United States v. Gabriel Werdene
Opinion of the Court
This case arises from the Federal Bureau of Investigation's (FBI) investigation into Playpen, a global online forum that existed on the dark web
Appellant Gabriel Werdene, a citizen of Pennsylvania, was a Playpen user whose computer was compromised by the NIT. Subsequently, he was charged in the Eastern District of Pennsylvania ("EDPA") with one count of possessing child pornography, in violation of
We hold that the NIT warrant violated the prior version of Rule 41(b) and that the magistrate judge exceeded her authority under the Federal Magistrates Act. The warrant was therefore void ab initio , and the Rule 41(b) infraction rose to the level of a Fourth Amendment violation. However, we agree with the Government that the good-faith exception to the exclusionary rule may apply to warrants that are void ab initio , which ultimately precludes suppression in this case. We therefore will affirm on alternative grounds the District Court's decision to deny Werdene's suppression motion.
I. FACTS AND PROCEDURAL HISTORY
To inform our forthcoming analysis, we shall detail how Playpen escaped traditional law enforcement detection and how the FBI circumvented the dark web to apprehend its users.
A. Tor
The Playpen site operated on the anonymous "The Onion Router" ("Tor") network-a constituent part of the "dark web"-which allows users to conceal their actual internet protocol ("IP") addresses while accessing the internet.
Tor, however, prevents websites from registering a computer's actual IP address by sending user communications through a network of relay computers called "nodes" up until those communications reach the website. Numerous intermediary computers therefore stand between the accessing computer and the website, and the website can log the IP address of only the "exit node", which is the final computer in the sequence. Accordingly, Playpen's IP log-like that of other Tor websites-contained only the IP addresses of the exit nodes, rendering traditional IP identification techniques useless.
B. The Playpen Investigation
In December 2014, a foreign law enforcement agency informed the FBI that Playpen was being hosted by a computer server in North Carolina. Playpen's administrator was identified as a person residing *208in Florida, who was promptly arrested.
The FBI's solution was the NIT, a form of government-created malware that allowed the FBI to retrieve identifying information from Playpen users located all around the world. The NIT's deployment worked in multiple steps. First, the FBI modified Playpen's code so that each accessing computer-unknowingly to the user and no matter the computer's physical location-downloaded the NIT whenever a "user or administrator log[ged] into [Playpen] by entering a username and password." App. 133. Once downloaded, the NIT searched the accessing computer for seven discrete pieces of identifying information: (1) an IP address; (2) a unique identifier to distinguish the data from that of other computers; (3) the type of operating system; (4) information about whether the NIT had already been delivered; (5) a Host Name; (6) an active operating system username; and (7) a Media Access Control address. Finally, the NIT transmitted this information back to a government-controlled computer in EDVA. The FBI postulated that it could then rely on this information to identify users' premises and distinguish their computers from other computers located within their proximity.
In February 2015, the FBI obtained a search warrant from a magistrate judge in EDVA to deploy the NIT to all "activating computers." App. 106. An "activating computer" was defined in the search warrant as the computer of "any user or administrator who logs into [Playpen] by entering a username and password." Id . Further, the NIT could be deployed to any activating computer "wherever located ." App. 136 (emphasis added). In other words, this single warrant authorized the FBI to retrieve identifying information from computers all across the United States, and from all around the world. Most importantly, these computers were overwhelmingly located outside of EDVA.
C. Charges Against Werdene and Suppression Motion
Analysis of the NIT data revealed the IP address of a Playpen user, eventually identified as Werdene, residing in Bensalem, Pennsylvania. In the final month of the website's operation, Werdene was logged in for approximately ten hours and made six text postings, commenting on child pornography and sharing links under the username "thepervert." The FBI obtained a separate search warrant for Werdene's home from a magistrate judge in EDPA, where agents seized one USB drive and one DVD containing child pornography.
In September 2015, Werdene was charged in EDPA with one count of possessing child pornography, in violation of
The District Court denied the motion in a memorandum and order issued on May 18, 2016. It first held that the NIT warrant violated Rule 41(b) because the magistrate judge in EDVA was without authority to issue a warrant to search Werdene's computer in EDPA. But the District Court also held that the NIT was not a "search" within the meaning of the Fourth Amendment because Werdene lacked a reasonable expectation of privacy to his computer's IP address. It concluded that the Fourth Amendment was not implicated, and that the Rule 41(b) violation was only "technical" in nature. The District Court therefore denied the suppression motion on the bases that the Government did not intentionally disregard the Rule's requirements and that Werdene was not prejudiced by the violation. This appeal followed.
