Facts
On December 21, 2016, Microsoft sent twenty-eight cybertips to the National Center for Missing and Exploited Children (NCMEC). All twenty-eight cybertips were generated as a result of Skype1 conversations between a Skype user with the username Qa.xi01 (Qa) and two other Skype users, Jasrob47 and jonesjason327. Twenty-eight images containing child exploitation material were uploaded and exchanged between these users. The cybertips generated by Microsoft included the Internet Protocol (IP) address that had been used in exchanging the images at issue.
On February 3, 2017, NCMEC sent all twenty-eight cybertips to the Mississippi Attorney General’s Office. The case was assigned to Investigator Wayne Lynch who served a grand jury subpoena on Comcast, the internet provider, for information regarding the IP address associated with the tips. The subpoena requested that Comcast identify the name and address of the party responsible for paying for the internet services associated with the IP address used to exchange the child exploitation material during the Skype chats on December 21, 2016. On June 15, 2017, Comcast identified Robert Ehrhardt as the person paying for the service associated with the IP address at issue, and identified the physical address for the IP address as 871 Willow Grand Circle, Brandon, Mississippi.
A search warrant was obtained in February of 2018 and executed on the Willow Grand Circle address. Twenty-four items were taken from Ehrhardt’s home, including computers, external hard drives, Amazon Echo devices, cameras with SD cards, an Apple iPhone, and an Apple iPad. Upon a forensic examination of these items, child exploitation material was found on an HP computer tower, a Hitachi hard drive, a Western Digital hard drive, an Apple iPhone, and an Apple iPad. Ehrhardt was found guilty of child exploitation in all five counts of the indictment and sentenced to 20 years in MDOC.
On appeal, he argued the items obtained via the search warrant should have been suppressed. MCOA affirmed.
Analysis
On February 20, 2018, Lynch presented an affidavit for a search warrant, along with a statement of underlying facts and circumstances, to a Rankin County justice court judge for authorization to search Ehrhardt’s home for electronic devices and evidence of child exploitation material. The search warrant was issued that day and was executed on February 22, 2018, by Lynch, Investigator Jay Houston, Investigator Jack Lilly, Investigator Rubisoff, and several deputies with the Rankin County Sheriff’s Office. Five of the devices seized during the search were found to contain child exploitation material.
Ehrhardt filed two motions to suppress evidence. First, Ehrhardt claimed that the evidence seized during the search of his home should be suppressed because the information relied upon by the State was stale. Next he argued the evidence should be suppressed because the State did not show that the information it received from other sources was reliable. We will address these issues separately below.
A. Staleness
Ehrhardt argues that the information supporting the issuance of the search warrant was stale because nearly fourteen months had passed between the date that the IP address was accessed as previously discussed, and the date that the search warrant was issued and executed. Ehrhardt points out that the State presented no evidence of any other illegal activity related to the IP address during that fourteen month period. Ehrhardt contends that there was nothing presented by the State to connect him to any illegal conduct, except for someone’s single, limited use of the IP address assigned to Ehrhardt’s home router over a year earlier. Ehrhardt urges this Court to find that, because there was no more recent information that supported the issuance of the search warrant, the information the State relied upon was stale and the evidence should have been suppressed.
Similarly, in Renfrow, Renfrow argued that there was no probable cause to issue a search warrant because the events that led the investigator to obtain the warrant occurred “nine or ten months” prior. This Court held: It was reasonable for the judge who issued the search warrant to conclude that images on a computer could still be recovered by forensic methods nine or ten months after the children saw them. . . . Accordingly, because the images were stored on a computer, the probable cause for the investigator’s search warrant was not rendered stale by the passage of time.
In this case, Lynch’s statement of underlying facts and circumstances represented to the justice court judge that the items sought in the warrant could be used as storage devices for the illegal images and/or could be used as an instrumentality to access the internet to either download or upload illegal images. The judge was further advised that “child pornographers” commonly store such images as computer files. Lynch described how a forensic examination could recover illegal images from devices even if they were “hidden, erased, compressed, password-protected, or encrypted filed.” Applying this Court’s decision in Renfrow to the facts of this case, Ehrhardt’s argument regarding the staleness of the information contained in the cybertips is without merit. It was reasonable for the judge to believe that any child exploitation material Ehrhardt had stored on his electronic devices at the time of the NCMEC cybertip could still be found on his devices at the time the warrant was issued.
B. Reliability
Ehrhardt argues that Lynch relied upon information provided by Microsoft and NCMEC to establish probable cause for the issuance of the search warrant for his residence. He contends that “while the agent verified the content of images prior to seeking the warrant, the process used by Microsoft to flag the images was never explained nor vouched for in the affidavit.” Because there was no evidence to support the reliability of the “cybertips,” Ehrhardt contends that his motion to suppress should have been granted.
