United States v. Eldred
United States v. Eldred
Opinion
This case arises from one of the many prosecutions following the investigation by the Federal Bureau of Investigation ("FBI") into Playpen, a child pornography site located on the dark web. The FBI infiltrated the website and discovered the identities of many registered users by deploying a search program, the Network Investigative Technique ("NIT"), which allowed the FBI to circumvent the anonymizing features of the dark web and collect computer-related identifying information, including internet protocol ("IP") addresses, from the computers of these Playpen users. Defendant-Appellant Robert Clay Eldred ("Eldred"), whose information was collected by the NIT, moved to suppress evidence gathered by the program, arguing that the warrant authorizing it was invalid. This motion was denied. Like the nine other circuits to have *112 considered the question thus far, we conclude that Eldred's claim is without merit: even assuming, arguendo , that the NIT warrant violated the Fourth Amendment, law enforcement officers acted in good faith and suppression is not warranted. We therefore AFFIRM the judgment of the district court.
BACKGROUND
I. Factual Background 1
Playpen operated on the "The Onion Router" (better known as "Tor"), an "anonymizing network" that allows users who have downloaded the Tor software to access websites without revealing their IP addresses or other identifying information by routing their internet traffic through numerous relay computers located around the world before such traffic arrives at a desired web location. These relay computers, which are owned by volunteers who donate their bandwidth to Tor, are known as "nodes." Because of this indirect routing, when someone-for example, a law enforcement officer-attempts to view a Tor user's IP address in order to identify the user's computer and ascertain its whereabouts, the IP address displayed is actually that of the Tor "exit node," i.e. , the last computer through which the user's traffic was relayed, rather than the actual address of the Tor user. Tor was originally developed and deployed by the U.S. Naval Research Laboratory to protect government communications, but it is now used by the public at large.
Certain websites on Tor, called "hidden services," are available only to Tor users on the Tor network. Instead of a typical web address, these hidden services are assigned a randomly generated list of characters ending with the suffix ".onion." Law enforcement cannot determine the location of computers hosting these hidden services using traditional IP lookup techniques. As these websites are not indexed on the traditional Internet, they also don't appear in searches run using traditional search engines-a Tor user must know the web address in order to access a hidden service. Playpen was one such website.
When a Tor user typed Playpen's ".onion" address into Tor and arrived at the site's homepage for the first time, he was required to register with a username and password in order to enter the site. By clicking on the "register an account" hyperlink, new users accessed a Playpen message instructing them that: (1) while "[t]he software we use for this forum requires that new users enter an email address ... the forum operators do NOT want you to enter a real address"; (2) users should refrain from posting any information that could be used to identify them; and (3) that "it is impossible for the staff or the owners of this forum to confirm the true identity of users ...." Joint Appendix ("J.A.") 47. After successfully registering, users could access a variety of child pornography, including images and videos indexed according to victim age, gender, and type of sexual activity depicted, as well as content related to child pornography. Although several of the site's forums involved general information and rules regarding the site, Playpen as a whole was "dedicated to the advertisement and distribution of child pornography," id. at 43, and included forums in which users exchanged information about obtaining child pornography and engaging in child sexual abuse. In addition to images and discussions, Playpen also contained a private *113 message feature. Available historical data suggests that Playpen had over 1,500 unique users a day and over 150,000 registered users.
The FBI began investigating Playpen in September 2014. In January 2015, FBI agents obtained a search warrant allowing the FBI to seize a copy of the server hosting Playpen, which it installed on a server at a government facility in Virginia. On February 19, 2015, the FBI executed a court-authorized search on the Naples, Florida home of the suspected administrator of the Playpen site. At that point the FBI was able to assume administrative control of Playpen. However, because of the anonymizing features of the Tor network, even with control of the website, the FBI could not identify other administrators or site users.
