MARK L. HORNSBY, Magistrate Judge.
Defendant, Paul Andrew Talley, is charged with four counts of Access with Intent to View Child Pornography in violation of 18 U.S.C. § 2252(a)(5)(B). Before the court is Defendant's motion to suppress all evidence derived from a Search and Seizure Warrant issued by a Magistrate Judge for the United States District Court for the Eastern District of Virginia. [Rec. Doc. 18].
In late February and early March 2015, the FBI seized and, for approximately two weeks, assumed administrative control of "Playpen," a child pornography hidden-services website. Playpen had been operating for six months on the anonymizing "Tor" network, an acronym for The Onion Router, which is described in more detail below. During that period, and pursuant to a search warrant and Title III order authorized by two different federal judges, the FBI monitored the traffic on the website and deployed a network investigative technique ("NIT") for the purpose of locating the website's users who were logged into, and actively accessing, the child pornography website.
As a result of the FBI's operation, the IP addresses of many of Playpen's users who thought they could anonymously conceal their locations via Tor were identified. Based on the result of the NIT warrant, the FBI office applied for and received a search warrant from the undersigned for an address where Talley was living with his mother and stepfather in Coushatta, Louisiana. Suspected child pornography was located during the search.
The Tor network is similar to the traditional internet, with two relevant differences. First, the Tor network allows users to anonymously browse the Internet. Def. Ex. A at 10. The Tor network hides the true IP address by bouncing the communications around a distributed network of relay computers, also called "nodes," run by volunteers all around the world. As a communication bounces around the nodes, the various IP addresses of these nodes obscure the location from which the communication is traveling. When the user's computer eventually accesses the website via this network of nodes, only the IP address of the last exit node (rather than the IP address from where the computer signal originated) appears in the website's log of IP addresses. Def. Ex. A at 016.
Second, the Tor network is different from the traditional internet in that it allows, within the Tor network, for websites to be configured as "hidden-services" sites. Def. Ex. A at 016-017. The IP address of a Tor hidden-services site is replaced with a Tor-based web address—a series of algorithm-generated characters followed by the suffix ".onion," a function of which makes it impossible to determine, through public lookups, the IP address of a computer hosting a Tor hidden-service site. Def. Ex. A at 016-017.
In order to get to the URL of a hidden-services site, a user must use Tor software and operate within the Tor network. Def. Ex. A at 017. Moreover, a Tor user cannot search for a hidden-services site on a search engine like Google. Def. Ex. A at 017. Instead, generally, the user must know the exact "onion" web address of the hidden-service site in order to access it. Def. Ex. A at 01.
When an individual looks at a website on the Tor network, after the computer signal travels through random nodes and eventually makes contact with the website's server, a communication channel is established between the computer and the server, which allows the user to view and download what is on the website. Def. Ex. A at 029. In the case of a computer on the Tor network accessing a hidden-services site, neither the computer nor the hidden-services site can see the other's IP address. Def. Ex. A at 017. Instead, they are able to communicate through the communication channel set up by the Tor network.
Playpen began operating as a hidden-services site in approximately August 2014. Def. Ex. A at 018. Playpen required users to register with a username and password. Def. Ex. A at 019-020. Upon entering the website, several forums were listed as a sort of "Table of Contents" and accessible to users, including forums and sub-forums for "Girls HC [hardcore]," "Incest," and "Toddlers." Def. Ex. A at 018-022. Each forum and sub-forum contained topics, i.e., posts often including discussions, preview images, and image and/or video files (either linked within the Playpen website itself or linked to external websites) related to the particular forum topic involving the sexual abuse of children. Def. Ex. A at 020-021.
Because Playpen was running as a hidden-services site, the FBI was initially unable to track where the server was located or who was running the site, but through a chain of events originating from a foreign law enforcement agency's tip, the FBI was able to locate Playpen's server because the site was misconfigured. Def. Ex. A at 026-027.
The Playpen server was copied and brought to a government facility in the Eastern District of Virginia. Def. Ex. A at 026-027. On February 20, 2016, the FBI obtained a search warrant from a magistrate judge in the Eastern District of Virginia that authorized the FBI to deploy a network investigative technique ("NIT") onto a government server to obtain information from "activating computers," i.e., "those of any user or administrator who logs into [Playpen] by entering a username and password." Def. Ex. A at 004. The warrant allowed the FBI to operate the NIT through the Playpen site for up to 30 days. Def. Ex. A at 003. The NIT seized only six discrete pieces of identifying information from a computer that logged into the Playpen site—including the true IP address of the user and the computer's hostname. Def. Ex. A at 005.
In support of the warrant application, the FBI submitted a 31-page affidavit describing Playpen. The affidavit explained that Playpen was dedicated to child pornography and described the structure of the site. Typical posts within the Playpen site appeared to contain text, images, previews of images, compressed files, and links to external sites. Def. Ex. A at 022. The majority of the topics within the Playpen site contained discussions and images that appeared to be child pornography and child erotica of prepubescent children, including toddlers. Def. Ex. A at 022.
The affidavit explained what the NIT would do and how the NIT would help law enforcement locate Playpen's otherwise anonymous users. Def. Ex. A at 029-031. By logging into the Playpen website, a user's computer sent a signal to the server in Virginia. The NIT was set up to function such that, once the user clicked on a post, rather than receiving back from Playpen just the content of the post, the NIT used the communication stream between Playpen and the computer to send a string of code with computer instructions to the computer as it was downloading a Playpen post. Def. Ex. B at 029. That string of code would cause the computer to transmit back to a government computer the true IP address to which the computer was assigned by the ISP. Def. Ex. A at 029-030.
