United States v. McLamb
United States v. McLamb
Opinion of the Court
MEMORANDUM OPINION AND ORDER
This matter comes before the court on the Defendant’s First Motion to Suppress, Second Motion to Suppress, and Motion to Compel. ECF Nos. 14, 15, 16. In his Motions to Suppress, the Defendant seeks to suppress evidence the government obtained, pursuant to a warrant, through use of the Network Investigative Technique (“NIT”) code that enabled the government to access information on the Defendant’s personal computer. First Mot. to Suppress at 1; Second Mot. to Suppress at 1. In his Motion to Compel, the Defendant seeks to compel discovery of two components of the NIT: (1) the unique identifier generator, and (2) the exploit source code. Mot. to Compel at 1. After full briefing and a hearing on the Motions, the matter is ripe for decision. For the reasons stated herein, these Motions to Suppress and the Motion to Compel are DENIED.
I. FACTUAL BACKGROUND
The Defendant was charged following an investigation into a website called “Playpen,” which the government asserts operated as a child pornography site. First Mot. to Suppress at 4. The Playpen website was unusual in that it operated on what is known as the “Tor” network. See id. The Tor network enables its users to conceal their Internet Protocol (“IP”) addresses, after they download the Tor browser from the Tor website. See id. IP addresses, if not hidden by either manual
On February 19, 2015, the Federal Bureau of Investigation (“FBI”) arrested the then-operator of Playpen, gained control of the Playpen website, and thereafter operated it on a server in Virginia. Macfarlane Aff., EOF No. 14-2, ¶ 30. On February 20, 2015, the government obtained a warrant (“NIT Warrant”) enabling it to use the NIT to investigate Playpen users. NIT Search Warrant and Application, EOF 19-9. The Defendant and the government disagree on the NIT’s operation, but the basic concept is that, after a computer user logged into Playpen with a username and password, an application was authorized to send code, or computer instructions, to the user’s computer. This code instructed the computer to send identifying information to a different, government-controlled computer.
While the NIT warrant authorized the NIT to be deployed as soon as a user logged into Playpen, here, the NIT was not deployed until a posting thread in the “kinky fetish — zoo subforum” was accessed. Resp. to Mot. to Compel at 18. After deploying the NIT, the FBI was able to identify an IP address associated with a particular Playpen username (“slutwhore”) and trace that username to the Defendant. Resp. to First Mot. to Suppress at 7. On December 1, 2015, the government obtained a residential search warrant (“Second Warrant”) for the Defendant’s home. The Second Warrant was executed on December 8, 2015, while the Defendant was home. Id. at 8. The Defendant acknowledged to agents that he viewed child pornography and that “slutwhore” was his username. See id. Child pornography was found on electronic devices owned by the Defendant during the execution of the Second Warrant. Id.
The parties do not dispute that Playpen’s content included child pornography; rather, the Defendant takes issue with the NIT Warrant Application’s description of the Playpen homepage. First Mot. to Suppress at 2-3. Although the NIT Warrant Application describes the homepage as displaying an image of partially clothed, prepubescent girls with their legs spread apart, the photo displayed on the homepage at the time of the application was actually one of a young girl with her legs crossed, wearing thigh-high fishnet stockings and a short dress or top that exposed her uncovered upper thighs. First Mot. to Suppress at 8-9; Resp. to First Mot. to Suppress at 14-15, 31.
On June 22, 2016, a federal grand jury-returned an indictment, which charged McLamb with four counts of receipt of child pornography, in violation of 18 U.S.C. § 2252(a)(2), and one count of possession of child pornography, in violation of 18 U.S.C. § 2252(a)(4). ECF No. 1. The court set a preliminary motions deadline of July 29, 2016. ECF No. 10. The parties’ agreed discovery order was filed on July 1, 2016. ECF No. 11. On July 29, 2016, the defense wrote a letter to the government seeking discovery of further information.
