 72(b) ("The district judge must determine de novo any part of the magistrate judge's disposition that has been properly objected to.").
Troy Boone is the Task Force Commander for the State of South Dakota Internet Crimes Against Children Task Force. On September 27, 2009, Agent Boone came across an IP address that was distributing files known to be child pornography. Agent Boone identified the files as child pornography by comparing the hash values of the files to the hash values of known child pornography. When two files have the same hash value, there is a 99.99 percent chance that they are the same file. The IP address distributing child pornography files was 22.214.171.124.
Agent Boone kept track of the file-sharing activity conducted by IP address 126.96.36.199 from September 29, 2009, to October 31, 2009. This activity was recorded in a 79-page log, the first page of which was introduced into evidence as Exhibit 6. Exhibit 6 indicates that the port number associated with the file-sharing activity was 22662, meaning that the subscriber using IP address 188.8.131.52 to access the Internet was using the channel identified as port number 22662 to communicate with file-sharing software. Agent Boone testified that the port number was 22662 during the entire 33-day period for which he tracked the file-sharing activity conducted by IP address 184.108.40.206. Agent Boone also testified that the port number is never the same from computer to computer and that if the same port number is associated with the same IP address over a certain period, then it was probably the same computer the whole time. Agent Boone had the IP history and port number for IP address 220.127.116.11 at the time he prepared the affidavit in support of the search warrant in question in this case.
In the course of his investigation, Agent Boone also obtained and served a subpoena on Knology, an Internet service provider, requesting "[s]ubscriber information for IP address 18.104.22.168 on 9-28-09 at 00:46 (퍍) GMT to 9-28-09 at 00:29 (퍍) GMT, including any and all billing information and payment information including credit card number, connection dates and times, and current IP address." Exhibit 4.*fn1 The parties agree that the times on the subpoena were reversed, so that the subpoena should have read "9-28-09 at 00:29 (퍍) GMT to 9-28-09 at 00:46 (퍍) GMT." Converted into Central Daylight Time (CDT), the subpoena requested subscriber information for IP address 22.214.171.124 for 7:29 p.m. to 7:46 p.m. on September 27, 2009. In response to this subpoena, Knology sent a series of emails to Agent Boone. These emails were introduced into evidence as Exhibit 2.
The series of emails shows that on September 30, 2009, Jason Griggs, Knology's Security and Fraud Coordinator and Subpoena and Legal Compliance Officer, contacted David Johnson, another Knology employee, and stated that he needed Dynamic Host Control Protocol (DHCP) logs and subscriber information for IP address 126.96.36.199 from September 28, 2009, through the most current date. Exhibit 2 at 7.*fn2 Johnson replied on October 5, 2009, that he could not determine the modem and/or account information for that IP address. Id. at 7. That day, Griggs asked Johnson if the subscriber could have disconnected service. Id. at 6-7. Johnson stated that he had consulted Cynthia Spence, another Knology employee, and Spence theorized that the DHCP log showed two MAC addresses slammed together. Id. at 6. Griggs asked Johnson to keep trying to locate the customer. Id. at 5.
On October 7, 2009, Spence sent an email to Jason Rang, a Knology employee, which said: "[h]ere is what DHCP spit out when we queried it on the date in question for the user of the IP address." Id. at 3. Spence copied a DHCP log for September 28, 2009, into this email. Id. at 4-5. The September 28, 2009, log reflects activity by IP address 188.8.131.52 and a computer with MAC address 00:1e:ec:2e:cc:36 as well as a device with MAC address 00:19:b9:de:7d:c3:00:0a:8b:19:70:0a:08:00. The time of the activity was between 11:24:19 p.m. CDT and 11:24:22 p.m. CDT. Rang replied that it looked like an IPV6 MAC address or a spoofed address and asked whether law enforcement could provide a MAC address to see if it matched the 00:1e:ec:2e:cc:36 address. Id. at 3. Spence then asked Griggs if the police had a suspected MAC address, and Griggs indicated that the police were looking to Knology to uncover that information. Id. at 2-3. Spence replied that they would "just have to keep monitoring and hope [the subscriber] gets online." Id. at 2. She also asked Griggs to "let the police know that we need to know ASAP if [the subscriber] sends out more material so we can check our logs again." Id. at 2.
On October 8, 2009, Griggs emailed Agent Boone. Griggs informed Agent Boone that Knology was still working to determine the subscriber information for IP address 184.108.40.206, but that it appeared that the subscriber had not been online since September 28, 2009. Griggs suggested that the subscriber had unplugged his modem or was using a spoofed IP address. Griggs also indicated that Knology technicians had recorded the subscriber's home computer MAC address as 00:1e:ec:2e:cc:36 and were keeping an eye out for it. Finally, Griggs asked Agent Boone to notify him immediately if the subscriber started his activity again. Id. at 1. It is unclear from Exhibit 2 whether Griggs forwarded the previous chain of emails to Agent Boone at this time. Agent Boone testified that he received some of the emails on this day. Agent Boone replied to Griggs on October 9, 2009, saying that he had seen the subscriber on the system "on 10-6-09 at 1307 (퍍), 10-5-09 at 10:59 (퍍), 10-3-09 at 00:51 (퍍)." Id. at 1. Agent Boone also informed Griggs that he had captured that the subscriber was using port number 22662 for file-sharing software. Id.
