United States District Court, D. Nebraska
FINDINGS, RECOMMENDATION AND ORDER
R. ZWART UNITED STATES MAGISTRATE JUDGE.
matter is before the court on Defendant Dominic C.
Dzwonczyk's Motion to Suppress evidence (Filing No.
37). For the reasons set forth below, the motion should
case is one of many originating from a search warrant issued
in the Eastern District of Virginia, each such case
consisting of a similar fact pattern. In January of 2015, the
Federal Bureau of Investigation (“FBI”) received
a warrant to seize a computer server. The server supported a
website called “Playpen” which contained child
pornography (referred throughout law enforcement affidavits
as the “Target Website”). The Playpen website was
operated on The Onion Router (“Tor network”). The
Tor network is accessed only through Tor software available
as “an add-on to the user's web browser or by
downloading the free ‘Tor: browser bundle'
available at www.torproject.org.” (Filing
No. 40 at CM/ECF p. 16).
on the Tor network typically cannot be accessed through
traditional internet search means - e.g., the Playpen website
could not be found through a traditional search engine like
Google or Yahoo. As explained in the warrant application, a
user must: a) have access to the Tor network, and b) know the
Tor Network address for Playpen.
Even after connecting the TOR network, however, a user must
know the web address of the website in order to access the
site. Moreover, TOR “hidden services” are not
indexed like websites on the traditional internet.
Accordingly, unlike the traditional internet, a user may not
simply perform a Google search for the name of one of the
websites on TOR to obtain and click on a link to the site. A
user might obtain the web address directly from communicating
with other users of the board, or from internet postings
describing the sort of content available on the website, as
well as the websites location. For example, there is a TOR
“hidden service” page that is dedicated to
pedophilia and child pornography. That “hidden
service” contains a section with links to TOR
“hidden services” that contain child pornography.
The [Playpen] website is listed in that section.
(Filing No. 40 at CM/ECF p. 17, ¶10).
Tor software protects users' privacy online by bouncing
their communications around a distributed network or relay
computers run by volunteers all around the world, thereby
masking the user's actual IP address which could
otherwise be used to identify a user.” (Filing No. 40
at CM/ECF p. 16, ¶ 8). These relay computers are known
as “nodes.” “An exit node is the last
computer through which a user's communications were
routed.” (Filing No. 39 at CM/ECF p. 16, ¶ 8).
“When a user on the Tor network accesses a website . .
. the IP address of a Tor ‘exit node, ' rather than
the user's actual IP address, shows up in the
website's IP log.” Id.
server seized in January of 2015 was moved to a Government
facility in Newington, Virginia. The FBI then took
administrative control over the server. Once the seized
server was under FBI control, the FBI sought and received a
warrant in the Eastern District of Virginia to deploy a
Network Investigative Technique (“NIT”) - a
method used to force a computer to send its actual IP address
to the website in question. As described in the warrant
In the normal course of operation, websites send content to
visitors. A user's computer downloads that content and
uses it to display webpages on the user's computer. Under
the NIT authorized by this warrant, the [Playpen website],
which will be located in Newington, Virginia, in the Eastern
District of Virginia, would augment that content with
additional computer instructions. When a user's computer
successfully downloads those instructions from the [Playpen
website], located in the Eastern District of Virginia, the
instructions, which comprise the NIT, are designed to cause
the user's “activating” computer to transmit
certain information to a computer controlled by or known to
the government. That information is described with
particularity on the warrant (in attachment B of this
affidavit), and the warrant authorizes obtaining no other
information. The NIT will not deny the user of the
“activating” computer access to any data or
functionality of the user's computer.
(Filing No. 40 at CM/ECF p. 29, ¶33).
allows law enforcement to gather information about users
contacting the Playpen website. All of this information can
assist the FBI with identifying the actual user of the
website, thereby circumventing the masking effect of the Tor
warrant application submitted to Magistrate Judge Theresa
Carroll Buchanan in the Eastern District of Virginia sought
authorization for the NIT to “cause an activating
computer - wherever located - to send to a computer
controlled by or known to the government network level
messages containing information that may assist in
identifying the computer, its location, other information
about the computer and the user of the computer . . .