For this reason, the FBI had developed the NIT, computer code which was added to the digital content of the copy of the Playpen website residing on the government server in Virginia. Once the NIT was deployed, whenever Tor users accessed Playpen and downloaded content so as to display it on their computers, that content was augmented with a set of computer instructions that traveled with it, through Tor's network of relay computers, until coming to rest on the computer of the Playpen user. When the NIT reached the Playpen user's computer, the attached instructions executed, causing the user's computer to transmit identifying information back to the government server in Virginia, including, inter alia , an IP address, the type of operating system employed by the computer and an active operating system username, and information regarding whether the NIT had previously been delivered.
On February 20, 2015, in the Eastern District of Virginia, where the government server then hosting Playpen was located, Magistrate Judge Theresa Carroll Buchanan issued a warrant to deploy the NIT (the "NIT warrant"). An attachment to the warrant listed the "[p]lace to be [s]earched" as "activating computers," i.e. , "those of any user or administrator who logs into the [Playpen website] by entering a username and password." J.A. 32. The NIT would collect from all "activating computers," wherever located, their actual IP addresses, as well as other specified pieces of information. While doing so, the NIT would not deny the users any functionality on their computers, or collect any additional, unrelated information. The listed information could then be used to identify the Playpen user's true identity and location. Acting under authority of the NIT warrant, the FBI operated Playpen for about two weeks, from February 20 until March 4, 2015, from the server in the Eastern District of Virginia.
On March 4, 2015, a Playpen user identified only by the username "robertecach" entered the site and thereafter spent over an hour accessing three separate posts that contained images of prepubescent girls involved in genital exposure, oral sex, and penetration by what appeared to be an adult male penis. Through the use of the NIT, the FBI learned the IP address associated with "robertecach," as well as the fact that the computer name for the device that accessed the site was "Robert." Agents traced the IP address to an address in East Montpelier, Vermont. Further investigation revealed that the house located at that address comprised two residences, one in the basement. An FBI agent thereafter interviewed the owners, who listed Eldred among previous tenants of the basement unit and confirmed that he shared the house's wireless connection with them.
FBI agents visited Eldred's subsequent residence in Northfield, Vermont on *114 March 15, 2016, but found Eldred away at work. His girlfriend, Holly Belanger, and Eldred's adult son were both present and spoke with the agents. Belanger confirmed that she and Eldred had lived at the address in East Montpelier in March 2015, and that Eldred still used the same laptop he had used at that time. She said that he had previously used the username "robertecache1" and that his laptop was password-protected, while Eldred's son said that Eldred had used the email address "[email protected]," and that Eldred would not allow others to use his laptop. Agents called Eldred, who refused to consent to a search of his laptop but agreed to meet with agents the following day. The agents then seized the laptop. After meeting with Eldred, who admitted he had used "robertecach" as a previous email account and had lived in the East Montpelier basement apartment, the agents applied for and received a warrant from Magistrate Judge John M. Conroy in the United States District of Vermont to search the laptop. The search revealed 116 files relating to child pornography, including images of penile-vaginal intercourse, penetration with objects, and oral sex.
II. Procedural History
Eldred was indicted on June 23, 2016 for knowingly possessing child pornography in violation of
On February 17, 2017 Judge Geoffrey W. Crawford of the United States District Court for the District of Vermont denied Eldred's motion to suppress in its entirety. While he agreed with Eldred that the NIT warrant was issued in violation of Federal Rule of Criminal Procedure 41(b) (" Rule 41(b)"), Judge Crawford concluded this rule violation was not of constitutional dimension. Citing this Court's decision in
United States v. Burke
,
Eldred pled guilty, but reserved his right to challenge the district court's denial of his motion to suppress. He was sentenced to six months in prison and a five-year term of supervised release. He timely filed a motion to appeal.
DISCUSSION
On appeal from a district court's ruling on a suppression motion, "we review a district court's findings of fact for clear error, and its resolution of questions of law and mixed questions of law and fact
de novo
."
United States v. Bohannon
,
On appeal, Eldred argues that the NIT warrant violated both Rule 41(b)
2
and the
*115
Federal Magistrates Act,
I
Rapid technological change can affect both the opportunities for criminal behavior and its detection. In recent years law enforcement officials with expertise in investigating child sexual exploitation have remarked on an increase in the technological savvy of the perpetrators of such crimes, particularly in their use of anonymization methods.
