Opinion
No. 20-10098 No. 20-10101
12-21-2022
UNITED STATES of America, Plaintiff-Appellee, v. Joshua Ray FISHER, Defendant-Appellant. United States of America, Plaintiff-Appellee, v. Justin Anthony Fisher, Defendant-Appellant.
Michael A. Humphreys, Paul Padda Law PLLC, Las Vegas, Nevada; Daniel J. Hill, Hill Firm PLLC, Las Vegas, Nevada; for Defendant-Appellant. Daniel D. Hollingsworth ; Christopher F. Burton and Richard A. Lopez, Assistant United States Attorneys; Jason M. Frierson, United States Attorney; Elizabeth O. White, Appellate Chief, Office of the United States Attorney, Las Vegas, Nevada; Robert L. Ellman, Assistant United States Attorney, Office of the United States Attorney, Reno, Nevada; for Plaintiff-Appellee.
Michael A. Humphreys, Paul Padda Law PLLC, Las Vegas, Nevada; Daniel J. Hill, Hill Firm PLLC, Las Vegas, Nevada; for Defendant-Appellant.
Daniel D. Hollingsworth ; Christopher F. Burton and Richard A. Lopez, Assistant United States Attorneys; Jason M. Frierson, United States Attorney; Elizabeth O. White, Appellate Chief, Office of the United States Attorney, Las Vegas, Nevada; Robert L. Ellman, Assistant United States Attorney, Office of the United States Attorney, Reno, Nevada; for Plaintiff-Appellee.
Before: Susan P. Graber, Evan J. Wallach, and Paul J. Watford, Circuit Judges.
The Honorable Evan J. Wallach, United States Circuit Judge for the U.S. Court of Appeals for the Federal Circuit, sitting by designation.
Opinion by Judge Wallach;
Concurrence by Judge Graber
WALLACH, Circuit Judge:
Defendants-Appellants Justin and Joshua Fisher ("Defendants") challenge their convictions under the Fourth Amendment of the U.S. Constitution. Before us is Defendants' joint appeal from two orders by the U.S. District Court for the District of Nevada, denying their joint motions to suppress evidence. The evidence obtained from two searches, occurring in 2016 and 2018, led to Defendants being charged with multiple federal offenses concerning the sexual exploitation of children and child pornography.
Defendants first argue that the district court erred in denying their first motion to suppress because the affidavit supporting the probable cause search warrant for Defendant Justin Fisher's residence contained material, intentionally false and/or reckless statements and omissions that misled the issuing judge.
Defendants further argue that the district court erred in denying their second motion to suppress for lack of standing because, contrary to the district court's finding, Defendants had not abandoned certain technological devices seized from the residence after it was sold to a new owner.
We have jurisdiction under 28 U.S.C. § 1291, and we affirm.
28 U.S.C. § 1291 provides that the courts of appeal "shall have jurisdiction of appeals from all final decisions of the district courts of the United States."
I
As is relevant to this appeal, Defendants Justin Fisher and Joshua Fisher, brothers, were charged in a second superseding criminal indictment returned March 12, 2019. Justin Fisher was charged with nine counts, and Joshua Fisher was charged with six counts, all for various sexual offenses against children. Defendants entered conditional guilty pleas, pursuant to plea agreements, on July 19, 2019.
On March 5, 2020, the district court entered final judgments against Defendants, sentencing Justin Fisher to 360 months' imprisonment, and Joshua Fisher to 300 months' imprisonment. Defendants' timely notices of appeal followed.
A
1. The Tumblr Report and CyberTipline Report
On April 27, 2016, the social media website Tumblr sent a report to the National Center for Missing and Exploited Children ("NCMEC"), which caused NCMEC to generate a "CyberTipline Report" or "CyberTip" documenting the incident. The CyberTip identified the "Incident Type" as "Child Pornography (possession, manufacture, and distribution)," based on eight files (videos and images) that had been uploaded to a Tumblr user's blog. The "Incident Time"—that is, "when this report was created in Tumblr's system"—was April 19, 2016, at 14:14:40 UTC (2:14 PM UTC).
NCMEC is "a national clearinghouse and resource center ... on missing and sexually exploited child issues."
The parties agree that files were uploaded to the Tumblr blog on or before April 19, 2016, though the Government argues, as a point of factual distinction, that the "Incident Time" is not the time of upload, but rather, the time of Tumblr's report generation.
Tumblr identified, as the "User or Person Being Reported," the username "mcw," profile URL "mcw.tumblr.com," and associated email address "mcwarson@gmail.com." The user IP Address was 50.118.198.254 (Other), but Tumblr also identified a second IP address, 24.253.48.163, which accounted for four of the "Suspect's" five most recent logins, as of the "Incident Time." The physical location of IP 50.118.198.254 ("Computer 254") resolved to the geographical area of San Jose, California, identifying, as the Internet Service Provider ("ISP/Org") "EGIHosting/Areti Internet." IP 24.253.48.163 ("Computer 163") resolved to Las Vegas, Nevada, identifying Cox Communications as the Internet Service Provider.
