MEMORANDUM AND ORDER
INTRODUCTION
Defendant Vincent Anzalone is charged with one count of possession of child pornography in violation of 18 U.S.C. § 2252A(a)(5)(B) and one count of receipt of child pornography in violation of 18 U.S.C. § 2252A(a)(2)(A). The government also seeks forfeiture of any child pornography images in the defendant’s possession.
This case arises from an FBI investigation into users of Playpen, a child pornography website. Playpen operates on the Tor network, which enables anonymous internet browsing. In February 2015, the government acquired control of Playpen’s server. For two weeks, the government operated the website. To obtain the IP addresses of the site’s users, the government applied for and received a search warrant from a magistrate judge in the Eastern District of Virginia. The search warrant allowed the FBI to deploy a Network Investigative Technique (NIT) on users’ computers. The NIT caused users’ computers to transmit identifying information, including IP addresses, to the government. The defendant asserts the government unreasonably searched his computer by using the NIT in violation of the Fourth Amendment. Specifically, the defendant contends that the warrant lacked probable cause, that the magistrate judge in the Eastern District of Virginia did not have the authority to authorize a search in the District of Massachusetts, and that suppression is required. The defendant moves to suppress all evidence gathered by the NIT as well as all fruits of the allegedly unconstitutional search.
For the reasons set forth below, the defendant’s motion to suppress (Docket No. 47) is DENIED.
FACTUAL BACKGROUND
The following facts are undisputed unless otherwise noted. The Court has not held an evidentiary hearing. The facts are primarily drawn from FBI Special Agent Douglas Macfarlane’s affidavit in support of the February 20, 2015 search warrant application. The defendant initially requested a Franks hearing, but later withdrew that request. See Docket No. 65 at 5 n.4. The Court requested the parties to supplement the record with more information about the NIT, which the Court considered.
I. The Tor Network
Special Agent Macfarlane has worked as an FBI Special Agent for two decades. At
In his affidavit, Agent Macfarlane described the mechanics of the Tor network. The Tor network, also known as The Onion Router, is an anonymity network that masks a user’s IP address. Designed by the U.S. Naval Laboratory to protect government communications, Tor is now available to the public. To access the Tor network, a user must download, an add-on to the user’s existing browser or download the Tor browser bundle. To ensure anonymity for its users, the Tor network bounces communications through various relay computers. When a user accesses a website, the IP address of the last computer in that chain is displayed, rather than the user’s IP address. The network therefore “prevents someone attempting to monitor an Internet connection from learning what sites a user visits, prevents the sites the user visits from learning the user’s physical location, and it lets the user access sites which could otherwise be blocked.” Macfarlane Aff. ¶ 8, Docket No. 48, Ex. 2.
Within the Tor network, sites can be designed as “hidden services.” Hidden services are only accessible if the user is using the Tor network. Hidden services allow websites and other servers to hide their location. Like traditional websites, these sites “are hosted on computer servers that communicate through IP addresses.” Id. ¶ 9. Unlike such websites, however, the “IP address for the web server is hidden and instead is replaced with a Tor-based web address, which is a series of algorithm-generated characters” followed by the suffix “.onion.” Id.
II. The Playpen Website
Playpen operated as a hidden service on the Tor network. The site was only accessible via the Tor network. According to Agent Macfarlane, even then, a user was required to know the site’s address: “Tor hidden services are not indexed like websites on the traditional internet. Accordingly, unlike on the traditional internet, a user may not simply perform a Google search for the name of one of the websites on Tor to obtain and click on a link to the site.” Id. ¶ 10. To learn Playpen’s unique .onion address, a user might communicate directly with others on Tor or he might consult another site that lists links to child pornography hidden service sites. Agent Macfarlane concluded that accessing Playpen “therefore requires numerous affirmative steps by the user, making it extremely unlikely that any user could simply stumble upon [Playpen] without understanding its purpose and content.” Id.
