United States District Court, E.D. Virginia, Norfolk Division
Vaughan Eure, Defendant, represented by Richard Joseph
Colgan, Office of the Federal Public Defender & Andrew
William Grindrod, Office of the Federal Public Defender.
Plaintiff, represented by Elizabeth M. Yusi, United States
Attorney's Office & Leslie W. Fisher, United States
G. DOUMAR, Senior District Judge.
matter comes before the Court on two Motions to Suppress
filed by Hunter Vaughan Cure ("Defendant"). ECF
Nos. 21, 22. On July 5, 2016, the Court held a hearing on
these and other motions. Hr'g, ECF No. 44. From the bench
the undersigned DENIED Defendant's First Motion to
Suppress, ECF No. 21, and DENIED Defendant's Second
Motion to Suppress, ECF No. 22. This memorandum opinion
memorializes the reasons for these denials.
instant prosecution is the result of an FBI investigation
into a website that facilitated the distribution of child
pornography. The government seized control of this website
and for a brief period of time operated it from a government
facility in the Eastern District of Virginia. Both Motions to
Suppress seek to exclude all evidence obtained as the result
of a search warrant that allowed the government to use the
website to remotely search the computers of individuals who
logged into the website.
following summary is provided as way of background. The basic
details of the investigation are not in dispute. Most of the
information summarized here has been drawn from the warrant
application, Appl. for a Search Warrant ("Warrant
Appl."), ECF No. 21-1. specifically the affidavit in
support of the warrant sworn to by FBI Special Agent Douglas
Macfarlane. Aff. in Supp. of Appl. for Search Warrant
("Macfarlane Aff."), ECF No. 21-2 at 2. Additional
details undisputed by the parties in their briefing are
included mainly to till out the narrative. For instance,
neither the warrant nor warrant application identify the
website and both refer to it simply as "TARGET
WEBSITE." See Macfarlane Aff. Â¶ 4. As explained in the
affidavit in support of the warrant, at the lime the warrant
application was submitted the website was still active.
Id . Â¶ 2 n.1. The government was concerned that
disclosure of the name of the website in the application
would alert potential users of the site to the
government's investigation and thus undermine it.
Id . The government has ceased operation of the
website, and the name of the website has been widely
reported. Both parties refer to the website by
its name: Playpen.
operated on the Tor network, which provides more anonymity to
its users than the regular Internet. Macfarlane Aff. Â¶Â¶
7-8. The Tor network was developed by the U.S. Naval Research
Laboratory and is now accessible to the general public.
Id . Â¶ 7. Users of the Tor network must download
special software that lets them access the network.
Id . Typically, when an individual visits a website,
the website is able to determine the individual's
Internet Protocol ("IP") address. See id. Â¶ 8. An
individual's IP address is associated with a particular
Internet Service Provider ("ISP") and particular
ISP customer. Id . Â¶ 35. Because internet access is
typically purchased for a single location, an IP address may
be used by law enforcement to determine the home or business
address of an internet user. See id. When a user accesses the
Tor network, communications from that user are routed through
a system of network computers that are run by volunteers
around the world. Id . Â¶ 8. When a user connects to
a website, the only IP address that the website
"sees" is the IP address of the last computer
through which the user's communications were routed.
Id . This final relay is called an exit node.
Id . Because there is no practical way to trace a
user's communications from the exit node back to the
user's computer, users of the Tor network are effectively
anonymous to the websites they visit, Id.
network also provides anonymity to individuals who run
websites or forums on it. Id . Â¶ 9. Websites may be
set up on the Tor network as "hidden services."
Id . A hidden service may only be accessed through
the Tor network. Id . A hidden service functions
much like a regular website except that its IP address is
bidden. Id . The IP address is replaced with a
Tor-based address which consists of a series of alphanumeric
characters followed by ".onion." Id .
There is no way to look up the IP address of the computer
hosting a hidden service, Id.
of the Tor network cannot simply perform a search to find a
hidden service that may interest the user, Id . Â¶
10. In order to access a hidden service a user must know the
Tor-based address of the hidden service. Id . As a
result, a user cannot simply stumble onto a hidden service,
Id . The user may obtain the address from postings
on the Internet or by communications with other users of the
Tor network. Id . One hidden service may also link
to another. See id. Playpen was a hidden service contained on
the Tor network, and it had been linked to by another hidden
service that was dedicated to child pornography. Id.
importance to the First Motion to Suppress is the homepage of
the Playpen site. See Def.'s First Mot. to Suppress
("First Mot."), ECF No. 21 at 2-3. In the warrant
application, the homepage is said to contain "images of
prepubescent females partially clothed and whose legs are
spread." Macfarlane Aff. Â¶ 12. A screenshot of this
version of the homepage has been attached to the briefing.