The Defendant filed the First and Second Motions to Suppress and the Motion to Compel Discovery, on July 29, 2016. ECF Nos. 14,15,16. The First and Second Motions to Suppress requested evidentiary hearings. The government filed its Responses on August 12, 2016. ECF Nos. 19, 20, 21. The Defendant filed Replies to these Responses on August 17, 2016. ECF Nos. 27, 28, 29. On August 22, 2016, the Defendant filed a Notice of Request for a Hearing on his First Motion to Suppress, Second Motion to Suppress, and Motion to Compel. ECF No. 30. The court held a hearing on the Motions to Suppress and Motion to Compel on November 1, 2016. ECF No. 89. At the hearing, FBI Special Agent McFarlane was called as a witness by telephone, as agreed upon by the parties. See Joint Motion to Continue Trial, ECF No. 36 at 2.
III. FIRST MOTION TO SUPPRESS
A. Legal Standard
When police undertake a search in order to discover evidence of a crime, the Fourth Amendment’s reasonableness standard generally requires them to obtain a search warrant. Riley v. California, — U.S. —, 134 S.Ct. 2473, 2482, 189 L.Ed.2d 430 (2014)(quoting Vernonia School Dist. 47J v. Acton, 515 U.S. 646, 653, 115 S.Ct. 2386, 132 L.Ed.2d 564 (1995)). A successful application for a search warrant must be sufficient to support a finding of probable cause by a neutral, detached magistrate. United States v. Leon, 468 U.S. 897, 915, 104 S.Ct. 3405, 82 L.Ed.2d 677 (1984). Probable cause requires that, given the totality of the circumstances, “there is a fair probability that contraband or evidence of a crime will be found in a particular place.” Illinois v. Gates, 462 U.S. 213, 238, 103 S.Ct. 2317, 76 L.Ed.2d 527 (1983). If a defendant shows that the affiant included a false statement knowingly and intentionally, or with reckless disregard for the truth, in the warrant affidavit and that false statement is necessary to find probable cause, the defendant is entitled to a hearing on the inaccuracies. Franks v. Delaware, 438 U.S. 154, 171, 98 S.Ct. 2674, 57 L.Ed.2d 667 (1978). When reviewing a magistrate’s determination of probable cause, district courts should
Even if a violation of the Fourth Amendment occurs, “suppression is not an automatic consequence.” Herring v. United States, 555 U.S. 135, 137, 129 S.Ct. 695, 172 L.Ed.2d 496 (2009). Rather, suppression is only appropriate where the blameworthiness of the police and the potential to deter police misconduct justify exclusion. Id. The exclusionary rule is a remedy of last resort; it is not an individual right. Id. at 140-41, 129 S.Ct. 695. The positive impacts of exclusion must outweigh the negative impacts of exclusion in order to merit application of the rule. Id. at 141, 129 S.Ct. 695. In accordance with these principles, evidence seized under a warrant that is invalid for lack of probable cause should not be excluded, if the police acted in good faith, defined as objectively reasonable reliance on the issued warrant. Id. at 142, 129 S.Ct. 695. Importantly, “when police mistakes are the result of negligence ... rather than systematic error or reckless disregard of constitutional requirements,” exclusion is improper. Id. at 147-48,129 S.Ct. 695.
B. Analysis
In the Defendant’s First Motion to Suppress, he argues that the fruits of the search conducted pursuant to the NIT Warrant should be suppressed for three reasons: (1) the NIT Warrant was unsupported by probable cause; (2) the FBI misled the issuing court with its description of Playpen’s homepage; and (3) the NIT Warrant was an anticipatory warrant for which the triggering event establishing probable cause did not occur. First Mot. to Suppress at 2-3. While the particulars of these three issues differ, all three share the same premise: probable cause to search the computers of Playpen users did not exist following the change to the images on Playpen’s homepage. Accordingly, if the finding of probable cause did not require the original images displayed on the homepage, the Defendant’s three arguments are meritless.
Courts in the Eastern District of Virginia have already ruled that this exact image change was not material to the probable cause determination. See, e.g., United States v. Matish, No. 4:16cr16, 193 F.Supp.3d 585, 593-94, 605-06, 2016 WL 3545776, at *2, *12 (E.D. Va. June 21, 2016)(Morgan, J.); United States v. Darby, No. 2:16cr36, 190 F.Supp.3d 520, 533-34, 2016 WL 3189703, at *9 (E.D. Va. June 3, 2016) (Doumar, J.). Additionally, the courts in this district ruled that, even if the image change had been material, suppression would be improper. See, e.g., Matish, 193 F.Supp.3d at 593-94, 605-06, 2016 WL 3545776, at *2, *12; United States v. Eure, No. 2:16cr43, 2016 WL 4059663, at *7 (E.D. Va. July 28, 2016) (Doumar, J.). The court finds no reason to depart from these rulings, as explained below.
