United States District Court, D. Nebraska
MEMORANDUM AND ORDER
M. Gerrard United States District Judge.
matter is before the Court on the defendant's motion to
suppress evidence (filing 37), the Magistrate Judge's
Findings and Recommendation (filing 56) recommending that the
motion be denied, and the defendant's objection (filing
59) to the findings and recommendation. Having conducted a de
novo review of the record pursuant to 28 U.S.C. §
636(b)(1)(C), the Court will adopt the Magistrate Judge's
recommendation. Accordingly, the defendant's objection
(filing 59) will be overruled, and the defendant's motion
to suppress (filing 37) will be denied.
case arises from an FBI investigation into online child
pornography. The investigation focused on a website
called Playpen, which was accessible to users through the
"Tor" network. In 2015, the FBI- pursuant to a
warrant-seized control of the server supporting that website.
Rather than shutting the website down, the agents continued
to operate it out of a government facility in Virginia in an
attempt to identify and prosecute administrators and users
throughout the country. To this end, the FBI requested
authorization from a magistrate judge for the use of a
Network Investigative Technique, or "NIT"-software
that the government could deploy onto the computer of any
person who successfully logged on to the Playpen website.
Once on a user's computer, the software would transmit
certain identifying information about that user back to the
FBI-and, in doing so, reveal the user's public IP
address. The FBI would then use that information to track the
physical location of the user, and to secure a search warrant
for that user's home or property.
defendant, through the username "RebeckaBecka, "
allegedly visited the Playpen website while it was in the
government's control. Filing 66 at 6. Using the NIT
software, the government uncovered the defendant's IP
address, which led them to Cox Communications-an internet
provider that services areas in and around Bellevue,
Nebraska. Filing 66 at 6. Cox indicated that the IP address
was assigned to the defendant, and on August 14, 2015,
authorities secured a search warrant for the defendant's
home. Filing 66 at 6. The search uncovered child pornography
on the defendant's computer.
defendant has moved to suppress all evidence obtained from
the search of his residence and the computers therein. In
support of his motion, the defendant argues that the NIT
warrant was issued in violation of Fed. R. Crim. P. 41 and 28
U.S.C. § 636(a). See filing 38 at 4-8.
Relatedly, the defendant argues that, given the nature of the
Rule 41(b) violation, the Leon good faith exception
does not apply. Filing 38 at 10.
thoroughly reviewing the relevant facts and law, Magistrate
Judge Zwart recommended that this Court deny the
defendant's motion to suppress. Filing 56 at 20. The
defendant filed a timely objection to the Magistrate's
Findings and Recommendation, renewing his argument that the
evidence was seized in violation of the Federal Rules of
Criminal Procedure. Filing 59.
addressing the merits of the defendant's objection, the
Court will examine the relevant facts in more detail.
Playpen & The Tor Network
was an internet website that was designed and utilized for
the advertisement and distribution of child pornography.
Filing 40 at 15. The website also included features whereby
users could discuss "matters pertinent to child sexual
abuse, including methods and tactics . . . use[d] to abuse
children, . . . [and] to avoid law enforcement detection
while perpetrating online child sexual exploitation
crimes[.]" Filing 40 at 15. Administrators and users
routinely utilized the website to send and receive illegal
child pornography. Filing 40 at 15.
operated as a hidden service on an anonymity provider called
the "Tor" network. Filing 40 at 15. As explained in
the Magistrate's Judge's Findings and Recommendation,
hidden services on the Tor network are not typically
accessible through traditional internet searches. Filing 56
at 1. So, a user could not, for example, locate or access
Playpen through a standard Google or Yahoo search. Rather, a
user of the site must (a) have access to the Tor network, and
(b) know the Tor network address for Playpen. See,
filing 56 at 1; filing 40 at 17. Thus, as set forth in the
application for the NIT warrant, accessing Playpen
"requires numerous affirmative steps by the user, making
it extremely unlikely that any user could simply stumble upon
. . . [Playpen] without understanding its purpose and
content." Filing 40 at 17-18.
value of the Tor network lies in the anonymity it provides
its users. To this end, the Tor software "bounc[es
users'] communications around a distributed network of
relay computers run by volunteers all around the
world[.]" See, filing 56 at 2; filing 40 at 16.
