Petition for Writ of Certiorari — Vincent Anzalone, Petitioner v. United States
Supreme Court briefJul 23, 2019
Ask Donna
What actually matters in this document.
Text
INDEX TO THE APPENDIX
Appendix A - Opinion-United States Court of Appeals for the First Circuit
(April 24, 2019) ........................................................................................... la
Appendix B - Memorandum and Order-United States District Court
for the District of Massachusetts
(September 22, 2016) ................................................................................. 13a
Appendix C - Federal Rules of Criminal Procedure, Rule 41.. ........................... .45a
Appendix D -Federal Magistrates Act (codified at 28 U.S.C. § 636) .................... 55a
Appendix E - Fourth Amendment to the United States Constitution .................. 60a
Case: 17-1454
Document: 00117430893
Page: 1
Date Filed: 04/24/2019
Entry ID: 6249302
United States Court of Appeals
For the First Circuit
No. 17-1454
UNITED STATES OF AMERICA,
Appellee,
v.
VINCENT ANZALONE,
Defendant, Appellant.
APPEAL FROM THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF MASSACHUSETTS
[Hon. Patti B. Saris, U.S. District Judge]
Before
Torruella, Selya, and Barron,
Circuit Judges.
Zainabu Rumala, Assistant Federal Public Defender, Federal
Public Defender Office, was on brief, for appellant.
Randall E. Kromm, Assistant United States Attorney, with whom
Andrew E. Lelling, United States Attorney, was on brief, for
appellee.
April 24, 2019
APPENDIX A
001a
Case: 17-1454
Document: 00117430893
Page: 2
Date Filed: 04/24/2019
TORRUELLA, Circuit Judge.
Entry ID: 6249302
This case is one of many
arising nationwide from the 2015 FBI investigation into Playpen,
an online forum hosted in the Tor Network that allowed users to
upload, download, and distribute child pornography.
Through that
investigation, defendant-appellant Vincent Anzalone ("Anzalone")
was identified as a Playpen user and indicted for possession and
receipt
of
child
pornography.
Anzalone
thereafter
moved
to
suppress all evidence obtained pursuant to a Network Investigative
Technique
("NIT")
warrant
and
to
outrageous government conduct.
dismiss
his
indictment
for
The district court denied both
requests, which Anzalone asks us to reconsider on appeal, and we
now affirm.
I.
Those interested in the particulars of the FBI's Playpen
sting should refer to our opinion in United States v. Levin, 874
F.3d 316, 319-21 (1st Cir. 2017), which was the first case to come
before
this
court
in
relation
to
this
investigation.
The
background that follows thus only focuses on the facts most
pertinent to Anzalone's case.
On the evening of February 19, 2015, the FBI assumed
control of Playpen and decided to maintain the website live for
two weeks to identify and apprehend its users.
On February 20,
the government obtained a warrant from a magistrate judge in the
-2APPENDIX A
002a
Case: 17-1454
Document: 00117430893
Page: 3
Date Filed: 04/24/2019
Entry ID: 6249302
Eastern District of Virginia authorizing it to deploy the NIT.
Id. at 320.
A meticulous 31-page affidavit accompanied the FBI's
application for this warrant.
The affidavit's statement of facts
in support of probable cause described, among other things, the
purpose of Playpen, the Tor Network and its hidden services, the
difficulty
of
coming
across
Playpen
without
seeking
out
its
content, and the appearance of Playpen's homepage on February 18,
2015 -- two days before the FBI applied for the NIT warrant.
With
regards to Playpen's homepage, the affidavit averred that the page
showed
"two
images
depicting
females
with
their
legs
partially
clothed
apart." 1
The
spread
prepubescent
affidavit
also
explained that Playpen counseled its visitors not to use their
real email addresses to register with the website.
Technicalities
aside,
the
NIT
allowed
the
FBI
to
identify Playpen users when they entered their credentials to
access
the
website.
Id.
The
NIT
eventually
identification of Anzalone as a Playpen user.
led
to
the
During the two
weeks that the government ran Playpen, Anzalone was logged into
the website for twelve hours.
On October 21, 2015, the FBI
executed a search warrant of Anzalone's residence.
Anzalone
These images, however, were switched out by Playpen's
administrator before the government took over the site on February
19 and changed for the image of just one female, sitting crosslegged in a dress and stockings.
1
-3APPENDIX A
003a
Case: 17-1454
Document: 00117430893
Page: 4
Date Filed: 04/24/2019
Entry ID: 6249302
waived his Miranda rights and, in an interview at his home with
the FBI Child Exploitation Task Force agents who executed the
warrant,
admitted
to
possessing
child
pornography
and
to
downloading it multiple times a week for five or six years.
On November 12, 2015, Anzalone was indicted with one
count
of
possession
of
child
pornography
under
18
U.S.C.
§ 2252A(a)(5)(B) and one count of receipt of child pornography
under 18 U.S.C. § 2252A(a)(2)(A).
Anzalone then moved to suppress
all the evidence resulting from the NIT warrant, arguing that the
warrant:
(1)
was
not
rooted
in
probable
cause;
(2)
lacked
particularity; (3) was supported by a misleading affidavit; and
(4)
was
issued
in
excess
territorial jurisdiction.
of
the
magistrate
judge's
limited
Anzalone also sought to dismiss the
indictment alleging that the government engaged in outrageous
conduct by running Playpen for two weeks after seizing its control.
The district court denied these two motions, see United States v.
Anzalone, 221 F. Supp. 3d 189 (D. Mass. 2016) (denying the motion
to dismiss); United States v. Anzalone, 208 F. Supp. 3d 358 (D.
Mass. 2016) (denying the motion to suppress), after which Anzalone
pled guilty to both charges while reserving his right to appeal.
Anzalone was sentenced to 84 months in prison and five years of
supervised release.
-4APPENDIX A
004a
Case: 17-1454
Document: 00117430893
Page: 5
Date Filed: 04/24/2019
Entry ID: 6249302
II.
Anzalone contests the district court's denial of his
motion to suppress on four grounds.
First, Anzalone claims that
the affidavit presented to the magistrate judge in support of the
NIT warrant was insufficient to establish probable cause.
Second,
he maintains that the government included misstatements in the
warrant affidavit.
Third, Anzalone insists that the magistrate
judge lacked jurisdiction to issue the NIT warrant pursuant to
Rule 41 of the Federal Rules of Criminal Procedure.
Lastly, he
argues that the good faith exception established in United States
v. Leon, 468 U.S. 897 (1984), does not apply because the government
supplied misleading information to the magistrate judge and knew
of the jurisdictional limitations of Rule 41.
As a threshold matter, we find that our decision in Levin
forecloses both Anzalone's challenge under Rule 41 and his argument
about the alleged inapplicability of the Leon good faith exception.
In Levin, we examined the same NIT warrant and considered a similar
argument about the magistrate judge's alleged lack of jurisdiction
to issue the warrant under Rule 41 as a basis to suppress evidence.
874 F.3d at 318, 321.
We concluded that the Leon good faith
exception applied and suppression was not warranted "[r]egardless
of whether a Fourth Amendment violation occurred."
Id. at 321.
Specifically, we observed that there was no government conduct to
-5APPENDIX A
005a
Case: 17-1454
Document: 00117430893
Page: 6
Date Filed: 04/24/2019
Entry ID: 6249302
deter since "[f]aced with the novel question of whether an NIT
warrant can issue -- for which there was no precedent on point -the government turned to the courts for guidance" and that, "if
anything, such conduct should be encouraged, because it leaves it
to the courts to resolve novel legal issues."
Id. at 323.
We are
bound to follow Levin's reasoning on these issues here.2
See
United States v. Guzmán, 419 F.3d 27, 31 (1st Cir. 2005) (noting
that, under the law of the circuit doctrine, courts of appeal are
"ordinarily . . . constrained by prior panel decisions directly
(or even closely) on point").
We
take
advantage
of
this
opportunity,
however,
to
consider a question raised by Anzalone that was not addressed in
Levin: whether probable cause supported the NIT warrant.
Anzalone
argues that it did not, but we disagree.
Our review of probable cause determinations is de novo.
See United States v. Tanguay, 787 F.3d 44, 49 (1st Cir. 2015).
"A
All of our sister circuits to address the Rule 41 jurisdiction
issue with regards to this NIT warrant have also held that
suppression is not warranted and the good faith exception applies.
See United States v. Moorehead, 912 F.3d 963, 969 (6th Cir. 2019);
United States v. Kienast, 907 F.3d 522, 528 (7th Cir. 2018); United
States v. Henderson, 906 F.3d 1109, 1120 (9th Cir. 2018); United
States v. Werdene, 883 F.3d 204, 207 (3d Cir.), cert. denied, 139
S. Ct. 260 (2018); United States v. McLamb, 880 F.3d 685, 691 (4th
Cir.), cert. denied, 139 S. Ct. 156 (2018); United States v.