.” (Filing No. 40 at CM/ECF pp. 34-35, ¶ 46(a)).
The “other” information included the
computer's actual IP address, active operating system
username, and the computer's Media Access Control
(“MAC”) address. The Magistrate Judge found
probable cause and signed the warrant.
the government's control and administration of the
Playpen website, a user with the username
“RebeckaBecka” accessed the Playpen website and
was accessing images of child pornography. Though the use of
the NIT, the FBI determined IP address 126.96.36.199 was
assigned to “RebeckaBecka.” Further investigation
determined the IP address used by “RebeckaBecka”
was assigned to Cox Communications, an internet service
provider serving Bellevue, Nebraska. Law enforcement
ascertained through Cox Communications that the IP address
was assigned to defendant Dominic C. Dzwonczyk at a residence
in Bellevue, Nebraska. Law enforcement requested and received
a warrant in Nebraska (the “Nebraska Warrant”) to
search Dzwonczyk's residence. During execution of the
Nebraska Warrant, law enforcement officers found evidence of
child pornography on the computers located in Defendant's
has moved to suppress all evidence obtained from the search
of his residence and the computers therein. He asserts: 1)
the warrant from the Eastern District of Virginia (the
“Virginia Warrant”) was issued in violation of
Fed. R. Crim. P. 41 and 28 U.S.C. § 636(a)
because a Magistrate Judge does not have the power to issue a
warrant to authorize the search of computers outside her
district; 2) since information improperly seized through the
invalid Virginia Warrant provides the probable cause basis
for the Nebraska Warrant, the evidence found during the
search of Defendant's Nebraska residence must be
suppressed; and 3) the Virginia Warrant was void at the
outset, so the Leon good faith exception is
district courts have ruled on similar motions to suppress
evidence discovered in connection with the Virginia Warrant.
See, e.g., United States v. Jean, case no.
5:15cr50087, 2016 WL 4771096 (W.D. Ark, Sept. 13, 2016);
United States v. Henderson; case no. 15cr0565, 2016
WL 4549108 (N.D. Cal. September 1, 2016); United States
v. Ammons, case no. 3:16cr00011, 2016 WL 4926438 (W.D.
Ken. September 14, 2016); United States v. Levin,
__F.Supp.3d__, 2016 WL 2596010 (D. Mass. May 5, 2016);
United States v. Weredene, __ F.Supp.3d. __, 2016 WL
3002376 (E.D. Penn. May 18, 2016); United States
v. Matish, __ F.Supp.3d __, 2016 WL 3545776 (E.D. Vir.
June 23, 2016); United States v. Darby, __ F.Supp.3d
__, 2016 WL 3189703 (E.D. Vir. June 3, 2016); United
States v. Michaud, case no. 3:15cr5351, 2016 WL 337263
(W.D. Wash. Jan. 28, 2016). Although, the courts have
employed different reasoning, the vast majority have held
suppression of the evidence gained through the Virginia
Warrant and various other local warrants was not appropriate.
motion requests suppression for violation of his Fourth
Amendment rights. As such, the threshold question is whether
Defendant has a reasonable expectation of privacy in the
location searched and/or the evidence obtained through
execution of the Virginia Warrant. If Defendant can assert a
privacy interest society is willing to recognize, then the
court must decide whether using a NIT from a Virginia server
to obtain an IP address from a Nebraska computer was a search
beyond the borders of Virginia such that a warrant
authorizing this activity was beyond the statutory and rule
authority of the Virginia magistrate judge. Finally, even
assuming Defendant has a privacy interest in his IP address
and, as applied to computers outside Virginia, the Virginia
magistrate judge exceeded her territorial authority when she
issued the Virginia Warrant, the court must determine whether
officers acted reasonably when they relied on the Virginia
and Nebraska warrants; that is, whether Defendant's
motion must be denied under the Leon good faith
Defendant's “Reasonable Expectation of
Privacy” in the Property Searched.
Fourth Amendment provides, in part, that “[t]he right
of the people to be secure in their persons, houses, papers,
and effects, against unreasonable searches and seizures,
shall not be violated.” U.S. Const. amend. IV.
