United States v. Ammons

• Citation: 207 F.Supp.3d 732
• Decision Date: 14 September 2016
• Docket Number: CRIMINAL ACTION NO. 3:16-CR-00011-TBR-DW
• Parties: UNITED STATES of America, Plaintiff, v. Dennis AMMONS, Defendant.
• Court: U.S. District Court — Western District of Kentucky

207 F.Supp.3d 732

UNITED STATES of America, Plaintiff,

v.Dennis AMMONS, Defendant.

CRIMINAL ACTION NO. 3:16-CR-00011-TBR-DW

United States District Court, W.D. Kentucky, Louisville Division.

Signed September 14, 2016.

Jo E. Lawless, U.S. Attorney Office, Louisville, KY, for Plaintiff.

Scott T. Wendelsdorf, Western Kentucky Federal Community Defender, Inc., Louisville, KY, for Defendant.

MEMORANDUM OPINION AND ORDER

Thomas B. Russell, Senior Judge

Dennis Ammons has been indicted for knowingly producing and receiving child pornography. His prosecution originates from the Government's investigation of "Playpen," a website dedicated to the distribution and discussion of matters pertinent to child pornography and the sexual abuse of children. Though a website, Playpen could not be accessed through the traditional Internet. Instead, Playpen existed on "The Onion Router" network (or "Tor," for short). The Tor network conceals the internet protocol addresses of its users, thereby thwarting traditional techniques employed to identify Internet users. To circumvent Tor's protections, the Federal Bureau of Investigation obtained a warrant from Magistrate Judge Buchanan of the Eastern District of Virginia to deploy a network investigative technique on Playpen's server. The NIT would instruct a user's computer to transmit certain information—such as the computer's IP address—to the FBI after the user logged on to Playpen. Using the NIT, the FBI identified Ammons as a registered user on Playpen. The FBI obtained a warrant to search his residence located in Muldraugh, Kentucky on the basis of that information. Now, Ammons seeks to suppress all information seized pursuant to the NIT warrant, including the evidence obtained during or as a result of the search of his home.

The Court holds that use of the NIT was a "search" within the meaning of the Fourth Amendment. Though Magistrate Judge Buchanan issued the NIT warrant, she lacked authority to do so under the Federal Magistrates Act, 28 U.S.C. §§ 631 -639, and Federal Rule of Criminal Procedure 41(b). The ensuing search of Amnions' computer, therefore, violated the Fourth Amendment. Yet, under the good-faith exception to the exclusionary rule, suppression is not an appropriate remedy for that unconstitutional search. Accordingly, Dennis Ammons' Motion to Suppress, [R. 24], is DENIED.

I.

A.

The prosecution of Dennis Ammons originates from the Government's investigation of "Playpen," a website "dedicated to the advertisement and distribution of child pornography" and "the discussion of matters pertinent to child sexual abuse." [R. 24-2 at 14, ¶ 6 (Special Agent Macfarlane's Affidavit).] Though a website, Playpen could not be accessed through the traditional Internet. [Id. at 16, ¶ 10.] Instead, Playpen existed on "The Onion Router" network (or "Tor," for short). [Id. at 14, ¶ 7.] Tor is designed "specifically to facilitate anonymous communication over the Internet." [R. 24-5 at 17, ¶ 17 (Special Agent MacHenry's Affidavit).] It accomplishes that task in two ways.

First, Tor thwarts traditional techniques employed to identify Internet users. [R. 24-2 at 27-28, ¶ 31.] For example, the Government typically identifies users by obtaining and tracing a computer's internet protocol address. [See R. 24-5 at 23, ¶ 32.] Whenever a person accesses a website through the Internet, the website typically logs that computer's IP address. [R. 24-2 at 15, ¶ 8.] If the Government were to seize control of that website, then it could retrieve the logs and discover which IP addresses accessed the site. [R. 24-5 at 23, ¶ 32.] By cross-referencing an IP address with publically-available databases, which list the IP address ranges assigned to various internet service providers, the Government could determine which ISP owned the target IP address. [Id. ] The Government could then ascertain the identity of the user through an administrative subpoena issued to the ISP. [Id. ]

Tor changes all of that. Tor masks a user's IP address by routing communications through "a distributed network of relay computers run by volunteers all over the world." [R. 24-2 at 15, ¶ 8.] When a user on the Tor network accesses a website, the only IP address revealed to the site is that of the last computer in the relay, dubbed an "exit node." [Id. ] It is impossible, though, to trace that IP address back to the originating computer. [Id. ] Consequently, a user on the Tor network remains effectively anonymous to the websites he or she visits. [Id. ]

Second, Tor affords anonymity to those who host websites as "hidden services" on the Tor network too. [Id. at 15–16, ¶ 9.] A hidden service functions just like any other website with a single exception: The website's IP address is hidden and replaced with a Tor-based address consisting of a series of alphanumeric characters followed by the suffix ".onion." [Id. ] There is no way to determine the IP address of the server hosting a hidden service. [Id. ]

A hidden service may only be accessed through the Tor network. [Id. at 16, ¶ 10.] Even after connecting to the Tor network, though, a user cannot stumble across a hidden service while using an ordinary search engine, such as Google. [See id. at 16–17, ¶ 10.] Instead, a user must know the exact Tor-based address of the hidden service. [Id. at 16, 10.]

