United States District Court, E.D. Virginia, Norfolk Division
MEMORANDUM OPINION AND ORDER
REBECCA BEACH SMITH CHIEF JUDGE
matter comes before the court on the Defendant's First
Motion to Suppress, Second Motion to Suppress, and Motion to
Compel. ECF Nos. 14, 15, 16. In his Motions to Suppress, the
Defendant seeks to suppress evidence the government obtained,
pursuant to a warrant, through use of the Network
Investigative Technique ("NIT") code that enabled
the government to access information on the Defendant's
personal computer. First Mot. to Suppress at 1; Second Mot.
to Suppress at 1. In his Motion to Compel, the Defendant
seeks to compel discovery of two components of the NIT: (1)
the unique identifier generator, and (2) the exploit source
code. Mot. to Compel at 1. After full briefing and a hearing
on the Motions, the matter is ripe for decision. For the
reasons stated herein, these Motions to Suppress and the
Motion to Compel are DENIED.
Defendant was charged following an investigation into a
website called "Playpen, " which the government
asserts operated as a child pornography site. First Mot. to
Suppress at 4. The Playpen website was unusual in that it
operated on what is known as the "Tor" network.
See id. The Tor network enables its users to conceal
their Internet Protocol ("IP") addresses, after
they download the Tor browser from the Tor website. See
id. IP addresses, if not hidden by either manual
configuration or use of the Tor browser, can readily identify
users. See Resp. to First Mot. to Suppress at 6. The
Tor network aims to provide both users and operators of
websites on the Tor network with anonymity. See id.
Tor network users can use Tor indexes to locate these hidden
services, which cannot be located on typical search engines,
such as Google. See First Mot. to Suppress at 16.
User communications on the Tor network are transmitted to
various points among a network of computers before reaching
their ultimate destination computer, and this makes
identifying information, like IP addresses, more difficult to
discover. Resp. to First Mot. to Suppress at 5. The
government, however, can still recover identifying
information, despite Tor network use, by way of the NIT.
Id. at 7.
February 19, 2015, the Federal Bureau of Investigation
("FBI") arrested the then-operator of Playpen,
gained control of the Playpen website, and thereafter
operated it on a server in Virginia. Macfarlane Aff., ECF No.
14-2, ¶ 30. On February 20, 2015, the government
obtained a warrant (''NIT Warrant") enabling it
to use the NIT to investigate Playpen users. NIT Search
Warrant and Application, ECF 19-9. The Defendant and the
government disagree on the NIT's operation, but the basic
concept is that, after a computer user logged into Playpen
with a username and password, an application was authorized
to send code, or computer instructions, to the user's
computer. This code instructed the computer to send
identifying information to a different, government-controlled
the NIT warrant authorized the NIT to be deployed as soon as
a user logged into Playpen, here, the NIT was not deployed
until a posting thread in the "kinky fetish-zoo
subforum" was accessed. Resp. to Mot. to Compel at 18.
After deploying the NIT, the FBI was able to identify an IP
address associated with a particular Playpen username
("slutwhore") and trace that username to the
Defendant. Resp. to First Mot. to Suppress at 7. On December
1, 2015, the government obtained a residential search warrant
("Second Warrant") for the Defendant's home.
The Second Warrant was executed on December 8, 2015, while
the Defendant was home. Id. at 8. The Defendant
acknowledged to agents that he viewed child pornography and
that "slutwhore" was his username. See id.
Child pornography was found on electronic devices owned by
the Defendant during the execution of the Second Warrant.
parties do not dispute that Playpen's content included
child pornography; rather, the Defendant takes issue with the
NIT Warrant Application's description of the Playpen
homepage. First Mot. to Suppress at 2-3. Although the NIT
Warrant Application describes the homepage as displaying an
image of partially clothed, prepubescent girls with their
legs spread apart, the photo displayed on the homepage at the
time of the application was actually one of a young girl with
her legs crossed, wearing thigh-high fishnet stockings and a
short dress or top that exposed her uncovered upper thighs.
First Mot. to Suppress at 8-9; Resp. to First Mot. to
Suppress at 14-15, 31.
22, 2016, a federal grand jury returned an indictment, which
charged McLamb with four counts of receipt of child
pornography, in violation of 18 U.S.C. § 2252(a)(2), and
one count of possession of child pornography, in violation of
18 U.S.C. § 2252(a)(4). ECF No. 1. The court set a
preliminary motions deadline of July 29, 2016. ECF No. 10.
