United States v. Tagg

• Decision Date: 27 March 2018
• Docket Number: No. 17-1777,17-1777
• Citation: 886 F.3d 579
• Parties: UNITED STATES of America, Plaintiff–Appellant, v. Derek Michael TAGG, Defendant–Appellee.
• Court: U.S. Court of Appeals — Sixth Circuit

886 F.3d 579

UNITED STATES of America, Plaintiff–Appellant,

v.Derek Michael TAGG, Defendant–Appellee.

No. 17-1777

United States Court of Appeals, Sixth Circuit.

Argued: March 7, 2018

Decided and Filed: March 27, 2018

Rehearing En Banc Denied May 4, 2018

ARGUED: Mark J. Chasteen, UNITED STATES ATTORNEY'S OFFICE, Detroit, Michigan, for Appellant. Benton C. Martin, FEDERAL DEFENDER OFFICE, Detroit, Michigan, for Appellee. ON BRIEF: Mark J. Chasteen, UNITED STATES ATTORNEY'S OFFICE, Detroit, Michigan, for Appellant. Benton C. Martin, FEDERAL DEFENDER OFFICE, Detroit, Michigan, for Appellee.

Before: COOK, McKEAGUE, and STRANCH, Circuit Judges.

McKEAGUE, J., delivered the opinion of the court in which COOK and STRANCH, JJ., joined. STRANCH, J. (pg. 591), delivered a separate concurring opinion.

In September 2015, police executed a warrant at Derek Tagg's residence, searching for child pornography. They found plenty of it—over 20,000 files, all stored on Tagg's computer. The search warrant was based primarily on digital evidence from an FBI operation showing that Tagg had spent over five hours browsing a website ("Playpen") that obviously contained child pornography. The district court found that the police lacked probable cause to search Tagg's house because the search warrant did not state that Tagg actually viewed any illegal images while on the site. Further, the court held that no reasonable officer would have relied on the warrant, and therefore suppressed all the evidence seized from Tagg's home. Because the warrant was supported by probable cause, we REVERSE the order granting the motion to suppress and REMAND the case for proceedings not inconsistent with this opinion.

I

This case arises out of federal and state investigations into child exploitation on the "dark web." The "dark web" is a sophisticated, anonymous internet network used both by criminals and by other individuals who, for whatever reason, do not want to be identified.

A

Until it was shut down by the FBI, Playpen operated a secret website on the "dark web." Although we think of websites as "out there" in the ether, the physical location of an ordinary website is on a computer programmed to permit access by anyone connected to the internet. Typical internet users access websites by searching for subjects through search engines (e.g., Google) in widely available web browsers (e.g., Mozilla Firefox), just like the ordinary shopper can walk into a store and look for signs indicating the location of the goods they desire. Clandestine websites like Playpen, however, sometimes require a "mask" before you can enter the computer(s) housing them. In this case, that "mask" is a web browser called "Tor," which hides your online "face" from other people on the internet.

Your online "face" is known as an "IP address," a unique number assigned to every computer connected to the internet. To hide your identity, Tor effectively masks your IP address so that the people operating the website's physical computers cannot trace your IP address back to your personal identity or your residence. Because this makes it difficult for anonymous websites to track customer preferences or allow users to interact with one another, websites like Playpen require you to create an identifying "pseudonym" when you enter the website. Thus, Playpen knows what each user likes and what it has looked at, but it cannot discern who the user is outside the confines of the website.

Further, Tor can also hide a website from all search engines entirely. In other words, a website operating on the Tor network can require you to know the exact combination of letters and numbers comprising the website's URL¹ before permitting you to see its content. And unlike intuitive URLs like cnn.com or nytimes.com , the URL of a secret Tor website like Playpen is randomized—for example, upf45jv3bziuctml.onion . Absent some statistically impossible stroke of luck, a site like Playpen is "an island that cannot be found, except by those who already know where it is." To access such a website, a newcomer must generally befriend someone who knows the URL, usually the website owner or another frequent user.

But just like in real life, nothing on the internet can be kept totally secret. Police or malicious website owners have discovered ways to work around Tor's "mask" and identify the people who visit a website. This is done by embedding software in the fabric of the website, which creates a digital "fingerprint"² identifying each user's IP address. Police can then link the "fingerprint" to the user's "pseudonym," and track what the person has viewed on the website. Police can also use a computer's IP address to discern its physical location through publicly available databases and routine subpoenas to companies like AT&T and Comcast. Thus, armed with the user's digital fingerprint, police can show a judge (a) what a user has viewed, and (b) where the user's computer is located in the real world.

