United States v. Darby

• Decision Date: 03 June 2016
• Docket Number: CRIMINAL NO. 2:16cr36
• Citation: 190 F.Supp.3d 520
• Parties: United States of America, v. Gerald Andrew Darby, Defendant.
• Court: U.S. District Court — Eastern District of Virginia

190 F.Supp.3d 520

United States of America,

v.Gerald Andrew Darby, Defendant.

CRIMINAL NO. 2:16cr36

United States District Court, E.D. Virginia, Norfolk Division .

Signed June 3, 2016

Elizabeth M. Yusi, Leslie W. Fisher, United States Attorney's Office, Norfolk, VA, for United States of America.

OPINION AND ORDER

ROBERT G. DOUMAR, UNITED STATES DISTRICT JUDGE

This matter comes before the Court on Two Motions to Suppress filed by Gerald Andrew Darby ("Defendant"). ECF Nos. 15, 18. For reasons set forth below, the Court DENIES Defendant's First Motion to Suppress, ECF No. 15, and DENIES Defendant's Second Motion to Suppress, ECF No. 18.

I. BACKGROUND

The instant prosecution is the result of an FBI investigation into a website that facilitated the distribution of child pornography. The government seized control of this website and for a brief period of time operated it from a government facility in the Eastern District of Virginia. Both Motions to Suppress seek to exclude all evidence obtained as the result of a search warrant that allowed the government to use the website to remotely search the computers of individuals who logged into the website.

The following summary is provided as way of background. There is not yet any evidentiary record in this case, but the basic details of the investigation are not in dispute. Most of the information summarized here has been drawn from the warrant application, Appl. for a Search Warrant ("Warrant Appl."), ECF No. 16-1, specifically the affidavit in support of the warrant sworn to by FBI Special Agent Douglas Macfarlane. Aff. in Supp. of Appl. for Search Warrant ("Aff., Warrant Appl.,"), ECF No. 16-1 at 6. Additional details undisputed by the parties in their briefing are included mainly to fill out the narrative. For instance, neither the warrant nor warrant application identify the website and both refer to it simply as "TARGET WEBSITE." See Aff., Warrant Appl., ¶ 4. As explained in the affidavit in support of the warrant, at the time the warrant application was submitted the website was still active. Id.¶ 2 n.1. The government was concerned that disclosure of the name of the website in the application would alert potential users of the site to the government's investigation and thus undermine it. Id. At present, the government has since ceased operation of the website, and the name of the website has been widely reported.¹ Both parties refer to the website by its name: Playpen.

Playpen operated on the Tor network, which provides more anonymity to its users than the regular Internet.² Aff., Warrant Appl., ¶¶ 7–8. The Tor network was developed by the U.S. Naval Research Laboratory and is now accessible to the general public. Id.¶ 7. Users of the Tor network must download special software that lets them access the network. Id. Typically, when an individual visits a website, the website is able to determine the individual's Internet Protocol ("IP") address. See id.¶ 8. An individual's IP address is associated with a particular Internet Service Provider ("ISP") and particular ISP customer. Id.¶ 35. Because internet access is typically purchased for a single location, an IP address may be used by law enforcement to determine the home or business address of an internet user. See id. When a user accesses the Tor network, communications from that user are routed through a system of network computers that are run by volunteers around the world. Id.¶ 8. When a user connects to a website, the only IP address that the website "sees" is the IP address of the last computer through which the user's communications were routed. Id. This final relay is called an exit node. Id. Because there is no practical way to trace a user's communications from the exit node back to the user's computer, users of the Tor network are effectively anonymous to the websites they visit. Id.

The Tor network also provides anonymity to the individuals who run websites or forums on it. Id.¶ 9. Websites may be set up on the Tor network as "hidden services." Id. A hidden service may only be accessed through the Tor network. Id. A hidden service functions much like a regular website except that its IP address is hidden. Id. The IP address is replaced with a Tor-based address which consists of a series of alphanumeric characters followed by ".onion." Id. There is no way to look up the IP address of the computer hosting a hidden service. Id.

A user of the Tor network cannot simply perform a search to find a hidden service that may interest the user. Id.¶ 10. In order to access a hidden service a user must know the Tor-based address of the hidden service. Id. As a result, a user cannot simply stumble onto a hidden service. Id. The user may obtain the address from postings on the Internet or by communications with other users of the Tor network. Id. One hidden service may also link to another. See id. Playpen was a hidden service contained on the Tor network, and it had been linked to by another hidden service that was dedicated to child pornography. Id.

