ORDER ACCEPTING AND MODIFYING MAGISTRATE JUDGE'S FINDINGS AND RECOMMENDATION AND DENYING MOTION TO SUPPRESS

(ECF Nos. 41, 146)

ANDREW P. GORDON, District Judge.

Defendants Justin Anthony Fisher and Joshua Ray Fisher filed a motion to suppress evidence seized during the November 21, 2016 search of the residence at 10432 Burkehaven Avenue, in Las Vegas. ECF No. 41. Magistrate Judge Foley conducted an evidentiary hearing, after which he recommended that the motion to suppress be denied. ECF No. 146. The defendants filed an Objection to that recommendation (ECF No. 147) and the Government filed a Response that also objected to some of Judge Foley's findings (ECF No. 149). Pursuant to Local Rule IB 3-2(b), I have conducted a de novo review of the motion to suppress and related papers. I agree with Judge Foley's recommendation to deny the motion to suppress, but on different grounds. Therefore, I will modify Judge Foley's Findings and Recommendation and deny the motion to suppress.

I. FACTUAL BACKGROUND

The parties are familiar with the facts and procedural posture of this case (and those are detailed in the briefs), so I will not repeat them here except where necessary for context.

On May 26, 2016, the National Center for Missing and Exploited Children (NCMEC) sent Cybertip #10001179 to the Las Vegas Metropolitan Police Department, reporting that Tumblr had reported the upload of apparent child pornography. ECF No. 47-1. The Cybertip reported the user as:

The Cybertip included additional information about IP addresses that appeared related to that user name, including 24.253.48.163.

Detective Scott Miller conducted an investigation of the Cybertip, including serving a search warrant on Tumblr. ECF No. 47-2. Based on his investigation, Det. Miller applied for a search warrant for the house located at 10432 Burkehaven; he submitted an affidavit in support of that search warrant request summarizing his investigation. ECF No. 47-4. Justice of the Peace Suzan Baucum issued the search warrant. The defendants challenge the contents of Det. Miller's warrant affidavit and seek to suppress items seized as a result of the warrant.

Magistrate Judge Foley conducted a Franks hearing and recommended that I deny the motion to suppress. ECF No. 146. The defendants objected to that recommendation and the Government's response includes objections to some of Judge Foley's findings.

II. LEGAL STANDARDS

Under Local Rule IB 3-2(b), I "must conduct a de novo review of those portions of the specified findings or recommendations to which objections have been made. [I] may accept, reject or modify, in whole or in part, the magistrate judge's findings or recommendations." See also 28 U.S.C. § 636(b)(1)(c) (same).

The Government objects (ECF No. 149 at 10-13) to Judge Foley's order (ECF No. 59) granting a Franks hearing.1 The Government contends, among other things, that the defendants did not meet the standard under Franks to warrant a hearing. I agree, and I would not have conducted a hearing.

A defendant challenging a search warrant affidavit is entitled to an evidentiary hearing "where the defendant makes a substantial preliminary showing that a false statement knowingly and intentionally, or with reckless disregard for the truth, was included by the affiant in the warrant affidavit, and [that] the allegedly false statement is necessary to the finding of probable cause. . . ." Franks v. Delaware, 438 U.S. 154, 155-56 (1978). The defendant must show "that the affidavit purged of those falsities and supplemented by the omissions would not be sufficient to support a finding of probable cause." United States v. Stanert, 762 F.2d 775, 782 (9th Cir.), amended, 769 F.2d 1410 (9th Cir. 1985) (citing Franks, 438 U.S. at 171-72). "The effect of the misrepresentations and omissions on the existence of probable cause is considered cumulatively." Id. (citation omitted). I "must determine, therefore, whether the affidavit, once corrected and supplemented, would provide a magistrate with a substantial basis for concluding that probable cause existed." Id.

III. ANALYSIS

The defendants contend that Det. Miller omitted critical facts from his warrant affidavit. They argue that if the affidavit is supplemented with the following five statements it would no longer support a finding of probable cause.

Defendants' proposed addition #1: "Tumblr provided CyberTipline Report #10001179, reporting a user with IP address 50.118.198.254, uploading eight images to a blog, two of which are possible child pornography."

This proposed addition is not specifically correct. The alleged uploading of child pornography occurred on April 19, 2016 at 14:13:00 UTC. See ECF No. 47-1 at 3 (Bates 00030). The NCMEC report identified the IP address for the user or person being reported as "50.118.198.254 (Other)." ECF No. 47-1 at 4 (Bates 00031). But Tumblr's later response to Det. Miller's search warrant indicates that IP address 24.253.48.163 was logged in at the time the alleged child pornography was uploaded. See ECF No. 47-2 at 16-18 (Bates 74-76).

Det. Miller stated in the Synopsis section of his warrant affidavit that NCMEC received a report from Tumblr of a possible uploading of child pornography. ECF No. 47-4 at 5 (Bates 107). That is a correct statement. But he went on to write that Tumblr reported a user ("mcw") with "an IP address of 24.253.48.163 uploaded 8 child exploitation images on their Tumblr account." ECF No. 47-4 at 5 (Bates 107). Id. Because this sentence came immediately after the sentence about the NCMEC report (and before the statement about the Tumblr search warrant), it could be incorrectly interpreted as saying the NCMEC report stated that Tumblr had reported IP address 24.253.48.163 as the one that uploaded child pornography, which is technically incorrect.

