United States v. Horton

• Decision Date: 24 July 2017
• Docket Number: No. 16-3976, No. 16-3982,16-3976
• Citation: 863 F.3d 1041
• Parties: UNITED STATES of America, Plaintiff-Appellant v. Steven Shane HORTON, Defendant-Appellee Electronic Frontier Foundation, Amicus on Behalf of Appellee(s) United States of America, Plaintiff-Appellant v. Beau Brandon Croghan, Defendant-Appellee Electronic Frontier Foundation, Amicus on Behalf of Appellee(s)
• Court: U.S. Court of Appeals — Eighth Circuit

863 F.3d 1041

UNITED STATES of America, Plaintiff-Appellant

v.Steven Shane HORTON, Defendant-Appellee

Electronic Frontier Foundation, Amicus on Behalf of Appellee(s)

United States of America, Plaintiff-Appellant

v.Beau Brandon Croghan, Defendant-Appellee

Electronic Frontier Foundation, Amicus on Behalf of Appellee(s)

No. 16-3976

No. 16-3982

United States Court of Appeals, Eighth Circuit.

Submitted: April 6, 2017

Filed: July 24, 2017

Rehearing and Rehearing En Banc Denied in Nos. 16-3982 and 16-3976 August 29, 2017^*

Counsel who appeared on the brief and presented argument on behalf of the appellant was David Brian Goodhand, of Washington, DC.

Counsel who appeared on the brief and presented argument on behalf of the appellee, Steven Shane Horton in 16-3976 was Stuart J. Dornan, of Omaha, NE. Counsel who appeared on the brief and presented argument on behalf of the appellee, Beau Brandon Croghan in 16-3982 was Bradley Ryan Hansen, of Sioux City, Iowa.

Before SMITH, Chief Judge, SHEPHERD, Circuit Judge, and FENNER, District Judge.¹

SMITH, Chief Judge.

Steven Horton and Beau Croghan were indicted separately for accessing child pornography in violation of 18 U.S.C. § 2252A(a)(5)(B). Both men moved to suppress evidence obtained through a warrant authorizing a search of their respective computers through the use of a Network Investigative Technique (NIT). In a combined order, the district court granted suppression.

The government appeals pursuant to 18 U.S.C. § 3731. We reverse.

I. Background

The Onion Router ("Tor") network exists to provide anonymity to Internet users by masking user data, hiding information by funneling it through a series of interconnected computers. The Tor Project, a not-for-profit research organization in Massachusetts, provides free downloads of the Tor program on its website. Although Tor's intended users include whistleblowers, journalists, law enforcement personnel, activists, and privacy-minded consumers, users with more nefarious motives have used Tor's anonymity capabilities for criminal purposes.

In September 2014, the FBI began investigating an internet forum for sharing child pornography hosted on the Tor network called "Playpen." Accessible through a web address of seemingly random letters and numbers, users entered Playpen by creating a username and password. Playpen had more than 150,000 registered accounts. In January 2015, FBI agents gained access to Playpen servers and relocated the website content to servers in a secure government facility in the Eastern District of Virginia. The agents assumed administrative control of the site. Although FBI investigators could monitor Playpen traffic, users were still cloaked by the Tor encryption technology.

On February 20, 2015, FBI Special Agent Douglas Macfarlane, a 19-year veteran of the agency, applied for a warrant in the Eastern District of Virginia to search computers that accessed Playpen. The warrant described the application of the NIT, which sent computer code to Playpen users' computers that instructed the computers to transmit certain information back to the government. The information sent back included the computer's Internet Protocol (IP) address, operating system information, operating system username, and its Media Access Control (MAC) address, which is a unique number assigned to each network modem. Although Playpen was hosted in the Eastern District of Virginia, the warrant explained that "the NIT may cause [a defendant's] computer—wherever located—to send to a computer controlled by or known to the government, network level messages containing information that may assist in identifying the computer." A United States magistrate judge signed the warrant, and the FBI began collecting the personal data of Playpen users.

During the warrant period, Horton accessed Playpen with the username "boybuttlover123." The FBI located Horton in the Southern District of Iowa through information obtained by the NIT. Horton was arrested and charged in Iowa. Croghan also accessed Playpen during the relevant time period, using the username "beau2358." Through the NIT, law enforcement located his home in Iowa, executed a search of his home, and indicted him. Both Horton and Croghan moved to suppress evidence obtained through the NIT. In a combined order, the district court found that the magistrate judge exceeded her statutory authority by issuing the NIT warrant beyond the district court's jurisdictional boundaries. See Fed. R. Crim. P. 41(b). The district court noted that "a warrant issued without proper jurisdiction is void ab initio and ... any search conducted pursuant to such warrant is the equivalent of a warrantless search." United States v. Croghan , 209 F.Supp.3d 1080, 1090 (S.D. Iowa 2016). The district court suppressed the evidence obtained through the warrant. Id. at 1091.

