Summary
compiling district and appellate court holdings on NIT-warrant searches
Summary of this case from United States v. TaylorOpinion
2:16-cr-00203-KOB-JEO-1.
04-24-2017
UNITED STATES of America v. James Ryan TAYLOR, Defendant.
United States Marshal, US Attorney Joyce White Vance, Jacquelyn Mather Hutzell, United States Attorney's Office, US Probation, United States Probation Office, Birmingham, AL, for United States of America. Kevin L. Butler, Federal Public Defender, Birmingham, AL, for Defendant.
United States Marshal, US Attorney Joyce White Vance, Jacquelyn Mather Hutzell, United States Attorney's Office, US Probation, United States Probation Office, Birmingham, AL, for United States of America.
Kevin L. Butler, Federal Public Defender, Birmingham, AL, for Defendant.
MEMORANDUM OPINION
KARON OWEN BOWDRE, CHIEF UNITED STATES DISTRICT JUDGE
The United States filed this and many other child pornography criminal cases following an extensive FBI sting operation that resulted in the seizure of a website, "Playpen," dedicated to the advertisement and distribution of child pornography. After taking over Playpen, the FBI first obtained a warrant in the Eastern District of Virginia that enabled it to seize Defendant's Internet Protocol (IP) address and other identifying information. With that information, the FBI obtained and executed a second warrant in the Northern District of Alabama to search Defendant's home and seize certain property, including a solid state drive that contained child pornography. The Government charged Defendant James Ryan Taylor with receipt of child pornography under 18 U.S.C. § 2252A(a)(2) and with possession and accessing child pornography with intent to view under 18 U.S.C. §§ 2252A(a)(5)(B) & (b)(2). (Doc. 1).
This case comes before the court on Defendant's Motion to Suppress Evidence. (Doc. 21). The Government has filed a Response (doc. 26) and Supplemental Response. (Doc. 30). The court WILL DENY the Motion to Suppress.
I. Statement of Facts
From September 2014 to February 2015, FBI agents monitored "Playpen," a website dedicated to the advertisement and distribution of child pornography. The Playpen website was only accessible via "The Onion Router" or "Tor" network, which is part of what is sometimes referred to as the "Dark Web" because of its anonymity features. On February 20, 2015, the FBI obtained a warrant in the Eastern District of Virginia to deploy a Network Investigative Technique ("NIT") on the Playpen website to obtain identifying information about the computers accessing the site. That warrant lies at the heart of this case. The FBI's warrant application included the affidavit of FBI Special Agent Douglas Mcfarlane, who investigated the Playpen website. Agent Mcfarlane's affidavit describes in detail the website, the Tor network, and other relevant facts from the FBI's investigation.
See Hacker Lexicon: What is the Dark Web?, Wired , https://www.wired.com/2014/11/hacker-lexicon-whats-dark-web/ (Nov. 19, 2014).
A. The Tor Network
Tor is a program designed to provide Internet privacy protections by restricting the kinds of information a website can collect from a user, particularly a computer's IP address. The Tor software permits a user to access the Tor network, a network of computers that obscures the identity of users by rerouting a user's IP address through "layers" of relay points, so that the IP address at which a signal exits (the "exit node") is not the IP address at which the signal originated. This process makes it impossible to "peel back the layers of the onion" to discover the originating IP address, which in turn marks the user's geographic location and can be used to identify the user.
" ‘Internet Protocol address’ or ‘IP address’ refers to a unique number used by a computer to access the Internet. IP addresses can be ‘dynamic,’ meaning that the Internet Service Provider (‘ISP’) assigns a different unique number to a computer every time it accesses the Internet. IP addresses might also be ‘static,’ if an ISP assigns a user's computer a particular IP address which is used each time the computer accesses the Internet. IP addresses are also used by computer servers, including web servers, to communicate with other computers." (Doc. 21–1 at 8–9).
Websites accessible only on the Tor network, termed "hidden services," are not searchable through Google or other search engines; rather, a user must employ the Tor software and know the exact address of a particular hidden service to access it. A user could obtain the address from communications with other individuals who use the hidden service or from an Internet posting describing the hidden service and giving its address. The Playpen website, for example, was listed on a Tor hidden service page dedicated to pedophilia and child pornography. Website addresses on the Tor network consist of a randomized series of characters produced by an algorithm and end in ".onion." Tor obscures the IP addresses of hidden services, meaning that law enforcement cannot determine the location of the computer hosting a hidden service.
Originally designed and employed by the U.S. Navy, the Tor network is used for many legal purposes and is freely available for download at https://www.torproject.org.
B. The Playpen Website
The Playpen website was located at different ".onion" URLs depending on when it was accessed; the administrator of Playpen periodically moved the website from one URL to another, without otherwise altering it, in part to avoid detection by law enforcement. The website's homepage featured the word "Playpen" and two images of partially clothed prepubescent females with their legs spread apart. Beneath the logo was text stating, "No cross-board reposts, .7z preferred, encrypt filenames, include preview, Peace out." Special Agent Mcfarlane's affidavit explains that "[n]o cross-board reposts" refers to not posting files from other websites and ".7z preferred" denotes a method of compressing large files for distribution. The homepage also included a login section and a link to the registration page. The registration terms on the registration page instructed users to not enter a real email address and stated that "[f]or your own security" users should not post identifying information and should disable other potentially identifying browser features.Upon logging in, a user would be immediately directed to a Playpen directory that listed message boards divided into more than fifty topics and subtopics that largely referred to child pornography, child erotica, and child sexual abuse. For example, the topics included "Pre-teen Videos" and "Pre-teen Photos," both subdivided into "Girls HC [hardcore]" and "Girls SC [softcore]/NN [non-nude]" and "Boys HC" and "Boys SC/NN"; "Kinky Fetish," and "Family [Playpen]—Incest." Agent Mcfarlane's affidavit details numerous examples of child pornography posted on the Playpen message boards under these topics and others.
Agent Mcfarlane's affidavit explains that "hardcore" refers to depictions of sexually penetrative explicit conduct; "softcore" refers to depictions of non-penetrative sexually explicit conduct; and "non-nude" refers to depictions of fully or partially clothed subjects.
C. The FBI Investigation & Network Investigative Technique ("NIT")
Upon receiving on a tip from a foreign law enforcement agency, the FBI identified the Playpen website's host IP address and seized a copy of the server containing the Playpen website, storing that copy on a server in the Eastern District of Virginia. The FBI arrested the Playpen website administrator and assumed administrative control of Playpen. Because traditional methods of obtaining IP addresses would only reveal the "exit node" IP addresses of Playpen users, the FBI sought and received permission to deploy a Network Investigative Technique (NIT) from the server in the Eastern District of Virginia to locate and identify Playpen users. A magistrate judge in the Eastern District of Virginia signed the warrant permitting the FBI to deploy the NIT.
The NIT consisted of computer code that instructed a user's computer to transmit specific information to a government-controlled computer. The NIT operated by downloading to a user's browser along with other content from the Playpen website. Though the warrant authorized the FBI to deploy the NIT to any computer logging into the Playpen website, in executing the warrant the FBI only deployed the NIT to computers accessing actual pornography in certain Playpen forums. See (Doc. 30–1 at 18–19). That is, when a user clicked on a designated pornographic image or video on Playpen, the website on the server in the Eastern District of Virginia transmitted the image or video along with the NIT code. Once downloaded to a user's browser, the NIT instructed a user's computer—the "activating computer"—to send specific information to the government computer.
In the section of the NIT warrant application requesting information about the person or property to be searched, the application refers to Attachment A. Attachment A explains that the warrant authorizes the use of a NIT on a computer server operating the Playpen website and that the server is located at a government facility in the Eastern District of Virginia. Attachment A also states that the NIT will obtain the information specified in Attachment B from the "activating computers" of any user or administrator who logs into the Playpen website.
