United States v. Werdene, CRIMINAL ACTION NO. 15-434

• Citation: 188 F.Supp.3d 431
• Decision Date: 18 May 2016
• Docket Number: CRIMINAL ACTION NO. 15-434
• Parties: United States of America, v. Gabriel Werdene, Defendant.
• Court: U.S. District Court — Eastern District of Pennsylvania

188 F.Supp.3d 431

United States of America,

v.Gabriel Werdene, Defendant.

CRIMINAL ACTION NO. 15-434

United States District Court, E.D. Pennsylvania.

Signed May 18, 2016

US, for Plaintiff(s)

Laurie Magid, Esq., for Defendant(s)

MEMORANDUM

PAPPERT, District Judge

Gabriel Werdene ("Werdene") was indicted on September 17, 2015 on one count of possessing and attempting to possess child pornography pursuant to 18 U.S.C. §§ 2252(a)(4)(B) and (b)(2). The indictment was based on evidence obtained during a June 17, 2015 search of Werdene's Bensalem, Pennsylvania home, which was conducted in accordance with a warrant issued by a magistrate judge in this judicial district. The Federal Bureau of Investigation ("FBI") identified Werdene after a magistrate judge in Virginia issued a warrant permitting agents to deploy software that revealed the IP addresses of visitors to a child pornography website called Playpen.¹ FBI agents matched Werdene's Playpen username, "thepervert," to his IP address and then located his home in Bensalem based on that information.

Playpen's patrons accessed the website through software called "Tor," an acronym for "The onion router." Tor conceals the IP addresses of people who visit certain websites, in Werdene's case a website purveying child pornography. Otherwise stated, Tor enables people to use websites like Playpen to view, upload and share child pornography without being identified by traditional law enforcement investigative methods. To circumvent Tor, the FBI used a Network Investigative Technique ("NIT"). The NIT caused software to be activated whenever a Playpen user logged into the website with his username and password. The software caused the Playpen user's computer to reveal its IP address to the FBI. The search warrant issued by the Virginia magistrate authorized the NIT.

Werdene moves to suppress the evidence seized from his home, arguing primarily that the magistrate judge in Virginia lacked jurisdiction under Federal Rule of Criminal Procedure 41 to authorize the NIT. Werdene contends that this violation of a procedural rule warrants suppression. While Rule 41 did not authorize the issuance of the warrant in Virginia, suppression is not the appropriate remedy. The magistrate judge's failure to comply with Rule 41 did not violate Werdene's Fourth Amendment rights because Werdene had no expectation of privacy in his IP address, and certainly not one that society would recognize as reasonable. Even if Werdene's constitutional rights were violated, the good faith exception to the exclusionary rule precludes suppression. Finally, any nonconstitutional violation of Rule 41 did not prejudice Werdene, as that term has been defined by the Third Circuit Court of Appeals in the Rule 41 context. The Court denies the motion.

I.

Playpen operated on the "dark web," a collection of websites that use anonymity tools to hide those websites' IP addresses and mask the identity of their administrators. Websites on the dark web can only be accessed using certain software such as Tor. (See Gov't. Mem. in Opp. to Def.'s Mot. to Suppress ("Gov't's Opp."), Ex. 1 ¶¶ 7–10, ECF No. 21.) Playpen, as its name connotes in this context, was "dedicated to the advertisement and distribution of child pornography, [and] the discussion of matters pertinent to child sexual abuse." (Id. , Ex. 1 ¶ 6.) The website's home page displayed an image of two partially clothed prepubescent females with their legs spread. (Id. , Ex. 1 ¶ 12.) Upon arriving at the home page, a user was prompted to either register an account or login using his pre-existing username and password. (Id. ) Prior to registering an account, a message was displayed which told the user, among other things, "NOT [to] ... enter a real [email] address" and "[f]or your security you should not post information here that can be used to identify you." (Id. , Ex. 1 ¶ 13.) The message also stated that "[t]his website is not able to see your IP address and can not [sic] collect or send any other form of information to your computer except what you expressly upload." (Id. )

After successfully registering and logging into the site, the user reached a page which listed a number of "forums" or discussion boards on which users could post images, videos or text regarding various topics. The "forums" included "Jailbait—Boy," "Jailbait—Girl," "Preteen—Boy," "Preteen—Girl," "Jailbait Videos," "Jailbait Photos," "Pre-teen Videos," "Pre-Teen Photos," "Family—Incest" and "Toddlers." (Id. , Ex. 1 – 14.) Within the pre-teen videos and photos forums were "subforums" titled "Girls [hardcore]," "Boys [hardcore]," "Girls [softcore/non-nude]" and "Boys [softcore/non-nude]."² (Id. ) Each forum contained a topic with titles, an author and the number of replies and views. (Id. , Ex. 1 ¶ 16.) Upon accessing a topic, the original post appeared at the top of the page with all corresponding replies to the original post below. (Id. ) Typical posts contained text, links to external sites, and/or images. (Id. )

Playpen also included features available to all users of the website referred to as "Playpen Image Hosting" and "Playpen Video Hosting." (Id. , Ex. 1 ¶ 23.) Those pages allowed users to upload images and videos of child pornography for other users to view. (Id. ) Over 1,500 unique users visited Playpen daily and over 11,000 unique users visited the site over the course of a week. (Id. , Ex. 1 ¶ 19.) According to statistics on the website, by March 2015 Playpen contained a total of 117,773 posts, 10,622 total topics and 214,898 total members. (Id. , Ex. 2 ¶ 12.)

