Background
Microsoft and Google submitted four CyberTip reports after images uploaded through Skype and Gmail from a single IP address matched hash values associated with apparent child sexual abuse material. Neither company nor the National Center for Missing and Exploited Children viewed the images. NCMEC forwarded the reports to Wisconsin authorities, who traced the IP address to Peter Braun’s home.
Special Agent Aaron Koehler viewed the images without a warrant and later obtained a state warrant to search Braun’s home. His affidavit included descriptions of the images, details from the CyberTips, the suggestive file name “pedomom-and-son.jpg,” information connecting the IP address to Braun, and a 2015 report that Braun’s son had observed him communicating online with very young girls. After the search and further investigation, Braun was charged with four counts of producing child pornography under 18 U.S.C. § 2251(a). The district court suppressed the evidence, concluding that Koehler’s warrantless viewing was unlawful and that the remaining affidavit did not establish probable cause; the government brought an interlocutory appeal.
The Court’s Holding
The Seventh Circuit reversed. It first held that the government had preserved—though only “by a hair’s breadth”—its argument that the affidavit established probable cause without Koehler’s descriptions of the images. The government had identified the relevant untainted facts and argued below that the warrant remained supported after the challenged material was excluded.
Assuming without deciding that Koehler’s viewing was unlawful, the court held that the untainted affidavit established a fair probability that evidence of child sexual abuse material would be found in Braun’s home. The four detailed CyberTips came from institutional sources whose information Koehler described as historically reliable; the reports were relatively recent and tied the uploads to Braun’s IP address; one image had a file name strongly suggestive of child sexual abuse material; and the 2015 report provided corroborating context. The court also concluded that Koehler would have sought the warrant without viewing the images, satisfying the second part of the independent-source analysis.
Chief Judge Brennan joined the panel opinion in full and wrote separately to criticize two rulings that were not before the court on appeal. He expressed the view that Koehler’s viewing of the hash-matched images did not require a warrant under the private-search doctrine and that Braun posed a danger warranting detention pending appeal. Those views were not holdings of the panel.
Key Takeaways
- Probable cause survived excision of the agent’s image descriptions because the remaining CyberTip information, file name, IP-address evidence, and prior report were sufficient when considered together.
- CyberTip reports do not necessarily establish probable cause standing alone, but their detail, freshness, institutional sources, demonstrated reliability, and corroboration can support a warrant.
- The panel did not decide whether law enforcement may view hash-matched images without a warrant; Chief Judge Brennan addressed that issue only in a concurrence.
Why It Matters
The decision illustrates how courts assess warrants containing potentially tainted information: they remove the challenged material, determine whether the remaining affidavit independently establishes probable cause, and ask whether the unlawful information prompted the decision to seek the warrant. It also confirms that probable cause must be evaluated from the combined force of the facts rather than by examining each fact in isolation.
For investigations based on provider CyberTips, the opinion identifies factors that can make hash-match reports useful to the probable-cause analysis, including the providers’ reliability, the reports’ level of detail and recency, suggestive file names, attribution of an IP address, and corroborating investigative information.