United States v. Dzwonczyk, 4:15-CR-3134
| Decision Date | 23 December 2016 |
| Docket Number | 4:15-CR-3134 |
| Parties | UNITED STATES OF AMERICA, Plaintiff, v. DOMINIC C. DZWONCZYK, Defendant. |
| Court | U.S. District Court — District of Nebraska |
This matter is before the Court on the defendant's motion to suppress evidence (filing 37), the Magistrate Judge's Findings and Recommendation (filing 56) recommending that the motion be denied, and the defendant's objection (filing 59) to the findings and recommendation. Having conducted a de novo review of the record pursuant to 28 U.S.C. § 636(b)(1)(C), the Court will adopt the Magistrate Judge's recommendation. Accordingly, the defendant's objection (filing 59) will be overruled, and the defendant's motion to suppress (filing 37) will be denied.
This case arises from an FBI investigation into online child pornography.1 The investigation focused on a website called Playpen, which was accessible to users through the "Tor" network. In 2015, the FBI—pursuant to a warrant—seized control of the server supporting that website. Rather than shutting the website down, the agents continued to operate it out of a government facility in Virginia in an attempt to identify and prosecute administrators and users throughout the country. To this end, the FBI requested authorization from a magistrate judge for the use of a Network Investigative Technique, or "NIT"—software that the government could deploy onto the computer of any person who successfully logged on to the Playpen website. Once on a user's computer, the software would transmit certain identifying information about that user back to the FBI—and, in doing so, reveal the user's public IP address. The FBI would then use thatinformation to track the physical location of the user, and to secure a search warrant for that user's home or property.
The defendant, through the username "RebeckaBecka," allegedly visited the Playpen website while it was in the government's control. Filing 66 at 6. Using the NIT software, the government uncovered the defendant's IP address, which led them to Cox Communications—an internet provider that services areas in and around Bellevue, Nebraska. Filing 66 at 6. Cox indicated that the IP address was assigned to the defendant, and on August 14, 2015, authorities secured a search warrant for the defendant's home. Filing 66 at 6. The search uncovered child pornography on the defendant's computer.
The defendant has moved to suppress all evidence obtained from the search of his residence and the computers therein. In support of his motion, the defendant argues that the NIT warrant was issued in violation of Fed. R. Crim. P. 41 and 28 U.S.C. § 636(a). See filing 38 at 4-8. Relatedly, the defendant argues that, given the nature of the Rule 41(b) violation, the Leon good faith exception does not apply. Filing 38 at 10.
After thoroughly reviewing the relevant facts and law, Magistrate Judge Zwart recommended that this Court deny the defendant's motion to suppress. Filing 56 at 20. The defendant filed a timely objection to the Magistrate's Findings and Recommendation, renewing his argument that the evidence was seized in violation of the Federal Rules of Criminal Procedure. Filing 59.
Before addressing the merits of the defendant's objection, the Court will examine the relevant facts in more detail.
Playpen was an internet website that was designed and utilized for the advertisement and distribution of child pornography. Filing 40 at 15. The website also included features whereby users could discuss "matters pertinent to child sexual abuse, including methods and tactics . . . use[d] to abuse children, . . . [and] to avoid law enforcement detection while perpetrating online child sexual exploitation crimes[.]" Filing 40 at 15. Administrators and users routinely utilized the website to send and receive illegal child pornography. Filing 40 at 15.
Playpen operated as a hidden service on an anonymity provider called the "Tor" network. Filing 40 at 15. As explained in the Magistrate's Judge's Findings and Recommendation, hidden services on the Tor network are not typically accessible through traditional internet searches. Filing 56 at 1. So, a user could not, for example, locate or access Playpen through a standard Google or Yahoo search. Rather, a user of the site must (a) have access to theTor network, and (b) know the Tor network address for Playpen. See, filing 56 at 1; filing 40 at 17. Thus, as set forth in the application for the NIT warrant, accessing Playpen "requires numerous affirmative steps by the user, making it extremely unlikely that any user could simply stumble upon . . . [Playpen] without understanding its purpose and content." Filing 40 at 17-18.
The value of the Tor network lies in the anonymity it provides its users. To this end, the Tor software "bounc[es users'] communications around a distributed network of relay computers run by volunteers all around the world[.]" See, filing 56 at 2; filing 40 at 16. These relay computers are known as "nodes," and an "exit node" is the last computer through which a user's communication is routed. Filing 56 at 2; filing 40 at 16. So, when a user on the Tor network accesses a website, it is the IP address of the "exit node"—not the user—that appears on the site's IP log. See filing 40 at 16. Thus, the process is designed to mask the user's actual IP address so that the user remains, to the extent possible, completely unidentifiable. Filing 40 at 16.
In December 2014, the FBI received information regarding the possible owner of the IP address associated with Playpen. See filing 40 at 26-27. Based on this information, the FBI, in January 2015, obtained and executed a search warrant to seize Playpen's host server. Filing 40 at 27. After reviewing the contents of the server, and confirming its association with Playpen, the FBI cloned the server on a government server in the Eastern District of Virginia. Filing 40 at 27. The administrator of that server was subsequently identified and apprehended.
Rather than shutting down Playpen, the FBI kept operating the site in an attempt to identify and locate other administrators and users of the website. To do so, the FBI, on February 20, 2015, submitted an application for a search warrant, along with a supporting affidavit, to a magistrate judge in the Eastern District of Virginia. See generally filing 40. According to the supporting affidavit, the government would "continue to operate [Playpen] from the government-controlled computer server in Newington, Virginia" for a limited period of time, not to exceed 30 days, "in order to locate and identify the administrators and users of [Playpen]." Filing 40 at 28.
Filing 40 at 29. The information transmitted from the "activating" computer to the FBI via the NIT included: the IP address of the activating computer, and the date and time that the NIT determined the IP address; a unique identifier generated by the NIT to distinguish data from different activating computers; the type of operating system running the computer; information about whether the NIT has already been delivered to the activating computer; the activating computer's operating system username; and the MAC address of the activating computer. Filing 40 at 30-31. The Eastern District of Virginia magistrate judge approved the warrant, authorizing the FBI to deploy the NIT for 30 days. See filing 40 at 3.
The parties to this dispute agree that, on or around February 28, 2015, the NIT was deployed and attached to a computer with an IP address allegedly belonging to the defendant. See filing 38 at 3. Information was gleaned from the defendant's computer, which led the authorities to the defendant's home in Bellevue, Nebraska. The authorities obtained a search warrant (the "Nebraska warrant"), and on August 21, 2015, that warrant was executed on the defendant's home. Filing 38 at 3. Electronic evidence was seized, and an indictment charging the defendant with one count of possession of child pornography and one count of receipt of child pornography was filed on December 8, 2015. Filing 38 at 3.
The defendant contends that the Eastern District of Virginia magistrate judge, in authorizing the NIT warrant, exceeded the jurisdictional requirements established under the Federal Magistrates Act and Rule 41(b) of the Federal Rules of Criminal Procedure. To this end, the defendant argues that the NIT warrant impermissibly authorized government agents to "seize and search computers located outside the [Eastern...
To continue reading
Request your trial