Below the site name, the image of the two partially clothed girls, and the login fields was a textbox that read: ‘Warning! Only registered members are allowed to access this section. Please login below or ‘register an account’ with Playpen.” Id. The “register an account” text was hyper-linked to the site’s registration page. Another set of login fields appeared below this warning, asking users to enter their username, password, minutes to stay logged in, and whether they wanted to permanently remain logged in.
When a prospective user clicked the “register an account” hyperlink, the user saw a message from the forum operators. The message explained that the forum required new users to enter an email address and that the software “checks that what you enter looks approximately valid.” Id. ¶ 13. However, the forum operators encouraged users to enter fake email addresses: we “do NOT want you to enter a real address, just something that matches the xxx@yyy.zzz pattern. No confirmation will be sent. This board has been intentionally configured so that it WILL NOT SEND EMAIL, EVER.” Id. The message further cautioned new users: “For your security you should not post information here that can be used to identify you.” Id. The forum operators further emphasized the site’s focus on anonymity: “The website is not able to see your IP and can not collect or send any other form of information to your computer except what you expressly upload,” explaining that only a text file with the user’s username and password reside in the browser’s cache. Id.
The defendant and the government agree that one aspect of the homepage changed between February 18, 2015, when Agent Macfarlane last visited the Playpen site, and February 20, 2015, when Agent Macfarlane signed his affidavit and submitted the search warrant application. As of February 3, 2015, the homepage featured the two photos of the partially clothed prepubescent girls described above. Sometime after February 3, 2015, Agent Macfarlane learned that the site’s URL had changed. On February 18, 2015, he visited the Playpen site at its new URL. He confirmed that its content had not changed. However, on February 19, 2015, the logo on Playpen’s site changed. Instead of two prepubescent, partially clothed girls with their legs spread, the site featured one young girl (age unclear) wearing' a short dress and black stockings with her legs crossed. Agent Macfarlane did not know of this change when he signed the affidavit on February 20, 2015. Therefore,
After logging into Playpen with a user-name and password, visitors to the site had access to various forums, many of which contained child pornography. The table of contents included nearly fifty topics, including “pre-teen photos,” “pre-teen videos,” “jailbait photos,” “jailbait videos,” “kinky fetish,” “webcams,” and “family— incest.” Id. ¶ 14. Agent Macfarlane noted in the affidavit that “jailbait” refers to underage, but post-pubescent minors. Id. ¶ 14 n.4. He also explained that the photos and videos were denominated as “HC” or “SC/NN.” Id. ¶ 14 n.5. Agent Macfarlane stated that “HC” stands for hardcore and depicts “penetrative sexually explicit content,” “SC” stands for softcore and includes “depictions of non-penetrative sexually explicit conduct,” and “NN” stands for non-nude and depicts “subjects who are fully or partially clothed.” Id. Agent Macfarlane provided various examples of photos and videos depicting child pornography within these forum sections.
Agent Macfarlane described other features of the site that allowed for the dissemination of child pornography: a private messaging function; an image hosting feature, which allowed users to upload links to images of child pornography; a file hosting feature, which allowed users to upload videos of child pornography; and a chat feature, which allowed those logged into the chat service to view and post images of child pornography. For each of these components of the website, Agent Macfarlane identified specific examples of child pornography being posted or transmitted.
III. The Network Investigative Technique
In December 2014, a foreign law enforcement agency alerted the FBI of an IP address connected with Playpen. The FBI identified the server hosting company that owned this IP address. The FBI then obtained a search warrant and seized a copy of the server assigned to the IP address at issue. After reviewing the server copy, FBI agents determined that it contained a copy of Playpen. Further investigation revealed that Playpen’s suspected administrator lived in Naples, Florida. On February 19, 2015, the FBI executed a search warrant at the administrator’s Florida residence. As of February 19, 2015, the FBI assumed control of Playpen. The government operated the website for the following two weeks.
While operating Playpen, the government sought permission from a magistrate judge in the Eastern District of Virginia to deploy the NIT. Because Playpen resided on the Tor network, Agent Macfarlane explained in his affidavit that the NIT was necessary to identify the site’s users and administrators. Macfarlane stated that other methods typically used in criminal investigations “have been tried and have failed or reasonably appear to be unlikely to succeed if they are tried.” Id. ¶ 31.
