OPINION AND ORDER DENYING MOTION TO SUPPRESS
On February 20, 2015, a federal magistrate judge in the Eastern District of Virginia signed a warrant authorizing a FBI hacking operation designed to infiltrate a suspected . child pornography website, named “Playpen.”
I.
A.
The following information is primarily drawn from the affidavits in support of the two applications for a search warrant. The “target website” which the FBI hacked was operated on the so-called “dark web.” The dark web is accessed by using certain software (Tor routing software) which routes communications through a series of computers' and thus masks the user’s IP address. The Tor software prevents websites from learning the user’s physical location and prevents individuals attempting to' monitor the user’s internet usage from determining which sites have been visited. When, as was the case for Playpen, a website can be accessed only by users which are using Tor Software, it is considered part of the dark web. Further, the dark web is not indexed like the traditional internet. Accordingly, a Tor user could not simply use a search engine to discover and access Playpen.
According to the FBI’s affidavit, Playpen “was a child pornography bulletin board and website dedicated to the advertisement and distribution of child pornography and the discussion bf matters pertinent to the sexual abuse of children.” FBI Aff. at 12, ECF No. 21, Ex. A. Playpen became abtive in approximately August 2014. As of March 4, 2015, 117,773 posts had been made by 21-4, 898 total members on Playpen. Between September 2014 and February 19, 2015, the front page of Playpen included an image of two scantily clothed girls. Both girls were posed salaciously and appeared to be prepubescent. The image also included the website’s title and the following text: “No cross-board reposts, .7z preferred, encrypt filenames, include preview.” Gov. Resp., ECF No. 27, Ex. 1. According to the FBI Agent who prepared the affidavit: “Based on my training and experience, I know that: ‘no cross-board reposts’ refers to a prohibition against material that is posted on other websites from being ‘re-posted’ to [Playpen]; and ‘.7z’ refers to a preferred method of compressing large files or sets of files for distribution.” FBI Aff. at 13.
On February 19, 2015, the image on the front page was changed. The new image depicted one girl with no visible breast development. The girl was pictured wearing a short dress which exposed her upper thighs and thigh-high fishnet stockings. She was posed in a chair in a sexually suggestive manner. The new image also included instructions which forbade cross-posts, indicated a preference for .7z, and directed users to encrypt the file names and include a preview.
Only registered users were allowed to enter Playpen. The front page included a' hyperlink to the registration page. On that account registration page, users were directed to enter an “email address,” but the page expressly instructed users to enter a fake email address." Users were also instructed that “ ‘for your security you should not post information here that can be used to identify you.’ ” Id. The registration page included further instructions regarding best practices for hiding the user’s identity.
B.
In December 2014, a. foreign law enforcement agency informed the FBI that it suspected the target website’s originating IP address was based in the United States. After further investigation, the FBI located the server hosting the target website, in North Carolina, and the residence of the website’s administrator, located in Florida. The FBI seized.the server, transported it to a government facility in Virginia, and assumed administrative control of Playpen. Rather than closing the website, the FBI chose to briefly operate Playpen in order to identify users of the website. Despite the FBI’s control over Playpen, the Tor software through which members accessed the site prevented the FBI from obtaining identifying information from the users.
To overcome the anonymity granted by the Tor software, the FBI sought a warrant authorizing a “Network Investigative Technique” (“NIT”). That technique works as follows: Typically, users view a web-page by communicating' with the website. The user’s computer requests access to a certain webpage, and the website then sends content to the user’s computer. The user’s computer receives that information and uses it to display the webpage. The NIT augments the instructions sent by the webpage and causes the user’s computer to transmit identifying information from that computer, including the computer’s IP address, operating system, operating system username,, and network adapter address-. -
A United States Magistrate Judge for the Eastern District of Virginia approved the FBI’s search and seizure warrant, thus authorizing usé’of the NIT. After the FBI implemented the NIT, Defendant Kahler’s computer made two postings on the target website on two different days. Based on the information the NIT revealed, the FBI sought and obtained a warrant to search Kahler’s residence and computer. Pornographic images of minors were seized during the search. After that search, Kahler was charged with possessing prepubescent child pornography. This motion to suppress followed.
II.
The Fourth Amendment provides:
The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue; but upon probable cause, supported by Oath or affirmation, and particularly describing the place tobe searched, and the persons or things to be seized.
U.S. Const. amend. IV.
