Search warrant affidavits into T. Denny Sanford have been unsealed. Here's what we know
Five search warrant affidavits unsealed Thursday reveal that billionaire banker T. Denny Sanford was believed to have obtained 36 images depicting child pornography in the summer of 2019.
The National Center for Missing and Exploited Children received a tip on July 9, 2019 about the images reported from an AOL account owned by Sanford, the documents show. The NCMEC then reported the tip to the South Dakota Internet Crimes Against Children Task Force on Aug. 14, 2019. The South Dakota Department of Criminal Investigation then started its investigation into Sanford relating to possession and distribution of child pornography.
The 83-page document dump, which shows what evidence law enforcement may have had to execute the search warrants, comes after a two-year legal battle between Sanford, the Argus Leader and ProPublica, an investigative news non-profit.
The South Dakota Supreme Court ruled on April 6 the affidavits, which explain why the search warrants were executed in 2019 and 2020, must be unsealed under the public's right to know and that a Minnehaha County judge had the right to redact personal information as he saw fit. The court's ruling is included in the document.
The Argus Leader had first learned about the investigation into Sanford, a nationally recognized philanthropist and billionaire who has pledged to 'die broke' and namesake of the Sanford Health system in Sioux Falls and the surrounding region, in 2019, but was under a gag order by a judge not to speak about the matter when the issue to get access to records first went to court. Sanford was only identified as the "Implicated Individual" in arguments and court hearings later on.
Sanford, the founder of First Premier Bank, is no longer being investigated for child pornography in South Dakota.
It's unclear why Sanford wasn't indicted, but the Argus Leader is actively asking that question. In January 2022, Sanford's legal team alleged he had been hacked.
“A forensic examination of the very email account and relevant timeframe that is the subject of the search warrant in this case has uncovered the specific name of an individual other than the Implicated Individual having gained access to that very account,” his attorney Marty Jackley wrote at the time. “Further exonerating evidence includes corroborating evidence of hacking into the Implicated Individual’s various accounts, unknown to the Implicated Individual until a forensic examination was performed that sought to uncover the truth in this matter.”
The South Dakota Attorney General's office concluded an investigation in May 2022 into Sanford, determining that "there are no prosecutable offenses within the jurisdiction of the state of South Dakota," according to a notice by the office. It remains unclear, though, if similar investigations into Sanford in other jurisdictions remain open.
The AG's office released the following statement Thursday in regard to the question of why he wasn't charged or indicted:
"In 2019, the Division of Criminal Investigation began investigating whether T. Denny Sanford had possessed child pornography. Search warrants were issued. That investigative file was then forwarded to the United States Attorney office in South Dakota, which forwarded it to the Department of Justice. The file was also forwarded to the authorities in Arizona and California. To date, none of those authorities have lodged charges against Sanford. In 2022, after Attorney General Jason Ravnsborg was impeached and suspended, his administration issued a statement that it did not find probable cause for criminal charges in the state of South Dakota."
More: What happened during the child porn investigation tied to T. Denny Sanford in South Dakota
The office then re-directed the Argus Leader to the notice by Deputy Attorney General Brent Kempem, signed May 27, 2022, that states the investigation had been completed. No other information was provided.
The current AG was the initial attorney representing Sanford when this investigation started, but he was not AG at the time the investigation began or ended.
Here's what the new documents show.
What's in the first search warrant affdavit?
The first affidavit, filed in December 2019, requests Oath Inc., which owns AOL, to turn over account information that was likely believed to be owned by Sanford.
The AOL account was suspected of containing 36 images depicting child porn and child erotica. The images appear to be three unique photos, showing young girls between the ages of 8 and 15 years old, nude, facing a camera and with genitalia visible. The three photos are then repeated multiple times.
A Verizon phone number was also attached to the AOL account. The DCI agent conducting the investigation found that the account was registered to Premier BankCard LLC.
On Nov. 20, the DCI agent was told by an employee of Premier Bank that first, the number was not associated with anyone at the bank. The employee then said the number was used by Sanford.
The same day, the DCI agent received a call from Jackley that Sanford would be cooperating with law enforcement but all communication related to the case go through Jackley.
Jackley currently serves as the South Dakota Attorney General. He was elected in November 2022.
More: What to know about the South Dakota Supreme Court ruling against T. Denny Sanford
What did affidavit No. 2 reveal?
