                                                                                        ACCEPTED
                                                                                    01-14-00516-CR
                                                                         FIRST COURT OF APPEALS
                                                                                 HOUSTON, TEXAS

Nos. 01-14-00516-CR, 01-14-00517-CR, 01-14-00518-CR
                                                                              4/20/2015 10:16:35 AM
                                                                              CHRISTOPHER PRINE

           01-14-00519-CR, 01-14-00520-CR                                                    CLERK



                          In the
                   Court of Appeals                            FILED IN
                         For the                        1st COURT OF APPEALS
                                                            HOUSTON, TEXAS
                First District of Texas
                                                        4/20/2015 10:16:35 AM
                       At Houston
                                                        CHRISTOPHER A. PRINE
                ♦                                      Clerk

 Nos. 1370904, 1370905, 1370906, 1370907, 1370908
                In the 230th District Court
                 Of Harris County, Texas
                ♦
               HUGO PACHAS-LUNA
                        Appellant
                           v.
               THE STATE OF TEXAS
                         Appellee
                ♦
               State’s Appellate Brief
                ♦

                                              DEVON ANDERSON
                                              District Attorney
                                              Harris County, Texas

                                              STEPHEN DRIVER
                                              KATHRYN KAHLE
                                              Assistant District Attorneys
                                              Harris County, Texas

                                              CLINTON A. MORGAN
                                              Assistant District Attorney
                                              Harris County, Texas
                                              State Bar No. 24071454
                                              morgan_clinton@dao.hctx.net

                                              1201 Franklin, Suite 600
                                              Houston, Texas 77002
                                              Tel: (713) 755-5826
                                              FAX: (713) 755-5809

                                              Counsel for the Appellee

              Oral Argument Not Requested
                   Statement Regarding Oral Argument

     The appellant requested oral argument, though he gave no particular

reason why. The State believes the briefs in this case adequately apprise this

Court of the issues and the law, and any marginal benefit from oral argument

does not justify the considerable amount of time that preparation for oral

argument requires of the parties and the Court. Therefore, the State does not

request oral argument.




                                      i
                         Identification of the Parties

Counsel for the State:

      Devon Anderson
            District Attorney of Harris County

      Stephen Driver & Kathryn Kahle
           — Assistant District Attorneys at trial

      Clinton A. Morgan
             Assistant District Attorney on appeal

Appellant:

      Hugo Pachas-Luna

Counsel for the Appellant:

      Connie Williams
           — Counsel at trial

      Alexander Bunin & Sarah V. Wood
           — Counsel on appeal

Trial Judge:

      Brad Hart
            Presiding judge




                                      ii
                                                    Table of Contents

                                                                                                                                Page

Statement Regarding Oral Argument .......................................................... i
Identification of the Parties ........................................................................ ii
Table of Contents .......................................................................................... iii
Index of Authorities ....................................................................................... v
Statement of the Case ................................................................................... 1
Statement of Facts ......................................................................................... 1
Reply to the Appellant’s Sole Point of Error
   Most of the appellant’s complaints are minor or completely meritless. His
   one legitimate complaint — the possible discrepancy between when the IP
   address was sharing child pornography and when the IP address was
   connected to the appellant — is unpreserved, and a matter of first
   impression that this Court should refrain from addressing. Given the
   deferential standard of review in warrant cases, this Court should defer to
   the magistrate’s determination of probable cause. ................................................... 2
      I. Appellate courts review warrant affidavits by reading them in a
      common-sense manner, and giving deference to both the trial court and
      the issuing magistrate. ....................................................................................................... 2
      II. A fair reading of the affidavit shows that it is not nearly so bad as the
      appellant makes it seem.................................................................................................... 4
         A.      Corporal Lee’s Background Knowledge ........................................................ 5
              1. Lee’s Training ......................................................................................................... 5
              2. Lee’s Knowledge of Peer-to-Peer Networks .............................................. 6
              3. Lee’s Software, and “Hash Values”................................................................. 7
         B.      This Investigation ................................................................................................... 8
              1. The Child Pornography Files............................................................................ 8
              2. Connecting the IP to the Appellant ............................................................ 10
              3. “People who have a sexual interest in children …” .............................. 12



                                                                   iii
      III. All but one of the appellant’s complaints are without merit, and on
      that issue there is a sufficient basis in the affidavit that the trial court’s
      ruling was not an abuse of discretion. ..................................................................... 12
         A. The name of the online database was not necessary to show
         probable cause............................................................................................................... 12
         B.     Lee adequately described his investigative software........................... 14
         C.     The missing verb is apparent from context clues. ................................. 15
         D. The affidavit elsewhere describes in detail some of the child
         pornography found on the suspect IP address, thus whether the phrase
         “labeled as child notables” was “conclusory and uncredited” is
         irrelevant, as it was not necessary for the probable-cause
         determination. ............................................................................................................... 17
         E. There was information regarding only one IP address; the
         “different” IP address mentioned in the affidavit was obviously a typo,
         as the trial court determined................................................................................... 18
         F. The appellant’s sole legitimate complaint — regarding the
         imprecise connection between the suspect IP address and the
         appellant’s residence — is unpreserved. If this Court addresses it, it is a
         question of first impression and this Court should defer to the
         inferences drawn by the magistrate and the trial court. ............................. 20
         G. The appellant’s complaint about Lee’s “method” of comparing hash
         values is irrelevant. ...................................................................................................... 23
         H. The information in the affidavit connecting child pornography to
         the appellant’s residence was not stale. ............................................................. 25
Conclusion .................................................................................................... 29
Certificate of Compliance and Service ..................................................... 30




