Searching over 5,500,000 cases.

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

United States v. McLamb

United States District Court, E.D. Virginia, Norfolk Division

November 28, 2016




         This matter comes before the court on the Defendant's First Motion to Suppress, Second Motion to Suppress, and Motion to Compel. ECF Nos. 14, 15, 16. In his Motions to Suppress, the Defendant seeks to suppress evidence the government obtained, pursuant to a warrant, through use of the Network Investigative Technique ("NIT") code that enabled the government to access information on the Defendant's personal computer. First Mot. to Suppress at 1; Second Mot. to Suppress at 1. In his Motion to Compel, the Defendant seeks to compel discovery of two components of the NIT: (1) the unique identifier generator, and (2) the exploit source code. Mot. to Compel at 1. After full briefing and a hearing on the Motions, the matter is ripe for decision. For the reasons stated herein, these Motions to Suppress and the Motion to Compel are DENIED.


         The Defendant was charged following an investigation into a website called "Playpen, " which the government asserts operated as a child pornography site. First Mot. to Suppress at 4. The Playpen website was unusual in that it operated on what is known as the "Tor" network. See id. The Tor network enables its users to conceal their Internet Protocol ("IP") addresses, after they download the Tor browser from the Tor website. See id. IP addresses, if not hidden by either manual configuration or use of the Tor browser, can readily identify users. See Resp. to First Mot. to Suppress at 6. The Tor network aims to provide both users and operators of websites on the Tor network with anonymity. See id. Tor network users can use Tor indexes to locate these hidden services, which cannot be located on typical search engines, such as Google. See First Mot. to Suppress at 16. User communications on the Tor network are transmitted to various points among a network of computers before reaching their ultimate destination computer, and this makes identifying information, like IP addresses, more difficult to discover. Resp. to First Mot. to Suppress at 5. The government, however, can still recover identifying information, despite Tor network use, by way of the NIT. Id. at 7.

         On February 19, 2015, the Federal Bureau of Investigation ("FBI") arrested the then-operator of Playpen, gained control of the Playpen website, and thereafter operated it on a server in Virginia. Macfarlane Aff., ECF No. 14-2, ¶ 30. On February 20, 2015, the government obtained a warrant (''NIT Warrant") enabling it to use the NIT to investigate Playpen users. NIT Search Warrant and Application, ECF 19-9. The Defendant and the government disagree on the NIT's operation, but the basic concept is that, after a computer user logged into Playpen with a username and password, an application was authorized to send code, or computer instructions, to the user's computer. This code instructed the computer to send identifying information to a different, government-controlled computer.[1]

         While the NIT warrant authorized the NIT to be deployed as soon as a user logged into Playpen, here, the NIT was not deployed until a posting thread in the "kinky fetish-zoo subforum" was accessed. Resp. to Mot. to Compel at 18. After deploying the NIT, the FBI was able to identify an IP address associated with a particular Playpen username ("slutwhore") and trace that username to the Defendant. Resp. to First Mot. to Suppress at 7. On December 1, 2015, the government obtained a residential search warrant ("Second Warrant") for the Defendant's home. The Second Warrant was executed on December 8, 2015, while the Defendant was home. Id. at 8. The Defendant acknowledged to agents that he viewed child pornography and that "slutwhore" was his username. See id. Child pornography was found on electronic devices owned by the Defendant during the execution of the Second Warrant. Id.

         The parties do not dispute that Playpen's content included child pornography; rather, the Defendant takes issue with the NIT Warrant Application's description of the Playpen homepage. First Mot. to Suppress at 2-3. Although the NIT Warrant Application describes the homepage as displaying an image of partially clothed, prepubescent girls with their legs spread apart, the photo displayed on the homepage at the time of the application was actually one of a young girl with her legs crossed, wearing thigh-high fishnet stockings and a short dress or top that exposed her uncovered upper thighs. First Mot. to Suppress at 8-9; Resp. to First Mot. to Suppress at 14-15, 31.


         On June 22, 2016, a federal grand jury returned an indictment, which charged McLamb with four counts of receipt of child pornography, in violation of 18 U.S.C. § 2252(a)(2), and one count of possession of child pornography, in violation of 18 U.S.C. § 2252(a)(4). ECF No. 1. The court set a preliminary motions deadline of July 29, 2016. ECF No. 10. The parties' agreed discovery order was filed on July 1, 2016. ECF No. 11. On July 29, 2016, the defense wrote a letter to the government seeking discovery of further information.[2] ECF No. 21-5. The government responded by letter on that same day, indicating that it did not intend to provide the requested source code or discovery on the unique identifier generator. ECF No. 21-6.

