United States v. Fisher

56 F.4th 673

UNITED STATES of America, Plaintiff-Appellee,

v.Joshua Ray FISHER, Defendant-Appellant.

United States of America, Plaintiff-Appellee,

v.Justin Anthony Fisher, Defendant-Appellant.

No. 20-10098

No. 20-10101

United States Court of Appeals, Ninth Circuit.

Submitted December 7, 2022^* San Francisco, California

Filed December 21, 2022

Michael A. Humphreys, Paul Padda Law PLLC, Las Vegas, Nevada; Daniel J. Hill, Hill Firm PLLC, Las Vegas, Nevada; for Defendant-Appellant.

Daniel D. Hollingsworth ; Christopher F. Burton and Richard A. Lopez, Assistant United States Attorneys; Jason M. Frierson, United States Attorney; Elizabeth O. White, Appellate Chief, Office of the United States Attorney, Las Vegas, Nevada; Robert L. Ellman, Assistant United States Attorney, Office of the United States Attorney, Reno, Nevada; for Plaintiff-Appellee.

Before: Susan P. Graber, Evan J. Wallach,^** and Paul J. Watford, Circuit Judges.

Opinion by Judge Wallach;

Concurrence by Judge Graber

WALLACH, Circuit Judge:

Defendants-Appellants Justin and Joshua Fisher ("Defendants") challenge their convictions under the Fourth Amendment of the U.S. Constitution. Before us is Defendants' joint appeal from two orders by the U.S. District Court for the District of Nevada, denying their joint motions to suppress evidence. The evidence obtained from two searches, occurring in 2016 and 2018, led to Defendants being charged with multiple federal offenses concerning the sexual exploitation of children and child pornography.

Defendants first argue that the district court erred in denying their first motion to suppress because the affidavit supporting the probable cause search warrant for Defendant Justin Fisher's residence contained material, intentionally false and/or reckless statements and omissions that misled the issuing judge.

Defendants further argue that the district court erred in denying their second motion to suppress for lack of standing because, contrary to the district court's finding, Defendants had not abandoned certain technological devices seized from the residence after it was sold to a new owner.

We have jurisdiction under 28 U.S.C. § 1291,¹ and we affirm.

I

As is relevant to this appeal, Defendants Justin Fisher and Joshua Fisher, brothers, were charged in a second superseding criminal indictment returned March 12, 2019. Justin Fisher was charged with nine counts, and Joshua Fisher was charged with six counts, all for various sexual offenses against children. Defendants entered conditional guilty pleas, pursuant to plea agreements, on July 19, 2019.

On March 5, 2020, the district court entered final judgments against Defendants, sentencing Justin Fisher to 360 months' imprisonment, and Joshua Fisher to 300 months' imprisonment. Defendants' timely notices of appeal followed.

A

1. The Tumblr Report and CyberTipline Report

On April 27, 2016, the social media website Tumblr sent a report to the National Center for Missing and Exploited Children ("NCMEC"),² which caused NCMEC to generate a "CyberTipline Report" or "CyberTip" documenting the incident. The CyberTip identified the "Incident Type" as "Child Pornography (possession, manufacture, and distribution)," based on eight files (videos and images) that had been uploaded to a Tumblr user's blog. The "Incident Time"—that is, "when this report was created in Tumblr's system"—was April 19, 2016, at 14:14:40 UTC (2:14 PM UTC).³

Tumblr identified, as the "User or Person Being Reported," the username "mcw," profile URL "mcw.tumblr.com," and associated email address "mcwarson@gmail.com." The user IP Address was 50.118.198.254 (Other), but Tumblr also identified a second IP address, 24.253.48.163, which accounted for four of the "Suspect's" five most recent logins,⁴ as of the "Incident Time."

The physical location of IP 50.118.198.254 ("Computer 254") resolved to the geographical area of San Jose, California, identifying, as the Internet Service Provider ("ISP/Org") "EGIHosting/Areti Internet." IP 24.253.48.163 ("Computer 163") resolved to Las Vegas, Nevada, identifying Cox Communications as the Internet Service Provider.

In Section C of NCMEC's CyberTipline Report, "Additional Information Provided by NCMEC," NCMEC identified an "Associated CyberTipline Report," which appeared "to contain supplemental IP information for the reported Tumblr profile in the current report." The second Report appeared in search results for "mcwarson" and "24.253.48.163."

Accordingly, the CyberTipline Report in this matter concluded that, "[b]ased on IP 24.253.48.163," the matter should be forwarded to the Nevada Internet Crimes Against Children ("ICAC") Task Force for investigation.

