NOTICE: All slip opinions and orders are subject to formal
revision and are superseded by the advance sheets and bound
volumes of the Official Reports. If you find a typographical
error or other formal error, please notify the Reporter of
Decisions, Supreme Judicial Court, John Adams Courthouse, 1
Pemberton Square, Suite 2500, Boston, MA, 02108-1750; (617) 557-
1030; SJCReporter@sjc.state.ma.us

SJC-12076

             COMMONWEALTH   vs.   ADALBERTO MARTINEZ.



       Bristol.      October 6, 2016. - February 7, 2017.

 Present:   Gants, C.J., Botsford, Lenk, Hines, Gaziano, Lowy, &
                             Budd, JJ.


Obscenity, Child pornography. Constitutional Law, Search and
     seizure. Search and Seizure, Computer. Evidence,
     Information stored on computer.



     Complaint received and sworn to in the Fall River Division
of the District Court Department on May 9, 2012.

     A pretrial motion to suppress evidence was heard by Kevin
J. Finnerty, J., and the case was tried before him.

     The Supreme Judicial Court on its own initiative
transferred the case from the Appeals Court.


     Michelle A. Dame for the defendant.
     Soshana E. Stern, Assistant District Attorney, for the
Commonwealth.


    BOTSFORD, J.   The defendant, Adalberto Martinez, appeals

from his conviction of possessing child pornography in violation

of G. L. c. 272, § 29C.   He challenges the denial of his motion
                                                                       2


to suppress computer evidence obtained pursuant to a search

warrant.    The gravamen of the defendant's claim is that the

police needed to do more to link the defendant to the place

searched and the items seized before a warrant could validly

issue.    We affirm the denial of the motion to suppress and the

conviction.

    Background.     1.   IP addresses.   All computers that connect

to the Internet identify each other through a unique string of

numbers known as an Internet protocol address (IP address).          See

Internet Corporation for Assigned Names and Numbers, Beginner's

Guide to Internet Protocol (IP) Addresses 2, 4 (2011) (ICANN

Guide).    In general, when a subscriber purchases Internet

service from an Internet service provider (ISP), the ISP selects

from a roster of IP addresses under its control and assigns a

unique IP address to the subscriber at a particular physical

address.   See id. at 4, 6; United States v. Kearney, 672 F.3d

81, 89-90 & n.6 (1st Cir. 2012).    See also Office of Legal

Education, United States Department of Justice, Searching and

Seizing Computers and Obtaining Electronic Evidence in Criminal

Investigations 65 (2009) (DOJ, Searching and Seizing Computers).

The IP address assigned to a particular subscriber may change

over time, but the ISP keeps a log of which IP address is

assigned to each subscriber at any given moment in time.       See

Kearney, supra; DOJ, Searching and Seizing Computers, supra.
                                                                       3


    In the early days of the Internet, when a residential

Internet subscriber went online using only a home computer

connected to a hard-wired Internet connection, there was a very

strong correlation between an IP address assigned to a

subscriber and a particular computer.    Now, however, many

subscribers use a wireless Internet router, which allows

multiple devices within the range of the router to connect to

the Internet simultaneously.     See United States v. McLellan, 792

F.3d 200, 213–214 (1st Cir.), cert. denied, 136 S. Ct. 494

(2015), and cases cited.   To the outside world, all of these

devices will share a single public IP address -- the one that

the ISP has assigned to its subscriber.     See id.   But

internally, the router will identify each connected device by

the device's own identifying number in order to channel data to

and from the appropriate device.     See id.   See also ICANN Guide,

supra at 4.   As a result, the correlation between an Internet

subscriber's assigned IP address and any one particular

Internet-enabled device may often be weaker than it once was.

However, the correlation between an IP address and a physical

address can still be strong, at least when the ISP has verified

its assignment of a particular IP address to a subscriber at a

specific physical address at a specific point in time.      See DOJ,

Searching and Seizing Computers, supra at 65-66; Mackey, Schoen,

& Cohn, Unreliable Informants:     IP Addresses, Digital Tips and
                                                                      4


Police Raids 8-10 (Sept. 2016), available at https://www.eff.

org/files/2016/09/22/2016.09.20_final_formatted_ip_address_white

_paper_0.pdf [https://perma.cc/Y42U-C5TG] (EFF, Unreliable

Informants).

