FROM THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF NEW
HAMPSHIRE [Hon. Joseph Laplante, U.S. District Judge]
N. Marx, with whom Fick & Marx LLP was on brief, for
R. Aframe, Assistant U.S. Attorney, with whom Scott W.
Murray, United States Attorney, was on brief, for appellee.
Lynch, Lipez, and Barron, Circuit Judges.
the district court denied his motions to suppress evidence,
David Morel, Jr., entered a conditional plea to one count of
possessing child pornography in violation of 18 U.S.C. §
2252(a)(4)(B). He was sentenced to seventy months'
imprisonment. Morel uploaded child pornography images to a
digital album on Imgur, an image hosting website. Law
enforcement learned of the images on Imgur from the National
Center for Missing and Exploited Children (NCMEC), which had
received a report about the images from an anonymous tipster.
appeal, Morel challenges the district court's
determinations that Morel had no reasonable expectation of
privacy in the images he uploaded to Imgur or in his internet
protocol (IP) address, and that the state warrant to search
Morel's computer was supported by probable cause. We
describe the findings of fact made by the district court
after evidentiary hearings on the motions to suppress. We
supplement those facts, as necessary, with other facts from
investigation of Morel began with an anonymous report
submitted to NCMEC. NCMEC is a non-profit organization that
maintains the "CyberTipline," a website through
which members of the public, law enforcement, and others
report child exploitation and child pornography. Those using
the CyberTipline to make a report are required to include the
date, time, and substance of the incident in the report, and
may submit reports anonymously. Electronic service providers
that "obtain actual knowledge of any facts and
circumstances . . . from which there is an apparent
violation" or a "planned or imminent"
violation of statutes concerning child pornography are
legally obligated to report such information to NCMEC. 18
U.S.C. § 2258A(a). NCMEC must forward reports it
receives to an appropriate law enforcement agency.
Id. § 2258A(c).
November 23, 2013, an unidentified individual submitted a
report, which included a list of Uniform Resource Locators
(URLs) said to depict child pornography, to the CyberTipline.
The list of URLs spanned two pages. This tipster did not
include any personal identifying information in the
report. NCMEC staff analysts investigated the
contents of the report. One of the URLs listed in the report
led to a "gallery" or "album" of images
hosted by Imgur. Each image in the album also had its own
specific URL; an analyst obtained the URLs of the images in
the album that appeared to contain child pornography without
clicking on the individual URLs,  and copied those URLs into a
November 26, 2013, NCMEC sent a notice to Imgur summarizing
the instances of child pornography reported to have been
found on its website, which included URLs of images reported
by the tipster. NCMEC's notice asked Imgur to
"[p]lease review the reported URL[s] to determine if
[they] contain content that violates federal and/or state
law or your Terms of Service or Member Services
reviewing the reported URLs, Imgur filed reports with NCMEC
concerning three images obtained through the CyberTipline,
stating that the corresponding URLs flagged by NCMEC appeared
to contain child pornography. Imgur attached copies of the
three images to the reports. Imgur provided the IP address
from which the images were uploaded to Imgur's servers,
which was the same for all three images. Imgur also reported
that the images were uploaded in November 2013. Imgur then
deleted the images from its server. Using a publicly
available website, NCMEC looked up the IP address included in
Imgur's report and learned that it was associated with a
Comcast subscriber in Derry, New Hampshire.
December 6, 2013, Imgur submitted three additional reports of
alleged child pornography associated with the same IP address
to NCMEC through the CyberTipline. Those images had also been
uploaded to Imgur in November 2013. That made a total of six
reported images of alleged child pornography from this IP
provided the six reports to the New Hampshire Internet Crimes
Against Children Task Force on December 12, 2013, which
forwarded the reports to the Derry, New Hampshire Police
Department on January 10, 2014. Detective Kennedy Richard,
experienced in investigating child pornography and child
sexual exploitation, reviewed the images in the reports. He
entered the IP address from the reports into a
publicly-available website and learned that the IP address
was associated with a Comcast account. He then obtained a
subpoena requesting information from Comcast about the owner
of the IP address. On February 14, 2014, Detective Richard
learned that the IP address belonged to a David Morel at
Pingree Hill Road in Derry, New Hampshire.
two weeks earlier, on February 1, 2014, David Morel, Jr., had
reported to the Derry Police Department that his laptop
computer was stolen during a burglary of the Pingree Hill
Road residence. The Derry Police Department recovered the
stolen computer and other stolen property the following week.
Morel went to the police station on February 7, 2014, and
identified the computer he had reported stolen. The police
retained the computer as evidence of the burglary.
March 2014, Detective Richard called the Pingree Hill Road
residence. Two weeks later, Morel's father called
Detective Richard back and stated that his son, David Morel,
Jr., had lived at the Pingree Hill Road residence on the date
that the images were uploaded in November 2013, but had moved
out later, in February 2014. Morel's father stated that
he did not use the email address associated with the Comcast
account connected to the IP address in question, but that he
believed his son used that email address.
April 16, 2014, Detective Richard sought and obtained a
warrant from a New Hampshire state court to search
Morel's computer, which was still in police custody. In
the affidavit supporting the warrant application, Detective
Richard did not attach the six suspected child pornography
images, which depicted different girls. The affidavit stated
that Detective Richard had worked as a Derry police officer
since 1993, and had been a detective for the Derry Police
Department since 1999. As a detective, his primary assignment
was in the Juvenile Division as an investigator. He had
received specialized training concerning sexual assault
investigations, including in child abuse and exploitation
cases. He had also been a member of the Internet Crimes
Against Children Task Force since 2005, and had assisted in
the execution of about fifty search warrants related to
possession and distribution of illegal child sexual abuse and
affidavit described the NCMEC reports and the IP address
information connected to Morel. The affidavit also described
the nudity and the sexual or sexually suggestive positioning
of the girls depicted in each of the six suspected child
pornography images. Some images contained more than one girl.
The ages of the different girls were described as follows:
(1) "A naked female . . . . She appears to be under the
age of 10"; (2) "Two naked females . . . both
believed to be under the age of 10"; (3) "A female
believed to be under the age of 10"; (4) "Two naked
females believed to be under the age of 13"; (5) "A
naked female [sic] to be under the age of 13"; and (6)
"A naked female believed to be under the age of
13." The affidavit specified that some of the other
females in the images were of "unknown age." The
affidavit did not describe the girls in such terms as
"pubescent" or "prepubescent."
to the warrant, Detective Richard obtained a forensic copy of
the hard drive of Morel's computer, which was still in
police custody. He reviewed the contents and saw what he
estimated to be about 200 videos and images of child
April 28, 2014, Morel was arrested on the charge of attempted
possession of child sexual abuse images. Morel was taken
into custody and Detective Richard interviewed him at the
Derry police station. Morel was given Miranda warnings,
waived his Fifth Amendment rights, and admitted to possessing
child pornography on his computer.
Imgur Terms of Service and Image Hosting Practices
Imgur Terms of Service stated at the time, in relevant part:
You can upload images anonymously and share them online with
only the people you choose to share them with. If you make
them publicly available, they may be featured in the gallery.
This means that if you upload an image to share with your
friend, only your friend will be able to access it online.
However, if you share an image with Facebook, Twitter, Digg,
Reddit, et cetera, then it may end up in the gallery.
following witnesses testified at the suppression hearings:
Brianna Walker, an Imgur employee who was an online
"store manager" and who also handled "user
support" and "rules"; John Shehan, the vice