PUBLISHED

                           UNITED STATES COURT OF APPEALS
                               FOR THE FOURTH CIRCUIT


                                          No. 17-4299



UNITED STATES OF AMERICA,

                        Plaintiff – Appellee,

                v.

ROBERT MCLAMB,

                        Defendant – Appellant,

------------------------------

PRIVACY INTERNATIONAL; ELECTRONIC FRONTIER FOUNDATION;
NATIONAL ASSOCIATION OF CRIMINAL DEFENSE LAWYERS,

               Amici Supporting Appellant.



Appeal from the United States District Court for the Eastern District of Virginia, at
Norfolk. Rebecca Beach Smith, Chief District Judge. (2:16-cr-00092-RBS-RJK-1)


Argued: October 26, 2017                                     Decided: January 25, 2018


Before DUNCAN and THACKER, Circuit Judges, and Max O. COGBURN, United
States District Judge for the Western District of North Carolina, sitting by designation.


Affirmed by published opinion. Judge Thacker wrote the opinion, in which Judge
Duncan and Judge Cogburn joined.
ARGUED: Andrew William Grindrod, OFFICE OF THE FEDERAL PUBLIC
DEFENDER, Norfolk, Virginia, for Appellant. Richard Daniel Cooke, OFFICE OF THE
UNITED STATES ATTORNEY, Richmond, Virginia, for Appellee. ON BRIEF:
Geremy C. Kamens, Federal Public Defender, OFFICE OF THE FEDERAL PUBLIC
DEFENDER, Alexandria, Virginia, for Appellant. Dana J. Boente, United States
Attorney, Alexandria, Virginia, Elizabeth M. Yusi, Assistant United States Attorney,
OFFICE OF THE UNITED STATES ATTORNEY, Norfolk, Virginia, for Appellee.
Scarlet Kim, PRIVACY INTERNATIONAL, London, United Kingdom, James R.
Theuer, JAMES R. THEUER, PLLC, Norfolk, Virginia, for Amicus Privacy
International. Cindy Cohn, Mark Rumold, Andrew Crocker, ELECTRONIC FRONTIER
FOUNDATION, San Francisco, California, for Amicus Electronic Frontier Foundation.
Elizabeth Franklin-Best, BLUME FRANKLIN-BEST & YOUNG, LLC, Columbia,
South Carolina, for Amicus National Association of Criminal Defense Lawyers.




                                         2
THACKER, Circuit Judge:

      Robert McLamb (“Appellant”) challenges the district court’s order denying his

motion to suppress evidence of child pornography contained on a hard drive recovered at

his home. The Federal Bureau of Investigation (“FBI”) obtained the evidence in the

course of its investigation of a child pornography website called “Playpen,” a hidden

services message board located on the “dark web.” The dark web is a collection of

encrypted networks providing strong privacy protections to its users.

      After locating and seizing the Playpen servers in February 2015, the FBI sought a

warrant to deploy the Network Investigative Technique (“NIT”) to locate users accessing

the website.   The NIT is a computer script designed to overcome the anonymity

protections of the dark web and collect identifying information from computers accessing

the Playpen website. A federal magistrate judge in the Eastern District of Virginia issued

the warrant, authorizing use of the NIT on Playpen visitors for 30 days. The NIT

identified thousands of computers across the world that accessed Playpen during the 30-

day period. After the NIT identified Appellant as one such visitor, the FBI seized

Appellant’s hard drive and charged him with receipt and possession of child

pornography.

      Appellant moved to suppress the evidence on the hard drive as the fruit of an

invalid warrant. Appellant challenged the warrant’s particularity and its execution, as

well as the jurisdiction of the magistrate judge to authorize such a search. The district

court denied the motion, and we affirm. Even if the warrant is unconstitutional, the



                                            3
district court properly denied Appellant’s motion to suppress because the Leon good faith

exception applies.

                                             I.

      The Onion Router (“Tor”) is an encrypted online network, one of several networks

that make up the dark web. Tor uses a series of relay computers to mask the identity of

online users. As a result, Tor obscures how, when, and where users access the internet.

With such powerful anonymity protections, some use Tor for drug dealing, child

pornography, and other nefarious purposes.

      Playpen was a message board on the dark web where users could upload or

download child pornography. At one time, Playpen had over 158,000 total members and

nearly 100,000 posts. In order to access a hidden services website like Playpen, a user

must download Tor and enter the site’s domain name, a 16-character URL consisting of

random letters and numbers. Playpen was not discoverable on the open web, nor could a

search engine like Google route users to it. Playpen’s welcome page required a visitor to

enter a username and password in order to proceed to the message board. On this

welcome page, a banner depicted two partially clothed, prepubescent girls with their legs

spread apart.   The banner was suggestive enough that Playpen’s content would be

apparent to any visitor of the welcome page.