Generally speaking, the requirement that searches be reasonable means law enforcement officials must obtain a judicially approved warrant beforehand. Riley v. California, — U.S. -,
Even if the defendant shows that the F.óurth Amendment was isolated, “suppression is not an automatic consequence.” Herring v. United States,
III.
Kahler argues that the warrant approved by the Magistrate Judge for the Eastern District of Virginia exceeded -the court’s territorial jurisdiction of the court, as provided in Federal Rule of Criminal Procedure 41(b). Kahler further argues that the warrant violated the Fourth Amendment’s particularity requirement. Third, Kahler argues that the -FBI agent who wrote the affidavit supporting the warrant purposely included materially misleading or incorrect information. Finally,, Kahler argues that suppression is the appropriate remedy.
A.
Rule 41(b) provides guidelines for determining the proper venue for á warrant application.
(1)' a magistrate judge with authority in the district — or if none, is reasonablyavailable, a judge of a state court of record in the district — has authority to issue a warrant to search for and seize a person or property located within the district;
(2) a magistrate judge with authority in the district has authority to issue a warrant for a person or property .outside the district if the person or property is located within the district when the warrant is issued but might move or be moved outside the district before the warrant is executed;
[[Image here]]
(4) -a magistrate judge with authority in the district has authority to issue a warrant to install within the district a tracking device; the warrant may authorize use of the device to track the movement of a person or property located within the district, outside the district, or both;
Id. at Rule 41(b)(1), (2), and (4).
The FBI’s hack of Playpen has resulted in at least dozens of prosecutions across the county. The warrant authorizing the NIT has, been challenged repeatedly, with courts adopting essentially one of three outcomes. Most federal courts to review the NIT warrant have concluded that it was likely not properly issued pursuant to Rule 41, but that suppression was inappropriate because of the circumstances of the investigation and warrant request.
The legal issues presented by this motion to suppress are difficult to resolve precisely because the technology deployed by child pornography criminals to obscure their behavior and the law enforcement investigative tactic's developed to enforce the law were not contemplated when Rule 41 was drafted. The rule, focused on the geographic location of physical documents and objects, was not crafted for a world with Tor-routing software, technologically sophisticated websites designed to shield the distribution of child-pornography from law enforcement, and the resulting need to use complex hacking procedures to discover and identify the perpetrators of online crimes.
Properly stated, the question here is whether the FBI’s NIT warrant so exceeded the limits of the magistrate judge’s jurisdiction and authority or reasonable behavior by law enforcement as to require suppression to deter similar actions in the future. Although the NIT warrant exceeded the scope of Rule 41(b) as it existed at the time, the FBI’s actions in investigating and closing Playpen were reasonable and directed toward securing the judicial review of law enforcement which the Fourth Amendment contemplates. Given the circumstances, suppression is not appropriate.
1.
None of the three bases in Rule 41(b) provided jurisdiction for the magistrate judge to approve the warrant. Rule 41(b)(1) cannot serve as the basis for jurisdiction. Under that provision, a magistrate judge can issue a warrant to seize property “located in the district.” Here, the server housing Playpen had been transported to Virginia by the FBI, but the NIT involved the transmission of information from that server to computers located around the country and then back to the server. The relevant information (or “property”
Likewise, Rule 41(b)(2) is an insufficient. basis for jurisdiction. The Government attempts to argue that.the NIT was initiated only when a user attempted to access Playpen (and thus electronically “entered” Virginia). For substantially the same reasons Rule 41(b)(1) does not apply, Rule 41(b)(2) does not. This is not a scenario where the property sought by the
Rule 41(b)(4) comes closest to providing a- jurisdictional basis for the warrant. Indeed, courts which have found that the NIT warrant complied with Rule 41 typically rest their analysis on subsection (b)(4). That section allows a magistrate judge to authorize use of a tracking device, if installed -within the district, to track property outside the district. A “tracking device” is defined as “an electronic or mechanical device which permits the tracking of the movement of a person or object.” 18 U.S.C. § 3117(b). There is a reasonable argument that the language of Rule 41(b)(4) should be read to encompass NIT software like the FBI used here. The NIT was “installed” on the Playpen server and then retrieved information from computers which .accessed that server. Further, the NIT does not actually “install” a program on the user’s computer (in the sense that nothing was left behind on the computer after the NIT finished), it simply requests and receives information. For several reasons, however, this interpretation of Rule 41(b)(4) goes too far. To begin with, the NIT provided law enforcement with more than just location information. As described above, the NIT requested the computer’s IP address, operating system, operating system username, and network adapter address. The Government admits that the “network information was not itself location information.” Gov’t Resp. Br. at 11, ECF No. 27. The receipt of the username associated with the computer’s operating system goes beyond simple location data to descriptive data regarding the identity of the user. The NIT is more than just a “tracking device”; it is a surveillance device.