     2.   Search warrant affidavit.    The affidavit in support of

the contested search warrant and related materials aver the

following.     On March 9, 2012, State police Sergeant Michael Hill

was investigating the use of "peer-to-peer" file sharing

programs to possess and distribute child pornography.    One such

file-sharing program, Ares, allows a user to connect to another

user's computer via the Internet and then download digital files

that are stored locally on the other user's computer.     Ares is

an open-source software that any person can download for free

via the Internet.    There is a special version of the Ares

program for law enforcement agencies that allows them to monitor

and investigate individuals suspected of using Ares to share

digital files of child pornography.    Using the law enforcement

version of Ares to download a file from another Ares user,

investigators can determine (1) the user's IP address, (2)

whether the user possesses and is sharing a particular file, (3)

the "hash value" associated with a particular file,1 (4) the

user's Ares username, and (5) the version of Ares software that

     1
       Each file shared through Ares is identified by its "hash
value" -- a string of numbers that, for all practical purposes,
uniquely identifies a digital file.
                                                                    5


the user's computer is operating.     Because the law enforcement

version of Ares displays both the IP addresses of Ares users and

the hash values of files being shared, when police identify a

file as one that contains child pornography, police can

determine with a high degree of confidence when that child

pornography file is being shared through a specific IP address.

    In this case, Hill discovered that a computer using the IP

address 65.96.142.191 and displaying the username

"datflypapi@Ares" was sharing suspected child pornography via

the Ares network.   Through an online mapping tool (several of

which exist on publicly accessible Web sites), Hill determined

that this IP address was likely associated with a computer in

Massachusetts.   The computer using this IP address was sharing a

total of ten files via the network.    Hill found that a majority

of these files had names containing terms commonly associated

with child pornography.   Over approximately thirty minutes, Hill

downloaded and viewed four video files from the suspect computer

and concluded that these files were child pornography.    While

downloading the files, Hill used another program that confirmed

that a computer associated with the IP address 65.96.142.191 was

connected to his computer.

    By conducting an Internet search, Hill determined that the

IP address in question was associated with Comcast Cable

(Comcast), a major cable company and ISP.     Based on the above
                                                                     6


information, the district attorney for the Berkshire district

issued an administrative subpoena to Comcast asking to whom the

IP address 65.96.142.191 was assigned during the thirty-minute

period on March 9, 2012, during which Hill downloaded the four

suspected child pornography video files from datflypapi@Ares.

Comcast responded to the subpoena on March 15, 2012, and

provided information that the IP address was assigned to a

subscriber named "Angel Martinez" at a certain address in Fall

River (apartment).   Hill then referred the investigation to

Detective Steven Washington of the Fall River police department.

On April 2, 2012, Washington went to the apartment, which is

part of a housing development.    Washington discovered that Maria

Avilez2 leased the apartment.    On April 3, 2012, Washington

sought and received, from the Fall River Division of the

District Court, a warrant to search the apartment for computers

and related items connected to the suspected possession and

distribution of child pornography.

     3.   Execution of the search warrant.   Washington and two

other officers executed the warrant on April 5, 2012.    According

to Washington's trial testimony, when the officers first knocked

     2
       The search warrant and supporting affidavit identify one
of the occupants of the apartment as "Maria Avilez." The trial
transcript refers to her as "Maria Alvarez" or "Maria Avelez."
In this opinion, we use the name on the search warrant. The
search warrant affidavit also refers to Avilez as the mother of
Angel Martinez. At trial, she was identified as the grandmother
of both Angel Martinez and the defendant, Adalberto Martinez.
                                                                     7


on the door of the apartment, no one answered.3    Washington then

heard someone say, "Hey, he just ran out that way," and saw a

"large male" running down a side street away from the apartment.