Finally, on October 12, 2009, Griggs sent Agent Boone an email saying, "[h]ere is the info for the IP address '220.127.116.11' for the date of 10/06/2009. The same user is assigned the same IP address today (also included in the log)." Id. at 1. Griggs attached a document containing Nelson's subscriber information and DHCP logs for IP address 18.104.22.168 on October 6, 2009, and October 12, 2009, to this email. The attachment, which was introduced into evidence as Exhibit 7, does not include DHCP logs for September 28, 2009. Agent Boone received the entire chain of emails in Exhibit 2 on October 12, 2009.
On November 2, 2009, Agent Boone created an affidavit in support of a request for a search warrant for Nelson's residence at 6161/2 Locust St., Yankton, SD 57078. See Exhibit 5. Agent Boone described his background in investigating child pornography offenses and stated,
[o]n September 28, 2009, . . . I was able to identify a computer at an IP address that appeared to be offering files consistent with child pornography for distribution. This can be done as IP addresses are often a temporary number issued to a computer on a network and after the IP address is no longer in use, it is reassigned to another computer. This is illustrated by having to subpoena an Internet Service Provider for an exact date/time pertaining to an IP address for an investigation.
Id. at NELSON-0026. Agent Boone further stated that the "IP address that was offering files consistent with child pornography for distribution was 22.214.171.124 on 9-28-09 at 00:46AM GMT (퍍)." Id. at NELSON-0027. Agent Boone attested that he conducted an IP history check and obtained an IP history for IP address 126.96.36.199 that indicated the dates, times, file names, IP address, port number, and hash value for the known or suspected images consistent with child pornography that were seen on file-sharing software at that IP address. Id. Agent Boone also stated that he used the American Registry for Internet Numbers and learned that the IP address was issued to Knology in Yankton, South Dakota. Id.
Then, Agent Boone explained, "[o]n September 30, 2009, I served legal process to Knology for the IP address 188.8.131.52 at the dates and times provided to me by the Wyoming ICAC database for the images consistent with child pornography being offered for distribution on the Gnutella network." Id. And in the paragraph at issue in this case, Agent Boone stated, "[o]n October 12, 2009, Knology responded with information stating that IP address 184.108.40.206 was subscribed to by JEREMY NELSON at 616 1/2 Locust St, Yankton, SD 57078 on the dates and times requested." Id. Agent Boone then described the content of several files he observed in the IP history for IP address 220.127.116.11. Id. at NELSON-0027 to -0028. The affidavit does not mention port numbers or MAC addresses or discuss the relationship between a MAC address and an IP address.
Both Agent Boone and Daryl Elcock, network manager for the Sioux Falls division of Knology, testified at length at the evidentiary hearing about the content of the DHCP logs for IP address 18.104.22.168.*fn3 Agent Boone and Elcock testified that the subscriber information for IP address 22.214.171.124 could be determined from the DHCP logs by tracing the MAC addresses of the host modem and the personal computer associated with this IP address. The IP address 126.96.36.199 appears in the DHCP logs for September 28, 2009, October 6, 2009, and October 12, 2009. Exhibit 2 at 4; Exhibit 7. Further, the October 6, 2009, and October 12, 2009, DHCP logs indicate that the host modem had MAC address 00:1E:46:BE:D3:EC. See Exhibit 7. This means that the DHCP logs recorded the activity of the modem with this MAC address as well as the computer that accessed the Internet via this modem. Knology identified Nelson as the subscriber using a cable modem with MAC address 00:1E:46:BE:D3:EC. Id. Finally, the MAC address for the subscriber's computer, 00:1e:ec:2e:cc:36, appears under the heading, "[t]he DHCP logs show the following modem host," on Exhibit 7. The same MAC address appears in the DHCP logs for September 28, 2009, October 6, 2009, and October 12, 2009. Exhibit 2 at 4; Exhibit 7.*fn4 Elcock testified that he could tell from the DHCP logs for September 28, 2009, and October 6, 2009, that the same computer used the same modem on both dates.
The key issue in this case is whether Agent Boone's statement in the affidavit that "[o]n October 12, 2009, Knology responded with information stating that IP address 188.8.131.52 was subscribed to by JEREMY NELSON . . . on the dates and times requested," was false. Agent Boone repeatedly testified that the basis for this statement was his analysis of the information Knology sent him in the email chain, including the DHCP logs, as well as the results of the IP history he gathered in the case. For example, Agent Boone testified, "[b]ased on what Knology had sent me in the e-mail and the log file, and based on . . . the IP history that I used for this case, I knew that there was only one computer that would be responsible for the distribution of the child pornography images in this case." Tr. 35-36. He further explained,
[b]ased on the . . . DHCP log that contained the MAC address of the modem, the MAC address of the computer, and based on the IP history that I had run through the Wyoming database, I knew that that particular computer was sharing child pornography at one IP address and at one port number, and sharing the same files over that 15 days time stretch ...