Background
Microsoft and Google sent four CyberTip reports to the National Center for Missing and Exploited Children after files uploaded from one IP address matched hash values associated with apparent child sexual abuse material. Neither the providers nor NCMEC viewed the files. One file was named “pedomom-and-son.jpg.” Investigators traced the IP address to Peter Braun’s home.
Wisconsin Special Agent Aaron Koehler viewed the images without a warrant, investigated further, and obtained a state warrant to search Braun’s home. His affidavit included descriptions of the images, the CyberTip information, the file name, evidence connecting the IP address to Braun, and a 2015 report that Braun’s son had seen him communicating online with very young girls. After Braun was charged with four counts of producing child pornography, the district court suppressed the evidence, concluding that Koehler’s viewing required a warrant and that the remaining affidavit did not establish probable cause. The government brought an interlocutory appeal.
The Court’s Holding
The Seventh Circuit reversed. It first held that the government had preserved—though only “by a hair’s breadth”—its argument that the affidavit established probable cause even after removing Koehler’s descriptions of the images. The government had identified the relevant untainted facts, supplied the probable-cause standard, and argued that the warrant remained adequately supported.
Considering the affidavit as a whole, the court held that the untainted information created a fair probability that evidence of CSAM would be found in Braun’s home. The institutional reliability and detail of the four CyberTips, the explicitly suggestive file name, the connection between the reported IP address and Braun’s residence, and the earlier report of Braun’s online interactions with young girls collectively established probable cause. The record also showed that Koehler would have sought the warrant without viewing the images. Because the government did not challenge the ruling that Koehler’s viewing was unlawful, the panel assumed illegality for its analysis and did not decide that Fourth Amendment question.
Key Takeaways
- Probable cause survived after the agent’s descriptions of the warrantlessly viewed images were excised from the affidavit.
- Detailed CyberTips from established providers, a file name strongly suggestive of CSAM, IP-address attribution, and corroborating historical information may establish probable cause when considered together.
- The majority did not decide whether police may view hash-matched files without a warrant; Chief Judge Brennan separately wrote that the private-search doctrine permitted the viewing.
Why It Matters
The decision shows that suppression is not required merely because a warrant affidavit contains unlawfully obtained information. Courts must remove the tainted material and determine whether the remaining facts independently establish probable cause and whether investigators would have sought the warrant without the unlawful search.
The opinion also underscores the evidentiary significance of provider CyberTips and hash matching while leaving unresolved in the Seventh Circuit whether an officer’s warrantless viewing of a hash-matched image falls within the private-search doctrine.