Similarly, in the section requesting information about the property to be seized, the application refers to Attachment B. Attachment B explains that the NIT would collect the following seven pieces of information:
1. The "activating" computer's actual IP address, and the date and time that the NIT determines what that IP address is;
2. A unique identifier generated by the NIT (e.g., a series of numbers, letters, and/or special characters) to distinguish the data from that of other "activating" computers. That unique identifier will be sent with and collected by the NIT;
3. The type of operating system running on the computer, including type (e.g., Windows), version (e.g., Windows 7), and architecture (e.g., x 86);
4. Information about whether the NIT has already been delivered to the "activating" computer;
5. The "activating" computer's "Host Name." A Host Name is a name assigned to a device connected to a computer network that is used to identify the device in various forms of electronic communication, such as communications over the Internet;
6. the "activating" computer's active operating system username; and
7. The "activating" computer's Media Access Control ("MAC") address. The equipment that connects a computer to a network is commonly referred to as a network adapter. Most network adapters have a MAC address assigned by the manufacturer of the adapter that is designed to be a unique identifying number. A unique MAC address allows for proper routing of communications on a network. Because the MAC address does not change and is intended to be unique, a MAC address can allow law enforcement to identify whether communications sent or received at different times are associated with the same adapter.
Both Attachments A and B, along with Agent Mcfarlane's affidavit, were included with the NIT warrant application.
D. Motions to Suppress in Other Cases
As of today, at least 44 district courts have ruled on motions to suppress the information seized pursuant to the NIT warrant. Twelve of these courts have found that the warrant did not violate § 636(a) of the Federal Magistrates Act and/or Rule 41 of the Federal Rules of Criminal Procedure. U.S. v. Jones , No. 3:16–cr–026, 230 F.Supp.3d 819, 2017 WL 511883 (S.D. Ohio February 2, 2017) ; U.S. v. Austin , No. 3:16–cr–00068, 230 F.Supp.3d 828, 2017 WL 496374 (M.D. Tenn. Feb. 2, 2017) ; U.S. v. Bee , No. 16-00002-01-CR-W-GAF, 2017 WL 424889 (W.D. Mo. Jan. 31, 2017) (adopting magistrate judge's report and recommendation); U.S. v. Sullivan , No. 1:16–cr–270, 2017 WL 201332 (N.D. Ohio Jan. 18, 2017) ; U.S. v. Dzwonczyk , No. 4:16-CR-3134, 2016 WL 7428390 (D. Neb. Dec. 23, 2016) (adopting magistrate judge's report and recommendation); U.S. v. McLamb , No. 2:16cr92, 2016 WL 6963046 (E.D. Va. Nov. 28, 2016) ; U.S. v. Lough , No. 1:16CR18, 221 F.Supp.3d 770, 2016 WL 6834003 (N.D.W. Va. Nov. 18, 2016) ; U.S. v. Johnson , No. 15–00340–01–CR–W–GAF, 2016 WL 6136586 (W.D. Mo. Oct. 20, 2016) (adopting in part magistrate judge's report and recommendation); U.S. v. Smith , No. 4:15–CR–00467 (S.D. Tex. Sept. 28, 2016); U.S. v. Jean , 207 F.Supp.3d 920 (W.D. Ark. 2016) ; U.S. v. Eure , No. 2:16cr43, 2016 WL 4059663 (E.D. Va. July 28, 2016) ; U.S. v. Matish , 193 F.Supp.3d 585 (E.D. Va. 2016) ; U.S. v. Darby , 190 F.Supp.3d 520 (E.D. Va. 2016) ; cf. U.S. v. Laurita , No. 8:13CR107, 2016 WL 4179365 (D. Neb. Aug. 5, 2016) (adopting magistrate judge's report and recommendation) (finding no violation of the statute or Rule by a NIT warrant issued in a different pornography website investigation).
Twenty-two district courts have found that the warrant did violate § 636(a) and/or Rule 41(b), but that the violation did not warrant suppression. U.S. v. Gaver , 3:16–cr–88, 2017 WL 1134814 (S.D. Ohio Mar. 27, 2017) ; U.S. v. Perdue , No. 3:16-CR-305-D(1), 2017 WL 661378 (N.D. Tex. Feb. 17, 2017) ; U.S. v. Pawlak , No. 3:16-CR-306-D(1), 2017 WL 661371 (N.D. Tex. Feb. 17, 2017) ; U.S. v. Kahler , No. 16–cr–20551, 2017 WL 586707 (E.D. Mich. Feb. 14, 2017) ; U.S. v. Deichert , No. 5:16-CR-201-FL-1, 232 F.Supp.3d 772, 2017 WL 398370 (E.D.N.C. Jan. 28, 2017) ; U.S. v. Vortman , No. 16–cr–00210–THE–1, 2016 WL 7324987 (N.D. Cal. Dec. 16, 2016) ; U.S. v. Hammond , No. 16–cr–00102–JD–1, 226 F.Supp.3d 58, 2016 WL 7157762 (N.D. Cal. Dec. 8, 2016); U.S. v. Duncan , No. 3:15–cr–00414–JO, 2016 WL 7131475 (D. Or. Dec. 6, 2016) ; U.S. v. Owens , No. 16-CR-38-JPS, 2016 WL 7053195 (E.D. Wis. Dec. 5, 2016) (adopting magistrate judge's report and recommendation); U.S. v. Stepus , No. 15-30028-MGM, 2016 WL 6518427 (D. Mass. Oct. 28, 2016) ; U.S. v. Scarbrough , No. 3:16-CR-35, 2016 WL 5900152 (E.D. Tenn. Oct. 11, 2016) (adopting magistrate judge's report and recommendation); U.S. v. Allain , No. 15–cr–10251, 2016 WL 5660452 (D. Mass. Sept. 29, 2016) ; U.S. v. Broy , 209 F.Supp.3d 1045 (C.D. Ill. 2016) ; U.S. v. Knowles , 207 F.Supp.3d 585 (D.S.C. 2016) ; U.S. v. Ammons , 207 F.Supp.3d 732 (W.D. Ky. 2016) ; U.S. v. Torres , No. 5:16-CR-285-DAE, 2016 WL 4821223 (W.D. Tex. Sept. 9, 2016) ; U.S. v. Henderson , No. 15–cr–00565–WHO–1, 2016 WL 4549108 (N.D. Cal. Sept. 1, 2016) ; U.S. v. Adams , No. 6:16–cr–11–Orl–40–GJK, 2016 WL 4212079 (M.D. Fla. Aug. 8, 2016) ; U.S. v. Rivera , 2:15–cr–00266–CJB–KWR (E.D. La. July 20, 2016); U.S. v. Werdene , 188 F.Supp.3d 431 (E.D. Penn. 2016) ; U.S. v. Stamper , No. 1:15cr109, 2016 WL 695660 (S.D. Ohio February 19, 2016) ; U.S. v. Michaud , No. 3:15–cr–05351–RJB, 2016 WL 337263 (W.D. Wash. Jan. 28, 2016).
A few courts have declined to decide whether the statute and/or the Rule authorized the warrant but found that exclusion was unwarranted regardless. U.S. v. Schuster , No. 1:16–cr–51, 2017 WL 1154088 (S.D. Ohio Mar. 28, 2017) ; U.S. v. Tran , No. 16-10010-PBS, ––– F.Supp.3d ––––, 2016 WL 7468005 (D. Mass. Dec. 28, 2016) ; U.S. v. Kienast , No. 16-CR-103, 2016 WL 6683481 (E.D. Wis. Nov. 14, 2016) ; U.S. v. Anzalone , 208 F.Supp.3d 358 (D. Mass. 2016) ; U.S. v. Acevedo–Lemus , No. SACR 15-00137-CJC, 2016 WL 4208436 (C.D. Cal. Aug. 8, 2016) ; U.S. v. Epich , No. 15-CR-163-PP, 2016 WL 953269 (E.D. Wis. Mar. 14, 2016) (adopting magistrate judge's report and recommendation).
