Searching over 5,500,000 cases.

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

United States v. Dzwonczyk

United States District Court, D. Nebraska

October 5, 2016




         This matter is before the court on Defendant Dominic C. Dzwonczyk's Motion to Suppress evidence (Filing No. 37). For the reasons set forth below, the motion should be denied.


         This case is one of many originating from a search warrant issued in the Eastern District of Virginia, each such case consisting of a similar fact pattern. In January of 2015, the Federal Bureau of Investigation (“FBI”) received a warrant to seize a computer server. The server supported a website called “Playpen” which contained child pornography (referred throughout law enforcement affidavits as the “Target Website”). The Playpen website was operated on The Onion Router (“Tor network”). The Tor network is accessed only through Tor software available as “an add-on to the user's web browser or by downloading the free ‘Tor: browser bundle' available at No. 40 at CM/ECF p. 16).

         Websites on the Tor network typically cannot be accessed through traditional internet search means - e.g., the Playpen website could not be found through a traditional search engine like Google or Yahoo. As explained in the warrant application, a user must: a) have access to the Tor network, and b) know the Tor Network address for Playpen.

Even after connecting the TOR network, however, a user must know the web address of the website in order to access the site. Moreover, TOR “hidden services” are not indexed like websites on the traditional internet. Accordingly, unlike the traditional internet, a user may not simply perform a Google search for the name of one of the websites on TOR to obtain and click on a link to the site. A user might obtain the web address directly from communicating with other users of the board, or from internet postings describing the sort of content available on the website, as well as the websites location. For example, there is a TOR “hidden service” page that is dedicated to pedophilia and child pornography. That “hidden service” contains a section with links to TOR “hidden services” that contain child pornography. The [Playpen] website is listed in that section.

(Filing No. 40 at CM/ECF p. 17, ¶10).

         “The Tor software protects users' privacy online by bouncing their communications around a distributed network or relay computers run by volunteers all around the world, thereby masking the user's actual IP address[1] which could otherwise be used to identify a user.” (Filing No. 40 at CM/ECF p. 16, ¶ 8). These relay computers are known as “nodes.” “An exit node is the last computer through which a user's communications were routed.” (Filing No. 39 at CM/ECF p. 16, ¶ 8). “When a user on the Tor network accesses a website . . . the IP address of a Tor ‘exit node, ' rather than the user's actual IP address, shows up in the website's IP log.” Id.

         The server seized in January of 2015 was moved to a Government facility in Newington, Virginia. The FBI then took administrative control over the server. Once the seized server was under FBI control, the FBI sought and received a warrant in the Eastern District of Virginia to deploy a Network Investigative Technique (“NIT”) - a method used to force a computer to send its actual IP address to the website in question. As described in the warrant application:

In the normal course of operation, websites send content to visitors. A user's computer downloads that content and uses it to display webpages on the user's computer. Under the NIT authorized by this warrant, the [Playpen website], which will be located in Newington, Virginia, in the Eastern District of Virginia, would augment that content with additional computer instructions. When a user's computer successfully downloads those instructions from the [Playpen website], located in the Eastern District of Virginia, the instructions, which comprise the NIT, are designed to cause the user's “activating” computer to transmit certain information to a computer controlled by or known to the government. That information is described with particularity on the warrant (in attachment B of this affidavit), and the warrant authorizes obtaining no other information. The NIT will not deny the user of the “activating” computer access to any data or functionality of the user's computer.

(Filing No. 40 at CM/ECF p. 29, ¶33).

         The NIT allows law enforcement to gather information about users contacting the Playpen website. All of this information can assist the FBI with identifying the actual user of the website, thereby circumventing the masking effect of the Tor Network.

         The warrant application submitted to Magistrate Judge Theresa Carroll Buchanan in the Eastern District of Virginia sought authorization for the NIT to “cause an activating computer - wherever located - to send to a computer controlled by or known to the government network level messages containing information that may assist in identifying the computer, its location, other information about the computer and the user of the computer . . . .” (Filing No. 40 at CM/ECF pp. 34-35, ¶ 46(a)). The “other” information included the computer's actual IP address, active operating system username, and the computer's Media Access Control (“MAC”) address. The Magistrate Judge found probable cause and signed the warrant.

