Searching over 5,500,000 cases.


searching
Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

United States v. Leonard

United States District Court, E.D. Virginia, Alexandria Division

October 6, 2017

UNITED STATES OF AMERICA,
v.
BRIAN HONIG LEONARD, Defendant.

          MEMORANDUM OPINION & ORDER

          Hon. Liam O'Grady Judge

         Pending before the Court are Defendant Brian Honig Leonard's Motion to Suppress Network Investigative Technique ("NIT") Search and for a Franks Hearing (Dkt. No. 37) and Motion to Suppress Home Search (Dkt. No. 39). For the reasons described below, the Court hereby DENIES both motions.

         I. Factual Background

         The Defendant was charged with Receipt of Child Pornography in violation of 18 U.S.C. § 2252(a)(2) and Possession of Child Pornography in violation of 18 U.S.C. 2252(a)(4)(B) following an investigation into a website called "Playpen, " which the government asserts operated as a child pornography site. See Indictment, Dkt. No. 20. The Playpen site operated on what is known as the "Tor" network, which enables its users to conceal their Internet Protocol ("IP") addresses after they download a browser from the Tor website. See United States v. McLamb. 220 F.Supp.3d 663, 666 (E.D. Va. 2016). User communications on the Tor network are transmitted to various points among a network of computers before reaching the destination computer, which makes it difficult to discover users' identifying information, including their IP addresses. Id. at 667. Tor network users can use Tor indices to locate hidden sites, which could not be located on typical Internet search engines. Id. Because these sites are hidden, a user of the Tor network cannot simply run a search to find a site of interest to the user. See United States v. Eure, 2:16cr43, 2016 WL 4059663 at *2 (E.D. Va. July 28, 2016) ("[A] user cannot simply stumble onto a hidden service")- Instead, the user must obtain the address in advance, through postings on the Internet or by communications with other users of the Tor network. Id.

         Therefore, to access the Playpen site, a user had to either know the specific site URL or locate Playpen via the Tor index. McLamb, 220 F.Supp.3d at 671. Once at the site, the user would have had to go to the homepage, click past the warning that only members were permitted, create a username, and register an account. Id. At the registration stage, potential users were warned not to enter a real email address or post identifying information in their profiles. See NIT Affidavit, Dkt. No. 38-1 at 14. There were thus several affirmative steps that a user would have to have taken to access the Playpen site, and it stands to reason that an accidental visitor would not have completed the steps without having any idea as to the site's content. See McLamb, 220 F.Supp.3d at 671.

         Despite the anonymity offered by the Tor network, the government is able to recover identifying information of Tor users through a Network Investigative Technique ("NIT") search. See Government's Opposition to Defendant's Motion to Suppress NIT Search, Dkt. No. 41 at 1-2. The NIT was a piece of computer code that, once downloaded to a computer, would search that computer for certain identifying information. Id. In this case, the NIT search operated as follows: the FBI seized control of Playpen's server, and added the computer code comprising the NIT to the digital content of the Playpen website. Id. at 6. From that point, when a computer user logged into the Playpen site with a username and password, an application instructed the user's computer to send identifying information to a different, government-controlled computer. Id. at 6-7. The NIT extracted from the user's computer (1) the IP address of the computer and the date and time this information was determined; (2) a unique identifier that would distinguish the user's computer's data from other computer's data; (3) the type of operating system used by the computer; (4) information about whether the NIT had already been sent to the computer; (5) the computer's "Host Name, " which is a name assigned to a device connected to a computer network that is used to identify the device in various forms of electronic communication, including communications over the Internet; (6) the computer's operating system user name; and (7) the computer's media access control ("MAC") address. See NIT Affidavit, Dkt. No. 38-1 at 25-26; see also Eure, 2016 WL 4059663 at *3.

         The initial NIT search of Defendant's computer occurred between February 20, 2015 and March 4, 2015. See Defendant's Memorandum in Support of Motion to Suppress Home Search, Dkt. No. 40 at 1. On July 27, 2015, the FBI applied for a search warrant for Defendant's home based on information elicited via the NIT search. Id. Both the affidavit in support of the NIT warrant and the affidavit in support of the home search warrant contained what the Defendant describes as a "false and misleading" description of the image appearing on the Playpen homepage. Defendant's Memorandum in Support of Motion to Suppress Home Search, Dkt. No. 40 at 2; Defendant's Memorandum in Support of Motion to Suppress NIT Search, Dkt. No. 38 at 4. Defendant seeks to suppress the NIT search of his computer on various grounds. He argues that a Franks hearing is necessary due to the affidavit's inaccurate description of the images on the Playpen homepage, that the NIT warrant violated the Fourth Amendment probable cause and particularity requirements, and that the NIT warrant was issued in violation of Federal Rule of Criminal Procedure 41(b). He also seeks the suppression of the home search on the grounds that the probable cause information contained in the supporting affidavit was stale, limited in duration, and insufficiently corroborated.