Tumblr reported the "last logins" as those occurring between March 16, 2016, and April 18, 2016. The April 18, 2016 login was from Computer 254.
In Section C of NCMEC's CyberTipline Report, "Additional Information Provided by NCMEC," NCMEC identified an "Associated CyberTipline Report," which appeared "to contain supplemental IP information for the reported Tumblr profile in the current report." The second Report appeared in search results for "mcwarson" and "24.253.48.163."
Accordingly, the CyberTipline Report in this matter concluded that, "[b]ased on IP 24.253.48.163," the matter should be forwarded to the Nevada Internet Crimes Against Children ("ICAC") Task Force for investigation.
2. Detective Miller's Investigation
Detective Scott Miller of the Las Vegas Metropolitan Police Department's ("LVMPD") ICAC received, reviewed, and further investigated the NCMEC's CyberTipline Report. Thereafter (but before Detective Miller prepared the affidavit challenged by Defendants here), the LVMPD sought information from Tumblr and Cox Communications regarding IP 24.253.48.163/Computer 163.
Specifically, on May 28, 2016, the LVMPD served an administrative subpoena on Cox Communications, commanding the company to produce customer records for Computer 163 as of the Incident Date (April 19, 2016). On June 14, 2016, Cox Communications responded to the administrative subpoena, identifying the customer associated with Computer 163 as Justin Fisher at an address on Burkehaven Avenue in Las Vegas, Nevada (the "Burkehaven Avenue Residence").
Further, on July 1, 2016, Detective Miller sought and obtained a search warrant on Tumblr. The affidavit identified "the following digital data" that was "sought to be seized":
The "Probable Cause Offering" section of Detective Miller's affidavit served on Tumblr described the information sent by Tumblr to NCMEC as follows: "Tumblr reported the user uploaded 8 images/videos of child sexual exploitation. Tumblr provided the following information regarding the user: IP Address 50.118.198.254 and 24.253.48.163...." It also described the information regarding Justin Fisher's account, home address, and other information provided by Cox Communications and corroborated by "[a] routine records check."
All Tumblr account information for the following user on / or between the dates of April 19, 2016 through July 01, 2016 :
IP Address: 50.118.198.254 and 24.253.48.163Date of Incident: April 19, 2016 at 14:14:00 UTCEmail Address: mcwarson@gmail.com Screen/User Name: mcwProfile URL: https://mcw.tumblr.com
Tumblr responded on September 16, 2016, with a flash-drive of files collected from mcw.tumblr.com and a list of recent logins. As identified by LVMPD, the flash drive "contained 40 additional images of child exploitation" and "200-plus age-difficult child erotica" images from the Tumblr blog. The only login listed for the mcw account from April 19, 2016 onward was a login from Computer 163 on April 19, 2016 at 10:40 AM UTC—i.e. , a few hours prior to the time at which Tumblr generated its report to NCMEC. ("Incident Time: 04-19-2016 14:14:00 UTC"). 3. The 2016 Search Warrant
On November 16, 2016, Detective Miller sought and obtained a search warrant for Joshua Fisher's residence. Detective Miller's affidavit in support of the search warrant stated that there was "probable cause to believe that certain property hereinafter described will be found at [the Burkehaven Avenue address]."
In the Synopsis section, Detective Miller stated that
On or about April 27, 2016, the [NCMEC] received a report from Tumblr reference [sic] a possible transmission of child pornography. Tumblr reported a user; "mcw", screen/user name of mcw, and an IP address of 24.253.48.163 uploaded 8 child exploitation images on their Tumblr account. Affiant viewed said image [sic] of child sexual exploitation and deemed 2 images to be child pornographic in nature.
A search warrant was served on Tumblr reference [sic] above account which resulted in numerous other images/videos of child exploitation being discovered.
This investigation conducted by Affiant has traced this child sexual exploitation computer activity of child pornography to [the Burkehaven Avenue Residence], where Affiant expects to find computer / digital evidence of these crimes.
The "Probable Cause Offering" section of the affidavit described the sequence of relevant events beginning with Tumblr's identification of the two IP addresses (50.118.198.254 and 24.253.48.163) associated with a "user [who] uploaded 8 images/videos of child sexual exploitation," the subsequent CyberTip/NCMEC's Report, the LVMPD's investigation, the administrative subpoena on Cox Communications, additional records collection including the identification of Justin Fisher and his residence, and the July 1, 2016 search warrant served on Tumblr. Detective Miller described the July 1, 2016 search warrant, and Tumblr's response, as follows:
On July 01, 2016, a search warrant was served on Tumblr for all account information regarding Tumblr account: mcwarson@gmail.com, IP address 24.253.48.163, user name: mcw.
On September 16, 2016, Tumblr responded to said search warrant with numerous other images/videos of child exploitation. Affiant viewed these images/videos and deemed over 40 of them to be child pornography....
