UNITED STATES v. ESTRADA (2025)

MEMORANDUM AND ORDER

INTRODUCTION

Defendant Steven Estrada Ramirez is charged with one count of receipt of child pornography, in violation of 18 U.S.C. § 2252A(a)(2)(A) and (b)(1), and one count of possession of child pornography, in violation of 18 U.S.C. § 2252A(a)(5)(B) and (b)(2). Currently before the Court is Estrada's motion to suppress the evidence obtained from searches of his person and home on April 11, 2024. Estrada also seeks a hearing pursuant to Franks v. Delaware, 438 U.S. 154, 98 S.Ct. 2674, 57 L.Ed.2d 667 (1978).

After a non-evidentiary hearing, the Court DENIES Estrada's motion to suppress and request for a Franks hearing (Dkt. 51).

BACKGROUND

Estrada's person and home were searched pursuant to a search warrant issued by Magistrate Judge Kelley on April 9, 2024. In support of the warrant, Agent Casey Hyde, an employee of Homeland Security Investigations (“HSI”), an investigative arm of the Department of Homeland Security and Immigrations and Customs Enforcement, submitted an affidavit that provided the following information.

I. Description of Viber

The affidavit explains that Viber ¹ is an online chat application available on the web or through a phone application. To register, users must provide a phone number and username. According to the affidavit, “[a]ll [Viber] chats are protected by end-to-end encryption, meaning that only the sender and receiver(s) of a chat have access to the content, and nothing is stored on any servers once delivered.” Dkt. 51-1 ¶ 6. Based on her training and experience, Agent Hyde explained that Viber “often is used for, among other things, illegal activity, including access to, and the exchange of, child pornography, because of the high degree of anonymity that is offered to [Viber] users.” Id. ¶ 7.

The affidavit describes Viber “groups” as private chats limited to 250 participants. These groups are unsearchable and not publicly accessible. Users may join a group in one of two ways: by clicking an invitation link or being added directly by another Viber user. When added to a group, a user receives a notification, and the group appears at the top of the user's chat list. Users can access all messages shared in the group from the date they joined onward. According to the affidavit, Viber notifies participants each time a message is posted, unless a user has enabled batched notifications. A user may leave a group at any time. Any group member may view the list of participants and their verified phone numbers.

II. The Investigation

Estrada's Viber account came to the attention of law enforcement through two investigations.

In the first, HSI Northern Kentucky assumed control of a Viber account belonging to an individual arrested for possession and receipt of child pornography. That account provided access to Viber groups used to exchange such content. One of these groups, “Group A,” included a user later identified as Estrada. HSI observed Estrada's account listed as a participant in Group A on both February 9, 2023, and March 26, 2024, though it was unclear when he joined the group. Between those dates, “large quantities” of images and videos depicting child pornography were shared in Group A. Id. ¶ 23. The affidavit described two specific videos posted on February 7, 2023, and January 29, 2024. On March 26, 2024, HSI agents observed that Estrada's account was marked “[l]ast [s]een” on Viber that day.

In the second investigation, HSI New England took control of another individual's account on December 20, 2023, after that person admitted to using Viber to receive files depicting child pornography. Through that account, agents accessed a second group, “Group B,” in which Estrada was also listed as a participant. HSI observed Estrada's account listed as a participant in Group B on January 2, 2024, and again on March 8, 2024. The affidavit does not specify when he joined. Between July 14, 2023, and March 8, 2024, approximately forty-two images and videos depicting child pornography were shared in the group. Agent Hyde described two videos posted to Group B on July 28, 2023. Estrada's Viber account was marked as “active” on December 12, 2023; March 2, 2024; and March 28, 2024.

Law enforcement linked Estrada to his Viber account by subpoenaing records from his cellular carrier and email provider. Agents then used Massachusetts Registry of Motor Vehicles records and the Trial Court of Massachusetts Warrant Management System to corroborate and identify Estrada's home address.²

III. Issuance and Execution of the Search Warrant

Based on this information, Magistrate Judge Kelley issued a warrant to search Estrada's person and residence. Agents executed the warrant on April 11, 2024, seizing multiple cell phones, a laptop, and an external storage device. On one cell phone taken from Estrada's bedroom, agents observed a photograph depicting child pornography set as the home and lock screen. The Viber account on the phone was a participant in multiple chats with names suggestive of child pornography. Agents also uncovered hundreds of video files depicting child pornography on the external storage device.

Estrada was arrested and later indicted for receipt and possession of child pornography, in violation of 18 U.S.C. § 2252A(a)(2)(A), (a)(5)(B), (b)(1), and (b)(2).