Four courts have suppressed the evidence. U.S. v. Croghan , 209 F.Supp.3d 1080 (S.D. Iowa 2016) ; U.S. v. Workman , 205 F.Supp.3d 1256 (D. Colo. 2016) ; U.S. v. Arterbury , No. 15–CR–182–JHP (N.D. Okla. May 17, 2016) (adopting magistrate judge's report and recommendation); U.S. v. Levin , 186 F.Supp.3d 26 (D. Mass. 2016).
E. Search of Mr. Taylor's Residence & Indictment
The data gathered from the NIT revealed that Playpen user "Wilcox1" was linked to a computer with the host name "RyansComputer," with computer login name "Ryan." (Doc. 26–2 at 31). Wilcox1 accessed several images of child pornography on Playpen on March 1, 2015. Through an administrative subpoena, the FBI further determined that the IP address associated with "Wilcox1" was assigned to Mr. Taylor at his residence in Birmingham, Alabama. A magistrate judge in the Northern District of Alabama authorized a search warrant for Mr. Taylor's residence, which the FBI executed on January 4, 2016.
The FBI seized a laptop, a hard drive, a solid state drive, and a USB drive from Mr. Taylor's residence. Both parties acknowledge that the initial FBI analysis of these devices did not reveal any child pornography stored on them; however, a second analysis of the devices at the FBI's Digital Analysis and Research Center found child pornography on the solid state drive. The Government subsequently indicted Mr. Taylor. (Doc. 1).
II. Discussion
Mr. Taylor argues that the search and seizure of his property in the Northern District of Alabama exceeded the scope of the NIT warrant. He further argues that the warrant was invalid under the Fourth Amendment's probable cause and particularity mandates, Rule 41(b) of the Federal Rules of Criminal Procedure, and 28 U.S.C. § 636(a), a provision of the Federal Magistrates Act. Mr. Taylor asserts that the pornography seized pursuant to the residential warrant, which was authorized based on the information seized by the NIT, should be suppressed as fruit of the poisonous tree.
However, the court will first examine the question of whether the FBI's execution of the NIT warrant constituted a search within the meaning of the Fourth Amendment, such that the Government required a warrant at all. In addition to determining whether the Fourth Amendment governs this case, this inquiry addresses precisely what property was searched and seized, which is necessary to the Rule 41(b) and § 636(a) analysis.
A. Whether Execution of the NIT Constituted a Fourth Amendment Search
The Fourth Amendment protects "[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures." U.S. CONST. amend. IV. A search for purposes of the Fourth Amendment does not require a physical trespass to property. See Katz v. U.S. , 389 U.S. 347, 353, 88 S.Ct. 507, 19 L.Ed.2d 576 (1967). In the absence of a trespass, "the application of the Fourth Amendment depends on whether the person invoking its protection can claim a justifiable, a reasonable, or a legitimate expectation of privacy that has been invaded by government action." See Smith v. Maryland , 442 U.S. 735, 740, 99 S.Ct. 2577, 61 L.Ed.2d 220 (1979).
Under the two-part Katz test, an individual must demonstrate both a subjective expectation of privacy in the object of the challenged search, and that society is prepared to accept that expectation as objectively reasonable. California v. Ciraolo , 476 U.S. 207, 211, 106 S.Ct. 1809, 90 L.Ed.2d 210 (1986). The third-party doctrine applies when someone voluntarily disclosed information to a third party; an expectation of privacy in such information fails the objectively reasonable prong. See Smith , 442 U.S. at 743–44, 99 S.Ct. 2577 ; see, e.g. , U.S. v. Davis , 785 F.3d 498, 511–12 (11th Cir. 2015).
The Supreme Court has applied the third-party doctrine to permit electronic tracking of certain information without a warrant. See U.S. v. Knotts , 460 U.S. 276, 285, 103 S.Ct. 1081, 75 L.Ed.2d 55 (1983) (holding that officers' installation, prior to purchase, of a "beeper" in a barrel purchased by one of the codefendants and the officers' subsequent monitoring of the signals from that beeper as the codefendant transported it by vehicle to its final destination did not constitute a Fourth Amendment search, because a car's movements are public information); but see U.S. v. Jones , 565 U.S. 400, 404, 132 S.Ct. 945, 181 L.Ed.2d 911 (2012) (distinguishing Knotts and holding that the use of a GPS tracker to monitor a car's movements over 28 days constituted a search because the monitor installation was a physical trespass—the car was already in the defendant's possession at the time the tracker was installed). Even though the information acquired by the Government in Jones was public, like that in Knotts , the place searched was constitutionally protected. See id. at 409, 132 S.Ct. 945 (in dicta, noting that the Court knew of no case that would support the position that "what would otherwise be an unconstitutional search is not such where it produces only public information").
Similarly, the Government may not employ "sense-enhancing technology" that is not in general public use to obtain information that "could not otherwise have been obtained without physical ‘intrusion into a constitutionally protected area’ ...." Kyllo v. U.S. , 533 U.S. 27, 34 (2001) (quoting Silverman v. U.S. , 365 U.S. 505, 512 (1961) ). The technology at issue in Kyllo was a thermal imager that produced images showing heat distributions within the defendant's home and in comparison with his neighbors' homes. Id. at 29–30, 121 S.Ct. 2038. Based on their thermal imaging scan of Kyllo's residence, officers determined that Kyllo was using halide lights to grow marijuana in his house. Id. at 30, 121 S.Ct. 2038. Though the officers obtained additional information about Kyllo's increased electricity usage by subpoenaing his utility company, the Court determined that the officers' use of the thermal imager constituted a search under the Fourth Amendment. See id. at 40, 121 S.Ct. 2038 ; id. at 44, 121 S.Ct. 2038 (Stevens, J., dissenting).
Lower courts uniformly agree that, because of the third-party doctrine, computer users lack a reasonable expectation of privacy in their IP addresses, subscriber information, and similar descriptive information they disclose to third parties (such as ISPs) to facilitate Internet service. See, e.g. , U.S. v. Carpenter , 819 F.3d 880, 887 (6th Cir. 2016) (internal citations omitted) ("The Fourth Amendment protects the content of the modern-day letter, the email. But courts have not (yet, at least) extended those protections to the internet analogue to envelope markings, namely the metadata used to route internet communications, like sender and recipient addresses on an email, or IP addresses."); U.S. v. Weast , 811 F.3d 743, 748 (5th Cir. 2016) (holding that the Fourth Amendment does not protect IP addresses or peer-to-peer shared files); U.S. v. Beckett , 369 Fed.Appx. 52, 56 (11th Cir. 2010) (non-precedential) (holding that an individual has no reasonable expectation of privacy in identifying information transmitted for ISPs and phone providers to provide service).
In contrast, courts agree that individuals do have a reasonable expectation of privacy in the contents of their computers. See, e.g. , U.S. v. Turner , 839 F.3d 429, 434 (5th Cir. 2016) (citing Riley v. California , ––– U.S. ––––, 134 S.Ct. 2473, 2485, 189 L.Ed.2d 430 (2014) ) (noting the recognized privacy interest in the electronic contents of computers and cell phones); U.S. v. Buckner , 473 F.3d 551, 554 (4th Cir. 2007) (citing Trulock v. Freeh , 275 F.3d 391, 403 (4th Cir. 2001) ) (finding a reasonable expectation of privacy in password-protected files). In a case involving a remote search of a computer, the Ninth Circuit held that a reasonable privacy interest in a personal computer (password-protected and located in the owner's residence) was not extinguished by the owner's connecting to a wireless network, even though others occasionally had access to the computer, because the computer owner was not alerted that his computer usage might be monitored. U.S. v. Hecken k amp , 482 F.3d 1142, 1147 (2007).
