United States v. Taylor

• Decision Date: 24 April 2017
• Docket Number: 2:16-cr-00203-KOB-JEO-1.
• Citation: 250 F.Supp.3d 1215
• Parties: UNITED STATES of America v. James Ryan TAYLOR, Defendant.
• Court: U.S. District Court — Northern District of Alabama

250 F.Supp.3d 1215

UNITED STATES of America

v.James Ryan TAYLOR, Defendant.

2:16-cr-00203-KOB-JEO-1.

United States District Court, N.D. Alabama, Southern Division.

Signed April 24, 2017

United States Marshal, US Attorney Joyce White Vance, Jacquelyn Mather Hutzell, United States Attorney's Office, US Probation, United States Probation Office, Birmingham, AL, for United States of America.

Kevin L. Butler, Federal Public Defender, Birmingham, AL, for Defendant.

MEMORANDUM OPINION

KARON OWEN BOWDRE, CHIEF UNITED STATES DISTRICT JUDGE

The United States filed this and many other child pornography criminal cases following an extensive FBI sting operation that resulted in the seizure of a website, "Playpen," dedicated to the advertisement and distribution of child pornography. After taking over Playpen, the FBI first obtained a warrant in the Eastern District of Virginia that enabled it to seize Defendant's Internet Protocol (IP) address and other identifying information. With that information, the FBI obtained and executed a second warrant in the Northern District of Alabama to search Defendant's home and seize certain property, including a solid state drive that contained child pornography. The Government charged Defendant James Ryan Taylor with receipt of child pornography under 18 U.S.C. § 2252A(a)(2) and with possession and accessing child pornography with intent to view under 18 U.S.C. §§ 2252A(a)(5)(B) & (b)(2). (Doc. 1).

This case comes before the court on Defendant's Motion to Suppress Evidence. (Doc. 21). The Government has filed a Response (doc. 26) and Supplemental Response. (Doc. 30). The court WILL DENY the Motion to Suppress.

I. Statement of Facts

From September 2014 to February 2015, FBI agents monitored "Playpen," a website dedicated to the advertisement and distribution of child pornography. The Playpen website was only accessible via "The Onion Router" or "Tor" network, which is part of what is sometimes referred to as the "Dark Web" because of its anonymity features.¹ On February 20, 2015, the FBI obtained a warrant in the Eastern District of Virginia to deploy a Network Investigative Technique ("NIT") on the Playpen website to obtain identifying information about the computers accessing the site. That warrant lies at the heart of this case. The FBI's warrant application included the affidavit of FBI Special Agent Douglas Mcfarlane, who investigated the Playpen website. Agent Mcfarlane's affidavit describes in detail the website, the Tor network, and other relevant facts from the FBI's investigation.

A. The Tor Network

Tor is a program designed to provide Internet privacy protections by restricting the kinds of information a website can collect from a user, particularly a computer's IP address.² The Tor software permits a user to access the Tor network, a network of computers that obscures the identity of users by rerouting a user's IP address through "layers" of relay points, so that the IP address at which a signal exits (the "exit node") is not the IP address at which the signal originated. This process makes it impossible to "peel back the layers of the onion" to discover the originating IP address, which in turn marks the user's geographic location and can be used to identify the user.

Websites accessible only on the Tor network, termed "hidden services," are not searchable through Google or other search engines; rather, a user must employ the Tor software and know the exact address of a particular hidden service to access it. A user could obtain the address from communications with other individuals who use the hidden service or from an Internet posting describing the hidden service and giving its address. The Playpen website, for example, was listed on a Tor hidden service page dedicated to pedophilia and child pornography. Website addresses on the Tor network consist of a randomized series of characters produced by an algorithm and end in ".onion." Tor obscures the IP addresses of hidden services, meaning that law enforcement cannot determine the location of the computer hosting a hidden service.

Originally designed and employed by the U.S. Navy, the Tor network is used for many legal purposes and is freely available for download at https://www.torproject.org.