Horton, 863 F.3d 1041, 1052 (8th Cir. 2017), cert. denied, 138 S.
Ct. 1440 (2018); United States v. Workman, 863 F.3d 1313, 1321
(10th Cir. 2017), cert. denied, 138 S. Ct. 1546 (2018).
2
-6APPENDIX A
006a
Case: 17-1454
Document: 00117430893
Page: 7
Date Filed: 04/24/2019
Entry ID: 6249302
warrant application must demonstrate probable cause to believe
that (1) a crime has been committed -- the 'commission' element,
and (2) enumerated evidence of the offense will be found at the
place to be searched -- the so-called 'nexus' element."
States v. Feliz, 182 F.3d 82, 86 (1st Cir. 1999).
United
Like the
magistrate judge and the district court, we are tasked with making
"a
practical,
common-sense
decision
whether,
given
all
the
circumstances . . . there is a fair probability that contraband or
evidence of a crime will be found in a particular place."
Illinois
v. Gates, 462 U.S. 213, 238 (1983) (citations omitted); see also
United States v. Rivera, 825 F.3d 59, 63 (1st Cir. 2016) (noting
that probable cause "does not demand certainty, or proof beyond a
reasonable
doubt,
evidence").
or
even
proof
by
a
preponderance
of
the
Recently, in District of Columbia v. Wesby, the
Supreme Court reiterated that probable cause determinations are to
be informed by the totality of circumstances and not by the
consideration of different pieces of evidence in isolation.
138
S. Ct. 577, 588 (2018).
Anzalone argues that the affidavit's description of the
image on Playpen's homepage (i.e., that the homepage showed two
"partially clothed prepubescent females with their legs spread
apart") was insufficient to establish probable cause.
He also
insists that some allegations in the affidavit -- such as that
-7APPENDIX A
007a
Case: 17-1454
Document: 00117430893
Page: 8
Date Filed: 04/24/2019
Entry ID: 6249302
users had to download the Tor Network and take several other
affirmative steps to locate Playpen and that the site's homepage
emphasized anonymity -- are not indicative of criminality.
making
these
determinations
arguments,
Anzalone
hinge
on
not
forgets
discrete
that
pieces
evidence, but on the totality of circumstances.
at 588.
probable
of
In
cause
standalone
Wesby, 138 S. Ct.
And here, the totality of the information asserted in the
warrant affidavit -- Playpen's hidden nature on the Tor Network,
its registration requirement, its focus on anonymity, and the image
depicted on its homepage -- established the fair probability that
users went into Playpen to access child pornography.
462 U.S. at 238.
See Gates,
Thus, the district court was correct to deny
Anzalone's motion to suppress for lack of probable cause.3
Anzalone further argues that probable cause cannot be
established because the FBI "was reckless in seeking the warrant"
since its affidavit presented an inaccurate description of
Playpen.
According to Anzalone, the FBI knew at the time it
submitted its warrant affidavit on February 20 that the image on
Playpen's homepage had changed from depicting two females to just
one female. We agree with the district court that the FBI affiant
was not reckless in failing to reexamine Playpen's homepage
immediately prior to applying for the warrant on February 20. The
affidavit described the image that appeared on the homepage until
February 18, and that image was only changed on February 19 -- the
day before the FBI applied for the NIT warrant. Moreover, we find
that the warrant affidavit would have still supported probable
cause had it just described the new image uploaded on February 19.
3
-8APPENDIX A
008a
Case: 17-1454
Document: 00117430893
Page: 9
Date Filed: 04/24/2019
Entry ID: 6249302
III.
Next,
we
consider
the
district
court's
Anzalone's motion to dismiss the indictment.
denial
of
In this motion,
Anzalone alleged that the FBI's decision to operate Playpen for
two weeks amounted to outrageous government conduct that violated
his right to due process.
Our review is de novo.
United States
v. Luisi, 482 F.3d 43, 58 (1st Cir. 2007).
According to Anzalone, prior to seizing Playpen and
operating it for two weeks, "never ha[d] the government distributed
child pornography to hundreds of thousands of individuals with no
control over or knowledge of how those images were later shared
with others," thus exemplifying the reason why the FBI's Playpen
sting "was the epitome of outrageous conduct."
Anzalone avers
further that "the government . . . engaged in misconduct that
cannot be condoned by this Court" since it "committ[ed] the crime
of child pornography distribution."
He insists that, to identify
site users, the FBI had alternatives other than maintaining Playpen
at full operability, such as replacing "images of real children"
with "[l]egal child erotica or virtual child pornography" or
redirecting visitors to a "Playpen clone which lacked any illegal
content."
Law enforcement conduct encroaches on a defendant's due
process rights if it violates "fundamental fairness" and "shock[s]
-9APPENDIX A
009a
Case: 17-1454
Document: 00117430893
Page: 10
Date Filed: 04/24/2019
. . . the universal sense of justice."
Entry ID: 6249302
United States v. Russell,
411 U.S. 423, 432 (1973) (quoting Kinsella v. United States ex
rel.
Singleton,
361
U.S.
234,
246
(1960)).
"In
limited
circumstances, courts may dismiss criminal charges in response to
outrageous government misconduct."
F.3d 37, 43 (1st Cir. 2012).
United States v. Djokich, 693
We consider outrageous government
conduct claims "holistically, evaluating the 'totality of the
relevant circumstances' while recognizing that 'outrageousness, by
its nature, requires an ad hoc determination' that cannot 'usefully
be broken down into a series of discrete components.'"
United
States v. Therrien, 847 F.3d 9, 14 (1st Cir. 2017) (quoting United
States v. Santana, 6 F.3d 1, 6-7 (1st Cir. 1993)).
We have also
said that the outrageous government conduct defense may be viable
"where law enforcement personnel become so overinvolved in a
felonious venture that they can fairly be said either to have
creat[ed]
the
crime
participation in it."
or
to
have
coerc[ed]
the
defendant's
Santana, 6 F.3d at 5 (citations omitted).
This defense, however, has never succeeded in our Circuit, see
Luisi, 482 F.3d at 59, in part because "[t]he law frowns on the
exoneration of a defendant for reasons unrelated to his guilt or
innocence," and thus "the power to dismiss charges based solely on
government misconduct must be used sparingly," United States v.
Guzmán, 282 F.3d 56, 59 (1st Cir. 2002).
-10APPENDIX A
010a
Case: 17-1454
Document: 00117430893
Page: 11
Date Filed: 04/24/2019
Entry ID: 6249302
To be sure, the strategy that the government employed in
this case falls close to the line.
In an ideal world, there would
be effective ways to intercept individuals who trade and distribute
child pornography online other than running a child pornography
website for two weeks.
But we live in a less than ideal world.
Ultimately, we agree with the district court that the FBI's Playpen
sting does not clear the high bar we have set for the outrageous
government conduct defense to succeed.
See Therrien, 847 F.3d at
14 (noting that a "defendant's claim of outrageous government
misconduct faces a demanding standard"); United States v. Gifford,
17 F.3d 462, 471 (1st Cir. 1994) ("[F]undamental fairness is not
compromised
in
a
child
pornography
case
merely
because
the
government supplies the contraband.").
Here, an FBI agent supportably opined that disabling or
shutting down portions of Playpen "would have alerted [site users]
immediately to the FBI takeover."
Before deciding to operate the
website for two weeks, the FBI assessed the pros and cons of its
operation and determined that its chosen path "outweighed the
option of just removing Playpen from existence and waiting until
another such website popped up 24 hours later."
Among other
things, the FBI concluded that maintaining the website would allow
it
to
identify
distributors
children from abuse.
of
child
pornography
and
rescue
The record also shows that the government
-11-
APPENDIX A
011a
Case: 17-1454
Document: 00117430893
Page: 12
Date Filed: 04/24/2019
Entry ID: 6249302
did not make any improvements to the website and that 49 children
were
rescued
from
sexual
exploitation
as
government's two-week operation of the site.
a
result
of
the
Finally, Anzalone's
decision to become a registered Playpen user and download child
pornography was his very own and not a result of the government's
design or coercion.
See Santana, 6 F.3d at 5; compare with, United
States v. Chin, 934 F.2d 393, 398-99 (2d Cir. 1991) (noting that
successful outrageous government conduct claims usually arise out
of interference with the defendant's person); Huguez v. United
States, 406 F.2d 366, 381-82 (9th Cir. 1968)
(finding that it was
outrageous conduct for the government to forcibly remove cocaine
packets from defendant's rectum).
Therefore, after considering
the totality of the circumstances, we have no grounds to reverse
the denial of Anzalone's motion to dismiss the indictment.
IV.