1. Nature of the Property Searched & Seized
In their briefs, both parties address Mr. Taylor's constitutional privacy interests in the property searched and seized in the context of a Rule 41 violation. Mr. Taylor maintains that the NIT search violated his reasonable expectation of privacy in his home and personal computers, while the Government argues that Mr. Taylor lacked a reasonable privacy interest in his IP address. Identification of precisely what property was searched and seized is a necessary prerequisite to making the reasonable expectation of privacy inquiry.
Like many of its sister district courts, this court concludes that the NIT searched the contents of Mr. Taylor's computer and seized the information that was listed in Attachment B to the NIT warrant. Accord, e.g. , Adams , 2016 WL 4212079, at *4 ("The NIT searches the user's computer to discover the IP address associated with that device."); Arterbury , No. 15–CR–182–JHP (N.D. Okla. May 17, 2016), at 14 (determining that the property searched and seized was the defendant's computer, not the "packets of data" he sent to the Eastern District of Virginia). Defendant's IP address and other identifying information were not exclusively "located" on his computer because (1) an IP address is, like a phone number to a phone, both internal and external to one's computer, and (2) by accessing the Internet and logging into Playpen Mr. Taylor transmitted some of his information on the "highways" of the Internet. However, the FBI could not obtain Mr. Taylor's information without directing the NIT to "invade" his computer. See Acevedo–Lemus , 2016 WL 4208436, at *5–6 (describing the IP address as "a feature of Defendant's connection," not something located on his computer).
For example, the Host Name, as described in the affidavit, would identify an activating computer in Internet communications.
2. Whether Mr. Taylor's Expectation of Privacy Was Reasonable
First, the court finds that Mr. Taylor exhibited a subjective expectation of privacy in the information gathered by the NIT because he either did not disclose it to a third party at all or employed the Tor software to conceal it from the public.
The court questions, for instance, whether and when the activating computer's username would be transmitted over the Internet.
The NIT warrant raises not simply the question of whether Mr. Taylor had a reasonable expectation that his IP address and other data would remain private, but whether Mr. Taylor held a reasonable privacy expectation in those pieces of information because of the extra steps he took to preserve the anonymity of his location and identifying information while he browsed the Internet. This Motion presents a different situation than most third-party doctrine questions, because the information seized could not be acquired directly from a third party. See, e.g. , U.S. v. Miller , 425 U.S. 435, 443, 96 S.Ct. 1619, 48 L.Ed.2d 71 (1976) (noting that "the Fourth Amendment does not prohibit the obtaining of information revealed to a third party and conveyed by him to Government authorities ...." (emphasis added)).
Some other district courts ruling on the NIT warrant have found that the use of Tor does not create in the Tor user has a subjective and/or a reasonable expectation that his IP address remains private, because a Tor user must still disclose his real IP address to a third party ISP and to an initial Tor relay computer. See, e.g. , Broy , 209 F.Supp.3d at 1053 (finding that the defendant lacked a reasonable expectation of privacy in his IP address because "[t]he fact that [the defendant] may have felt his identity was anonymous does not negate the fact that, in order to gain that feeling of anonymity, he voluntarily disclosed his IP address to the operator of the first Tor node."); Michaud , 2016 WL 337263, at *7 (finding that the defendant could have no reasonable expectation of privacy in his IP address, which "was public information, like an unlisted telephone number, and eventually could have been discovered").Other courts have rejected that analysis. Those courts found that the fact that the NIT required interaction with a user's private computer to obtain information, or the practical impossibility of peeling back the layers hiding a Tor user's original IP location without technology like the NIT, means that a Tor user has a subjective and objectively reasonable expectation of privacy in his IP address and other information gathered by the NIT. See, e.g. , Adams , 2016 WL 4212079, at *4 (citing U.S. v. Lanford , 838 F.2d 1351, 1353 (5th Cir. 1988) ) ("[O]ne's expectation of privacy in [the user's computer] is the proper focus of the analysis.... a defendant has an expectation of privacy in his garage, even if that defendant lacks an expectation of privacy in the stolen vehicle parked in the garage."); Arterbury , No. 15–CR–182–JHP (N.D. Okla. May 17, 2016), at 12 n.6, 14–15, 22 n.10, 23 (noting that, absent the NIT's interaction with the defendant's computer, the Government could not have obtained the defendant's IP address, and finding that the defendant's expectation of privacy was reasonable).
This court agrees with the latter contingent of courts and finds that, given his use of Tor, Mr. Taylor's expectation in the privacy of the information seized by the NIT was objectively reasonable. Mr. Taylor could reasonably expect that his computer's contents would remain private. And his computer was located in his home at the time he accessed Playpen, making this case more like Jones and not Knotts —the NIT was deployed to Mr. Taylor's property (his computer) while it was already in his possession, in a place whose protection lies at the heart of the Fourth Amendment (the home). As the Court observed in Jones , no case law exists permitting the government to invade a constitutionally protected place (here, either the computer or the home) to obtain even public information. See Jones , 565 U.S. at 409, 132 S.Ct. 945. And though no physical trespass occurred here as it did in Jones , the reasoning in Kyllo demonstrates that the Government may not rely upon technology that is not in general public use (and the NIT certainly is not) to search locations that would otherwise remain private, even if similar information could be gathered from a third party. See Kyllo , 533 U.S. at 34, 121 S.Ct. 2038.
In addressing prejudice under Rule 41, the Government argues that Mr. Taylor cannot, after having employed Tor to shield his location from investigators, "wield it as a sword" to prevent the government from obtaining a warrant to search his computer. (Doc. 26 at 42). Similarly, some courts have stated that an individual can have no reasonable expectation of privacy in property used to conduct illegal activity. See, e.g. , Werdene , 188 F.Supp.3d at 446 ; cf. U.S. v. Stanley , 753 F.3d 114, 120–21 (3d Cir. 2014) (finding that an individual who used his neighbor's wireless network to distribute child pornography had no objectively reasonable expectation of privacy in his wireless signal, especially because the purpose of the unauthorized connection was itself illegal). One district court ruling on the NIT warrant went a step farther and determined that, because of the ubiquity of hacking, an individual no longer has a reasonable expectation that his computer will not be hacked. See Matish , 193 F.Supp.3d at 620 (comparing the NIT's exploitation of a vulnerability in the Tor system to a police officer peering through broken blinds).
But these conclusions are a bridge too far for this court. The nature of Mr. Taylor's privacy interest cannot depend on whether he was engaging in illegal activity, or the Fourth Amendment would lose all meaning. And the use of Tor itself is legal.
Moreover, this court declines to hold that an individual never has a reasonable expectation that the contents of his computer will remain private simply because hackers' skills may outpace the development of cybersecurity. Indeed, federal law reflects a strong stance that hacking violates personal privacy, and that individuals' personal information is entitled to protection by the parties with whom they share it. See, e.g. , Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030(a)(5) (2012) (criminalizing the knowing transmission of "a program, information, code, or command" to and the intentional access of a protected computer without authorization, so as to cause damage); Telecommunications Act of 1996, 47 U.S.C. § 222, 501 (2012) (requiring telecommunications carriers to protect the confidentiality of customers' information, including location data, and providing for criminal penalties).
The court acknowledges that the Tor website cautions users that the Tor network cannot ensure total anonymity. See Tor: Overview, Tor , https://www.torproject.org/about/overview.html.en (last visited Feb. 14, 2016). However, that fact alone does not alter the conclusion that Defendant's interest in the privacy of his computer's contents is recognized by society as reasonable.
