DENNIS L. HOWELL, Magistrate Judge.
Pending before the Court are Defendant Hall's Motion to Suppress and Dismiss, 1:16cr147 [# 18 & # 27] and Defendant Litwack's Motion to Suppress and Dismiss, 1:17cr60 [# 15]. The Government filed a Response in both cases, 1:16cr147 [# 22], 1:17cr60 [# 17]. The Court conducted a joint hearing and heard evidence and argument from the Government and Defendants. Defendants then filed Memorandums in Support of the Motions to Suppress and Dismiss, 1:16cr147 [# 33], 1:17cr60 [# 25]. The Government filed a Response to both Memorandums, 1:16cr147 [# 35], 1:17cr60 [#27]. Finally, the Government filed a Supplement to both Responses, 1:16cr147 [# 39], 1:17cv60 [# 32]. Having carefully considered the evidence, briefs, and arguments of counsel, the Court enters the following findings, conclusions, and recommendation.
Defendant Hall is charged with receiving and possessing child pornography, in violation of 18 U.S.C. §§ 2252A(a)(2)(A), 2252A(a)(5)(B). On April 25, 2017, Defendant Hall filed his Motion to Suppress and Dismiss [# 18]. On May 9, 2017, the Government filed its Response to Defendant Hall's Motion to Suppress [# 22]. On July 27, 2017, Defendant Hall filed a Supplement to the Motion to Dismiss [# 27]. On August 15, 2017, the Court held a joint hearing with the Government and Defendants Hall and Litwack. On September 19, 2017, Defendant Hall filed a Memorandum in Support of his Motion to Dismiss [# 33]. On September 29, 2017, the Government filed a Response to Defendant's Memorandum [# 35]. On November 13, 2017, the Government filed a Supplemental Response [# 39].
Defendant Litwack is charged with two counts of possessing child pornography, in violation of 18 U.S.C. § 2252A(a)(5)(B). On June 15, 2017, Defendant Litwack filed his Motion to Suppress and Dismiss [# 15]. On June 22, 2017, the Government filed its Response to Defendant Litwack's Motion to Suppress [# 17]. On August 15, 2017, the Court held a joint hearing with the Government and Defendants Hall Litwack. On September 20, 2017, Defendant Litwack filed a Memorandum in Support of his Motion to Dismiss [# 25]. On September 29, 2017, the Government filed a Response to Defendant's Memorandum [# 27]. On November 13, 2017, the Government filed a Supplemental Response [# 32].
In their Motions to Suppress and Dismiss, Defendants raise two arguments to suppress evidence or otherwise dismiss the cases against them: (1) the warrant from the Eastern District of Virginia, which led to the initial identification of defendants, was defective, overbroad, or void ab initio; and (2) the Government engaged in outrageous conduct.
Defendants called FBI Special Agent Daniel Alfin as a witness. (T. 4)
Initially, when Alfin discovered Playpen on the Tor network, there was little possible investigation due to Tor users' anonymity. (T. 11) While determining how to investigate Playpen, the FBI documented the content of the website. (T. 11) In December, 2014, the FBI caught a break. (T. 88) The FBI was able to locate the creator of the Playpen website due to a glitch that revealed the website creator's real Internet Protocol (IP) address. (T. 13-14) With the real IP address, the FBI was able to identify and prosecute Steven Chase as Playpen's creator. (T. 15)
On February 20, 2015, the FBI took administrative control over Playpen for thirteen days. (T. 18, 38) Prior to the takeover, however, Special Agent Douglas MacFarlane sought a search warrant from a magistrate judge in the Eastern District of Virginia. (T. 19-20) The FBI needed a warrant because even though it could take Playpen over, it still would not be able to identify individual Playpen users. (T. 17, 89) The FBI crafted a method that would allow it to identify individual users using a warrant and called it the Network Investigative Technique (NIT). (T. 19-20) The NIT warrant specified that the data to be collected included: (1) IP addresses; (2) a unique identifier generated by the NIT to establish the date the website was used; (3) the type of operating system used by the computer; (4) information about whether the NIT had already been delivered to the computer; (5) the computer's host name; (6) the computer's operating system username; and (7) the computer's Media Access Control (MAC) addresses. [1:16cr147 # 18, Ex. 1 at 5] [
In order for the FBI to obtain a user's identifying information, several steps needed to happen in order to trigger the NIT. (T. 30, 95) First, a user would have to find Playpen on the Tor network, either through an external link or via a website address consisting of sixteen random characters and ending ".onion". (T. 96) Second, a user had to log in to Playpen with a user name and password. (T. 30, 95-96) Third, a the user would need to navigate to a subsection of the website—Playpen had its subsections organized by content. (T. 30, 95-96) Fourth, a user would need to open a thread advertising child pornography from that subsection. (T. 30, 97) If the user downloaded content, that triggered the ability for the FBI to send hidden malware imbedded within the content. [NIT Warrant at 24]. The malware would capture a user's identifying information and transmit it back to the FBI in Virginia.