For the foregoing reasons, the district court's judgment
is affirmed.
Affirmed.
-12APPENDIX A
012a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 1 of 32
UNITED STATES DISTRICT COURT
DISTRICT OF MASSACHUSETTS
___________________________________
)
)
)
v.
)
)
VINCENT ANZALONE,
)
)
Defendant.
)
___________________________________)
UNITED STATES OF AMERICA,
Criminal Action
No. 15-10347-PBS
MEMORANDUM AND ORDER
September 22, 2016
Saris, C.J.
INTRODUCTION
Defendant Vincent Anzalone is charged with one count of
possession of child pornography in violation of 18 U.S.C.
§ 2252A(a)(5)(B) and one count of receipt of child pornography
in violation of 18 U.S.C. § 2252A(a)(2)(A). The government also
seeks forfeiture of any child pornography images in the
defendant’s possession.
This case arises from an FBI investigation into users of
Playpen, a child pornography website. Playpen operates on the
Tor network, which enables anonymous internet browsing. In
February 2015, the government acquired control of Playpen’s
server. For two weeks, the government operated the website. To
obtain the IP addresses of the site’s users, the government
1
APPENDIX B
013a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 2 of 32
applied for and received a search warrant from a magistrate
judge in the Eastern District of Virginia. The search warrant
allowed the FBI to deploy a Network Investigative Technique
(NIT) on users’ computers. The NIT caused users’ computers to
transmit identifying information, including IP addresses, to the
government. The defendant asserts the government unreasonably
searched his computer by using the NIT in violation of the
Fourth Amendment. Specifically, the defendant contends that the
warrant lacked probable cause, that the magistrate judge in the
Eastern District of Virginia did not have the authority to
authorize a search in the District of Massachusetts, and that
suppression is required. The defendant moves to suppress all
evidence gathered by the NIT as well as all fruits of the
allegedly unconstitutional search.
For the reasons set forth below, the defendant’s motion to
suppress (Docket No. 47) is DENIED.
FACTUAL BACKGROUND
The following facts are undisputed unless otherwise noted.
The Court has not held an evidentiary hearing. The facts are
primarily drawn from FBI Special Agent Douglas Macfarlane’s
affidavit in support of the February 20, 2015 search warrant
application. The defendant initially requested a Franks hearing,
but later withdrew that request. See Docket No. 65 at 5 n.4. The
2
APPENDIX B
014a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 3 of 32
Court requested the parties to supplement the record with more
information about the NIT, which the Court considered.
I.
The Tor Network
Special Agent Macfarlane has worked as an FBI Special Agent
for two decades. At the time of the investigation at issue, he
was assigned to the FBI’s Violent Crimes Against Children
Section. On February 20, 2015, Macfarlane submitted a search
warrant application to Magistrate Judge Theresa Carroll Buchanan
of the Eastern District of Virginia. Macfarlane appended his
affidavit to that application. The statements contained in the
affidavit were based on information provided by other federal
and foreign law enforcement agents, information obtained from
subpoenas, the results of physical and electronic surveillance,
forensic computer analysis, and Macfarlane’s own experience and
training as a special agent.
In his affidavit, Agent Macfarlane described the mechanics
of the Tor network. The Tor network, also known as The Onion
Router, is an anonymity network that masks a user’s IP address.
Designed by the U.S. Naval Laboratory to protect government
communications, Tor is now available to the public. To access
the Tor network, a user must download an add-on to the user’s
existing browser or download the Tor browser bundle. To ensure
anonymity for its users, the Tor network bounces communications
through various relay computers. When a user accesses a website,
3
APPENDIX B
015a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 4 of 32
the IP address of the last computer in that chain is displayed,
rather than the user’s IP address. The network therefore
“prevents someone attempting to monitor an Internet connection
from learning what sites a user visits, prevents the sites the
user visits from learning the user’s physical location, and it
lets the user access sites which could otherwise be blocked.”
Macfarlane Aff. ¶ 8, Docket No. 48, Ex. 2.
Within the Tor network, sites can be designed as “hidden
services.” Hidden services are only accessible if the user is
using the Tor network. Hidden services allow websites and other
servers to hide their location. Like traditional websites, these
sites “are hosted on computer servers that communicate through
IP addresses.” Id. ¶ 9. Unlike such websites, however, the “IP
address for the web server is hidden and instead is replaced
with a Tor-based web address, which is a series of algorithmgenerated characters” followed by the suffix “.onion.” Id.
II.
The Playpen Website
Playpen operated as a hidden service on the Tor network.
The site was only accessible via the Tor network. According to
Agent Macfarlane, even then, a user was required to know the
site’s address: “Tor hidden services are not indexed like
websites on the traditional internet. Accordingly, unlike on the
traditional internet, a user may not simply perform a Google
search for the name of one of the websites on Tor to obtain and
4
APPENDIX B
016a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 5 of 32
click on a link to the site.” Id. ¶ 10. To learn Playpen’s
unique .onion address, a user might communicate directly with
others on Tor or he might consult another site that lists links
to child pornography hidden service sites. Agent Macfarlane
concluded that accessing Playpen “therefore requires numerous
affirmative steps by the user, making it extremely unlikely that
any user could simply stumble upon [Playpen] without
understanding its purpose and content.” Id.1
Agent Macfarlane described Playpen’s homepage as it
appeared on February 18, 2015, two days before he signed the
affidavit. At the top left corner of the page, the name Playpen
was prominently displayed. On either side of the site name were
images depicting partially clothed prepubescent girls with their
legs spread apart. Below these images, the site stated: “No
cross-board reports, .7z preferred, encrypt filenames, include
The defendant counters that Tor search engines do exist and
that even hidden service sites are indexed: “All a user need do
is enter search terms for sexually oriented sites, chat rooms,
or a host of other content not related to child pornography to
find sites like Playpen.” Docket No. 48 at 22. The defendant
cites ahmia.fi as an example of a Tor search engine. However,
Playpen and other child pornography websites are banned by
ahmia.fi. See Hidden Service Blacklist – Ahmia,
https://ahmia.fi/blacklist (last visited Aug. 31, 2016) (“Ahmia
blacklists sites containing child abuse material from its
index.”); Ahmia search after GSoC development,
https://blog.torproject.org/category/tags/ahmiafi (last visited
Aug. 31, 2016) (“We have decided to filter any sites related to
child porn from our search results. Ahmia is removing everything
related to these websites.”).
1
5
APPENDIX B
017a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 6 of 32
preview.” Id. ¶ 12. Agent Macfarlane explained that “no-crossboard reports” was an instruction to users not to post material
appearing on other sites. Id. The “.7z preferred” statement
referred to a method of compressing large files for
distribution. Id. At the top right corner, to the right of the
site name, users could enter a username and password, and select
a session length. A login button appeared to the right of those
login fields.
Below the site name, the image of the two partially clothed
girls, and the login fields was a textbox that read: “Warning!
Only registered members are allowed to access this section.
Please login below or ‘register an account’ with Playpen.” Id.
The “register an account” text was hyperlinked to the site’s
registration page. Another set of login fields appeared below
this warning, asking users to enter their username, password,
minutes to stay logged in, and whether they wanted to
permanently remain logged in.
When a prospective user clicked the “register an account”
hyperlink, the user saw a message from the forum operators. The
message explained that the forum required new users to enter an
email address and that the software “checks that what you enter
looks approximately valid.” Id. ¶ 13. However, the forum
operators encouraged users to enter fake email addresses: we “do
NOT want you to enter a real address, just something that
6
APPENDIX B
018a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 7 of 32
matches the xxx@yyy.zzz pattern. No confirmation will be sent.
This board has been intentionally configured so that it WILL NOT
SEND EMAIL, EVER.” Id. The message further cautioned new users:
“For your security you should not post information here that can
be used to identify you.” Id. The forum operators further
emphasized the site’s focus on anonymity: “The website is not
able to see your IP and can not collect or send any other form
of information to your computer except what you expressly
upload,” explaining that only a text file with the user’s
username and password reside in the browser’s cache. Id.
The defendant and the government agree that one aspect of
the homepage changed between February 18, 2015, when Agent
Macfarlane last visited the Playpen site, and February 20, 2015,
when Agent Macfarlane signed his affidavit and submitted the
search warrant application. As of February 3, 2015, the homepage
featured the two photos of the partially clothed prepubescent
girls described above. Sometime after February 3, 2015, Agent
Macfarlane learned that the site’s URL had changed. On February
18, 2015, he visited the Playpen site at its new URL. He
confirmed that its content had not changed. However, on February
19, 2015, the logo on Playpen’s site changed. Instead of two
prepubescent, partially clothed girls with their legs spread,
the site featured one young girl (age unclear) wearing a short
dress and black stockings with her legs crossed. Agent
7
APPENDIX B
019a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 8 of 32
Macfarlane did not know of this change when he signed the
affidavit on February 20, 2015. Therefore, the affidavit
incorrectly described the homepage.