                                                                  iv
                                                  Index of Authorities



Cases
Barrett v. State
  367 S.W.3d 919 (Tex. App.—
  Amarillo 2012, no pet.) ....................................................................................................... 21
Champion v. State
  919 S.W.2d 816 (Tex. App.—
  Houston [14th Dist.] 1996, pet. ref’d) ................................................................... 16, 19
Gardner v. State
  433 S.W.3d 93 (Tex. App.—
  Houston [1st Dist.] 2014, pet. ref’d).............................................................................. 22
Hereford v. State
  339 S.W.3d 111 (Tex. Crim. App. 2011) .......................................................................... 4
Illinois v. Gates
   462 U.S. 213 (1983) ................................................................................................................. 3
Pair v. State
  184 S.W.3d 329 (Tex. App.—
  Fort Worth 2006, no pet.) .................................................................................................. 24
Reyes v. State
  02-11-00327-CR, 2013 WL 1338023 (Tex. App.—
  Fort Worth Apr. 4, 2013, no pet.)
  (mem. op. not designated for publication) ................................................................. 16
Rodriguez v. State
  232 S.W.3d 55 (Tex. Crim. App. 2007) .......................................................................... 23
Rothstein v. State
  267 S.W.3d 366 (Tex. App.—
  Houston [14th Dist.] 2008, pet. ref’d) ................................................................. passim
Sanders v. State
  191 S.W.3d 272 (Tex. App.—
  Waco 2006, pet. ref’d) ......................................................................................................... 28




                                                                    v
Serrano v. State
  123 S.W.3d 53 (Tex. App.—
  Austin 2003, pet. ref’d) .......................................................................................................... 3
State v. Cotter
  360 S.W.3d 647 (Tex. App.—
  Amarillo 2012, no pet.) ....................................................................................................... 28
State v. Delagarza
  158 S.W.3d 25 (Tex. App.—
  Austin 2005, no pet.)............................................................................................................... 3
State v. Jordan
  342 S.W.3d 565 (Tex. Crim. App. 2011) .......................................................................... 3
Tucker v. State
  369 S.W.3d 179 (Tex. Crim. App. 2012) .......................................................................... 4
United States v. Bervaldi
  226 F.3d 1256 (11th Cir. 2000)................................................................................. 26, 27
United States v. Diecidue
  603 F.2d 535 (5th Cir. 1979) ............................................................................................. 27
United States v. Hay
  231 F.3d 630 (9th Cir. 2000) ............................................................................................. 28
United States v. Morales-Aldahondo
  524 F.3d 115 (1st Cir. 2008).............................................................................................. 28
United States v. Vosburgh
  602 F.3d 512 (3d Cir. 2010)............................................................................................... 21




                                                                  vi
                               Statement of the Case

      The appellant was charged in five indictments with different charges of

possession of child pornography. (1 CR 13; 2 CR 13; 3 CR 13; 4 CR 13; 5 CR

13).1 The appellant waived his right to a jury trial and pled not guilty to the

trial court. (2 RR 4-8). The trial court found him guilty as charged. (4 RR 130-

31). After a pre-sentence investigation, the trial court assessed punishment for

each case at eight years’ confinement, with the sentences to run consecutively.

(5 RR 18; 1 CR 87-88; 2 CR 88-89; 3 CR 88-89; 4 RR 86-87; 5 RR 80-81). The

appellant filed timely notices of appeal and the trial court certified his right of

appeal. (1 CR 92, 94).


                                 Statement of Facts

      A Harris County Precinct Four Constable’s Deputy conducted an

investigation into online child-pornography file sharing and discovered a

computer sharing child pornography from an internet account associated with

the appellant. (Def.’s Ex. 1). The deputy obtained a warrant for the appellant’s

house, and when the warrant was served police found numerous hard drives


1 The State will refer to the clerk’s records in the different causes as though they were
sequential volumes. Thus the record for 01-14-00516- CR will be 1 CR, the record for 01-
14-00517-CR will be 2 CR, and so on, in numerical order. If the same document appears in
all the records, the State will cite to the copy in 1 CR.

                                           1
containing, in total, more than 18,000 images and videos of child pornography,

including the four images and one video for which he was charged in this case.

(4 RR 103-16).


                 Reply to the Appellant’s Sole Point of Error


Most of the appellant’s complaints are minor or completely meritless.
His one legitimate complaint — the possible discrepancy between when
the IP address was sharing child pornography and when the IP address
was connected to the appellant — is unpreserved, and a matter of first
impression that this Court should refrain from addressing. Given the
deferential standard of review in warrant cases, this Court should defer
to the magistrate’s determination of probable cause.

      The appellant filed a pre-trial motion to suppress alleging, inter alia, that

the warrant affidavit in this case did not contain probable cause to believe

contraband would be found in the appellant’s home, thus the evidence was

obtained illegally. (1 CR 79-81). The trial court held a hearing on the motion to

suppress at the beginning of the appellant’s bench trial and denied the motion.

(3 RR 129-31). In his sole point of error, the appellant claims that the trial

court erred in denying his motion to suppress.


    I.   Appellate courts review warrant affidavits by reading them in a
         common-sense manner, and giving deference to both the trial
         court and the issuing magistrate.

      Probable cause exists if, under the totality of the circumstances set forth

in the affidavit before the magistrate, there is a fair probability that
                                        2
contraband or evidence of a crime will be found in a particular place at the

time the warrant is issued. State v. Jordan, 342 S.W.3d 565, 568-69 (Tex. Crim.