Playpen operated on the Tor network as a hidden service from around August 2014 to March 2015. [Id. at 16–17, ¶¶ 10–11.] Upon registering for an account, potential users were warned not to enter a real e-mail address or to post identifying information in their profiles. [Id. at 18, ¶ 13.] Playpen informed potential users that the website and its administrators were unable to determine the IP addresses of any users' computer. [Id. at 18–19, ¶ 13.] In less than one year, more than two-hundred thousand members created and viewed tens of thousands of postings related to child pornography. [R. 24-5 at 19, ¶ 22; see also R. 24-2 at 22, ¶ 19.] Images and videos shared through the site were extensively categorized according to the child's age and gender, as well as the type of sexual activity involved. [See R. 24-2 at 19–21, ¶ 14.]

In December 2014, a foreign law-enforcement agency advised the Federal Bureau of Investigation that a United States-based IP address appeared to be associated with Playpen. [Id. at 25, ¶ 28.] Shortly after, the FBI confirmed that the IP address belonged to Centrilogic, a server hosting company headquartered in Lenoir, North Carolina. [Id. at 25–26, ¶ 28.] The FBI subsequently obtained and executed a search warrant in January 2015. [Id. ] Upon discovering that the target server contained a copy of Playpen, the FBI transported it to a government-controlled server in Newington, Virginia, located in the Eastern District of Virginia. [See id. at 25–27, ¶¶ 28, 30.] On February 19, 2015, the FBI apprehended the suspected administrator of, and assumed control over, Playpen. [Id. at 26–27, ¶ 30.]

The FBI wished to continue operating Playpen for a limited time (from February 20 to March 5, 2015) so as to identify its users. [Id. ] To that end, the Government sought and obtained a warrant from Magistrate Judge Buchanan of the Eastern District of Virginia to deploy a network investigative technique (or "NIT," for short) on Playpen's server. [Id. at 27–28, ¶ 31; see also id. at 2–4 (NIT Search Warrant).] The NIT is a series of code that instructed a user's computer to transmit certain information to the FBI after the user logged on to Playpen. [Id. at 28, ¶ 32–33.] In detail, the information consisted of the computer's IP address, operating system, "host name," active operating system username, media access control address, and a unique identifier (to distinguish the data sent from other devices). [Id. at 4.]

Using the NIT, the FBI determined that a person going by the username "H8RL3Y" had registered on Playpen on March 4, 2015. [R. 24–5 at 24, ¶ 37.] Between March 4 and March 5, "H8RL3Y" accessed several images of child pornography over a six-hour period of activity. [Id. at 24–25, ¶¶ 37–39.] Cross-referencing the IP address associated with "H8RL3Y" against publically-available databases, the FBI determined that the IP address belonged to a Time Warner Cable subscriber. [Id. at 26, ¶ 40.] Through an administrative subpoena issued to TWC, the FBI traced the IP address to a home in Muldraugh, Kentucky, where Dennis Ammons (along with his sister and her two minor children, "Jane Doe" and "Jane Roe" resided. [See id. at 26–27, ¶¶ 41–43; R. 1 at 5-6, ¶¶ 9-11 (Criminal Complaint and Affidavit).]

On December 8, 2015, FBI Special Agent Virginia MacHenry sought and obtained from Magistrate Judge Lindsay in the Western District of Kentucky a warrant to search Ammons' residence for evidence of child pornography. [R. 24-6 at 1 (Residential Search Warrant).] Law-enforcement officers executed that warrant on December 15. [R. 1 at 5, ¶ 9.] During an interview with law-enforcement officers, Ammons admitted to looking at child pornography, but officers made no arrest at that time. [Id. ]

Subsequently, on December 29, 2015, a staff member with the Family and Children's Place in Louisville, Kentucky, conducted an interview with "Jane Doe," a sixteen-year-old girl. [Id. at 6, ¶ 10.] (Special Agent MacHenry observed the interview via closed-circuit television. [Id. ] ) During that interview, Doe recounted an incident where Ammons made her pose fully nude in the "spread-eagle" position on his bed while he photographed her with his cell phone. [Id. , ¶ 11.] Doe also described multiple occasions when Ammons forced her to completely undress and sit on his bed "with her legs open while facing Ammons and his computer." [Id. , ¶ 12.]

B.

On December 31, 2015, Special Agent MacHenry filed a criminal complaint and affidavit of probable cause, [see R. 1 at 1–7], and obtained from Magistrate Judge Brennenstuhl in the Western District of Kentucky a warrant to arrest Ammons, [see R. 6 at 1 (Arrest Warrant) ]. Law-enforcement officers...