From Casetext: Smarter Legal Research

United States v. Trahan

UNITED STATES DISTRICT COURT DISTRICT OF MASSACHUSETTS
Jul 3, 2018
CRIMINAL NO. 15-10346-GAO (D. Mass. Jul. 3, 2018)

Opinion

CRIMINAL NO. 15-10346-GAO

07-03-2018

UNITED STATES OF AMERICA, v. SEAN TRAHAN, Defendant.


OPINION AND ORDER

The defendant, Sean Trahan, is charged with one count of possession of child pornography and one count of knowing access with intent to view child pornography in violation of 18 U.S.C. §§ 2252A(a)(5)(B) and (b)(2). The charges arise from an FBI investigation into users of a child pornography website "Playpen" and the FBI's use of a network investigative technique ("NIT") that relayed identifying information about a Playpen user to the FBI when the user logged in to the site. Trahan has moved to suppress all evidence gathered by the NIT, as well as any fruits of the allegedly unconstitutional search. He also has moved to dismiss the indictment on the basis of allegedly egregious government misconduct. I. Factual Background

The government's use of the NIT led to the identification of hundreds of users of the child pornography website Playpen and has subsequently been the subject of litigation around the country. See, e.g., United States v. Taylor, 250 F. Supp. 3d 1215, 1222-23 (N.D. Ala. 2017) (collecting and categorizing district court cases as of April 2017). Most of the relevant facts have been described by numerous other courts, including recently by the First Circuit in United States v. Levin, 874 F.3d 316 (1st Cir. 2017). Accordingly, the factual background and case history are recited here only to the extent necessary to resolve the pending motions.

In 2014, FBI agents began investigating Playpen. Playpen operated on the internet network known as Tor, which provides anonymity for users by permitting them to hide identifying information such as Internet Protocol addresses ("IP addresses"). Playpen was a "hidden service" on the "Dark Web," reachable only by a browser capable of using Tor or similar software and by users who knew or were redirected to the algorithm-generated website address (or "URL"). The website required visitors to register and log in to the website, after which a user could view its illicit content. When a user attempted to register by clicking a registration hyperlink on the homepage, the user saw a message from the forum operators. The message explained that the forum required new users to enter an email address, but that they should not enter real addresses. The message further warned users to refrain from posting any information that could be used to identify them. It also emphasized the site's privacy features, including the staff's inability to confirm true identities or see user IP addresses.

For the majority of the FBI's investigation, the Playpen homepage contained the images of two partially clothed prepubescent females with their legs spread apart. The homepage later was changed to an image of a young girl wearing a short dress and black thigh-high stockings, leaning back on a red chair with her legs crossed.

In February 2015, the government seized control of the website from its web-hosting facility pursuant to a warrant. The FBI then moved it to a server located in the Eastern District of Virginia. The government permitted Playpen to continue to operate through March 4, 2015, as it monitored its traffic.

On February 20, 2015, FBI agents obtained a search warrant from a magistrate judge in the Eastern District of Virginia which authorized the FBI to deploy the NIT onto any "activating computer," defined as the computer of "any user or administrator who logs into [Playpen] by entering a username and password." (Mot. to Suppress Ex. B at 3 (dkt. no. 63-2).) When deployed, the NIT would cause the user's computer to send identifying information, such as the computer's actual IP address, back to a government-controlled computer located in the Eastern District of Virginia.

According to data obtained by the government through the deployment of the NIT, a Playpen user named "Kelly33" accessed several images of child pornography on February 21, 22, and 28, 2015. The user had registered an account with Playpen on September 2, 2014, and was actively logged in to the website for over seventy-seven hours between September 2, 2014, and March 4, 2015. Between February 21, 2015, and March 4, 2015, the user viewed approximately 409 threads on the website.

Using the information it obtained through the NIT, the government served an administrative subpoena on the internet service provider for the account associated with the IP address, which revealed that the IP address was assigned to the defendant's father with service at the family's home in Seekonk, Massachusetts. The government obtained a warrant from a magistrate judge in Massachusetts to search the Seekonk home, and upon execution of the search warrant, seized a computer from the defendant's bedroom. On subsequent forensic examination, the device was found to contain child pornography. The defendant also made inculpatory statements to law enforcement agents. II. Motion to Suppress

The defendant raises several arguments in support his motion to suppress. Some relate to the magistrate judge's authority to issue the NIT warrant and are foreclosed by the First Circuit's recent Levin decision. The defendant's other suppression arguments, including that the NIT warrant did not authorize searches outside of the Eastern District of Virginia, lacked particularity, and was not supported by probable cause; that the NIT's triggering condition failed; and that a Franks hearing is required, are also rejected for the reasons set forth below.