On June 7, 2016, Werdene pled guilty pursuant to a plea agreement in which he reserved his right to appeal the District Court's ruling on the suppression motion. On September 7, 2016, the District Court accepted the recommendation of the U.S. Probation Office and applied a downward variance from the United States Federal Sentencing Guideline's range of 51-63 months. It sentenced Werdene to 24 months' imprisonment, a term of supervised release of five years, and restitution in the amount of $1,500.
II. JURISDICTION AND STANDARD OF REVIEW
The District Court had original jurisdiction over this case pursuant to
III. DISCUSSION
This case requires us to decide a multitude of issues regarding Rule 41 and the Fourth Amendment. First, we must determine whether the NIT warrant violated Rule 41. If it did not, then we will affirm the District Court because there is no basis to grant Werdene's suppression motion. Second, if it did violate Rule 41, then we are required to decide whether the breach rose to the level of a Fourth Amendment violation. To do so, we consider whether the NIT warrant, by being issued by a magistrate judge beyond her jurisdiction, was void ab initio and, if so, whether such a transgression constituted a Fourth Amendment violation in the founding era. See Virginia v. Moore ,
For the reasons discussed below, we hold that the NIT warrant violated Rule 41(b). As a result, the magistrate judge not only exceeded her authority under the Rule as then drafted, but also under the Federal Magistrates Act, rendering the warrant void ab initio and raising the magnitude of the infraction from a technical one to a Fourth Amendment violation. On the other hand, we also hold that the good-faith exception applies to such warrants, which, given the circumstances of this case, precludes suppression. We therefore will affirm on alternative grounds the District Court's decision to deny Werdene's suppression motion.
A. Federal Magistrate Judge Jurisdiction
The Federal Magistrates Act,
While § 636(a) defines the geographic scope of a magistrate judge's powers, the Rules of Criminal Procedure-including Rule 41(b) -define what those powers are. See § 636(a)(1) ; see also Krueger ,
B. The NIT Warrant Violated Rule 41(b)
We must first determine whether the NIT warrant violated Rule 41(b). The Government conceded below that "[a]lthough Rule 41 does authorize a judge to issue a search warrant for a search in another district in some circumstances, it does not explicitly do so in these circumstances ." App. 91 (Government Br. in Opposition to Motion to Suppress) (emphasis added). Given the concession, the Government instead argued that the Rule set forth an illustrative, rather than exhaustive, list of circumstances in which a magistrate judge may issue a warrant.
On appeal, however, the Government curiously has reversed course, and now contends that the NIT was in fact explicitly authorized by Rule 41(b)(4), which provides that a magistrate judge may "issue a warrant to install within the district a tracking device; the warrant may authorize use of the device to track the movement of a person or property located within the district, outside the district, or both." Fed. R. Crim. P. 41(b)(4) (emphasis added).
According to the Government, under this Rule, "the NIT warrant properly authorized use of the NIT to track the movement of information-the digital child pornography content requested by users who logged into Playpen's website-as it traveled from the server in [EDVA] through the encrypted Tor network to its final destination: the users' computers, wherever located." Government Br. at 30. At that point, the NIT caused the Playpen users' computers to transmit the identifying information back to the FBI over the open internet, thus enabling law enforcement to locate and identify the user. In the Government's estimation, the NIT is similar to a transmitter affixed to an automobile that is programmed to send location-enabling signals (like GPS coordinates) back to a government-controlled receiver because it was designed to send location-enabling information (like an actual IP address) back to a government-controlled computer. "Thus, although not a physical beeper affixed to a tangible object [as was the case in, for example, United States v. Karo ,
We need not resolve Werdene's contention that the Government waived this argument because we find that the Government's tracking device analogy is inapposite. As an initial matter, it is clear that the FBI did not believe that the NIT was a tracking device at the time that it sought the warrant. Warrants issued under Rule 41(b)(4) are specialized documents that are denominated "Tracking Warrant" and require the Government to submit a specialized "Application for a Tracking Warrant." See ADMINISTRATIVE OFFICE OF U.S. COURTS, CRIMINAL FORMS AO 102 (2009) & AO 104 (2016). Here, the FBI did not submit an application for a tracking warrant-rather, it applied for, and received, a standard search warrant. Indeed, the term "tracking device" is absent from the NIT warrant application and supporting affidavit.
