State v. Mixton

250 Ariz. 282

478 P.3d 1227

STATE of Arizona, Appellee,

v.William MIXTON, Appellant.

No. CR-19-0276-PR

Supreme Court of Arizona.

Filed January 11, 2021

Mark Brnovich, Arizona Attorney General, Brunn "Beau" W. Roysden III, Solicitor General, Joseph T. Maziarz, Chief Counsel, Criminal Appeals Section, Linley Wilson (argued), Deputy Solicitor General, Phoenix, Attorneys for State of Arizona

Joel Feinman, Pima County Public Defender, Abigail Jensen (argued), David J. Euchner, Deputy Public Defenders, Tucson, Attorneys for William Mixton

Timothy Sandefur, Scharf-Norton Center for Constitutional Litigation at the Goldwater Institute, Phoenix, Attorney for Amicus Curiae Goldwater Institute

Paul V. Avelar, Timothy D. Keller, Keith E. Diggs, Institute for Justice, Tempe, Attorneys for Amicus Curiae Institute for Justice

Elizabeth Burton Ortiz, Arizona Prosecuting Attorneys’ Advisory Council, Phoenix, Attorney for Amicus Curiae Arizona Prosecuting Attorneys’ Advisory Council

Jared G. Keenan, American Civil Liberties Union Foundation of Arizona, Phoenix, Attorney for Amici Curiae American Civil Liberties Union of Arizona, American Civil Liberties Union, and Electronic Frontier Foundation

JUSTICE LOPEZ authored the opinion of the Court, in which JUSTICES GOULD, BEENE, and MONTGOMERY joined. JUSTICE BOLICK, joined by CHIEF JUSTICE BRUTINEL and VICE CHIEF JUSTICE TIMMER, dissented.

JUSTICE LOPEZ, opinion of the Court:

¶1 We consider whether the Fourth Amendment to the United States Constitution or article 2, section 8 of the Arizona Constitution requires law enforcement officials to secure a judicially-authorized search warrant or order to obtain either (1) a user's Internet Protocol ("IP") address or (2) subscriber information the user voluntarily provides to an Internet Service Provider ("ISP") as a condition or attribute of service. We hold that neither the federal nor the Arizona Constitution requires a search warrant or court order for such information and that law enforcement officials may obtain IP addresses and ISP subscriber information with a lawful federal administrative subpoena.

BACKGROUND

¶2 An ISP is a company that provides individuals with access to the internet. United States v. Jean , 207 F. Supp. 3d 920, 931 (W.D. Ark. 2016), aff'd 891 F.3d 712 (8th Cir. 2018). The ISP assigns a string of numbers, called an IP address, to a customer's modem to facilitate access to the internet. Id. at 928. Consequently, a user does not control nor own an IP address. IP addresses are always attached, "like a ‘return address,’ to every ‘envelope’ of information exchanged back and forth by computers that are actively communicating with each other over the internet." Id. at 928–29. When a computer accesses a website, the IP address tells the website where to transmit data. See Frederick Lah, Note, Are IP Addresses "Personally Identifiable Information"? , 4 I/S: J.L. & Pol'y for Info. Soc'y 681, 693 (2008). Search engines, such as Google, also log IP addresses of users and use these logs to improve the quality of search results and advertisements for visitors. Id. at 693–94.

¶3 An IP address alone does not reveal an internet user's identity. Rather, it generally reveals only a user's approximate geographic location, such as a neighborhood, and the user's ISP. Lincoln Spector, Your IP address: Who can see it and what you can do about it , PCWorld (Mar. 17, 2014, 7:15 AM), https://www.pcworld.com/article/2105405/your-ip-address-who-can-see-it-and-what-you-can-do-about-it.html.

The ISP, however, maintains records and information, such as the name, address, and telephone number associated with an IP address, known as "subscriber information." See Savanna L. Shuntich & Kenneth A. Vogel, Doe Hunting: A How-to Guide for Uncovering John Doe Defendants in Anonymous Online Defamation Suits , Md. B.J. 48, 51 (July/Aug. 2017).

¶4 Here, in 2016, an undercover Tucson Police Department detective posted an advertisement on an online forum seeking users interested in child pornography. The detective was contacted by someone with the username "tabooin520," who asked to be added to a group chat on a messaging application called "Kik." Once added, tabooin520 sent images and videos of child pornography to the group chat and to the detective.

¶5 Federal agents with Homeland Security Investigations ("HSI"), at the request of the detective, served a federal administrative subpoena authorized under federal law on Kik to obtain tabooin520's IP address. Kik provided the IP address to the detective. The detective, using publicly available databases, determined that Cox Communications ("Cox") was the ISP for the IP address. HSI agents then served another federal administrative subpoena on Cox for the subscriber information associated with the IP address.