A. Magistrate Judge's Authority

The defendant's arguments related to the magistrate judge's authority—that the NIT warrant violated Federal Rule of Criminal Procedure 41(b), that the NIT warrant was void ab initio because, absent authority under Rule 41, it violated the Federal Magistrates Act and was issued without jurisdiction, and that suppression is required for a Rule 41 violation—all fail in light of Levin. See 874 F.3d 316. In that case, the district judge suppressed evidence obtained from the deployment of the NIT, finding that "since the warrant purported to authorize a search of property located outside the federal judicial district where the issuing judge sat, the NIT warrant was issued without jurisdiction and thus was void ab initio" and that "the magistrate judge was not authorized to issue it either under Rule 41 . . . or under the Federal Magistrates Act." Id. at 320-21. The district court further concluded that the good-faith exception to the exclusionary rule, see United States v. Leon, 468 U.S. 897 (1984), "did not apply because the search was conducted pursuant to a warrant that, in its view, was void ab initio." Levin, 874 F.3d at 321.

On appeal, the First Circuit overruled the district court's order suppressing the evidence. It held that "[r]egardless of whether a Fourth Amendment violation occurred, the facts of this case show that the Leon good-faith exception applies." Id. The court reasoned that "because the government acted in good faith reliance on the NIT warrant, and because the deterrent effects on law enforcement do not outweigh the great cost to society of suppressing the resulting evidence, suppression [was] not warranted." Id. at 324. It therefore concluded that "[b]ecause the executing officers acted in good faith on the NIT warrant, the Leon exception appl[ied]." Id.

This Court is bound by that conclusion.

B. Searches Outside of Virginia

The defendant also argues that the NIT warrant itself expressly limited searches to the Eastern District of Virginia, and because the FBI deployed the NIT onto computers outside of that district—e.g., the defendant's computer in Massachusetts—the search exceeded the scope of the warrant. In support of his argument, the defendant focuses on the warrant's cover page, which begins: "An application by a federal law enforcement officer or an attorney for the government requests the search of the following person or property located in the Eastern District of Virginia." (Mot. to Suppress Ex. B at 2.)

A complete, contextual reading of the NIT warrant demonstrates that it was not limited to searches in the Eastern District of Virginia, but instead permitted searches for data from activating computers outside that geographic location. The NIT warrant authorized the search of "property located in the Eastern District of Virginia," but it also specified that the "property to be searched . . . and location" were found in Attachment A. (Id.) Attachment A, describing the "Place to be Searched," stated that the server operating the website would be "located at a government facility in the Eastern District of Virginia," and that the NIT would be deployed on the server to obtain information "from the activating computers" logging in to Playpen "by entering a username and password." (Id. at 3.) The warrant did not limit the location of "activating computers" to those in the Eastern District of Virginia. Similarly, the supporting affidavit requested the issuance of the NIT warrant to cause "an activating computer—wherever located—to send" identifying information to the government-controlled computer. (Id. Ex. C ¶ 46(a) (dkt. no. 63-3).) Thus, based on a complete, contextual reading of the NIT warrant, the "place to be searched" was any activating computer that logged in to Playpen on the Eastern District of Virginia server, regardless of the geographic location of the activating computer. This is not a remarkable or unusual authority. It is commonplace that a Title III warrant monitoring a telephone located in authorizing district permits the interception and recording of a call made to that telephone from outside the district.

C. Particularity

The defendant argues briefly that the NIT warrant failed to describe with particularity the location of the search in contravention of the Fourth Amendment's requirement that all warrants "particularly describ[e] the place to be searched, and the . . . things to be seized." See U.S. Const. Amend. IV. This theory has been soundly rejected by district courts reviewing the NIT warrant, see United States v. Anzalone, 208 F. Supp. 3d 358, 368 (D. Mass. 2016) (citing United States v. Acevedo-Lemus, No. SACR 15-00137-CJC, 2016 WL 4208436, at *7 n.4 (C.D. Cal. Aug. 8, 2016)), and more recently by the First Circuit in Levin in the context of its Leon analysis. The Circuit found that the NIT warrant was not akin to a general warrant because it

did not leave to the discretion of the executing officials which places should be searched, because the NIT warrant clearly specifies that only activating computers—that is "those of any user . . . who logs into [Playpen] by entering a username and password"—are to be searched. The NIT warrant specifies into which homes an intrusion is permitted (those where the activating computers are located), and on what basis (that the users in those homes logged into Playpen).
874 F.3d at 323.

The theory is similarly rejected here.

