Searching over 5,500,000 cases.

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

United States v. Eure

United States District Court, E.D. Virginia, Norfolk Division

July 28, 2016


          Hunter Vaughan Eure, Defendant, represented by Richard Joseph Colgan, Office of the Federal Public Defender & Andrew William Grindrod, Office of the Federal Public Defender.

          USA, Plaintiff, represented by Elizabeth M. Yusi, United States Attorney's Office & Leslie W. Fisher, United States Attorney Office.


          ROBERT G. DOUMAR, Senior District Judge.

         This matter comes before the Court on two Motions to Suppress filed by Hunter Vaughan Cure ("Defendant"). ECF Nos. 21, 22. On July 5, 2016, the Court held a hearing on these and other motions. Hr'g, ECF No. 44. From the bench the undersigned DENIED Defendant's First Motion to Suppress, ECF No. 21, and DENIED Defendant's Second Motion to Suppress, ECF No. 22. This memorandum opinion memorializes the reasons for these denials.

         I. BACKGROUND

         The instant prosecution is the result of an FBI investigation into a website that facilitated the distribution of child pornography. The government seized control of this website and for a brief period of time operated it from a government facility in the Eastern District of Virginia. Both Motions to Suppress seek to exclude all evidence obtained as the result of a search warrant that allowed the government to use the website to remotely search the computers of individuals who logged into the website.

         The following summary is provided as way of background. The basic details of the investigation are not in dispute. Most of the information summarized here has been drawn from the warrant application, Appl. for a Search Warrant ("Warrant Appl."), ECF No. 21-1. specifically the affidavit in support of the warrant sworn to by FBI Special Agent Douglas Macfarlane. Aff. in Supp. of Appl. for Search Warrant ("Macfarlane Aff."), ECF No. 21-2 at 2. Additional details undisputed by the parties in their briefing are included mainly to till out the narrative. For instance, neither the warrant nor warrant application identify the website and both refer to it simply as "TARGET WEBSITE." See Macfarlane Aff. ¶ 4. As explained in the affidavit in support of the warrant, at the lime the warrant application was submitted the website was still active. Id . ¶ 2 n.1. The government was concerned that disclosure of the name of the website in the application would alert potential users of the site to the government's investigation and thus undermine it. Id . The government has ceased operation of the website, and the name of the website has been widely reported.[1] Both parties refer to the website by its name: Playpen.

         Playpen operated on the Tor network, which provides more anonymity to its users than the regular Internet.[2] Macfarlane Aff. ¶¶ 7-8. The Tor network was developed by the U.S. Naval Research Laboratory and is now accessible to the general public. Id . ¶ 7. Users of the Tor network must download special software that lets them access the network. Id . Typically, when an individual visits a website, the website is able to determine the individual's Internet Protocol ("IP") address. See id. ¶ 8. An individual's IP address is associated with a particular Internet Service Provider ("ISP") and particular ISP customer. Id . ¶ 35. Because internet access is typically purchased for a single location, an IP address may be used by law enforcement to determine the home or business address of an internet user. See id. When a user accesses the Tor network, communications from that user are routed through a system of network computers that are run by volunteers around the world. Id . ¶ 8. When a user connects to a website, the only IP address that the website "sees" is the IP address of the last computer through which the user's communications were routed. Id . This final relay is called an exit node. Id . Because there is no practical way to trace a user's communications from the exit node back to the user's computer, users of the Tor network are effectively anonymous to the websites they visit, Id.

         The Tor network also provides anonymity to individuals who run websites or forums on it. Id . ¶ 9. Websites may be set up on the Tor network as "hidden services." Id . A hidden service may only be accessed through the Tor network. Id . A hidden service functions much like a regular website except that its IP address is bidden. Id . The IP address is replaced with a Tor-based address which consists of a series of alphanumeric characters followed by ".onion." Id . There is no way to look up the IP address of the computer hosting a hidden service, Id.

         A user of the Tor network cannot simply perform a search to find a hidden service that may interest the user, Id . ¶ 10. In order to access a hidden service a user must know the Tor-based address of the hidden service. Id . As a result, a user cannot simply stumble onto a hidden service, Id . The user may obtain the address from postings on the Internet or by communications with other users of the Tor network. Id . One hidden service may also link to another. See id. Playpen was a hidden service contained on the Tor network, and it had been linked to by another hidden service that was dedicated to child pornography. Id.