This single NIT warrant executed in Virginia has implicated more than a hundred defendants across the United States. More than 40 district courts have held hearings regarding suppression of evidence generated from the NIT, including several courts in this circuit. See, e.g. , United States v. Dzwonczyk , No. 4:15-CR-3134, 2016 WL 7428390 (D. Neb. Dec. 23, 2016) ; United States v. Johnson , No. 15-00340-01-CR-W-GAF, 2016 WL 6136586 (W.D. Mo. Oct. 20, 2016) ; United States v. Jean , 207 F.Supp.3d 920 (W.D. Ark. 2016) ; see also United States v. Taylor , No. 2:16-CR-00203-KOB-JEO-1, –––F.Supp.3d ––––, –––– – ––––, 2017 WL 1437511, at *3–4 (N.D. Ala. Apr. 24, 2017) (collecting cases). Most district courts that have addressed these suppression motions have denied them, but they have taken varying approaches in reaching that result. See Dzwonczyk , 2016 WL 7428390, at *4 ("[T]he Court takes a different path to this [non-suppression] result."). Only a few have granted suppression, and all used similar reasoning. See, e.g. , United States v. Workman , 205 F.Supp.3d 1256 (D. Colo. 2016) ; United States v. Levin , 186 F.Supp.3d 26 (D. Mass. 2016) ; United States v. Arterbury , No. 15-CR-182-JHP, 2016 U.S. Dist. LEXIS 67091 (N.D. Okla. Apr. 25, 2016), adopted by No. 15–CR–182–JHP, 2016 U.S. Dist. LEXIS 67092 (N.D. Okla. May 17, 2016).

II. Discussion

"On appeal from a grant of a motion to suppress, we review a district court's findings of fact for clear error and its legal conclusions de novo." United States v. Marasco , 487 F.3d 543, 547 (8th Cir. 2007). We will affirm the district court's decision "unless it is not supported by substantial evidence on the record; it reflects an erroneous view of the applicable law; or upon review of the entire record, the appellate court is left with the definite and firm conviction that a mistake has been made." United States v. Layne , 973 F.2d 1417, 1420 (8th Cir. 1992). This appeal challenges the lower court's legal conclusions, so our review is de novo.

A. The Fourth Amendment

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

U.S. Const. amend. IV. "[W]hat [a citizen] seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected." Katz v. United States , 389 U.S. 347, 351, 88 S.Ct. 507, 19 L.Ed.2d 576 (1967). "The fact that the electronic device employed to achieve [the search] did not happen to penetrate the [defendant's physical space] can have no constitutional significance." See id. at 353, 88 S.Ct. 507.

We first address whether a warrant was required for the use of a NIT. At least one district court in this circuit has determined that a warrant would likely be unnecessary for an NIT that exclusively searched for IP addresses, relying on a line of cases allowing third-party subpoenas of the same. See Jean , 207 F.Supp.3d at 933 ("IP addresses are unlikely to be entitled to the same Fourth Amendment protections as are the substantive contents of users' computers."). A defendant's publicly available information may not be entitled to Fourth Amendment protection. See Katz , 389 U.S. at 351, 88 S.Ct. 507 ("What a person knowingly exposes to the public, even in his own home or office, is not a subject of Fourth Amendment protection."). But, "[t]he government is not permitted to conduct a warrantless search of a place in which a defendant has a reasonable expectation of privacy simply because it intends to seize property for which the defendant does not have a reasonable expectation of privacy." Workman , 205 F.Supp.3d at 1265.

This case differs from cases in which an IP address is voluntarily provided to third parties. See United States v. Christie , 624 F.3d 558, 573 (3d Cir. 2010) ("Federal courts have uniformly held that ‘subscriber information provided to an internet provider is not protected by the Fourth Amendment's privacy expectation’ because it is voluntarily conveyed to third parties." (quoting United States v. Perrine , 518 F.3d 1196, 1204 (10th Cir. 2008) )). In this case, the FBI sent computer code to the defendants' respective computers that searched those computers for specific information and sent that information back to law enforcement. Even if a defendant has no reasonable expectation of privacy in his IP address, he has a reasonable expectation of privacy in the contents of his personal computer. See United States v. Turner , 839 F.3d 429, 434 (5th Cir. 2016) (saying "a privacy interest exists in the electronic contents of computers and cell phones"). Moreover, the NIT retrieved content from the defendants' computers beyond their IP addresses. We conclude the execution of the NIT in this case required a warrant. "Our answer to the question of what police must do before searching a [computerized device] ... is accordingly simple—get a warrant." Riley v. California , –––U.S. ––––, 134 S.Ct. 2473, 2495, 189...