More importantly, the analogy does not withstand scrutiny. The explicit purpose of the warrant was not to track movement-as would be required under Rule 41(b)(4) -but to "obtain[ ] information" from "activating computers." App. 106. As discussed above, the NIT was designed to search -not track -the user's computer for the IP address and other identifying information, and to transmit that data *212back to a government-controlled server. Although the seized information (mainly the IP address) assisted the FBI in identifying a user, it provided no information as to the computer's or user's precise and contemporary physical location. This fact-that the NIT did not track movement -is dispositive, because Rule 41(b)(4) is "based on the understanding that the device will assist officers only in tracking the movements of a person or object." Fed. R. Crim. P. 41 Advisory Committee's Note (2006) (emphasis added); see also Fed. R. Crim. P. 41(a)(2)(E) (incorporating the definition of "tracking device" from
Furthermore, Rule 41(b)(4) requires that a tracker be "install[ed] within the district." Fed. R. Crim. P. 41(b)(4). It is difficult to imagine a scenario where the NIT was "installed" on Werdene's computer-which was physically located in Pennsylvania-in EDVA. The Eighth Circuit, which is the only other Court of Appeals to address the Government's Rule 41(b)(4) argument to date, rejected it on this basis:
The government argues that the defendants made a "virtual" trip to the Eastern District of Virginia to access child pornography and that investigators "installed" the NIT within that district. Although plausible, this argument is belied by how the NIT actually worked: it was installed on the defendants' computers in their homes in Iowa.... [W]e agree with the district court that the "virtual trip" fiction "stretches the rule too far."
Horton ,
The Government correctly contends that Rule 41 should be read flexibly "to include within its scope electronic intrusions authorized upon a finding of probable cause" so that it can keep up with technological innovations. United States v. New York Tel. Co. ,
C. The NIT Warrant Violated the Fourth Amendment
Since the NIT warrant violated Rule 41(b), we next consider the nature of the violation to assess if suppression is warranted. See *213United States v. Simons ,
The Fourth Amendment guarantees that:
[t]he right of the people to be secure in their persons, houses, papers, and effects against unreasonable searches and seizures, shall not be violated, and no Warrant shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
U.S. Const. amend. IV.
"[T]he overriding function of the Fourth Amendment is to protect personal privacy and dignity against unwarranted intrusion by the State." Reedy v. Evanson ,
We must therefore determine whether the circumstances of this case constituted a Fourth Amendment violation during the founding era.
The NIT warrant was therefore void ab initio because it violated § 636(a) 's jurisdictional limitations and was not authorized by any positive law.
It follows that the Rule 41(b) violation was of constitutional magnitude because "at the time of the framing ... a warrant issued for a search or seizure beyond the territorial jurisdiction of a magistrate's powers under positive law was treated as no warrant at all." Krueger ,
The Government retorts that the NIT warrant was valid for the purposes of the Fourth Amendment because it met the Supreme Court's three constitutional requirements for validity: it was "(1) supported by probable cause, (2) sufficiently particular, and (3) issued by a neutral and detached magistrate." Government Br. at 36 (citing Dalia v. United States ,
*215D. The Exclusionary Rule and Good Faith Exception
Having established that a Fourth Amendment violation occurred, we must now address an issue of first impression for this Court: does the good-faith exception to the exclusionary rule apply when a warrant is void ab initio due to the magistrate judge lacking jurisdiction to issue it? We must consider the purpose of the exclusionary rule to address this inquiry. See United States v. Wright ,
The exclusionary rule is a prudential doctrine that "prevent[s] the government from relying at trial on evidence obtained in violation of the [Fourth] Amendment's strictures." Franz ,
Rather, the exclusionary rule aims to deter government violations of the Fourth Amendment. See Krueger ,
In Katzin , we explained how the good-faith exception to the exclusionary rule effectuates this balance:
Where the particular facts of a case indicate that law enforcement officers *216act[ed] with an objectively reasonable good-faith belief that their conduct [was] lawful, or when their conduct involve[d] only simple, isolated negligence, there is no illicit conduct to deter. In such circumstances, the deterrence rationale loses much of its force and exclusion cannot pay its way. Alternatively, where law enforcement conduct is deliberate, reckless, or grossly negligent or involves recurring or systemic negligence, deterrence holds greater value and often outweighs the associated costs.