“It is clear that a physical intrusion or trespass by a
government official constitutes a search within the meaning
of the Fourth Amendment.” United States v. De
L'Isle, 825 F.3d 426, 431 (8th Cir. 2016)(citing
United States v. Jones, __ U.S. __, 132 S.Ct. 945,
949, 181 L.Ed.2d 911 (2012)). But “[a] search is
reasonable if the officer has a valid search warrant or if
the search fits within a specific warrant exception.”
“search” to occur within the meaning of the
Fourth Amendment, an individual must have a “reasonable
expectation of privacy” in the place or thing subjected
to search. United States v. Jones, __ U.S. __, 132
S.Ct. 945, 950, 181 L.Ed.2d 911 (2012). “For this type
of violation, the claimant must show both “an actual
(subjective) expectation of privacy, and ... that the
expectation [is] one that society is prepared to recognize as
‘reasonable.'” DE L'Isle, 825
F.3d at 431 (internal quotations omitted). If a law
enforcement official's search does not offend a
person's reasonable expectation of privacy, the Fourth
Amendment is not implicated. Id.
Eighth Circuit held that a person has no reasonable
expectation of privacy in internet subscriber data,
“including his IP address and name from third-party
service providers.” United States v. Wheelock,
772 F.3d 825, 828-29 (8th Cir. 2014)(internal citations
omitted); see United States v. Laurita, case no.
8:13cr107, 2016 WL 4179365 (D. Neb. August 5, 2016)(Hon.
Joseph F. Bataillon)(“Generally, one has no reasonable
expectation of privacy in an IP address when using the
internet”)(citing United States v. Forrester,
512 F.3d 500, 509-11(9th Cir. 1999)). The lack of an
expectation of privacy exists because an individual
necessarily shares the IP address assigned to his computer to
and from third parties, such as an Internet Service Provider
(“ISP”). “A person has no legitimate
expectation of privacy in information he voluntarily turns
over to third parties.” United States v.
Miller, 425 U.S. 435, 442-44 (1976); see also
United States v. Christie, 624 F.3d 558, 574 (3d
Cir. 2010) (a person has “no reasonable expectation of
privacy in his IP address” because the information is
conveyed to and from third parties).
sole question was whether a Defendant has a reasonable
expectation of privacy in his IP Address, applying Eighth
Circuit law, the answer would simply be “No.” But
under the facts of this case, the issue is complicated by
Defendant's use of the Tor Network to hide his IP
address. And unlike the facts in the Eighth Circuit's
holding in Wheelock, Defendant's IP address was
obtained using a NIT which prompted Defendant's computer
to reveal the actual IP address, and not through a subpoena
served on a third-party internet service provider.
Wheelock, 772 F.3d at 828-29 (finding the
government's acquisition of the defendant's IP
address through a third-party subpoena to an internet service
provider did not violate the defendant's Fourth Amendment
rights). Thus, the court must consider “whether the Tor
user's expectation of privacy in his IP address may be
stronger, or more legitimate, than that of an internet user
who has taken no steps to conceal his IP address.”
Jean, 2016 WL 4771096 at *9.
explained above, the Tor Network conceals a user's IP
address prior to connecting with the end website. The main
purpose of the Tor Network is for a user to avoid being
identified. But even when using the Tor Network, an
individual's IP address is disclosed to the first
“node” in the Tor Network before being bounced to
subsequent “nodes.” “Using the Tor network
does not strip users of all anonymity, because users
accessing [Playpen] must still send and receive information,
including IP addresses, through another computer . . . at a
specific location.” Michaud, 2016 WL 337263 at
*7. “[A] necessary aspect of Tor is the initial
transmission of a user's IP address to a
third-party.” Werdene, __ F.Supp.3d at __,
2016 WL 3002376 at *8. “[I]n order for a prospective
user to use the Tor network they must disclose information,
including their IP addresses, to unknown individuals running
Tor nodes, so that communications can be directed toward
their destinations.” United States v. Farrell,
2016 WL 705197 at *2 (W.D. Wash. Feb. 23, 2016). The Tor
project itself warns users: “Tor cannot solve all