A justice of the peace for Clark County, Nevada, determined that Detective Miller's affidavit presented sufficient evidence for a finding of probable cause, and issued the search warrant.
4. The 2016 Search
The search of Justin Fisher's Burkehaven Avenue Residence was executed on November 21, 2016. Various technological devices were seized from the premises. Joshua Fisher "approached the residence on foot" while the search was ongoing, "stating that he worked out of the residence where the search warrant was being executed." He turned over a cell phone to the NVMPD ICAC team. NVMPD obtained a search warrant for the phone on November 23, 2016.
FBI Special Agent Sue Flaherty recited these facts in her affidavit in support of the warrant obtained to search devices collected from Burkehaven Avenue Residence during the July 2018 search, which is the subject of Defendants' second motion to suppress. This warrant was obtained after the new homeowner who purchased the home from Justin Fisher in September 2017 consented to a search of the premises.
Forensic analysis of the devices obtained from Defendants (forty-eight in total) resulted in the recovery of evidence of child sexual exploitation offenses. According to the Government, "[t]his evidence led to Counts 1-5 and 7-12 in the second superseding indictment." Defendants were detained on federal Criminal Complaints as of February 15, 2017 (Justin Fisher) and April 7, 2017 (Joshua Fisher).
5. First Motion to Suppress
On August 10, 2017, Justin Fisher moved to suppress "all tangible evidence, and the fruits thereof" obtained from the November 21, 2016 search warrant. Joshua Fisher joined this Motion on January 1, 2018.
By their Motion, Defendants asserted their entitlement to an evidentiary hearing under Franks v. Delaware , alleging intentional and/or reckless omissions and misstatements—which they claimed were material to a finding of probable cause—in Detective Miller's affidavit. U.S. Magistrate Judge George Foley considered the Motion to Suppress and, upon review of Detective Miller's affidavit in support of the November 21, 2016 search warrant, found that there were false statements and omissions contained in the affidavit.
Franks sets forth the standard by which a defendant may overcome the "presumption of validity with respect to the affidavit supporting the search warrant." 438 U.S. 154, 171, 98 S.Ct. 2674, 57 L.Ed.2d 667 (1978) ; see also United States v. Norris , 942 F.3d 902, 909–10 (9th Cir. 2019) ("To obtain a Franks hearing, a defendant must make a substantial preliminary showing that: (1) ‘the affiant officer intentionally or recklessly made false or misleading statements or omissions in support of the warrant,’ and (2) ‘the false or misleading statement or omission was material, i.e. , necessary to finding probable cause.’ " (quoting United States v. Perkins , 850 F.3d 1109, 1116 (9th Cir. 2017) )).
Judge Foley's analysis primarily concerned the contents of the CyberTipline Report. Judge Foley acknowledged that the evidence obtained from the July 1, 2016 Tumblr search warrant might provide probable cause "separate and apart from the information regarding the Tumblr Cybertip report," but he declined to rule on the question for the time being.
Judge Foley then concluded that an evidentiary hearing was warranted under the Franks rule to determine "whether the false statements and omissions in Detective Miller's affidavit were intentionally or recklessly made, and, if so, whether the balance of the information in the affidavit still supports a finding of probable cause."
The evidentiary hearing was conducted on March 15, 2019. Thereafter, Magistrate Judge Foley issued his Findings and Recommendation, recommending that Defendants' Motion to Suppress be denied.
In his Findings and Recommendation, Judge Foley determined that the Synopsis of Detective Miller's affidavit contained an "untrue and misleading" statement that "Tumblr reported a user; ‘mcw’, screen/user name of mcw, and IP address of 24.253.48.163 uploaded 8 child exploitation images on their Tumblr account." Judge Foley believed that this statement conveyed as fact "that Tumblr had affirmatively made such statement to NCMEC," when the statement "was actually Detective Miller's conclusion based on his analysis of the CyberTipline Report and the information that Tumblr provided in response to the search warrant." Judge Foley determined, however, that
Detective Miller's statement would not have been problematical if he had clearly identified it as his opinion or conclusion , and had included in the affidavit all of the relevant facts that the issuing judge would need to independently determine whether there was probable cause to believe that images of child
pornography had been uploaded from IP address 24.253.48.163. (emphasis added).
Further, Magistrate Foley pointed to omissions he perceived in the affidavit, including the login dates for Computer 163, the April 18, 2016 login from Computer 254, or "the information in Tumblr's response to the search warrant that someone using IP Address 24.253.48.163 logged into the Tumblr account on April 19, 2016 at 10:40, which occurred only a few hours before the ‘Incident Time’ of 14:14:00 UTC reported in the CyberTipline Report."
Judge Foley noted that "[t]here is no disagreement that the IP address login times indicate only when someone logged into the Tumblr account from a particular IP Address. They do not establish when or if a user actually uploaded images to the Tumblr account."
