United States District Court, E.D. Kentucky, Northern Division, Covington
L. BUNNING UNITED STATES DISTRICT JUDGE.
matter is before the Court on Defendant John Schank's
Motion for a FranksHearing to Suppress All Physical Evidence
and Testimonial Evidence. (Doc. # 29). For the reasons listed
below, Defendant's Motion is denied.
FACTUAL AND PROCEDURAL BACKGROUND
November 4, 2014, Kentucky State Police Detective Kurt Buhts
used a law-enforcement database to query “recently
observed IP addresses in Kentucky” that were determined
to be sharing “child sexual exploitation files over the
Internet on Peer-to-Peer (P2P) file sharing networks.”
(Doc. # 37 at 8). Detective Buhts determined that the IP
address 184.108.40.206 (the “.43 Address”) had
recently distributed files indicative of child sexual
exploitation; in addition, the law-enforcement database
indicated that the .43 Address had been observed offering
more than 100 notable files of child sexual exploitation for
sharing. Id. On November 12, 2014, at 17:35
Greenwich Mean Time (“GMT”), Detective Buhts
successfully downloaded one of the files that a computer
connected through the .43 Address was offering to share.
Id. This contained an image from the Identified
Child Victim Series known as “Bianca.”
December 3, 3014, Detective Buhts used this information and
sent a subpoena to the internet service provider Time Warner
Cable, seeking subscriber information for the .43 Address.
Id. That same day, Detective Buhts repeated his
query of Kentucky IP addresses that had been noted to have
shared child sexual exploitation files over P2P file-sharing
networks, and determined that the IP address 220.127.116.11
(the “.238 Address”) had been observed offering
to share over 100 notable files of child sexual exploitation.
Id. Detective Buhts successfully downloaded two of
these notable files from the .238 Address-the first file on
December 4, 2014, at 02:37 GMT, and the second file on
December 5, 2014, at 02:15 GMT. Id. One of these
files contained an image from the same Identified Child
Victim Series known as “Bianca, ” and the other
contained an image of a child under the age of fifteen in a
sexually explicit pose. Id. at 9. Detective Buhts
learned that the law-enforcement database had linked the .43
Address and the .238 Address together through their use of
the same Globally Unique ID 6B013867D90E42BAA6B3B32D5f876F42
(“GUID 6F42”). Id. at 8. Based upon his
training and knowledge,  Detective Buhts knew that a GUID is
unique to a P2P software program installed on a computer, and
that to change the GUID, a user would have to delete or
uninstall the P2P software program. Id.
December 5, 2014, Time Warner Cable responded to Detective
Buhts's subpoena, indicating that the .43 Address had
been assigned to Insight Communications at 100 Barnwood Drive
Data Apt Test 1, Edgewood, Kentucky, 41017 on the date and
time indicated in the subpoena. Id. at 9. Detective
Buhts then spoke to a Time Warner Cable Security Operations
Senior Investigator, who informed him that the device used to
connect to the Internet through the .43 Address was a cable
modem that had been assigned to and placed in a Time Warner
Cable testing facility at 100 Barnwood Drive, for the purpose
of testing internet connections. Id. The Senior
Investigator also indicated that Time Warner Cable was unable
to locate the modem at 100 Barnwood Drive, and that it would
attempt to find the physical location of the modem.
February 5, 2015, the Senior Investigator contacted Detective
Buhts with the following email:
Hello Detective. I was notified this morning that the modem
you have been searching for was back online. I arranged with
our Technical Operations teams to track the location of the
modem through the cable plant. Out (Our) diagnostic tools
report the node location from which the modem is responding.
From this point we physically disconnect certain parts of the
plant while running a continuous ping to the modem. If the
pings are dropped or time out then that indicates the modem
is located in a part of the plant service[d] by the leg that
was disconnected. This process was repeated until we
eventually pulled the service line leading to an individual
address. In this case, the modem is located at 2700 Sterling
Trace Burlington KY 41005-8848. This address is showing as a
TWC employee account registered to John E. Schank.
Information I have received shows that he would have had
access to the location where the modem should have been.
Id. The Senior Investigator advised that Time Warner
Cable employee John E. Schank had “24/7 access to the
headend facility where the modem was located.”
Id. at 10. Detective Buhts confirmed that John E.
Schank listed the 2700 Sterling Trace address as his current
address though use of the Kentucky operator's license
February 10, 2015, Detective Buhts sent another subpoena to
Time Warner Cable, requesting the subscriber information for
the .238 Address on December 4, 2014, at 02:37 GMT and on
December 5, 2014, at 02:15 GMT. Id. Time Warner
Cable's response indicated that the .238 Address had been
assigned to Insight Communications at the 100 Barnwood Drive
test site on those dates and times. Id.
Buhts spoke with the Senior Investigator and learned that the
modem identified at 2700 Sterling Trace had been on
consistently from February 5 through February 9, 2015, and
was accessing the Internet via IP address 18.104.22.168 (the
“.119 Address”). Id. On February 11,
2015, Detective Buhts queried the Kentucky law-enforcement
database, and found that the .119 Address had been observed
to offer for sharing more than twenty notable files of child
sexual exploitation during the time period from February 7 to
February 9, 2018. Id. As a result, Detective Buhts
sent a subpoena to Time Warner Cable for the subscriber
information for the .119 Address for February 9, 2015, at
13:10 GMT, a date and time that the law-enforcement database
had noted the .119 Address was observed offering to share a
notable child sexual exploitation file. Id. The
response indicated that the .119 Address was assigned to
Insight Communications at the 100 Barnwood Drive test center
on the date and time in the subpoena. Id.
Buhts averred, based upon his knowledge, experience, and
training, that the use of the .43 and .238 Addresses, which
had been linked by law enforcement through GUID 6F42, in
conjunction with the .119 Address, linked to 2700 Sterling
Trace by the missing modem, demonstrated a pattern of
criminal activity related to child pornography. Id.
The detective's experience, knowledge, and training
further led him to believe that the “user treats child
pornography as a valuable commodity to be retained and
collected, ” and it was therefore “likely that
evidence of the contraband remains in the user's
possession [and] is likely to be recoverable even if a person
attempts to conceal it.” Id.
warrant to search the residence located at 2700 Sterling
Trace, Burlington, KY-based upon Detective Buhts's
affidavit-was signed and issued on February 26, 2015, by
Boone County Circuit Court Judge J. R. Schrand. Id.
at 12. Fifty-nine computers and associated equipment,
including multiple sets of hard drives, were seized during
the search of Defendant's residence. (Doc. # 1-1).
October 12, 2017, Defendant was indicted by a federal grand
jury on three counts of distribution of child pornography and
one count of possession of child pornography. (Doc. # 1).
Following his arrest and arraignment (Docs. # 7 and 8),
Defendant filed a Motion to Suppress the evidence seized at
his home, seeking a hearing to suppress all physical and
testimonial evidence. (Doc. # 29). Defendant was subsequently
arraigned on a superseding indictment, which added four
additional counts of receipt of child pornography. (Docs. #
35 and 31). The United States filed its response to
Defendant's Motion to Suppress soon after. (Doc. # 38).
Defendant having replied (Doc. # 40), this matter is ripe for
the Court's review.
Defendant has not made the substantial preliminary showing to