In re Search of One Address in Wash., D.C., Under Rule 41

• Citation: 512 F.Supp.3d 23
• Decision Date: 06 January 2021
• Docket Number: Case No. 20-sw-314 (ZMF)
• Parties: In the MATTER OF the SEARCH OF ONE ADDRESS IN WASHINGTON, D.C., UNDER RULE 41
• Court: U.S. District Court — District of Columbia

512 F.Supp.3d 23

In the MATTER OF the SEARCH OF ONE ADDRESS IN WASHINGTON, D.C., UNDER RULE 41

Case No. 20-sw-314 (ZMF)

United States District Court, District of Columbia.

Signed January 6, 2021

MEMORANDUM OPINION

ZIA M. FARUQUI, UNITED STATES MAGISTRATE JUDGE

To seize or not to seize, that is the question. On December 15, 2020, the government submitted an Application for a Warrant ("Application") to search a residence (the "Target Premises") in Washington, D.C., and to seize from the Target Premises items related to suspected violations of the child pornography statute. See ECF No. 6 (Application for Search & Seizure Warrant and Accompanying Documents) at 4, 6 ("Warrant"). Among the specific properties the government sought for seizure were all cryptocurrency and information necessary to access such cryptocurrency. See Warrant at 6–7, 12. For the below reasons, this Court granted the Application.

I. Background

In or around April 2019, agents with U.S. Homeland Security Investigations ("HSI") began investigating a marketplace on the darknet ("Website 1")¹ "dedicated to the advertisement and distribution of child pornography." Warrant at 46. Darknet marketplaces frequently act as "the Amazon for contraband." Vicki Chou et al., Prosecuting Darknet Marketplaces: Challenges and Approaches , 67 DOJ J. Fed. L. & Prac. 65, 66 (2019). To access darknet marketplaces, users must download anonymizing software called "The Onion Router" (also referred to as "Tor"). Warrant at 41. "Tor-based websites ‘anonymize[ ] [i]nternet activity by routing [a] user's communications through a global network of relay computers (or proxies), thus effectively masking the internet-protocol ("IP") address of the user.’ "

United States v. Harmon , 474 F.Supp.3d 76, 82 (D.D.C. 2020) (quoting United States v. Galarza , No. 18-mj-146, 2019 WL 2028710, at *2 (D.D.C. May 8, 2019) ). "Tor is not in and of itself illegal. Indeed, it is partially supported by the United States government and is used around the world to promote free speech and privacy. But the anonymity that Tor brings has a darker side, as it is also used by criminals and others who would seek to evade law enforcement detection." Chou et al., supra , at 67.

Nothing is free, including on the darknet. Payments on darknet marketplaces frequently occur via "cryptocurrenc[y]," which is "a virtual currency traded over the Internet and controlled through computer software rather than issued by a bank or government." United States v. Twenty-Four Cryptocurrency Accounts , 473 F. Supp. 3d 1, 3 (D.D.C. 2020). Bitcoin ("BTC") is the most widely-used cryptocurrency.² "Individuals can acquire BTC through cryptocurrency exchanges, cryptocurrency ATMs, or directly from other people." Warrant at 43. BTC transactions "require[ ] an address, a public encryption key, and a private encryption key." Harmon , 474 F.Supp.3d at 81. These encryption keys generally are stored in unhosted wallets (e.g. , paper or electronic media retained by the owner), or hosted wallets (account held by a third party financial-institution, known as a cryptocurrency exchange).³ See Jai Ramaswamy, How I Learned to Stop Worrying and Love Unhosted Wallets , Coin Center (Nov. 18, 2020), available at https://www.coincenter.org/how-i-learned-to-stop-worrying-and-love-unhosted-wallets/. "Most [darknet] marketplaces assign users a cryptocurrency wallet to make purchases or receive payments." Warrant at 43. "Darknet marketplace users can transfer cryptocurrency from an external [hosted or unhosted] wallet into their marketplace wallet by sending [BTC] to a deposit address assigned to their account." Id.

Transfers of fiat currency⁴ are not recorded in any centralized location. However, every transfer of BTC is documented in real time on a public ledger called the "blockchain." See Harmon , 474 F.Supp.3d at 80–82. "The [BTC] blockchain contains only the sender's address, the receiver's address, and the amount of Bitcoin transferred." United States v. Gratkowski , 964 F.3d 307, 309 (5th Cir. 2020). Although "[t]he owners of the addresses are anonymous on the [BTC] blockchain," id. , law enforcement can use publicly-available software⁵ to analyze the BTC blockchain by "forensically examining, tracing, and mapping data on the blockchain ... to unmask the identities of specific users of a given cryptocurrency wallet." Warrant at 44. Ironically, the public nature of the blockchain makes it exponentially easier to follow the flow of cryptocurrency over fiat funds. See Gratkowski , 964 F.3d at 312 ("Bitcoin users are unlikely to expect that the information published on the Bitcoin blockchain will be kept private, thus undercutting their claim of a legitimate expectation of privacy.") (internal quotation marks and citation omitted).