At the evidentiary hearing, Detective Miller testified to his belief that the images provided by Tumblr (via flash drive) were uploaded from Computer 163 because Computer 254 was an "encrypted" virtual private network (VPN), from which uploaded data could not have been recovered. Detective Miller affirmatively testified that the flash drive stated that its contents were recovered from Computer 163. The flash drive itself was not produced at the hearing because of the nature of its contents. Judge Foley remained unconvinced that, merely because a VPN was "encrypted," "a person logging into the Tumblr account through that VPN IP address could not upload the child pornography images to the Tumblr account.... No evidence was presented at the hearing that information had been uploaded to the Tumblr account that could not be ‘opened’ because it was encrypted."
Nevertheless, once Judge Foley had considered how Detective Miller's affidavit would have been supplemented and/or corrected to reflect "all of the relevant and material information, ... there would still have been probable cause to believe that the child pornography images were uploaded to Tumblr from IP address 24.253.48.163, most likely on April 19, 2016 in close proximity to when Tumblr discovered the uploading of suspect images."
On de novo review of Defendants' Motion to Suppress and related papers, the district court agreed with Magistrate Judge Foley's recommendation that the Motion be denied, but modified Judge Foley's Findings and Recommendations in part. The district court reviewed Defendants' proposed supplemental statements to determine whether Detective Miller's affidavit—if so supplemented—would support probable cause. Essentially, Defendants' proposed additions were aimed at modifying the affidavit's representations as to which IP addresses made the upload of incriminating files.
The district court declined to make any of Defendants' proposed changes, because it concluded that Defendants' supplemental information was inaccurate, incomplete, and immaterial to the probable cause determination. Although the district court determined that Detective Miller's affidavit contained some potentially misleading statements, it concluded that
Miller's subsequent investigation—especially the Tumblr response to the search warrant—confirmed that IP address 24.253.48.163 was tied to the incident and uploaded the subject images.... [C]onsidered in its entirety, the affidavit was not misleading. Det. Miller summarized the chain of his investigation, including the results of the search warrants and subpoena he obtained. That investigation supported probable cause to issue the search warrant for the Burkehaven house.
Further, the district court identified supplementing changes that might be made if it found the affidavit misleading as prepared: e.g. , changing the Synopsis and Probable Cause Offering sections to indicate that Tumblr listed IP 50.118.198.254 (Other) in its proffered user information for the Tumblr blog mcw. The court determined, however, that no such supplement would undermine the sufficiency of probable cause in the affidavit. In sum, the court concluded that "the affidavit still supports a finding of probable cause because of the other information obtained from the search warrants and subpoena that linked the child pornography to IP address 24.253.48.163." The district court emphasized two facts in its conclusion drawn from Tumblr's response to the July 1, 2016 warrant: first, that the only IP address logged in at the "Incident Time" was 24.253.48.163, and second, that Tumblr provided the flash drive of additional files (including forty that were child pornography) that were uploaded after the "Incident Time."
Accordingly, the district court denied Defendants' Motion to Suppress.
The district court also stated that, contrary to Magistrate Judge Foley's determination, it would not have granted Defendants' motion for an evidentiary hearing.
B
1. The 2018 Search
On September 15, 2017, Justin Fisher—while in custody—sold the Burkehaven Avenue Residence to new owners. On July 9, 2018, the new homeowner (referred to in the record below as "T") contacted the Las Vegas, Nevada FBI office. T informed the FBI that he had learned from his neighbors that the Burkehaven Avenue Residence had been searched in connection with the previous owner's criminal activity.
On July 12, 2018, Detective Miller—who had received T's contact information—reached out to T and informed him of certain telephone conversations between Defendants. These conversations involved Defendants discussing, at times in code, the location of personal property apparently concealed in the Burkehaven Avenue Residence. Defendants had enlisted the help of another brother (referred to in the record below as "E") to search the Burkehaven Avenue Residence to recover the property, but E's attempts were unsuccessful.
These conversations were held in violation of a no-contact order, obtained by the Government, that was in place at the time.
T gave Detective Miller consent to search the upstairs attic crawl space. "[C]oncealed between the insulation and the wood framing" of the attic crawlspace, Detective Miller located "a black cellular telephone and two portable SSD drives." Thereafter, FBI Special Agent Sue Flaherty sought and obtained a warrant to search the recovered devices. According to the Government, "[t]he search warrant was executed and revealed that the brothers had compiled and curated evidence of their sexual exploitation of children and compiled it onto the three devices found in the attic."
2. Second Motion to Suppress
On November 7, 2018, Defendants moved to suppress the evidence obtained in the 2018 search, arguing that the evidence was "fruit of the poisonous tree"—i.e. , that it was a direct result of the 2016 search, which they were simultaneously contending was unlawful. The Government argued, in opposition, that Defendants had abandoned the personal property at issue, and thus, they lacked standing to seek suppression. Judge Foley issued his Findings and Recommendations on December 14, 2018, concluding, after conducting a "totality of the circumstances" abandonment analysis, that Defendants' second Motion to Suppress should be denied for lack of standing.
The evidentiary hearing regarding Defendants' first Motion to Suppress had not yet been held at the time that Magistrate Judge Foley issued his Findings and Recommendation on their second Motion.