Between February 20, 2015, and March 4, 2015 (less than half the time authorized by the warrant), the FBI assumed administrative control over, and monitored, the Playpen website. Govt. Ex. 1 at 013. During this time, the NIT was installed onto, and operated from, a server in Virginia, which resulted in the FBI being able to track registered users' IP addresses when those registered users logged into Playpen and, generally speaking, clicked on a post. Govt. Ex. 1 at 018-019.
The NIT did not search through any content from inside an activating computer; instead, the computer code only transmitted discrete pieces of information to the government server that were authorized by the warrant. Govt. Ex. 1 at 018-019.
On March 2, 2015, an individual created an account on the Playpen website with the username "realpirateguy666." Between March 2 and March 5 2015, "realpirateguy666" was logged into Playpen with a user name and password for approximately three hours and forty-five minutes. Govt. Ex. 1 at 019.
During the FBI's Playpen sting, user "realpirateguy666" clicked through the Playpen site a number of times. For example, on March 4, 2015, the user "realpirateguy666" accessed a post that contained a link to forty-nine images, most of which appeared to depict minor, prepubescent females nude below the waist. Several of the images appeared to depict an adult male sexually assaulting a prepubescent female. Govt. Ex. 1 at 019. As the content of the Playpen posts were downloading onto Defendant's computer, the NIT was automatically sent from Virginia through the Tor nodes to Defendant's computer in Louisiana, utilizing the same communication stream as the Playpen webpage. Def. Ex. A and Govt. Ex. 1.
As a result of the NIT, the Government learned the actual IP address to which "realpirateguy666"'s computer was assigned at that specific time on March 4, 2015, as he accessed the child pornography post on Playpen. Govt. Ex. at 020. The FBI used a publicly available website to determine that BellSouth Telecommunications (BellSouth) was the ISP that assigned that particular IP address to an account accessing the Internet. Govt. Ex. at 020. The FBI served BellSouth with an administrative subpoena for the identified IP address at the particular time user "realpirateguy666" clicked on the posts on Playpen. Govt. Ex. at 021. The subpoena return reflected that the account had been receiving internet service at Talley's residence. Govt. Ex. at 021.
The FBI obtained a search warrant from the undersigned to search the residence reflected in the BellSouth subpoena return. Govt. Ex. 1 at 021. The FBI recovered a computer from Talley's bedroom. On that computer, the FBI found thumbnails of child pornography and search terms commonly used to find child pornography.
Defendant argues that the warrant was illegal because it was issued in the Eastern District of Virginia but obtained information from his computer located in the Western District of Louisiana. Defendant argues that the version of Rule 41 that was in effect at the time the search was conducted did not allow a magistrate judge to authorize the use of the NIT because the NIT—which found identifying information from computer users for the purpose of locating them—was not a tracking device. Doc. 18-3 at 4. Defendant also argues that the
Under the Fourth Amendment, "no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." U.S. Const. amend. IV. "[T]he Fourth Amendment require[s] that (1) a warrant provide sufficient notice of what the agents may seize and (2) probable cause exist to justify listing those items as potential evidence subject to seizure."
Generally, magistrate judges are allowed to issue warrants to search for and seize a person or property located within their district. Fed. R. Crim. P. 41(b)(1). In December 2016, after the NIT warrant was issued by the court in the Eastern District of Virginia, Rule 41 was amended to expand a magistrate judge's territorial reach to authorize searches of electronic storage media if the district where the media is located has been concealed through technological means. Fed. R. Crim. P. 41(b)(6).
The Government argues that while the technology authorized by the NIT warrant was somewhat novel, the magistrate judge in the Eastern District of Virginia had the authority to issue the warrant under the then-existing version of Federal Rule of Criminal Procedure 41(b)(4). Rule 41(b)(4) stated (then and now) that "a magistrate judge with authority in the district has authority to issue a warrant to install within the district a tracking device; the warrant may authorize use of the device to track the movement of a person or property located within the district, outside the district, or both[.]"
The undersigned has some concerns about construing the NIT as a tracking device warrant in order to uphold the search under the circumstances present here. The NIT was configured to capture the true IP address of the visiting computer and send that IP address to the FBI. However, the court need not wrestle further with this issue because even if the NIT warrant was not valid (due to the territorial limitations of Rule 41 in effect at the time of the warrant), the
Even where the Fourth Amendment has been violated, that "does not necessarily mean that the exclusionary rule applies."
"In considering whether the good-faith exception applies, [the court does] not attempt an `expedition into the minds of police officers' to determine their subjective belief regarding the validity of the warrant."
The FBI's reliance on the NIT warrant issued in Virginia was objectively reasonable. An experienced and neutral magistrate judge reviewed the detailed warrant application and concluded that there was probable cause to issue the warrant.
The undersigned adopts the good faith analysis of the
Even if the NIT warrant is defective due to the territorial limitations that existed in Rule 41 at the time the warrant was issued, the
Accordingly;
Under the provisions of 28 U.S.C. § 636(b)(1)(C) and Fed. R. Crim. P. 59(b)(2), parties aggrieved by this recommendation have
A party's failure to file timely written objections to the proposed findings, conclusions and recommendation set forth above shall bar that party, except upon grounds of plain error, from attacking on appeal the unobjected-to proposed factual findings and legal conclusions accepted by the district court.