         The Defendant filed the First and Second Motions to Suppress and the Motion to Compel Discovery, on July 29, 2016. ECF Nos. 14, 15, 16. The First and Second Motions to Suppress requested evidentiary hearings. The government filed its Responses on August 12, 2016. ECF Nos. 19, 20, 21. The Defendant filed Replies to these Responses on August 17, 2016. ECF Nos. 27, 28, 29. On August 22, 2016, the Defendant filed a Notice of Request for a Hearing on his First Motion to Suppress, Second Motion to Suppress, and Motion to Compel. ECF No. 30. The court held a hearing on the Motions to Suppress and Motion to Compel on November 1, 2016. ECF No. 39. At the hearing, FBI Special Agent McFarlane was called as a witness by telephone, as agreed upon by the parties. See Joint Motion to Continue Trial, ECF No. 36 at 2.


         A. Legal Standard

         When police undertake a search in order to discover evidence of a crime, the Fourth Amendment's reasonableness standard generally requires them to obtain a search warrant. Riley v. California, 134 S.Ct. 2473, 2482 (2014)(quoting Vernonia School Dist. 47J v. Acton, 515 U.S. 646, 653 (1995)). A successful application for a search warrant must be sufficient to support a finding of probable cause by a neutral, detached magistrate. United States v. Leon, 468 U.S. 897, 915 (1984). Probable cause requires that, given the totality of the circumstances, "there is a fair probability that contraband or evidence of a crime will be found in a particular place." Illinois v. Gates, 462 U.S. 213, 238 (1983). If a defendant shows that the affiant included a false statement knowingly and intentionally, or with reckless disregard for the truth, in the warrant affidavit and that false statement is necessary to find probable cause, the defendant is entitled to a hearing on the inaccuracies. Franks v. Delaware, 438 U.S. 154, 171 (1978). When reviewing a magistrate's determination of probable cause, district courts should award it "great deference, " declining to defer only when the finding was not supported by substantial evidence in the record or when the basis of the determination was a knowingly or recklessly false affidavit. Leon, 468 U.S. at 914-15.

         Even if a violation of the Fourth Amendment occurs, "suppression is not an automatic consequence." Herring v. United States, 555 U.S. 135, 137 (2009). Rather, suppression is only appropriate where the blameworthiness of the police and the potential to deter police misconduct justify exclusion. Id. The exclusionary rule is a remedy of last resort; it is not an individual right. Id. at 140-41. The positive impacts of exclusion must outweigh the negative impacts of exclusion in order to merit application of the rule. Id. at 141. In accordance with these principles, evidence seized under a warrant that is invalid for lack of probable cause should not be excluded, if the police acted in good faith, defined as objectively reasonable reliance on the issued warrant. Id. at 142. Importantly, "when police mistakes are the result of negligence . . . rather than systematic error or reckless disregard of constitutional requirements, " exclusion is improper. Id. at 147-48.

         B. Analysis

         In the Defendant's First Motion to Suppress, he argues that the fruits of the search conducted pursuant to the NIT Warrant should be suppressed for three reasons: (1) the NIT Warrant was unsupported by probable cause; (2) the FBI misled the issuing court with its description of Playpen's homepage; and (3) the NIT Warrant was an anticipatory warrant for which the triggering event establishing probable cause did not occur. First Mot. to Suppress at 2-3. While the particulars of these three issues differ, all three share the same premise: probable cause to search the computers of Playpen users did not exist following the change to the images on Playpen's homepage. Accordingly, if the finding of probable cause did not require the original images displayed on the homepage, the Defendant's three arguments are meritless.

         Courts in the Eastern District of Virginia have already ruled that this exact image change was not material to the probable cause determination. See, e.g., United States v. Matish, No. 4:16cr16, 2016 WL 3545776, at *2, *12 (E.D. Va. June 21, 2016)(Morgan, J.); United States v. Darby, No. 2:16cr36, 2016 WL 3189703, at *9 (E.D. Va. June 3, 2016) (Doumar, J.). Additionally, the courts in this district ruled that, even if the image change had been material, suppression would be improper. See, e.g., Matish at *2, *12; United States v. Eure, ...

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.