The Government also argued that, even if Defendants had not abandoned the property seized in the 2018 search, and even if the 2016 search was unlawful, the fruits of the 2018 search were too attenuated to be excluded pursuant to the "fruits of the poisonous tree" doctrine. While attenuation is a recognized exception to the "fruits of the poisonous tree" doctrine, Magistrate Judge Foley did not reach this argument because he based his Findings and Recommendation on the issue of standing.
Judge Foley's reasoning was based on Defendants' communications with their brother E, wherein Justin "instructed ‘E’ to remove the items from the house before it was sold" and Joshua inquired "as to whether he had found and removed the items." When E was unsuccessful in recovering any items, "Defendants made no further effort to recover the items after the house was sold and was in possession of a new owner with whom Defendants had no relationship." Nine months passed between the sale and new owner T's contact with the FBI and Detective Miller. Judge Foley found it "reasonable to infer" that Defendants made the decision to abandon the items rather than risk detection of further incriminating evidence by pursuing their recovery. This was sufficient for Judge Foley to find abandonment "by a preponderance of the evidence" and recommend denial of Defendants' second Motion to Suppress for lack of standing.
On de novo review, the district court adopted Magistrate Judge Foley's Findings and Recommendation in its entirety. The district court concluded that Defendants' concealment of the items prior to sale of the Burkehaven Avenue Residence made no difference as to the abandonment determination because "no efforts were made to retrieve the items after the house was sold in September 2017 until the items were seized by the Government in July 2018." Accordingly, the district court ruled that Defendants "abandoned the items after the house was sold," and the subsequent search and seizure of the personal property concealed there did not violate their Fourth Amendment rights.
II
We review a district court's denial of a motion to suppress evidence and its determination of validity of a search warrant de novo . United States v. Underwood , 725 F.3d 1076, 1081 (9th Cir. 2013). We review the district court's factual findings for clear error. United States v. Monghur , 588 F.3d 975, 978 (9th Cir. 2009) ; see also United States v. Todhunter , 297 F.3d 886, 889 (9th Cir. 2002) ("We may affirm the denial of a motion to suppress ‘on any basis fairly supported by the record.’ " (quoting United States v. Mariscal , 285 F.3d 1127, 1129 (9th Cir. 2002) )). Further, "[w]e give ‘great deference’ to an issuing judge's finding that probable cause supports a warrant and review such findings for clear error." Underwood , 725 F.3d at 1081 (quoting United States v. Krupa , 658 F.3d 1174, 1177 (9th Cir. 2011) ).
Whether defendants have standing to challenge a search is a mixed question of law and fact. United States v. Sarkisian , 197 F.3d 966, 986 (9th Cir. 1999). We review "the district court's ultimate legal conclusion" as to standing de novo and its underlying factual findings for clear error. Id. (citation omitted).
III
The Fourth Amendment dictates that "no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." U.S. CONST. amend. IV. "The task of the issuing magistrate is simply to make a practical, common-sense decision whether, given all the circumstances set forth in the affidavit before him, ... there is a fair probability that contraband or evidence of a crime will be found in a particular place." Illinois v. Gates , 462 U.S. 213, 238, 103 S.Ct. 2317, 76 L.Ed.2d 527 (1983).
Evidence obtained during the execution of a warrant that lacks probable cause "should generally be suppressed under the exclusionary rule." Underwood , 725 F.3d at 1084 (citations omitted).
We consider each of the district court's denials of Defendants' motions to suppress in turn. We affirm the district court's denial of Defendants' first motion to suppress because Detective Miller's affidavit in support of the November 21, 2016 search warrant did not contain material misstatements or omissions. We also affirm the district court's denial of Defendants' second motion to suppress for lack of standing because Defendants abandoned the devices that were seized and searched.
A
Defendants first contend that probable cause did not exist to support the November 21, 2016 search warrant by arguing that Detective Miller's affidavit "only established probable cause through knowing and intentional deception or, at best, recklessness to the truth or falsity of the information."
According to Defendants, Detective Miller's affidavit misstated the contents of the CyberTipline Report, drew conclusions unsupported by the Report, "and ignored factors exculpatory to [Defendants]." Defendants contend that the affidavit "misquote[s]" the Report by "identify[ing] the guilty party as ‘user mcw screen/user name of mcw and an IP address of 24.253.163 [sic] [which] uploaded 8 child exploitation images on their Tumblr account," when in fact, the "sub-heading" of the CyberTipline Report labeled "the guilty device" as the computer with the IP address 50.118.198.254. Defendants argue that "[t]his is a mindful, purposeful substitution of one party (Computer 163) for another party (Computer 254), or, at the very least, a reckless disregard to the truth or falsity that Computer 163 was identified as culpable."
Under the preponderance of the evidence standard set forth in Franks , Defendants contend that the false statements made by Detective Miller with respect to which IP address made the upload, and the "key material omission" he made by "fail[ing] to disclose that the last reported IP address login prior to the ‘incident’ was from IP address 50.118.198.254," misled the issuing judge.