After logging into Playpen with a username and password,
visitors to the site had access to various forums, many of which
contained child pornography. The table of contents included
nearly fifty topics, including “pre-teen photos,” “pre-teen
videos,” “jailbait photos,” “jailbait videos,” “kinky fetish,”
“webcams,” and “family -- incest.” Id. ¶ 14. Agent Macfarlane
noted in the affidavit that “jailbait” refers to underage, but
post-pubescent minors. Id. ¶ 14 n.4. He also explained that the
photos and videos were denominated as “HC” or “SC/NN.” Id.
¶ 14 n.5. Agent Macfarlane stated that “HC” stands for hardcore
and depicts “penetrative sexually explicit content,” “SC” stands
for softcore and includes “depictions of non-penetrative
sexually explicit conduct,” and “NN” stands for non-nude and
depicts “subjects who are fully or partially clothed.” Id. Agent
Macfarlane provided various examples of photos and videos
depicting child pornography within these forum sections.
Agent Macfarlane described other features of the site that
allowed for the dissemination of child pornography: a private
messaging function; an image hosting feature, which allowed
users to upload links to images of child pornography; a file
hosting feature, which allowed users to upload videos of child
8
APPENDIX B
020a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 9 of 32
pornography; and a chat feature, which allowed those logged into
the chat service to view and post images of child pornography.
For each of these components of the website, Agent Macfarlane
identified specific examples of child pornography being posted
or transmitted.
III. The Network Investigative Technique
In December 2014, a foreign law enforcement agency alerted
the FBI of an IP address connected with Playpen. The FBI
identified the server hosting company that owned this IP
address. The FBI then obtained a search warrant and seized a
copy of the server assigned to the IP address at issue. After
reviewing the server copy, FBI agents determined that it
contained a copy of Playpen. Further investigation revealed that
Playpen’s suspected administrator lived in Naples, Florida. On
February 19, 2015, the FBI executed a search warrant at the
administrator’s Florida residence. As of February 19, 2015, the
FBI assumed control of Playpen. The government operated the
website for the following two weeks.
While operating Playpen, the government sought permission
from a magistrate judge in the Eastern District of Virginia to
deploy the NIT. Because Playpen resided on the Tor network,
Agent Macfarlane explained in his affidavit that the NIT was
necessary to identify the site’s users and administrators.
Macfarlane stated that other methods typically used in criminal
9
APPENDIX B
021a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 10 of 32
investigations “have been tried and have failed or reasonably
appear to be unlikely to succeed if they are tried.” Id. ¶ 31.
The search warrant requested the authority to deploy the
NIT at the point when a user accesses Playpen, enters a username
and password, and logs into the site. Agent Macfarlane noted
that, despite a request to deploy the NIT at this stage, “in
order to ensure technical feasibility and avoid detection of the
technique by suspects under investigation, in executing the
requested warrant, the FBI may deploy the NIT more discretely
against particular users,” such as those who post most often or
those who visit those forum sections dedicated solely to child
pornography. Id. ¶ 32 n.8.
Agent Macfarlane detailed the technical aspects of the NIT
deployment. He explained that the NIT would deploy from the
Eastern District of Virginia. Macfarlane stated that generally,
when a user visits a website, the computer downloads content
that is used to display web pages on the user’s computers. The
NIT “would augment that content with additional computer
instructions.” Macfarlane Aff. ¶ 33, Docket No. 48, Ex. 2. “When
a user’s computer successfully downloads those instructions from
[Playpen], located in the Eastern District of Virginia, the
instructions, which comprise the NIT, are designed to cause the
user’s ‘activating’ computer to transmit certain information to
a computer controlled by or known to the government.” Id.
10
APPENDIX B
022a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 11 of 32
The affidavit enumerated the seven categories of
information that would be transmitted back to the government and
would help identify Playpen users: the activating computer’s IP
address, a unique identifier generated by the NIT to distinguish
data from other activating computers, the type of operating
system running on the activating computer, information about
whether the NIT had previously been delivered to the activating
computer, the activating computer’s Host Name,2 the activating
computer’s active operating system username, and the activating
computer’s media access control (MAC) address.3 These seven
pieces of information were to be transmitted to the government
every time a user logged into Playpen. In addition, when
accessing Playpen, a user sends “request data” to the website.
The government recorded that data and paired it with the data
collected separately by the NIT so that the government could
determine which pages a user accessed and how long the user was
logged into Playpen during the two-week period in which the
government operated the site.
“A Host Name is a name assigned to a device connected to a
computer network that is used to identify that device in various
forms of electronic communication, such as communications over
the Internet.” Macfarlane Aff. ¶ 34, Docket No. 48, Ex. 2.
3 A MAC address is a unique identifying number assigned to a
network adapter, which is equipment that connects a computer to
a network. The MAC address does not change and is intended to be
unique. Id.
2
11
APPENDIX B
023a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 12 of 32
On February 20, 2015, Magistrate Judge Theresa Carroll
Buchanan granted the NIT warrant. The next day, the defendant
visited Playpen and the NIT was deployed. According to the
government, the defendant was actively logged into Playpen for
twelve hours, one minute, and twenty-four seconds during the two
weeks the government controlled the site.
On October 20, 2015, Magistrate Judge Judith Dein of the
District of Massachusetts issued a search warrant of the
defendant’s residence. Members of the FBI Child Exploitation
Task Force executed the warrant on October 21, 2015. Inside the
residence and after the defendant waived his Miranda rights, law
enforcement agents recorded an interview with him. During the
interview, the defendant allegedly admitted to possessing child
pornography, stating that he downloaded it three to four times a
week for five or six years. He purportedly estimated that he had
between 50 and 100 gigabits of child pornography on his
computer.
IV.
Procedural Background
On November 12, 2015, the defendant was indicted on one
count of possession of child pornography in violation of 18
U.S.C. § 2252A(a)(5)(B) and one count of receipt of child
pornography in violation of 18 U.S.C. § 2252A(a)(2)(A). On May
13, 2016, the defendant moved to suppress the evidence gathered
12
APPENDIX B
024a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 13 of 32
by the NIT and all fruits of this search, including the evidence
gathered during the subsequent search of the defendant’s home.
DISCUSSION
I.
Reasonable Expectation of Privacy
The government contends that the “most critical piece of
information obtained by the NIT warrant -- Defendant’s IP
address -- is information that ordinarily would have been
publicly available over which the defendant cannot claim a
reasonable expectation of privacy.” Docket No. 58 at 30. The
defendant responds that the NIT gathered more than the IP
address and that the defendant had a reasonable expectation of
privacy in the contents of his personal computer.
The Fourth Amendment provides that the “right of the people
to be secure in their persons, houses, papers, and effects,
against unreasonable searches and seizures, shall not be
violated.” U.S. Const. amend. IV. “Intrusions upon personal
privacy do not invariably implicate the Fourth Amendment.
Rather, such intrusions cross the constitutional line only if
the challenged conduct infringes upon some reasonable
expectation of privacy.” Vega-Rodriguez v. P.R. Tel. Co., 110
F.3d 174, 178 (1st Cir. 1997). “Whether a defendant has a
reasonable expectation of privacy in a particular place is a
two-pronged inquiry. We consider ‘first, whether the movant has
exhibited an actual, subjective, expectation of privacy; and
13
APPENDIX B
025a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 14 of 32
second, whether such subjective expectation is one that society
is prepared to recognize as objectively reasonable.’” United
States v. Werra, 638 F.3d 326, 331 (1st Cir. 2011) (quoting
United States v. Rheault, 561 F.3d 55, 59 (1st Cir. 2009)).
The NIT caused a user’s computer to transmit to the
government seven pieces of information, including the user’s IP
address. The government also collected information about a
user’s activities on Playpen -- such as the particular pages
visited and the amount of time logged into the site -- and
matched that data to the user’s IP address. Some courts have
found that an individual lacks a reasonable expectation of
privacy in one’s IP address. See, e.g., United States v. Caira,
No. 14-1003, 2016 WL 4376472, at *5 (7th Cir. Aug. 17, 2016)
(“Because [the defendant] voluntarily shared his I.P. addresses
with Microsoft, he had no reasonable expectation of privacy in
those addresses.”).
