Opinion
Case No. 15-cr-00565-WHO-1
09-01-2016
UNITIED STATES OF AMERICA, Plaintiff, v. BRYAN GILBERT HENDERSON, Defendant.
ORDER DENYING MOTION TO SUPPRESS NIT WARRANT
INTRODUCTION
On August 24, 2015, Chief Magistrate Judge Joseph C. Spero of the Northern District of California issued a search warrant for the residence located at 1106 E. 16th Avenue, San Mateo, California on information that Bryan Henderson, or an internet user at that residence, had accessed Playpen, a website used to receive and send child pornography. McDougall Decl. Ex. A. ("San Mateo Warrant") (Dkt. No. 56-2). The San Mateo Warrant was based substantially on evidence obtained in execution of a search warrant issued in the Eastern District of Virginia on February 20, 2015 by Magistrate Judge Theresa Carroll Buchanan. McDougall Decl. Ex. B ("NIT Warrant") (Dkt. No. 56-3). FBI agents executed the San Mateo Warrant, during which they seized multiple computers and cell devices from Henderson's residence and interrogated Henderson for several hours. The FBI arrested Henderson on November 3, 3015 based on evidence obtained in that search, which indicated that Henderson was in possession of child pornography. The United States has indicted Henderson for alleged offenses of 18 U.S.C. § 2252(a)(2) and 18 U.S.C. § 2252(a)(4)(b) for receipt and possession of child pornography. Dkt. No. 26.
On June 16, 2016, Henderson filed a motion to suppress the NIT Warrant and all fruits of the Warrant, including all evidence seized or obtained during the execution of the San Mateo Warrant on September 2, 2015. Motion to Suppress ("Mot.") 1 (Dkt. No. 56). Henderson argues that the NIT Warrant was invalid when issued because it violated Federal Rule of Criminal Procedure 41(b), which outlines the geographic limitations of a magistrate judge's authority to issue a warrant, and violated the Federal Magistrates Act, which incorporates Rule 41.
More than a dozen motions to suppress similar NIT Warrants have been decided in federal courts throughout the country. I agree with the majority of courts that the motion should be denied. I conclude that, although the NIT Warrant was invalid under Rule 41(b), suppression is not appropriate because the violation was technical, not constitutional, Henderson was not prejudiced, the FBI did not act with deliberate disregard for Rule 41, and the NIT Warrant was executed in good faith.
BACKGROUND
Playpen is a website dedicated to sharing child pornography that operated on an anonymous network called "Tor." Mot. 6. The Tor network protects user anonymity by allowing computers to access a large number of intermediary users before accessing the target website. Id. This masks the location and identity of the user and prevents publicizing the computer's IP address. Id. Tor also allows anonymous web hosting which allows users to host a website on the Tor network while preventing the website's location and its user's locations from being identified. Id. at 7.
There is no evidentiary record in this case. However, the parties do not dispute the facts relevant to this motion. --------
In 2014, the FBI began an investigation into Playpen. Id. In December 2014, the FBI determined that Playpen was hosted on servers located in Lenoir, North Carolina. Id. On February 20, 2015, the FBI executed a warrant and seized the Playpen servers which were then relocated to an FBI facility in Newington, Virginia. Id. The same day, the FBI obtained a search warrant authorizing use of a "Network Investigative Technique" ("NIT") that would allow the FBI to search computers accessing the Playpen site for identifying information. NIT Warrant.
The NIT worked by augmenting information exchanged between a user's computer and the Playpen server. A user can only access the site by first entering the Tor network, locating the hidden website hosted on the network, and then entering a username and password. Once a computer completed these steps and accessed the Playpen site (located on servers in Virginia), the NIT would be sent to the activating computer (at the computer's unknown location) and would instruct the activating computer to send identifying information, including the IP address of the computer, back to the Playpen servers in Virginia. Id.
Using the NIT, the FBI obtained the IP address associated with Playpen user "askjeff." San Mateo Warrant at 11-12. After conducting an additional investigation, the FBI determined that this IP address likely belonged to Bryan Henderson, located in San Mateo, California. Id. The FBI then obtained a search warrant from Judge Spero to search Henderson's San Mateo residence and to seize electronic and computer devices believed to contain evidence that Henderson received and possessed child pornography. Id. The FBI executed the San Mateo Warrant and arrested Henderson after it found evidence of child pornography on his electronic devices.
Henderson moves to suppress the NIT Warrant and all fruits of the NIT Warrant, including all evidence seized and obtained on September 2, 2015. He argues that the NIT Warrant was invalid at the time it was issued because it violated Federal Rule 41 and 28 U.S.C. § 636(a) - the Federal Magistrates Act - which limit the jurisdictional reach of a magistrate judge. Mot. 10. Henderson contends that a magistrate judge's authority is limited to the district in which he or she sits except under specific circumstances, none of which apply to the facts here, and that the NIT Warrant exceeded this limitation because it permitted government agents to conduct a search of computers outside the Eastern District of Virginia. I heard oral argument on August 18, 2016 and granted Henderson leave to submit supplemental briefing on August 26, 2016, which I have now reviewed.
