United States v. Levin

• Decision Date: 27 October 2017
• Docket Number: No. 16-1567.,16-1567.
• Citation: 874 F.3d 316
• Parties: UNITED STATES of America, Appellant, v. Alex LEVIN, Defendant, Appellee.
• Court: U.S. Court of Appeals — First Circuit

874 F.3d 316

UNITED STATES of America, Appellant,

v.Alex LEVIN, Defendant, Appellee.

No. 16-1567.

United States Court of Appeals, First Circuit.

October 27, 2017

Kelly Begg Lawrence, Assistant United States Attorney, with whom Carmen M. Ortiz, United States Attorney, was on brief, for appellant.

J.W. Carney, Jr., with whom Nathaniel Dolcort-Silver and J. W. Carney, Jr. & Associates were on brief, for appellee.

Mark Rumold, with whom Andrew Crocker, Electronic Frontier Foundation, Jessie J. Rossman and American Civil Liberties Union of Massachusetts, were on brief, as amici curiae.

Caroline Wilson Palow, Scarlet Kim and Privacy International on brief, as amici curiae.

Before Torruella, Selya, and Lynch, Circuit Judges.

TORRUELLA, Circuit Judge.

Central to this case is the Federal Bureau of Investigation's ("FBI" or "government") use of software that it terms a Network Investigative Technique ("NIT"). The FBI used the NIT pursuant to a warrant it obtained from a magistrate judge in the Eastern District of Virginia (the "NIT warrant"). The FBI installed the NIT on Playpen, a child pornography website it had taken over and was operating out of Virginia. The NIT attached itself to anything that was downloaded from Playpen, and thus effectively travelled to the computers that were downloading from the website, regardless of where those computers were located. The NIT then caused those computers to transmit several specific items of information—which would allow the FBI to locate the computers—back to the FBI.

One computer the FBI located in this manner belonged to Alex Levin of Norwood, Massachusetts. After a search of his computer pursuant to a subsequent search warrant issued in Massachusetts, the FBI found various media files allegedly containing child pornography. Levin was indicted and charged with one count of possession of child pornography, in violation of 18 U.S.C. § 2252A(a)(5)(B). Levin moved to suppress the evidence seized pursuant to the NIT warrant and the warrant issued in Massachusetts. The district court granted suppression, United States v. Levin, 186 F.Supp.3d 26, 44 (D. Mass. 2016), and the government appealed. We disagree with the district court that suppression is warranted, because the FBI acted in good faith reliance on the NIT warrant. Accordingly, we vacate the district court's suppression order and remand for further proceedings.¹

I. Background

A. Playpen and the Dark Web

Child-pornography websites are a source of significant social harm. "[T]he exploitive use of children in the production of pornography" was already "a serious national problem" decades ago. New York v. Ferber, 458 U.S. 747, 749, 102 S.Ct. 3348, 73 L.Ed.2d 1113 (1982). Modern technology, which allows images and videos to be "traded with ease on the [i]nternet," has only amplified the problem. Paroline v. United States, ––– U.S. ––––, 134 S.Ct. 1710, 1717, 188 L.Ed.2d 714 (2014). The child-pornography website at the center of this case—and several dozen other cases throughout the nation² —bore the name "Playpen."

Playpen attracted web traffic on a massive scale. Just between August 2014 and February 2015, more than 150,000 users accessed the site. Visitors to Playpen made over 95,000 posts on over 9,000 topics, all pertaining to child pornography. Playpen also featured discussion forums where its users discussed issues such as how to groom child victims and how to evade law enforcement.

Playpen operated on the internet network known as Tor (short for "The Onion Router"). This network, together with similar networks, is known as the Dark Web. The United States Naval Research Laboratory originally created Tor as a means of protecting government communications. Today, however, the Tor network is publicly accessible. One gains access to the Tor network by downloading the Tor software. By masking its users' actual IP addresses—which could otherwise be used to identify users—that software offers its users much greater anonymity than do conventional web browsers. Tor achieves this masking by bouncing users' communications around a distributed network of relay computers run by volunteers all around the world. The Tor software can be used to access the conventional internet as well as the Dark Web.