On appeal, Werdene contends that the good-faith exception should not apply when a Fourth Amendment violation arises from a warrant that was void ab initio . He argues that the common theme in all of the Supreme Court's good-faith cases is that police reasonably relied on some positive law that was appropriately issued, even though it was later invalidated. According to Werdene, each of those sources-i.e., a warrant, a statute, binding case law, or non-binding case law-had the force of law, but a warrant that is void ab initio is different because "[a]ll proceedings of a court beyond its jurisdiction are void." Appellant Br. at 49 (quoting Ex parte Watkins ,
However, the fundamental flaw with Werdene's argument is that it does not appreciate the distinction between the validity of the warrant and the deterrence rationale of the exclusionary rule and the good-faith exception. Implicit in his argument is the assumption that where "the magistrate lacks authority to issue the contested warrant, the supposed 'good faith' of the officer who executes the warrant can do nothing to confer legal status upon the [void] warrant." Master ,
Thus, in each of the Supreme Court's good-faith exception cases, "the Court has not focused on the type of Fourth Amendment violation at issue, but rather confined the 'good-faith inquiry ... to the objectively ascertainable question whether a reasonably well trained officer would have known that the search was illegal' in light of 'all of the circumstances.' " Horton ,
Having determined that the good-faith exception is applicable, we turn to whether it precludes suppression in this case. Here, the FBI sought and received a warrant, and we have identified only four scenarios in which reliance on a warrant is unreasonable:
(1) the magistrate issued the warrant in reliance on a deliberately or recklessly false affidavit;
(2) the magistrate abandoned his judicial role and failed to perform his neutral and detached function;
(3) the warrant was based on an affidavit so lacking in indicia of probable cause as to render official belief in its existence entirely unreasonable; or
(4) the warrant was so facially deficient that it failed to particularize the place to be searched or the things to be seized.
United States v. Pavulak ,
Here, the NIT warrant was issued by a neutral and detached, duly appointed magistrate judge, who determined that the warrant was supported by probable cause and particularly described the places to be searched and things to be seized. This, on its own, is sufficient for us to determine that the FBI acted in good-faith, especially because there is no evidence that it exceeded the scope of the warrant. See Leon , 468 U.S. at 922,
The Rule 41(b) error, therefore, was committed by the magistrate judge, not *218the FBI agents who reasonably relied on the NIT warrant, and we have repeatedly recognized that "officer[s] normally should not be penalized for the magistrate's mistake." Doe v. Groody ,
More importantly, the exclusionary rule "applies only where it 'result[s] in appreciable deterrence.' " Herring ,
*219IV. CONCLUSION
For the reasons above, we will affirm on alternative grounds the District Court's decision to deny Werdene's suppression motion.
"The dark web is a private global computer network that enables users to conduct anonymous transactions without revealing any trace of their location." Ahmed Ghappour, Searching Places Unknown: Law Enforcement Jurisdiction on the Dark Web ,
The NIT warrant was issued on February 20, 2015. On December 1, 2016, Rule 41(b) was amended to authorize magistrate judges to issue warrants to search computers and seize or copy electronically stored information located outside the magistrate judge's district if the district where the computer or information is located has been concealed through technological means. Fed. R. Crim. P. 41(b)(6). That Rule, which authorizes warrants such as the NIT warrant here, is not at issue in this appeal, and the references to "Rule 41(b)" throughout this opinion thus refer only to the prior version of the Rule.
Tor was developed by the U.S. Naval research Laboratory, and is now made available to the public at large. It is used by myriad individuals, groups and institutions concerned with digital privacy: journalists, military personnel, lawyers, activists, governments, corporations, and those engaged in nefarious enterprises.
The Playpen administrator was responsible for, inter alia , the distribution of child pornography, monitoring the website's activity and content, facilitating private messages between users, instructing users how to evade detection by law enforcement, and periodically changing the website's address to bypass discovery.
Werdene does not contest the lawfulness of this search warrant issued in EDPA. See Appellant Br. at 15 ("The only contested issue in this case [is] the lawfulness of the search of Mr. Werdene's computer, via the NIT, pursuant to the warrant issued in the Eastern District of Virginia.").
Having found that a Rule 41(b) violation occurred, we need not reach here Werdene's argument that the NIT warrant fails the Fourth Amendment's particularity requirement, codified in Fed. R. Crim. P. 41(e)(2)(A). See Horton ,
The District Court wrongly concluded that the Rule 41(b) violation did not violate the Fourth Amendment because Werdene had no reasonable expectation of privacy in his IP address, and accordingly, that the NIT did not conduct a "search" within the meaning of the Fourth Amendment. Both parties agree that this was error, and the Government explicitly disavows this portion of the District Court's ruling. The NIT obtained the IP address and other identifying information from Werdene's home computer and not from a third party, and Werdene had a reasonable expectation of privacy in his home computer. See, e.g. , United States v. Lifshitz ,
As previously noted, the state of authorizing positive law for NIT searches has since changed with the promulgation of Rule 41(b)(6). See supra note 2.