LEGAL STANDARD
Henderson argues that the NIT Warrant is invalid under the Federal Magistrates Act and Rule 41(b) of the Federal Rules of Criminal Procedure. The Federal Magistrates Act, Section 636(a) provides that a magistrate judge shall have within her district and "elsewhere as authorized by law . . . all powers and duties conferred or imposed upon the United States commissioners by law or by the Rules of Criminal Procedures for the United States District Courts." 28 U.S.C. § 636(a). Henderson contends that the NIT Warrant violated Section 636(a) by failing to meet the requirements of Rule 41(b). Mot. 14. Therefore, analysis of Henderson's arguments under both sections is identical.
Federal Rule 41(b) outlines the geographical areas over which a magistrate judge has authority to issue warrants: (b) Authority to issue a Warrant. At the request of a federal law enforcement officer or an attorney for the government:
(1) a magistrate judge with authority in the district-or if none is reasonably available, a judge of a state court of record in the district-has authority to issue a warrant to search for and seize a person or property located within the district;
(2) a magistrate judge with authority in the district has authority to issue a warrant for a person or property outside the district if the person or property is located within the district when the warrant is issued but might move or be moved outside the district before the warrant is executed;
(3) a magistrate judge-in an investigation of domestic terrorism or international terrorism-with authority in any district in which activities related to the terrorism may have occurred has authority to issue a warrant for a person or property within or outside that district;
(4) a magistrate judge with authority in the district has authority to issue a warrant to install within the district a tracking device; the warrant may authorize use of the device to track the movement of a person or property located within the district, outside the district, or both; and
(5) a magistrate judge having authority in any district where activities related to the crime may have occurred, or in the District of Columbia, may issue a warrant for property that is located outside the jurisdiction of any state or district, but within any of the following:
Fed. R. Crim. P. 41(b).(A) a United States territory, possession, or commonwealth;
(B) the premises-no matter who owns them-of a United States diplomatic or consular mission in a foreign state, including any appurtenant building, part of a building, or land used for the mission's purposes; or
(C) a residence and any appurtenant land owned or leased by the United States and used by the United States personnel assigned to a United States diplomatic or consular mission in a foreign state.
Rule 41 violations fall into two categories: fundamental errors and mere technical errors. United States v. Negrete-Gonzales, 966 F.2d 1277, 1283 (9th Cir. 1992). A fundamental error is one resulting in a constitutional violation, requiring suppression. Id. A technical error requires suppression only if: (1) the defendant is prejudiced by the error, or (2) there is evidence of deliberate disregard for Rule 41. Id.
DISCUSSION
I. WHETHER THE NIT WARRANT VIOLATES RULE 41
Henderson contends that the NIT Warrant was not permissible under any of the five sections of 41(b) because it was issued by a magistrate judge in the Eastern District of Virginia and, through the use of the NIT, permitted searches of Playpen users' computers wherever they were located. Many computers, including Henderson's, were not within the Eastern District of Virginia.
The government argues that the NIT Warrant is valid under Rule 41(b)(1), (2), and (4) because the Playpen servers were located in the Eastern District of Virginia and Playpen users had to virtually reach into the district to access the Playpen site, at which time the NIT was sent and installed on their computers. Opposition ("Oppo.") 15 (Dkt. No. 54). The United States adds that the provisions of Rule 41 are to be read broadly and flexibly where a particular type of search does not fall explicitly under the language of the rule. Id. at 14.
I agree with Henderson that the NIT Warrant is not permissible under Rule 41(b)(1) and (2). These sections allow a magistrate judge to issue a warrant to search property located in the district or located in the district at the time the warrant is issued. Neither of these applies as the NIT search occurred outside the district at the location of Henderson's computer in San Mateo, California, which was never located within the Eastern District of Virginia.
There is a stronger argument that the NIT Warrant is permissible under Rule 41(b)(4), which authorizes a magistrate judge "to issue a warrant to install within the district a tracking device; the warrant may authorize use of the device to track the movement of a person or property located within the district, outside the district, or both." Fed. R. Crim. P. 41(b)(4). Two courts have found that the NIT Warrant was permissible under (b)(4), noting that this section is "exactly analogous to what the NIT Warrant authorized" because it allowed the FBI to install a tracking device on the computers of Playpen users which "digitally touched down in the Eastern District of Virginia when they logged into the site." United States v. Darby, No. 16-cr-36, 2016 WL 3189703 (E.D. Va. Jun. 3, 2016); United States v. Matish, No. 16-cr-16, 2016 WL 3545776 (E.D. Va. Jun. 23, 2016). However, a majority of courts have found that the NIT Warrant does not fit under 41(b)(4) because the users did not have "control" over the government controlled servers at the time they accessed the Playpen site and because the NIT was installed on the activating computers located outside the district. See e.g., United States v. Michaud, No. 15-cr-05351, 2016 WL 337263 (W.D. Wash. Jan. 28, 2016); United States v. Werdene, No. 15-cr-434, 2016 WL 3002376 (E.D. Penn. May 18, 2016).