B

This case began when the FBI obtained access to the physical computer running Playpen's website. The warrant permitting the FBI to use a bug is the "NIT warrant" in the record here.³ Tagg does not really dispute that Playpen contained a significant amount of child pornography; neither does the government deny that Playpen also contained legal child erotica. After seizing Playpen's computers, the FBI kept the website running to try and catch some of its patrons. However, to identify Playpen's users, the FBI had to place a digital bug in the fabric of the website. Because this act counts as a Fourth Amendment "search" of the user's home computer—the bug creates a digital fingerprint that can identify the user—the FBI needed to obtain a warrant before embedding it. United States v. Horton , 863 F.3d 1041, 1046–47 (8th Cir. 2017), cert. pet. filed in No. 17-6910 (Nov. 21, 2017).

After collecting identifying data on the individual users of the website, the FBI and its local task-force affiliates sought separate, individual warrants for the homes of the identified users ("Residential Warrants"). To support these warrants, officers explained to federal magistrate judges how they cross-referenced the user's digital fingerprint with their pseudonym and IP address to connect three data points: (a) the user's identity, (b) the items the user had viewed on the website, and (c) the physical location and address of the user's computer.

The affidavit supporting the Residential Warrant outlined Tagg's browsing history, which neither party disputes. The Residential Warrant therefore contained the following pieces of data. (1). Tagg spent around five hours logged into Playpen's website under the pseudonym "derpderk." (2). Tagg opened the website's "index" and browsed them for topics of interest to him. (3). He clicked on the "Pre-Teen Videos" entry in the index. That link took him to a separate part of the index where he could browse "Pre-teen Videos" in more detail. (4). After browsing that topic, Tagg viewed a collection of pages under the heading "Girls HC"—which, in the pornography world, means explicit, penetrative sexual acts. (5). Tagg then accessed the message board "video collection clow85."⁴ (6). On other occasions, Tagg accessed pages titled, "Drug(g)ed sleeping girl 10yo fuck—", "girl Toy3-8y&man", and "PTHC^{[5 ]} Anal dildo." The affidavit did not, however, state whether Tagg actually viewed or downloaded any illegal files.

The magistrate judge approved the Residential Warrant. The warrant indicated that officers had established probable cause that Tagg violated 18 U.S.C. § 2252A(a)(5) (access of a website with intent to view child pornography) and that evidence of the crime would be found at Tagg's residence. After searching Tagg's home, police found over 20,000 files of child pornography on his personal computers.

C

Tagg was charged with one count of receiving child pornography and one count of possessing the same. 18 U.S.C. § 2252A(a)(2), (a)(5)(B). Tagg moved to suppress all the evidence seized by the government, claiming that both the NIT Warrant and his individual Residential Warrant violated the Fourth Amendment. As noted above, the district court only addressed the Residential Warrant.

After a hearing, the district court held that the Residential Warrant was invalid. Specifically, the court held that police could not establish probable cause to search Tagg's home for child pornography unless the supporting materials established that he actually clicked on or viewed an online file containing child pornography. Moreover, the court suppressed the evidence, reasoning that the good-faith exception did not apply because police acted recklessly and because no reasonable officer could have relied on the warrant. After its motion for reconsideration was denied, the government timely appealed. We have jurisdiction under 18 U.S.C. § 3731.

II

The district judge found that the Residential Warrant lacked probable cause. This was incorrect, particularly considering the Supreme Court's recent instructions in District of Columbia v. Wesby , 583 U.S. ––––, 138 S.Ct. 577, 584–89, 199 L.Ed.2d 453 (2018) (examining probable cause "to arrest ... partygoers for unlawful entry" in a civil action under 42 U.S.C. § 1983 ).

A

The Fourth Amendment prohibits judges from issuing search warrants unless the requesting officer demonstrates probable cause. U.S. Const. amend. IV. "A police officer has probable cause to conduct a search when the facts available to [the officer] would warrant a person of reasonable caution in the belief that contraband or evidence of a crime is present." Florida v. Harris , 568 U.S. 237, 243, 133 S.Ct. 1050, 185 L.Ed.2d 61 (2013) (alterations and internal quotation marks omitted). A Supreme Court opinion, fresh off the press, has reminded the courts that "probable cause deals with probabilities and depends on the totality of the circumstances." Wesby , 138 S.Ct. at 586 (internal quotation marks omitted). Therefore, "[p]robable cause is not a...