See
Susan Hennessey,
The Elephant in the Room: Addressing Child Exploitation and Going Dark
, Hoover Institution, Aegis Paper Series No. 1701, at 5-6 (2017). The proliferation of anonymization networks such as Tor has at the same time rendered "certain law enforcement techniques for electronic search and seizures ... no longer effective." Jonathan Mayer,
*116
Government Hacking
, 127 YALE L.J. 570, 577 (2017). Investigators who in the past "used to be able to subpoena an Internet Service Provider (ISP) for an online suspect's identity,"
The debate between privacy and security in our era of rapidly changing technology is not new.
See
Carpenter v. United States
, --- U.S. ----,
This case is illustrative of the Fourth Amendment issues that can arise in Internet investigations involving dispersed actors in unknown physical locations. Eldred argues that the NIT warrant in this investigation, purporting to authorize "searches that were executed in judicial districts across the United States," Def.-App. Br. at 2, in fact "exceeded the magistrate judge's territorial jurisdiction and violated Federal Rule of Criminal Procedure 41 and
For the reasons set forth below, we need not address Eldred's claim that the Fourth Amendment was violated by use of the NIT warrant. We note, however, that the issue is not clear cut. Both Rule 41(b) and § 636(a) impose territorial constraints on the authority of magistrate judges to issue particular types of warrants, but the Fourth Amendment itself says nothing about where such authority may be exercised, nor whether a venue requirement exists as a matter of Fourth Amendment law.
See
Dalia v. United States
,
Here, for instance, even assuming that Magistrate Judge Buchanan in fact lacked jurisdiction to issue a NIT warrant to authorize the retrieval of information from computers located outside the Eastern District of Virginia, there is no dispute that she had authority as to computers
within
that district. At least one sister circuit has determined, as a result, that the NIT warrant "was
not
void ab initio, for the warrant could validly be executed by extracting data from computers within the magistrate judge's district (the Eastern District of Virginia)."
United States v. Workman
,
Several of the nine sister circuits to have addressed the NIT warrant here have noted that the situation that arose in this case will not recur due to the passage of the 2016 amendments to Rule 41(b).
See, e.g.,
Werdene
,
But that issue is not before us today. Nor need we determine whether the NIT warrant in this case in fact issued in violation of the pre-amendment Rule 41(b) or § 636(a) of the Federal Magistrates Act. For as we discuss below, regardless whether Magistrate Judge Buchanan exceeded the scope of her jurisdiction pursuant to either of these provisions, we agree with the nine previous circuits to have considered the issue and conclude that suppression is not warranted because the good-faith doctrine applies.
II
The Fourth Amendment protects the "right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures." U.S. Const. amend IV. To effectuate this right, courts have created an exclusionary rule "that, when applicable, forbids the use of improperly obtained evidence at trial."
Herring v. United States
,
The good-faith exception first recognized in
Leon
holds that when the agents executing a search warrant "act with an objectively reasonable good-faith belief' that their conduct is lawful," improperly obtained evidence remains admissible because in such circumstances, "the deterrence rationale loses much of its force, and exclusion cannot pay its way."
Davis
,
(1) the magistrate or judge "was misled by information in an affidavit that the affiant knew was false or would have known was false except for his reckless disregard of the truth";
(2) "where the issuing magistrate wholly abandoned his judicial role";
(3) a warrant was based on an affidavit "so lacking in indicia of probable cause as to render official belief in its existence entirely unreasonable"; and
(4) a warrant is so "facially deficient" that officers "cannot reasonably presume it to be valid."
*119
Leon
,
Eldred in fact makes no argument for any but the fourth. He contends that the NIT warrant was "facially deficient" because it-as opposed to the affidavit supporting the warrant's application-was limited to the Eastern District of Virginia and did not encompass Vermont or the many other judicial districts to which the FBI's computer instructions were delivered. Of course, "[t]he Fourth Amendment by its terms requires particularity in the warrant, not in the supporting documents."