In sum, given the nature of the Tor program, the Government could discover the information seized here only by entering Mr. Taylor's personal computer through a back door—only by taking over the website itself. The NIT is not akin to a police officer peering through broken blinds into a house; it is more like a police officer acquiring a key to the house and entering through the back door to secretly observe activity in the living room. Cf. Workman , 205 F.Supp.3d at 1265 (noting that the government could not conduct a warrantless search of the defendant's home to seize an IP address written on a piece of paper).
This court finds that, although Mr. Taylor may not have had a reasonable expectation in the privacy of his IP address in the abstract, he did have a reasonable expectation of privacy in information that could be gleaned only from his computer. Thus, the Government required a warrant to execute the NIT, and the guarantees of the Fourth Amendment apply to the NIT warrant issued in the Eastern District of Virginia, as well as to the residential warrant issued in the Northern District of Alabama. The fact that the Government obtained a warrant, however, does not end the analysis.
B. Fourth Amendment Warrant Requirements
The focal point of analysis of this issue remains the Fourth Amendment: "[N]o Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." U.S. CONST. amend. IV. Mr. Taylor posits that the NIT warrant violated the Fourth Amendment in three different respects: officers' execution of the warrant exceeded its scope; the warrant lacked probable cause; and the warrant was insufficiently particular. Mr. Taylor also asserts that the Northern District of Alabama residential warrant operated as an unconstitutional general warrant.
1. Execution of the NIT Warrant
Defendant argues that the NIT warrant on its face does not authorize the search of computers located outside of the Eastern District of Virginia. The Government responds that "[t]he warrant and accompanying attachments made clear to the magistrate that the NIT was to be deployed initially to the web server hosting Playpen in the Eastern District of Virginia and then obtain information from computers that logged into Playpen, wherever they may be located." (Doc. 26 at 16). The Government cites language from the warrant and Attachment A and particularly from the NIT warrant's attached affidavit, which explains that the NIT was necessary to obtain the identities and locations of Playpen users and would operate by deploying to computers of any users who logged into the site without reference to where those computers and users were located.
Whether the method of execution of the warrant was reasonable provides the touchstone of this issue. Absent "flagrant disregard" of the terms of the warrant, items seized outside the scope of the warrant should not be suppressed. U.S. v. Wuagneux , 683 F.2d 1343, 1354 (11th Cir. 1982) (internal citations omitted). "Flagrant disregard" means that "the executing officer's conduct exceeds any reasonable interpretation of the warrant's provisions." See id. (internal citation omitted). The court should consider "[s]uch things as the scope of the warrant, the behavior of the searching agents, the conditions under which the search was conducted, and the nature of the evidence being sought" in determining whether the search was reasonable. U.S. v. Schandl , 947 F.2d 462, 465 (11th Cir. 1991) (citing U.S. v. Heldt , 668 F.2d 1238, 1254 (D.C. Cir. 1981) ). A warrant may incorporate by reference documents or affidavits attached to the warrant if the warrant uses proper words of incorporation. See Groh v. Ramirez , 540 U.S. 551, 557–558, 124 S.Ct. 1284, 157 L.Ed.2d 1068 (2004).
Like every other district court to examine this question, this court finds that the FBI's execution of the NIT warrant was objectively reasonable. See, e.g. , Rivera , 2:15–cr–00266–CJB–KWR (E.D. La. July 20, 2016), at 10; Michaud , 2016 WL 337263 at *4. The warrant on its face makes clear that Attachment A to the warrant describes the place to be searched. Attachment A explains that the NIT was to be deployed on a computer server in the Eastern District of Virginia and that the activating computers were "those of any user or administrator who logs into [Playpen]"—regardless of where those computers were physically located. (Doc. 26–1 at 1, 33). The attached affidavit further clarifies the nature of the NIT and specifies that deployment of the NIT is necessary because Playpen users' locations are unknown.
Given the text of the warrant, its attachments, and the circumstances surrounding the NIT search, this court cannot conclude that the FBI's reliance on the warrant to deploy the NIT to obtain Mr. Taylor's IP address and other identifying information was executed in flagrant disregard of the warrant's terms.
2. Probable Cause
Mr. Taylor argues that the FBI had probable cause to search and seize the website server itself but not computers that merely logged in to the server, because logging in does not necessarily mean that a user viewed child pornography; but under the warrant a computer was deemed an "activating computer" under the warrant if it merely logged in to the website. The Government responds that Agent Mcfarlane's affidavit, which describes the nature of the Playpen website and the steps a user had to take before logging into it, supported a determination of probable cause that any computer from which a person logged into the Playpen website would provide evidence of child pornography-related crimes.
In determining whether probable cause exists, a magistrate must "simply ... make a practical, common-sense decision whether, given all the circumstances set forth in the affidavit before him ... there is a fair probability that contraband or evidence of a crime will be found in a particular place." Illinois v. Gates , 462 U.S. 213, 238, 103 S.Ct. 2317, 76 L.Ed.2d 527 (1983). A district court's job is not to conduct a de novo review, but to consider whether the issuing magistrate judge had a "substantial basis" for concluding that probable cause existed. Id. at 236; 238–39, 103 S.Ct. 2317 (quoting Jones v. U.S. , 362 U.S. 257, 271, 80 S.Ct. 725, 4 L.Ed.2d 697 (1960), overruled on other grounds by U.S. v. Salvucci , 448 U.S. 83, 100 S.Ct. 2547, 65 L.Ed.2d 619 (1980) ).
Probable cause governs the warrant. A warrant must be tailored to provide for a search only of those places agents have probable cause to believe contain evidence of a crime:
[T]he scope of a lawful search is "defined by the object of the search and the places in which there is probable cause to believe that it may be found. Just as probable cause to believe that a stolen lawnmower may be found in a garage will not support a warrant to search an upstairs bedroom, probable cause to believe that undocumented aliens are being transported in a van will not justify a warrantless search of a suitcase."
Maryland v. Garrison , 480 U.S. 79, 84, 107 S.Ct. 1013, 94 L.Ed.2d 72 (1987) (quoting U.S. v. Ross , 456 U.S. 798, 824, 102 S.Ct. 2157, 72 L.Ed.2d 572 (1982) ).
Like every other court to address this issue, the court finds that the NIT warrant was supported by sufficient probable cause. See, e.g. , Henderson , 2016 WL 4549108, at *4 (N.D. Cal. Sept. 1, 2016) (internal citations omitted) ("The courts that have analyzed the NIT warrant have all found that it was supported by probable cause."). First, Playpen existed to enable access to child pornography. Second, the nature of Playpen was such that "[a]ccessing [it] ... require[d] numerous affirmative steps by the user, making it extremely unlikely that any user could simply stumble upon [Playpen] without understanding its purpose and content." (Doc. 26–1 at 13–14).
Any user logging into the Playpen hidden service would have had to take these steps: (1) download Tor software; (2) acquire the website's unique algorithm-generated address (most likely from a Playpen user or from another Tor hidden service page, like the one dedicated to child pornography described in the affidavit); (3) navigate to the Playpen homepage, featuring suggestive images of prepubescent females with directions regarding file uploading and posting; (4) create a Playpen account, which required viewing the instructions to enter a fake email address and take other steps to preserve one's identity; and (5) arrive at the main Playpen directory, which included forum titles that clearly alluded to illicit pornographic content of children. These "numerous affirmative steps" provided a more than substantial basis for the magistrate judge to find sufficient probable cause that any user logging into Playpen did so with the intent to access, view, and/or distribute child pornography; i.e., to engage in criminal conduct. (Doc. 26–1 at 13).