These relay computers are known as "nodes, " and an
"exit node" is the last computer through which a
user's communication is routed. Filing 56 at 2; filing 40
at 16. So, when a user on the Tor network accesses a website,
it is the IP address of the "exit node"- not the
user-that appears on the site's IP log. See
filing 40 at 16. Thus, the process is designed to mask the
user's actual IP address so that the user remains, to the
extent possible, completely unidentifiable. Filing 40 at 16.
December 2014, the FBI received information regarding the
possible owner of the IP address associated with Playpen.
See filing 40 at 26-27. Based on this information,
the FBI, in January 2015, obtained and executed a search
warrant to seize Playpen's host server. Filing 40 at 27.
After reviewing the contents of the server, and confirming
its association with Playpen, the FBI cloned the server on a
government server in the Eastern District of Virginia. Filing
40 at 27. The administrator of that server was subsequently
identified and apprehended.
than shutting down Playpen, the FBI kept operating the site
in an attempt to identify and locate other administrators and
users of the website. To do so, the FBI, on February 20,
2015, submitted an application for a search warrant, along
with a supporting affidavit, to a magistrate judge in the
Eastern District of Virginia. See generally filing
40. According to the supporting affidavit, the government
would "continue to operate [Playpen] from the
government-controlled computer server in Newington,
Virginia" for a limited period of time, not to exceed 30
days, "in order to locate and identify the
administrators and users of [Playpen]." Filing 40 at 28.
Tor network, as described above, complicated this
investigation by actively masking the IP addresses-and thus
the identities-of the website's users. To address this
issue, the government sought authorization from the same
Eastern District of Virginia magistrate judge to use a
Network Investigation Technique, or "NIT, " which
it would activate on the Playpen website. Once installed, the
NIT would deploy onto the computer of any user who logged on
(via username and password) to the Playpen website. Filing 40
at 31. The NIT would then communicate with the computer of
the Playpen user, causing the computer to send identifying
information back to the FBI. Filing 40 at 31. As described in
the warrant application,
In the normal course of operation, websites send content to
visitors. A user's computer downloads that content and
uses it to display web pages on the user's computer.
Under the NIT authorized by this warrant, the [Playpen
website], which will be located in Newington, Virginia, in
the Eastern District of Virginia, would augment that content
with additional computer instructions. When a user's
computer successfully downloads those instructions from the
[Playpen website], . . . the instructions, which comprise the
NIT, are designed to cause the user's
"activating" computer to transmit certain
information to a computer controlled by or known to the
40 at 29. The information transmitted from the
"activating" computer to the FBI via the NIT
included: the IP address of the activating computer, and the
date and time that the NIT determined the IP address; a
unique identifier generated by the NIT to distinguish data
from different activating computers; the type of operating
system running the computer; information about whether the
NIT has already been delivered to the activating computer;
the activating computer's operating system username; and
the MAC address of the activating computer. Filing 40 at
30-31. The Eastern District of Virginia magistrate judge
approved the warrant, authorizing the FBI to deploy the NIT
for 30 days. See filing 40 at 3.
parties to this dispute agree that, on or around February 28,
2015, the NIT was deployed and attached to a computer with an
IP address allegedly belonging to the defendant. See
filing 38 at 3. Information was gleaned from the
defendant's computer, which led the authorities to the
defendant's home in Bellevue, Nebraska. The authorities
obtained a search warrant (the "Nebraska warrant"),
and on August 21, 2015, that warrant was executed on the
defendant's home. Filing 38 at 3. Electronic evidence was
seized, and an indictment charging the defendant with one
count of possession of child pornography and one count of
receipt of child pornography was filed on December 8, 2015.
Filing 38 at 3.
defendant contends that the Eastern District of Virginia
magistrate judge, in authorizing the NIT warrant, exceeded
the jurisdictional requirements established under the Federal
Magistrates Act and Rule 41(b) of the Federal Rules of
Criminal Procedure. To this end, the defendant argues that
the NIT warrant impermissibly authorized government agents to
"seize and search computers located outside the [Eastern
District of Virginia.]" Filing 38 at 4-5. And because
the NIT warrant exceeded the jurisdictional boundaries of its
issuing authority, the defendant argues that it was void, and
that the deployment of the NIT therefore amounted to a
warrantless search and seizure. Thus, he contends that the
government obtained his IP address unlawfully, and then used
that information as the basis of probable cause for the
subsequent Nebraska warrant. Based on these events, and the
nature of the Rule 41(b) violation, the defendant argues that
the evidence obtained from his computer (i.e., the
pornographic images) must be suppressed.