Additionally, the entire purpose of the NIT was to interact with a computer and obtain information that was located in another district. Even though the NIT was nominally installed on the Playpen Server, the NIT’s “tracking” functionality occurred in other districts. Finally, the purpose of the NIT was to discover the location of the users accessing Playpen, not track their movement. The plain language of Rule 41(b)(4) most clearly applies to situations where the property to be tracked has been located (and is within the district), but law enforcement wishes to track its movement. In contrast, the “property” sought here had not been located and the FBI knew that it was not, at least for the most part, within the district. This distinction between discovering the location of an internet user and tracking movement of property illustrates the unsuitability of Rule 41, as it existed at the time of
2.
The Government argues that, even if the NIT warrant exceeded the scope of Rule 41(b), the magistrate judge possessed inherent power to issue the search warrant. District judges do. have inherent power to issue warrants consistent with the Fourth Amendment. See United States v. Torres,
3.
The Government alternatively argues that, even if the warrant could not have been properly issued under Rule 41(b), the NIT search could have been conducted without a warrant. In making this’ argument, the Government relies on the consensus among the Federal Courts of Appeal that there is no constitutionally recognizable privacy interest in an IP address. See e.g., United States v. Carpenter,
The Government argues that, despite using a software which exists only to veil the user’s IP address from prying eyes, the user has no reasonable privacy interest in his or her IP address. This argument has little to recommend it. If a user who has taken special precautions to hide his IP' address does not suffer a Fourth Amendment violation when a law enforcement officer compels his computer to disclose the IP address, the operating system, the operating system username, and other identifying information, then it is difficult to imagine any kind of online activity which is protected by the Fourth Amendment. Internet use pervades modern life. Law enforcement, acting alone, may not coerce the computers of internet users into revealing identifying information without a warrant,- at least when the user has taken affirmative steps to ensure that third parties do not have that information. See generally Riley v. California, — U.S. -,
4.
Kahler also argues that the NIT warrant did not satisfy the Fourth Amendment’s particularity requirement. Because resolution of the issue may impact the analysis of whether suppression is-.justified, this argument will be briefly addressed. The Fourth Amendment specifies that warrants must particularly describe the place to be-searched. This requirement is .meant to prevent “ ‘general searches by requiring a neutral judicial officer to cabin the scope of the search to those areas and items for which there exists probable cause that a crime has been committed.’" United States v. Richards,
According to Kahler, the warrant application was impermissibly broad because it “failed to explain how the government planned to avoid searching the activities of innocent computer users.” Mot. Supp. at 19, ECF No. 21.
B.
Although Rule 41(b) did not provide express authorization for the warrant, the suppression remedy has no place here. In United States v. Master, the Sixth Circuit held that the good faith exception can apply even when a warrant is void ab initio because it was issued by a judge who lacked jurisdiction.
Despite the novelty of the FBI’s investigative techniques here, their conduct does not justify suppression. Kahler argues that the FBI should have known that the NIT warrant exceeded the jurisdictional scope allowed by Rule 41(b). That is an arguable point. As discussed above, some federal courts have held that Rule 41(b)(4) does authorize the warrant at issue here. Under the best interpretation of Rule 41(b)(4), the NIT warrant was improperly issued. But the very fact that some federal courts have concluded the opposite indicates that law enforcement could have reasonably believed that the NIT warrant was properly issued. The FBI should not be faulted for failing to correctly predict the outcome of an intricate, disputed question of federal jurisdiction.
Even more importantly, this is not a case where the FBI purposely avoided compliance with the law. The investigation of Playpen was difficult precisely because the FBI had so little information about the location of the users. If the FBI had known where certain users were located but nevertheless chose to seek a warrant in another district, suppression would be appropriate. In that case, the FBI would have purposely skirted the law despite a legal alternative. Kahler’s arguments, if accepted, would imply that the FBI should not have conducted the NIT investigation at all because the users were masking their true location. The FBI’s decision to adopt novel tactics to bring individuals distributing child pornography behind location-concealing software to justice is not inherently troubling behavior.