1. Neither the Issuance nor the Execution of the NIT Warrant Violated the Fourth Amendment
In his First Motion to Suppress, the Defendant argues that the search of his home computer was undertaken pursuant to a warrant unsupported by probable cause. Because the Magistrate’s probable cause determination is awarded great deference, the Defendant would need to show that the finding was not supported by substantial evidence in the record, or that the finding was based on a knowingly or recklessly false affidavit, in order to successfully challenge the probable cause determination. The Defendant does not make this
Far from being an essential component of the probable cause determination, the description of images on the homepage is insignificant compared to the other information found in the affidavit. Replacing “the user sees images of prepubescent females partially clothed and whose legs are spread” with something like “the user sees an image of a female who appears to be pre-pubescent and is clothed in a short dress and thigh-high fishnet stockings” does not have any appreciable effect on the perceived or actual nature of the website. The Defendant’s statement that the description of the logo on the homepage “was a pivotal component of the affiant’s allegations in support of probable cause,” First Mot. to Suppress at 20, offends common sense: the addition of thigh-high fishnet stockings to a picture of a scantily clad young girl hardly makes an image less sexually suggestive, regardless of whether she can technically be considered “fully clothed.” See Matish, 193 F.Supp.3d at 606, 2016 WL 3545776, at *12 (stating that “the logo change lacks significance”); Darby, 190 F.Supp.3d at 531, 2016 WL 3189703,at *7 (noting that the distinction between the images “does not subtract from the sexualized nature” of the later image). As the Defendant points out, the female in the later image merely “appears to be young,” and it is unclear that she is prepubescent. First Mot. to Suppress at 9. However, the government need not establish the ages of the subjects to a clear certainty- for purposes of probable cause.
The Defendant maintains that, because Playpen’s illegal nature was not readily apparent, some computer users may have unwittingly accessed Playpen and then “balked and clicked away.” Reply to Resp. to First Mot. to Suppress at 4. The Defendant argues that, because the NIT Warrant did not distinguish between “accidental browsers” and “people actively seeking child pornography,” any “accidental browsers” would have been inappropriately targeted by the NIT Warrant. First Mot. to Suppress at 16-17. The possible means of accessing Playpen are disputed between the government and the defense. The government asserts that, because of Playpen’s “hidden service” status on the Tor network, “users must know the exact web address” in order to reach the site. Resp. to First Mot. to Suppress at 6. The Defendant theorizes that Playpen might have been located via an index of sites located on the Tor network. Fust Mot. to Suppress at 21-22. However, the site need not be “hidden” for the probable cause finding to remain valid. A probable cause finding “does not deal with hard certainties, but with probabilities.” Illinois v. Gates, 462 U.S. 213, 231, 103 S.Ct. 2317, 76 L.Ed.2d 527 (1983) (quoting United States v. Cortez, 449 U.S. 411, 418, 101 S.Ct. 690, 66 L.Ed.2d 621 (1981)). There was a substantial basis for the Magistrate Judge to conclude that a computer user accessing Playpen was doing so in order to view child pornography, whether Playpen was located via an index or by entering the exact web address. See Darby, 190 F.Supp.3d at 532-33, 2016 WL 3189703, at *8. “[T]he Fourth Amendment requires no more.” Gates, 462 U.S. at 236, 103 S.Ct. 2317.