Websites on the Dark Web, known as hidden services, can be reached only by using Tor software, or a similar software. Playpen was one such hidden service. Unlike websites on the conventional internet, hidden services cannot be accessed through public search engines such as Google. Hidden services can be accessed by using their addresses, if known to the person seeking to access the hidden service, or by being redirected to them. The latter can occur when, for instance, a link to a hidden service is posted on another hidden service and a user clicks that link.

Because Playpen was a hidden service, a Playpen user had to take several affirmative steps to access the site. First, he or she needed to download and install the Tor software. Second, the user would need to acquire the unique web address for Playpen. Third, the user would use this address to find Playpen in the Tor Network. And finally, he or she needed to enter a username and password on Playpen's main page to access the site's content. The main page displayed "two images depicting partially clothed prepubescent females with their legs spread apart." Thus, Playpen's subject matter was obvious even before the user logged in and accessed the child-pornography content.

B. The Warrants and the NIT

In February 2015, FBI agents seized control of Playpen pursuant to a warrant (which is not at issue in the present case). After seizing control, the FBI continued to run Playpen out of a government facility in the Eastern District of Virginia for two weeks, with the purpose of identifying and apprehending Playpen users.

On February 20, 2015, the government obtained the NIT warrant from a magistrate judge in the Eastern District of Virginia. This warrant permitted the FBI to install the NIT on its server that hosted Playpen, and thereby to obtain information from "[t]he activating computers [which] are those of any user or administrator who logs into [Playpen] by entering a username and password." The warrant authorized the FBI to obtain seven items of information: (1) the activating computer's actual IP address, and the date and time that the NIT determines what the IP address is; (2) a unique identifier generated by the NIT (e.g., a series of numbers, letters, and/or special characters) to distinguish data from that of other activating computers, that will be sent with and collected by the NIT; (3) the type of operating system running on the computer, including type (e.g., Windows), version (e.g., Windows 7), and architecture (e.g., x 86); (4) information about whether the NIT has already been delivered to the activating computer; (5) the activating computer's Host Name; (6) the activating computer's active operating system username; and (7) the activating computer's media access control ("MAC") address.

After the NIT was installed on the government's server, it worked in two steps. First, it augmented the content of the website with additional computer instructions. Once a user or administrator who had logged into Playpen downloaded such content, he or she would also download those additional computer instructions, which comprise the NIT. Then, the NIT would cause the activating computer to transmit the seven pieces of information, described above and authorized to be obtained by the warrant, back to a computer controlled by the FBI. The NIT did not deny the user of the activating computer access to any data or functionality of its computer. The NIT allowed the FBI to identify the IP addresses of hundreds of Playpen users around the country, including in the Eastern District of Virginia.

Using the NIT, the government determined that a Playpen user named "Manakaralupa" had accessed several images of child pornography in early March 2015. The NIT caused Manakaralupa's activating computer to transmit the aforementioned information to the government. Using the seized information, the government traced the IP address of that user to Levin's home address in Norwood, Massachusetts.

On August 11, 2015, the government obtained a warrant from a magistrate judge in the District of Massachusetts to search Levin's home. The government executed the warrant the next day, searched Levin's computer, and identified eight media files allegedly containing child pornography.

On September 17, 2015, Levin was indicted and charged with one count of possession of child pornography, in violation of 18 U.S.C. § 2252A(a)(5)(B). After Levin moved to suppress all evidence seized pursuant to the NIT warrant and the warrant authorizing the search of his home, the district court granted Levin's motion on May 5, 2016. First, the district court found that, since the warrant purported to authorize a search of property located outside the federal judicial district where the issuing judge sat, the NIT warrant was issued without jurisdiction and thus was void ab initio. The court reasoned that the magistrate judge was not authorized to issue it either under Rule 41 of the Federal Rules of Criminal Procedure³ or under the Federal Magistrates Act, 28 U.S.C. § 636(a).⁴

Second, the district court determined that suppression was an appropriate remedy because the violation of Rule 41 was substantive, rather than technical. The court reasoned that, since the magistrate judge did not have jurisdiction to issue the warrant, there was no judicial approval. According to the district court, the resulting search was thus conducted as if not pursuant to any warrant authorization, and was therefore presumptively unreasonable.

The district court further concluded that, even if that error were technical, suppression would still be appropriate, as Levin demonstrated that he suffered prejudice. The court reasoned that, had Rule 41(b) been followed, the magistrate...