To be sure, the FBI’s best intentions in conducting the NIT cannot substitute for a lawful warrant. But this is not a case where law enforcement opted for illegal investigative methods over legal methods. Rather, the technical investigative tools available to the FBI have advanced to the point where they, at times, defy categorization by courts. The FBI sought and received approval of the investigative tech-
C.
Kahler separately argues that he is entitled to relief pursuant to Franks v. Delaware,
Kahler does not specifically request a Franks hearing, and he has not met his burden of demonstrating entitlement to a hearing regardless. Most of Kahler’s arguments here fall far short of making a “substantial preliminary showing” of deliberate falsehoods or even reckless disregard for the truth. The Government’s refusal to disclose the details of the code used in the NIT, the locations of the computers that the NIT would target, and other information about the exact procedures used by the NIT do not constitute falsehoods. The FBI’s attempt to summarize the technical details of the operation in layman’s terms is reasonable. Likewise, the FBI cannot be faulted for not disclosing the locations of the computers the NIT would target, considering the purpose of the NIT was to identify those locations.
Only three of Kahler’s arguments that a Franks violation occurred merit further discussion. First, Kahler argues that the NIT warrant did not disclose the fact that the image on the front page of Playpen changed on February 19, 2015, just before the affidavit was submitted. However, the differences between the two images were largely irrelevant for purposes of assessing probable cause. Both depicted young girls wearing sexually provocative clothing and posed suggestively. There was probable cause to believe that users who logged into Playpen were seeking child pornography even without considering the front page images, and both images supported that conclusion. Thus, the FBI’s failure to indicate that the front page image had recently changed on its affidavit for the warrant was not a material omission.
Kahler also argues that the FBI improperly described Playpen as being dedicated only to child pornography. In fact, Kahler argues, it also included erotic fiction subforums and a chat messaging system. However, the warrant indicated that the chat system was used to relive
Finally, Kahler argues that, contrary to the representations in the warrant, several dark web search engines exist and Playpen could have been accessed by them. Kahler contends that these search engines exist, but does not corroborate his assertion that Playpen was specifically accessible through such a search engine. Even assuming that to be the case, however, accessing Playpen still required a number of affirmative steps — including downloading the Tor software, viewing the homepage, and registering an account— which are indicative, of a person seeking child pornography. Even taking Kahler’s largely unproven assertions as true, they were.not material to the probable causé finding., Kahler has not demonstrated entitlement to a Franks hearing.
IV.
Accordingly, it is ORDERED that Defendant Kahler’s motion to suppress, EOF No. 21, is DENIED.
Notes
. The website is no longer active and the details of the hack have been reported on by the media. Accordingly, directly identifying the website poses minimal threat to ongoing investigations.
. As discussed below, Kahler disputes this point, but has not sufficiently corroborated this assertion to justify holding a hearing. Even if this assertion in the warrant were not true, the motion to suppress the warrant would still be denied.
. The Federal Magistrates Act gives magistrate judges "all powers and duties conferred or imposed ... by the Rules of Criminal Procedure for the United States District Courts." 28 U.S.C. § 636(a)(1).
. After the FBI’s seizure of the target website occurred, Rule 41(b) was amended to expressly address situations like the one the FBI faced here. Rule 41(b)(6) reads as follows:
(6) a magistrate judge with authority in any district where activities related to a crime may have occurred has authority to issue a warrant to use remote access to search electronic storage media and to seize or copy electronically stored information located within or outside that district if:
(A) the district where the media or information is located has been concealed through technological means; or
(B) in an investigation of a violation of 18 U.S.C. § 1030(a)(5), the media are protected computers that have been damaged without authorization and are located in five or more districts.
Id.
. See United States v. Kneitel, No. 16-cr-23-MSS-JSS (M.D. Fl. Jan. 3, 2017); United States v. Tran, No. 16-cr-10010,
. See United States v. McLamb, No. 16-cr-092,
. See United States v. Levin,
. Rule 41(a)(2)(A) defines "property” to include "tangible objects” and "information.”
. Kahler does not specifically argue that the scope of the warrant or the explanation of how the NIT would work was unconstitutionally vague. Even if he had, the Warrant affidavit sufficiently described how the NIT worked for the magistrate judge to make an informed decision about whether the scope of. the warrant corresponded to the degree of probable cause that wrongdoing was occurring.