FCF No. 27-4. There appears to have just been two photographs
on the homepage. The images show two young girls in the
attire and pose described. Id . The images of these
children appear at the top of the homepage and flank a large
image of the site's name, Playpen. Id . In their
briefing, the parties describe the combination of these
images and the site name as the site logo. Although these
images were at an earlier point on the homepage, the parties
agree that at the lime the warrant was signed, on February
20, 2015 at 11:45 a.m., a different logo confronted users to
the site. First Mot. at 8-9; Gov't's Resp. to
Def.'s First Mot. to Suppress ("Gov't's
Resp. to First Mot."), ECF No. 27 at 14-15. A screenshot
of this version of the homepage has also been included in the
briefing. ECF No. 17-5. There is an image of a young girl
with her legs crossed, reclined on a chair, wearing stockings
that stop at her upper thigh and a short dress or top that
exposes the portion of her upper thigh not covered by the
stockings. Id . Her image is to the left of the site
name in this version of the site logo, Id.
government claims that the images must have changed shortly
before the warrant was signed. Gov't's Resp. to First
Mot. at 14-15. In the affidavit in support of the warrant.
Special Agent Macfarlane recounts that FBI agents monitored
the Playpen website from September 16, 2014 to February 3,
2015. Macfarlane Aff. Â¶ 11. The screenshot of the homepage
that was included in the government's brief and contains
the images of the two young girls was taken on February 3,
2015. ECF No. 27-4. The date is visible in the lower right
corner of the screen, Id . The affidavit further
states that sometime between February 3, 2015 and February
18, 2015, the Tor address of the site was changed. Macfarlane
Aff. Â¶ 11 n.3. Special Agent Macfarlane slates in his
affidavit that after the address change he "accessed the
TARGKT WEBSITE in an undercover capacity at its new URL, and
determined that its content had not changed."
Id . In its briefing the government asserts that
this statement confirms that the homepage of Playpen was as
described in the warrant application on February 18, 2015,
two days before the warrant was sworn and signed.
Gov't's Resp. to First Mot. at 14-15.
homepage also provided users with instructions on how to join
and then log into the site. Macfarlane Aff. Â¶ 12. Users had
to register with the site before going any further into the
site. Id . Users were instructed to enter a phony
email address and to create a login name and password,
Id . Â¶ 13. The instructions also informed users that
the owners of the site and staff were unable to determine the
true identity of users and that the website could not sec the
IP addresses of users. Id.
registered and logged into the site users had access to
numerous sections, forums, and sub-forums where they could
upload material and view material uploaded by others.
Id . Â¶ 14. For instance under the heading
"Playpen Chan" are four subcategories:
"Jailbait - Boy, " "Jailbait - Girl."
"Preteen - Boy." and "Preteen - Girl."
Id . Special Agent Macfarlane, based on his training
and experience, explains that "jailbait" refers to
underage but post-pubescent minors. Id . Â¶ 14 n.4.
Other forum and sub-forum categories on the site include
"Jailbait videos, " "Family Playpen - Incest,
" "Toddlers, " and "Bondage."
Id . Â¶ 14. Not surprisingly, a review of the
contents of these forums revealed that the majority of
content was child pornography. Id . 18. The warrant
application has several specific examples of the
reprehensible material contained on the site. Id .
Â¶Â¶ 18, 23-25. Additionally, there was a section of the site
that allowed members of the site to exchange usernames on a
Tor-based instant messaging service known to law enforcement
to be "used by subjects engaged in the online sexual
exploitation of children." Id . Â¶ 15.
December of 2014, a foreign law enforcement agency informed
the FBI that it suspected that a United States-based IP
address was the IP address of Playpen. Id . 28. In
January 2015, after obtaining a search warrant, the FBI
seized the IP address and copied the contents of the website.
Id . Â¶ 28. On February 19, 2015 the FBI arrested the
individual suspected of administering Playpen. Id .
desired to continue to operate Playpen for a limited time so
as to identity individuals who logged into the site and who
were likely to possess, distribute, or produce child
pornography, Id . 30. The FBI would operate the site
from a location in the Eastern District of Virginia,
Id . Â¶ 33. As mentioned above, normally a website
administrator is able to determine the IP addresses of those
individuals that visit the site. However, on the Tor network
the website administrator is only able to determine the IP
address of the exit node, which it not the IP-address of the
visitor to the website. To determine the IP addresses of
individuals who logged into Playpen, the FBI sought a warrant
from a magistrate judge in the Eastern District of Virginia,
Alexandria Division that would allow it to deploy a Network
Investigative Technique ("NIT"). Id . 31.
to the FBI in the warrant application, when an individual
visits a website the website sends "content" to the
individual, Id . Â¶ 33. This content is downloaded by
the individual's computer and used to display the webpage
on the computer. Id . A NIT "augments" the
content with additional instructions, Id . The NIT
deployed in the instant case instructed the computers of
those individuals who logged into Playpen to send to a
computer "controlled by or known to the government"
certain information, Id . The information that the
NIT would instruct the computers to send is described in an
attachment to the warrant application. Attach. B. Warrant
Appl., ECF No. 21-1 at 3. The NIT extracted from any
"activating computer"-that is, a computer that
logged into Playpen using a username and password-(1) the IP
address of the computer and the date and time this
information is determined, (2) a unique identifier that
distinguishes the data from this activating computer from
that of others, (3) the type of operating system used by the