The officers eventually entered the apartment.    Inside they

encountered the defendant's girl friend, Ruth Pereira, holding

her infant child.    Both Avilez and Angel Martinez, the

defendant's cousin, arrived at the apartment while officers were

conducting the search, but the defendant was not present.

     During the search, Washington noticed two laptop computers

underneath a basket of laundry.    After some initial testing

(which was not described in detail in the trial record), the

officers seized the two computers and brought them back to the

police station.4    Upon further inspection at the station,

officers discovered five video files of child pornography on one

of the defendant's laptop computers.    It is not clear from the

record whether any of these video files were among those

observed by Hill during his Ares surveillance on March 9, 2012.

     4.   Procedural history.   A complaint issued charging the

defendant with one count of distribution of material depicting a

child engaged in a sexual act, in violation of G. L. c. 272,

     3
       The pretrial hearing on the defendant's motion to suppress
evidence seized during the search of the apartment was
nonevidentiary.
     4
       The defendant's girl friend, Ruth Pereira, testified at
trial that the two computers belonged to the defendant. The
defendant does not challenge the accuracy of this testimony.
                                                                      8


§ 29B (b), and one count of possession of child pornography, in

violation of G. L. c. 272, § 29C.     Prior to trial, the defendant

moved to suppress the evidence obtained in executing the search

warrant described above.    He argued that the search warrant

affidavit did not establish probable cause that the contraband

being sought would be present in the apartment, and therefore

the search violated his rights under the Fourth Amendment to the

United States Constitution and art. 14 of the Massachusetts

Declaration of Rights.    After a hearing, a District Court judge

denied the motion.    The judge ruled that the affidavit and

accompanying exhibits provided probable cause to believe

evidence of specific criminal activity would be found at the

apartment.

    The defendant was tried before and convicted by a jury in

the District Court on the charge of possession of child

pornography; the Commonwealth filed a nolle prosequi of the

distribution charge.     The defendant timely appealed from his

conviction, and we transferred the appeal to this court on our

own motion.

    Discussion.      The sole issue on appeal is the validity of

the search warrant issued for the apartment.     Detective

Washington's affidavit in support of the search warrant averred

that a particular IP address was used to share child pornography

and that this IP address had been assigned at the time in
                                                                   9


question to an Internet subscriber at the specific physical

address to be searched.   The central question is whether these

averments were sufficient to establish probable cause for the

search, even though the named subscriber was neither listed as,

nor confirmed to be, living in the unit, and even though police

had no information before the search linking the defendant to

the residence.   We conclude that the affidavit in this case did

establish probable cause to search the apartment for computer

evidence related to the suspected possession or distribution of

child pornography.

     "Under the Fourth Amendment and art. 14, a search warrant

may issue only on a showing of probable cause."5   Commonwealth v.


     5
       The defendant is correct that, in certain circumstances,
art. 14 of the Massachusetts Declaration of Rights provides more
substantive protection to criminal defendants than the Fourth
Amendment to the United States Constitution. See, e.g.,
Commonwealth v. Rodriguez, 472 Mass. 767, 776 (2015). Here, we
conclude that there was probable cause for the search warrant
under both art. 14 and the Fourth Amendment. As for the Fourth
Amendment, our conclusion accords with the decisions of several
Federal courts that have found probable cause in similar factual
settings. See, e.g., United States v. Valley, 755 F.3d 581, 587
(7th Cir.), cert. denied, 135 S. Ct. 461 (2014) (probable cause
existed when investigators downloaded child pornography from IP
address, then traced IP address to residence defendant shared
with his mother); United States v. Vosburgh, 602 F.3d 512, 526
(3d Cir. 2010), cert. denied, 563 U.S. 905 (2011) (noting that
"several Courts of Appeals have held that evidence that the user
of a computer employing a particular IP address possessed or
transmitted child pornography can support a search warrant for
the physical premises linked to that IP address," and so
holding); United States v. Perez, 484 F.3d 735, 740 (5th Cir.),
cert. denied, 552 U.S. 952 (2007) (probable cause based on
information in affidavit that child pornography was viewed by
                                                                      10


Anthony, 451 Mass. 59, 68 (2008).     "The probable cause necessary

to support the issuance of a search warrant does not require

definitive proof of criminal activity."      Id. at 69.   Rather, a

warrant may issue if a magistrate finds "a substantial basis on

which to conclude that the articles or activity described are

probably present or occurring at the place to be searched"

(emphasis in original).   Id.    To determine whether probable

cause exists, our inquiry "always begins and ends with the four

corners of the affidavit."      Id. at 68, quoting Commonwealth v.