App. 2011). The magistrate may interpret the affidavit in a non-technical,

common-sense manner and may draw reasonable inferences from the facts

and circumstances contained within its four corners. Id. at 569.

      When reviewing whether a warrant should have issued, courts —

whether at the trial or appellate level — are not to determine whether there

actually was probable cause. State v. Delagarza, 158 S.W.3d 25, 29 (Tex. App.—

Austin 2005, no pet.). The test at the trial court is: considering the totality of

the circumstances before the issuing magistrate, was there a substantial basis

to believe that probable cause existed. Ibid.; Illinois v. Gates, 462 U.S. 213, 268

(1983). On appellate review, then, the appropriate test is: did the trial court

abuse its discretion in finding that the magistrate had a substantial basis to

believe that probable cause existed. “The resolution of doubtful or marginal

cases should largely be determined by the preference to be accorded to

warrants.” Delagarza, 158 S.W.3d at 29. On appeal, the sufficiency of a warrant

affidavit is generally determined by looking at the affidavit itself, without

regard to extrinsic evidence. Serrano v. State, 123 S.W.3d 53, 58 (Tex. App.—

Austin 2003, pet. ref’d).



                                        3
      In reviewing a trial court’s ruling on a motion to suppress, appellate

courts give almost total deference to the trial court’s factual determinations,

even when those determinations are based on affidavit, but review de novo the

trial court’s application of the law of search and seizure. Tucker v. State, 369

S.W.3d 179, 184 (Tex. Crim. App. 2012). The record should be viewed in the

light most favorable to the trial court’s decision, and the trial court’s decision

should be upheld so long as it is reasonable in light of the record. Hereford v.

State, 339 S.W.3d 111, 18 (Tex. Crim. App. 2011).


    II.   A fair reading of the affidavit shows that it is not nearly so bad as
          the appellant makes it seem.

      In his brief, the appellant engages in a persnickety reading of certain

sections of the affidavit. He focuses, at times, on what the affidavit does not say

rather than what it does. He seems befuddled by certain phrases in the

affidavit that are explained clearly enough in other parts. And he demands

descriptions and definitions of ordinary notions that any magistrate of

common intelligence would have understood.

      The State will grant that Corporal Lee is unlikely to be nominated for

any literary prizes based on this affidavit, but appellate review is not about

critiquing stylistic and typographical errors. Rather, this Court is to examine

the whole document and determine whether it was reasonable for the trial

                                        4
court to conclude that the affidavit gave the issuing magistrate a substantial

basis to find probable cause that there would be evidence of a crime at the

searched address. What follows is an attempt to read through the affidavit for

its relevant parts and to place them in the order that makes the most sense.


            A. Corporal Lee’s Background Knowledge

               1. Lee’s Training

      The affidavit begins with the qualifications of the affiant. (Def.’s Ex. 1 at

4-5). Corporal Jeffrey Lee is employed as a peace officer by the Harris County

Precinct Four Constable, and he has been a law enforcement officer for more

than a decade. “[H]is duties include the investigation of technologically

advanced offenses including … Child Pornography.” (Def’s. Ex. 1 at 4). He is

certified “in Basic Cybercrime Investigation.”

      Lee has spoken with others in the law enforcement community who

know about the ways of those who trade and collect child pornography.

Moreover, he “has been personally involved in the investigation, arrest, and

prosecution of numerous persons involved in child sexual exploitation.” (Def’s

Ex. 1 at 4). Lee is a member of the Houston Metro Internet Crimes Against

Children Task Force, a federally funded initiative.




                                        5
               2. Lee’s Knowledge of Peer-to-Peer Networks

      Through his training and experience, Lee is aware that “the trade of

child pornography through the internet is extensive and one of the main

methods of distribution for this type of contraband.” (Def.’s Ex. 1 at 4). Lee is

aware that the use of peer-to-peer (P2P) networks is “one of the most

pervasive methods for the distribution of child pornography through the

internet.” (Def.’s Ex. 1 at 4). Lee knows that P2P file sharing is accomplished by

downloading software and listing certain files and folders as being “shared,”

and then those files and folders are indexed by an “ultra-peer,” through which

other users can search the shared files and folders and select which ones to

download. (Def.’s Ex. 1 at 5). Once a user chooses to download a file from

another user, those computers are then connected through an internet

protocol (IP) address. (Def.’s Ex. 1 at 5). The sending and receiving computers

record each others’ IP addresses in order to facilitate the file sharing. (Def.’s

Ex. 1 at 5).

      An IP address is “a unique four-byte number assigned to a computer

when that computer accesses the Internet.” (Def.’s Ex. 1 at 17). Every

computer on the internet has an IP address that is assigned to it by its internet

service provider when it logs on. (Def.’s Ex. 1 at 17). An IP address “is unique

in the sense that no two users can have the exact same IP address at the same

                                        6
time.” (Def.’s Ex. 1 at 17). Internet service providers generally keep records

that allow them to know which subscriber was using a particular IP address at

a particular time. (Def.’s Ex. 1 at 8-9, 17).


                3. Lee’s Software, and “Hash Values”

      Lee has received “specialized training” for the investigation of P2P

networks using “a specialized program developed to allow investigators to

access a variety of [P2P] networks.” (Def.’s Ex. 1 at 5). Lee “is trained and

licensed to use this software.” (Def.’s Ex. 1 at 5). The software allows

investigators to “search the variety of networks for digital material from users

connecting to the [P2P] Networks and download files that the users ‘share’

with the network…” (Def.’s Ex. 1 at 5).