Regardless of whether the technical language on the homepage and the site’s location on the Tor network indicated criminality, it stands to reason that the casual accidental visitor probably would not locate the Playpen site on the Tor network, let alone create a username and password in order to log into the site, without having any idea as to what the site contained. The fact is that Playpen did contain child pornography, and the affiant knew it contained child pornography. Playpen’s content, not its homepage, was the necessary factor in the probable cause determination. See Matish, 193 F.Supp.3d at 604-05, 2016 WL 3545776, at *11; Darby, 190 F.Supp.3d at 532-33, 2016 WL 3189703, at *8. There is at least a reasonable probability that evidence of a crime related to child pornography will be found on a computer that one uses to register with a website that displays child pornography, regardless of whether the homepage alone makes it obvious that the site is a child pornography site. See Darby, 190 F.Supp.3d at 532-33, 2016 WL 3189703, at *8. Therefore, while the information and image found on the homepage buttressed the conclusion that Playpen was a child pornography site, they were not essential to that conclusion.
The Defendant notes that visitors would have been able to navigate to legal content, such as fictional stories of the “child erotica” variety, without ever accessing child pornography. First Mot. to Suppress at 10, 17. This assertion is contrary to the Defendant’s argument that the homepage did not give any indication as to the site’s contents. It is improbable that anyone would go to the trouble of registering for the site in order to look for fictional stories likely available elsewhere on the Internet. The user had to (1) either know the URL or locate Playpen via a Tor index, (2) go to the homepage, (3) click past the warning that only members were permitted, (4) create a username, and (5) create a password. NIT Search Warrant and Application at 17-19. Given the totality of the circumstances, substantial support underlies the probable cause finding, and the Defendant has not shown otherwise.
The Defendant next argues in his First Motion to Suppress that “the FBI intentionally or recklessly misled the issuing court about how the sité appeared, among other false and misleading statéments.” First Mot. to Suppress at 2. The affidavit makes clear that the affiant examined Playpen on February 18, 2015, one day before the logo change. See NIT Search Warrant and Application at 17-18, n.3; Resp. to First Mot. to Suppress at 15. Thus, it is unclear that the affiant’s description of Playpen as it appeared on that day was a misrepresentation at all, let alone an intentional or reckless one.
2. Suppression Would Be Inappropriate Here, Even if the Fourth Amendment Was Violated
It is true that the affiant’s description of the images depicted on the Playpen homepage was not the same as the images that appeared on the homepage at the time the NIT Warrant Application was filed. However, this inaccuracy is not indicative of the sort of culpability that would warrant suppression of the fruits of the NIT Warrant search. This FBI operation was a time-sensitive one: the home search of the then-operator of Playpen was the day before the NIT Warrant application was submitted, and the image on the homepage was changed shortly before the search. A delay in the NIT Warrant would have meant a delay in the detection of users downloading child pornography. See Eure, at *7. The time-sensitive nature of the operation lessens the culpability of agents who failed to correct what was, in the entire scheme of things, a small error. As courts in the Eastern District have held, under these facts, suppression would not be justified, even if the Fourth Amendment had been violated. See,. e.g., id.; Matish, 193 F.Supp.3d at 622-23, 2016 WL 3545776, at *25. The court, however, is of the opinion that no Fourth Amendment violation occurred here.
II. SECOND MOTION TO SUPPRESS
A. Legal Standards
Rule 41(b) of the Federal Rules of Criminal Procedure has been explicitly incorporated by the Federal Magistrates Act. 28 U.S.C. § 636(a)(1). Rule 41(b) establishes jurisdictional authority of magistrate judges to issue certain search warrants. Violations of Rule 41 are either constitutional or non-constitutional in na
B. Analysis
The Defendant’s Second Motion to Suppress asserts that the fruits of the search should be suppressed for two reasons: (1) the NIT Warrant was void, because the Magistrate Judge lacked jurisdiction to issue it under the Federal Magistrates Act; and, alternatively, (2) the Defendant was prejudiced by the government’s allegedly deliberate violation of Rule 41(b). Second Mot. to Suppress at 1-2. Courts in the Eastern District of Virginia have already ruled that the Magistrate Judge had jurisdictional authority to issue this same Warrant in regard to three other defendants. See Matish, 193 F.Supp.3d at 611-12, 2016 WL 3545776, at *17; Darby, 190 F.Supp.3d at 536-37, 2016 WL 3189703, at *12; Eure, at *4.