The preponderance of the evidence is the standard Defendants must meet to show that the affidavit supporting a warrant is materially misleading, not the standard for a finding of probable cause. See Franks , 438 U.S. at 156, 98 S.Ct. 2674 ("In the event that at that hearing the allegation of perjury or reckless disregard is established by the defendant by a preponderance of the evidence ...."); Krupa , 658 F.3d at 1177–78 (citations omitted) ("Whether there is a fair probability depends upon the totality of the circumstances, including reasonable inferences, and is a ‘commonsense, practical question,’ for which ‘[n]either certainty nor a preponderance of the evidence is required.’ ") (cleaned up).
We find Defendants' arguments challenging denial of their first Motion to Suppress to be unavailing. As a general matter, "[p]robable cause exists if ‘it would be reasonable to seek the evidence in the place indicated in the affidavit.’ " United States v. Wong , 334 F.3d 831, 836 (9th Cir. 2003) (citation omitted). Reasonableness is determined by an examination of "the ‘totality of the circumstances’ in a ‘common-sense’ manner." United States v. Mayer , 560 F.3d 948, 956 (9th Cir. 2009) (citation omitted). It is true that the deference we accord to an issuing judge's determination of probable cause "does not preclude inquiry into the knowing or reckless falsity of the affidavit on which that determination was based." United States v. Leon , 468 U.S. 897, 914, 104 S.Ct. 3405, 82 L.Ed.2d 677 (1984) ; see also Underwood , 725 F.3d at 1081 (citation omitted) ("Conclusions of the affiant unsupported by underlying facts cannot be used to establish probable cause.").
Here, however, Defendants fail to point to any misstatements or omissions in Detective Miller's affidavit that, if stricken or supplemented, would undermine the reasonableness of the ultimate probable cause determination. Defendants misstate the factual record by insisting that IP 50.118.198.254 was the only relevant IP address. It is readily apparent from the CyberTipline Report that Computer 163—Defendants' computer—was also identified as associated with the suspect Tumblr account. Indeed, the CyberTipline Report stated that, "[b]ased on IP 24.253.48.163"—not 50.118.198.254—the matter should be forwarded for investigation to the Nevada Internet Crimes Against Children ("ICAC") Task Force. Moreover, in his affidavit, Detective Miller did not omit any mention of Computer 254, but rather, emphasized the relevance of Computer 163—a conclusion that he based on the CyberTipline Report and his own investigation into the origin of each IP address. ("Probable Cause Offering").
Related to their other IP-address-related arguments, Defendants contend that Detective Miller's affidavit contained a misleading statement under the section heading "Computers, Technology and Digital Forensics," when he stated that he "has personally viewed files identical to the ones on a computer using Public IP address 24.253.48.163 and determined them to be child pornography." For Defendants, Detective Miller's statement "leaves the reader (especially a county judge who might be unfamiliar with the arcane terminology and concepts of digital communications connected to cyber-crime investigations) with the distinct impression that Det. Miller had physically examined the files on Computer 163" and identified them as child pornography.
The Government argues that this argument was not raised in the district court, and is therefore waived, citing United States v. Peterson , 995 F.3d 1061, 1068 (9th Cir. 2021). A review of Defendants' motion papers below, however, indicates that they did quote the same language for the purpose of contesting its accuracy. Although this argument is before us on appeal, we dispense with it as an obvious misreading of the text of Detective Miller's affidavit. Detective Miller does not say that he "physically examined the files on Computer 163," since he was, as the Government asserts, seeking to gain access to those very files. Rather, he was "merely summariz[ing] what the rest of his search warrant asserts, namely that he had traced child pornography offenses to the Nevada IP address and therefore expected to find additional evidence on digital devices at the physical location associated with that IP address."
Further, at the time Detective Miller prepared his affidavit, he had already received a response to the July 1, 2016 search warrant served on Tumblr, which showed that the most recent login to the "mcw" account was from Computer 163. While this particular fact—the last login as of the incident time—was not explicitly included in Detective Miller's affidavit, Defendants cannot plausibly argue that Detective Miller's affidavit should be corrected to indicate that the most recent login as of the "Incident Time" was from Computer 254, since that change itself would be inaccurate based on the record before us.
Moreover, Defendants do not substantively address the results from the July 1, 2016 Tumblr search warrant, referenced in Detective Miller's affidavit, which further supports the issuing judge's probable cause determination and the district court's denial of Defendants' first Motion to Suppress.
Defendants do not acknowledge that Detective Miller's affidavit discussed the response that Tumblr provided to the July 1, 2016 search warrant (not an administrative subpoena). That search warrant, which requested all account information on or between the dates of April 19, 2016 (the "Incident Date") and July 1, 2016, resulted in a response from Tumblr indicating that Computer 163 was logged in mere hours before the "Incident Time," and that additional files, later determined to be child pornography/child sexual exploitation material, were uploaded to the blog. Based on the date range requested, it can be inferred that the additional files were uploaded on or after April 19, 2016, at which time Computer 163 was the last logged-in IP address. Indeed, the district court relied on these very facts in reaching its conclusions that Defendants' proposed additions to Detective Miller's affidavit were inaccurate, unnecessary, or immaterial.
