Searching over 5,500,000 cases.


searching
Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

United States v. Schank

United States District Court, E.D. Kentucky, Northern Division, Covington

June 11, 2018

UNITED STATES OF AMERICA PLAINTIFF
v.
JOHN E. SCHANK DEFENDANT

          ORDER

          DAVID L. BUNNING UNITED STATES DISTRICT JUDGE.

         This matter is before the Court on Defendant John Schank's Motion for a Franks[1]Hearing to Suppress All Physical Evidence and Testimonial Evidence. (Doc. # 29). For the reasons listed below, Defendant's Motion is denied.

         I. FACTUAL AND PROCEDURAL BACKGROUND

         On November 4, 2014, Kentucky State Police Detective Kurt Buhts used a law-enforcement database to query “recently observed IP addresses in Kentucky” that were determined to be sharing “child sexual exploitation files over the Internet on Peer-to-Peer (P2P) file sharing networks.” (Doc. # 37 at 8). Detective Buhts determined that the IP address 74.130.145.43 (the “.43 Address”) had recently distributed files indicative of child sexual exploitation; in addition, the law-enforcement database indicated that the .43 Address had been observed offering more than 100 notable files of child sexual exploitation for sharing. Id. On November 12, 2014, at 17:35 Greenwich Mean Time (“GMT”), Detective Buhts successfully downloaded one of the files that a computer connected through the .43 Address was offering to share. Id. This contained an image from the Identified Child Victim Series known as “Bianca.” Id.

         On December 3, 3014, Detective Buhts used this information and sent a subpoena to the internet service provider Time Warner Cable, seeking subscriber information for the .43 Address. Id. That same day, Detective Buhts repeated his query of Kentucky IP addresses that had been noted to have shared child sexual exploitation files over P2P file-sharing networks, and determined that the IP address 17.130.145.238 (the “.238 Address”) had been observed offering to share over 100 notable files of child sexual exploitation. Id. Detective Buhts successfully downloaded two of these notable files from the .238 Address-the first file on December 4, 2014, at 02:37 GMT, and the second file on December 5, 2014, at 02:15 GMT. Id. One of these files contained an image from the same Identified Child Victim Series known as “Bianca, ” and the other contained an image of a child under the age of fifteen in a sexually explicit pose. Id. at 9. Detective Buhts learned that the law-enforcement database had linked the .43 Address and the .238 Address together through their use of the same Globally Unique ID 6B013867D90E42BAA6B3B32D5f876F42 (“GUID 6F42”). Id. at 8. Based upon his training and knowledge, [2] Detective Buhts knew that a GUID is unique to a P2P software program installed on a computer, and that to change the GUID, a user would have to delete or uninstall the P2P software program. Id.

         On December 5, 2014, Time Warner Cable responded to Detective Buhts's subpoena, indicating that the .43 Address had been assigned to Insight Communications at 100 Barnwood Drive Data Apt Test 1, Edgewood, Kentucky, 41017 on the date and time indicated in the subpoena. Id. at 9. Detective Buhts then spoke to a Time Warner Cable Security Operations Senior Investigator, who informed him that the device used to connect to the Internet through the .43 Address was a cable modem that had been assigned to and placed in a Time Warner Cable testing facility at 100 Barnwood Drive, for the purpose of testing internet connections. Id. The Senior Investigator also indicated that Time Warner Cable was unable to locate the modem at 100 Barnwood Drive, and that it would attempt to find the physical location of the modem. Id.

         On February 5, 2015, the Senior Investigator contacted Detective Buhts with the following email:

Hello Detective. I was notified this morning that the modem you have been searching for was back online. I arranged with our Technical Operations teams to track the location of the modem through the cable plant. Out (Our) diagnostic tools report the node location from which the modem is responding. From this point we physically disconnect certain parts of the plant while running a continuous ping to the modem. If the pings are dropped or time out then that indicates the modem is located in a part of the plant service[d] by the leg that was disconnected. This process was repeated until we eventually pulled the service line leading to an individual address. In this case, the modem is located at 2700 Sterling Trace Burlington KY 41005-8848. This address is showing as a TWC employee account registered to John E. Schank. Information I have received shows that he would have had access to the location where the modem should have been.

Id. The Senior Investigator advised that Time Warner Cable employee John E. Schank had “24/7 access to the headend facility where the modem was located.” Id. at 10. Detective Buhts confirmed that John E. Schank listed the 2700 Sterling Trace address as his current address though use of the Kentucky operator's license database. Id.

         On February 10, 2015, Detective Buhts sent another subpoena to Time Warner Cable, requesting the subscriber information for the .238 Address on December 4, 2014, at 02:37 GMT and on December 5, 2014, at 02:15 GMT. Id. Time Warner Cable's response indicated that the .238 Address had been assigned to Insight Communications at the 100 Barnwood Drive test site on those dates and times. Id.

         Detective Buhts spoke with the Senior Investigator and learned that the modem identified at 2700 Sterling Trace had been on consistently from February 5 through February 9, 2015, and was accessing the Internet via IP address 74.132.184.119 (the “.119 Address”). Id. On February 11, 2015, Detective Buhts queried the Kentucky law-enforcement database, and found that the .119 Address had been observed to offer for sharing more than twenty notable files of child sexual exploitation during the time period from February 7 to February 9, 2018. Id. As a result, Detective Buhts sent a subpoena to Time Warner Cable for the subscriber information for the .119 Address for February 9, 2015, at 13:10 GMT, a date and time that the law-enforcement database had noted the .119 Address was observed offering to share a notable child sexual exploitation file. Id. The response indicated that the .119 Address was assigned to Insight Communications at the 100 Barnwood Drive test center on the date and time in the subpoena. Id.

         Detective Buhts averred, based upon his knowledge, experience, and training, that the use of the .43 and .238 Addresses, which had been linked by law enforcement through GUID 6F42, in conjunction with the .119 Address, linked to 2700 Sterling Trace by the missing modem, demonstrated a pattern of criminal activity related to child pornography. Id. The detective's experience, knowledge, and training further led him to believe that the “user treats child pornography as a valuable commodity to be retained and collected, ” and it was therefore “likely that evidence of the contraband remains in the user's possession [and] is likely to be recoverable even if a person attempts to conceal it.” Id.

         The warrant to search the residence located at 2700 Sterling Trace, Burlington, KY-based upon Detective Buhts's affidavit-was signed and issued on February 26, 2015, by Boone County Circuit Court Judge J. R. Schrand. Id. at 12. Fifty-nine computers and associated equipment, including multiple sets of hard drives, were seized during the search of Defendant's residence. (Doc. # 1-1).

         On October 12, 2017, Defendant was indicted by a federal grand jury on three counts of distribution of child pornography and one count of possession of child pornography. (Doc. # 1). Following his arrest and arraignment (Docs. # 7 and 8), Defendant filed a Motion to Suppress the evidence seized at his home, seeking a hearing to suppress all physical and testimonial evidence. (Doc. # 29). Defendant was subsequently arraigned on a superseding indictment, which added four additional counts of receipt of child pornography. (Docs. # 35 and 31). The United States filed its response to Defendant's Motion to Suppress soon after. (Doc. # 38). Defendant having replied (Doc. # 40), this matter is ripe for the Court's review.

         II. ANALYSIS

         A. Defendant has not made the substantial preliminary showing to ...


Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.