The Defendant’s argument is that Rule 41(b) did not permit the Magistrate Judge to issue the NIT Warrant, jaecause the Rule only permits magistrate judges to issue warrants for searches outside their districts in limited circumstances. See Second Mot. to Suppress at 1-2. Here, the Magistrate Judge issued the NIT warrant against any computer that logged into Playpen and made contact with the server located in the Eastern District of Virginia, regardless of the computer’s location. Importantly, Rule 41(b)(4) permits magistrate judges to issue warrants for tracking devices installed within their own districts. Fed. R. Crim. P. 41(b)(4). Such tracking devices, provided'they are installed within the district, can permissibly operate even after the device leaves the district where it was installed. See id. As held by two recent opinions in this district, what occurred here is analogous to these cases. See Matish, 193 F.Supp.3d at 612-14, 2016 WL 3545776, at *18; Darby, 190 F.Supp.3d at 536-37, 2016 WL 3189703, at *12. When users logged into Playpen, located on a server in the Eastern District of Virginia, an application launched the NIT coding, only in response to which the users’ computers sent messages to the government server. Darby/Eure Hearing Transcript, ECF No. 21-4, at 11:12-13. The Defendant focuses on the locations of the activating computers, but in order to become an activating computer user, the user had to visit Playpen, which was located in the Eastern .District of Virginia. Whether the subsequent “tracking” of the identifying information can be said to have physically occurred in this district is a complicated technological’ question, but it is also a question that misses the point. Here, users picked up an application from a site located in this district. Accordingly, the court FINDS that the Magistrate Judge did not violate Rule 41(b) by issuing the NIT warrant.
Regardless, suppression would not be warrantéd under these circumstances. The Defendant argues for suppression on both constitutional and non-constitutional theories of Rule 41(b) violation. The Defendant’s constitutional theory echoes his general Rule 41(b) violation argument: the NIT Warrant’s issuance violated Rule 41(b), voiding the Warrant, and consequently, dooming its execution to violate the Fourth Amendment. However, violation of the Fourth Amendment does not result in automatic suppression of the fruits of the violating search, as discussed above. The conduct of FBI agents here cannot be accurately described as sufficiently culpable or deliberate to warrant suppression. See Darby, 190 F.Supp.3d at 538-39, 2016 WL 3189703, at *14. They
III. MOTION TO COMPEL A. Legal Standards
The government must permit, upon a defendant’s request, the inspection of items within the government’s control, if (1) the item is material to defense preparation, (2) the government intends to use the item in its case-in-chief, or (3) the item belongs to the defendant. Fed. R. Crim. P. 16(a)(1)(E). A showing of materiality requires that “pretrial disclosure of the disputed evidence would have enabled the defendant significantly to alter the quantum of proof in his favor.” United States v. Caro, 597 F.3d 608, 621 (4th Cir. 2010)(quoting United States v. Ross, 511 F.2d 757, 763 (5th Cir. 1975), cert, denied, 423 U.S. 836, 96 S.Ct. 62, 46 L.Ed.2d 54). The defendant bears the burden of showing materiality. Id. (quoting United States v. Lloyd, 992 F.2d 348, 351 (D.C. Cir. 1993)). More narrowly, the Due Process Clause requires that, upon request, the government disclose favorable evidence that is material to guilt or punishment of the accused. Brady v. Maryland, 373 U.S. 83, 87, 83 S.Ct. 1194, 10 L.Ed.2d 215 (1963). A materiality showing under Brady requires a reasonable probability that the result would have been different, if the government had disclosed the evidence sought. Caro, 597 F.3d at 619.
Even if evidence is material, the law enforcement privilege can prevent its disclosure. The Fourth Circuit has not directly addressed the law enforcement privilege. However, the privilege has been addressed, in this specific context, by courts in the Eastern District of Virginia. See, e.g., Matish, 193 F.Supp.3d at 596-97, 2016 WL 3545776, at *5 (stating that the law enforcement privilege is a qualified privilege, subject to a balancing test, that covers information pertaining to law enforcement techniques and procedures).