The search warrant requested the authority to deploy the NIT at the point when a user accesses Playpen, enters a username and password, and logs into the site. Agent Macfarlane noted that, despite a request to deploy the NIT at this stage, “in order to ensure technical feasibility and avoid detection of the technique by suspects under investigation, in executing the requested warrant, the FBI may deploy the NIT more discretely against particular users,” such as those who post most often or those who visit those forum sections dedicated solely to child pornography. Id. ¶ 32 n.8.
Agent Macfarlane detailed the technical aspects of the NIT deployment. He explained that the NIT would deploy from the Eastern District of Virginia. Macfar-
The affidavit enumerated the seven categories of information that would be transmitted back to the government and would help identify Playpen users: the activating computer’s IP address, a unique identifier generated by the NIT to distinguish data from other activating computers, the type of operating system running on the activating computer, information about whether the NIT had previously been delivered to the activating computer, the activating computer’s Host Name,
On February 20, 2015, Magistrate Judge Theresa Carroll Buchanan granted the NIT warrant. The next day, the defendant visited Playpen and the NIT was deployed. According to the government, the defendant was actively logged into Playpen for twelve hours, one minute, and twenty-four seconds during the two weeks the government controlled the site.
On October 20, 2015, Magistrate Judge Judith Dein of the District of Massachusetts issued a search warrant of the defendant’s residence. Members of the FBI Child Exploitation Task Force executed the warrant on October 21, 2015. Inside the residence and after the defendant waived his Miranda rights, law enforcement agents recorded an interview with him. During the interview, the defendant allegedly admitted to possessing child pornography, stating that he downloaded it three to four times a week for five or six years. He purportedly estimated that he had between 50 and 100 gigabits of child pornography on his computer.
IV. Procedural Background
On November 12, 2015, the defendant was indicted on one count of possession of child pornography in violation of 18 U.S.C. § 2252A(a)(5)(B) and one count of receipt of child pornography in violation of 18 U.S.C. § 2252A(a)(2)(A). On May 13, 2016, the defendant moved to suppress the evidence gathered by the NIT and all fruits of this search, including the evidence gathered during the subsequent search of the defendant’s home.
I. Reasonable Expectation of Privacy
The government contends that the “most critical piece of information obtained by the NIT warrant—Defendant’s IP address—is information that ordinarily would have been publicly available over which the defendant cannot claim a reasonable expectation of privacy.” Docket No. 58 at 30. The defendant responds that the NIT gathered more than the IP address and that the defendant had a reasonable expectation of privacy in the contents of his personal computer.
The Fourth Amendment provides that the “right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated.” U.S. Const. Amend. IV. “Intrusions upon personal privacy do not invariably implicate the Fourth Amendment. Rather, such intrusions cross the constitutional line only if the challenged conduct infringes upon some reasonable expectation of privacy.” Vega-Rodriguez v. P.R. Tel. Co.,
The NIT caused a user’s computer to transmit to the government seven pieces of information, including the user’s IP address. The government also collected information about a user’s activities on Playpen—such as the particular pages visited and the amount of time logged into the site—and matched that data to the user’s IP address. Some courts have found that an individual lacks a reasonable expectation of privacy in one’s IP address. See, e.g., United States v. Caira, No. 14-1003,
A number of district courts have found that law enforcement therefore did not require a search warrant before deploying the NIT. See United States v. Acevedo-Lemus, No. SACR 15-00137-CJC,
Other district courts have cautioned against the narrow scope of this inquiry, asking “whether the IP address should be the focus of this analysis or whether Defendant’s expectation of privacy in his computer is the proper subject of this analysis.” United States v. Adams, No. 6:16-CR-11-ORL-40GJK,
The Court finds that the defendant had a reasonable expectation of privacy in his personal computer and that the government’s use of the NIT constituted a Fourth Amendment search. While the most critical piece of information obtained by the NIT warrant may have been the IP address, the NIT afforded the government access to six other pieces of identifying information that were not readily available to law enforcement, as well as the ability to pair a user’s actions on Playpen with the user’s IP address. Even if the defendant did not have a reasonable expectation of privacy in these discrete pieces of information, he did have a reasonable expectation of privacy in the computer that housed this data and that was instructed by the NIT to transmit the data back to the government.