DISCUSSION

I. Probable Cause

A. Legal Standard

The Fourth Amendment mandates that warrants be based on probable cause. See U.S. Const. amend. IV. Probable cause “is not a high bar” and demands “only the kind of fair probability on which reasonable and prudent people, not legal technicians, act.” United States v. Cortez, 108 F.4th 1, 8 (1st Cir.) (cleaned up), cert. denied, ––– U.S. ––––, 145 S. Ct. 578, ––– L.Ed.2d –––– (2024). Moreover, “an affidavit submitted to show probable cause need not point to some straight-line connection but, rather, may rely on the affiant's connecting of a series of dots in a commonsense way.” United States v. Adams, 971 F.3d 22, 32 (1st Cir. 2020). To determine “whether a search warrant affidavit establishes probable cause,” courts “consider ․ the totality of the circumstances based on the facts and supported opinions set out within the four corners of the affidavit.” Cortez, 108 F.4th at 8 (cleaned up). Courts must also “give significant deference to the magistrate judge's initial evaluation,” disagreeing only if there is “no ‘substantial basis’ for concluding that probable cause existed.” United States v. Chiu, 36 F.4th 294, 297 (1st Cir. 2022) (quoting United States v. Mendoza-Maisonet, 962 F.3d 1, 16 (1st Cir. 2020)).

The probable cause inquiry is two-fold: “[a]n application for a warrant must demonstrate probable cause to believe that (1) a crime has been committed -- the ‘commission’ element, and (2) enumerated evidence of the offense will be found at the place searched -- the so-called ‘nexus’ element.” United States v. Gonzalez, 113 F.4th 140, 148 (1st Cir. 2024) (quoting United States v. Roman, 942 F.3d 43, 50 (1st Cir. 2019)). In other words, there must be “a “ ‘fair probability” — not certainty -- that evidence of a crime will be found in a particular location.’ ” United States v. Corleto, 56 F.4th 169, 175 (1st Cir. 2022) (quoting United States v. Lindsey, 3 F.4th 32, 39 (1st Cir. 2021)). Satisfaction of the nexus element “can be ‘inferred from the type of crime, the nature of the items sought, ․ and normal inferences as to where a criminal would hide [evidence of a crime].’ ” Id. (alterations in original) (quoting Lindsey, 3 F.4th at 39).

B. Application

Estrada contends that the affidavit failed to establish probable cause to search his person and home. In particular, he argues that the affidavit showed only that he was a passive participant in two unnamed Viber groups for an unspecified period and did not allege that he ever viewed or shared illicit material. He further asserts that the affiant's discussion of traits common to consumers of child pornography could not support a finding of probable cause because the affidavit failed to show he belonged to that class.

Agent Hyde's affidavit established probable cause to believe that evidence of the receipt and possession of child pornography would be found in Estrada's home and on his person. The affidavit identified Estrada as a member of two Viber groups used to exchange files depicting child pornography. HSI agents observed Estrada listed as a participant in the first group on two dates over a year apart and in the second group on two dates around two months apart. These groups were not publicly listed and could be joined only by clicking a direct link or being added by an existing member. See United States v. Bosyk, 933 F.3d 319, 327-28 (4th Cir. 2019) (“[T]he likelihood that a specific filesharing page containing child pornography would find its way to somebody uninterested in such contraband -- thereby exposing its distributors to detection, capture, and loss of their materials -- is probably quite low.”). During the periods when Estrada was a participant, Agent Hyde averred that large volumes of illicit files were shared in each group.

Estrada responds that anyone can add a user to a Viber group, including strangers, and that users appear as participants even if they never open the group. But the affidavit explained that users are notified when they are added and that the group appears at the top of their chat list. It also stated that Estrada accessed Viber after he was observed in the groups and that he remained in one group for over a year. See Dkt. 51-1 ¶ 30 (describing Estrada as “[l]ast [s]een” on the Viber application on March 28, 2024); id. ¶¶ 22-23 (explaining that Estrada was listed as a participant in a group on February 9, 2023, and again on March 26, 2024). These facts support a “fair probability” that he was aware of and knowingly remained in groups that were actively distributing child pornography. Lindsey, 3 F.4th at 39 (quoting United States v. Dixon, 787 F.3d 55, 60 (1st Cir. 2015)).

Estrada also argues that the affidavit failed to describe a specific file shared on the exact dates that HSI agents observed Estrada in the groups. The affidavit included “reasonably specific description[s]” of four videos depicting child pornography. United States v. Brunette, 256 F.3d 14, 19 (1st Cir. 2001). While a participant in a Viber group may not be able to see messages posted before he joined or was added, one of the verified pieces of child pornography was shared in a group after Estrada was listed as a participant. See United States v. Austin, 640 F. Supp. 3d 171, 177 (D. Mass. 2022) (denying motion to suppress where affidavit alleged that numerous images depicting child pornography were shared during the period the defendant was a confirmed group member, even though not on the exact dates he was observed in the chat).

Estrada's reliance on United States v. Falso, 544 F.3d 110 (2d Cir. 2008), is similarly misplaced. In Falso, the Second Circuit found no probable cause where the affidavit failed to allege that the defendant had subscribed to a website known to contain files depicting child pornography. Id. at 121. Here, by contrast, the affidavit stated that Estrada was listed as a participant in two groups used to distribute illicit material, that group members could view the chat history from the date of joining, and that substantial volumes of illicit content were shared while Estrada was listed as a participant.