         During the government's control and administration of the Playpen website, a user with the username “RebeckaBecka” accessed the Playpen website and was accessing images of child pornography. Though the use of the NIT, the FBI determined IP address was assigned to “RebeckaBecka.” Further investigation determined the IP address used by “RebeckaBecka” was assigned to Cox Communications, an internet service provider serving Bellevue, Nebraska. Law enforcement ascertained through Cox Communications that the IP address was assigned to defendant Dominic C. Dzwonczyk at a residence in Bellevue, Nebraska. Law enforcement requested and received a warrant in Nebraska (the “Nebraska Warrant”) to search Dzwonczyk's residence. During execution of the Nebraska Warrant, law enforcement officers found evidence of child pornography on the computers located in Defendant's residence.

         Dzwonczyk has moved to suppress all evidence obtained from the search of his residence and the computers therein. He asserts: 1) the warrant from the Eastern District of Virginia (the “Virginia Warrant”) was issued in violation of Fed. R. Crim. P. 41 and 28 U.S.C. § 636(a) because a Magistrate Judge does not have the power to issue a warrant to authorize the search of computers outside her district; 2) since information improperly seized through the invalid Virginia Warrant provides the probable cause basis for the Nebraska Warrant, the evidence found during the search of Defendant's Nebraska residence must be suppressed; and 3) the Virginia Warrant was void at the outset, so the Leon good faith exception is inapplicable.


         Several district courts have ruled on similar motions to suppress evidence discovered in connection with the Virginia Warrant. See, e.g., United States v. Jean, case no. 5:15cr50087, 2016 WL 4771096 (W.D. Ark, Sept. 13, 2016); United States v. Henderson; case no. 15cr0565, 2016 WL 4549108 (N.D. Cal. September 1, 2016); United States v. Ammons, case no. 3:16cr00011, 2016 WL 4926438 (W.D. Ken. September 14, 2016); United States v. Levin, __F.Supp.3d__, 2016 WL 2596010 (D. Mass. May 5, 2016); United States v. Weredene, __ F.Supp.3d. __, 2016 WL 3002376 (E.D. Penn. May 18, 2016); United States v. Matish, __ F.Supp.3d __, 2016 WL 3545776 (E.D. Vir. June 23, 2016); United States v. Darby, __ F.Supp.3d __, 2016 WL 3189703 (E.D. Vir. June 3, 2016); United States v. Michaud, case no. 3:15cr5351, 2016 WL 337263 (W.D. Wash. Jan. 28, 2016). Although, the courts have employed different reasoning, the vast majority have held suppression of the evidence gained through the Virginia Warrant and various other local warrants was not appropriate.

         Defendant's motion requests suppression for violation of his Fourth Amendment rights. As such, the threshold question is whether Defendant has a reasonable expectation of privacy in the location searched and/or the evidence obtained through execution of the Virginia Warrant. If Defendant can assert a privacy interest society is willing to recognize, then the court must decide whether using a NIT from a Virginia server to obtain an IP address from a Nebraska computer was a search beyond the borders of Virginia such that a warrant authorizing this activity was beyond the statutory and rule authority of the Virginia magistrate judge. Finally, even assuming Defendant has a privacy interest in his IP address and, as applied to computers outside Virginia, the Virginia magistrate judge exceeded her territorial authority when she issued the Virginia Warrant, the court must determine whether officers acted reasonably when they relied on the Virginia and Nebraska warrants; that is, whether Defendant's motion must be denied under the Leon good faith exception.