D. Probable Cause

The defendant next argues that the warrant application failed to establish probable cause that any individual logging in to the website was doing so for the purpose of viewing or distributing child pornography because the site's illegal purpose was not readily apparent from the homepage, and consequently a visitor might log in to the site innocently unaware of its illegal content.

More precisely, the defendant argues that the government "failed to establish probable cause that any visitor to the Playpen homepage had committed a child pornography crime." (Mot. to Suppress 19.) However, the warrant did not permit the NIT deployment upon visiting the homepage, but rather, only after a user on an activating computer actually logged in to the site using a username and password.

"A warrant application must demonstrate probable cause to believe that (1) a crime has been committed—the 'commission' element, and (2) enumerated evidence of the offense will be found at the place to be searched—the so-called 'nexus' element." United States v. Feliz, 182 F.3d 82, 86 (1st Cir. 1999) (citation omitted). When assessing nexus, the issuing judicial officer must "make a practical, common-sense decision whether, given all the circumstances set forth in the affidavit before him . . . there is a fair probability that contraband or evidence of a crime will be found in a particular place." Id. (quoting Illinois v. Gates, 462 U.S. 213, 238 (1983)). "[T]he duty of a reviewing court is simply to ensure that the magistrate had a 'substantial basis for . . . concluding' that probable cause existed." Gates, 462 U.S. at 238-39 (1983) (quoting Jones v. United States, 362 U.S. 257, 271 (1960); accord Feliz, 183 F.3d at 86 (citation omitted).

The affidavit submitted in support of the search warrant application provided a substantial basis for the magistrate judge's finding that there was probable cause to issue the warrant. First, the name Playpen itself together with the visual image displayed on the outward-facing homepage—whether it was two partially clothed prepubescent females or one young female dressed and posed provocatively—are suggestive of the website's proscribed content. Second, accessing the website required multiple affirmative steps by a user that made it very unlikely anyone could simply stumble upon the website unaware of its illegal content. In order to be able to access the website, a user had to download Tor, obtain the algorithm-generated URL of Playpen, and enter an email address and password. It was not simply a matter of "visiting" a website simply by clicking on a link suggested by a search engine, as the defendant seems to suggest. Third, in order to log in to the website, a user first had to register an account by accessing a page that displayed a message with warnings about maintaining anonymity (e.g., instructions to not enter a real address and to not post any information that could be used to identify the user, as well as notifications that it was impossible for the administrators to confirm a true identity of a user or see his IP address). And, of course, Playpen was an internet forum where users did share child pornography. "Although it is not beyond possibility that some of those who logged in to Playpen did so without intention of finding child pornography, probable cause requires a fair probability that a search will uncover evidence, not absolute certainty." United States v. Darby, 190 F. Supp. 3d 520, 532 (E.D. Va. 2016).

Even if there were a defect in the regard argued by the defendant, the good faith exception would apply in light of the First Circuit's holding in Levin.

The defendant registered an account with the website in September 2014, before the homepage changed in February 2015.

E. Triggering Event

The defendant next contends that the NIT warrant was an anticipatory warrant in which the triggering event did not occur. "[F]or a conditioned anticipatory warrant to comply with the Fourth Amendment's requirement of probable cause, two prerequisites of probability must be satisfied." United States v. Grubbs, 547 U.S. 90, 96 (2006). "It must be true not only that if the triggering condition occurs 'there is a fair probability that contraband or evidence of a crime will be found in a particular place,' Gates, [462 U.S. at 238,] but also that there is probable cause to believe the triggering condition will occur." Id. at 96-97 (emphasis in original).

In support of his argument, the defendant appears to argue that the triggering event was logging in to Playpen as it was described in the affidavit in support of the warrant, i.e., with two prepubescent girls on the homepage. Because the logo had changed by the time the affidavit was submitted to the magistrate judge, the defendant's theory goes, that triggering event could not have (and therefore did not) occur. However, the triggering event was simply logging in to the target website, Playpen, which the warrant application identified by its URL. There is no dispute that the defendant here logged in to Playpen, after which the NIT obtained the desired information. When a user like the defendant "opened a Tor browser, located the Playpen site, created an account and password, and logged on, the triggering condition was satisfied as there was a fair probability that the user sought to access child pornography." Anzalone, 208 F. Supp. 3d at 369.

F. Franks Hearing

The defendant further requests a Franks hearing, contending that the NIT warrant application contained recklessly misleading statements and omissions related to the images on Playpen's homepage. In order to obtain a Franks hearing, a defendant must make a "substantial preliminary showing" that (i) the affidavit upon which a search warrant was granted contained a false statement made knowingly and intentionally or with a reckless disregard for the truth; and (ii) the allegedly false statement was "necessary to the finding of probable cause." Franks v. Delaware, 438 U.S. 154, 155-56 (1978).

