Opinion
CRIMINAL ACTION NO. 5:17-32-KKC
09-19-2017
UNITED STATES OF AMERICA, Plaintiff, v. EASA S. EQAL, Defendant.
OPINION AND ORDER
*** *** ***
This matter is before the Court on the defendant's motion to suppress (DE 20). The Court has conducted a hearing on the motion and the parties have submitted post-hearing briefs and supplemental briefs. While the magistrate judge located in Virginia may not have had authority to issue the warrant that ultimately led to a search of defendant Easa Eqal's computer in Kentucky, the officers relying on the warrant acted in good faith. Accordingly, the motion is DENIED.
I. Facts
Eqal is charged with one count of receiving child pornography in violation of 18 U.S.C. § 2252(a)(2) and one count of possessing it in violation of 18 U.S.C. § 2252(a)(4)(B).
At the hearing on this matter, Kathryn Reed, a member of the FBI's Child Exploitation Task Force, testified that Eqal's case is part of a nationwide investigation. The investigation has resulted in motions to suppress in various courts across the country with differing outcomes.
At the center of the investigation is a website called Playpen, which was dedicated to "the advertisement and distribution of child pornography." (DE 20-2, NIT Warrant at 14.) Playpen was a "hidden service" on, what Reed described as, the "dark web." To access the dark web, users have to download special software such as The Onion Router ("Tor"). (DE 20-2, NIT Warrant at 14.)
Agent Reed testified that every computer has a unique IP address which is provided to users by Internet service providers like Time-Warner Cable. When a person accesses a website through normal means, the website has a record of that person's IP address. Investigators can obtain the IP address from the website operator and then obtain the identity of the person from the Internet service provider.
Websites on the Tor network, however, can be set up as "hidden services," which means that the IP address for the webserver is hidden so that neither law enforcement nor the website's users can determine the location of the computer hosting the website. (DE 20-2, NIT Warrant at 16.) Likewise, Reed explained, the IP addresses of individuals accessing hidden services on the Tor network are hidden.
Hidden services cannot be accessed through traditional web browsers. (DE 20-3, Ky. Warrant at 11.) Even after connecting to the Tor network, in order to access the hidden services, a user must know the web address of the website the user wishes to visit. (DE 20-2, NIT Warrant at 16.) Thus, accessing hidden services like the Playpen website requires "numerous affirmative steps by the user, making it extremely unlikely that any user could have simply stumbled upon" the site. (DE 20-2, NIT Warrant at 16.)
The Playpen website contained a warning that only registered members were allowed to access it and a hyperlink to a registration page. (DE 20-2, NIT Warrant at 13.) The registration page informed users that they were required to enter an email address that looked to be valid but that they should not enter a real email address. (DE 20-2, NIT Warrant at 13.) It also warned, "[F]or your security you should not post information here that can be used to identify you." (DE 20-3, Ky. Warrant at 14.) The website provided other recommendations on how users could hide their identity. (DE 20-3, Ky. Warrant at 14.)
In December 2014, an unidentified foreign law enforcement agency informed the FBI that Playpen originated from a computer with a United States-based IP address. (DE 20-2, NIT Warrant at 25.) In January 2015, the FBI obtained a search warrant for that computer server and it copied the contents of the Playpen website onto a government server. (DE 20-2, NIT Warrant at 26.)
Because Playpen was a hidden service on the Tor network, the FBI could not obtain the identity of its users by the methods used for normal websites. For a normal website not on the Tor network, the FBI could obtain the site's IP address logs and then utilize a publicly available resource to determine what Internet service provider owned each particular IP address. (DE 20-2, NIT Warrant at 26.) The FBI would then subpoena that service provider to determine the user to which that IP address was assigned. (DE 20-2, NIT Warrant at 26.)
In order to obtain the identifies of the users of the Playpen website, on February 19, 2015, the FBI arrested the individual operating Playpen and assumed administrative control of the Playpen website. (DE 20-2, NIT Warrant at 27.) On February 20, 2015, the FBI obtained a search warrant from Magistrate Judge Theresa Buchanan in the Eastern District of Virginia. The warrant permitted the FBI to use a network investigative technique (NIT) to locate the administrators and users of Playpen. (DE 20-2, NIT Warrant at 28.) The NIT involved installing software onto the government's Playpen server in Virginia.