The parties' agreed discovery order was filed on July 1,
2016. ECF No. 11. On July 29, 2016, the defense wrote a
letter to the government seeking discovery of further
information. ECF No. 21-5. The government responded by
letter on that same day, indicating that it did not intend to
provide the requested source code or discovery on the unique
identifier generator. ECF No. 21-6.
Defendant filed the First and Second Motions to Suppress and
the Motion to Compel Discovery, on July 29, 2016. ECF Nos.
14, 15, 16. The First and Second Motions to Suppress
requested evidentiary hearings. The government filed its
Responses on August 12, 2016. ECF Nos. 19, 20, 21. The
Defendant filed Replies to these Responses on August 17,
2016. ECF Nos. 27, 28, 29. On August 22, 2016, the Defendant
filed a Notice of Request for a Hearing on his First Motion
to Suppress, Second Motion to Suppress, and Motion to Compel.
ECF No. 30. The court held a hearing on the Motions to
Suppress and Motion to Compel on November 1, 2016. ECF No.
39. At the hearing, FBI Special Agent McFarlane was called as
a witness by telephone, as agreed upon by the parties.
See Joint Motion to Continue Trial, ECF No. 36 at 2.
FIRST MOTION TO SUPPRESS
police undertake a search in order to discover evidence of a
crime, the Fourth Amendment's reasonableness standard
generally requires them to obtain a search warrant. Riley
v. California, 134 S.Ct. 2473, 2482 (2014)(quoting
Vernonia School Dist. 47J v. Acton, 515 U.S. 646,
653 (1995)). A successful application for a search warrant
must be sufficient to support a finding of probable cause by
a neutral, detached magistrate. United States v.
Leon, 468 U.S. 897, 915 (1984). Probable cause requires
that, given the totality of the circumstances, "there is
a fair probability that contraband or evidence of a crime
will be found in a particular place." Illinois v.
Gates, 462 U.S. 213, 238 (1983). If a defendant shows
that the affiant included a false statement knowingly and
intentionally, or with reckless disregard for the truth, in
the warrant affidavit and that false statement is necessary
to find probable cause, the defendant is entitled to a
hearing on the inaccuracies. Franks v. Delaware, 438
U.S. 154, 171 (1978). When reviewing a magistrate's
determination of probable cause, district courts should award
it "great deference, " declining to defer only when
the finding was not supported by substantial evidence in the
record or when the basis of the determination was a knowingly
or recklessly false affidavit. Leon, 468 U.S. at
a violation of the Fourth Amendment occurs, "suppression
is not an automatic consequence." Herring v. United
States, 555 U.S. 135, 137 (2009). Rather, suppression is
only appropriate where the blameworthiness of the police and
the potential to deter police misconduct justify exclusion.
Id. The exclusionary rule is a remedy of last
resort; it is not an individual right. Id. at
140-41. The positive impacts of exclusion must outweigh the
negative impacts of exclusion in order to merit application
of the rule. Id. at 141. In accordance with these
principles, evidence seized under a warrant that is invalid
for lack of probable cause should not be excluded, if the
police acted in good faith, defined as objectively reasonable
reliance on the issued warrant. Id. at 142.
Importantly, "when police mistakes are the result of
negligence . . . rather than systematic error or reckless
disregard of constitutional requirements, " exclusion is
improper. Id. at 147-48.
Defendant's First Motion to Suppress, he argues that the
fruits of the search conducted pursuant to the NIT Warrant
should be suppressed for three reasons: (1) the NIT Warrant
was unsupported by probable cause; (2) the FBI misled the
issuing court with its description of Playpen's homepage;
and (3) the NIT Warrant was an anticipatory warrant for which
the triggering event establishing probable cause did not
occur. First Mot. to Suppress at 2-3. While the particulars
of these three issues differ, all three share the same
premise: probable cause to search the computers of Playpen
users did not exist following the change to the images on
Playpen's homepage. Accordingly, if the finding of
probable cause did not require the original images displayed
on the homepage, the Defendant's three arguments are
in the Eastern District of Virginia have already ruled that
this exact image change was not material to the probable
cause determination. See, e.g., United States v.
Matish, No. 4:16cr16, 2016 WL 3545776, at *2, *12 (E.D.
Va. June 21, 2016)(Morgan, J.); United States v.
Darby, No. 2:16cr36, 2016 WL 3189703, at *9 (E.D. Va.
June 3, 2016) (Doumar, J.). Additionally, the courts in this
district ruled that, even if the image change had been
material, suppression would be improper. See, e.g.,
Matish at *2, *12; United States v. Eure,