This is a close question but I am inclined to agree with the majority of courts that have decided this question. The NIT search does not meet the requirements of 41(b)(4) because, even though it was analogous to a tracking device in some ways, it nevertheless falls outside the meaning of a "tracking device" as contemplated by the rule. Further, the NIT was installed outside of the district, at the location of the activating computers, not within the district as required by Rule 41(b)(4).
Rule 41 has traditionally been read flexibly. See United States v. New York Telephone Co., 434 U.S. 159, 169 (1977) ("Rule 41 is sufficiently flexible to include within its scope electronic intrusions authorized upon a finding of probable cause."); United States v. Koyomejian, 970 F.2d 536, 542 (9th Cir. 1992) (concluding that Rule 41(b) authorizes a district court to issue warrants for silent video surveillance although the practice is not specifically covered by statute). However, "[e]ven a flexible application of the Rule [] is insufficient to allow the Court to read into it powers possessed by the magistrate that are clearly not contemplated and do not fit into any of the five subsections." Werdene, 2016 WL 3002376. The NIT Warrant was invalid under Rule 41(b) because the NIT search was not permissible under any of the five subsections of the Rule.
II. SUPPRESSION IS INAPPROPRIATE
While the NIT search violated Rule 41, suppression is not appropriate because the violation was technical, not constitutional, it did not prejudice Henderson, and the Warrant was executed in good faith.
A Rule 41 violation may be constitutional or technical. Negrete-Gonzales, 966 F.2d at 1283. While a constitutional violation must be suppressed, a technical violation should only be suppressed if the search prejudiced the defendant or there is evidence that the government acted with deliberate disregard for Rule 41. Id.
A. The NIT Warrant Complies with the Fourth Amendment
The NIT Warrant's violation of Rule 41 is technical because the Warrant complies with the Fourth Amendment requirements of probable cause and particularity. The Fourth Amendment reads in part, "no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."
The NIT Warrant was supported by substantial probable cause and evidence that the Playpen website was used to host and exchange child pornography. The courts that have analyzed the NIT Warrant have all found that it was supported by probable cause. See, e.g., Darby, 2016 WL 3189703, at *8; Michaud, 2016 WL 337263, at *8.
Further, the NIT Warrant meets the Fourth Amendment's particularity requirements. See United States v. SDI Future Health, Inc., 568 F.3d 684, 702 (9th Cir. 2009) ("Particularity means the warrant must make clear . . . exactly what it is that he or she is authorized to search for and seize."); United States v. Turner, 770 F.2d 1508, 1510 (9th Cir. 1985) ("The place searched must be "described with sufficient particularity to enable the executing officer to locate and identify the premises with reasonable effort."). The NIT Warrant describes the persons and places to be searched in the Warrant's Attachment A, which provides that the NIT will "obtain[] information . . . from the activating computers," that are "those of any user or administrator who logs onto [Playpen] by entering a username and password." NIT Warrant, Attachment A. This description is sufficiently particular because it is limited only to individuals that log onto the Playpen website using a username and password. Because of the structure of the Tor network, only individuals actively attempting to access the Playpen website, with sufficient knowledge of the website and its contents, are able to access it. The Warrant is sufficiently particular as it specifies that the NIT search applies only to computers of users accessing the website, a group that is necessarily actively attempting to access child pornography. See e.g., Michaud, 2016 WL 337263 (holding that the NIT Warrant meets the Fourth Amendment's particularity requirements).
B. The NIT Warrant did not Prejudice Henderson
Given that I have concluded that issuance of the NIT Warrant was a technical violation of Rule 41, suppression is only appropriate if the violation causes prejudice to the defendant or if there is evidence of deliberate disregard for the Rule. Negrete-Gonzales, 966 F.2d 1283; see also United States v. Williamson, 439 F.3d 1125, 1132 (9th Cir. 2006) ("[W]e have repeatedly held—and have been instructed by the Supreme Court—that suppression is rarely the proper remedy for a Rule 41 violation."). Neither circumstance exists here.