      The software allows investigators to narrow their searches in a couple of

ways. One way is that they can narrow their searches so that they only return

results from specified geographic areas, “such as Harris County, the City of

Houston, or City of Pasadena.” (Def.’s Ex. 1 at 5).

      The second way in which this software allows investigators to limit their

searches is that the software can be set to return results for “confirmed images

of child pornography.” (Def.’s Ex. 1 at 5). It does this through the use of “hash

values.” All digital files can be processed through a Secure Hash Algorithm to


                                          7
produce an identifying hash value that will be the same for any two duplicate

files, but which will be different if the files differ in any way. (Def.’s Ex. 1 at 7).

Lee knows that by comparing the hash value of two files, he can determine

whether two files are identical “with a precision that greatly exceeds 99.9999

percent certainty.” (Def.’s Ex. 1 at 7). Because of how hash values are produced,

“there has never been a documented occurrence of two different files being

found on the Internet having different contents while sharing the same [hash]

value.” (Def.’s Ex. 1 at 7).

       Lee’s investigative software uses hash values to limit its search. The

software can take the hash values of files that have been determined to be

child pornography and return search results only from computers that are

sharing known child pornography. (Def.’s Ex. 1 at 5). Lee is aware that through

the use of this software and of the methods in which has been trained,

“hundreds of [P2P] cases have been successfully investigated throughout the

United States.” (Def.’s Ex. 1 at 6).


              B. This Investigation

                 1. The Child Pornography Files

       On August 9, 2012, Lee conducted an investigation using an “online

database.” (Def.’s Ex. 1 at 6). “The software allows licensed investigators to


                                          8
track [IP addresses] in order to determine specifically what the individual or

computer has downloaded over a specific … time frame.” (Def.’s Ex. 1 at 6).

That afternoon, Lee conducted a search limited to Harris County and

discovered that IP address 98.194.180.10 was sharing 2 more than twenty files

that were “child notables,” meaning that “they are files that have been

observed by other law enforcement officers as being ‘child pornography.’”

(Def.’s Ex. 1 at 6). That computer was sharing “numerous other files” that “had

titles which were indicative of child porn.” (Def.’s Ex. 1 at 6). Lee conducted

additional checks of this IP address, and it repeatedly showed up as sharing

what appeared to be child pornography.3 (Def.’s Ex. 1 at 6).


2 As the appellant correctly notes in his brief, this portion of the affidavit is missing a verb.
The affidavit states that Lee “located IP address 98.194.180.106 which several unique
files….” (Def.’s Ex. 1 at 6). The appellant believes this renders the affidavit
incomprehensible. (See Appellant’s Brief at 21-22). However, later in the same paragraph of
the affidavit, Lee states that a later search of the IP address showed that it “continued to
have files within its share folder and those files all have files which are indicative of being
child pornographic and nature ….” (Def.’s Ex. 1 at 6). Using context clues, it is apparent that
the missing verb must be “was sharing” or something similar.

3 As the appellant also correctly notes, in a single instance the affidavit specifies an IP
address that differs by one numeral from the other references to an IP address in the
affidavit. In three instances the affidavit refers to IP 98.194.180.106; it once, however,
refers to 98.194.180.196. (Def.’s Ex. 1 at 6-7). From the context clues this must be regarded
as a typographical error. The affidavit refers to an “additional check” of IP address
98.194.180.196, and states that this “additional check” shows that the IP address
“continue[d]” to share child pornography, when the only check previously mentioned in the
affidavit was of IP 98.194.180.106. (Def.’s Ex. 1 at 6). Additionally, the affidavit states that
Lee requested information from Comcast “based upon the dates and times the IP address
was seen downloading” child pornography, indicating that Lee meant to refer only to a
single IP address in the affidavit. The State’s appellate counsel will also note that the
numerals 9 and 0 are directly next to each other on a standard keyboard.
                                               9
       Lee then took the hash values of the files that were being shared from

this IP address and asked other investigators whether they had seen files with

those hash values. (Def.’s Ex. 1 at 7). Lee knows this method of matching files

“has proven to be extremely reliable,” and he has used hash values to match

“thousands of files and has never found two files with different contents but

the same” hash value. (Def.’s Ex. 1 at 7). On August 17, 2012, Lee procured

from other investigators copies of three video files that matched the hash

values of files being shared by the suspect IP address. (Def.’s Ex. 1 at 7-8). One

involved a girl between the ages of 5 and 8 being raped; the second involved

four girls between 11 and 14 engaging in sex with each other and with the

male cameraman; the third involved a girl between the ages of 13 and 16

engaging in oral and vaginal sex with a male. (Def.’s Ex. 1 at 8).


                 2. Connecting the IP to the Appellant

       Lee knows that “absent fraud or intentional deception, an [IP] address is

an accurate method to find the method of internet connection for an individual

accessing the internet.” (Def.’s Ex. 1 at 8). Internet service providers “keep

accurate records that can be traced back to specific accounts if the [service

providers] are provided with accurate dates and times of [internet] use.”

(Def.’s Ex. 1 at 9).


                                        10
      After identifying the suspect IP address as being from a block of IP

addresses used by Comcast, Lee sent a grand jury subpoena to Comcast

requesting information regarding “the subscriber assigned to that IP address,

based upon … the dates and time the IP address was seen downloading what

are believed to be child pornographic images or videos.” (Def.’s Ex. 1 at 6). On

August 20, 2012, Lee received a response from Comcast. It stated that on April

4, 2012, at 8:57 pm, and on August 5, 2012 at 8:42 pm, IP address

98.194.180.106 was being used by an the appellant’s account, the address for

which was 18107 Fairhope Oak Street, Houston. (Def.’s Ex. 1 at 7). The account

was created on August 7, 2009, and was still active at the time of the grand

jury subpoena. (Def.’s Ex. 1 at 7).