A number of district courts have found that law enforcement
therefore did not require a search warrant before deploying the
NIT. See United States v. Acevedo-Lemus, No. SACR 15-00137-CJC,
2016 WL 4208436, at *3 (C.D. Cal. Aug. 8, 2016) (“The Court
concludes that the FBI’s acquisition of the key piece of
information here -- Defendant’s IP address -- was not a search
under the meaning of the Fourth Amendment, and therefore did not
require a warrant.”); United States v. Matish, No. 4:16CR16,
14
APPENDIX B
026a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 15 of 32
2016 WL 3545776, at *19 (E.D. Va. June 23, 2016) (“Defendant
possessed no reasonable expectation of privacy in his computer's
IP address, so the Government’s acquisition of the IP address
did not represent a prohibited Fourth Amendment search.”);
United States v. Werdene, No. CR 15-434, 2016 WL 3002376, at *10
(E.D. Pa. May 18, 2016) (“Since Werdene did not have a
reasonable expectation of privacy in his IP address, the NIT
cannot be considered a ‘search’ within the meaning of the Fourth
Amendment . . . .”).
Other district courts have cautioned against the narrow
scope of this inquiry, asking “whether the IP address should be
the focus of this analysis or whether Defendant’s expectation of
privacy in his computer is the proper subject of this analysis.”
United States v. Adams, No. 6:16-CR-11-ORL-40GJK, 2016 WL
4212079, at *4 (M.D. Fla. Aug. 10, 2016). These district courts
have concluded that, because the “NIT searches the user’s
computer to discover the IP address associated with that
device,” the user’s “expectation of privacy in that device is
the proper focus of the analysis, not one’s expectation of
privacy in the IP address residing in that device.” Id. If “an
individual has a reasonable expectation of privacy in the
contents of his or her personal computer, as he or she does, and
the deployment of the NIT invades that privacy, then the NIT is
a search.” United States v. Darby, No. 2:16CR36, 2016 WL
15
APPENDIX B
027a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 16 of 32
3189703, at *6 (E.D. Va. June 3, 2016). It “is irrelevant that
Defendant might not have a reasonable expectation of privacy in
some of the information searched and seized by the government.
The government’s deployment of the NIT was a Fourth Amendment
search.” Id.
The Court finds that the defendant had a reasonable
expectation of privacy in his personal computer and that the
government’s use of the NIT constituted a Fourth Amendment
search. While the most critical piece of information obtained by
the NIT warrant may have been the IP address, the NIT afforded
the government access to six other pieces of identifying
information that were not readily available to law enforcement,
as well as the ability to pair a user’s actions on Playpen with
the user’s IP address. Even if the defendant did not have a
reasonable expectation of privacy in these discrete pieces of
information, he did have a reasonable expectation of privacy in
the computer that housed this data and that was instructed by
the NIT to transmit the data back to the government.
II.
Probable Cause
The defendant argues that the site’s illegal purpose was
not readily apparent from the homepage as described in the
affidavit and that a visitor could log into the site unaware of
its content. The government retorts that users had to take a
number of affirmative steps to access the site, that the
16
APPENDIX B
028a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 17 of 32
homepage alerted users that the site contained illicit material,
and that the registration process further signaled the unlawful
nature of the site.
“A warrant application must demonstrate probable cause to
believe that (1) a crime has been committed -- the ‘commission’
element, and (2) enumerated evidence of the offense will be
found at the place to be searched -- the so-called ‘nexus”
element.’” United States v. Feliz, 182 F.3d 82, 86 (1st Cir.
1999). Probable cause “does not demand certainty, or proof
beyond a reasonable doubt, or even proof by a preponderance of
the evidence -- it demands only ‘a fair probability that
contraband or evidence of a crime will be found in a particular
place.’” United States v. Rivera, 825 F.3d 59, 63 (1st Cir.
2016) (quoting Illinois v. Gates, 462 U.S. 213, 235, 238
(1983)). “All that is needed is a ‘reasonable likelihood’ that
incriminating evidence will turn up during a proposed search.”
United States v. Clark, 685 F.3d 72, 76 (1st Cir. 2012) (quoting
Valente v. Wallace, 332 F.3d 30, 32 (1st Cir. 2003)).
“A magistrate’s ‘determination of probable cause should be
paid great deference by reviewing courts.’” Gates, 462 U.S. at
236 (quoting Spinelli v. United States, 393 U.S. 410, 419
(1969)). The inquiry “is whether the magistrate had a
‘substantial basis’ for concluding that probable cause existed.”
17
APPENDIX B
029a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 18 of 32
Feliz, 182 F.3d at 86 (quoting United States v. Taylor, 985 F.2d
3, 5 (1st Cir. 1993)).
Agent Macfarlane’s affidavit establishes a fair probability
that an individual who downloaded a Tor browser, located the
Playpen site, entered an email address and password, and logged
in4 did so with the purpose of accessing child pornography. See
United States v. Eure, No. 2:16CR43, 2016 WL 4059663, at *6
(E.D. Va. July 28, 2016) (“[T]here was probable cause to search
the computers of those who registered and logged into the
website even after the change to the website.”); Matish, 2016 WL
3545776, at *11 (finding that it was reasonable to “find that
Playpen’s focus on anonymity, coupled with Playpen’s suggestive
name, the logo of two prepubescent females partially clothed
with their legs spread apart (or, as discussed below, the one
scantily clad minor), and the affidavit's description of
Playpen’s content, endowed the NIT Warrant with probable
cause.”); Darby, 2016 WL 3189703, at *8 (“In sum, the
In supplemental briefing, the government informed the Court
that, despite what the warrant authorized, the FBI did not
deploy the NIT in this case until the defendant accessed a forum
section that explicitly referenced the child pornography content
therein. Docket No. 70 at 1-2. The defendant responds that the
probable cause inquiry focuses on what the warrant permitted,
not when the officers chose to deploy the NIT. Docket No. 74 at
1. Because the Court finds that there was probable cause to
deploy the NIT when a user logged into Playpen, the Court need
not address how, if at all, the timing of the NIT deployment in
this particular case affects the probable cause analysis.
4
18
APPENDIX B
030a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 19 of 32
information in the affidavit provided substantial evidence in
support of the magistrate’s finding that there was probable
cause to issue the NIT Warrant. . . . Although it is not beyond
possibility that some of those who logged into Playpen did so
without intention of finding child pornography, probable cause
requires a fair probability that a search will uncover evidence,
not absolute certainty.”); United States v. Epich, No. 15-CR163-PP, 2016 WL 953269, at *1 (E.D. Wis. Mar. 14, 2016)
(“[A]nyone who ended up as a registered user on the web site was
aware that the site contained, among other things, pornographic
images of children.”).
The defendant maintains that, even if the affidavit as
presented to the magistrate judge established probable cause for
the NIT, the magistrate judge would have ruled differently if
she had been presented with an accurate description of the
Playpen homepage. Specifically, the defendant emphasizes that
the homepage depicted a single image of a scantily clad girl
with her legs crossed, as opposed to two partially clothed
prepubescent girls with their legs spread apart. Initially, the
defendant requested a Franks hearing on these misstatements.
Docket No. 48 at 24. Because the government concedes that the
images on the website changed in the two days prior to Agent
Macfarlane submitting the search warrant application, the
defendant no longer seeks a Franks hearing. See Docket No. 65 at
19
APPENDIX B
031a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 20 of 32
5 n.4. However, the defendant continues to assert that the
affidavit should be reformed to account for the incorrect
description of the site’s appearance and that probable cause
should be assessed with respect to the reformed affidavit. See
Docket No. 65 at 5.
The defendant has not proven that the affiant knowingly or
recklessly included the incorrect description of the homepage.
As other district courts have noted, Agent Macfarlane visited
the website two days prior to submitting the warrant application
and he verified that the site appeared as described in his
affidavit. Macfarlane was not reckless in failing to check the
site again in the hours prior to presenting the application to
the magistrate judge. See Matish, 2016 WL 3545776, at *12 (“The
Court also finds that it was not reckless for the affiant not to
examine the website one more time on the day he sought the
warrant’s authorization, as he had recently examined the website
and confirmed that nothing had changed.”); Darby, 2016 WL
3189703, at *9 (“There is nothing reckless about relying on a
visit to the website on February 18, 2015 when describing the
website for a warrant signed and executed on February 20,
2015.”).
Nor has the defendant demonstrated that probable cause
would have been lacking had the affidavit described the site as
it appeared on February 20, 2015. See Matish, 2016 WL 3545776,
20
APPENDIX B
032a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 21 of 32
at *12 (holding that the “logo change lacks significance because
the probable cause rested not solely on the site’s logo but also
on the affiant’s description that the entire site was dedicated
to child pornography, Playpen’s suggestive name, the affirmative
steps a user must take to locate Playpen, the site’s repeated
warnings and focus on anonymity, and the actual contents of the
site”); Darby, 2016 WL 3189703, at *9 (“[C]ontrary to the
repeated emphasis of Defendant, the images of two prepubescent
females described in the warrant application were not necessary
to the finding of probable cause. There was an abundance of
other evidence before the magistrate judge that supported her
finding that there was probable cause to issue the warrant.”).