Ehrhardt cites Woods, Chesney, and Roebuck. He also contends that because Lynch relied upon information provided by third parties and outside his personal knowledge, Lynch was required to establish that the information provided by Microsoft and NCMEC was credible or reliable before the justice court judge issued the warrant.
In Woods, the search warrant had been issued based upon information provided to law enforcement by a female who was dating Woods at the time. The female was unknown by law enforcement and had never been used as a confidential informant before. According to the female, she gave the information to law enforcement because “Woods ‘was doing wrong and . . . she wanted [the Unit] to take care of it for her.’”
In Roebuck, a search warrant was obtained based upon information that narcotics were being manufactured and sold at Roebuck’s residence. The search warrant was based upon information that law enforcement received from two unknown informants. On appeal, this Court found that neither the affidavit for a search warrant nor the oral testimony given to the issuing judge gave any information at all regarding the informants’ veracity or reliability. There was no evidence that they had proved to be reliable in the past, and there was insufficient efforts made to corroborate the information.
In Chesney, Police Chief Richard Sistrunk received information from John Paul Dove that Chesney was involved in an identity theft scheme. Although a victim of the scheme had made a complaint, the affidavit to obtain a search warrant for Chesney’s residence was based upon the information provided by Dove. In finding that the search warrant was not founded upon probable cause, this Court said: Based on the holdings in Woods and Roebuck, we find that the threshold requirements for probable cause, to support the issuance of the original search warrant, were not met. Chief Sistrunk admitted that he had only spoken with Dove a couple of times and that he had never met him. There was nothing in the affidavit, its underlying facts and circumstances, or the testimony to establish that the information provided by the informant was credible or reliable; nor was there any testimony that Chief Sistrunk attempted to corroborate Dove’s statement through an additional independent investigation.
This case is substantially different than those relied upon by Ehrhardt. Investigator Lynch prepared an affidavit for a search warrant and attached as Exhibit A a “Statement of Underlying Facts and Circumstances.” He presented these documents to the justice court judge in an effort to obtain a search warrant. He signed these documents under oath before the justice court judge and discussed the case with the judge under oath.
He advised the judge that his investigation began as a result of computer-generated “cybertips” he received from the NCMEC. He described the documentation he received as computer-generated information from the “Skype” social networking site owned by Microsoft. He evidenced his familiarity with the program by explaining how the program allowed “Skype” users to connect directly with each other to share multimedia files, share other content, and make live video calls to one another.
He testified that he viewed all twenty-eight images provided with the “cybertips” and, based upon his training and experience, he confirmed that each of the images “depicts actual children engaging in sexually explicit conduct as defined by Mississippi Law.” The cybertips indicated that all twenty-eight of the illegal images were exchanged using the same IP address on December 21, 2016. He confirmed, through information received in Comcast’s response to a grand jury subpoena, that the IP address at issue was leased by Comcast and was assigned to Don Ehrhardt, 871 Willow Grand Circle, Brandon, Mississippi, 39047. The justice court judge found the information was sufficient to establish probable cause and issued the search warrant.
Additionally, caselaw does not treat an “informant” such as Microsoft the same as a confidential informant in a narcotics case or other unknown informants. Microsoft found evidence of illegal activity on the platform that it owned and operated. It then reported the information it obtained from its platform to NCMEC, as it was required to do by law. NCMEC then provided that information to the appropriate law enforcement agency.
In Wolf v. State, 281 So. 2d 445 (Miss. 1973), a neighbor to Wolf carried marijuana plants to law enforcement who then obtained a search warrant based upon the information provided by the neighbor. Law enforcement did nothing more to verify what they were told by the neighbor, or to establish the neighbor’s reliability. MSC affirmed the conviction and said in part: The rationale behind requiring a showing of credibility and reliability is to prevent searches based upon an unknown informant’s tip that may not reflect anything more than idle rumor or irresponsible conjecture. Eyewitnesses by definition are not passing along idle rumor, for they either have been the victims of the crime or have otherwise seen some portion of it.
We find that the information supplied by Microsoft, through NCMEC, was in the nature of a bystander or victim-eyewitness as described above. Microsoft found evidence of criminal activity on the platform that they own and manage. Clearly, the information provided by Microsoft was “more than idle rumor or irresponsible conjecture.” Lynch verified the nature of the images and that the identified IP address was located at a residence in Rankin County, Mississippi. We find that under the totality of the circumstances, there was a “substantial basis” for the justice court judge to find that there was probable cause to believe that evidence of child exploitation could be found at Ehrhardt’s residence.