O'Day, 440 Mass. 296, 297 (2003).     For probable cause to arise,

the facts contained in an affidavit, plus the reasonable

inferences that may be drawn from them, must allow the

magistrate to determine that "the items sought are related to

the criminal activity under investigation, and that they

reasonably may be expected to be located in the place to be

searched at the time the search warrant issues."      Commonwealth

v. McDermott, 448 Mass. 750, 767, cert. denied, 552 U.S. 910

(2007), quoting Commonwealth v. Cinelli, 389 Mass. 197, 213,

cert. denied, 464 U.S. 860 (1983).     See Anthony, supra at 68.


computer using particular IP address and that this IP address
was assigned to user at specific physical address; noting that
although "it was possible that the transmissions originated
outside of the residence to which the IP address was assigned,
it remained likely that the source of the transmissions was
inside that residence"); United States v. Grant, 218 F.3d 72, 75
(1st Cir.), cert. denied, 531 U.S. 1025 (2000) (probable cause
existed even discounting for possibility that someone other than
Internet account registrant was using account).
                                                                    11


"[S]earch warrant affidavits are to be interpreted in a

realistic and commonsense manner," not "subjected to

hypercritical analysis" (citation omitted).   Id. at 69.

    The probable cause inquiry in this case asks whether the

facts averred in Washington's affidavit showed a sufficient

nexus between the suspected criminal activity (possessing or

distributing child pornography), the items sought (computers and

related materials), and the place to be searched (the

apartment).   See McDermott, 448 Mass. at 768-769.   To that end,

the nexus between the suspected criminal activity, the items

sought, and the place to be searched may be based on, among

other things, the type of crime, the extent of the suspect's

opportunity for concealment, and normal inferences about where a

criminal would be likely to hide evidence of the suspected

crime.   See id. at 768.

    Here, the affidavit described how Sergeant Hill had

observed a computer associated with the IP address 65.96.142.191

that contained, and was sharing, child pornography via the Ares

network.   An Internet search revealed that this IP address had

been issued to Comcast, the ISP.   The district attorney for the

Berkshire district then issued a subpoena to the ISP, which

revealed that the IP address in question had been assigned

during the relevant time period to a subscriber at the physical
                                                                    12


address of the apartment.6   The temporal and geographical links

between the target IP address and the physical address to be

searched provided a substantial basis for concluding that

evidence sought (computers and related items) was connected to

the suspected crime (possessing or sharing child pornography)

and likely would be found at the specified premises (the

apartment), and therefore gave rise to a sufficient nexus

between the suspected criminal activity and the residence.    See

Commonwealth v. Augustine, 472 Mass. 448, 455 (2015);

Commonwealth v. Foster, 471 Mass. 236, 241–242 (2015).

     Of course, the ISP also provided a name associated with the

service address and officers took subsequent steps to determine

who actually lived at the apartment.   In many cases, those

pieces of information can serve a useful confirmatory role.    But

in the present case, we conclude that there was probable cause

to search for evidence related to sharing child pornography

based on the information police obtained through their Ares

surveillance and the administrative subpoena, independent of

whose name was on the Internet account or in the housing

     6
       We note that the administrative subpoena is generally a
more reliable method of connecting an IP address with a physical
address, as compared to certain IP address mapping services.
See Mackey, Stanton, Schoen, & Cohn, Electronic Frontier
Foundation, Unreliable Informants: IP Addresses, Digital Tips
and Police Raids 8-9 (Sept. 2016), available at https://www.eff.
org/files/2016/09/22/2016.09.20_final_formatted_ip_address_white
_paper_0.pdf [https://perma.cc/Y42U-C5TG] (discussing error
rates of some IP address mapping services).
                                                                  13


development's records.     The probable cause showing necessary for

issuance of a search warrant is "only a fair probability that

evidence of such a crime would be found in particular

locations," not "a prima facie showing that the defendant

possessed child pornography."    Anthony, 451 Mass. at 72.   Police

met that threshold here.