III. Particularity
The defendant argues that the search warrant was a general
warrant and that it was insufficiently particular. The
government responds that the search warrant amply described both
the places to be searched and the items to be seized.
“We begin with the basic proposition that the Warrant
Clause of the Fourth Amendment prohibits the issuance of a
warrant, except one ‘particularly describing the place to be
searched, and the persons or things to be seized.’” United
States v. Tiem Trinh, 665 F.3d 1, 15 (1st Cir. 2011) (quoting
U.S. Const. amend. IV). “Any search intruding upon that privacy
interest must be justified by probable cause and must satisfy
21
APPENDIX B
033a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 22 of 32
the particularity requirement, which limits the scope and
intensity of the search.” United States v. Bonner, 808 F.2d 864,
867 (1st Cir. 1986).
Every court to consider this question has found the NIT
search warrant sufficiently particular. See Acevedo-Lemus, 2016
WL 4208436, at *7 n.4 (“Defendant’s alternative argument -- that
the NIT Warrant failed the Fourth Amendment’s particularity
requirement -- is without merit. That argument has been
rejected, as near as the Court can tell, by every federal court
to consider it.”). This Court agrees and finds that the warrant
is “sufficiently particular as it specifies that the NIT search
applies only to computers of users accessing the website, a
group that is necessarily actively attempting to access child
pornography.” United States v. Henderson, No. 15-CR-00565-WHO-1,
2016 WL 4549108, at *4 (N.D. Cal. Sept. 1, 2016).
IV.
Anticipatory Warrant
The defendant contends that the warrant was an anticipatory
warrant in which the triggering event did not occur. The
defendant defines the triggering event as accessing the Playpen
website as it was described in the affidavit, with the images of
two partially clothed girls. The government counters that the
triggering event was simply the act of logging into the site.
For “a conditioned anticipatory warrant to comply with the
Fourth Amendment’s requirement of probable cause, two
22
APPENDIX B
034a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 23 of 32
prerequisites of probability must be satisfied.” United States
v. Grubbs, 547 U.S. 90, 96 (2006). “It must be true not only
that if the triggering condition occurs ‘there is a fair
probability that contraband or evidence of a crime will be found
in a particular place,’ but also that there is probable cause to
believe the triggering condition will occur.” Id. at 96-97
(quoting Gates, 462 U.S. at 238). “The supporting affidavit must
provide the magistrate with sufficient information to evaluate
both aspects of the probable-cause determination.” Id. at 97.
The Court concludes that “logging into Playpen -- which the
warrant application identified by its URL -- represents the
relevant triggering event.” Matish, 2016 WL 3545776, at *15.
When a user opened a Tor browser, located the Playpen site,
created an account and password, and logged on, the triggering
condition was satisfied as there was a fair probability that the
user sought to access child pornography. The anticipatory
warrant complied with the Fourth Amendment.
V.
Rule 41(b)
The defendant urges the Court to find that, even if there
was probable cause for the NIT search warrant, the magistrate
judge in the Eastern District of Virginia lacked authority under
Rule 41(b) to issue it. The government responds that the
magistrate judge had the power to issue the warrant under
subsections (b)(1), (b)(2), and (b)(4).
23
APPENDIX B
035a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 24 of 32
Federal Rule of Criminal Procedure 41(b) states in relevant
part:
At the request of a federal law enforcement officer or an
attorney for the government:
(1) a magistrate judge with authority in the district
-- or if none is reasonably available, a judge of a
state court of record in the district -- has authority
to issue a warrant to search for and seize a person or
property located within the district;
(2) a magistrate judge with authority in the district
has authority to issue a warrant for a person or
property outside the district if the person or
property is located within the district when the
warrant is issued but might move or be moved outside
the district before the warrant is executed;
. . .
(4) a magistrate judge with authority in the district
has authority to issue a warrant to install within the
district a tracking device; the warrant may authorize
use of the device to track the movement of a person or
property located within the district, outside the
district, or both;
Fed. R. Crim. P. 41(b)(1)-(2), (4).
Rule 41(b)(1) is inapposite. The defendant’s computer was
not in the Eastern District of Virginia, where the magistrate
judge issued the warrant. Rule 41(b)(2) does not apply either
because the defendant and his property were not within the
district when the warrant was issued.
Rule 41(b)(4) presents a closer call. See Henderson, 2016
WL 4549108, at *3 (“There is a stronger argument that the NIT
Warrant is permissible under Rule 41(b)(4) . . . .”). Agent
Macfarlane stated that the NIT “would augment” the content that
a user downloads from the Playpen website, which was located on
24
APPENDIX B
036a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 25 of 32
a server in the Eastern District of Virginia, “with additional
computer instructions.” Macfarlane Aff. ¶ 33, Docket No. 48, Ex.
2. After the defendant downloaded those instructions from the
server in Virginia to his home computer in Massachusetts, the
NIT would instruct the defendant’s computer to transmit certain
identifying information back to the government.
Some district courts have found that the NIT constituted a
tracking device and the magistrate judge was within her
authority under Rule 41(b)(4) to issue the warrant. See Matish,
2016 WL 3545776, at *17; Darby, 2016 WL 3189703, at *12 (“Users
of Playpen digitally touched down in the Eastern District of
Virginia when they logged into the site. When they logged in,
the government placed code on their home computers. Then their
home computers, which may have been outside of the district,
sent information to the government about their location.”); see
also United States v. Laurita, No. 8:13CR107, 2016 WL 4179365,
at *6 (D. Neb. Aug. 5, 2016) (“Rule 41(b)(4) authorizes the
magistrate judge to issue a warrant such as the NIT warrant
issued in this case. That provision authorizes the use of a
tracking device and the NIT is analogous to a tracking
device.”).
However, other courts have found the NIT warrant does not
satisfy Rule 41(b)(4). See Henderson, 2016 WL 4549108, at *3.
These courts have either concluded that the NIT was installed
25
APPENDIX B
037a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 26 of 32
outside of the Eastern District of Virginia or that it
functionally differed from a tracking device in that it did not
merely relay location data. See id. at *4 (“The NIT . . . falls
outside the meaning of a ‘tracking device’ as contemplated by
the rule. Further, the NIT was installed outside of the
district, at the location of the activating computers, not
within the district as required by Rule 41(b)(4).”); Adams, 2016
WL 4212079, at *6 (“Moreover, the NIT does not track; it
searches. As discussed above, the NIT is designed to search the
user’s computer for certain information, including the IP
address, and to transmit that data back to a server controlled
by law enforcement.”).
Because the NIT relays more than just the location of a
user’s computer, the Court concludes the NIT is probably not a
tracking device within the meaning of Rule 41(b)(4), but it is
certainly similar to a tracking device. Because this is such a
close call, the Court ultimately concludes that the good faith
exception applies even if issuance of the search warrant did not
comply with Rule 41(b).
VI.
Good Faith Exception
As a preliminary matter, the First Circuit has not decided
whether a failure to comply with Rule 41(b) is a ministerial,
technical violation -- as the government argues -- or if it
26
APPENDIX B
038a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 27 of 32
rises to the level of a constitutional violation -- as the
defendant claims.
If the violation is merely technical, suppression is not
warranted unless the defendant can demonstrate prejudice. United
States v. Burgos-Montes, 786 F.3d 92, 109 (1st Cir.), cert.
denied, 136 S. Ct. 599 (2015) (finding that a violation of
subsection (e) is ministerial and stating that suppression
requires prejudicial error); Bonner, 808 F.2d at 869 (finding
that a violation of subsection (f)(1)(C) is ministerial and
stating that suppression requires prejudicial error). Other
circuits have adopted a similar rule. See United States v.
Krueger, 809 F.3d 1109, 1113 (10th Cir. 2015) (“[W]e typically
proceed by determining whether that specific Rule 41 violation
rises to the level of a Fourth Amendment violation. . . . Unless
the defendant can establish prejudice or intentional disregard
of the Rule, a non-constitutional violation of Rule 41 will not,
by itself, justify suppression.”); United States v. Simons, 206
F.3d 392, 403 (4th Cir. 2000) (internal citations omitted)
(“There are two categories of Rule 41 violations: those
involving constitutional violations, and all others. The
violations termed ‘ministerial’ in our prior cases obviously
fall into the latter category.”). If the violation is
constitutional, no additional prejudicial showing is required.
Even constitutional violations, however, do not merit
27
APPENDIX B
039a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 28 of 32
suppression in all cases. Herring v. United States, 555 U.S. 135,
140 (2009) (“The fact that a Fourth Amendment violation occurred
-- i.e., that a search or arrest was unreasonable -- does not
necessarily mean that the exclusionary rule applies.”).