Website 1 advertised child-exploitation material to subscribers who paid using BTC. See Warrant at 46–47. Law enforcement, acting in an undercover capacity, purchased videos from Website 1. See id. at 47. The downloaded videos depicted children, ranging from infant to 6 years of age, being sexually abused. See id. at 46–47.

Blockchain analysis revealed that Website 1 used a "payment processing service ... operated by a known cryptocurrency exchange service (the ‘Exchange’) located in the United States" to effectuate the illicit transactions. Id. at 47–48. By subpoenaing the Exchange, law enforcement obtained documents revealing the identity of the Subject. See id. at 48, 51. Records from the Exchange further detailed what law enforcement saw on the blockchain: the sending of BTC by the Subject to Website 1 in November 2019. See id. at 51–52. Subpoena returns further revealed that the Subject resided at the Target Premises. See id. at 57.

On December 15, 2020, the government submitted an Application requesting authority to search the Target Premises for: "evidence of a crime;" "contraband, fruits of crime, or other items illegally possessed;" and "property designed for use, intended for use, or used in committing a crime" related to violations of 18 U.S.C. §§ 2252A(a)(2) (receipt of child pornography) and 2252A(a)(5)(B) (possession and/or access with intent to view child pornography) ("Target Offenses"). Warrant at 1. The undersigned magistrate judge signed the warrant that day, authorizing the search and seizure of any material that constituted "fruits, evidence, information, contraband, or instrumentalities in whatever form and however stored, related to violations of [the Target Offenses]." Id. at 1, 6. Pursuant to 18 U.S.C. § 2253, the Court further authorized seizure of all unhosted wallets and any information used to access hosted or unhosted cryptocurrency wallets.⁶ See id. at 12. The Court also authorized the government "to seize any and all cryptocurrency by transferring the full account balance in each wallet to a public cryptocurrency address controlled by the United States ... [, and] copy any wallet files and restore them onto computers controlled by the United States ... [which would allow the government] to collect cryptocurrency transferred into the [Subject's] wallets as a result of transactions that were not yet completed at the time that the [Subject's] devices were seized" (collectively, the "Target Properties"). Id. at 7.

II. Legal Standards

A. Pretrial Seizure of Property

The pretrial seizure of forfeitable property is authorized by 21 U.S.C. § 853(f). See United States v. Bikundi , 125 F. Supp. 3d 178, 184 (D.D.C. 2015). The Court shall issue a warrant authorizing the seizure of such property if there is probable cause to believe: "(1) that ‘the defendant has committed an offense permitting forfeiture;’ and (2) that ‘the property at issue has the requisite connection to that crime.’ " Id. (quoting Kaley v. United States , 571 U.S. 320, 323–24, 134 S.Ct. 1090, 188 L.Ed.2d 46 (2014) ). The standard of probable cause "is ‘not a high bar.’ " Id. (quoting Kaley , 571 U.S. at 338, 134 S.Ct. 1090 ). Rather, it means a "fair probability." Id. (quoting United States v. Jackson , 415 F.3d 88, 91 (D.C. Cir. 2005) ). There is a "strong governmental interest in obtaining full recovery of all forfeitable assets." Caplin & Drysdale, Chartered v. United States , 491 U.S. 617, 631, 109 S.Ct. 2646, 105 L.Ed.2d 528 (1989). "Forfeiture serves important punitive and deterrence functions, and forfeited property often is put to productive use in assisting crime victims and improving communities damaged by criminal behavior." Bikundi , 125 F. Supp. 3d at 183 (citing Kaley , 571 U.S. at 323, 134 S.Ct. 1090 ).

B. Forfeiture Authority for Child Pornography Violations

Violations of 18 U.S.C. § 2252A give rise to forfeiture of three categories of property: (1) the child pornography itself; (2) proceeds traceable to the offense; (3) and "any property, real or personal, used or intended to be used to commit or to promote the commission of such offense." 18 U.S.C. § 2253(a)(1)–(3).⁷ This third prong covers two sub-categories—property used to (1) commit or (2) promote the offense. See § 2253(a)(3). These terms are to be "liberally construed to effectuate [the] remedial purposes [of forfeiture]." United States v. Rivera , 884 F.2d 544, 546 (11th Cir. 1989) (quoting 21 U.S.C. § 853(o) ).

"To ‘use’ is to ‘convert to one's service, to employ, to avail oneself of, and to carry out a purpose or action by means of.’ " Twenty-Four Cryptocurrency Accounts , 473 F. Supp. 3d at 7 (citing United States v. Hull , 606 F.3d 524, 527 (8th Cir. 2010) ).

The first subcategory, property used to commit the offense, has no analogue in other forfeiture statutes. It includes: (1) cryptocurrency wallets used to access a darknet child pornography site, see Twenty-Four Cryptocurrency Accounts , 473 F. Supp. 3d at 7 ; (2) a home from which a person accessed child pornography, see Hull , 606 F.3d at 527–28 ; and (3) electronic devices used to view child pornography, see United States v. Gleason , 277 F. App'x 536, 539 (6th Cir. 2008). It is irrelevant that...