Groh v. Ramirez
,
Moreover, even if we exclude consideration of the affidavit as not sufficiently incorporated into the search warrant, as Eldred urges for the first time on appeal, the warrant itself does not contain clear geographic limitations on the place to be searched. Quite the opposite-Attachment A to the NIT warrant refers to the place to be searched as all "activating computers," defined in relevant part as "
any
user ... who logs into" Playpen. J.A. 32 (emphasis added). We thus agree with the Eighth Circuit again that there is no "obvious deficiency" in the warrant, which a number of courts have found facially valid.
Horton
,
We also disagree with Eldred that actions taken by the government surrounding this warrant more broadly demonstrate the sort of "deliberate, reckless, or grossly negligent conduct" that the exclusionary rule exists to deter.
Herring
,
[I]n light of rapidly developing technology, there will not always be definitive precedent upon which law enforcement can rely when utilizing cutting edge investigative techniques. In such cases, consultation with government *120 attorneys is precisely what Leon 's "good faith" expects of law enforcement. We are disinclined to conclude that a warrant is "facially deficient" where the legality of an investigative technique is unclear and law enforcement seeks advice from counsel before applying for the warrant.
United States v. McLamb,
Lastly, to the extent that Eldred argues the good faith exception categorically cannot apply when a warrant is issued by a judge lacking jurisdiction and is thus void
ab initio
, we do not agree. Again, we need not-and do not-pass on the issue whether the warrant here
was
void
ab initio
, and for this reason violative of the Fourth Amendment.
See
Herring
,
As the Supreme Court has repeatedly stated, the exclusionary rule cannot be used to penalize law enforcement officers for a
magistrate's
error.
See
Leon
,
*121
We therefore agree with our sister circuits that the good-faith exception is applicable even when a warrant is void
ab initio
, so long as the law enforcement agents executing such a warrant had an objectively reasonable belief that it was valid.
See
Horton
,
CONCLUSION
We have considered Eldred's remaining arguments and deem them waived or without merit. For the foregoing reasons, we AFFIRM the judgment of the district court.
The factual background presented here is derived from the parties' filings and testimony and evidence before the district court at the suppression hearing, held on January 19, 2017.
Rule 41(b) provides generally that a magistrate judge "has authority to issue a warrant to search for and seize a person or property located within the [magistrate judge's] district," but also authorizes the issuance of warrants pertaining to persons or property located outside the district in specified circumstances. At the time the NIT warrant was deployed, the Rule provided for issuance of the latter type of warrant for: (1) "a person or property outside the district if the person or property is located within the district when the warrant is issued but might move or be moved outside the district before the warrant is executed"; (2) in investigations of domestic or international terrorism; (3) for the installation within the district of a tracking device, to track movement of a person or property both within and without the district; and (4) for property located outside of any federal district. Fed. R. Crim. Pr. 41(b). None of these provisions "expressly allow[ed] a magistrate judge in one jurisdiction to authorize the search of a computer in a different jurisdiction."
United States v. Horton
,
Section 636(a) provides in relevant part as follows:
Each United States magistrate judge serving under this chapter shall have within the district in which sessions are held by the court that appointed the magistrate judge, at other places where that court may function, and elsewhere as authorized by law - (1) all powers and duties conferred or imposed upon United States commissioners by law or by the Rules of Criminal Procedure for the United States District Courts ....
The 2016 amendment added Rule 41(b)(6), which provides the following, in relevant part:
[A] magistrate judge with authority in any district where activities related to a crime may have occurred has authority to issue a warrant to use remote access to search electronic storage media and to seize or copy electronically stored information located within or outside that district if ... the district where the media or information is located has been concealed through technological means ....
See
United States v. Ganzer
,
Reference
- Full Case Name
- UNITED STATES of America Appellee, v. Robert Clay ELDRED Defendant-Appellant.
- Cited By
- 18 cases
- Status
- Published