United States v. Michaud, CASE NO. 3:15-cr-05351-RJB

• Decision Date: 28 January 2016
• Docket Number: CASE NO. 3:15-cr-05351-RJB
• Court: U.S. District Court — Western District of Washington
• Parties: UNITED STATES OF AMERICA, Plaintiff, v. JAY MICHAUD, Defendant.

UNITED STATES OF AMERICA, Plaintiff, v. JAY MICHAUD, Defendant.

CASE NO. 3:15-cr-05351-RJB

UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON AT TACOMA

January 28, 2016

ORDER DENYING DEFENDANT'S MOTIONS TO SUPPRESS EVIDENCE

These matters come before the Court on Defendant's Motion to Suppress Evidence (Dkt. 26) and Defendant's Second Motion to Suppress Evidence and Motion for Franks Hearing (Dkt. 65). The Court has considered the parties' responsive briefing and the remainder of the file herein, as well as the testimony of FBI Special Agent Daniel Alfin and Christopher Soghoian, Principal Technologist for the Speech and Technology Project at the American Civil Liberties Union, elicited at an evidentiary hearing held on January 22, 2016. Dkt. 47, 69, 90, 94, 111. Having orally denied Mr. Michaud's motion for a Franks hearing (Dkt. 135), the sole issue before the Court, raised by both of Mr. Michaud's motions, is whether to suppress evidence of what Mr. Michaud argues is fruit of an unreasonable search. At oral argument, the parties agreed that the Court should decide the issue based on the submitted record, as supplemented by the testimony adduced at the hearing. See Dkt. 135.

I. FACTUAL BACKGROUND

a. Website A

Mr. Jay Michaud, a resident of Vancouver, Washington, is charged with receipt and possession of child pornography in violation of 18 U.S.C. §§ 2252(a)(2), (a)(4), (b)(1), and (b)(2). Dkt. 117. The charges against Mr. Michaud stem from Mr. Michaud's alleged activity on "Website A," a website that, according to the FBI, was dedicated to the advertisement and distribution of child pornography. Dkt. 47-5, at ¶¶14-16. Website A was created in August of 2014, and by the time that the FBI shut the site down, on March 4, 2015, Website A had over 200,000 registered member accounts and 1,500 daily visitors, making it "the largest remaining known child pornography hidden service in the world." Dkt. 47-1, at ¶19; Dkt. 50-1, at ¶3.

According to the three warrant applications submitted in this case, the main page of the site featured a title with the words, "Play Pen." Dkt. 47-1, at ¶¶12. See also Dkt. 47-5, at ¶¶18-37; Dkt 47-2, at ¶¶11-21. See also Dkt. 90-1, at 2. The main page, which required users to login to proceed, also featured "two images depicting partially clothed prepubescent females with their legs apart." Id. Text on the same page read, "No cross-board reposts, .7z preferred, encrypt filenames, include preview, Peace out." Id. "No cross-board reposts," appeared to prohibit the reposting of material from other websites, while ".7z preferred," referred to a preferred method of compressing large files. Id. After logging in, registered users would next view a page with hyperlinks to forum topics, the clear majority of which advertise child pornography. Id., at ¶¶14-18. See also Dkt. 65-2, at 1-4.

b. The Title III Warrant

On February 20, 2015, agents from the Federal Bureau of Investigation executed a Title III warrant to intercept the communications of Website A. Dkt. 47-5, at ¶4 and pp. 57-62. Website A operated on the Tor network, a publicly available alternative internet service that allows users to mask identifying information, such as Internet Protocol ("IP") addresses. Id., at ¶¶18-36. For approximately 14 days, from February 20, 2015 through March 4, 2015, the FBI administered Website A from a government-controlled computer server located in Newington, Virginia, which forwarded a copy of all website communications, through the server, to FBI personnel in Linthicum, Maryland. Dkt. 47-1, at ¶30; Dkt. 47-5, ¶¶38, 52 and p. 60. Based on the authority of the Title III warrant, the FBI captured communications of users accessing Website A, including user "Pewter." The FBI apparently did not post any new content but allowed registered users to access the site and to continue to post content. See id.

c. The NIT Warrant

While controlling Website A, the FBI sought to identify the specific computers, and ultimately the individuals, accessing the site, by deploying a network investigating technology ("NIT") that "cause(d) an activating computer—wherever located—to send to a computer controlled by or known to the government, network level messages containing information that may assist in identifying the computer, its location, [and] other information[.]" Dkt. 47-1, at 34. Prior to deploying the NIT, on February 20, 2015 the FBI sought and obtained a warrant ("the NIT Warrant"), which was issued by a magistrate judge in the Eastern District of Virginia. Id. The NIT Warrant cover sheet reads as follows:

"An application by a federal law enforcement officer . . . requests the search of the following person of property located in the Eastern District of Virginia (identify the person or describe the property to be searched and give its location):

See Attachment AThe person or property to be searched, described above, is believed to conceal (identify the person or describe the property to be seized):

See Attachment B[.]" Dkt. 47-1, at 39.