II. Probable Cause
The defendant argues that the site’s illegal purpose was not readily apparent from the homepage as described in the affidavit and that a visitor could log into the site unaware of its content. The government retorts that users had to take a number of affirmative steps to access the site, that the homepage alerted users that the site contained illicit material, and that the registration process further signaled the unlawful nature of the site.
“A warrant application must demonstrate probable cause to believe that (1) a crime has been committed—the ‘commission’ element, and (2) enumerated evidence of the offense will be found at the place to be searched—the so-called ‘nexus” element.’ ” United States v. Feliz,
“A magistrate’s ‘determination of probable cause should be paid great deference by reviewing courts.’ ” Gates,
Agent Macfarlane’s affidavit establishes a fair probability that an individual who downloaded a Tor browser, located
The defendant maintains that, even if the affidavit as presented to the magistrate judge established probable cause for the NIT, the magistrate judge would have ruled differently if she had been presented with an accurate description of the Playpen homepage. Specifically, the defendant emphasizes that the homepage depicted a single image of a scantily clad girl with her legs crossed, as opposed to two partially clothed prepubescent girls with their legs spread apart. Initially, the defendant requested a Franks hearing on these misstatements. Docket No. 48 at 24. Because the government concedes that the images on the website changed in the two days prior to Agent Macfarlane submitting the search warrant application, the defendant no longer seeks a Franks hearing. See Docket No. 65 at 5 n.4. However, the defendant continues to assert that the affidavit should be reformed to account for the incorrect description of the site’s appearance and that probable cause should be assessed with respect to the reformed affidavit. See Docket No. 65 at 5.
The defendant has not proven that the affiant knowingly or recklessly included the incorrect description of the homepage. As other district courts have noted, Agent Macfarlane visited the website two days prior to submitting the warrant application and he verified that the site appeared as described in his affidavit. Macfarlane was not reckless in failing to check the site again in the hours prior to presenting the application to the magistrate judge. See Matish,
Nor has the defendant demonstrated that probable cause would have been lacking had the affidavit described the site as it appeared on February 20, 2015. See Matish,
III. Particularity
The defendant argues that the search warrant was a general warrant and that it was insufficiently particular. The government responds that the search warrant amply described both the places to be searched and the items to be seized.
“We begin with the basic proposition that the Warrant Clause of the Fourth Amendment prohibits the issuance of a warrant, except one ‘particularly describing the place to be searched, and the persons or things to be seized.’ ” United States v. Tiem Trinh,
Every court to consider this question has found the NIT search warrant sufficiently particular. See Acevedo-Lemus,
IV. Anticipatory Warrant
The defendant contends that the warrant was an anticipatory warrant in which the triggering event did not occur. The defendant defines the triggering event as accessing the Playpen website as it was described in the affidavit, with the images of two partially clothed girls. The government counters that the triggering event was simply the act of logging into the site.
For “a conditioned anticipatory warrant to comply with the Fourth Amendment’s requirement of probable cause, two prerequisites of probability must be satisfied.” United States v. Grubbs,
The Court concludes that “logging into Playpen—which the warrant application identified by its URL—represents the relevant triggering event.” Matish,
Y. Rule 41(b)
The defendant urges the Court to find that, even if there was probable cause for the NIT search warrant, the magistrate judge in the Eastern District of Virginia lacked authority under Rule 41(b) to issue it. The government responds that the magistrate judge had the power to issue the warrant under subsections (b)(1), (b)(2), and (b)(4).