The second search warrant affidavit, filed on March 12, 2020, was executed to MidCo for the cable and internet company to turn over all documents, PDF and text files from a computer that was accessed on June 27, 2019 with an IP address registered to their company in Sioux Falls.
The affidavit was presented on "December 9th, 2020... in support of a search warrant for Oath Inc records and content of the email," redacted by the judge. "The search warrant was presented to the Honorable Judge James Power of the 2nd Circuit in Sioux Falls, SD who later signed the warrant."
Records were received "January 10, 2020... including emails from Oath Inc." from a redacted address. The December 9, 2020 date may be an error and refer to December 9, 2019.
Eight emails were collected from the search warrant with dates of May 28, 2019, May 29, 2019 and June 27, 2019. Two emails were sent from a Verizon Samsung Galaxy Smartphone.
Each email had an image of a young nude girl attached, according to the documents. There were five unique images, three of which were repeated several times in the emails.
Third search warrant affidavit examines Verizon cell phone
The third search warrant affidavit, filed March 12, 2020, requested Verizon wireless records for a cell phone used on June 27, 2019. The cell phone number was used by Sanford at the time, according to the documents.
Two of the emails that contained child porn in May 2019 had signature lines identifying they had been sent from a Verizon Samsung Galaxy Smart phone, according to the documents. There were also 14 additional outgoing emails sent between May 28 and May 29 in the same timeframe as the outgoing messages that had the child porn attachments.
One email containing a graphic image of a young girl had a naming convention "that possibly identifies a date and a time that the image was taken and is a common naming convention for Android devices," the DCI agent, who wrote the affidavit and had experience with cell phone image naming conventions, said.
Three IP addresses not registered in South Dakota were also noted in the affidavit. They include Oregon, Arizona and California.
Geolocation information pinged addresses in Sioux Falls, Scottsdale, Arizona and La Jolla, California, all where Sanford owns homes.
But, the DCI agent wrote he was unable to accurately locate the location of the individual because all three locations were pinged on the two dates in May and date in June.
"The most reliable way to positively identify the individual who was using the email account on that date and the reliable way to accurately determine the location of that individual is by obtaining records and information from Verizon Wireless regarding the cell phone number of [redacted]," according to the search warrant affidavit. "Specifically, subscriber information, device information, call detail records, IP address information and historical location information from Verizon Wireless can be necessary and essential in order to make those determinations."
Fourth and fifth affidavits request rest of cell phone usage
The fourth and fifth search warrant affidavits filed requested the cell phone number records used on May 28 and May 29, 2019.
The affidavits contain the same information as the third affidavit requesting the cell phone records used on June 27, 2019, along with the three different IP addresses recorded.
What else is contained in the documents?
The warrants note that a review of the emails from one of the relevant email accounts (though exactly which one is redacted from the documents) included “identifiers,” like a photograph of Sanford’s driver’s license, a hotel receipt for a 2019 stay in California, several photographs of a person believed to be Sanford, and a letter from the Dalai Lama thanking Sanford for his support of the University of California San Diego T. Denny Sanford Institute for Empathy and Compassion.
What has the reaction been?
In a statement, Sanford Health's Media Relations Manager Paul Heinert said “We took this matter seriously and trust law enforcement’s process with regard to their investigation, including their determination last year that there were no chargeable offenses. Sanford Health was not contacted by law enforcement or involved in the investigation.”
In a statement Thursday, Stacy Hegge, Sanford's lawyer, said her client appreciated that after a thorough investigation, there were no prosecutable offenses and that the records released by the court were only allegations.
"These preliminary allegations were provided to law enforcement prior to law enforcement’s exhaustive investigation and its realization that various individuals had documented access to the electronic devices at issue, including signs of hacking," Hegge wrote. "While some claim releasing affidavits that reiterate these allegations constitute transparency, releasing preliminary allegations made prior to completing the full investigation only misinforms people and obscures the investigation’s conclusions that no prosecutable offense occurred.”
It's been two years. What else has happened?
After the conclusion of the case, according to state law and James Power, the Minnehaha County judge, the search warrant affidavits were supposed to be unsealed. However, intervention by Sanford's legal team kept the records sealed until now.
The five search warrants themselves had been unsealed in 2021 after a ruling from the South Dakota Supreme Court found some material inside the documents were of a public nature.
Typically, search warrants and their affidavits are public record, according to state law.
This article originally appeared on Sioux Falls Argus Leader: Sanford affidavits reveal police found 36 images of child porn on his phone