¶6 Cox complied with the subpoena, disclosing the subscriber information—name, street address, and phone number—of William Mixton. The detective used this information to obtain and execute a search warrant on Mixton's residence. Detectives seized a cell phone, an external hard drive, a laptop, and a desktop computer. A subsequent search of these devices revealed photos and videos of child pornography, as well as the messages, photos, and videos that Mixton, under the username "tabooin520," sent to the detective.

¶7 Mixton was indicted on twenty counts of sexual exploitation of a minor under fifteen years of age. Mixton moved unsuccessfully to suppress the subscriber information and all evidence seized from his residence on the grounds that the Fourth Amendment to the United States Constitution and article 2, section 8 of the Arizona Constitution require a warrant or court order to obtain his IP address and ISP subscriber information. A jury convicted Mixton on all counts, and he appealed.

¶8 In a split decision, the court of appeals affirmed Mixton's convictions and sentences, holding that although Mixton lacked a reasonable expectation of privacy under the Fourth Amendment, State v. Mixton , 247 Ariz. 212, 220 ¶ 13, 447 P.3d 829, 837 (App. 2019), the Arizona Constitution required a search warrant to obtain his ISP subscriber information, id. at 225 ¶ 27, 447 P.3d at 842, and the federal third-party doctrine did not apply to the Arizona Constitution, id. at 227 ¶ 33, 447 P.3d at 844. The court concluded that, although the State obtained Mixton's ISP subscriber information in violation of the Arizona Constitution, suppression of the information was unnecessary because the good-faith exception to the exclusionary rule applied, as no precedent prohibited the search, controlling law deemed the search reasonable, and law enforcement reasonably relied on existing precedent. Id. at 228 ¶ 39, 447 P.3d at 845.

¶9 On review in this Court, the State argues that article 2, section 8 of the Arizona Constitution does not require a search warrant or court order to obtain IP addresses and ISP subscriber information. Mixton disagrees and further contends that the Fourth Amendment protects IP addresses and ISP subscriber information in light of Carpenter v. United States , ––– U.S. ––––, 138 S. Ct. 2206, 201 L.Ed.2d 507 (2018).

¶10 We granted review to consider whether the United States or Arizona Constitution requires a search warrant or court order to obtain IP addresses and ISP subscriber information, a recurring issue of statewide importance. We have jurisdiction under article 6, section 5(3) of the Arizona Constitution and A.R.S. § 12-120.24.

DISCUSSION

¶11 Whether the United States or Arizona Constitution requires a search warrant or court order to obtain an IP address and ISP subscriber information involves the interpretation of constitutional provisions, a matter we review de novo. See State v. Hegyi , 242 Ariz. 415, 416 ¶ 7, 396 P.3d 1095, 1096 (2017).

I.

¶12 We consider first whether, in light of Carpenter , the United States Constitution requires a search warrant or court order to obtain an IP address and ISP subscriber information.

A.

¶13 The Fourth Amendment protects "[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures." The Fourth Amendment was designed to protect individuals against "arbitrary invasions by governmental officials." Carpenter , 138 S. Ct. at 2213 (quoting Camara v. San Francisco , 387 U.S. 523, 528, 87 S.Ct. 1727, 18 L.Ed.2d 930 (1967) ). Traditionally, the Supreme Court viewed search and seizure under the Fourth Amendment through a lens of "common-law trespass." See United States v. Jones , 565 U.S. 400, 405, 132 S.Ct. 945, 181 L.Ed.2d 911 (2012). However, the Court has recognized that the Fourth Amendment protects people, not just places, when an individual "seeks to preserve something as private" and that expectation is "one that society is prepared to recognize as reasonable." Carpenter , 138 S. Ct. at 2213 (quoting Smith v. Maryland , 442 U.S. 735, 740, 99 S.Ct. 2577, 61 L.Ed.2d 220 (1979) ). "A ‘search’ occurs when an expectation of privacy that society is prepared to consider reasonable is infringed." United States v. Jacobsen , 466 U.S. 109, 113, 104 S.Ct. 1652, 80 L.Ed.2d 85 (1984).

B.

¶14 Federal appellate courts held uniformly, before Carpenter , that the Fourth Amendment does not protect IP addresses and ISP subscriber information because such information falls within the exception created by the "third-party doctrine." See, e.g. , United States v. Bynum , 604 F.3d 161, 164 (4th Cir. 2010) (noting that every federal court considering this issue has held that subscriber information provided to an internet provider is not protected by the Fourth Amendment); United States v. Perrine , 518 F.3d 1196, 1204–05 (10th Cir. 2008) (collecting cases that hold the Fourth Amendment's privacy expectation does not apply to IP addresses and ISP subscriber information); United States v. Forrester , 512 F.3d 500, 510 (9th Cir. 2008) (holding that IP addresses and ISP subscriber information are not protected by the Fourth Amendment). The...