Moreover, several circuit courts have held that membership in a child pornography website alone sufficiently establishes probable cause, reasoning that an individual who took the affirmative steps necessary to become a member probably accessed or contributed to the site's illegal content. See, e.g. , U.S. v. Shields , 458 F.3d 269, 278 (3d Cir. 2006) (finding sufficient probable cause to search the defendant's home where defendant used a suggestive email address to join two online groups dedicated to exchanging child pornography); U.S. v. Froman , 355 F.3d 882, 890–91 (5th Cir. 2004) ("[I]t is common sense that a person who voluntarily joins a group such as Candyman [a website whose sole purpose was the exchange of child pornography ], remains a member of the group for approximately a month without cancelling his subscription, and uses screen names that reflect his interest in child pornography, would download such pornography from the website and have it in his possession."). This court finds these decisions persuasive and concludes that Playpen membership independently constituted sufficient probable cause for the magistrate judge to conclude that the computers of Playpen members who logged into the website would contain evidence of at least one child pornography-related crime.
The Eleventh Circuit has not directly addressed this membership question but cited the Shields and Froman reasoning in two opinions addressing different ultimate issues. Davidson v. U.S., 213 Fed.Appx. 769, 771–72 (11th Cir. 2007) (citing Shields and Froman ); U.S. v. Williams, 444 F.3d 1286, 1304 n.87 (11th Cir. 2006), rev'd on other grounds, U.S. v. Williams, 553 U.S. 285, 128 S.Ct. 1830, 170 L.Ed.2d 650 (2008) (citing Froman ).
Accordingly, the court concludes that the NIT warrant satisfied the probable cause requirement.
3. Particularity
Mr. Taylor argues that the warrant itself lacks sufficient specificity because it refers to "Attachment A" and "Attachment B" to describe the property to be searched and seized. The Government avers that these two documents were attached to the warrant, not the affidavit, and that the Supreme Court has specifically permitted this kind of incorporation by reference and attachment. (Doc. 26 at 20 (citing Groh , 540 U.S. 551 at 557–58, 124 S.Ct. 1284, 157 L.Ed.2d 1068 )).
A warrant must particularly describe the place to be searched and the items to be seized. U.S. CONST. amend. IV. Regarding place, the warrant must only "describe the premises in such a way that the searching officer may ‘with reasonable effort ascertain and identify the place intended.’ " U.S. v. Burke , 784 F.2d 1090, 1092 (11th Cir. 1986) (quoting U.S. v. Weinstein , 762 F.2d 1522, 1532 (11th Cir. 1985) ). Regarding items to be seized, "[a] description is sufficiently particular when it enables the searcher to reasonably ascertain and identify the things authorized to be seized." Wuagneux , 683 F.2d at 1348 (citing U.S. v. Cook , 657 F.2d 730, 733 (5th Cir. 1981) ). The Eleventh Circuit recognizes that "[e]laborate specificity is unnecessary." U.S. v. Strauss , 678 F.2d 886, 892 (11th Cir. 1982).
The court in Anzalone observed that "[e]very court to consider this question has found the NIT search warrant sufficiently particular." 208 F.Supp.3d at 368 (internal citations omitted). As discussed previously, the attachments were correctly incorporated into the NIT warrant by reference. Attachments A and B clearly identified the "place" to be searched (the NIT would be deployed to the computer server in the Eastern District of Virginia and then to computers logging into the Playpen website) and the information to be seized (Attachment B includes an itemized list of the seven pieces of information to be seized). Though the Constitution does not require elaborate specificity, the court finds it difficult to imagine how much more specific the descriptions of the place to be searched and the items to be seized could have been. The NIT warrant was sufficiently particular.
4. Northern District of Alabama Warrant
Additionally, Mr. Taylor maintains that the FBI's seizure of his personal property, pursuant to the Northern District of Alabama residential warrant, for offsite forensic testing when an initial search did not yield any pornographic images constituted unconstitutional exploratory "rummaging." See Coolidge v. New Hampshire , 403 U.S. 443, 467, 91 S.Ct. 2022, 29 L.Ed.2d 564 (1971). The Government correctly points out that the affidavit attached to the Northern District of Alabama residential search warrant included a non-exclusive list of techniques that might be used to search seized electronic information. See (Doc. 26–2 at 41–43). Further, as to electronic storage media or electronically stored information, the Federal Rules of Criminal Procedure specifically authorize "a later review of the media or information consistent with the warrant." FED. R. CRIM. P. 41(e)(2)(B). The court concludes that the Northern District of Alabama warrant and the officers' execution of it fell within constitutional bounds.
C. Section 636(a) of the Federal Magistrates Act & Rule 41(b)
Mr. Taylor argues that the NIT warrant was issued without authorization from § 636(a) of the Federal Magistrates Act, 28 U.S.C. § 631 et seq. (2012), and Federal Rule of Criminal Procedure 41. He contends that the warrant was thus void ab initio and that he was prejudiced by the seizure of evidence pursuant to it, warranting suppression. The Government responds that Rule 41 and § 636(a) authorized the magistrate to issue the NIT warrant; that, alternatively, any violation was merely technical, not constitutional, in nature and did not prejudice Mr. Taylor and the officers did not act in bad faith; and that, alternatively, the good faith exception to the exclusionary rule should prevent suppression in any case.
1. Whether the NIT Warrant Was Issued in Violation of § 636(a)
Section 636(a) of the Federal Magistrates Act provides that "[e]ach United States magistrate judge serving under this chapter shall have within the district in which sessions are held by the court that appointed the magistrate judge ... all powers and duties conferred or imposed upon United States commissioners by law or by the Rules of Criminal Procedure...." 28 U.S.C. § 636(a)(1) (2012) (emphasis added). Many other district courts ruling on the NIT warrant have analyzed the alleged § 636(a) and Rule 41(b) violations together, reasoning that the statute incorporates Rule 41(b) by virtue of granting to magistrate judges the power given to them by the Federal Rules; thus, the purported Rule 41(b) violation becomes the ultimate question. See, e.g. , Levin , 186 F.Supp.3d at 31–32 (stating that " Section 636(a) expressly incorporates any authorities granted to magistrate judges by the Federal Rules of Criminal Procedure" and concluding that " Section 636(a)(1) is inapposite because Rule 41(b) did not confer on the magistrate judge authority to issue the NIT warrant"); Tran , 226 F.Supp.3d at 65, 2016 WL 7468005, at *5 (citing Levin for the proposition that "[w]hether the Federal Magistrates Act was violated can be answered by asking if the warrant complies with Rule 41").
The statute also provides that magistrate judges shall have power "at other places where that court may function, and elsewhere as authorized by law," but neither such area is at issue here. See § 636(a).
This court declines to read the independent jurisdictional limitations out of the statute. The Act limits the exercise of magistrate judges' power and duties to "within the district" of the appointing court. "[T]he grammatical structure of the sentence indicates that magistrate judges shall have those powers specified by rule or other law (e.g., Rule 41 ), but those powers are effective only in certain specified geographic areas—and, as we've seen, none of those areas is implicated here." U.S. v. Krueger , 809 F.3d 1109, 1119 (10th Cir. 2015) (Gorsuch, J., concurring) (affirming the district court's grant of a motion to suppress evidence seized pursuant to a warrant to search property in Oklahoma that had been issued by a magistrate judge in Kansas). If the mandates of the statute and the rule are not examined separately, "[t]he statute might as well be written this way: Magistrate judges shall have all powers and duties conferred or imposed by law or by the rules." See id.
The Government argues that § 636(a) does not limit the locations in which a magistrate judge's exercise of power may have effect , which is correct; however, it presumes that the search and seizure here took place in the Eastern District of Virginia and had effects in the Northern District of Alabama. But the court has already determined that the search itself took place in Alabama. The Government's argument illustrates why most courts have analyzed the statute and Rule together—as goes the magistrate's authority under § 636(a), so goes her authority under Rule 41, because the Rule cannot give the magistrate more power than does the statute. See Rules Enabling Act, 28 U.S.C. § 2072 (2012) (providing that rules of procedure may not "abridge, enlarge or modify any substantive right"); cf. Krueger , 809 F.3d at 1125 (Gorsuch, J., concurring) (explaining that our government is one of divided power and that because magistrate judges do not enjoy Article III protections, Congress has curbed their geographic authority). Thus, whether the authority of the magistrate judge to issue the NIT warrant fell within the statute or the Rule, or neither, turns on where the search took place.