Once the NIT transmitted the identifying information to the FBI in Virginia, that information was given to local FBI field offices. (T. 132) The local FBI offices would begin an investigation and apply for subsequent warrants in their respective districts. (T. 132)
When the FBI took over Playpen, it was decided that the FBI would operate the website in the Eastern District of Virginia. (T. 20) When the FBI transferred the operation to Virginia, Playpen was taken offline for a couple of hours. (T. 22) Before taking Playpen back online, the FBI presented the NIT warrant to a magistrate in the Eastern District of Virginia. (T. 20-21) The Magistrate Judge was aware that the warrant would allow the capture of information and lead to subsequent prosecutions of individuals outside the district. (T. 20-21)
Additionally, once the FBI had seized Playpen, it transferred Playpen's content to the National Center for Missing and Exploited Children (NCMEC). (T. 25) NCMEC identifies victims of child pornography and sends out victim notification letters when investigations are ongoing. (T. 25) Further, NCMEC let the FBI know which photos had previously been identified for victim restitution. (T. 129)
During the thirteen days of FBI takeover, Playpen registered approximately 100,000 new accounts—though not necessarily new users. (T. 39, 63) From time to time, the original Playpen creator would purge inactive accounts. (T. 63) So while Playpen user accounts increased from 317,000 accounts to 417,000 accounts under FBI control, these raw numbers do not reflect necessarily the total real number of Playpen users during its operation. (T. 62-63) Agent Alfin testified that for a website like Playpen, 100,000 new user accounts in thirteen days was within the realm of normal activity. (T. 64) Both before and after FBI takeover, Playpen had approximately 50,000 unique visitors a week. (T. 79)
The only alteration the FBI made to Playpen before taking it over was to remove a section of the website called "Producer's Pen." (T. 23) This was an area of the website that encouraged users to create new amateur child pornography. (T. 23, 37) To assuage any distrust by Playpen users, the FBI posted that the Producer's Pen section would soon be up and running again. (T. 36-37) Otherwise the website continued as it had before FBI takeover, including fluctuating website speed associated with the Tor network. (T. 25, 40-41, 70) Users remained free to upload and exchange content, including potentially new photos of victims. (T. 28) The FBI did not create new content. (T. 71) The FBI allowed Playpen to continue to function in this way because removing certain amounts or types of content can tip off users that the site is being investigated. (T. 28-29, 94) Agent Alfin testified that regarding consumers of child pornography, users of the Tor network are likely to be more tech savvy compared to non-Tor users. (T. 87)
After thirteen days of FBI takeover, the FBI had identified approximately 8,000 individuals to investigate. (T. 46-47) While the FBI could have continued to operate Playpen, 8,000 new individual investigations, even spread among agencies, was determined to be a reasonable end point. (T. 47-48, 72) The FBI was keenly aware of the tightrope it walked in keeping users in the dark about the takeover. (T. 52) If a user was tipped off, he or she would likely destroy evidence (i.e., hard drive). (T. 84) Before taking down Playpen, the FBI posted to Playpen users that the site was going offline for an upgrade. (T. 85)
Project Pacifier has led to the worldwide prosecution of over 1,000 people and the rescue of over 200 victims of child sexual abuse. (T. 72, 103) The FBI continues to prosecute Playpen users from Project Pacifier. (T. 75)
On February 20, 2015, Agent MacFarlane sought the NIT warrant from a magistrate siting in the Eastern District of Virginia. [NIT Warrant at 2]. The warrant was filed under seal and has been provided with redactions.
The warrant stated the information to be seized: (1) the activating computer's actual IP address along with the time and date of that determination; (2) a unique identifier generated by the NIT to distinguish date from one activating computer from that of another; (3) the type of operating system used by the computer; (4) information about whether the NIT had already been delivered to the activating computer; (5) the activating computer's host name; (6) the activating computer's operating system username; and (7) the activating computer's MAC addresses.