addressing the merits of this argument, the Court will
address two separate yet related points. First, it is worth
noting that, to the extent the defendant is claiming a
violation of his Fourth Amendment rights, that claim is part
and parcel of his argument regarding Rule 41(b). In other
words, the defendant has not alleged that the warrants were
constitutionally deficient under the Warrants clause of the
Fourth Amendment and issued in violation of Rule
41(b). Rather, his sole claim is that the warrant exceeded
the jurisdictional requirements of Fed. R. Crim. P. 41(b),
and that the Rule 41(b) violation, at least in part, resulted
in a constitutional infirmity.
advancing this argument, the defendant acknowledges that a
violation of Rule 41 is not itself tantamount to a Fourth
Amendment violation, and that noncompliance with the Rule
does not, in every instance, require suppression. U.S. v.
Spencer, 439 F.3d 905, 913 (8th Cir. 2006). In this way,
and as discussed in more detail below, the Eighth Circuit
distinguishes between Rule 41(b) violations that are
"fundamental, " thereby necessitating suppression,
and those that are "non-fundamental, " in which
suppression is appropriate only upon a showing of prejudice
or reckless disregard of proper procedure. See United
States v. Freeman, 897 F.2d 346, 349-50 (8th Cir. 1990);
see also United States v. Jean, 2016 WL 4771096, at
*17 (W.D. Ark. Sept. 13, 2016). Thus, applying this framework
to the facts of his case, the defendant argues that
suppression is required because the purported violation of
the Rule is fundamental (in that it facilitated a violation
of his constitutional rights), and, alternatively, that it
resulted in prejudice (in that the search of his home would
not have occurred if the Rule had been followed).
See, filing 38 at 8; filing 52 at 2-3.
the Playpen investigation has resulted in nationwide
litigation, producing largely divergent opinions regarding
the validity of the NIT warrant under Fed. R. Crim. P. 41(b),
and the applicability, if at all, of the exclusionary rule.
With respect to these issues, and as discussed in more detail
below, courts have generally reached one of three results:
either (1) the NIT warrant was unlawfully issued and
suppression is required; (2) the NIT warrant was unlawfully
issued, but suppression is not the appropriate remedy; or (3)
the NIT warrant was lawfully issued, and there are no legal
violations that require suppression. See United States v.
Johnson, 2016 WL 6136586, at *3 (W.D. Mo. Oct. 20, 2016)
Judge Zwart, in her Findings and Recommendation to this
Court, recommends the third result-that is, that the NIT
warrant complied with Fed. R. Crim. P. 41(b), and that there
are no legal violations that require suppression.
Seefiling 56 at 13, 16. In reaching this result,
Judge Zwart first determined that the deployment of the NIT
was not a "search" for purposes of the Fourth
Amendment. Filing 56 at 10. She next concluded that, even
assuming the NIT was a search, the search warrant was validly
issued under Fed. R. Crim. P. 41(b), and even assuming
otherwise, that it did not result in a constitutional
infirmity or prejudice. Filing 56 at 10-16. And finally, she
determined that even assuming the warrant was invalid, and
that it caused either a constitutional infirmity or
prejudice, that the good faith exception set forth in
United States v. Leon and its progeny would prohibit
suppression of the evidence. Filing 56 at 17.
reasons set forth below, the Court adopts the Magistrate
Judge's recommendation, and accordingly, will deny the
defendant's motion to suppress. However, the Court takes
a different path to this result. Specifically, the Court
concludes that the NIT warrant was issued in violation of
Rule 41(b), and that the government's conduct amounted to
a search under the Fourth Amendment. However, consistent with
the findings and recommendation, the Court concludes that the
Rule 41(b) violation was neither "of constitutional
magnitude, " or otherwise prejudicial. Further, because
the officers acted in reasonable good faith, the Court finds
that, even if the violation implicated the exclusionary rule,
suppression-at least on these facts-is not the appropriate
R. Crim. P. 41
defendant argues that the NIT warrant was issued in violation
of Federal Rule of Criminal Procedure 41(b), which, at all
relevant times, provided in part,
(b) Authority to Issue a Warrant. At the
request of a federal law enforcement officer or an attorney