The court finds that the "within the district" language of § 636(a) is not surplusage; the magistrate judge had no jurisdiction to issue a warrant for a search in another district than where she sat. Because the NIT warrant authorized a search in a district different from that in which the magistrate judge may exercise her Rule 41 power to issue a search warrant, it was "no warrant at all," or void ab initio for want of jurisdiction. See Krueger , 809 F.3d at 1118, 1123 (Gorsuch, J., concurring).
2. Whether the NIT Warrant Was Issued in Violation of Rule 41(b)
In the alternative, the court concludes that the warrant was issued without authority under Federal Rule of Criminal Procedure 41(b). Titled "Authority to Issue a Warrant," that rule provides in relevant part that a magistrate judge has authority to issue a warrant (1) "to search for and seize a person or property located within the district"; (2) "for a person or property outside the district if the person or property is located within the district when the warrant is issued but might move or be moved outside the district before the warrant is executed"; and (4) "to install within the district a tracking device; the warrant may authorize use of the device to track the movement of a person or property located within the district, outside the district, or both."
The December 1, 2016 amendments to the Rule changed this title to "Venue for a Warrant Application." See Fed. R. Crim. P. 41(b).
Subsections (3) and (5) of Rule 41(b) are inapplicable here.
Sections 41(b)(1) and (b)(2) did not imbue the magistrate with issuing authority. Both these subsections require that the property to be searched/seized be located in the same district as the issuing magistrate at the time the warrant is issued; but the location of the property searched—Mr. Taylor's computer—and seized—his IP address and other identifying information—were unknown by the FBI at the time it applied for the warrant. Mr. Taylor's computer was at all relevant times located in the Northern District of Alabama, and many of the other activating computers were located outside of the Eastern District of Virginia. True, as the Government notes, the FBI installed the NIT on the server in the Eastern District of Virginia. But as the court has already determined, the Defendant's computer was the object of the search and that search occurred in Alabama.
Similarly, Rule 41(b)(4) did not empower the magistrate judge to issue the NIT warrant. First, the NIT is not a "tracking device," which is defined in Rule 41(a)(2)(E) by reference to 18 U.S.C. § 3117(b) as "an electronic or mechanical device which permits the tracking of the movement of a person or object." FED. R. CRIM. P. 41(a)(2)(E) ; 18 U.S.C. § 3117(b) (2012). The NIT did not track movement like the beeper in Knotts ; rather, it conducted a search for several pieces of identifying information from activating computers, each in one static location. See Adams , 2016 WL 4212079, at *6 ("[T]he NIT does not track; it searches."); Rivera , 2:15–cr–00266–CJB–KWR (E.D. La. July 20, 2016), at 15 (noting that "the NIT could do much more than simply track a computer's location").
Second, even if the NIT were a tracking device, it was not "installed" in the Eastern District of Virginia, but at the location of the activating computer, in this case, in the Northern District of Alabama. The Government characterizes the NIT as a tracking device because it was attached to Playpen content in the Eastern District of Virginia, traveled to Defendant's computer in the Northern District of Alabama, and permitted the Government to identify Mr. Taylor's computer and his location.
Though this question is a close call, the court concludes that the Government's position ultimately misconstrues the nature of the property tracked; the contents of Mr. Taylor's computer, not the Playpen content he downloaded, would be the property "tracked" by the NIT, and neither his computer nor its contents ever entered into the Eastern District of Virginia for installation of the tracking device. See Michaud , 2016 WL 337263, at *6 (observing that the tracking device analogy "breaks down" if the installation is deemed to have occurred on the server in the Eastern District of Virginia, because the defendant "never controlled the government-controlled computer, unlike a car with a tracking device leaving a particular district," and similarly fails if the installation occurred on the defendant's computer outside of the issuing district); but see, e.g. , Matish , 193 F.Supp.3d at 612 (describing the process of logging into Playpen as taking a "virtual trip" to Virginia and so permitting the installation of the NIT in the Eastern District of Virginia).
The Government additionally argues that the NIT warrant was issued by a magistrate judge in the district with the strongest known connection to the search. While this point may be true, it does not follow that Rule 41 authorized the magistrate judge to issue the warrant. The court is bound to interpret Rule 41 as it is written, not to approve any warrants for which the issuing venue merely appears reasonable. Further, the Government contends that Rule 41 has been interpreted flexibly and has been read as permitting searches not expressly prohibited by the rule or by statute. See U.S. v. New York Tel. Co. , 434 U.S. 159, 169, 98 S.Ct. 364, 54 L.Ed.2d 376 (1977) ; U.S. v. Koyomejian , 970 F.2d 536, 542 (9th Cir. 1992) (en banc).
However, the New York Telephone and Koyomejian cases both involved a kind of search not addressed one way or the other by the text of Rule 41 (the use of a pen register to collect telephone numbers when the definition of "property" did not yet include information and video surveillance, respectively), not the location of a search, which is addressed by the wording of Rule 41. This court in any case declines to legislate by reading into the statute language that Congress did not place there.
Further bolstering this conclusion is the addition to Rule 41 that became law on December 1, 2016, permitting a magistrate judge to issue a warrant "to use remote access to search electronic storage media and to seize or copy electronically stored information located within or outside that district if: (A) the district where the media or information is located has been concealed through technological means...." Fed. R. Crim. P. 41(b)(6). The addition of this text suggests that the prior version of the Rule did not permit a magistrate judge to issue a warrant in such a situation.
a. Nature of the Rule 41 Violation
A Rule 41 violation is either "technical" or "procedural," as courts have phrased it, or constitutional. See, e.g. , Adams , 2016 WL 4212079, at *6 ("The Court views a Rule 41(b) violation to be a technical or procedural violation...."). "[U]nless a clear constitutional violation occurs, noncompliance with Rule 41 requires suppression of evidence only where (1) there was prejudice in the sense that the search might not have occurred or would not have been so abrasive if the rule had been followed, or (2) there is evidence of intentional and deliberate disregard of a provision in the Rule." U.S. v. Gerber , 994 F.2d 1556, 1560 (11th Cir. 1993) (quoting U.S. v. Loyd , 721 F.2d 331, 333 (11th Cir. 1983) (per curiam)).
First, the Rule 41 violation here was constitutional. True, as the Government points out, the Fourth Amendment does not impose a venue requirement; rather, it requires only that a warrant be (1) signed by a neutral, detached magistrate; (2) supported by probable cause; and (3) sufficiently particular. See Dalia v. U.S. , 441 U.S. 238, 255, 99 S.Ct. 1682, 60 L.Ed.2d 177 (1979). But inherent in the notion of a "neutral, detached magistrate" is that the magistrate have authority to issue the warrant. See Shadwick v. City of Tampa , 407 U.S. 345, 352, 92 S.Ct. 2119, 32 L.Ed.2d 783 (1972) (holding, in answer to "[t]he single question [of] whether power has been lawfully vested," that municipal court clerks may issue warrants) (emphasis added); U.S. v. Glover , 736 F.3d 509, 515 (D.D.C. 2013) (holding that a Rule 41(b) violation constituted a "jurisdictional flaw" inexcusable as a "technical defect"); U.S. v. Master , 614 F.3d 236, 241 (6th Cir. 2010) (holding that a warrant issued by a judge lacking authority violated defendant's Fourth Amendment rights).
Second, even if not a constitutional violation, Mr. Taylor was prejudiced by the Rule 41 violation. Although the Eleventh Circuit has not interpreted "the search might not have occurred" to the same extent as other circuits, this court concurs with the majority's reasoning in Krueger that the correct standard inquires "whether the issuing federal magistrate judge could have complied with the rule." See Krueger , 809 F.3d at 1116 ; Adams , 2016 WL 4212079, at *8 (M.D. Fla.) (holding that the defendant was prejudiced by the Rule 41 violation because "[h]ad the magistrate judge followed Rule 41(b), the search of Defendant's computer would not have occurred").