      When Lee ran an additional check on the IP address on December 7,

2012 using his investigative software, he saw that the IP address had been

active on one P2P network for roughly a year predating the investigation, from

August 27, 2011 through September 3, 2012. (Def.’s Ex. 1 at 6). While using

that network, the IP address had been seen using software with two Globally

Unique Identifiers (GUIDs). (Def.’s Ex. 1 at 6). While it is possible for a

computer’s IP address to change, the GUIDs used by a particular program will

remain the same unless the program is updated or uninstalled. (Def.’s Ex. 1 at

6).
                                      11
                3. “People who have a sexual interest in children …”

      Based on his training and experience, Lee believes the individual at

18107 Fairhope Oak Street who was downloading and sharing child

pornography had “a sexual interest in children.” (Def.’s Ex. 1 at 12). Lee is

aware of several characteristics of such individuals. They “often collect

sexually explicit materials … depicting children, which they use for their own

sexual gratification and fantasy. (Def.’s Ex. 1 at 12). They “rarely, if ever,

dispose of their sexually explicit materials … and those materials are treated as

prized possessions.” (Def.’s Ex. 1 at 12-13).


   III.   All but one of the appellant’s complaints are without merit, and
          on that issue there is a sufficient basis in the affidavit that the
          trial court’s ruling was not an abuse of discretion.

      The appellant raises eight specific complaints about the warrant in his

brief. The State will address them one by one.


             A. The name of the online database was not necessary to
                show probable cause.

      In his first complaint, the appellant points out that the “online database”

mentioned once in the affidavit is not named in the affidavit. (Appellant’s Brief

at 16-17). This observation is true, as far as it goes.




                                         12
      The State’s first response is that this argument is not preserved because

it was not presented to the trial court either in the appellant’s motion to

suppress (1 CR 79-81) or in his arguments to the trial court (3 RR 83-88). See

Rothstein v. State, 267 S.W.3d 366, 373 (Tex. App.—Houston [14th Dist.] 2008,

pet. ref’d) (where defendant filed generic motion to suppress and presented

certain specific arguments to trial court, other specific arguments not

presented to trial court were not preserved).

      Second, the appellant gives away the insignificance of this point when he

notes that, aside from a single insubstantial reference, “this online database …

is not mentioned or described anywhere else in the voluminous affidavit ….”

(Appellant’s Brief at 16). The appellant is correct. All of the evidence

connecting the appellant to the child pornography was discovered using the

investigative software described by Lee; the importance of the “online

database” and its relation to the software are not obvious from the affidavit. If

this Court were to completely disregard anything in the affidavit relating to an

online database, it would not affect the quantum of evidence present to

support probable cause.




                                       13
             B. Lee adequately described his investigative software.

      The appellant next complains that the software used by Lee “is Not

Credited within the Affidavit.” (Appellant’s Brief at 17-20). The appellant

seems confused by the fact that the affidavit describes two types of software.

First, the affidavit gives a description of the sort of software commonly used

for P2P sharing. (Def.’s Ex. 1 at 4-5). Later, the affidavit describes the

investigative software for which Lee has received specialized training and that

was used in the investigation of this case. (Def.’s Ex. 1 at 5-6).

      First, this matter was not raised in the appellant’s motion to suppress or

in his arguments to the trial court, thus, on abuse-of-discretion review, it

should play no role in this Court’s decision. Rothstein, 267 S.W.3d at 373.

      On the merits, though, the State does not believe the affidavit is

confusing in the least on this point. In its discussion of P2P file sharing, the

affidavit mentions the publicly-available software, stating that Lee “learned

that computer users can choose to install publicly available software that

facilitates the trading of images.” (Def.’s Ex. 1 at 5). Later, the affidavit states

that Lee “has received specialized training regarding the investigations of

[P2P] Networks in which a specialized software program developed to allow

investigators to access a variety of [P2P] Networks is used.” (Def.’s Ex. 1 at 5).

The affidavit then states that Lee “is trained and licensed to use this software”;

                                         14
this is followed by further descriptions of the capabilities of “this software.”

(Def.’s Ex. 1 at 5-6). There is no indication anywhere in the affidavit that Lee

used any “software” other than the investigative software he described with

some detail.

       Perhaps the affidavit could have been clearer had Lee used the specific

name of his investigative software, but, in light of Lee’s descriptions of its

capabilities, the name of the program would neither add to nor detract from

its reliability.


               C. The missing verb is apparent from context clues.

       The third complaint raised by the appellant is that there is a missing

verb in one sentence: “Your Affiant located IP address 98.194.180.106 which

several unique files, over twenty of them being labeled as child notables,

meaning they are files that have been observed by other law enforcement

officers as being ‘child pornography.’” (Def.’s Ex. 1 at 6). According to the

appellant, it is “impossible” to determine the meaning of this sentence.

(Appellant’s Brief at 21).

       This matter was not raised in the appellant’s motion to suppress or at

the trial court. That indicates two things: First, neither trial counsel nor the

trial court had any apparent difficulty deciphering the meaning of this


                                      15
sentence; second, the matter is not preserved for this Court’s review.

Rothstein, 267 S.W.3d at 373.

       The appellant’s failure to raise this matter in the trial court has further

significance, because, while the sufficiency of an affidavit is normally

determined by what is contained within its four corners, a typographical error

in an affidavit can be explained through testimony at a motion-to-suppress

hearing. See Champion v. State, 919 S.W.2d 816, 818 (Tex. App.—Houston

[14th Dist.] 1996, pet. ref’d) (citing Green v. State, 799 S.W.2d 756, 760 (Tex.

