United States v. Moorehead

• Decision Date: 09 January 2019
• Docket Number: No. 18-5216,18-5216
• Citation: 912 F.3d 963
• Parties: UNITED STATES of America, Plaintiff-Appellee, v. Andrew Blake MOOREHEAD, Defendant-Appellant.
• Court: U.S. Court of Appeals — Sixth Circuit

912 F.3d 963

UNITED STATES of America, Plaintiff-Appellee,

v.Andrew Blake MOOREHEAD, Defendant-Appellant.

No. 18-5216

United States Court of Appeals, Sixth Circuit.

Argued: December 6, 2018

Decided and Filed: January 9, 2019

ARGUED: M. Dianne Smothers, FEDERAL PUBLIC DEFENDER, Memphis, Tennessee, for Appellant. Debra L. Ireland, UNITED STATES ATTORNEY'S OFFICE, Memphis, Tennessee, for Appellee. ON BRIEF: M. Dianne Smothers, FEDERAL PUBLIC DEFENDER, Memphis, Tennessee, for Appellant. Debra L. Ireland, UNITED STATES ATTORNEY'S OFFICE, Memphis, Tennessee, for Appellee.

Before: COLE, Chief Judge; GRIFFIN and KETHLEDGE, Circuit Judges.

COLE, Chief Judge.

This case is one of many that have arisen from the government's investigation into a child pornography website known as "Playpen." Andrew Moorehead was indicted for possession and receipt of child pornography based on his activity on the website. He moved to suppress the evidence against him, arguing that it was obtained as a result of an invalid warrant. The district court denied his motion, and Moorehead now appeals. Because the good-faith exception to the exclusionary rule applies, we affirm.

I.

In December 2014, a foreign law enforcement agency informed the FBI of its suspicion that an IP address in the United States was associated with Playpen. After accessing Playpen and verifying the nature of its contents, the FBI obtained and executed a search warrant at Centrilogic, a server hosting company in North Carolina that owned the IP address. The FBI seized the server that was assigned the relevant IP address and confirmed that it contained a copy of Playpen. The agents relocated a copy of the server to a government facility in Newington, Virginia. Because of a server misconfiguration, the government was able to identify the administrator of Playpen and gain administrative control of the website. For approximately two weeks, the FBI continued to operate Playpen from a government-controlled computer server at its facility in Newington.

Even with administrative control, however, the government was unable to identify the individuals who logged into Playpen because the website operates on the Onion Router ("Tor")—an anonymity network that masks computer users' IP addresses. Ordinarily, when the government seizes control of an illicit website, law enforcement officers can access the website's IP log—which records the IP addresses that have accessed the website—and use the log to locate and apprehend the website's users. But because Playpen was operating on Tor, the IP addresses of the users were hidden, and traditional investigative techniques were unavailable.

To combat the problem of user anonymity, the FBI turned to counter-technology called the Network Investigative Technique ("NIT"). The NIT works as follows:

• When a user logs into Playpen by entering a username and password, the NIT is downloaded on the user's computer.

• Once downloaded, the NIT obtains the following information from the user's computer: (1) the IP address; (2) a unique identifier that distinguishes the data from that of other computers; (3) the type of operating system; (4) information regarding whether the NIT has already been delivered to that computer; (5) the Host Name; (6) an active operating system username; and (7) a Media Access Control address.

• That information is then sent to a computer controlled by the government in Newington.

The government sought a warrant in the Eastern District of Virginia authorizing use of the NIT. Specifically, the warrant sought to "cause an activating computer—wherever located —to send [identifying information] to a computer controlled by or known to the government." (Mot. Suppress, Ex. 3, R. 45-3, PageID 452) (emphasis added.) The affidavit in support of the warrant described the large number of Playpen users: "[O]ver 1,500 unique users visit[ ] the website daily and over 11,000 unique users visit[ ] the website over the course of a week." (Id. at PageID 441.) On February 20, 2015, a magistrate judge in the Eastern District of Virginia signed a warrant authorizing the government to deploy the NIT on "any user or administrator who logs into [Playpen] by entering a username and password" (the "NIT Warrant"). (Id. at PageID 421–422.)

Between March 1, 2015 and March 5, 2015, a user named "logidragon321" logged into Playpen for a little over three and a half hours. On March 2, 2015, while "logidragon321" was logged into Playpen, law enforcement personnel deployed the NIT and identified the IP address associated with the username. An administrative subpoena was sent to Jackson Energy Authority, the Internet Service Provider that operated the IP address. The subpoena response indicated that Rebecca Moorehead was paying for the Internet service at a residence in Tennessee, and an open source database revealed that she and Andrew Moorehead were the occupants of the residence.

On September 22, 2015, the government obtained a residential warrant for the Moorehead property, and officers executed the warrant on September 24, 2015, seizing Andrew Moorehead's computer equipment. During the execution of the search warrant, Moorehead admitted that he used the Internet to view child pornography and that "logidragon321" was his user name.