The affidavit outlined the probable cause the FBI had in pursing the warrant. [NIT Warrant at 18]. In September, 2014, the FBI first became aware of Playpen.
On March 1, 2015, Defendant Hall, under the username "amoura," accessed a post containing child pornography from Playpen, at which point the NIT was deployed to the activating computer. [1:16cr147 # 18 at 3]. The NIT collected Defendant Hall's information and sent it to the FBI in the Eastern District of Virginia.
On July 13, 2015, local FBI obtained a residential search warrant from a magistrate in the district of Defendant Hall's residence, the Western District of North Carolina. [#18 at 3] On July 15, 2015, FBI agents executed the warrant on Hall's home, where they seized a Hewlett Packard laptop.
On October 11, 2014, Defendant Litwack, under the username "29stroke," first accessed the child pornography website Playpen. [1:17cr60 # 15 at 4]. After the FBI took over Playpen, Defendant Litwack again accessed child pornography at which point the NIT was deployed to the activating computer.
Local FBI obtained a residential search warrant from a magistrate in the district of Defendant Litwack's residence, the Western District of North Carolina [# 15 at 4]. On December 17, 2015, FBI agents executed the warrant on Defendant Litwack's home, where they seized Litwack's desktop computer. Id. Later, the desktop computer would be found to have child pornography downloaded and the Tor network installed.
U.S. Const. amend. IV.
The standard of review for a magistrate's determination of probable cause is one of great deference.
To that end, in reviewing a warrant application a magistrate may rely on law enforcement officers, who may "draw on their own experiences and specialized training to make inferences from and deductions about the cumulative information available to them that might well elude an untrained person," so long as the affidavit contains facts supporting the officer's determinations.
Regarding probable cause, anticipatory warrants are no different from ordinary warrants.
In addition to the probable cause requirement, a warrant must contain with particularity "the place to be searched" and "the persons or things to be seized."
The Fourth Amendment also limits the scope of a search. A search pursuant to a warrant is "limited in scope by the terms of the warrant's authorization."
After reviewing the NIT warrant and affidavit, the Court finds that the warrant issued in the Eastern District of Virginia was supported by probable cause. Agent MacFarlane, a nineteen-year FBI veteran with specialized experience in child pornography, gave the Magistrate Judge his affidavit and a warrant application. In the affidavit, Agent MacFarlane gave detailed probable cause to believe that anyone who entered Playpen was seeking to download or exchange child pornography.
The affidavit provided that for someone to access Playpen, first he or she would have to know about the dark web and download the Tor network in order to remain anonymous. Then, a user would have to find the Playpen web address, either through an existing user or via other child pornography discussion forums. The home page, as discussed above, left little to the imagination of what was behind the login page with images of two partially-clothed, prepubescent females. Thus, an innocent user would not stumble upon Playpen. Further, there were website rules on the homepage and a warning on the login page. The website rules, which appear as gibberish, were translated by Agent MacFarlane to show a preference for a compressed file type and that images were not to be reposts from other child porn websites. The warning on the login page advised users to create a fake email address and to protect their identities. After examining the totality of these circumstances, it is a fair probability to conclude that people accessing Playpen were doing so to trade and download child pornography. Therefore, the Court concludes that there was ample probable cause to support the NIT warrant.
Defendants argue that the warrant lacked particularity. To the contrary, the warrant outlined exactly the places to be searched: computers where someone logged into Playpen by entering a username and password. The warrant also contained the seven specific items to be seized:
Defendants contend that the NIT warrant allowed the FBI to search any computer. That is incorrect. The NIT warrant required that a user first log in to Playpen with a user name and password before the NIT could be deployed. In this case, logging in to Playpen serves as a sufficient trigger because of the fair probability that Playpen contained child pornography and that users who logged in would download and share such images.
Finally, the warrant was not overbroad. In particular, the likelihood was great that the identifying information to be seized would be on a Playpen user's computer.
Defendants argue that the NIT warrant was unlawful because the issuing Magistrate Judge had no authority to issue a warrant to search any activating computer located outside the judge's district. Defendants argue that because this warrant was unlawful, evidence from the NIT and subsequent warrants must be suppressed.
Federal Rule of Criminal Procedure 41(b) and § 636 of the Federal Magistrates Act concern the scope of a magistrate's authority. Section 636 incorporates Federal Rule of Criminal Procedure 41(b). Other courts have analyzed the NIT warrant regarding Rule 41(b) with varied reasoning and outcomes. This Court, however, does not see the need for a Rule 41(b) analysis for two reasons. First, Rule 41(b) has been subsequently amended.