The use of Tor made recovering Defendant's IP address and other identifying information without the NIT impossible; Mr. Taylor had a reasonable expectation of privacy in the contents of his computer, meaning that the seven pieces of information seized by the NIT warrant could not have been obtained in the absence of the NIT warrant. The issuing magistrate judge could not comply with Rule 41 because it did not empower her to authorize searches outside of her district. Mr. Taylor, therefore, was prejudiced by the Rule 41(b) violation.
However, no evidence supports a finding of intentional and deliberate disregard of the Rule. The very existence of divergent interpretations of Rule 41(b) by district court judges across the country demonstrates that reasonable minds may interpret the Rule, and where the searches under the NIT took place, differently.
3. Suppression
a. Suppression of Evidence Seized Pursuant to a Warrant Void Ab Initio
Under the statute and Rule 41, both of which limit a magistrate judge's authority to issue a warrant, the NIT warrant was void ab initio , meaning that the FBI's search of Mr. Taylor's computer and the seizure of evidence pursuant to it were conducted without a valid warrant and thus were unreasonable in violation of the Fourth Amendment. But "[t]he fact that a Fourth Amendment violation occurred ... does not necessarily mean that the exclusionary rule applies" to "forbid[ ] the use of improperly obtained evidence at trial." Herring v. U.S. , 555 U.S. 135, 139–140, 129 S.Ct. 695, 172 L.Ed.2d 496 (2009). Rather, "[t]o trigger the exclusionary rule, police conduct must be sufficiently deliberate that exclusion can meaningfully deter it, and sufficiently culpable that such deterrence is worth the price paid by the justice system." Id. at 144, 129 S.Ct. 695. This balancing test is an objective one that does not assess officers' subjective intent. Id. at 145, 129 S.Ct. 695.
The "good faith" line of cases, beginning with U.S. v. Leon in 1984, implements the balancing of these factors by carving out an exception to the exclusionary rule where the search was the result of objectively reasonable behavior by officers. See Davis v. U.S. , 564 U.S. 229, 238–39, 131 S.Ct. 2419, 180 L.Ed.2d 285 (2011). The Supreme Court in Leon itself held that when officers are objectively reasonable in relying on a search warrant that is later invalidated, any evidence seized pursuant to that search warrant should not be suppressed. U.S. v. Leon , 468 U.S. 897, 922, 104 S.Ct. 3405, 82 L.Ed.2d 677 (1984).
Whether the good faith exception is available for a warrant that is void ab initio is an open question in the Eleventh Circuit. Many of the district courts ruling on the NIT warrant have addressed the issue, as have a handful of other state and federal courts. See, e.g. , Master , 614 F.3d at 242–43 (overruling its previous holding that the good faith exception does not apply to a warrant issued without jurisdiction and remanding for consideration of the deterrent value and costs of suppression); Werdene , 188 F.Supp.3d at 449–453 (following Master and ultimately finding suppression not warranted); Levin , 186 F.Supp.3d at 41 (finding that the good faith exception did not apply to the void ab initio NIT warrant).
The court concurs with the reasoning of the court in Werdene that, given the balancing test articulated in Leon and its progeny, including Herring , "the legal status of the warrant under the Fourth Amendment does not inform the decision of whether the good faith exception is available in a given case; that inquiry is separate and must be considered in light of the exclusionary rule's purpose and the officers' conduct at issue." 188 F.Supp.3d at 451 (citing Master , 614 F.3d at 243 ). Thus, the court proceeds to the good faith inquiry.
b. Application of the Good Faith Exception
Assuming either a constitutional violation or prejudice under Rule 41(b), the court finds that the good faith exception to the exclusionary rule applies here; the officers were objectively reasonable in relying on the NIT warrant.
As the court in Werdene found:
[T]o the extent a mistake was made in this case, it was not made by the agents.... Rather, it was made by the magistrate when she mistakenly issued a warrant outside her jurisdiction. The agents consulted with federal attorneys before preparing the warrant application. They presented the magistrate judge with all relevant information to allow her to make a decision as to whether Rule 41(b) permitted her to issue the warrant. The FBI agents did not misrepresent how the search would be conducted or, most importantly, where it would be conducted.
188 F.Supp.3d at 452–453 (internal citations omitted).
The court acknowledges that, contrary to this court, the court in Werdene concluded that no constitutional violation occurred in the issuance of the NIT warrant, but as an alternative ruling found good faith. See Werdene, 188 F.Supp.3d at 446, 448, 451. This court finds the Werdene court's reasoning on the issue of good faith persuasive.
--------
As to warrants, the good faith exception does not apply where (1) the issuing judge is "misled by information in an affidavit that the affiant knew was false or would have known was false except for his reckless disregard of the truth"; (2) the judge "wholly abandoned his judicial role"; (3) the affidavit on which the warrant was based was "so lacking in indicia of probable cause as to render official belief in its existence entirely unreasonable"; or (4) the warrant is "so facially deficient—i.e., in failing to particularize the place to be searched or the things to be seized—that the executing officers cannot reasonably presume it to be valid." Leon , 468 U.S. at 923, 104 S.Ct. 3405 (internal citations omitted).
Defendant does not allege that any of these circumstances indicating bad faith are present here, and indeed none are supported by the record. None of the information in Special Agent Mcfarlane's affidavit was false. The magistrate judge in the Eastern District of Virginia did not wholly abandon her judicial role; the divergent results of the various motions to suppress resulting from the NIT warrant are themselves evidence that the magistrate judge did not make a determination completely outside the realm of reason. This court has already found that the NIT warrant was supported by probable cause. And the court has also determined that the warrant additionally complied with the particularity requirements of the Fourth Amendment, making it facially valid.
"A magistrate judge's mistaken belief that she had jurisdiction, absent any indicia of reckless conduct by the agents, does not warrant suppression." Werdene , 188 F.Supp.3d at 453 ; see Leon , 468 U.S. at 916, 104 S.Ct. 3405 ("[T]he exclusionary rule is designed to deter police misconduct rather than to punish the errors of judges and magistrates."). Exclusion of the evidence seized pursuant to the NIT warrant would serve little deterrent purpose where the mistaken conduct of the magistrate judge, not the officers, invalidated the warrant. Accordingly, the court finds that suppression is an inappropriate remedy for the Fourth Amendment and/or Rule 41 violation(s) that occurred here.
III. Conclusion
The court FINDS that Mr. Taylor had a reasonable expectation of privacy in the contents of his computer, such that the FBI's actions in deploying the NIT constituted a search under the Fourth Amendment, mandating a warrant. The court FINDS that the executing officers did not exceed the scope of the warrant and that the NIT warrant was supported by probable cause and was sufficiently particular; additionally, the court FINDS that the Northern District of Alabama warrant was constitutionally issued and executed. However, the court FINDS that the NIT warrant was not authorized under 28 U.S.C. § 636(a) of the Federal Magistrates Act or, in the alternative, Federal Rule of Criminal Procedure 41(b).
The court FINDS that the statutory and Rule violations resulted in the NIT warrant being void ab initio , making the search of Mr. Taylor's computer unreasonable under the Fourth Amendment; further, the Rule 41(b) violation prejudiced Mr. Taylor. But the court FINDS that the good faith exception to the exclusionary rule applies to prevent suppression of the evidence seized pursuant to the NIT warrant, including the evidence seized pursuant to the secondary residential warrant issued in the Northern District of Alabama.
Accordingly, the court WILL DENY Defendant's Motion to Suppress. The court will enter a separate order consistent with this Opinion.
DONE and ORDERED this 24th day of April, 2017.