Defendants' failure to address the relevance of these facts and their bearing on the accuracy of any proposed alterations to Detective Miller's affidavit, further undermines their arguments on appeal.
Thus, this is not a case where the warrant "rest[s] upon mere affirmance or belief without disclosure of supporting facts or circumstances." Underwood , 725 F.3d at 1081 (quoting United States v. Dubrofsky , 581 F.2d 208, 212 (9th Cir. 1978) ). Detective Miller's affidavit conveys his fact-based understanding of the most relevant IP address identified by Tumblr and NCMEC—Computer 163—and describes the sequence of events, including his investigation between the time that he was assigned the CyberTipline Report and the time that he sought a warrant for the Burkehaven Avenue Residence. Having reviewed the affidavit and supporting evidence—the same evidence that Defendants highlight to contradict Detective Miller's statements—we cannot say that the "issuing judge lacked a substantial basis for concluding that probable cause existed." Underwood , 725 F.3d at 1081 (cleaned up). Rather, Detective Miller's affidavit, relying on the CyberTipline Report as well as the results of the Cox Communications subpoena and the Tumblr search warrant, established "a fair probability that ... evidence of a crime will be found in a particular place"—here, the Burkehaven Avenue Residence. Gates , 462 U.S. at 238, 103 S.Ct. 2317. Put another way, Defendants have pointed to no facts that would alter "the central basis" of the underlying probable cause determination. Underwood , 725 F.3d at 1081.
Since Defendants fail to show that Detective Miller's affidavit contained any material false statements or omissions (much less any such statements knowingly or recklessly made), there is no basis on which to find that the district court erred in its factfinding, or that the issuing judge was materially misled when reaching a probable cause determination. Accordingly, we affirm the district court's denial of Defendants' first Motion to Suppress.
B
We turn next to Defendants' appeal of the denial of their second Motion to Suppress. The district court did not reach the merits of this Motion because it determined—adopting Magistrate Judge Foley's Findings and Recommendation in its entirety—that Defendants lacked standing to challenge the search of certain devices recovered from the attic crawlspace of the Burkehaven Avenue Residence after the house was sold to new owners.
It is worth noting that, even if Defendants could establish their standing to challenge the 2018 search of the devices obtained from the Burkehaven Avenue Residence, their sole argument on appeal rests on the "fruit of the poisonous tree" doctrine. See, e.g. , United States v. Ngumezi , 980 F.3d 1285, 1290 (9th Cir. 2020) (citations omitted) ("The exclusionary rule generally applied in Fourth Amendment cases requires courts to suppress any evidence obtained as a ‘direct result of an illegal search or seizure,’ as well as ‘evidence later discovered and found to be derivative of an illegality, the so-called fruit of the poisonous tree.’ ") (cleaned up). Defendants argue that the 2018 search was unlawful because it would not have occurred but for the 2016 search, which they contend was unlawful based on Detective Miller's underlying affidavit. As discussed supra , we affirm the district court's denial of Defendants' first Motion, holding that Detective Miller's affidavit was not misleading, and that it established probable cause to search the Burkehaven Avenue Residence. Thus, were we to reach the Defendants' "fruit of the poisonous tree" argument regarding their second Motion, it would likewise fail.
To establish standing to challenge an illegal search and seek suppression of evidence unlawfully obtained, a defendant "must show that he personally had ‘a property interest protected by the Fourth Amendment that was interfered with ..., or a reasonable expectation of privacy that was invaded by the search.’ " United States v. Lopez-Cruz , 730 F.3d 803, 807 (9th Cir. 2013) (quoting United States v. Padilla , 111 F.3d 685, 688 (9th Cir. 1997) ). Where a defendant depends on a "reasonable expectation of privacy," two elements must be met: (1) that he had "an actual (subjective) expectation of privacy," and (2) that his subjective expectation is "objectively reasonable"—i.e. , that it is an expectation "that society is prepared to recognize as ‘reasonable.’ " Lopez-Cruz , 730 F.3d at 807 (citations omitted).
"[P]ersons who voluntarily abandon property lack standing to complain of its search or seizure." United States v. Nordling , 804 F.2d 1466, 1469 (9th Cir. 1986) (citation omitted). Abandonment is a factual determination that "is a question of intent." Id. That is, the factfinder's "inquiry should focus on whether, through words, acts or other objective indications, a person has relinquished a reasonable expectation of privacy in the property at the time of the search or seizure." Id.
We find that the district court did not clearly err by finding abandonment here, and accordingly, we conclude that Defendants lacked standing to challenge the 2018 search of the devices recovered from the Burkehaven Avenue Residence.