      After receiving a tip, the FBI seized the Playpen server and arrested the

administrator of the site. Despite having possession of the server, however, the FBI was

unable to locate Playpen users, because by virtue of their use of Tor, the users uploading

and downloading child pornography remained anonymous. Therefore, the FBI sought to

                                             4
deploy the NIT to defeat the anonymity protections of the dark web. The NIT works by

corrupting the target server, thereby surreptitiously supplementing child pornography

data with the NIT script:

       [NIT] is installed on the server [of a particular Tor website.] After a user of
       the [Tor website] takes certain actions, including downloading information
       from the [NIT infected] server . . . that information is supplemented with
       the NIT instructions. So the user downloads the NIT to their computer and
       takes it to their computer, wherever it may be located.

J.A. 137. *

       Once delivered and installed to a user’s computer, the NIT deploys a “payload”

software that searches the user’s computer for identifying information: (1) the user’s IP

address; (2) a unique signature generated by the NIT so that user’s activities on the Tor

network might be identified; (3) the user’s operating system; (4) whether the NIT is

already installed on a user’s computer; (5) a host name used to identify the device in

other kinds of electronic communication; (6) the user’s active operating system

username; and (7) the user’s Media Access Control address, which identifies the location

where the user’s computer connects to the internet. The NIT then transmits all of that

data to the FBI.

       Concerned with the legality of the NIT and similar remote access investigative

programs, the FBI sought to amend the Federal Rules of Criminal Procedure in 2014 to

enlarge the scope of magistrate judges’ jurisdiction in issuing warrants. However, the

       *   Citations to the “J.A.” refer to the Joint Appendix filed by the parties in this
appeal.



                                             5
rule was not amended until 2016, after the events of this case. At the time of the Playpen

investigation, lower courts differed on the permissibility of remote access investigative

techniques. Compare United States v. Laurita, No. 8:13-cv-107, 

, at

*6 (D. Neb. Aug. 5, 2016) (“[Rule 41] authorizes the use of a tracking device and the

NIT is analogous to a tracking device.”), with In re Warrant to Search a Target

Computer at Premises Unknown, 

, 757 (S.D. Tex. 2013) (concluding

an NIT warrant exceeded the magistrate judge’s Rule 41 jurisdiction). No appellate court

had addressed the issue. Before applying for the NIT warrant in this case, the FBI

consulted with attorneys at the Department of Justice’s Child Exploitation and Obscenity

Section as well as the FBI’s Remote Operations Unit.

      FBI Agent Douglas Macfarlane (“Agent Macfarlane”) authored the affidavit in

support of the Playpen NIT warrant. The affidavit outlines Tor, details the content of

Playpen, and devotes several pages to describing the mechanics of the NIT.            The

magistrate judge in the Eastern District of Virginia issued the warrant. The warrant

authorized the use of the NIT for 30 days on any user entering a username and password

into the Playpen welcome page.

      Just over a week after the NIT went into effect, Appellant entered a username and

password into the Playpen welcome page and entered the website, thereby triggering the

NIT. The FBI obtained a second warrant to physically search Appellant’s home and to

seize his computer and two hard drives. Appellant was apprehended and found with over

2,700 images and videos of child pornography in his possession. Appellant was charged

with four counts of receipt of child pornography in violation of 18 U.S.C. § 2252(a)(2)

                                            6
and one count of possession of child pornography in violation of              18 U.S.C.

§ 2252(a)(4)(B). Appellant moved to suppress evidence of the child pornography found

on his hard drive as fruit of an invalid warrant. The district court denied the motion.

Appellant then entered a conditional guilty plea, reserving his right to appeal the

suppression ruling. This timely appeal followed.

                                           II.

      In the context of a suppression ruling, we review legal questions de novo. United

States v. Castellanos, 

, 832 (4th Cir. 2013). Appellant challenges the NIT

warrant’s particularity and execution, as well as the magistrate judge’s jurisdiction to

issue it. Even if any of these alleged shortcomings amount to a constitutional violation,

suppression is not an appropriate remedy if the good faith exception applies under United

States v. Leon, 

(1984).

      Three of our sister circuits have analyzed the same NIT warrant at issue in this

case. Each has concluded that even if the NIT warrant violates the Fourth Amendment,

the Leon good faith exception precludes suppression of the evidence. See United States

v. Horton, 

(8th Cir. 2017); United States v. Levin, 

(1st Cir.

2017); United States v. Workman, 

(10th Cir. 2017). We agree.