    The defendant advances, in essence, three arguments about

why investigators needed to do more to establish probable cause.

We address each in turn.

    First, he points out that before applying for the search

warrant, the police were unable to verify that the subscriber

named by the ISP -- Angel Martinez -- lived at the apartment,

and also were unable to rule out the possibility that someone

other than the named subscriber was responsible for using the IP

address assigned to the apartment at the time in question.

Therefore, the defendant argues, it was possible that a new (and

innocent) person had moved into the apartment while Angel

Martinez, living at a different address altogether, continued to

pay the Internet bill, or that a new occupant merely took over

the Internet payments without changing the name on the account.

To support his position, the defendant cites several cases in

which investigators obtained more information linking an

individual suspect to a specific physical address before

applying for a search warrant.    See, e.g., United States v.
                                                                  14


Elbe, 774 F.3d 885, 887–888 (6th Cir. 2014), cert. denied, 135

S. Ct. 1573 (2015) (agents observed person matching child

pornography suspect's driver's license photograph sitting on

porch of target residence); United States v. Stults, 575 F.3d

834, 838 (8th Cir. 2009), cert. denied, 559 U.S. 915 (2010)

(public records check using LexisNexis, postal service mail

delivery check, and motor vehicle registration check all

confirmed that named Internet subscriber actually resided at

target residence).

    It is true that investigators had no direct information

that Angel Martinez personally had used, was using, or would

ever use the IP address in question.   However, in this

particular case, the name of the Internet account holder did not

defeat probable cause.    See Commonwealth v. Molina, 476

Mass.   ,    (2017).     The question before the magistrate was

whether the apartment located at a certain address likely

contained evidence of criminal activity -- period.    The question

was not whether that address likely contained evidence of

criminal activity on the part of Angel Martinez (or on the part

of Avilez for that matter).

    To that end, Detective Washington's supporting search

warrant affidavit spelled out a relatively direct link between

(1) the downloading and sharing of child pornography video

files, (2) a specific IP address, and (3) a specific physical
                                                                  15


address to which that IP address had been assigned.   From a

technological standpoint, an IP address can be assigned to only

one service address at any given point in time.   See United

States v. Vosburgh, 602 F.3d 512, 527 & n.14 (3d Cir. 2010),

cert. denied, 563 U.S. 905 (2011), and cases cited (noting

"unique nature of the IP address assigned" to defendant on

particular date made Internet activity on that date "fairly

traceable" to specific ISP account and associated physical

address); DOJ, Searching and Seizing Computers, supra at 65.

Taken together, these facts gave rise to a reasonable inference

that evidence related to possession or distribution of child

pornography via the Internet likely would be found at the

apartment -- the one place, according to the ISP's records, to

which the IP address in question was assigned during the

relevant time period.

     Once this nexus was established, the name of the account

holder was essentially incidental.   See Molina, 476 Mass. at

.   Although information showing that the named subscriber was

also the person suspected of possessing or sharing the child

pornography might have increased the likelihood that the sought-

after evidence would be located at the service address, the lack

of such information does not necessarily defeat probable cause.

See United States v. Grant, 218 F.3d 72, 75 (1st Cir.), cert.

denied, 531 U.S. 1025 (2000).   This is so precisely because an
                                                                     16


IP address can be assigned to only one service address at any

given time -- regardless of whose name is on the account.7     See

Vosburgh, 602 F.3d at 527 & n.14.

     Second, the defendant points out that investigators did not

determine whether the Internet connection at the apartment used

a wireless router and, if so, whether the wireless network

required a password.   This left open the possibility that

someone other than the subscriber, located at a different

physical address, was "joyriding" on an unsecured wireless

network based out of the apartment.   See Snow, Accessing the

Internet Through the Neighbor's Wireless Internet Connection:

Physical Trespass in Virtual Reality, 84 Neb. L. Rev. 1226,

1227-1229 (2006).   The defendant argues that this concern is

especially acute in the present case because investigators knew

that the apartment was part of a housing development, in which

multiple residences were in close proximity to the target

physical address.

