United States v. Acevedo-Lemu

          ORDER DENYING DEFENDANT’S MOTION TO SUPPRESS

          CORMAC J. CARNEY UNITED STATES DISTRICT JUDGE

         I. INTRODUCTION AND BACKGROUND

         In December 2014, a foreign law enforcement agency advised the FBI that a known child pornography website called “Playpen” appeared to be associated with a United States-based IP address.^[1] (Dkt. 32 Ex. A at 6-37 [“Macfarlane Aff.”] ¶ 28.) An ensuing investigation confirmed that Playpen was hosted by a server located in North Carolina. (Id.) The FBI obtained a search warrant for the location of the server in January 2015, seized the server, and found a copy of Playpen on it. (Id.)

         Playpen operated as a “hidden service” located on an anonymity network known as “The Onion Router, ” or “Tor.” (Macfarlane Aff. ¶¶ 6-7.) Ordinarily, public websites log the IP addresses of all visiting users. It is therefore an easy task for law enforcement to discover who has visited a certain website-or, alternatively, which websites a computer with a particular IP address has visited. The Tor network does not operate this way. Instead, to even access the network, a user must first download and install particular software, which subsequently shields the user’s IP address by relaying it among “nodes”-computers run by volunteers all over the world. (Id. ¶ 8.) When a user visits a website located on the Tor network-like Playpen, for example-his actual IP address is not shown. Instead, Playpen can only see the IP address of the Tor “exit node”-the final relay computer which sent the user’s communication to Playpen. (Id.) This deliberate concealment of IP addresses makes it exceptionally difficult for law enforcement to determine who has visited a website or hidden service located on the Tor network, as there is no practical way to trace a user’s IP address back through the Tor nodes. (Id.)

         Once on the Tor network, a user must know a website’s particular web address to visit it. (He may not, as on the traditional or “open” Internet, simply perform an Internet search for certain material, since websites on the Tor network are not indexed like websites on the open Internet.) (Macfarlane Aff. ¶ 10.) Tor users must obtain web addresses from each other, or by viewing Internet postings describing the content available on certain websites. (Id.) The Tor network contains a “hidden service” page that is dedicated to pedophilia and child pornography, and Playpen’s web address is listed on that page. (Id.) It would be highly unusual for a user to stumble upon Playpen. He would first have to elect to download Tor software and access the “dark web, ” where Tor websites are hosted, and then he would be required to affirmatively locate Playpen’s web address before reaching Playpen.

         Users who entered Playpen’s web address arrived at a main page which contained images of two partially clothed prepubescent females with their legs spread apart, along with text stating, “No cross-board reposts, .7z preferred, encrypt filenames, include preview, Peace out.” (Macfarlane Aff. ¶ 12.) This text apparently referred to a ban on posting material from other message boards, an indication of which file compression method was preferable, and instructions on what to include with posted materials. (Id.) Adjacent to the text were fields for users to enter login credentials, and a hyperlink for new users to “register an account with Playpen.” (Id.) Upon clicking the “register an account” hyperlink, users were taken to additional text which explained that Playpen required an email address but that rather than entering their real email address, users should simply enter a made-up address: “something that matches the xxx@yyy.zzz pattern.” (Id. ¶ 13.) Users who successfully registered for the service by entering a false email address were then taken to a page containing Playpen’s forums and subforums. (Id. ¶ 14.)

         Playpen was entirely devoted to the publication and exchange of child pornography. Its forums, where Playpen users could post materials, bore titles such as “Jailbait Videos”^[2] (of both “Girls” and Boys”), “Pre-teen Videos, ” “Pre-teen Photos, ” and “Webcams” (again, divided by gender), “Family Playpen - Incest, ” and “Toddlers.” (Macfarlane Aff. ¶ 14.) Playpen also maintained a “Kinky Fetish” forum that included subforums like “Bondage, ” “Peeing, ” “Scat, ” “Spanking, ” “Voyeur, ” and “Zoo.” (Id.) In addition to these forums and subforums, Playpen included three other important features. The first, called “Playpen Image Hosting, ” allowed Playpen users to upload links to images of child pornography. (Id. ¶ 23.) The links were then available to all registered Playpen users. (Id.) The second, “Playpen File Hosting, ” similarly allowed users to upload videos of child pornography, which were then available to Playpen registered users. (Id. ¶ 24.) The third, “Playpen Chat, ” permitted users to post links to child pornography for other users who were logged into Playpen Chat at the same time. (Id. ¶ 25.) The link to Playpen Chat was on Playpen’s main index page. (Id.)

         The FBI’s review of Playpen’s forums and subforums, as well as its Playpen Image Hosting, Playpen File Hosting, and Playpen Chat features, revealed links to numerous depictions of what appeared to be child pornography. A representative sampling of those depictions is as follows:

. An image of a prepubescent or early pubescent female being orally penetrated by the penis of a naked male. (Macfarlane Aff. ¶ 18.)

. A video of a prepubescent female, naked from the waist down, being anally penetrated by the penis of a naked adult male. (Id. ¶ 18.)

. Images focused on the nude genitals of a prepubescent female. (Id. ¶ 23.)

. A video of an adult male masturbating and ejaculating into the mouth of a nude prepubescent female. (Id. ¶ 24.)

. An image of two prepubescent females lying on a bed with their genitals exposed. ( Id. ¶ 25.)

. An image of four females, including at least two prepubescent females, performing oral sex on one another. (Id. ¶ 25.)

         The FBI seized a copy of the server hosting Playpen in January 2015. (Macfarlane Aff. ¶ 28.) The nature of the Tor network, however, prevented the FBI from identifying Playpen users, since Playpen’s “logs of member activity . . . contain[ed] only the IP addresses of Tor ‘exit nodes’ utilized by board users.” (Id. ¶ 29.) Accordingly, on February 19, 2015, the FBI executed a court-authorized search at the Naples, Florida residence of the suspected administrator of Playpen. (Id. ¶ 30.) The administrator was apprehended, and the FBI managed to assume administrative control of Playpen. (Id.) The FBI then devised a plan to determine the identities of Playpen users: it would, while running Playpen from a server in Virginia, reconfigure the website to deploy a network investigative technique (“NIT”) any time a user downloaded content from Playpen. (Id. ¶ 33.) As Douglas Macfarlane, an FBI Special Agent, subsequently explained,

In the normal course of operations, websites send content to visitors. A user’s computer downloads that content and uses it to display web pages on the user’s computer. [Upon deployment of the NIT, Playpen, ] which will be located in Newington, Virginia, . . . would augment that content with additional computer instructions. When a user’s computer successfully downloads those instructions from [Playpen], the instructions, which comprise the NIT, are designed to cause the user’s “activating” computer to transmit certain information to a computer controlled by or known to the government.

(Macfarlane Aff. ¶ 33.) Specifically, the NIT would reveal to the government seven items:

1. The activating computer’s IP address, and the date and time that the NIT determined what that IP address was;

2. A unique identifier generated by the NIT to distinguish the data from that of other ...