A.

Playpen operated on and was only accessible through Tor. (Id. , Ex. 1 ¶ 7.) Unlike a public website, a user could not reach Playpen through a traditional web search engine, such as Google. (Id. , Ex. 1 ¶ 10.) Rather, he could only access the website by using Tor and inputting the "particular ... combination of letters and numbers that" matched Playpen's specific Tor-based web address. (Id. , Ex. 1 ¶¶ 9–10; Hr'g Tr. 38:9–13, ECF No. 29.)

Although the United States Naval Research Laboratory initially designed and implemented Tor for the primary purpose of protecting government communications, it is now "free software, [ ] available worldwide" to the public. (Gov't's Opp., Ex. 1 ¶ 7; Hr'g Tr. 7:13–17.) In order to access the Tor network, a user must take affirmative steps to install the software on his computer by either downloading an add-on to his web browser or downloading the Tor software available on its website. (Gov't's Opp., Ex 1 ¶ 7.)

The use of Tor thwarts traditional IP identification and investigative techniques. (Id. , Ex. 2 ¶ 23.) Under those traditional methods, FBI agents can review IP address logs after they seize a website to determine which IP addresses visited the site. (Id. , Ex. 1 ¶ 22.) They can then conduct a publicly available search to determine which internet service providers ("ISPs") owned the target IP address and issue a subpoena to the ISP to ascertain the identity of the user. (Id. )

The Tor software masks a user's IP address by "bouncing their communications around a distributed network of relay computers run by volunteers all around the world." (Id. , Ex. 1 ¶ 8.) As a result, "traditional IP identification techniques are not viable" because the last computer or "exit node" is not the IP address of the actual user who visits the website. (Id. ; id. , Ex. 2 ¶ 23.) It is also impossible to trace the IP address back to the originating computer. (Id. , Ex. 2 ¶ 23.) The Tor network "operates similarly to a proxy server—that is, a computer through which communications are routed to obscure a user's true location." (Id. , Ex. 1 ¶ 8.)

Tor also allows websites, such as Playpen, to operate as a "hidden service." (Id. , Ex. 1 ¶ 9.) Tor masks the website server's IP address and replaces it with a Tor-based web address. (Id. ) The Tor-based address is usually a series of algorithm-generated characters such as "asdlk8fs9dflku7f" followed by the suffix ".onion." (Id. ) The user may obtain Playpen's specific address from other users or through a link posted on one of Tor's "hidden services" pages dedicated to child pornography and pedophilia. (Id. , Ex. 1 ¶ 10.)

B.

In December 2014, a foreign law enforcement agency informed the FBI that it suspected a United States-based IP address was associated with Playpen. (Id. , Ex. 1 ¶ 28.) The FBI confirmed through a publicly available search that the IP address was owned by Centrilogic, a server hosting company headquartered in Lenoir, North Carolina. (Id. ) The FBI subsequently obtained a search warrant for the server. (Id. ) FBI agents examined the server and determined that it contained a copy of Playpen. They then stored the copy of the website on a computer server at a government facility in Newington, Virginia. Newington is located in the Eastern District of Virginia. (Id. )

Additional investigation revealed that a resident of Naples, Florida had administrative control of Playpen and the computer server in Lenoir. (Id. ) On February 19, 2015 FBI personnel executed a court-authorized search of the suspected administrator's residence in Naples. (Id. , Ex. 1 ¶ 30.) The FBI arrested the suspect and assumed administrative control of Playpen. (Id. ) On February 20, 2015, Agent Macfarlane applied to a United States Magistrate Judge in the Eastern District of Virginia for a warrant to use the NIT while the FBI assumed administrative control of Playpen on a copy of its server in Newington. (See generally id. , Ex. 1.)

Agent Macfarlane stated in the warrant application that the NIT was necessary to overcome the obstacles presented by Tor's masking capabilities. (Id. , Ex. 1 ¶ 31.) He stated that "other investigative procedures that are usually employed in criminal investigations of this type have been tried and failed or reasonably appear to be unlikely to succeed if they are tried." (Id. ) The agent represented that the search would aid the FBI in its investigation by revealing ...