                                           A.

      Suppression is “a judicially created remedy designed to safeguard Fourth

Amendment rights generally through its deterrent effect, rather than a personal

constitutional right of the party aggrieved.” United States v. Leon, 

, 909

(1984) (quoting United States v. Calandra, 

, 348 (1974)).             “[T]he

                                           7
exclusionary rule serves to deter deliberate, reckless, or grossly negligent conduct, or in

some circumstances recurring or systemic negligence.” Herring v. United States, 

, 144 (2009). Central to the question of suppression is “the culpability of the law

enforcement conduct.” 

“[E]vidence should be suppressed ‘only if it can be

said that the law enforcement officer had knowledge, or may properly be charged with

knowledge, that the search was unconstitutional under the Fourth Amendment.” Illinois

v. Krull, 

, 348–49 (1987) (quoting United States v. Peltier, 

,

542 (1975)). Suppression “applies only where it ‘result[s] in appreciable deterrence.’”

(quoting 

).

       In Leon, the Supreme Court explained the limits of the good faith exception:

              Suppression . . . remains an appropriate remedy if the
              magistrate or judge in issuing a warrant was misled by
              information in an affidavit that the affiant knew was false or
              would have known was false except for his reckless disregard
              of the truth. The [good faith] exception . . . will also not
              apply in cases where the issuing magistrate wholly abandoned
              his judicial role . . . . Nor would an officer manifest objective
              good faith in relying on a warrant based on an affidavit so
              lacking in indicia of probable cause as to render official belief
              in its existence entirely unreasonable. Finally, depending on
              the circumstances of the particular case, a warrant may be so
              facially deficient . . . that the executing officers cannot
              reasonably presume it to be 

(citations omitted).

       None of these conditions apply here. There is no indication that the magistrate

judge “wholly abandoned” its judicial role, or that the affidavit lacked an “indicia of

probable cause.”    

.       Nor did Agent Macfarlane mislead the

magistrate judge with falsehoods or reckless disregard of truth. In his affidavit in support

                                             8
of the warrant application, Agent Macfarlane detailed the investigatory difficulties posed

by the dark web and devoted several pages to explaining the NIT’s mechanism.

Although he does not specifically use the term “tracking device” in his affidavit, Agent

Macfarlane’s detailed description of the NIT was sufficient to inform the magistrate

judge of the scope of the warrant sought.

       Appellant notes that Agent Macfarlane identified the Eastern District of Virginia

as the location of the search, but the NIT actually searched computers all over the world.

Agent Macfarlane did so in the warrant application, a preprinted form inviting the affiant

to fill in the blanks as to the magisterial district of the search. The location of the

Playpen server, the Eastern District of Virginia, was the most sensible single district to

identify as the “locat[ion]” of the contraband. J.A. 51. To the extent the form is

misleading, Agent Macfarlane cured any ambiguity by informing the magistrate judge

that the NIT would cause activating computers “wherever located” to transmit data to the

FBI. 

       Nor was the warrant so “facially deficient . . . that the executing officers [could

not] reasonably presume it to be valid.” 

. The boundaries of a

magistrate judge’s jurisdiction in the context of remote access warrants were unclear at

the time of the warrant application. Without judicial precedent for reference, the FBI

consulted with attorneys from the Department of Justice Child Exploitation and

Obscenity Section. Appellant casts the consultation in a cynical light, arguing that it

evidences a guilty conscience. But in light of rapidly developing technology, there will

not always be definitive precedent upon which law enforcement can rely when utilizing

                                            9
cutting edge investigative techniques.    In such cases, consultation with government

attorneys is precisely what Leon’s “good faith” expects of law enforcement. We are

disinclined to conclude that a warrant is “facially deficient” where the legality of an

investigative technique is unclear and law enforcement seeks advice from counsel before

applying for the warrant.

                                            B.

      Appellant also claims that the good faith exception to the exclusionary rule is

categorically inapplicable for warrants exceeding a magistrate judge’s jurisdiction.

Because such warrants are void from inception, Appellant contends, their execution is the

equivalent of a warrantless search. However, as noted, the Supreme Court has held that

“the exclusionary rule is designed to deter police misconduct rather than to punish the

errors of judges and magistrates.” 

. Suppressing evidence merely

because it was obtained pursuant to a warrant that reached beyond the boundaries of a

magistrate judge’s jurisdiction would not, under the facts of this case, produce an

“appreciable deterrence” on law enforcement. 

      Accordingly, suppression is not appropriate.

                                           III.

      For the foregoing reasons, the judgment of the district court is

                                                                            AFFIRMED.




                                            10