Crim. App. 1990)); see also Reyes v. State, 02-11-00327-CR, 2013 WL 1338023,

at *3 (Tex. App.—Fort Worth Apr. 4, 2013, no pet.) (mem. op. not designated

for publication) (collecting cases). Had the appellant raised this matter in the

trial court, the parties could have questioned Lee as to what the missing word

was.

       As a final note on this point, as the State observed in Footnote 2 of this

brief, the context in which this sentence occurs makes apparent that the

missing verb was “was sharing” or something similar. Two sentences later the

affidavit notes that “an additional check” of the IP address “show[ed] the IP

has continued to have files within its shared folders and those files all have

files [sic.] which are indicative of being child pornographic in nature. ….” (Def.’s

Ex. 1 at 6). In this context (and, indeed, in the larger context of the affidavit
                                        16
itself, which is seeking to establish probable cause that a particular IP address

associated with the appellant was sharing child pornography), it would be

passingly strange if the missing verb were something that did not indicate the

suspected IP address was sharing child pornography.


              D. The affidavit elsewhere describes in detail some of the
                 child pornography found on the suspect IP address, thus
                 whether the phrase “labeled as child notables” was
                 “conclusory and uncredited” is irrelevant, as it was not
                 necessary for the probable-cause determination.

        The appellant’s next complaint is that the affidavit’s use of the phrase

“labeled as child notables” “is conclusory and uncredited. (Appellant’s Brief at

22). The State’s first response, again, is that this complaint was not made

either in the appellant’s motion to suppress or in his argument to the trial

court, thus it should not factor into this Court’s determination of whether the

trial court abused its discretion. Rothstein, 267 S.W.3d at 373.

        Second, this part of the affidavit is merely describing the investigation

and is not essential for determining probable cause. Later in the affidavit, Lee

went into graphic detail regarding three of the files that were being shared by

the suspected IP address, and that should be more than sufficient to show

probable cause even if this Court disregards the “labeled-as-child-notables”

line.


                                        17
             E. There was information regarding only one IP address; the
                “different” IP address mentioned in the affidavit was
                obviously a typo, as the trial court determined.

       In his fifth complaint, the appellant notes that in three instances the

affidavit refers to IP address 98.194.180.106, but in one instance in the middle

of these references the affidavit refers to IP address 98.194.180.196.

(Appellant’s Brief at 23-24). The appellant presented this argument at the

motion-to-suppress hearing, and the trial court determined that the reference

to 98.194.180.196 was a typo and should have read 98.194.180.106. (3 RR 93-

94).

       Lee testified at the hearing before the trial court, and while he did not

explicitly state that the reference to 98.194.180.196 was a typo, it could easily

be inferred from his testimony, from the nature of the questioning, and from

the affidavit itself. Lee testified that in this case he investigated IP address

98.194.180.106. (3 RR 21). Throughout the hearing the parties questioned Lee

about this IP address, and in seemingly every instance the questioning was

phrased in the singular (i.e. the investigation involved only one IP address),

and Lee responded, likewise, in the singular. (See, e.g., 3 RR 33 (Defense

Counsel: “Is that the day you found out who the IP belonged to and what

address it was coming from?” Lee: “That’s the date I found out that the IP

address was assigned to that account.”)). Most tellingly, at one point the

                                       18
prosecutor asked Lee “how many dates did you verify that child pornography

was available for trade from that particular IP address you mentioned earlier,”

and Lee responded: “Two days.” (3 RR 55). The affidavit mentions viewing

child pornography on an IP address on two dates, but it refers to different IP

addresses for each date. (Def.’s Ex. 1 at 6). Thus, Lee’s testimony that on two

dates he viewed child pornography on the same IP address is, effectively,

testimony that the reference to IP 98.194.180.196 was a typo.

      The conclusion that the reference to 98.194.180.196 was a typo is also

supported by the affidavit itself. When IP address 98.194.180.196 is

mentioned, it follows a mention to a check performed on IP 98.194.180.106

and states that an “additional check” was performed on 98.194.180.196,

which “continued to have” child pornography available for sharing. (Def.’s Ex.

1 at 6). Reading the reference to IP 98.194.180.196 as a typo makes sense of

the paragraph. Reading it, as the appellant does, as a reference to a second IP

address renders half the paragraph nonsensical. It is obvious from the

surrounding context that this was a typo, and the trial court had testimony

supporting its conclusion that it was a typo. See Champion, 919 S.W.2d at 818.

This Court should defer to the trial court’s determination that this was a typo

and not a wholly nonsensical paragraph.



                                      19
            F. The appellant’s sole legitimate complaint — regarding the
               imprecise connection between the suspect IP address and
               the appellant’s residence — is unpreserved. If this Court
               addresses it, it is a question of first impression and this
               Court should defer to the inferences drawn by the
               magistrate and the trial court.

      The most serious problem with this affidavit is that it does not explicitly

connect the appellant to the suspected IP address at the precise moments

when the IP address was sharing child pornography. The appellant raises this

matter in his brief. (See Appellant’s Brief at 25-29). At trial, however, the

appellant’s only argument related to IP addresses was that the appellant’s IP

address could have changed between the date that Lee subpoenaed Comcast

and the date the warrant issued. (3 RR 86 (“[W]hat I’m getting to, this does not

refer to the fact that at a certain time it belonged to him and necessarily

belonged to him in December or in November.”), 92-93). That is a different

(and irrelevant) issue. This Court should disregard this appellate complaint as

unpreserved, particularly because the record shows that the trial court

labored under an incorrect interpretation of the affidavit that could have been

corrected had trial counsel pointed it out. See Rothstein, 267 S.W.3d at 373.