Websites always send instructions to their visitor's computers, which allow the user's computer to display web pages. (DE 20-2, NIT Warrant at 28.) With the NIT, the Playpen website - now operated by the FBI - sent additional instructions to the user's computer. (DE 20-2, NIT Warrant at 28.) Those instructions caused the user's computer to transmit certain information back to Virginia to a computer controlled by the government. (DE 20-2, NIT Warrant at 28.) The instructions were sent anytime a user or administrator logged onto Playpen. (DE 20-2, NIT Warrant at 30.) The information that was transmitted back to the government included the computer's IP address, the type of operating system running on the computer, and the computer's media access control (MAC) address. (DE 20-2, NIT Warrant at 3, 4.) The information was intended to assist the FBI in identifying the user's computer, the location of the computer, and the identity of the user. (DE 20-2, NIT Warrant at 29.)
The NIT was employed from approximately February 20, 2015 to March 4, 2015. (DE 20-3, Ky. Warrant at 17-18.) On February 23, 2015, a user named "Bigbees" registered on the site. (DE 20-3, Ky. Warrant at 19.) According to that user's profile, Bigbees logged on the website for a total of 3 hours, 41 minutes and 30 seconds between February 23, 2015 and March 4, 2015. (DE 20-3, Ky. Warrant at 19.) The NIT captured Bigbees' IP and MAC addresses. Using publicly available websites, the FBI determined that the captured IP address was operated by Time Warner Cable. (DE 20-3, Ky. Warrant at 29.)
Pursuant to a subpoena, Time Warner Cable provided the FBI with information indicating that the IP address belonged to Sam Eqal, who was receiving Internet service at a particular address in Lexington, Kentucky. (DE 20-3, Ky. Warrant at 21.) The NIT also collected information indicating that Bigbees' host name was Easa and log-on name was Easa, which the FBI knew was the first name of an adult male residing in the premises. (DE 20-3, Ky. Warrant at 21.)
Reed testified that she received information in September 2015 that the FBI had traced the user Bigbees to a Lexington address. She testified that the FBI sent her a disc indicating which forums on the Playpen website Bigbees had accessed. Reed testified that she knew from the information provided to her that Bigbees was a relatively new user on the site. Reed was able to discern from the information the FBI provided to her what sorts of materials and images Bigbees had accessed on the site. She confirmed that the images viewed constituted child pornography.
Kentucky law enforcement officers began surveillance of the residence and observed two cars parked in the driveway, both registered to Sam N. Eqal. (DE 20-3, Ky. Warrant at 21.) The officers searched a public record database and learned that four adult individuals with the surname Eqal resided at the residence, including the defendant Easa Eqal. (DE 20-3, Ky. Warrant at 22.) On February 18, 2016, Magistrate Judge Robert Wier issued a search warrant authorizing a search of Eqal's residence. (DE 20-3, Ky. Warrant at 22.)
Reed testified that the search warrant was executed on February 22, 2016. She testified that Eqal was present on the date the FBI conducted the search. She explained that forensics experts conducted an on-site review of Eqal's computer on the day of the search. She testified that the FBI obtained a computer, a hard drive, and several flash drives that belonged to Eqal and that she identified over 40 videos and over 1,000 still images, which are the basis for the charges in the indictment against Eqal.
Eqal moves to dismiss this evidence, arguing that Magistrate Judge Buchanan in the Eastern District of Virginia did not have authority to issue the warrant authorizing the NIT and, thus, evidence obtained from his residence should be suppressed as the fruit of the poisonous tree.
II. Analysis
Dozens of district courts have ruled on motions to suppress similar to this one in connection with the Playpen investigation. By far the majority of courts have denied the motion, finding either that the Virginia magistrate judge had authority to issue the warrant authorizing the NIT or that the so-called Leon exception to the exclusionary rule set forth in United States v. Leon, 468 U.S. 897 (1984) applied. Two Courts of Appeals - the Eighth and Tenth Circuits - have issued opinions on the Playpen suppression motions. In both cases, the courts decided the motions should be denied because, even if the warrant exceeded the magistrate judge's authority, the Leon exception applied. United States v. Workman, 863 F.3d 1313, 1317 (10th Cir. July 21, 2017); United States v. Horton, 863 F.3d 1041, 1048 (8th Cir. July 24, 2017).
The Leon exception to the exclusionary rule, "allows admission of evidence seized in reasonable, good-faith reliance on a search warrant that is subsequently held to be defective." United States v. Evers, 669 F.3d 645, 654 (6th Cir.2012) (citation and internal quotations omitted). This is because the "sole purpose" of the exclusionary rule "is to deter future Fourth Amendment violations." Davis v. United States, 564 U.S. 229, 236-37 (2011). Thus, the rule should be used "as a last resort," and only where "the deterrence benefits of suppression . . . outweigh its heavy costs." Id. at 237. Under the Leon exception to the exclusionary rule, evidence obtained pursuant to a defective warrant remains admissible when the executing agents "act with an objectively reasonable good-faith belief that their conduct is lawful or when their conduct involves only simple, isolated negligence." Id. at 238.