B. The Playpen Website

The Playpen website was located at different ".onion" URLs depending on when it was accessed; the administrator of Playpen periodically moved the website from one URL to another, without otherwise altering it, in part to avoid detection by law enforcement. The website's homepage featured the word "Playpen" and two images of partially clothed prepubescent females with their legs spread apart. Beneath the logo was text stating, "No cross-board reposts, .7z preferred, encrypt filenames, include preview, Peace out." Special Agent Mcfarlane's affidavit explains that "[n]o cross-board reposts" refers to not posting files from other websites and ".7z preferred" denotes a method of compressing large files for distribution. The homepage also included a login section and a link to the registration page. The registration terms on the registration page instructed users to not enter a real email address and stated that "[f]or your own security" users should not post identifying information and should disable other potentially identifying browser features.

Upon logging in, a user would be immediately directed to a Playpen directory that listed message boards divided into more than fifty topics and subtopics that largely referred to child pornography, child erotica, and child sexual abuse. For example, the topics included "Pre-teen Videos" and "Pre-teen Photos," both subdivided into "Girls HC [hardcore]" and "Girls SC [softcore]/NN [non-nude]" and "Boys HC" and "Boys SC/NN"; "Kinky Fetish," and "Family [Playpen]—Incest."³ Agent Mcfarlane's affidavit details numerous examples of child pornography posted on the Playpen message boards under these topics and others.

C. The FBI Investigation & Network Investigative Technique ("NIT")

Upon receiving on a tip from a foreign law enforcement agency, the FBI identified the Playpen website's host IP address and seized a copy of the server containing the Playpen website, storing that copy on a server in the Eastern District of Virginia. The FBI arrested the Playpen website administrator and assumed administrative control of Playpen. Because traditional methods of obtaining IP addresses would only reveal the "exit node" IP addresses of Playpen users, the FBI sought and received permission to deploy a Network Investigative Technique (NIT) from the server in the Eastern District of Virginia to locate and identify Playpen users. A magistrate judge in the Eastern District of Virginia signed the warrant permitting the FBI to deploy the NIT.

The NIT consisted of computer code that instructed a user's computer to transmit specific information to a government-controlled computer. The NIT operated by downloading to a user's browser along with other content from the Playpen website. Though the warrant authorized the FBI to deploy the NIT to any computer logging into the Playpen website, in executing the warrant the FBI only deployed the NIT to computers accessing actual pornography in certain Playpen forums. See (Doc. 30–1 at 18–19). That is, when a user clicked on a designated pornographic image or video on Playpen, the website on the server in the Eastern District of Virginia transmitted the image or video along with the NIT code. Once downloaded to a user's browser, the NIT instructed a user's computer—the "activating computer"—to send specific information to the government computer.

In the section of the NIT warrant application requesting information about the person or property to be searched, the application refers to Attachment A. Attachment A explains that the warrant authorizes the use of a NIT on a computer server operating the Playpen website and that the server is located at a government facility in the Eastern District of Virginia. Attachment A also states that the NIT will obtain the information specified in Attachment B from the "activating computers" of any user or administrator who logs into the Playpen website.

Similarly, in the section requesting information about the property to be seized, the application refers to Attachment B. Attachment B explains that the NIT would collect the following seven pieces of information:

1. The "activating" computer's actual IP address, and the date and time that the NIT determines what that IP address is;2. A unique identifier generated by the NIT (e.g., a series of numbers, letters, and/or special characters) to distinguish the data from that of other "activating" computers. That unique identifier will be sent with and collected by the NIT;

3. The type of operating system running on the computer, including type (e.g., Windows), version (e.g., Windows 7), and architecture (e.g., x 86);

4. Information about whether the NIT has already been delivered to the "activating" computer;

5. The "activating" computer's "Host Name." A Host Name is a name assigned to a device connected to a computer network that is used to identify the device in various forms of electronic communication, such as communications over the Internet;

6. the "activating" computer's active operating system username; and

7. The "activating" computer's Media Access Control ("MAC") address. The equipment that connects a computer to a network is commonly referred to as a network adapter. Most network adapters have a MAC address assigned by the manufacturer of the adapter that is designed to be a unique identifying number. A unique MAC address allows for proper routing of communications on a network. Because the MAC address does not change and is intended to be unique, a MAC address can allow law enforcement to identify whether communications sent or received at different times are associated with the same adapter.

Both Attachments A and B, along with Agent Mcfarlane's affidavit, were included with the NIT...