      The appellant’s appellate complaint, though unpreserved, is well taken.

Reading it in the light most favorable to the trial court’s findings, the affidavit

states that Lee observed IP 98.194.180.106 sharing and/or downloading child


                                        20
pornography on August 9, November 13, and December 7. (Def.’s Ex. 1 at 6). It

then states that Lee subpoenaed Comcast regarding which subscriber was

using that IP address “based upon … the dates and time the IP address was

seen downloading what are believed to be child pornographic images or

videos.” (Def.’s Ex. 1 at 6). Comcast responded to this subpoena stating that the

suspect IP address was being used by the appellant at particular times on

April 4 and August 5. (Def.’s Ex. 1 at 6).

      Had the affidavit connected the IP address to the appellant’s account at

the precise time the IP address was sharing or downloading child

pornography, the caselaw is clear that this would have been adequate to

establish probable cause. See, e.g., United States v. Vosburgh, 602 F.3d 512, 518,

527 (3d Cir. 2010) (so holding, and collecting cases). What is not clear, though,

is how close in time the affidavit must connect the IP address to the suspect.

The Texas cases the State can find have determined that probable cause

existed if the IP address is “associated” with the suspect, or if it has been

“assigned” to the suspect, but those cases have not specified whether the

evidence showed that the IP address was “associated” with or “assigned” to

the suspect at the precise moment illegal activity was observed. See, e.g.,

Barrett v. State, 367 S.W.3d 919, 923 (Tex. App.—Amarillo 2012, no pet.) (IP

address “associated” with suspect); Gardner v. State, 433 S.W.3d 93, 100 (Tex.
                                         21
App.—Houston [1st Dist.] 2014, pet. ref’d) (IP address “assigned to” suspect).

The State can find no case, either in Texas or in the federal courts, where an

affidavit connected the suspect to the offending IP address but not at the

precise moment the illegal activity occurred, and the appellant has cited to no

such case.

      At the motion-to-suppress hearing, the trial court focused on the next

paragraph of the affidavit, which stated that the appellant’s Comcast account

“was created on 07/09/2009 and is currently active on [August 20, 2012].”

(Def.’s Ex. 1 at 7). The trial court believed this meant that the appellant had

had the same IP address for the entire period his account was active: “[T]he

information in the search warrant that the officer got from the grand jury

subpoena from Comcast shows that this IP address was created on July 9th of

2009 for this defendant at this address and remained with him at least up

until the point of, I guess, August 9th of 2012.” (3 RR 89-90).

      Nothing in the affidavit directly supports or refutes this belief. Trial

counsel did not apprise the trial court that this belief was incorrect.

      There is still a substantial basis in the affidavit for a magistrate to find

that the appellant had the offending IP address at the time it was seen

downloading and/or sharing child pornography. First, the affidavit states that

Lee subpoenaed Comcast for subscriber information “based upon the dates
                                        22
and time the IP address was seen downloading what are believed to be child

pornographic images or videos.” (Def.’s Ex. 1 at 6). It is a fair inference from

these facts that Lee had observed this IP address downloading child

pornography on April 4 and August 5 but had not mentioned it explicitly in his

affidavit.4 See Rodriguez v. State, 232 S.W.3d 55, 62 (Tex. Crim. App. 2007)

(“The inquiry for reviewing courts, including the trial court, is whether there

are sufficient facts, coupled with inferences from those facts, to establish a ‘fair

probability’ that evidence of a particular crime will likely be found at a given

location.”). Certainly this inference is at least as fair as inferring that Lee had

subpoenaed information for relevant dates but Comcast had replied with

more-or-less random information.


                G. The appellant’s complaint about Lee’s “method” of
                   comparing hash values is irrelevant.

         In his brief, the appellant complains that Lee “did not use valid

techniques to compare the hash values” of the files found on the appellant’s

computer to known child pornography. (Appellant’s Brief at 29-31). In the

trial court, most of the appellant’s arguments related to the hash value

comparison. (3 RR 83-85, 87-88).



4   Lee testified to as much at the motion-to-suppress hearing. (3 RR 56).

                                               23
      The appellant’s complaint is both meritless and irrelevant. In his brief,

the appellant bases his complaint on a statement in the affidavit where Lee

states that his software “allows investigators to compare the digital hash

values of the offered files to the hash values of known child pornography

provided by the National Center for Missing and Exploited Children, which

acts as a clearinghouse for images and videos of Child Pornography.” (Def.’s Ex.

1 at 6). From this statement, the appellant draws the conclusion that

comparing hash values to images from the National Center for Missing and

Exploited Children is the only appropriate method to determine from a file’s

hash values if it contains child pornography. (Appellant’s Brief at 29-30). This

conclusion has no basis in the affidavit and is facially absurd, as it suggests

that no one other than the National Center for Missing and Exploited Children

is capable of determining whether a file contains child pornography.

      The affidavit clearly lays out Lee’s method in this case and his basis for

believing it was reliable. He obtained the hash values of files that were being

shared by the appellant’s computer. He then asked other law officers if they

had seen files with those hash values. He obtained copies of three files that

matched those hash values. See Pair v. State, 184 S.W.3d 329, 338 (Tex. App.—

Fort Worth 2006, no pet.) (when law enforcement officer swears out affidavit

and describes getting information from other officers, that information is
                                      24
presumed credible). He stated that, to his knowledge, there have never been

two files with the same hash values but different content. He also stated that

he had personally matched up “thousands” of files by using their hash values.