B. Analysis
The Defendant argues that the NIT exploit source code and the unique identifier generator are material to his defense. Mot. to Compel at 2. The government argues that (1) these components are not material to defense preparation, and (2) these components are protected by the law enforcement privilege. See Resp. to Mot. to Compel at 4, 21. The Defendant presents a variety of hypothetical situations in which the exploit code and the unique identifier generator could be material to defense preparation. See Reply to Resp. to Mot. to Compel at 3. However, the Defendant has not shown that pretrial disclosure of the disputed evidence would significantly alter the quantum of proof in his favor.
The Defendant seeks disclosure of the unique identifier generator in order to determine whether the NIT accurately identified him. Id. at 7-8. For example, the Defendant discusses the possibility that the code created duplicate identifiers, which he implies would render the identification unreliable. Id. at 6-8. A declara
The Defendant also seeks disclosure of the source code for the exploit that enabled the government to deploy the NIT. Mot. to Compel at l.
The Defendant expresses concern that the exploit could have compromised the security of his computer,, allowing other individuals to put child pornography on the machine. Reply to Resp. to Mot. to Compel at 8. He has not submitted any evidence that these things occurred. Special Agent Alfin has said in his declaration that these things did not occur. ECF No. 21-7 at 3. The Defendant’s speculation, without more, is insufficient to show materiality. Moreover, the Defendant knows what was in his computer and the government has offered to let the Defendant examine his computer for signs of hacking. Resp. to Mot. to Compel at 13. Again, the Defendant has not taken advantage of this offer, and has presented no evidence that his computer was hacked.
The Defendant also claims that the exploit source code is material because it would enable him to determine whether government representations of how the
Because the Defendant has not shown the materiality of the discovery sought, the Defendant’s Motion to Compel is DENIED.
IV. CONCLUSION
For the foregoing reasons, the court FINDS that the NIT Warrant was valid and supported by probable cause, and that neither the exploit source code nor the unique identifier generator are material to defense preparation. Accordingly, the Defendant’s Motions to Suppress, ECF Nos. 14 and 15, and the Defendant’s Motion to Compel, ECF No. 16, are DENIED. The Clerk is DIRECTED to send a copy of this Memorandum Opinion and Order to the Federal Public Defender at Norfolk and the United States Attorney at Norfolk.
IT IS SO ORDERED.
. This identifying information included: (1) the activating computer’s IP address, and the date and time that the NIT determined what that IP address was; (2) a unique identifier generated by the NIT; (3) the type of operating system running on the computer, including type, version, and architecture; (4) information about whether the NIT has already been delivered to the activating computer; (5) the activating computer's Host Name; (6) the activating computer’s active operating system username; and (7) the activating computer's media access control ("MAC”) address. NIT Search Warrant and Application at 4.
. The discovery sought by the Defendant included "copies of the source code for all software that the government used to identify Mr. McLamb, including the payload or 'NIT'; the exploit; the ‘unique identifier’ generator; and the server software.” ECF No. 21-5 at 1. In the Motion to Compel Discovery, the Defendant asks the court to compel production of "the source code or programming code for the exploit that the government used to gain access to Mr. McLamb’s computer” and "the unique identifier generator through which the government purports to link Mr. McLamb to particular activity on the Playpen website.” Mot. to Compel at 1. The Defendant’s expert. Dr. Matthew Miller, defines "exploit” as "a piece of software that takes advantage of a flaw in a computer system.” Miller Deck, ECF No. 16-3 at 2.
. See supra pp. 669-71.
. The court held an evidentiary hearing on November 1, 2016. ECF No. 39. Any further hearing into the matter is not warranted, because, as discussed herein, the Defendant has not shown the affiant included a false state
. See supra note 2.
. This court need not reach the issue of whether the law enforcement privilege applies. However, one court within the Eastern District of Virginia has held that the law enforcement privilege would apply to the discovery sought, because the public interest in nondisclosure outweighs the interest of one particular litigant. See Matish, 193 F.Supp.3d at 600-01, 2016 WL 3545776, at *8. Having reviewed in camera the Government's Ex Parte, In Camera Classified Memorandum of Law in Support of Assertion of Law Enforcement Privilege, the court here agrees with the conclusion in Matish.
Reference
- Full Case Name
- United States v. Robert MCLAMB
- Cited By
- 5 cases
- Status
- Published