To ensure continued judicial guidance to magistrate judges and law enforcement officers, there are cases where the court should first decide whether the Fourth Amendment has been violated before proceeding to whether the Leon good-faith exception is applicable. This is true "[i]f the resolution of a particular Fourth Amendment question is necessary to guide future action by law enforcement officers and magistrates." Leon, 468 U.S. at 925. It is also true if the court should determine that "magistrates under their supervision need to be informed of their errors." Id. But the Court should turn immediately "to a consideration of the officers' good faith" where a suppression motion poses "no important Fourth Amendment questions." Id.
Rule 41 has now been amended to permit the very action that the Virginia magistrate judge took. Under new Rule 41(b)(6) - which did not exist at the time of the actions at issue here - a magistrate judge may "issue a warrant to use remote access to search electronic storage media and to seize or copy electronically stored information located within or outside that district if . . . the district where the media or information is located has been concealed through technological means." Accordingly, resolving whether the search here was unconstitutional will not provide a guide for future action by law enforcement officers and magistrates.
The Court will therefore assume that the magistrate judge in Virginia did not have authority to issue the warrant authorizing the NIT. Under 28 U.S.C. § 636(a), a magistrate judge only has authority in the district in which she is appointed. Further, under Federal Rule of Criminal Procedure 41, a magistrate "has authority to issue a warrant to search for and seize a person or property located within the district." Fed. R. Crim. P. 41(b)(1) (emphasis added). The Court will assume that the NIT exceeded the magistrate's authority under Rule 41 as it existed at the time the warrant was issued and under Section 636(a) because the warrant permitted the government to "search" computers outside of the Eastern District of Virginia.
The government argues that the magistrate judge had authority to issue the NIT under Rule 41(b)(4). That rule permits a magistrate judge "to issue a warrant to install within the district a tracking device," which tracks "the movement of a person or property" located outside the district. For purposes of this opinion, the Court will assume that the NIT was not a tracking device permitted under Rule 41(b)(4).
The Court will further assume that the fact that the magistrate judge was not authorized to issue the warrant renders the warrant void ab initio. See Horton, 863 F.3d at 1049. This would mean the search was essentially warrantless in violation of the Fourth Amendment. Id. Regardless, the Leon exception to the exclusionary rule applies even to warrants that are void ab initio. United States v. Master, 614 F.3d 236, 242 (6th Cir. 2010).
As to the good faith of the officers executing the Virginia warrant, they understood the NIT would permit software to be installed on a government server located in the Eastern District of Virginia "and that all information from the search would be retrieved in that district." Workman, 863 F.3d at 1320. "The executing agents could reasonably rely on the magistrate judge's authority to issue a warrant authorizing installation and retrieval of information in the Eastern District of Virginia." Id.
Eqal cites no case law that existed at the time the warrant was issued that prohibited a magistrate judge from authorizing the installation of software on a computer located in her district that permitted the retrieval of electronic data in another district. Id. Nor does he cite any case law making clear that a NIT like that at issue in this case was not a tracking device authorized under Rule 41(b). Thus, the executing officers "could reasonably defer to the magistrate judge on these nuanced legal issues." Id. Indeed, multiple federal judges have ruled that the warrant complies with federal law and the federal rules even though it permitted data to be extracted from computers outside the Eastern District of Virginia. Id. at 1321. Thus, reasonable minds could - and have - differed on the magistrate's authority to issue the warrant. Id. "[O]fficers are generally not required to second-guess the magistrate's decision in granting a warrant." Id. (citing United States v. Gonzales, 399 F.3d 1225, 1228-29 (10th Cir. 2005)). The executing agents' reliance on the warrant was objectively reasonable.
Eqal argues the Leon good-faith exception is not applicable because the officers who obtained the Virginia warrant proposed to engage in blatantly illegal activity - the operation of a website that disseminated child pornography. Eqal argues that these actions not only permitted the officers to engage in a "blind fishing expedition" but also violated federal laws protecting crime victims and restricting the disclosure and use of property that constitutes child pornography. 18 U.S.C. §§ 3771, 3509(d).
As to whether the warrant permitted a "blind fishing expedition," it did not. The NIT permitted the government to retrieve information only from individuals who had engaged in several affirmative steps to access a website dedicated to the advertisement and distribution of child pornography.
As to whether the warrant permitted officers to engage in blatantly illegal activity, the Court sees no meaningful distinction between the government's conduct in this case and its conduct in a "reverse sting" operation in which "the police pose as sellers of [contraband], set up deals with would-be buyers under carefully controlled conditions, and arrest the purchasers following the sham sale." United States v. Tucker, 28 F.3d 1420, 1421 (6th Cir. 1994) (citation omitted).