         Of importance to the First Motion to Suppress is the homepage of the Playpen site. See Def.'s First Mot. to Suppress ("First Mot."), ECF No. 21 at 2-3. In the warrant application, the homepage is said to contain "images of prepubescent females partially clothed and whose legs are spread." Macfarlane Aff. ¶ 12. A screenshot of this version of the homepage has been attached to the briefing. FCF No. 27-4. There appears to have just been two photographs on the homepage. The images show two young girls in the attire and pose described. Id . The images of these children appear at the top of the homepage and flank a large image of the site's name, Playpen. Id . In their briefing, the parties describe the combination of these images and the site name as the site logo. Although these images were at an earlier point on the homepage, the parties agree that at the lime the warrant was signed, on February 20, 2015 at 11:45 a.m., a different logo confronted users to the site. First Mot. at 8-9; Gov't's Resp. to Def.'s First Mot. to Suppress ("Gov't's Resp. to First Mot."), ECF No. 27 at 14-15. A screenshot of this version of the homepage has also been included in the briefing. ECF No. 17-5. There is an image of a young girl with her legs crossed, reclined on a chair, wearing stockings that stop at her upper thigh and a short dress or top that exposes the portion of her upper thigh not covered by the stockings. Id . Her image is to the left of the site name in this version of the site logo, Id.

         The government claims that the images must have changed shortly before the warrant was signed. Gov't's Resp. to First Mot. at 14-15. In the affidavit in support of the warrant. Special Agent Macfarlane recounts that FBI agents monitored the Playpen website from September 16, 2014 to February 3, 2015. Macfarlane Aff. ¶ 11. The screenshot of the homepage that was included in the government's brief and contains the images of the two young girls was taken on February 3, 2015. ECF No. 27-4. The date is visible in the lower right corner of the screen, Id . The affidavit further states that sometime between February 3, 2015 and February 18, 2015, the Tor address of the site was changed. Macfarlane Aff. ¶ 11 n.3. Special Agent Macfarlane slates in his affidavit that after the address change he "accessed the TARGKT WEBSITE in an undercover capacity at its new URL, and determined that its content had not changed." Id . In its briefing the government asserts that this statement confirms that the homepage of Playpen was as described in the warrant application on February 18, 2015, two days before the warrant was sworn and signed. Gov't's Resp. to First Mot. at 14-15.

         The homepage also provided users with instructions on how to join and then log into the site. Macfarlane Aff. ¶ 12. Users had to register with the site before going any further into the site. Id . Users were instructed to enter a phony email address and to create a login name and password, Id . ¶ 13. The instructions also informed users that the owners of the site and staff were unable to determine the true identity of users and that the website could not sec the IP addresses of users. Id.

         Once registered and logged into the site users had access to numerous sections, forums, and sub-forums where they could upload material and view material uploaded by others. Id . ¶ 14. For instance under the heading "Playpen Chan"[3] are four subcategories: "Jailbait - Boy, " "Jailbait - Girl." "Preteen - Boy." and "Preteen - Girl." Id . Special Agent Macfarlane, based on his training and experience, explains that "jailbait" refers to underage but post-pubescent minors. Id . ¶ 14 n.4. Other forum and sub-forum categories on the site include "Jailbait videos, " "Family Playpen - Incest, " "Toddlers, " and "Bondage." Id . ¶ 14. Not surprisingly, a review of the contents of these forums revealed that the majority of content was child pornography. Id . 18. The warrant application has several specific examples of the reprehensible material contained on the site. Id . ¶¶ 18, 23-25. Additionally, there was a section of the site that allowed members of the site to exchange usernames on a Tor-based instant messaging service known to law enforcement to be "used by subjects engaged in the online sexual exploitation of children." Id . ¶ 15.

         In December of 2014, a foreign law enforcement agency informed the FBI that it suspected that a United States-based IP address was the IP address of Playpen. Id . 28. In January 2015, after obtaining a search warrant, the FBI seized the IP address and copied the contents of the website. Id . ¶ 28. On February 19, 2015 the FBI arrested the individual suspected of administering Playpen. Id . ¶ 30.

         The FBI desired to continue to operate Playpen for a limited time so as to identity individuals who logged into the site and who were likely to possess, distribute, or produce child pornography, Id . 30. The FBI would operate the site from a location in the Eastern District of Virginia, Id . ¶ 33. As mentioned above, normally a website administrator is able to determine the IP addresses of those individuals that visit the site. However, on the Tor network the website administrator is only able to determine the IP address of the exit node, which it not the IP-address of the visitor to the website. To determine the IP addresses of individuals who logged into Playpen, the FBI sought a warrant from a magistrate judge in the Eastern District of Virginia, Alexandria Division that would allow it to deploy a Network Investigative Technique ("NIT"). Id . 31.

         According to the FBI in the warrant application, when an individual visits a website the website sends "content" to the individual, Id . ¶ 33. This content is downloaded by the individual's computer and used to display the webpage on the computer. Id . A NIT "augments" the content with additional instructions, Id . The NIT deployed in the instant case instructed the computers of those individuals who logged into Playpen to send to a computer "controlled by or known to the government" certain information, Id . The information that the NIT would instruct the computers to send is described in an attachment to the warrant application. Attach. B. Warrant Appl., ECF No. 21-1 at 3. The NIT extracted from any "activating computer"-that is, a computer that logged into Playpen using a username and password-(1) the IP address of the computer and the date and time this information is determined, (2) a unique identifier that distinguishes the data from this activating computer from that of others, (3) the type of operating system used by the ...

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.