The district court found that one or both of the Defendants had, at some point prior to detention, concealed the recovered devices in the walls of the Burkehaven Avenue Residence attic. Thereafter, the district court determined that Defendants' intentions with respect to those devices changed, because "no efforts were made to retrieve the items after the house was sold in September 2017 until the items were seized by the Government in July 2018." Defendants argue on appeal that they did not intend to abandon the items because they
As Magistrate Judge Foley detailed in his Findings and Recommendation, Defendants initially took steps to retrieve the concealed devices by enlisting the help of their out-of-custody brother, E, "to remove something secret from the Burkehaven residence' when no one else was around" and before the home was sold. E was unable to discover the concealed items.
manifested a desire and concern to safeguard the items and keep them secure from accidental exposure or even an intentional search.... The effort to secret the items from prying and even searching eyes indicates their value to the owner.
Defendants further contend that they "had an ongoing interest in the devices even though they had no physical control over the devices. They were only not in physical possession of the devices (and their home) because of their arrest and subsequent incarceration."
This argument is unpersuasive. It is well-established in this Circuit's caselaw that property may be abandoned even when the defendant only abandons the property in response to, or in anticipation of, law enforcement action. See, e.g. , United States v. McLaughlin , 525 F.2d 517, 519–20 (9th Cir. 1975) (finding that contraband was abandoned property when it was thrown from a truck during law enforcement pursuit); Nordling , 804 F.2d at 1470 (emphasis added) (citation omitted) ("Nordling physically relinquished control of the tote bag when he left it on the airplane where anyone, including the PSA employee who found it in Seattle, could have access to it. That act of relinquishment, under the circumstances in which Nordling found himself , also supports an inference that he intended to abandon the bag.... While everyone who leaves luggage on an airplane cannot be said to have abandoned it, Nordling deliberately chose to leave the bag behind when requested by officers to leave the plane. ").
The district court's finding here was premised on Defendants' "acts [and] other objective indications" that they had decided to abandon the devices in the attic, thus relinquishing any reasonable expectation of privacy in them. Nordling , 804 F.2d at 1469. Specifically, the district court—and Magistrate Judge Foley—pointed to the lapse of more than nine months between the sale of the residence and the eventual search, during which the devices were recovered at the consent of the new homeowner, T. That Defendants concealed the devices, and initially attempted to recover them by enlisting their brother E's help, does not compel us to reach a different conclusion than the district court on either the facts or the law. "If one who has abandoned property from all outward appearances in fact has retained a subjective expectation of privacy, then a search of the property is nevertheless valid if that expectation is intrinsically unreasonable or not otherwise entitled to protection." United States v. Sledge , 650 F.2d 1075, 1080 (9th Cir. 1981).
As shown by the record, Defendants' failure to ensure that E recovered the devices before the home was sold, and their subsequent failure to take any additional action, is sufficient to support a finding of abandonment, even if Defendants ceased their efforts only because they feared detection by law enforcement. See United States v. Cella , 568 F.2d 1266, 1284 (9th Cir. 1977) ("[B]y telling [a third party] to destroy the [documents later seized], and failing to ensure that he did so, the defendants abandoned the materials and lost any reasonable expectation of privacy in them."); see also Nordling , 804 F.2d at 1470 ("Nordling disclaimed ownership and left the bag on the airplane in circumstances in which it was virtually certain that the bag would be opened, inspected and turned over to law enforcement authorities before he could possibly attempt to reexert physical control.").
Accordingly, we hold that the district court did not clearly err by finding that Defendants abandoned the devices seized in the 2018 search of the Burkehaven Avenue Residence. Because Defendants abandoned the devices, they lost any reasonable expectation of privacy in them, and lacked standing to seek suppression of the devices' contents. We therefore affirm the district court's denial of Defendants' second Motion to Suppress.
AFFIRMED.
GRABER, Circuit Judge, concurring in the judgment:
I concur in the judgment only.
1. The district court correctly denied Defendants' motion to suppress evidence derived from the November 2016 search warrant. The affidavit in support of the search warrant accurately reported that, in response to an earlier search warrant, Tumblr had provided dozens of images of child pornography linked directly to Defendants' computer and to Defendants' Tumblr account. Probable cause therefore existed, even assuming that we agreed with Defendants' arguments concerning the IP addresses. See, e.g., Ewing v. City of Stockton, 588 F.3d 1218, 1224 (9th Cir. 2009) (holding that, in reviewing a challenge to a search warrant, we ask whether probable cause exists after purging false statements and correcting misleading statements). I therefore would not reach the merits of the dispute about the IP addresses.
2. The district court correctly denied Defendants' motion to suppress evidence derived from the 2018 search warrant. Nine months after selling the house to a third party, Defendants lacked any reasonable expectation of privacy in items that they had left in house. See Smith v. Maryland, 442 U.S. 735, 740, 99 S.Ct. 2577, 61 L.Ed.2d 220 (1979) (reiterating that, to succeed in suppressing the fruits of a search, an individual first must have sought to preserve the items as private).