Moorehead was indicted by a federal grand jury for one count of possession of child pornography in violation of 18 U.S.C. § 2252(a)(4)(B) and one count of receipt of child pornography in violation of 18 U.S.C. § 2252(a)(2). He filed a motion to suppress the evidence obtained from the government's use of the NIT, arguing that the NIT Warrant violated Federal Rule of Criminal Procedure 41 and 28 U.S.C. § 636(a) because it was executed outside of the magistrate judge's territorial jurisdiction. On June 6, 2017, the district court denied Moorehead's motion to suppress.

Subsequently, Moorehead pleaded guilty to receipt of child pornography and the government agreed to dismiss the possession charge. The plea agreement reserved Moorehead's right to appeal the denial of his motion to suppress.

On February 27, 2018, Moorehead was sentenced to 97 months' imprisonment. Moorehead filed a timely notice of appeal the following day.

II.

On appeal from the denial of a motion to suppress, "we review the district court's findings of fact for clear error and its conclusions of law de novo." United States v. Buford , 632 F.3d 264, 268 (6th Cir. 2011) (citation omitted). The evidence is reviewed "in the light most likely to support the district court's decision." United States v. Powell , 847 F.3d 760, 767 (6th Cir. 2017), cert. denied , ––– U.S. ––––, 138 S.Ct. 143, 199 L.Ed.2d 36 (2017) (citations omitted). "[A] denial of a motion to suppress will be affirmed on appeal if the district court's conclusion can be justified for any reason." United States v. Pasquarille , 20 F.3d 682, 685 (6th Cir. 1994).

Moorehead first argues that the magistrate judge violated Federal Rule of Criminal Procedure 41(b) by signing the NIT Warrant. That rule gives a magistrate judge authority to issue warrants for people or property located within her district. In 2015, when the magistrate judge issued the NIT Warrant, Rule 41(b) provided four exceptions to the requirement that a search warrant be issued within a magistrate judge's district. Relevant here is the exception for "tracking devices": the government contends the NIT is analogous to a tracking device and thus argues that the warrant was authorized at the time it was issued. See Fed. R. Crim. P. 41(b)(4). After the warrant was issued, Rule 41(b) was amended to add an additional exception to a magistrate judge's territorial limitations, one that indisputably authorizes warrants like the NIT Warrant. But Moorehead contends that no exceptions authorized the NIT Warrant in 2015, arguing (persuasively) that the NIT is not a tracking device. He thus contends that the magistrate judge violated Rule 41, rending the warrant invalid. He further contends that such violation is of constitutional magnitude and that the NIT Warrant is void ab initio. But we need not decide these issues. We conclude that even if the NIT Warrant runs afoul of the Fourth Amendment, the good-faith exception to the exclusionary rule applies to preclude suppression.

Suppression is not an automatic consequence of a Fourth Amendment violation. Indeed, the Fourth Amendment "says nothing about suppressing evidence obtained in violation of [its] command." Davis v. United States , 564 U.S. 229, 236, 131 S.Ct. 2419, 180 L.Ed.2d 285 (2011). Nonetheless, the Supreme Court created the exclusionary rule—a prudential doctrine which prohibits "evidence obtained in violation of the Fourth Amendment [from] be[ing] used in a criminal proceeding against the victim of the illegal search and seizure." United States v. Calandra , 414 U.S. 338, 347, 94 S.Ct. 613, 38 L.Ed.2d 561 (1974). Exclusion of evidence under the rule "is not a personal constitutional right" nor is it "calculated to redress the injury to the privacy of the victim of the search." Stone v. Powell , 428 U.S. 465, 486, 96 S.Ct. 3037, 49 L.Ed.2d 1067 (1976). Rather, the rule is "designed to safeguard Fourth Amendment rights generally through its deterrent effect." Calandra , 414 U.S. at 348, 94 S.Ct. 613. As the Supreme Court has "repeatedly held," the rule's "sole purpose ... is to deter future Fourth Amendment violations." Davis , 564 U.S. at 236–37, 131 S.Ct. 2419 (citing Herring v. United States , 555 U.S. 135, 141, and n.2, 129 S.Ct. 695, 172 L.Ed.2d 496 (2009) ; United States v. Leon , 468 U.S. 897, 909, 921 n.22, 104 S.Ct. 3405, 82 L.Ed.2d 677 (1984) ; Elkins v. United States , 364 U.S. 206, 217, 80 S.Ct. 1437, 4 L.Ed.2d 1669 (1960) ). Thus, "[t]he fact that a Fourth Amendment violation occurred ... does not necessarily mean that the exclusionary rule applies." Herring , 555 U.S. at 140, 129 S.Ct. 695.

Instead, courts must ask whether "the deterrence benefits of suppression ... outweigh its heavy costs." Davis , 564 U.S....