United States v. Croghan

• Decision Date: 19 September 2016
• Docket Number: 1:15-cr-48,1:15-cr-51
• Parties: UNITED STATES of America, Plaintiff, v. Beau Brandon CROGHAN, Defendant. United States of America, Plaintiff, v. Steven Shane Horton, Defendant.
• Court: U.S. District Court — Southern District of Iowa

209 F.Supp.3d 1080

UNITED STATES of America, Plaintiff,

v.Beau Brandon CROGHAN, Defendant.

United States of America, Plaintiff,

v.Steven Shane Horton, Defendant.

1:15-cr-48

1:15-cr-51

United States District Court, S.D. Iowa.

Signed September 19, 2016

Richard E. Rothrock, Katherine Ann McNamara, United States Attorneys Office, Council Bluffs, IA, Maureen McGuire, United States Attorney's Office, Des Moines, IA, for United States of America, Plaintiff.

Michael Lee Smart, Federal Public Defenders Office, Sioux City, IA, for Beau Brandon Croghan, Defendant.

Stuart J. Dornan, Dornan Lustgarten & Troia PC, LLO, Omaha, NE, for Steven Shane Horton, Defendant.

ORDER

ROBERT W. PRATT, Judge, UNITED STATES DISTRICT COURT

Before the Court are two Motions to Suppress, one filed by Defendant Beau Croghan in Case No. 1:15–cr–48 ("Croghan"), and one filed by Defendant Steven Horton in Case No. 1:15-cr-51 ("Horton"). Croghan Clerk's No. 33; Horton Clerk's No. 45. The Government filed an identical resistance brief in each case. Croghan Clerk's No. 36; Horton Clerk's No. 49. Because the facts leading to each Defendant's arrest are fundamentally the same, the Court considers the Motions to Suppress together. And, because the facts are undisputed, the Court agrees with the parties that no hearing is necessary. The matters are, therefore, fully submitted.

I. FACTUAL BACKGROUND

In approximately September 2014, the Federal Bureau of Investigation ("FBI") began investigating a child pornography website known as "Playpen." NIT Warrant¹ ¶ 11. Playpen existed as a "hidden service" on the "Tor" network, which is designed to protect user anonymity by obscuring identifying information such as the user's IP address.² Id. ¶ 10. Because "hidden services" are not publically indexed or searchable, a user must both connect to Tor and know the specific Tor-based web address of a particular site to gain access. Id.

During the course of its investigation, the FBI connected to the Playpen website and discovered that it appeared to be dedicated to advertising and distributing child pornography. Id. ¶¶ 11–12. In December 2014, a foreign law enforcement agency advised the FBI that it had discovered the actual IP address of the Playpen server and that such server was located in Lenoir, North Carolina. Id. ¶ 28. In January 2015, the FBI obtained and executed a search warrant whereby it seized the Playpen website server. Id. Hoping to locate and identify visitors to the site, the FBI placed a complete copy of the Playpen website, including all of the child pornography on the website, on a government-controlled server located in Newington, Virginia. Id. ; see also Gov't Resistance Br. at 2. On February 19, 2015, the FBI arrested the suspected administrator of the Playpen website and "assumed administrative control" of it. NIT Warrant ¶ 30.

On February 20, 2015, the FBI submitted an application for and affidavit in support of a search warrant to Eastern District of Virginia Magistrate Judge Theresa Carroll Buchanan. See generally NIT Warrant. The affidavit provided that the FBI intended to continue operating the Playpen website from its own server for a period of time not to exceed 30 days in an attempt to identify users of the site. Id. ¶ 30. Because the site utilized the Tor network to mask user identify information, the FBI requested that Magistrate Judge Buchanan authorize use of a "Network Investigative Technique" ("NIT") whereby the FBI would insert computer software into the Playpen website that would assist it in "locat[ing] and apprehend[ing] the TARGET SUBJECTS who are engaging in the continuing sexual abuse and exploitation of children" by accessing the Playpen website. Id. Once installed on the Playpen website on the government-controlled server, the NIT would be deployed to the computer of any user who visited the Playpen website and entered a user name and password. Id. ¶¶ 31–34; Croghan Br. at 7 (noting that the NIT would be deployed to " ‘any user’ who logged into the site with a username and password, regardless of their physical location, whether or not they were using the site's chat features, or viewing child pornography"). The NIT would then force the "activating" computer to transmit information back to the FBI, including: the IP address of the activating computer; the date and time the NIT determined the IP address; a unique identifier generated by the NIT to distinguish data from different activating computers; the type of operating system running on the activating computer, including type, version, and architecture; information on whether the NIT had already been delivered to the activating computer; the "host name" of the activating computer; the operating system used by the activating computer; and the Media Access Control ("MAC") address of the activating computer. NIT Warrant ¶ 34. Magistrate Judge Buchanan approved the warrant and authorized the FBI to deploy the NIT for 30 days. See generally Id. She further granted a request by the Government to delay notice of the search "until 30 days after any individual accessing the [Playpen site] has been identified to a sufficient degree as to provide notice" under 18 U.S.C. § 3103(a)(b) and Federal Rule of Criminal Procedure 41(f)(3). Id. ¶¶ 38–41.

