Background
In May 2021, Dropbox detected and reported to the National Center for Missing and Exploited Children (NCMEC) that a single video depicting child sexual abuse material (CSAM) had been uploaded to a Dropbox account associated with Zachary James Baker. NCMEC forwarded the tip to Detective Winters, who received it on October 5, 2021. Winters investigated, obtained a warrant for the Dropbox account, but learned that Dropbox had already purged the records — the account’s data had not been preserved within the required 90-day window and no longer existed.
On December 7, 2021 — approximately seven months after the original upload — Winters submitted an affidavit seeking a warrant to search Baker’s McMinnville, Oregon residence and seize his electronic devices. The affidavit relied on the single NCMEC tip, IP address records linking Baker to the residence, and Winters’s training and experience that CSAM consumers typically collect and retain such material indefinitely. A magistrate issued the warrant, and law enforcement seized two iPhones, two tablets, and two laptops. Baker consented to a device search, then revoked consent the next day; by then, a forensic exam of his cellphone had identified 22 files of CSAM or animal sexual abuse material, which supported a second warrant.
Baker entered conditional guilty pleas to 10 counts of second-degree encouraging child sexual abuse and 10 counts of encouraging sexual assault of an animal, reserving his right to appeal the denial of his motion to suppress. The Yamhill County Circuit Court denied suppression, finding the seven-month gap did not render the affidavit stale. Baker appealed.
The Court’s Holding
The Oregon Court of Appeals reversed and remanded, holding that the search warrant was invalid because the supporting affidavit failed to establish probable cause. Applying a five-factor totality-of-the-circumstances staleness analysis — length of time, perishability/durability, mobility, the explicitly inculpatory character of the evidence, and the suspect’s or class’s propensity to retain such evidence — the court found the seven-month-old tip stale on the specific facts presented. Critically, the affidavit rested on a single reported upload, the video itself no longer existed in the Dropbox account by the time the warrant issued, and the affidavit contained no case-specific evidence that Baker was a collector or persistent consumer of CSAM.
The court acknowledged that digital evidence is durable and that an affiant’s training and experience regarding CSAM collectors’ retention habits can help overcome staleness — but only when tethered to objective, case-specific facts. Here, Detective Winters’s training-and-experience averments were contradictory (some CSAM consumers keep files on devices; others use cloud storage precisely to avoid having files on devices) and were not connected to any particularized facts about Baker’s conduct. The affidavit did not establish how the video came to be in Baker’s account, whether Baker himself uploaded it, whether he had ever viewed it, or whether it reflected a pattern of collection rather than a one-time event.
Because the affidavit failed to establish the necessary factual predicate — that Baker was a collector or persistent consumer of CSAM — the probable cause was stale and the warrant was invalid. The trial court therefore erred in denying the motion to suppress. Since Baker’s challenge to the second warrant rested entirely on taint from the first, the court reversed and remanded without separately analyzing the second warrant’s validity.
Key Takeaways
- A single NCMEC tip of one CSAM upload, standing alone, is insufficient to establish probable cause for a residential search warrant when seven months have elapsed and the file no longer exists in the reported account.
- An affiant’s training and experience about CSAM collectors’ retention propensities must be anchored to case-specific, objective facts linking the particular defendant to a pattern of collection — generalizations about a class of offenders do not substitute for individualized probable cause.
- The durability of digital evidence does not automatically prevent staleness; courts must also assess whether there is a reasonable inference the evidence is probably on the defendant’s devices rather than simply somewhere in the digital ether.
- Contradictory averments in a probable-cause affidavit (e.g., that consumers both store CSAM on devices and use cloud storage to avoid keeping it on devices) undermine rather than support probable cause when no case-specific facts resolve the contradiction.
Why It Matters
This decision clarifies the floor for probable cause in CSAM investigations that originate from a single NCMEC/CyberTipline report. Law enforcement and prosecutors must do more than cite an isolated upload and invoke general CSAM-collector retention statistics; the affidavit must supply case-specific facts — such as prior convictions, multiple tips tied to the same account, evidence of ongoing abuse, or other indicia of persistent collection — to bridge the gap between a stale tip and a current search. The court explicitly contrasted Baker’s “exceptionally thin” evidentiary record with cases from the Second, Fourth, and Sixth Circuits and with its own precedent in Daniels and Gustafson, signaling that Oregon courts will look hard at whether the defendant is actually linked to a pattern of conduct before upholding such warrants.
For defense practitioners, the decision confirms that staleness is a viable suppression argument even in CSAM cases, where courts sometimes assume collectors never discard material. For law enforcement, the practical lesson is to gather corroborating evidence of ongoing or repeated activity — additional tips, subscriber records showing continued account activity, evidence of prior offenses, or indicia that a suspect actively maintains a collection — before seeking a residential search warrant based solely on a single, months-old cloud-storage report.