     The defendant's argument is misdirected.   A showing of

probable cause to search a place (as opposed to arrest a person)


     7
       The defendant does not now claim that the information in
the police affidavit had become stale. The defendant's motion
to suppress did include a passing reference to staleness.
However, this theory was not advanced at the suppression motion
hearing, and the defendant's brief does not make such an
argument. Any staleness issue, therefore, is waived. See
Commonwealth v. Wood, 389 Mass. 552, 554 n.3 (1983), citing
Mass. R. A. P. 16 (a) (4), as amended, 367 Mass. 919 (1975).
                                                                       17


need not identify a specific criminal suspect -- although

frequently it does.      See Zurcher v. Stanford Daily, 436 U.S.

547, 555–557 & n.6 (1978).     See also Molina, 476 Mass. at       .

Indeed, "[t]he critical element in a reasonable search is not

that the owner of the property is suspected of crime but that

there is reasonable cause to believe that the specific 'things'

to be searched for and seized are located on the property to

which entry is sought."     Zurcher, supra at 556.   In other words,

police need only demonstrate a sufficient nexus between the

criminal activity under investigation, the items sought, and a

place to be searched where the items may reasonably be expected

to be located -- independent of whether they have identified a

specific criminal suspect.8     See McDermott, 448 Mass. at 767-768;

O'Day, 440 Mass. at 302-304.     Certainly police may have an

easier time demonstrating a sufficient nexus if they can link a

specific suspect (e.g., the named Internet account holder) to




     8
       To this point, the prosecutor and Detective Steven
Washington had the following colloquy at trial:

     Q.: "Now when you execute a warrant like this . . . are
     you conducting . . . [the search] for a person or for a
     device?"

     A.:   "A device."

     Q.:   "Okay.   And why is that?"

     A.:   "Because I have no clue who is behind that device."
                                                                  18


the criminal activity.   However, such a link is not always

required.

     The search warrant affidavit in this case demonstrated that

child pornography was being shared via the Internet from a

specific IP address.   This IP address, in turn, had been

assigned to a specific physical address during the time when the

child pornography was being shared.   These facts provided a

substantial basis from which to conclude that evidence of

downloading and sharing child pornography via the Internet would

be located at the apartment, even if it turned out that an

unauthorized user was "joyriding" using the targeted IP address.

See Augustine, 472 Mass. at 455; Commonwealth v. Escalera, 462

Mass. 636, 645 (2012), quoting 2 W.R. LaFave, Search and Seizure

§ 3.7(d), at 420–421 (4th ed. 2004) (police do not need to

provide definitive proof that evidence of suspected criminal

activity will be located at targeted residence, only facts

supporting reasonable inference that such evidence "probably"

would be located there).   See also Grant, 218 F.3d at 75 (even

discounting for possibility that individual other than

subscriber may have been using account, there was fair

probability that subscriber was user and that evidence of user's

illegal activities would be found in subscriber's home).9


     9
       This close nexus also distinguishes a case like
Commonwealth v. Kaupp, 453 Mass. 102 (2009). In that case, we
                                                                  19