The Government began deploying the NIT on February 20, 2015, and continued to do so until March 4, 2015, at which time it took the Playpen website offline. Gov't Resistance Br. at 2. On July 17, 2015, law enforcement obtained a search warrant for Beau Croghan's residence in Council Bluffs, Iowa. Croghan Clerk's No. 33-3. Law enforcement obtained a search warrant for Steven Horton's residence in Glenwood, Iowa on August 5, 2015.³ Horton Clerk's No. 45-2. The affidavits submitted in support of each of the Iowa Warrants relied primarily on information collected from the NIT. In particular, each affidavit described the Playpen website, its existence on the Tor network, and the authorization for the NIT from the Eastern District of Virginia. The affidavits recounted that the NIT had yielded specific user names and IP addresses, and that subsequent investigation using public records and administrative subpoenas to Internet Service Providers ("ISPs") had associated the identified IP addresses with Croghan, Horton, and their specific residences. While executing the warrants, law enforcement seized evidence from each Defendant's home, eventually culminating in both men being indicted for accessing or attempting to access child pornography in violation of 18 U.S.C. § 2252(a)(5)(B).

II. LAW AND ANALYSIS

Defendants urge that all evidence discovered by virtue of and flowing from the NIT warrant must be suppressed. In particular, they argue: (1) the NIT warrant was issued in violation of Federal Rule of Criminal Procedure 41 ; (2) as a result of the Rule 41 violation, evidence obtained by use of the NIT must be suppressed; (3) evidence obtained as a result of the Iowa Warrants must also be suppressed because the probable cause supporting their issuance was derived solely from evidence collected by virtue of the NIT; and (4) no good faith exception is applicable to avoid suppression. The Government counters: (1) that the NIT warrant complied with Rule 41 ; (2) that even if Rule 41 was violated, suppression is not warranted; and (3) that the good faith exception applies in any event.

The Court notes that the NIT Warrant at issue in this case has resulted in a great deal of litigation across the country. The numerous district courts to consider motions similar to the present Motions to Suppress have reached varying conclusions on the legal issues at play. At least two courts have concluded that the NIT Warrant was unlawfully issued and suppressed all fruits of it. See , e.g. , United States v. Levin , No. 15–10271, 186 F.Supp.3d 26, 2016 WL 2596010 (D.Mass. May 5, 2016); United States v. Arterbury , No. 15-cr-182, Clerk's No. 42 (N.D. Okla. Apr. 25, 2016). Several others have found that while the NIT Warrant may have been issued unlawfully, suppression was not warranted, either under the exclusionary rule in general or pursuant to the Leon⁴ good faith exception. See United States v. Torres , No. 5:16–cr–285, 2016 WL 4821223 (W.D.Tex. Sept. 9, 2016) ; United States v. Henderson , No. 15–cr–565, 2016 WL 4549108 (N.D.Cal. Sept. 1, 2016) ; United States v. Adams , No. 6:16–cr–11, 2016 WL 4212079 (M.D.Fla. Aug. 10, 2016) ; United States v. Acevedo – Lemus , No. 15–00137, 2016 WL 4208436 (C.D.Cal. Aug. 8, 2016) ; United States v. Werdene , No. 15–434, 188 F.Supp.3d 431, 2016 WL 3002376 (E.D.Pa. May 18, 2016) ; United States v. Epich , No. 15–cr–163–PP, 2016 WL 953269 (E.D.Wis. Mar. 14, 2016) ; United States v. Michaud , No 3:15–cr–05351–RJB, 2016 WL 337263 (W.D.Wash. Jan. 28, 2016). And, at least four decisions, three from the Eastern District of Virginia and one from the Western District of Arkansas, have concluded that the magistrate judge possessed adequate authority to issue the NIT Warrant under Rule 41 such that there was no legal violation that would require suppression. See , e.g. , United States v. Jean , No. 5:15–cr–50087, 2016 WL 4771096 (W.D.Ark. Sept. 13, 2016) ; United States v. Eure , No 2:16cr43, 2016 WL 4059663 (E.D.Va. July 28, 2016) ; United States v. Matish , No. 4:16cr16, 193 F.Supp.3d 585, 2016 WL 3545776 (E.D.Va. June 23, 2016) ; United States v. Darby , No. 2:16cr36, 190 F.Supp.3d 520, 2016 WL 3189703 (E.D.Va. June 3, 2016).

A. Did the NIT Warrant Comply With Rule 41

The Federal Magistrates Act provides that "[e]ach United States magistrate judge serving under [the Act] shall have within the district in which sessions are held by the court that appointed the magistrate judge, at other places where that court may function, and elsewhere as authorized by law" certain duties, including among other things "all powers and duties conferred or imposed ... by the Rules of Criminal Procedure for the United States District Courts." 28 U.S.C. § 636(a)(1). Federal Rule...