Finally, Estrada asserts that his presence in the groups is consistent with innocent behavior -- for example, being added to a group without knowing its content, ignoring any notifications, and never opening the group. This argument insists on more proof than a warrant requires. “[P]robable cause does not require officers to rule out a suspect's innocent explanation for suspicious facts.” District of Columbia v. Wesby, 583 U.S. 48, 61, 138 S.Ct. 577, 199 L.Ed.2d 453 (2018). Instead, probable cause requires only a “fair probability that ․ evidence of a crime will be found in a particular place.” United States v. Austin, 991 F.3d 51, 55 (1st Cir. 2021) (alteration in original) (quoting United States v. Silva, 742 F.3d 1, 7 (1st Cir. 2014)). Given the length of Estrada's membership in the two groups, the volume of files depicting child pornography shared during Estrada's membership, and the detailed description of a file shared while Estrada was a participant in one of the groups, the magistrate judge had a substantial basis to find probable cause.

II. Franks Hearing

A. Legal Standard

Estrada requests a Franks hearing in his motion to suppress. An affidavit in support of probable cause is presumed valid. See Franks, 438 U.S. at 171, 98 S.Ct. 2674. If “incorrect information is contained in an affidavit that is used to obtain a warrant, the trial court may hold a so-called Franks hearing to determine whether evidence obtained with the warrant should be excluded at trial.” United States v. O'Neal, 17 F.4th 236, 244 (1st Cir. 2021). A Franks hearing is only warranted, however, “should the defendant make “ ‘a substantial preliminary showing” that: 1) the warrant affidavit contains a false statement made “knowingly and intentionally, or with reckless disregard for the truth” and 2) ․ “the allegedly false statement was necessary to the finding of probable cause.” ’ ” United States v. Pérez-Greaux, 83 F.4th 1, 32 (1st Cir. 2023) (quoting United States v. Hicks, 575 F.3d 130, 138 (1st Cir. 2009)).

B. Application

Estrada argues that Agent Hyde's statements that “participants receive a notification every time there is a new message or can opt to receive ․ batched notifications” and that users “receive a notification” when they are added to a chat were materially misleading. Dkt. 51-1 ¶¶ 12, 14. He claims these statements implied he was aware of the content shared in the groups, when in fact users can mute notifications or snooze a group for thirty days. He emphasizes that Agent Hyde should have included the fact that a user could mute notifications from a group in her affidavit. Estrada relies on two cases involving the Candyman egroup, where two district courts found the test under Franks met after law enforcement affidavits incorrectly stated that every member automatically received email alerts when illicit files were uploaded, though users had to opt in to that feature. See United States v. Strauser, 247 F. Supp. 2d 1135, 1138-39, 1143-45 (E.D. Mo. 2003); United States v. Perez, 247 F. Supp. 2d 459, 463 (S.D.N.Y. 2003).

Estrada's arguments are unpersuasive. As the government notes, before a user could mute or snooze a group, he would first receive a notification that he was added to the group. More importantly, unlike the Candyman cases, where the key issue was whether illicit files were ever delivered to a user, here, it is undisputed that contraband was shared directly in the groups Estrada belonged to and that he remained a participant in those groups for two months and a year, respectively. Therefore, the affidavit's omission of further detail about notification settings does not vitiate probable cause. See United States v. Simpkins, 978 F.3d 1, 7 (1st Cir. 2020) (“A finding of probable cause does not demand proof beyond a reasonable doubt ․”).

Estrada next contends that that the affidavit was misleading when it described the dates that Estrada was “last seen” or “active” on Viber because it failed to explain that these terms refer to general activity on the Viber application, not within a specific group. But that distinction is evident from the affidavit's language and structure: Agent Hyde presented these observations separately from her discussion of the specific group content and did not claim that Estrada accessed the groups on those dates. Compare Dkt. 51-1 ¶ 22 (“[T]he [defendant] was a participant in Group A ․ on or about February 9, 2023.”), with id. ¶ 24 (“[HSI] observed the [defendant] as being ‘Last Seen’ on [Viber] on March 26, 2024.”). At most, these statements draw a temporal connection between Estrada's presence in the groups and his general activity on Viber, supporting a finding of probable cause without being misleading.³

ORDER

For the foregoing reasons, Estrada's motion to suppress and his request for a Franks Hearing (Dkt. 51) are DENIED.

SO ORDERED.

FOOTNOTES

1.   Agent Hyde refers to the Viber application as Chat Application A. The government later revealed that Chat Application A is Viber.

2.   A straight warrant was issued for Estrada on November 7, 2023, based on a criminal complaint charging Estrada with carrying a dangerous weapon, assault with a dangerous weapon, and an ordinance violation.

3.   Because Estrada has not made a substantial preliminary showing that any alleged falsehood or omission was material to the probable cause determination, the Court denies his request for a Franks hearing and need not reach the second prong of the Franks analysis. See United States v. Rigaud, 684 F.3d 169, 176 (1st Cir. 2012) (affirming the denial of a Franks hearing on materiality grounds without reaching intent).

Saris, United States District Judge