Most courts have found that, even if the magistrate judge
violated Rule 41(b) in issuing the NIT warrant, there was no
constitutional infirmity. See Henderson, 2016 WL 4549108, at *4
(“The NIT Warrant’s violation of Rule 41 is technical because
the Warrant complies with the Fourth Amendment requirements of
probable cause and particularity.”); Adams, 2016 WL 4212079, at
*6 (“The Court views a Rule 41(b) violation to be a technical or
procedural violation.”); United States v. Michaud, No. 3:15-CR05351-RJB, 2016 WL 337263, at *6 (W.D. Wash. Jan. 28, 2016)
(“[T]he NIT Warrant did not fail for constitutional reasons, but
rather was the product of a technical violation of Rule
41(b).”).
As explained above, the Court finds that there was probable
cause to issue this warrant and that the warrant was
sufficiently particular. There was no Fourth Amendment violation
here and suppression is not warranted. Even if Rule 41(b) was
violated and even if that violation was of the constitutional
variety, the Court concludes that the good faith exception would
apply. See United States v. Leon, 468 U.S. 897, 922 (1984) (“We
conclude that the marginal or nonexistent benefits produced by
28
APPENDIX B
040a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 29 of 32
suppressing evidence obtained in objectively reasonable reliance
on a subsequently invalidated search warrant cannot justify the
substantial costs of exclusion.”).
“The exclusionary rule should be limited to those
situations where its remedial objectives are best served, i.e.,
to deter illegal police conduct, not mistakes by judges and
magistrates.” Burgos-Montes, 786 F.3d at 109 (quoting Bonner,
808 F.2d at 867). “Indeed, exclusion ‘has always been our last
resort, not our first impulse.’” Herring, 555 U.S. at 140
(quoting Hudson v. Michigan, 547 U.S. 586, 591 (2006)). The
Supreme Court has “repeatedly rejected the argument that
exclusion is a necessary consequence of a Fourth Amendment
violation.” Id. at 141. For the exclusionary rule to apply, “the
benefits of deterrence must outweigh the costs.” Id.
The Court has already found that it is a close call whether
this warrant complied with Rule 41(b). See also Michaud, 2016 WL
337263, at *6 (“The Court must conclude that the NIT Warrant did
technically violate Rule 41(b), although the arguments to the
contrary are not unreasonable and do not strain credulity.”).
Given the closeness of the question and the absence of any
evidence of reckless disregard of the strictures of the Fourth
Amendment by law enforcement, the Court finds that the agents
here acted in “objectively reasonable reliance” on the NIT
warrant. See Leon, 468 U.S. at 922. Most district courts to
29
APPENDIX B
041a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 30 of 32
consider this question have reached this same conclusion. See
Michaud, 2016 WL 337263, at *7 (“Because reliance on the NIT
Warrant was objectively reasonable, the officers executing the
warrant acted in good faith, and suppression is unwarranted.”);
Darby, 2016 WL 3189703, at *14 (“[T]here is no evidence that any
failure by the FBI to understand the intricacies of the
jurisdiction of federal magistrates was deliberate.”); Werdene,
2016 WL 3002376, at *15 (“The FBI agents did not misrepresent
how the search would be conducted or, most importantly, where it
would be conducted. A magistrate judge’s mistaken belief that
she had jurisdiction, absent any indicia of reckless conduct by
the agents, does not warrant suppression.”).
The defendant contends that exclusion is warranted because
the warrant here was void ab initio, arguing that Leon’s good
faith exception only applies to a “subsequently invalidated”
search warrant. See Leon, 468 U.S. at 922. The defendant relies
principally on United States v. Levin, No. CR 15-10271-WGY, 2016
WL 2596010, at *10 (D. Mass. May 5, 2016) (Young, J.). The Levin
court concluded that the magistrate judge did not have authority
to issue the NIT warrant and that it was void ab initio. Id. at
*15. Noting that whether “the good-faith exception applies where
a warrant was void is a question of first impression in [the
First Circuit], and an unresolved question more broadly,” the
court concluded that the exception did not apply. Id. at *10. At
30
APPENDIX B
042a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 31 of 32
least three other district courts have subscribed to the Levin
court’s reasoning and found the good faith exception
inapplicable to a warrant deemed void ab initio. See United
States v. Croghan, No. 1:15-CR-48, 2016 WL 4992105, at *6 (S.D.
Iowa Sept. 19, 2016) (“For the same reasons asserted in Levin,
however, the Court finds that Leon is inapplicable to issuance
of the NIT Warrant because the NIT Warrant was issued without
jurisdiction and was, therefore, void ab initio.”); United
States v. Workman, 15-cr-00397-RBJ, slip op. at 12-15 (D. Colo.
Sept. 6, 2016); United States v. Arterbury, No. 15-CR-182-JHP,
slip op. at 25 (N.D. Okla. Apr. 25, 2016).
The Court holds that the warrant here was not void ab
initio. See Adams, 2016 WL 4212079, at *6. Even if the
magistrate judge in the Eastern District of Virginia lacked the
authority to issue a warrant that allowed the FBI to deploy the
NIT outside of that district, the magistrate judge did have
authority to issue a warrant in which the NIT deployed in that
district. The warrant was not void at its issuance. Even if it
had been, the Court concludes that the good faith exception
would apply and that suppression would not be warranted. See
Herring, 555 U.S. at 144 (“To trigger the exclusionary rule,
police conduct must be sufficiently deliberate that exclusion
can meaningfully deter it, and sufficiently culpable that such
deterrence is worth the price paid by the justice system.”);
31
APPENDIX B
043a
Case 1:15-cr-10347-PBS Document 81 Filed 09/22/16 Page 32 of 32
United States v. Master, 614 F.3d 236, 241-42 (6th Cir. 2010)
(stating that the court’s earlier holding that the good faith
exception did not apply to warrants that were void ab initio was
no longer “viable in light of more recent Supreme Court cases”
such as Herring); United States v. Ammons, No. 3:16-CR-00011TBR-DW, 2016 WL 4926438, at *8 (W.D. Ky. Sept. 14, 2016) (“The
Court holds that the good-faith exception is not foreclosed
where the warrant relied upon is void ab initio.”); Eure, 2016
WL 4059663, at *8 (“[E]ven if Rule 41(b) did not allow the
magistrate judge to issue the NIT warrant, suppression would not
be justified because the actions of the law enforcement officers
in this case were not sufficiently culpable.”); Werdene, 2016 WL
3002376, at *14 (“The good faith exception is not foreclosed in
the context of a warrant that is void ab initio . . . .”).
ORDER
The defendant’s motion to suppress (Docket No. 47) is
DENIED.
/s/ PATTI B. SARIS
Patti B. Saris
Chief United States District Judge
32
APPENDIX B
044a
Page 1 of 10
Rule 41. Search and
Seizure
(a) Scope and Definitions.
Search …
¬
+
ã
ƚ
Ɨ
â
(1) Scope. This rule does not modify any statute
regulating search or seizure, or the issuance and
execution of a search warrant in special
circumstances.
(2) Definitions. The following definitions apply
under this rule:
⇒ 2019 Federal Rules of
Criminal Procedure book Just $12.50
Table of Contents
Title I – Applicability
(A) “Property” includes documents, books,
papers, any other tangible objects, and
information.
(B) “Daytime” means the hours between 6:00
a.m. and 10:00 p.m. according to local time.
Title II – Preliminary
Proceedings
Title III – The Grand Jury, the
Indictment, and the
Information
Title IV – The Arraignment
(C) “Federal law enforcement officer” means a
and Preparation for Trial
government agent (other than an attorney for
Title V – Venue
the government) who is engaged in enforcing
Title VI – Trial
the criminal laws and is within any category of
APPENDIX C
045a
Page 2 of 10
officers authorized by the Attorney General to
Title VII – Post-Conviction
request a search warrant.
Procedures
(D) “Domestic terrorism” and “international
terrorism” have the meanings set out in 18
U.S.C. § 2331.
Title VIII – Supplementary
and Special Proceedings
Title IX – General Provisions
(E) “Tracking device” has the meaning set out
in 18 U.S.C. § 3117(b).