Here, the defendant has failed to make the requisite preliminary showing that would justify a Franks hearing. See id. Although the image on the homepage changed prior to the submission of the search warrant application, the defendant does not demonstrate how the purportedly false statement regarding the image was necessary to the finding of probable cause. The logo change described by the defendant does not materially alter the probable cause determination because the replacement image continued to be suggestive of the website's illicit content. Further, as described above, the probable cause determination was not based only on the logo, but also on the affiant's description of the website's content, the suggestive name of the website, the multiple steps a Playpen user had to take in order to locate the website, the website's instructions and information regarding anonymity, and the illicit content actually on the website.

Consequently, the Court need not make a determination as to whether the statement was made knowingly and intentionally or with a reckless disregard for the truth. --------

In summary, neither suppression nor a Franks hearing is warranted in this case. III. Motion to Dismiss

The defendant separately moves to dismiss the indictment with prejudice based on the government's purportedly outrageous misconduct arising from the FBI's alleged facilitation of child pornography distribution on Playpen, which it controlled and operated for two weeks as part of its investigation. The defendant in large part faults the government for permitting the website to remain fully functional for about two weeks before shutting it down, permitting its continued distribution of child pornography.

"In rare and extreme circumstances, a federal court has the authority to dismiss criminal charges as a sanction for government misconduct." United States v. Guzman, 282 F.3d 56, 59 (1st Cir. 2002) (citations omitted). The sanction is reserved for the rare circumstances "when the government's misconduct is so appalling and egregious as to violate due process by 'shocking . . . the universal sense of justice.'" United States v. Luisi, 482 F.3d 43, 59 (1st Cir. 2007) (quoting United States v. Russell, 411 U.S. 423, 432 (1973)). Courts "review these claims holistically, evaluating the 'totality of the relevant circumstances' while recognizing that 'outrageousness, by its nature, requires an ad hoc determination' that cannot 'usefully be broken down into a series of discrete components.'" United States v. Therrien, 847 F.3d 9, 14 (1st Cir. 2017), cert. denied, 137 S. Ct. 2227 (2017) (quoting United States v. Santana, 6 F.3d 1, 6-7 (1st Cir. 1993)). Although theoretically available, the "doctrine is moribund; in practice, courts have rejected its application with almost monotonous regularity." Santana, 6 F.3d at 4 (citations omitted); id. ("The banner of outrageous misconduct is often raised but seldom saluted."); accord Luisi, 482 F.3d at 59 ("While the doctrine is often invoked by criminal defendants, it has never yet been successful in this circuit.") (citations omitted).

In light of the totality of circumstances in this case, the government's actions—namely, operating Playpen for two weeks while it permitted continued access to child pornography in support of its efforts to identify persons committing criminal activities—fell short of "shocking . . . the universal sense of justice." See Luisi, 482 F.3d at 59 (quoting Russell, 411 U.S. at 432); see also United States v. Anzalone, 221 F. Supp. 3d 189, 195 (D. Mass. 2016) (citations omitted), appeal docketed, No. 17-1454 (1st Cir. May 5, 2017); United States v. Allain, 213 F. Supp. 3d 236, 253 (D. Mass. 2016) ("Reasonable minds will no doubt differ on whether the government made the right choice here, but it is not the rare case in which any misconduct on the part of the government was sufficiently blatant, outrageous, or egregious to warrant the dismissal of the indictment."). The government did not create Playpen nor the child pornography available on the website. It did not encourage—much less coerce—the defendant to visit the website, log in, or view child pornography. Rather, the defendant joined Playpen months before the government took it over and logged over seventy hours on it between the date he registered and the date the government shut the website down.

Consequently, the Court finds that the government's conduct was not so outrageous as to warrant dismissal of the indictment. See Guzman, 282 F.3d at 59. IV. Conclusion

For the foregoing reasons, the defendant's Motion to Suppress (dkt. no. 63) and Motion to Dismiss (dkt. no. 65) are DENIED.

It is SO ORDERED.

/s/ George A. O'Toole, Jr.

United States District Judge


Summaries of

United States v. Trahan

UNITED STATES DISTRICT COURT DISTRICT OF MASSACHUSETTS
Jul 3, 2018
CRIMINAL NO. 15-10346-GAO (D. Mass. Jul. 3, 2018)
Case details for

United States v. Trahan

Case Details

Full title:UNITED STATES OF AMERICA, v. SEAN TRAHAN, Defendant.

Court:UNITED STATES DISTRICT COURT DISTRICT OF MASSACHUSETTS

Date published: Jul 3, 2018

Citations

CRIMINAL NO. 15-10346-GAO (D. Mass. Jul. 3, 2018)