935 F.3d 337
5th Cir.2019Background
- In 2015 the FBI seized a U.S.-based server hosting the TOR hidden-site "PlayPen," then operated the site for 13 days and deployed a Network Investigative Technique (NIT) malware to identify users.
- The NIT returned identifying data tying user "notsoslow" to an IP at Pawlak’s Texas residence and to a computer named "Sigma94" with username "d.pawlak."
- FBI executed a warrant at Pawlak’s home; recorded calls captured Pawlak admitting long‑term viewing of child pornography, use of the "notsoslow" account, and that he had used a computer named Sigma94.
- Forensics of the Sigma94 machine and a work computer (Independence Oil) recovered numerous child‑pornography images and thumbnails in browser cache; agents also found evidence he attempted to download wipe software during the search.
- Pawlak was indicted for (1) receipt of child pornography, 18 U.S.C. § 2252A(a)(2)(A), and (2) access with intent to view child pornography involving a prepubescent minor, 18 U.S.C. § 2252A(a)(5)(B).
- District court denied motions to dismiss (outrageous government conduct) and to suppress (NIT warrant); jury convicted on both counts; court applied a two‑level U.S.S.G. § 3C1.1 obstruction enhancement; sentence 210 months concurrent.
Issues
| Issue | Pawlak's Argument | Government's Argument | Held |
|---|---|---|---|
| Motion to dismiss for outrageous government conduct | Pawlak: FBI’s operation of PlayPen and distribution of images was overinvolved; he was a passive user so due‑process dismissal warranted | Gov: Pawlak was an active, predisposed consumer; undercover operations are legitimate and conduct here was limited and time‑bounded | Court: Denied. Pawlak was an active participant; government conduct not "outrageous" under Fifth Amendment (abduction of rarest circumstances standard) |
| Motion to suppress NIT‑derived evidence (Rule 41/Leon good‑faith) | Pawlak: Officers knew or should have known Rule 41 prohibited multi‑district malware searches; reliance on the warrant was not objectively reasonable | Gov: Officers acted in objectively reasonable good faith; multiple courts have upheld similar NIT warrants; legal question was close | Court: Denied. Good‑faith exception applies; officers reasonably relied on the magistrate’s warrant (Ganzer controlling) |
| Sufficiency of evidence — Count Two (access with intent to view prepubescent images) | Pawlak: No proof images depicted real children (could be virtual/morphed) | Gov: Images and agent testimony sufficed to show they depicted real prepubescent children; jury could draw that inference | Court: Affirmed. Evidence (images + testimony) sufficient to prove images were of real children |
| Sufficiency of evidence — Count One (receipt) | Pawlak: Thumbnails found in cache do not show who downloaded them or when; other users had access to Sigma94 | Gov: Presence in cache proves receipt; Pawlak’s admissions and forensic links to Sigma94 corroborate knowing receipt | Court: Affirmed. Cache files plus admissions and forensic evidence suffice to infer knowing receipt |
| Application of U.S.S.G. § 3C1.1 obstruction enhancement | Pawlak: Attempting (but failing) to wipe drive contemporaneous with arrest is not a qualifying obstruction | Gov: Pawlak downloaded/installed wipe software after learning of the search—attempted destruction of material evidence—qualifies under § 3C1.1 | Court: Affirmed. Attempt to obtain/deploy wiping software shortly after agents arrived satisfied obstruction (attempt and not contemporaneous with arrest) |
Key Cases Cited
- United States v. Ganzer, 922 F.3d 579 (5th Cir. 2019) (applied good‑faith exception to NIT warrant challenges)
- United States v. Sandlin, 589 F.3d 749 (5th Cir. 2009) (outrageous‑conduct defense standard)
- United States v. Arteaga, 807 F.2d 424 (5th Cir. 1986) (defendant must be passive to invoke outrageous‑conduct defense)
- United States v. Fortna, 796 F.2d 724 (5th Cir. 1986) (evaluate undercover tactics in context of law enforcement needs)
- United States v. Tobias, 662 F.2d 381 (5th Cir. 1981) (limits of permissible government infiltration; defendant’s predisposition relevant)
- Herring v. United States, 555 U.S. 135 (2009) (exclusionary rule and good‑faith limitations)
- United States v. Leon, 468 U.S. 897 (1984) (good‑faith exception to the exclusionary rule)
- United States v. Cherna, 184 F.3d 403 (5th Cir. 1999) (two‑step review for warrant‑based suppression challenges)
- United States v. Contreras, 905 F.3d 853 (5th Cir. 2018) (standard of review for suppression denials)
- United States v. McNealy, 625 F.3d 858 (5th Cir. 2010) (images themselves may suffice to show they depict real children)
- United States v. Winkler, 639 F.3d 692 (5th Cir. 2011) (files in cache can prove receipt of images)