(b) Venue for a Warrant Application. At the request
of a federal law enforcement officer or an attorney for
the government:
(1) a magistrate judge with authority in the district
— or if none is reasonably available, a judge of a
state court of record in the district — has
authority to issue a warrant to search for and
seize a person or property located within the
district;
(2) a magistrate judge with authority in the district
has authority to issue a warrant for a person or
property outside the district if the person or
Purchase the print edition of
the
2019 Federal Rules of
Criminal Procedure
for $12.50.
property is located within the district when the
Other Sites:
warrant is issued but might move or be moved
Federal Rules of Civil
outside the district before the warrant is
Procedure
executed;
Federal Rules of Bankruptcy
(3) a magistrate judge–in an investigation of
domestic terrorism or international terrorism
–with authority in any district in which activities
related to the terrorism may have occurred has
Procedure
Federal Rules of Evidence
Federal Rules of Appellate
Procedure
authority to issue a warrant for a person or
property within or outside that district;
APPENDIX C
046a
Page 3 of 10
(4) a magistrate judge with authority in the district
has authority to issue a warrant to install within
the district a tracking device; the warrant may
authorize use of the device to track the
movement of a person or property located within
the district, outside the district, or both; and
(5) a magistrate judge having authority in any
district where activities related to the crime may
have occurred, or in the District of Columbia, may
issue a warrant for property that is located
outside the jurisdiction of any state or district, but
within any of the following:
(A) a United States territory, possession, or
commonwealth;
(B) the premises–no matter who owns them
–of a United States diplomatic or consular
mission in a foreign state, including any
appurtenant building, part of a building, or
land used for the mission’s purposes; or
(C) a residence and any appurtenant land
owned or leased by the United States and
used by United States personnel assigned to a
United States diplomatic or consular mission
in a foreign state.
(6) a magistrate judge with authority in any district
where activities related to a crime may have
occurred has authority to issue a warrant to use
remote access to search electronic storage media
and to seize or copy electronically stored
information located within or outside that district
if:
APPENDIX C
047a
Page 4 of 10
(A) the district where the media or
information is located has been concealed
through technological means; or
(B) in an investigation of a violation of 18
U.S.C. § 1030(a)(5), the media are protected
computers that have been damaged without
authorization and are located in five or more
districts.
(c) Persons or Property Subject to Search or
Seizure. A warrant may be issued for any of the
following:
(1) evidence of a crime;
(2) contraband, fruits of crime, or other items
illegally possessed;
(3) property designed for use, intended for use, or
used in committing a crime; or
(4) a person to be arrested or a person who is
unlawfully restrained.
(d) Obtaining a Warrant.
(1) In General. After receiving an affidavit or other
information, a magistrate judge–or if authorized
by Rule 41(b), a judge of a state court of record
–must issue the warrant if there is probable cause
to search for and seize a person or property or to
install and use a tracking device.
(2) Requesting a Warrant in the Presence of a Judge.
APPENDIX C
048a
Page 5 of 10
(A) Warrant on an Affidavit. When a federal
law enforcement officer or an attorney for the
government presents an affidavit in support
of a warrant, the judge may require the
affiant to appear personally and may examine
under oath the affiant and any witness the
affiant produces.
(B) Warrant on Sworn Testimony. The judge
may wholly or partially dispense with a
written affidavit and base a warrant on sworn
testimony if doing so is reasonable under the
circumstances.
(C) Recording Testimony. Testimony taken in
support of a warrant must be recorded by a
court reporter or by a suitable recording
device, and the judge must file the transcript
or recording with the clerk, along with any
affidavit.
(3) Requesting a Warrant by Telephonic or Other
Reliable Electronic Means. In accordance with Rule
4.1, a magistrate judge may issue a warrant based
on information communicated by telephone or
other reliable electronic means.
(e) Issuing the Warrant.
(1) In General. The magistrate judge or a judge of a
state court of record must issue the warrant to an
officer authorized to execute it.
(2) Contents of the Warrant.
APPENDIX C
049a
Page 6 of 10
(A) Warrant to Search for and Seize a Person
or Property. Except for a tracking-device
warrant, the warrant must identify the person
or property to be searched, identify any
person or property to be seized, and
designate the magistrate judge to whom it
must be returned. The warrant must
command the officer to:
(i) execute the warrant within a specified
time no longer than 14 days;
(ii) execute the warrant during the
daytime, unless the judge for good cause
expressly authorizes execution at another
time; and
(iii) return the warrant to the magistrate
judge designated in the warrant.
(B) Warrant Seeking Electronically Stored
Information. A warrant under Rule 41(e)(2)(A)
may authorize the seizure of electronic
storage media or the seizure or copying of
electronically stored information. Unless
otherwise specified, the warrant authorizes a
later review of the media or information
consistent with the warrant. The time for
executing the warrant in Rule 41(e)(2)(A) and
(f)(1)(A) refers to the seizure or on-site copying
of the media or information, and not to any
later off-site copying or review.
(C) Warrant for a Tracking Device. A trackingdevice warrant must identify the person or
property to be tracked, designate the
APPENDIX C
050a
Page 7 of 10
magistrate judge to whom it must be
returned, and specify a reasonable length of
time that the device may be used. The time
must not exceed 45 days from the date the
warrant was issued. The court may, for good
cause, grant one or more extensions for a
reasonable period not to exceed 45 days
each. The warrant must command the officer
to:
(i) complete any installation authorized by
the warrant within a specified time no
longer than 10 days;
(ii) perform any installation authorized by
the warrant during the daytime, unless
the judge for good cause expressly
authorizes installation at another time;
and
(iii) return the warrant to the judge
designated in the warrant.
(f) Executing and Returning the Warrant.
(1) Warrant to Search for and Seize a Person or
Property.
(A) Noting the Time. The officer executing the
warrant must enter on it the exact date and
time it was executed.
(B) Inventory. An officer present during the
execution of the warrant must prepare and
verify an inventory of any property seized.
The officer must do so in the presence of
APPENDIX C
051a
Page 8 of 10
another officer and the person from whom,
or from whose premises, the property was
taken. If either one is not present, the officer
must prepare and verify the inventory in the
presence of at least one other credible
person. In a case involving the seizure of
electronic storage media or the seizure or
copying of electronically stored information,
the inventory may be limited to describing the
physical storage media that were seized or
copied. The officer may retain a copy of the
electronically stored information that was
seized or copied.
(C) Receipt. The officer executing the warrant
must give a copy of the warrant and a receipt
for the property taken to the person from
whom, or from whose premises, the property
was taken or leave a copy of the warrant and
receipt at the place where the officer took the
property. For a warrant to use remote access
to search electronic storage media and seize
or copy electronically stored information, the
officer must make reasonable efforts to serve
a copy of the warrant and receipt on the
person whose property was searched or who
possessed the information that was seized or
copied. Service may be accomplished by any
means, including electronic means,
reasonably calculated to reach that person.
(D) Return. The officer executing the warrant
must promptly return it–together with a copy
of the inventory–to the magistrate judge
designated on the warrant. The officer may
APPENDIX C
052a
Page 9 of 10
do so by reliable electronic means. The judge
must, on request, give a copy of the inventory
to the person from whom, or from whose
premises, the property was taken and to the
applicant for the warrant.
(2) Warrant for a Tracking Device.
(A) Noting the Time. The officer executing a
tracking-device warrant must enter on it the
exact date and time the device was installed
and the period during which it was used.
(B) Return. Within 10 days after the use of the
tracking device has ended, the officer
executing the warrant must return it to the
judge designated in the warrant. The officer
may do so by reliable electronic means.
(C) Service. Within 10 days after the use of the
tracking device has ended, the officer
executing a tracking-device warrant must
serve a copy of the warrant on the person
who was tracked or whose property was
tracked. Service may be accomplished by
delivering a copy to the person who, or whose
property, was tracked; or by leaving a copy at
the person’s residence or usual place of
abode with an individual of suitable age and
discretion who resides at that location and by
mailing a copy to the person’s last known
address. Upon request of the government,
the judge may delay notice as provided in
Rule 41(f)(3).
APPENDIX C
053a
Page 10 of 10
(3) Delayed Notice. Upon the government’s
request, a magistrate judge–or if authorized by
Rule 41(b), a judge of a state court of record–may
delay any notice required by this rule if the delay
is authorized by statute.
(g) Motion to Return Property. A person aggrieved
by an unlawful search and seizure of property or by
the deprivation of property may move for the
property’s return. The motion must be filed in the
district where the property was seized. The court
must receive evidence on any factual issue necessary
to decide the motion. If it grants the motion, the court
must return the property to the movant, but may
impose reasonable conditions to protect access to the
property and its use in later proceedings.
(h) Motion to Suppress. A defendant may move to
suppress evidence in the court where the trial will
occur, as Rule 12 provides.
(i) Forwarding Papers to the Clerk. The magistrate
judge to whom the warrant is returned must attach to
the warrant a copy of the return, of the inventory, and
of all other related papers and must deliver them to
the clerk in the district where the property was seized.
Home
APPENDIX C
Free Trademark Search
054a
APPENDIX D
055a
APPENDIX D
056a
APPENDIX D
057a
APPENDIX D
058a
APPENDIX D
059a
U.S. 'Constitution - Amendment 4
Amendment 4 - Search ·and Seizure
The right of the people to be secure in their pers9ns, houses, papers, and effects, against umeasonable searches and
seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or
affrrrnation, and particularly describing the place to be searched, and the persons or things to be seized.
·,
APPENDIX E
.,
060a
This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.