Attachment A reads as follows:

Attachment A

Place to be Searched

This warrant authorizes the use of a network investigative technique ("NIT") to be deployed on the computer server described below, obtaining information described in Attachment B from the activating computers below.

The computer server is the server operating the Tor network child pornography website referred to herein as the TARGET WEBSITE, as identified by its URL - [omitted]— which will be located at a government facility in the Eastern District of Virginia.

The activating computers are those of any user or administrator who logs into the TARGET WEBSITE by entering a username and password. The government will not employ this network investigative technique after 30 days after this warrant is authorized, without further authorization. Id., at 37.

Attachment B reads as follows:

Attachment B

Information to be Seized

From any "activating" computer described in Attachment A:

1. the "activating" computer's actual IP address, and the date and time that the NIT determines what that IP address is;2. a unique identifier generated by the NIT (e.g., a series of numbers, letters, and/or special characters) to distinguish data from that other "activating" computers, that will be sent with and collected by the NIT;

3. the type of operating system running on the computer, including type (e.g., Windows), version (e.g., Windows 7), and architecture (e.g., x 86);

4. information about whether the NIT has already been delivered to the "activating" computer;

5. the "activating" computer's Host Name;

6. the "activating" computer's active operating system username; and

7. the "activating" computer's media access control ("MAC") address; that is evidence of violations of . . . [child pornography-related crimes]. Id., at 38.

Both Attachment A and Attachment B, which the NIT Warrant incorporated, are identical in content to the attachments submitted in the warrant application. Id., at 4, 5, 37, 38.

d. Warrant issued in the Western District of Washington ("the Washington Warrant")

After obtaining the NIT warrant, the FBI deployed the NIT, obtaining the IP address and other computer-related information connected to a registered user, "Pewter," who allegedly accessed Website A for 99 hours between October 31, 2014 and March 2, 2015. Dkt. 47-2, at ¶26. "Pewter" had apparently accessed 187 threads on Website A, most related to child pornography. Id., at ¶27. With the IP address in hand, the FBI ultimately ascertained the residential address associated with "Pewter," an address at which Mr. Michaud resided, in Vancouver, Washington. Id., at ¶¶35, 36. A magistrate judge in the Western District of Washington issued a warrant to search that address, and the FBI subsequently seized computers and storage media allegedly containing contraband. See generally, id.

e. Evidentiary testimony of SA Alfin and Dr. Christopher Soghoian

SA Alfin's testimony explained how the NIT was deployed against Mr. Michaud. While the FBI administered Website A from a government-controlled computer, between February 20, 2015 and March 4, 2015, a registered user, "Pewter," logged into Website A and accessed a forum entitled, "Preteen videos—girls HC." (HC stands for "hardcore.") The FBI setup the NIT so that accessing the forum hyperlink, not Website A's main page, triggered the automatic deployment of the NIT from the government-controlled computer in the Eastern District of Virginia, to Pewter's computer in Vancouver, Washington, where the NIT collected the IP address, MAC address, and other computer-identifying information, and relayed that information back to the government-controlled server in the Eastern District of Virginia, after which the information was forwarded to FBI personnel for data analysis.

SA Alfin also explained a discrepancy in the content of Website A's main page. While the warrant application for the NIT describes a main page featuring two prepubescent females with legs spread apart, Dkt. 47-1, at ¶12, by the time that the FBI submitted the warrant application, on February 20, 2015, the main page had been changed to display only one young female with legs together. Compare Dkt. 90-1, at 2 and Dkt. 90-1, at 4. According to SA Alfin, the main page changed several hours prior to the arrest of a Website A administrator, in the early evening hours of February 19, 2015. After the arrest, SA Alfin viewed Website A and other material on the administrator's computer, at which point SA Alfin saw the newer version of Website A's main page but did not notice the picture changes. The balance of Website A's focus on child pornography apparently remained unchanged, in SA Alfin's opinion. The new picture also appears suggestive of child pornography, especially when considering its placement next to the site's suggestive name, Play Pen.

Dr. Christopher Soghoian, testifying on behalf of Mr. Michaud, explained how the Tor network functions and theorized about how the NIT may have...