And he described in graphic detail the contents of the files that matched the

hash values of the files the appellant was sharing. Nothing in the appellant’s

brief undermines the validity of the hash-value comparison Lee performed in

this case.


             H. The information in the affidavit connecting child
                pornography to the appellant’s residence was not stale.

      In his next complaint, the appellant points out that, while the affidavit

connects the appellant and his internet account to 18107 Fairhope Oaks in

August (via the subpoena return from Comcast), the affidavit was not sworn to

until December 10, and nothing in the affidavit indicates that police did

anything to confirm that the appellant was still living at the address in

December. (Appellant’s Brief at 31-32). The appellant claims that this four-

month gap in information renders the affidavit stale.

      However, the affidavit, read in the light most favorable to the trial court’s

ruling, includes information that the appellant had had this internet account at

this address for more than three years at the time of the subpoena return.



                                       25
(Def.’s Ex. 1 at 7). This is how the trial court interpreted the affidavit. (3 RR 89-

90).

       The State can find no Texas case describing how long information

regarding an individual’s residence remains fresh enough to support a

warrant for that residence, and the appellant does not cite to any. The State

would direct this Court to the case of United States v. Bervaldi, 226 F.3d 1256

(11th Cir. 2000). That case dealt with the execution of an arrest warrant; the

police executed an arrest warrant at a particular address on the basis of

information that the suspect had lived there six months earlier. Bervaldi, 226

F3d 1265. On appeal, Bervaldi complained that the police did not have a

“reasonable belief” — the standard required by the Supreme Court in order to

allow police to serve an arrest warrant at a particular location — that he

would be at that residence. Ibid.

       The Eleventh Circuit began its analysis by recognizing that, while

“reasonable belief” was a different standard than “probable cause,” the same

general rules of staleness would apply to both situations. Ibid. The Bervaldi

court compared the situation to cases where affidavits had described ongoing

criminal activity at a location or bullets in the walls of a location and

concluded that, because of the nature of what was described in the affidavit,

probable cause did not dissipate as quickly as it would if the affidavit
                                         26
described a single drug transaction at a location. Id. at 1265 (citing United

States v. Diecidue, 603 F.2d 535, 560 (5th Cir. 1979) (four-month-old

information about bullets in floors and walls of searched location not stale)).

“Residency in a house, like protracted and continuous criminal activity or

projectiles embedded in the house's walls and floors, generally is not

transitory or ephemeral, but instead endures for some length of time.”

Bervaldi, 226 F.3d at 1265.

      In this case, the affidavit gave information that the appellant had lived a

particular location for several years. That location, as described in the

affidavit, was not an apartment or vacation rental, but a single-family

suburban home. (Def.’s Ex. 1 at 1). Given those facts, the State believes that

whatever probable cause to believe that the appellant lived at this address in

August had not become stale by the time the warrant issued four months later.

      As for the information regarding the child pornography itself, the

affidavit in this case stated that those who download child pornography tend

to collect it and hold it as “prized possessions,” and tend to keep it even if they

move or change computers. (Def.’s Ex. 1 at 12-13). When an affidavit contains

such statements and details the ongoing possession of child pornography, the

information will be “fresh,” for probable-cause purposes, for a lengthy period

of time. See State v. Cotter, 360 S.W.3d 647, 654 (Tex. App.—Amarillo 2012, no
                                        27
pet.) (four months); Sanders v. State, 191 S.W.3d 272, 279 (Tex. App.—Waco

2006, pet. ref’d) (seventeen months); United States v. Hay, 231 F.3d 630, 636

(9th Cir. 2000) (six months); United States v. Morales-Aldahondo, 524 F.3d 115,

119 (1st Cir. 2008) (forty-four months).

      In sum, while the appellant may be correct that it might have been

better for Lee to have updated some of his information sometime between

August and December, it is not this Court’s role to determine what he should

have done. The only question on appeal is whether what he did do provided

the magistrate with a substantial basis for finding probable cause. The

caselaw, both of this State and of the federal courts, indicates that the

information Lee provided in his affidavit was still fresh enough to support a

finding of probable cause.




                                      28
                                  Conclusion

      The State respectfully submits that under the applicable standard of

review the trial court was within its discretion to deny the motion to suppress,

and this Court should affirm that decision.

                                                 DEVON ANDERSON
                                                 District Attorney
                                                 Harris County, Texas


                                                 /s/ C.A. Morgan
                                                 CLINTON A. MORGAN
                                                 Assistant District Attorney
                                                 Harris County, Texas
                                                 1201 Franklin, Suite 600
                                                 Houston, Texas 77002-1923
                                                 (713) 755-5826
                                                 Texas Bar No. 24071454




                                      29
                     Certificate of Compliance and Service

      I certify that, according to Microsoft Word’s word counting function, the

portion of this brief for which Rule of Appellate Procedure 9.4(i)(1) requires a

word count contains 6,380 words.

      I also certify that I have requested that efile.txcourts.gov electronically

serve a copy of this brief to:

      Sarah V. Wood
      sarah.wood@pdo.hctx.net


                                                 /s/ C.A. Morgan
                                                 CLINTON A. MORGAN
                                                 Assistant District Attorney
                                                 Harris County, Texas
                                                 1201 Franklin, Suite 600
                                                 Houston, Texas 77002-1923
                                                 (713) 755-5826
                                                 Texas Bar No. 24071454


Date: April 20, 2015




                                       30