2. Detective Miller's Investigation

Detective Scott Miller of the Las Vegas Metropolitan Police Department's ("LVMPD") ICAC received, reviewed, and further investigated the NCMEC's CyberTipline Report. Thereafter (but before Detective Miller prepared the affidavit challenged by Defendants here), the LVMPD sought information from Tumblr and Cox Communications regarding IP 24.253.48.163/Computer 163.

Specifically, on May 28, 2016, the LVMPD served an administrative subpoena on Cox Communications, commanding the company to produce customer records for Computer 163 as of the Incident Date (April 19, 2016). On June 14, 2016, Cox Communications responded to the administrative subpoena, identifying the customer associated with Computer 163 as Justin Fisher at an address on Burkehaven Avenue in Las Vegas, Nevada (the "Burkehaven Avenue Residence").

Further, on July 1, 2016, Detective Miller sought and obtained a search warrant on Tumblr. The affidavit identified "the following digital data" that was "sought to be seized":⁵

All Tumblr account information for the following user on / or between the dates of April 19, 2016 through July 01, 2016 :

IP Address: 50.118.198.254 and 24.253.48.163Date of Incident: April 19, 2016 at 14:14:00 UTCEmail Address: mcwarson@gmail.com Screen/User Name: mcwProfile URL: https://mcw.tumblr.com

Tumblr responded on September 16, 2016, with a flash-drive of files collected from mcw.tumblr.com and a list of recent logins. As identified by LVMPD, the flash drive "contained 40 additional images of child exploitation" and "200-plus age-difficult child erotica" images from the Tumblr blog. The only login listed for the mcw account from April 19, 2016 onward was a login from Computer 163 on April 19, 2016 at 10:40 AM UTC—i.e. , a few hours prior to the time at which Tumblr generated its report to NCMEC. ("Incident Time: 04-19-2016 14:14:00 UTC").

3. The 2016 Search Warrant

On November 16, 2016, Detective Miller sought and obtained a search warrant for Joshua Fisher's residence. Detective Miller's affidavit in support of the search warrant stated that there was "probable cause to believe that certain property hereinafter described will be found at [the Burkehaven Avenue address]."

In the Synopsis section, Detective Miller stated that

On or about April 27, 2016, the [NCMEC] received a report from Tumblr reference [sic] a possible transmission of child pornography. Tumblr reported a user; "mcw", screen/user name of mcw, and an IP address of 24.253.48.163 uploaded 8 child exploitation images on their Tumblr account. Affiant viewed said image [sic] of child sexual exploitation and deemed 2 images to be child pornographic in nature.

A search warrant was served on Tumblr reference [sic] above account which resulted in numerous other images/videos of child exploitation being discovered.

This investigation conducted by Affiant has traced this child sexual exploitation computer activity of child pornography to [the Burkehaven Avenue Residence], where Affiant expects to find computer / digital evidence of these crimes.

The "Probable Cause Offering" section of the affidavit described the sequence of relevant events beginning with Tumblr's identification of the two IP addresses (50.118.198.254 and 24.253.48.163) associated with a "user [who] uploaded 8 images/videos of child sexual exploitation," the subsequent CyberTip/NCMEC's Report, the LVMPD's investigation, the administrative subpoena on Cox Communications, additional records collection including the identification of Justin Fisher and his residence, and the July 1, 2016 search warrant served on Tumblr. Detective Miller described the July 1, 2016 search warrant, and Tumblr's response, as follows:

On July 01, 2016, a search warrant was served on Tumblr for all account information regarding Tumblr account: mcwarson@gmail.com, IP address 24.253.48.163, user name: mcw.

On September 16, 2016, Tumblr responded to said search warrant with numerous other images/videos of child exploitation. Affiant viewed these images/videos and deemed over 40 of them to be child pornography....

A justice of the peace for Clark County, Nevada, determined that Detective Miller's affidavit presented sufficient evidence for a finding of probable cause, and issued the search warrant.

4. The 2016 Search

The search of Justin Fisher's Burkehaven Avenue Residence was executed on November 21, 2016. Various technological devices were seized from the premises. Joshua Fisher "approached the residence on foot" while the search was ongoing, "stating that he worked out of the residence where the search warrant was being executed." He turned over a cell phone to the NVMPD ICAC team. NVMPD obtained a search warrant for the phone on November 23, 2016.⁶

Forensic analysis of the devices obtained from Defendants (forty-eight in total) resulted in the recovery of evidence of child sexual exploitation offenses. According to the Government, "[t]his evidence led to Counts 1-5 and 7-12 in the second superseding indictment." Defendants were detained on federal Criminal Complaints as of February 15, 2017 (Justin Fisher) and April 7, 2017 (Joshua Fisher).

5. First Motion to Suppress

On August 10, 2017, Justin Fisher moved to suppress "all tangible evidence, and the fruits thereof" obtained from the November 21, 2016 search warrant. Joshua Fisher joined this...