The Government also contends that the NIT warrant was not void ab initio because it could validly be executed to search computers within EDVA. We reject this argument-the fact that Rule 41(b) may have permitted a more limited warrant confined solely to EDVA has no bearing on the fatal jurisdictional issues that plagued the actual NIT warrant. See Horton ,
The First, Fourth, Eighth, and Tenth Circuits have each applied the good-faith exception to NIT cases. See United States v. McLamb ,
The 2016 Fed. R. Crim. P. 41(b) Advisory Note states:
The amendment provides that in two specific circumstances a magistrate judge in a district where activities related to a crime may have occurred has authority to issue a warrant to use remote access to search electronic storage media and seize or copy electronically stored information even when that media or information is or may be located outside of the district.
Fed. R. Crim. P. 41 Advisory Committee's Note (2016). Werdene concedes that Rule 41(b)(6)"authorizes warrants such as the NIT warrant here." Appellant Br. at 24 n.10. However, he contends that the Department of Justice originally sought the amendment on October 18, 2013, almost eighteen months before the NIT warrant was issued, indicating that the agency knew that the warrant was not authorized by Rule 41(b) at the time. Although plausible, the amendment may also reflect that the drafters of the Federal Rules of Criminal Procedure did not believe that it was unreasonable for a magistrate judge to issue a NIT warrant, and that the Rules had simply failed to keep up with technological changes. Werdene's argument, on its own, is insufficient for us to determine that the FBI did not act in good-faith.
Werdene proffers two additional pieces of evidence to demonstrate that the FBI did not act in good-faith, neither of which is compelling.
First, he contends that a published decision by the United States District Court for the Southern District of Texas in 2013-In re Warrant to Search a Target Computer at Premises Unknown ,
Furthermore, In re Warrant was decided by a single magistrate judge in Texas-it has no binding precedential authority and does not reflect the opinions of judges in other jurisdictions. Contrary to Werdene's assertions at oral argument, the legal landscape here was entirely unlike that in Katzin , where government agents relied on a 3-1 federal circuit split to conduct a warrantless search.
Second, Werdene argues that the FBI breached the Department of Justice's Computer Crime and Intellectual Property Section's revised manual for U.S. Attorney's Offices. See Department of Justice, Criminal Division, Computer Crime and Intellectual Property Section, Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations (3d ed. 2009). This manual was published in 2009 and advises that "[a]gents should obtain multiple warrants if they have reason to believe that a network search will retrieve data stored in multiple locations." Id . at 84. However, we decline to impute to the FBI agents the same understanding of legal nuances that is expected from the U.S. Attorney's Office. See United States v. Tracey ,
Concurring Opinion
I join Judge Greenaway's well-reasoned opinion without reservation. However, I write separately to highlight a somewhat nuanced legal point that would go unnoticed were I not to comment. In an attempt to save the search at issue here from the strictures of the Fourth Amendment, the Government not only argued for application of the good faith exception, but also for the application of the tracking device exception set out in Fed. R. Crim. P. 41(b)(4) in the District Court. Anticipating that the Government might bring this argument up on appeal, Werdene argued in his opening brief that it was waived because the Government, contrary to its own interests, conceded in the District Court that none of Rule 41 's exceptions applied. And, indeed, the Government did concede-both in their opposition to the motion to suppress and in open court-that Rule 41 does not explicitly authorize a judge to issue a search warrant in the circumstances presented here. App. at 91-92, 250-251.
Now, the Government says that their tracking device argument is not waived because we can affirm on any basis that is supported by the record, see, e.g., Murray v. Bledsoe ,
The Government offers no authority to the contrary. Werdene points to one Supreme Court opinion and a couple of court of appeals opinions in support of his position. For example, in Steagald v. United States ,
*220
Our case differs slightly in that the concession here was legal, not factual. In my view, this is a difference without a distinction. If, as here, the issue or argument has been conceded or waived before a district court, then we must not affirm on that basis. Judge Greenaway elided the issue as unnecessary to a decision in the cause before us. Slip Op. at 13. I do not disagree. I point out my thoughts on this matter nonetheless solely to remind practitioners of that old adage, "you cannot have it both ways." In my opinion, conceding a fact or a legal point in the District Court prevents us from affirming on that basis.
Reference
- Full Case Name
- UNITED STATES of America v. Gabriel WERDENE, Appellant
- Cited By
- 40 cases
- Status
- Published