In his Probable Cause Offering section that immediately followed his Synopsis, Det. Miller provided more detail, stating that Tumblr had provided the following IP addresses to NCMEC: 50.118.198.254 and 24.253.48.163. Id. at 6 (Bates 108). In reality, the NCMEC report initially says that Tumblr reported the IP address as "50.118.198.254 (Other)." ECF No. 47-1 at 3-4 (Bates 00030-31). Immediately below that, the NCMEC report lists "additional information submitted by the reporting ESP," which includes the "suspect's last logins" under both of the IP addresses Miller listed in his Probable Cause Offering: 50.118.198.254 and 24.253.48.163. Miller's subsequent investigation—especially the Tumblr response to the search warrant—confirmed that IP address 24.253.48.163 was tied to the incident and uploaded the subject images. See ECF No. 47-2 at 16-18 (Bates 74-76).

Det. Miller's warrant affidavit could be incorrectly interpreted as stating that the NCMEC report identified the IP address of 24.253.48.163 as the one that uploaded the child pornography. But considered in its entirety, the affidavit was not misleading. Det. Miller summarized the chain of his investigation, including the results of the search warrants and subpoena he obtained. That investigation supported probable cause to issue the search warrant for the Burkehaven house.

But even if I find that the misstatements discussed above were misleading, at most I would supplement the affidavit with the following changes. In the Synopsis section, I would change page 5 (Bates 107) to say: On or about April 27, 2016, the National Center for Missing and Exploited Children (NCMEC) received a report from Tumblr reference a possible transmission of child pornography. Tumblr reported a user "mcw," screen/user name of mcw, and an IP address of <50.118.198.254> 24.253.48.163, uploaded 8 child exploitation images on their Tumblr account.

In the Probable Cause Offering section, I would change page 6 (Bates 108) to say:

With those changes, the affidavit still supports a finding of probable cause because of the other information obtained from the search warrants and subpoena that linked the child pornography to IP address 24.253.48.163.

Defendants' proposed addition #2: "IP address 50.118.198.254 resolves to an unknown person in San Jose."

The NCMEC report's "Geo-Lookup" resolves to a location in San Jose but no person or entity is identified. But even if this proposed language was included in the affidavit, it would not be material because the NCMEC report also identified IP address 24.253.48.163 as related to the incident and noted that it resolved to Las Vegas. Even the NCMEC reporter believed that the IP address 50.118.198.254 was not material because, after reviewing the relevant information, the reporter concluded: "Based on IP 24.253.48.163, I will place this report on the VPN for the NV ICAC." See ECF No. 47-1 at 9 (Bates No. 36). The report was sent to the Las Vegas Metropolitan Police Department but not to any authorities in San Jose. Id. at 11 (Bates No. 38). That confirms that NCMEC believed the suspect IP address was 24.253.48.163, not 50.118.198.254. The defendants' complained-of omission and proposed addition about San Jose are not material.

Defendants' proposed addition #3: "Three separate IP addresses are associated with the username `mcw' of the blog and have logged in to access the blog from January 1, 2016 and April 19, 2016."

Again, the NCMEC report reviewed the information regarding "mcw" and "mcwarson" and concluded that the suspect IP address was 24.253.48.163. See ECF No. 47-1 at 7-9 (Bates 34-36). Also, Tumblr's response to the search warrant reported that IP address 24.253.48.163 was logged in on the day and time of the incident. See ECF No. 47-2 at 16-18 (Bates 74-76). No other IP address was logged in at that time. Tumblr also indicated that from April 19, 2016 to July 2, 2016, 40 more images of child pornography were uploaded by "mcw," and that the last login for "mcw" from April 19, 2016 to July 2, 2016 was from IP address 24.253.48.163. ECF No. 47-4 at 7 (Bates 109). Thus, the complained-of omission is not material, and the defendants' proposed addition would not alter the analysis of probable cause.

Defendants' proposed addition #4: "Tumblr does not know when blogs are accessed, only when there is a login made."

The defendants do not explain the difference, if any, between "accessed" and "login," and I do not see a material difference in the context of this case.

Defendants' proposed addition #5: "It is unknown which IP addresses may have viewed or uploaded the photographs of the blog."

This proposal would be misleading as it ignores that Tumblr reported that the IP address 24.253.48.163 was logged in on the day and time the child pornography was uploaded. See ECF No. 47-2 at 16-18 (Bates 74-76). No other IP address was logged in at that time. Based on the circumstances, there is more than a reasonable probability that the alleged child pornography was uploaded from IP address 24.253.48.163.

IV. CONCLUSION

The defendants have not shown that Det. Miller was reckless or that he deliberately omitted material information in preparing his search warrant affidavit.2 And the complained-of omissions were not material. At most, I would supplement the affidavit by revising the statements in the Synopsis and Probable Cause Offering sections as discussed above. As supplemented, the affidavit still would have provided probable cause to issue the search warrant.3 Therefore, I would not have granted the defendants' request for a Franks hearing. Rather, I would have denied the motion to suppress without an evidentiary hearing.

IT IS THEREFORE ORDERED that Magistrate Judge Foley's Findings and Recommendation (ECF No. 146) is accepted as to its recommendation to deny the motion to suppress and modified to the extend my reasoning is different than his, as set forth above. The defendants' motion to suppress (ECF No. 41) is denied.