         II. A Franks Hearing is Unnecessary

         A Franks hearing is warranted where (1) the defendant makes a substantial preliminary showing that a false statement knowingly and intentionally, or with reckless disregard for the truth, was included by the affiant in the warrant affidavit; and (2) the allegedly false statement is necessary to the finding of probable cause. Franks v. Delaware, 438 U.S. 154, 155-56 (1978).

         Defendant claims that the NIT search warrant application contained a "clear falsehood" that was central to Magistrate Judge Buchanan's probable cause determination. See Defendant's Memorandum in Support of Motion to Suppress NIT Search, Dkt. No. 38 at 5. Specifically, the application incorrectly described the image that appeared on the front page of the Playpen website. Id. at 4. The application described the homepage as containing "images depicting partially clothed prepubescent females with their legs spread apart." NIT Affidavit, Dkt. No. 38-1 at 13. However, at the time the warrant was signed, the homepage displayed a different image. It showed a prepubescent girl, wearing a short dress and black stockings, reclined on a chair with her legs crossed and posed in a sexually suggestive manner. Government's Opposition to Defendant's Motion to Suppress NIT Search, Dkt. No. 41 at 8. The Government has explained that the description of the image on the Playpen homepage in the NIT search warrant application was inaccurate because the Playpen site administrator changed the image sometime between February 18, 2015, when the affiant last reviewed the Playpen site, and February 20, 2015, when the affiant swore to the NIT warrant. Id. The affidavit did not reference the change in images because the Government was not yet aware of the logo change. Id. The Court finds that the Government's explanation for the affidavit's inaccurate description of the Playpen homepage is reasonable, and that Defendant has made no showing that the description of the Playpen homepage made in the affidavit was knowingly or intentionally false, or made with reckless disregard for the truth.

         III. Probable Cause Existed for the NIT Warrant, and the Warrant did not Violate the Fourth Amendment's Particularity Requirement

         A court reviewing whether a magistrate judge correctly determined that probable cause exists should afford the magistrate judge's determination of probable cause great deference. United States v. Matish, 193 F.Supp.3d 585, 602 (E.D. Va. 2016) (citing Illinois v. Gates, 462 U.S. 213, 236 (1983)). The duty of a reviewing court is simply to ensure that the magistrate judge had a substantial basis for concluding that probable cause existed. Id. Defendant asserts that the magistrate judge's judgment had no "substantial basis" for her finding of probable cause, because the "mere act" of logging onto the site was insufficient to create probable cause that contraband or evidence of a crime would be found on the user's computer. See Defendant's Memorandum in Support of Motion to Suppress NIT Search, Dkt. No. 38 at 16. As described above, users had to take multiple affirmative steps to log in to the Playpen website, and it is unlikely a user could do so without knowledge that the site was dedicated to child pornography. See United States v. Darby, 190 F.Supp.3d. 520, 532 (E.D. Va. 2016) ("Defendant fails to explain why someone would go to the trouble of entering the Tor network, locating Playpen, registering for the site, and then logging into the site if they were not looking for illegal content. It is not as if the Internet is not saturated in legal pornography. The magistrate judge's common sense judgment would justify her finding that an individual would likely only take these steps if he was seeking child pornography and knew he could find it on Playpen.").

         The fact that the affidavit did not accurately describe the exact image that appeared on the Playpen website at the time the warrant was issued does not change this analysis. It is irrelevant that the old image on the Playpen homepage was more indicative of child pornography than the image actually in place at the time the affidavit was sworn. See Darby, 190 F.Supp.3d at 531 ("To the extent one can or should differentiate among sexualized depictions of children, the images of the two girls that were previously on the homepage are more reprehensible. But that distinction does not subtract from the sexualized nature of the single image of child erotica that appeared on the homepage ..."). Courts in the Eastern District of Virginia have already ruled that this image change was not material to the probable cause determination, and this Court finds no reason to depart from those rulings. See, e.g., United States v. McLamb, 220 F.Supp.3d 663 (E.D. Va. 2016); United States v. Matish, 193 F.Supp.3d 585 (E.D. Va. 2016); United Slates v. Darby, 190 F.Supp.3d. 520 (E.D. Va. 2016). Additionally, the abundance of other evidence before the magistrate judge supported her finding of probable cause. See Dkt. 41 at 13.

         Defendant additionally argues that the NIT warrant was unconstitutionally overbroad and violated the particularity requirement of the Fourth Amendment because the warrant identified the place to be searched as the "activating computers, " which were those computers of a user who logged into the Playpen website by entering a username and password. See Defendant's Memorandum in Support of Motion to Suppress NIT Search, Dkt. No. 38 at 19. The Fourth Amendment requires that search warrants "particularly describ[e] the place to be searched, and the persons or things to be seized." U.S. Const, amend. IV. This particularity requirement ...


Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.