         1. Defendant's “Reasonable Expectation of Privacy” in the Property Searched.

         The Fourth Amendment provides, in part, that “[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated.” U.S. Const. amend. IV. “It is clear that a physical intrusion or trespass by a government official constitutes a search within the meaning of the Fourth Amendment.” United States v. De L'Isle, 825 F.3d 426, 431 (8th Cir. 2016)(citing United States v. Jones, __ U.S. __, 132 S.Ct. 945, 949, 181 L.Ed.2d 911 (2012)). But “[a] search is reasonable if the officer has a valid search warrant or if the search fits within a specific warrant exception.” Id.

         For a “search” to occur within the meaning of the Fourth Amendment, an individual must have a “reasonable expectation of privacy” in the place or thing subjected to search. United States v. Jones, __ U.S. __, 132 S.Ct. 945, 950, 181 L.Ed.2d 911 (2012). “For this type of violation, the claimant must show both “an actual (subjective) expectation of privacy, and ... that the expectation [is] one that society is prepared to recognize as ‘reasonable.'” DE L'Isle, 825 F.3d at 431 (internal quotations omitted). If a law enforcement official's search does not offend a person's reasonable expectation of privacy, the Fourth Amendment is not implicated. Id.

         The Eighth Circuit held that a person has no reasonable expectation of privacy in internet subscriber data, “including his IP address and name from third-party service providers.” United States v. Wheelock, 772 F.3d 825, 828-29 (8th Cir. 2014)(internal citations omitted); see United States v. Laurita, case no. 8:13cr107, 2016 WL 4179365 (D. Neb. August 5, 2016)(Hon. Joseph F. Bataillon)(“Generally, one has no reasonable expectation of privacy in an IP address when using the internet”)(citing United States v. Forrester, 512 F.3d 500, 509-11(9th Cir. 1999)). The lack of an expectation of privacy exists because an individual necessarily shares the IP address assigned to his computer to and from third parties, such as an Internet Service Provider (“ISP”). “A person has no legitimate expectation of privacy in information he voluntarily turns over to third parties.” United States v. Miller, 425 U.S. 435, 442-44 (1976); see also United States v. Christie, 624 F.3d 558, 574 (3d Cir. 2010) (a person has “no reasonable expectation of privacy in his IP address” because the information is conveyed to and from third parties).

         If the sole question was whether a Defendant has a reasonable expectation of privacy in his IP Address, applying Eighth Circuit law, the answer would simply be “No.” But under the facts of this case, the issue is complicated by Defendant's use of the Tor Network to hide his IP address. And unlike the facts in the Eighth Circuit's holding in Wheelock, Defendant's IP address was obtained using a NIT which prompted Defendant's computer to reveal the actual IP address, and not through a subpoena served on a third-party internet service provider. Wheelock, 772 F.3d at 828-29 (finding the government's acquisition of the defendant's IP address through a third-party subpoena to an internet service provider did not violate the defendant's Fourth Amendment rights). Thus, the court must consider “whether the Tor user's expectation of privacy in his IP address may be stronger, or more legitimate, than that of an internet user who has taken no steps to conceal his IP address.” Jean, 2016 WL 4771096 at *9.

         As explained above, the Tor Network conceals a user's IP address prior to connecting with the end website. The main purpose of the Tor Network is for a user to avoid being identified. But even when using the Tor Network, an individual's IP address is disclosed to the first “node” in the Tor Network before being bounced to subsequent “nodes.” “Using the Tor network does not strip users of all anonymity, because users accessing [Playpen] must still send and receive information, including IP addresses, through another computer . . . at a specific location.” Michaud, 2016 WL 337263 at *7. “[A] necessary aspect of Tor is the initial transmission of a user's IP address to a third-party.” Werdene, __ F.Supp.3d at __, 2016 WL 3002376 at *8. “[I]n order for a prospective user to use the Tor network they must disclose information, including their IP addresses, to unknown individuals running Tor nodes, so that communications can be directed toward their destinations.” United States v. Farrell, 2016 WL 705197 at *2 (W.D. Wash. Feb. 23, 2016). The Tor project itself warns users: “Tor cannot solve all ...

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.