If a search violates the Fourth Amendment, "the fruits thereof are inadmissible under the exclusionary rule, a "judicially created remedy designed to safeguard the Fourth Amendment rights generally through its deterrent effect.""
The FBI agents' reliance on the NIT warrant was objectively reasonable, and it appears that the agents acted in good faith. A neutral and detached Magistrate Judge reviewed the warrant and determined that there existed probable cause to issue the NIT warrant. The FBI did not intentionally or recklessly mislead the Magistrate Judge in obtaining the NIT warrant. As discussed, the warrant contained ample probable cause to support the issuance of the warrant. The affidavit unambiguously described the places to be searched and the items to be seized. Finally, the FBI agents showed no improper conduct or misjudgment in relying upon the NIT warrant. Thus, the
Therefore, the Court recommends that Defendants' motions to suppress evidence be denied.
Defendants raise the Due Process claim that law enforcement conduct was "so outrageous as to violate fundamental notions of fairness."
In
Defendants' claim of outrageous police conduct centers on the FBI takeover of the child pornography website Playpen. On February 20, 2017, the FBI took administrative control over Playpen for thirteen days. Before bringing the site back online, however, the FBI removed a section of the website that promoted the creation of new amateur child pornography. The FBI did not otherwise change the website— fearing it would tip off tech savvy users. The FBI did not create new child pornography. The FBI did not enhance, encourage, or contribute to the use of Playpen. The FBI waited for individuals to enter the website, navigate to a subsection, and download child pornography. In short, the FBI waited until a user clearly and by their own volition broke the law before acting. Then, the FBI employed the NIT to search an activating computer and seize the identifying information.
Defendants ask the Court to apply the reasoning in
While the FBI operating a child pornography website might be unsavory, the FBI administrative takeover of Playpen, in this case, is not outrageous government conduct. It might have been a different analysis had the FBI created new child pornography, promoted the website, or otherwise helped users with Playpen. But the FBI did none of these.
Defendants also argue that by taking over the website, the FBI continued to harm child-pornography victims, which constitutes outrageous government conduct. This is unpersuasive for four reasons. First, as outlined above, the FBI did not create a new harm to victims. Rather, the FBI took administrative control over the already existing Playpen website and waited for Playpen users to break the law. Then, the FBI would begin the process of investigation and prosecution of the lawbreakers. Again, the Court emphasizes that the FBI did not create a new harm to victims.
Second, the FBI, before and during the Playpen takeover, worked with NCMEC. The FBI supplied NCMEC with Playpen victims' photos. NCMEC would identify past victims, record new victims, and send out letters telling identified victims of the investigation. Thus, the FBI was aware of the sensitive nature of its investigation and worked with NCMEC to ensure that victims could be helped.
Third, Defendants base their claim on the protected rights of third parties— the victims. Defendants argue that
Finally, Defendants argue that the Court should weigh the interest of the FBI in its investigation versus the harm to the victims. Defendants characterize the FBI's investigation as humiliating and endangering children. Operation Pacifier involved taking administrative control over an already existing website. The FBI waited until users broke the law by creating, transmitting, or downloading child pornography. Users were free not to view, download, or exchange child pornography. While other investigatory avenues were theoretically available, the NIT method was the best way—and perhaps the only way—because it allowed a large number of users to be identified, and it would not tip off users to destroy evidence. Other theoretical methods would not have been realistically effective. As mentioned above, the FBI's investigation into Playpen has led to numerous prosecutions and has helped save over 200 children worldwide. In this case, the FBI's interest in investigating and prosecuting those using child pornography outweighs the harm, if any, to victims.
Therefore, the Court finds that the FBI's conduct was not outrageous as to Defendants or to victims. The Court recommends that Defendants' motions for dismissal for outrageous government conduct be denied.
The Court respectfully
The parties are hereby advised that, pursuant to Title 28, United States Code, Section 636(b)(1)(C), and Federal Rule of Civil Procedure 72(b)(2), written objections to the findings of fact, conclusions of law, and recommendation contained herein must be filed within fourteen (14) days of service of same. Responses to the objections must be filed within fourteen (14) days of service of the objections. Failure to file objections to this Memorandum and Recommendation with the presiding District Judge will preclude the parties from raising such objections on appeal. Thomas v. Arn, 474 U.S. 140, 140 (1985); United States v. Schronce, 727 F.2d 91, 94 (4th Cir. 1984).