Federal Rule of Criminal Procedure 41(b) states in relevant part:
At the request of a federal law enforcement officer or an attorney for the government:
(1) a magistrate judge with authority in the district—or if none is reasonably available, a judge of a state court of record in the district—has authority to issue a warrant to search for and seize a person or property located within the district;
(2) a magistrate judge with authority in the district has authority to issue a warrant for a person or property outside the district if the person or property is located within the district when the warrant is issued but might move or be moved outside the district before the warrant is executed;
[[Image here]]
(4) a magistrate judge with authority in the district has authority to issue a warrant to install within the district a tracking device; the warrant may authorize use of the device to track the movement of a person or property located within the district, outside the district, or both;
Fed. R. Crim. P. 41(b)(1)—(2), (4).
Rule 41(b)(1) is inapposite. The defendant’s computer was not in the Eastern District of Virginia, where the magistrate judge issued the warrant. Rule 41(b)(2) does not apply either because the defendant and his property were not within the district when the warrant was issued.
Rule 41(b)(4) presents a closer call. See Henderson,
However, other courts have found the NIT warrant does not satisfy Rule 41(b)(4). See Henderson,
Because the NIT relays more than just the location of a user’s computer, the Court concludes the NIT is probably not a tracking device within the meaning of Rule 41(b)(4), but it is certainly similar to a tracking device. Because this is such a close call, the Court ultimately concludes that the good faith exception applies even if issuance of the search warrant did not comply with Rule 41(b).
VI. Good Faith Exception
As a preliminary matter, the First Circuit has not decided whether a failure to comply with Rule 41(b) is a ministerial, technical violation—as the government argues—or if it rises to the level of a constitutional violation—as the defendant claims.
If the violation is merely technical, suppression is not warranted unless the defendant can demonstrate prejudice. United States v. Burgos-Montes,
Most courts have found that, even if the magistrate judge violated Rule 41(b) in issuing the NIT warrant, there was no constitutional infirmity. See Henderson,
As explained above, the Court finds that there was probable cause to issue this warrant and that the warrant was sufficiently particular. There was no Fourth Amendment violation here and suppression is not warranted. Even if Rule 41(b) was violated and even if that violation was of the constitutional variety, the Court concludes that the good faith exception would apply. See United States v. Leon,
“The exclusionary rule should be limited to those situations where its remedial objectives are best served, i.e., to deter illegal police conduct, not mistakes by judges and magistrates.” Burgos-Montes,
The Court has already found that it is a close call whether this warrant complied with Rule 41(b). See also Michaud,
The defendant contends that exclusion is warranted because the warrant here was void ab initio, arguing that Leon’s good faith exception only applies to a “subsequently invalidated” search warrant. See Leon,
The Court holds that the warrant here was not void ab initio. See Adams,
ORDER
The defendant’s motion to suppress (Docket No. 47) is DENIED.
Notes
. The defendant counters that Tor search engines do exist and that even hidden service sites are indexed: "All a user need do is enter search terms for sexually oriented sites, chat rooms, or a host of other content not related to child pornography to find sites like Playpen.” Docket No. 48 at 22. The defendant cites ahmia.fi as an example of a Tor search engine. However, Playpen and other child pornography websites are banned by ahmia.fi. See Hidden Service Blacklist—Ahmia, https:// ahmia.fi/blacklist (last visited Aug. 31, 2016) ("Ahmia blacklists sites containing child abuse material from its index.”); Ahmia
. "A Host Name is a name assigned to a device connected to a computer network that is used to identify that device in various forms of electronic communication, such as communications over the Internet.” Macfarlane Aff. ¶ 34, Docket No. 48, Ex. 2.
. A MAC address is a unique identifying number assigned to a network adapter, which is equipment that connects a computer to a network. The MAC address does not change and is intended to be unique. Id.
. In supplemental briefing, the government informed the Court that, despite what the warrant authorized, the FBI did not deploy the NIT in this case until the defendant accessed a forum section that explicitly referenced the child pornography content therein. Docket No. 70 at 1-2. The defendant responds that the probable cause inquiry focuses on what the warrant permitted, not when the officers chose to deploy the NIT. Docket No. 74 at 1. Because the Court finds that there was probable cause to deploy the NIT when a user logged into Playpen, the Court need not address how, if at all, the timing of the NIT deployment in this particular case affects the probable cause analysis.