     The defendant is correct, from a technological standpoint,

that if an Internet subscriber at the apartment set up an

unsecured wireless Internet network, a computer outside of this

physical address (in a neighboring unit, perhaps) could have

used the targeted IP address to access the Internet and share

child pornography.10   This point misses the mark, because



held that police lacked probable cause to search a specific
computer for evidence of child pornography. Id. at 113-114.
However, in the Kaupp case, there was no indication that a
specific IP address had been used to download or share child
pornography. Instead, police essentially relied on the fact
that the targeted computer may have shared another,
nonpornographic file with a computer that did contain child
pornography, and that these two computers were connected in a
way that made it possible for them to share other files. See
id. at 111-112. The nexus in this case -- where an officer
directly observed child pornography being transmitted through
the targeted IP address, which could only be assigned to one
physical address at the time in question -- is substantially
stronger.
     10
       Notably, there was no evidence, either at the suppression
stage or at trial, that the apartment was home to an unsecured
wireless Internet connection or that anyone other than the
defendant used the Internet connection there. Nor was there any
evidence that the defendant did not connect his laptop computers
to the Internet through the IP address assigned to the
apartment. However, even if we accept the defendant's
hypothetical scenario of "joyriding," and it turned out that
none of the defendant's devices contained child pornography,
police still would have had probable cause to seize and search
any Internet modems or routers in order to determine which
devices were connected to the targeted IP address at the time
when police witnessed child pornography being shared via the
targeted IP address. See United States v. Stanley, 753 F.3d
114, 115-117 (3d Cir.), cert. denied, 135 S. Ct. 507 (2014)
(describing how wireless Internet router keeps log of devices
that have connected to it). If those devices, or other
information, then led police to a device at a different physical
address from the one linked to the IP address through the ISP's
                                                                  20


probable cause does not require investigators to "establish to a

certainty that the items to be seized will be found in the

specified location," nor does it require them to "exclude any

and all possibility that the items might be found elsewhere."

Anthony, 451 Mass. at 70, quoting Commonwealth v. Harmon, 63

Mass. App. Ct. 456, 461 (2005).

    Finally, the defendant argues that, in a case like this,

probable cause cannot arise until police show one of three

things:   (1) that the target IP address has not been linked to a

wireless Internet service; (2) that the target IP address is

linked to a wireless Internet service, but it is a secure

connection requiring a password; or (3) that no one outside the

target physical address could be accessing the network.     The

defendant urges that, without these showings, the likelihood of

someone outside the target physical address using the target IP

address is substantial enough to defeat probable cause.     By and

large, these proposals simply restate the defendant's arguments


records, police likely would have needed another warrant. Cf.
United States v. Voustianiouk, 685 F.3d 206, 213-214 (2d Cir.
2012) (where police omitted target's name from application for
warrant to search specific apartment, second warrant was
required once it became clear target lived in different
apartment); United States v. Greathouse, 297 F. Supp. 2d 1264,
1274–1275 (D. Or. 2003) (second warrant required when it became
clear to officers executing warrant that target resided in
rented room within house). But, as illustrated above, that
scenario is several steps removed from what occurred here, where
police quickly located two laptop computers that belonged to the
defendant, one of which contained five video files of child
pornography.
                                                                    21


urging that the police, in order to show probable cause, should

have been required to rule out the possibility that persons

outside of the apartment may have been "joyriding" on the IP

address assigned to that location at the time in question.     To

the extent that is the case, we reject these proposals for the

reasons already mentioned.

    Moreover, as the Commonwealth points out, it is not clear

whether it would be technologically feasible for investigators

to do what the defendant asks.   With respect to the first

proposal, there is nothing in the record showing that a third

party (like an ISP, for instance) would be able to determine

whether a subscriber's connection to the Internet is through a

hard-wired or wireless connection at any given point in time.

With respect to the second, in the case of a subscriber who uses

a wireless router, it is not clear how investigators would be

able to ascertain whether the network is password-protected

without first learning the name of that subscriber's wireless

network.   And regarding the third proposal, even assuming

investigators knew that a target IP address was associated with

an unprotected wireless network that had been accessed by

devices not belonging to the subscriber, these considerations

would not necessarily change the fact that, given the Ares

surveillance conducted in this case, there remained a fair

probability that any computers located at the apartment would
                                                                   22