Of importance to the First Motion to Suppress is the homepage of the Playpen site. See Def.'s First Mot. to Suppress ("First Mot."), ECF No. 15 at 2–3. In the warrant application, the homepage is said to contain "images of prepubescent females partially clothed and whose legs are spread." Aff., Warrant Appl., ¶ 12. The censored version of the exact images has been attached to the briefing. ECF No. 16-2. There appears to have just been two photographs on the home page. The images show two young girls in the attire and pose described. Id. The images of these children appear at the top of the homepage and flank a large image of the site's name, Playpen. Id. Although these images were at an earlier point on the homepage, the parties agree that at the time the warrant was signed, on February 20, 2015 at 11:45 am, a different image confronted users to the site. First Mot. at 9; Gov't's Resp. to Def.'s First Mot. to Suppress ("Gov't's Resp. to First Mot."), ECF No. 16 at 14. A censored version of this image has also been included in the briefing. ECF No. 16-3. It shows a young girl with her legs crossed, reclined on a chair, wearing stockings that stop at her upper thigh and a short dress or top that exposes the portion of her upper thigh not covered by the stockings. Id. Her image is to the left of the site name. Id.

The government claims that the images must have changed shortly before the warrant was signed. Gov't's Resp. to First Mot. at 14. In the affidavit in support of the warrant, Special Agent Macfarlane recounts that FBI agents reviewed the Playpen website from September 16, 2014 to February 3, 2015. Aff., Warrant Appl., ¶ 11. The screenshot of the home page that was included in the government's brief and contains the images of the two young girls was taken on February 3, 2015. ECF No. 16-2. The date is visible in the lower right corner of the screen. Id. The affidavit further states that sometime between February 3, 2015 and February 18, 2015, the Tor address of the site was changed. Warrant Appl. ¶ 11 n.1. Special Agent Macfarlane states in his affidavit that after the address change he "accessed the TARGET WEBSITE in an undercover capacity at its new URL, and determined that its content had not changed." Id. In its briefing the government asserts that this statement confirms that the homepage of Playpen was as described in the warrant application on February 18, 2015, two days before the warrant was sworn and signed. Gov't's Resp. to First Mot. at 14–15.

The homepage also provided users with instructions on how to join and then log into the site. Aff., Warrant Appl., ¶ 12. Users had to register with the site before going any further into the site. Id. Users were instructed to enter a phony email address and to create a login name and password. Id.¶ 13. The instructions also informed users that staff and owners of the site were unable to determine the true identity of users and that the website could not see the IP addresses of users. Id.

Once registered and logged into the site users had access to numerous sections, forums, and sub-forums where they could upload material and view material uploaded by others. Id.¶ 14. For instance under the heading "Playpen Chan"³ are four subcategories: "Jailbait—Boy," "Jailbait—Girl," "Preteen—Boy," and "Preteen—Girl." Id. Special Agent Macfarlane, based on his training and experience, explains that "jailbait" refers to underage but post-pubescent minors. Id.¶ 14 n.4. Other forum and sub-forum categories on the site include "Jailbait videos," "Family Playpen—Incest," "Toddlers," and "Bondage." Id.¶ 14. Not surprisingly, a review of the contents of these forums revealed that the majority of content was child pornography. Id.¶ 18. The warrant application has several specific examples of the reprehensible material contained on the site. Id.¶¶ 18, 23–25. Additionally, there was a section of the site that allowed members of the site to exchange usernames on a Tor-based instant messaging service known to law enforcement to be "used by subjects engaged in the online sexual exploitation of children." Id.¶ 15.

In December of 2014, a foreign law enforcement agency informed the FBI that it suspected that a United States-based IP address was the IP address of Playpen. Id.¶ 28. In January 2015, after obtaining a search warrant, the FBI seized the IP address and copied the contents of the website. Id.¶ 28. On February 19, 2015 the FBI arrested the individual suspected of administering Playpen. Id.¶ 30.

The FBI desired to continue to operate Playpen for a limited time so as to identify individuals who logged into the site and who were likely to possess, distribute, or produce child pornography. Id.¶ 30. The FBI would operate the site from a location in the Eastern District of Virginia. Id.¶ 33. As mentioned above, normally a website administrator is able to determine the IP addresses of those individuals that visit the site. However, on the Tor network...