Other district courts have addressed the propriety of the FBI's activities in the Playpen investigation. The defendants in these cases challenged the FBI's activities not in motions to suppress, but in motions to dismiss the indictment. In doing so, they relied on case law rooted in Supreme Court dicta recognizing the possibility that, "we may some day be presented with a situation in which the conduct of law enforcement agents is so outrageous that due process principles would absolutely bar the government from invoking judicial processes to obtain a conviction." United States v. Pipes, 87 F.3d 840, 843 (6th Cir. 1996) (quoting United States v. Russell, 411 U.S. 423, 431 (1973)).
Based on this dicta, some courts have recognized a so-called "outrageous government conduct" defense, which, unlike an entrapment defense, is "based solely on an objective assessment of the government's conduct." Tucker, 28 F.3d at 1423. The Sixth Circuit, however, has rejected the defense. Id. at 1428. Nevertheless, cases analyzing the propriety of the FBI's conduct with regard to that defense are instructive in determining whether the officers acted in bad faith for Fourth Amendment purposes.
In United States v. Kim, No. 16-CR-191, 2017 WL 394498 (E.D.N.Y. Jan. 27, 2017), the court noted that all courts have declined to dismiss the Playpen indictments under the outrageous conduct defense. Id. at * 4 (citing cases). In reaching that same conclusion, the court began by recognizing the "well-established deference to the Government's choice of investigatory methods." Id. at *2. "The FBI's weighing of the costs and benefits of allowing the Playpen website to remain fully functional during the investigation is precisely the type of difficult decision-making that law enforcement must be allowed to make without undue second-guessing by the judiciary." Id. at *5. "The decision not to render Playpen, in effect, a dummy website during the investigation, as Defendant suggests . . . was one for the FBI, and not the Court or Defendant, to make." Id.
The court noted that the FBI did not actually post any pornography on the site but instead simply "let it continue to operate so that the NIT could be used to identify the website's users and other information that would assist the government in investigating and prosecuting them." Id. Further, the FBI "ceased the operation as soon as it determined that the costs outweighed the benefits, which was within two weeks." Id. As to the public benefits of the investigation, the court noted that, as of January 2015, the government "had identified or recovered 26 child victims from abuse and charged at least 137 individuals in the United States." Id.
Likewise, in United States v. Anzalone, 221 F. Supp. 3d 189 (D. Mass. 2016), the court determined that "the FBI maintained access to the site's content because it predicted that significant changes to the site would tip off Playpen's users, making it more difficult to find and arrest them." Id. at 194. The Massachusetts court further noted, "The FBI convened regularly to assess the continued benefits of the investigation. When it concluded that the costs outweighed the benefits of keeping the site online, the FBI shut the site down. The FBI also continuously monitored postings to the site and took immediate action where it determined that a child was in imminent danger." Id. In fact, the Massachusetts court found, "as of October 2016, at least forty-nine children have been identified or rescued from abuse" as a result of the Playpen investigation. Id.
In United States v. Vortman, No. 16-CR-210, 2016 WL 7324987 (N.D. Cal. Dec. 16, 2016), the court noted "the government did not threaten, coerce, or prod [the defendant] to use Playpen." Id. at *4. Instead, the defendant's actions in accessing the child pornography on the site were "completely voluntary." Id. Further, the court noted the government did not orchestrate the child pornography enterprise. It "merely attached itself to a child pornography operation that was already in full operation." Id. The FBI did not create Playpen, add any content to the website, or engage with the site's users. Id. at *5. The court recognized "the difficulties law enforcement agents face in stopping and preventing [clandestine child pornography operations] are exacerbated with the creation of technologies that can conceal a person's identity in the digital realm." Id.
The FBI acted in good faith in executing the NIT warrant. The Court will not lightly second-guess the FBI's decisions regarding how best to conduct an investigation. This is especially true with regard to investigations of individuals who distribute and receive child pornography via the dark web and hidden services, which are designed precisely to permit users to evade detection. The FBI's decision to administer the Playpen site was reasonable. Without doing so, the officers would have no means of determining the identity of the site's users and administrators. The FBI did not create the site and there is no evidence that the FBI actually posted anything on it. Further, the FBI operated the site for a limited amount of time. There is no allegation that the government induced Eqal to use the site. He did so voluntarily and without any prior communication from the government.
For all these reasons, the Court finds that the officers who relied on the warrant issued in Virginia did so in good faith. Accordingly, pursuant to the Leon exception to the exclusionary rule, the Court hereby ORDERS that Eqal's motion to suppress (DE 20) is DENIED.
Dated September 19, 2017.
/s/
KAREN K. CALDWELL, CHIEF JUDGE
UNITED STATES DISTRICT COURT
EASTERN DISTRICT OF KENTUCKY