To determine whether Henderson has been prejudiced, I must consider whether the evidence obtained could have been obtained through other lawful means. United States v. Vasser, 648 F.2d 507, 511 (9th Cir. 1980). I conclude that Henderson was not prejudiced because he did not have a reasonable expectation of privacy in the key evidence obtained through the NIT search, his IP address. United States v. Forrester, 512 F.3d 500, 510 (9th Cir. 2008) ("Internet users have no expectation of privacy in the to/from addresses of their messages or the IP addresses of the websites they visit because they should know that this information is provided to and used by Internet service providers for the specific purpose of directing the routing information."). Although the Tor network hides IP addresses, the "Tor network does not strip users of all anonymity" and to access the network users "must still send and receive information, including IP addresses, through another computer, such as an Internet Service Provider, at a specific physical location." Michaud, 2016 WL 337263, at *7. The FBI was ultimately able to locate Henderson by tracking his IP address to his internet provider, demonstrating that Henderson voluntarily turned his IP address information over to this third party so that it could provide him with web services. Smith v. Maryland, 442 U.S. 735, 743-44 (1979) ("[A] person has no legitimate expectation of privacy in information he voluntarily turns over to third parties."). As Henderson does not have an expectation of privacy in his IP address, the FBI could have legally discovered Henderson's IP address absent the NIT Warrant.
While difficult to locate, the IP address of a Playpen user is public information and Henderson's IP address could have been accessed absent the NIT Warrant. Further, the FBI could have conducted its supplemental investigation of Henderson, using his IP address, to obtain the information sufficient to support the San Mateo Warrant. Because the FBI could have lawfully obtained the information for the San Mateo Warrant through other means, Henderson was not prejudiced by the NIT Warrant.
C. The FBI Did Not Deliberately Disregard Rule 41
Henderson argues that the FBI acted with deliberate disregard for Rule 41 because it knew, prior to requesting the NIT Warrant, that the Warrant was not valid under Rule 41's geographical limitations. Henderson first points to In re Warrant to Search a Target Computer at Premises Unknown, in which a court concluded that a different NIT search was not permissible under Rule 41. 958 F. Supp. 2d 753, 758 (S.D. Tex. 2013). While the In re Warrant court did find an NIT search impermissible under Rule 41, a single court's decision analyzing a complicated and "novel request" does not definitively demonstrate that the FBI deliberately disregarded the Rule. Indeed, multiple courts have now found that the NIT Warrant is valid under Rule 41. See Darby, 2016 WL 3189703, at *12; Matish, 2016 WL 3545776, at*18. The FBI could have reasonably believed the NIT Warrant complied with the Rule.
Next, Henderson argues that the FBI deliberately disregarded Rule 41 because on May 5, 2014, the government proposed an amendment to Rule 41(b) that would specifically authorize the type of search conducted by the NIT Warrant and "would authorize a court to issue a warrant to use remote access to search electronic storage media and seize electronically stored information inside or outside of the district: (1) when a suspect has used technology to conceal the location of the media to be searched." Mot. 18. Henderson argues that because it proposed this amendment, the government was well aware that Rule 41(b), as it stands, does not authorize the type of search conducted by the NIT Warrant. The government responds that while it believes Rule 41 authorized the NIT search, it proposed an amendment to the rule to help clarify the ambiguities demonstrated by the varying analyses of the courts that have ruled on the issue.
While I find that the NIT Warrant violated Rule 41(b), the government's position is plausible and does not demonstrate deliberate disregard for Rule 41. As the cases analyzing the NIT Warrant demonstrate, whether the NIT search is permissible under Rule 41 is a close question and the Rule will undoubtedly benefit from clarification. The government's proposed amendment to the Rule demonstrates that it recognized ambiguities in the Rule, not that it acted with deliberate disregard for the Rule.
Because I conclude that Henderson was not prejudiced by the NIT Warrant and the FBI did not deliberately disregard Rule 41, suppression of the NIT Warrant is not appropriate.
D. The FBI Acted in Good Faith
In addition, suppression is not appropriate in this case because the government acted in good faith. United States v. Leon, 468 U.S. 897, 922 (1984) ("objectively reasonable reliance on a subsequently invalidated search warrant cannot justify the substantial costs of exclusion.). A warrant is executed in good faith if the warrant is objectively reasonable. Negrete-Gonzales, 966 F.2d at 922. Here, the NIT Warrant was objectively reasonable—it was supported by substantial probable cause, was sufficiently particular in describing the people and places to be searched, and was issued by a neutral magistrate judge. The good faith exception applies and suppression is not appropriate.
CONCLUSION
Henderson's motion to suppress is DENIED. Although the NIT Warrant was invalid under Rule 41(b), suppression is not appropriate because the warrant meets the Fourth Amendment requirements of probable cause and particularity, the FBI did not deliberately disregard Rule 41, and the FBI acted in good faith in executing the warrant.
IT IS SO ORDERED. Dated: September 1, 2016
/s/_________
WILLIAM H. ORRICK
United States District Judge