contain evidence related to the possession or distribution of

child pornography.   See United States v. Stanley, 753 F.3d 114,

115-117 (3d Cir.), cert. denied, 135 S. Ct. 507 (2014) (based on

file-sharing surveillance similar to that conducted in this

case, police obtained valid search warrant for home linked to

target IP address; only after police found no evidence of child

pornography there and learned, in course of their search, that

home deployed wireless Internet network that was not password-

protected did they take subsequent steps to locate true

suspect); United States v. Perez, 484 F.3d 735, 740 (5th Cir.),

cert. denied, 552 U.S. 952 (2007) (although possible that

Internet transmissions originated outside of residence to which

IP address was assigned, it remained likely that source of

transmissions was inside that residence); Grant, 218 F.3d at 75

(similar); United States v. Carter, 549 F. Supp. 2d 1257, 1268–

1269 (D. Nev. 2008) (similar).   The defendant's proposals merely

illustrate that different hypothetical scenarios could lead to a

different conclusion regarding probable cause.   But those

potentialities do not necessarily defeat probable cause,

especially when they lack any factual underpinning.   See

Anthony, 451 Mass. at 70 (discussing nexus requirement).

Instead, the fundamental question is whether there was a

substantial basis from which to conclude that the items

described in the application were probably present at the place
                                                                       23


to be searched.     See id. at 69.   For all of these reasons, we

affirm the denial of the defendant's motion to suppress.11

     We end with a cautionary note.       Our decision today should

not be read to mean that probable cause always exists any time

investigators link illegal computer activity to an IP address

and then link that IP address to a physical address.        For one,

police should (as they did in this case) connect the IP address

with a physical address through a reliable method, such as an

administrative subpoena to the ISP, rather than relying solely

on a potentially unreliable method, such as certain IP address

mapping services.    See note 6, supra.     Additionally,

technologies that apparently were not at issue in this case may

further erode the connection between an IP address and a

physical address.    See EFF, Unreliable Informants, supra at 10-

11 (discussing how Tor exit relays, virtual private networks,

and proxy server connections can mask originating IP addresses

through use of one or more intermediary IP addresses); Vosburgh,

602 F.3d at 527 n.14 (discussing "possibility of mischief and

mistake with IP addresses" such that, in some cases, "value of

     11
        The defendant does not challenge the reasonableness or
scope of the search of his digital files once police had seized
his computers, nor does he raise the related issue whether
courts should require police to develop minimization techniques
to govern the execution of a digital search. Accordingly, we
need not address those issues here. However, in an appropriate
case, we would consider whether to require some type of digital
search protocol. See Commonwealth v. Molina, 476 Mass.       ,
(2017).
                                                                    24


that IP address for probable cause purposes may be greatly

diminished, if not reduced to zero").

    At the very least, certain cases may require police to

disclose in a search warrant affidavit the possibility that one

of these technologies is, or may be, in play based on facts

known or reasonably knowable to investigators at the time.    See

EFF, Unreliable Informants, supra at 18.    If such technologies

become more common, it is entirely possible that we would

require police to proceed in multiple steps, obtaining subpoenas

related to each intermediary IP address or warrants to search

each location hosting those IP addresses.    Alternatively, some

cases may require the police to examine forensically a wireless

router to determine which devices were connected to it, and

when, before they search particular computers.    See Stanley, 753

F.3d at 115-117 (describing police investigation based on

information obtained by examining innocent Internet user's

unprotected wireless Internet router that had been "hijacked" by

neighbor-defendant to share child pornography).

    Such possibilities demonstrate why the probable cause

analysis rarely, if ever, lends itself to bright-line rules.

See Escalera, 462 Mass. at 643 ("No bright-line rule can

establish whether there is a nexus" between suspected criminal

activity and defendant's home).   This is especially so when, as

here, the analysis hinges on fluid and rapidly changing
                                                                  25


technologies.   Cf. Commonwealth v. Dorelas, 473 Mass. 496, 502 &

n.11 (2016) (noting that "what might have been an appropriate

limitation [on searches] in the physical world becomes a

limitation without consequence in the virtual one"); id. at 505

(Lenk, J., dissenting) (transposing protections of art. 14 and

Fourth Amendment to digital contexts "is an ongoing and

challenging task"); Commonwealth v. Phifer, 463 Mass. 790, 797

(2012) (noting that developments in cellular telephone

technology "present novel and important questions about the

relationship between the modern doctrine of search incident to

arrest and individual privacy rights").

    Conclusion.    The order denying the motion to suppress and

the defendant's conviction are affirmed.

                                   So ordered.
