Heard in the Court of Appeals April 24, 2014
This Decision is not final until expiration of the twenty-one day rehearing period. [North Carolina Rules of Appellate Procedure 32(b)]
Attorney General Roy A. Cooper, III, by Assistant Attorney General Joseph L. HydeMr., for the State.
Hicks McDonald Noecker LLP, by Raymond D. Large III Mr., for defendant-appellant.
Judges Robert N. HUNTER,
JR. and DILLON concur.
Appeal by defendant from consolidated order entered 4 April 2013, order denying motion to suppress entered 27 June 2013, and judgments entered 12 July 2013 by
Judge David L. Hall Guilford County. No. 09CRS094505, 10CRS082813, 16, 19-46.
Defendant appeals her convictions for accessing a government computer without authority, accessing computers, and identity theft, arguing that her motions to suppress evidence seized by the North Carolina Agricultural and Technical State University police from a search of her home should have been allowed. For the following reasons, we find no error.
This case has an odd and somewhat disturbing background. It began with a civil case and ended up as a criminal prosecution of defendant, who was the plaintiff in the civil case. In this criminal case, as a practical matter, North Carolina Agricultural and Technical State University (" A& T" ) used a criminal search warrant to obtain discovery from defendant for possible use in its defense of the civil case she had filed against A& T. Until 11 July 2008, defendant was an employee of A& T, but her employment was terminated. On 28 July 2009, in the civil action, the trial court entered an order addressing defendant's " Petition for Judicial Review of the Decision" before an administrative law judge which determined that A& T had failed to inform her of her right to contest her termination. The order found that " Petitioner [defendant] received a letter from Respondent [A& T] dated June 11, 2008 advising that her employment would be terminated July 11, 2008" and concluded that
[t]he letter to Petitioner [defendant] dated June 11, 2008 fails to inform her of her right to contest her termination based on RIF; the procedure for contesting her termination, or the time limit for filing her objection to the termination. Accordingly, the notice was insufficient to start the time limit for filing her petition[.]
Accordingly, the trial court reversed the final decision of the administrative law judge, which had dismissed defendant's contested case, and remanded the case for further proceedings.
About a month and a half after the civil case was remanded, on or about 8 September 2009, " Detective M. Tillery, of North Carolina Agricultural and Technical State University Department of Police & Public Safety" applied for a search warrant for Road Runner Hold Company LLC (" Road Runner" ) based upon the following facts:
On September 3, 2009 I, Detective M. Tillery, responded to 1020 Wendover Avenue, Greensboro, NC, which is property of NC A& T State University. The complainant, Mrs. Linda McAbee, Vice Chancellor of Human Resources at NC A& T SU, stated that someone accessed her NC A& T SU email account without her permission. The complainant stated that the unknown and unauthorized user(s) created an email which intended to deceive Administrators of the university.
The complaint stated that the information contained in the email addressed an issue which NC A& T State University and [defendant] Mrs. Patrice A. Bernard (Petitioner) is/was in litigation in Guilford County, North Carolina. The complainant also stated that the unauthorized email was sent on August 30, 2009 at 18:49EST.
This affiant discovered through court documents that the petitioner filed a grievance in April 2008 in response to a termination letter dated April 22, 2008. According to court documents, the petitioner [defendant] received a Reduction In Force (RIF) letter indicating that her position would be eliminated for funding reasons. The petitioner filed an appeal. University Administrators have been communicating with Mrs. McAbee to resolve this issue through legal means. Mrs. McAbee stated that someone accessed her email, constructed a bogus communication, and emailed the document to University Administrators in an effort to rehire or compensate the former employee, [defendant] Mrs. Patrice Bernard.
Mrs. Lisa Lewis-Warren, Department of Information Technology with NC A& T SU stated that her department conducted forensic analysis on Mrs. McAbee's desktop computer and the campus Network System. Mrs. Warren stated that her department discovered that the unauthorized communication was not sent from Mrs. McAbee's desktop computer. Mrs. Warren stated that the NC A& T SU IT Department analysis indicated that an unauthorized person accessed Mrs. McAbee's university email account and other current employees email accounts of NC A& T SU, several times for several minutes from IP Address 126.96.36.199, between August 28, 2009 through September 2, 2009.
This affiant knows that many individuals and businesses obtain their access to the Internet through businesses known as Internet Service Providers (" ISPs" ). ISPs provide their customers with access to the Internet using telephone or other telecommunications lines; provide Internet email accounts that allow users to communicate with other Internet users by sending and receiving electronic messages through the ISPs' servers; remotely store electronic files on their customers' behalf; and may provide other services unique to each particular ISP.
Through this affiant['s] training and experience, when an ISP or other providers uses dynamic IP addresses, the ISP randomly assigns one of the available IP addresses in the range of IP addresses controlled by the ISP each time a user dials into the ISP to connect to the Internet. The customer's computer retains that IP address for the duration of that session, and the IP address cannot be assigned to another user during that period.
. . . .
Through this affiant['s] training and experience, a static IP address is an IP address that is assigned permanently to a given user or computer on a network. A customer of an ISP that assigns static IP addresses will have the same IP address every time.
Through this affiant['s] training and experience, ISPs maintain records pertaining to the individuals or companies that have [a] subscriber account with it. Those records could include identifying and billing information account access information in the form of log files, email transaction information, posting information, account application information, and other information both in computer data format and in written record format. ISPs reserve and/or maintain computer disk storage space on their computer system for the use of the Internet service subscriber for both temporary and long-term storage of electronic communications with other parties and other types of electronic data and files. E-mail that has not been open is stored temporarily by an ISP incident to the transmission of the e-mail to the intended recipient, usually within an area known as the home directory.
Through my training and experience this affiant knows that when an individual uses a computer to obtain unauthorized access to a victim computer over the internet, the individual's computer will generally serve both as an instrumentality for committing the crime, and also as a storage device for evidence of the crime. The computer is an instrumentality of the crime because it is used as a means of committing the criminal offense.
Based on these facts Detective Tillery requested a search warrant to seize anything within the possession of Road Runner regarding IP Address 188.8.131.52 between the dates of August 28, 2009 and September 2, 2009. The magistrate issued the search warrant. On or about 15 September 2009, Detective Tillery applied for an amended search warrant based on the same facts and requesting the same information to be seized; again, the magistrate issued the search warrant. On or about 15 September 2009, Time Warner Cable's Subpoena Compliance Team, wrote to Detective Tillery and informed him that the IP Address at issue was assigned to defendant Patrice Bernard.
On or about 16 September 2009, Detective Tillery again applied for a search warrant but this time for defendant's home, vehicle, and her person. Detective Tillery's factual basis for the search warrant was the same as the Road Runner search warrants except he added that " [t]he ISP, Road Runner Hold Co LLC RRMA, identified IP Address 184.108.40.206 connection as being assigned to [defendant] Patrice Bernard located at 2722 Chadbury Drive Greensboro, North Carolina. This is the petitioner who is/was in litigation against NC A& T State University in Guilford County, North Carolina." The magistrate issued the search warrant. On or about 23 September 2009, Detective Tillery again applied for a search warrant based on the same facts as in the other search warrants, this time specifically requesting to search a computer seized during the search of defendant's home. The magistrate issued the search warrant. All of the search warrants except for the one regarding defendant's computer were returned by Detective Tillery.
On or about 30 September 2009, the magistrate issued a warrant for defendant's arrest for accessing a government computer; this warrant was returned by Detective Tillery. On or about 12 July 2010, the magistrate issued two other arrest warrants for felony accessing computers and identity theft; these warrants were returned by A& T officers. On 20 September 2010, defendant was indicted for ...