United States v. Workman

• Decision Date: 06 September 2016
• Docket Number: Criminal Case No. 15-cv-00397-RBJ-1
• Citation: 205 F.Supp.3d 1256
• Parties: UNITED STATES of America, Plaintiff, v. Andrew Joseph WORKMAN, Defendant.
• Court: U.S. District Court — District of Colorado

205 F.Supp.3d 1256

UNITED STATES of America, Plaintiff,

v.Andrew Joseph WORKMAN, Defendant.

Criminal Case No. 15-cv-00397-RBJ-1

United States District Court, D. Colorado.

Signed September 6, 2016

David Alan Tonini, U.S. Attorney's Office, Denver, CO, for Plaintiff.

ORDER

R. Brooke Jackson, United States District Judge

This matter is before the Court on defendant's motion to suppress [ECF No. 33]. For the reasons discussed in this Order, defendant's motion is granted.

I. FACTS

This case arises out of an investigation into a child pornography website. ECF No. 36 at 1. In September 2014, the Federal Bureau of Investigation began investigating a website named Playpen, suspecting it of hosting users for the purpose of advertising, distributing, and accessing child pornography. Id. Playpen had more than 150,000 registered users and contained tens of thousands of posts related to child pornography. Id. ; ECF No. 36-1 at ¶ 10–13.

Playpen was not accessible through traditional search engines or browsers. ECF No. 36 at 1–3. It operated on "The Onion Router" or "Tor." Id. Tor conceals a user's location and activity by encrypting data and sending it through a series of random relay nodes. Id. Users have to download specific Tor software or utilize a Tor "gateway" to get onto the Tor network and then navigate to a site like Playpen. Id.

Additionally, Playpen encouraged users to register anonymously using a false email address. ECF No. 33-1 at ¶ 38. After registering, users could access different sections of the website, including forums relating to sexual exploitation of children. Id. at ¶ 42. For example, Playpen had forums and sub-forums for "jailbait," "preteen," and "toddlers." ECF No. 36-1 at ¶ 14. Playpen also encouraged users to upload child pornography and contained discussion boards relating to sexual abuse of children. ECF No. 33-1 at ¶ 40.

The Network Investigative Technique Warrant

In February 2015, the FBI apprehended the administrator of Playpen and took control of the website. ECF No. 36 at 1–3. Rather than shut down Playpen, however, the FBI operated the website from a government facility in the Eastern District of Virginia for close to two weeks in an effort to identify website users. To do so the FBI sought and obtained two forms of court authorization from the United States District Court for the Eastern District of Virginia which enabled it to obtain information about users visiting the site. Id. First, the FBI obtained a Title III application to monitor Playpen's chat function. ECF No. 33-2. Second, the FBI obtained a warrant (the NIT Warrant) to deploy a Network Investigative Technique (NIT). ECF No. 33-3.

The NIT Warrant was issued by Magistrate Judge Theresa Carroll Buchanan in the Eastern District of Virginia. Id. The warrant stated,

An application by a federal law enforcement officer or an attorney for the government requests the search of the following person or property located in the Eastern District of Virginia. (Identify the person or describe the property to be searched and give its location): See Attachment A. The person or property to be searched, described above, is believed to conceal (identify the person or describe the property to be seized): See Attachment B.

Id.

Thus, attachment A described the place to be searched. Id. at 2. It stated that the NIT Warrant "authorize[d] the use of [an NIT] to be deployed on the computer server described below, obtaining information described in Attachment B from the activating computers described below." Id. It explained that the computer server, which was located at a government facility in the Eastern District of Virginia, was operating a Tor network child pornography website. Id. Further, it stated that the activating computers were those of any user or administrator who logged into the child pornography website. Id.

Attachment B identified the property to be seized. Id. It listed seven pieces of information to be seized "[f]rom any ‘activating’ computer": (1) the IP address, and the date and time the NIT determined the IP address; (2) a unique identifier generated by the NIT; (3) the type of operating system running on the computer; (4) information about whether the NIT had already been delivered to the activating computer; (5) the activating computer's Host Name; (6) the activating computer's active operating system username; and (7) the activating computer's media access control address. Id. at 3.

In March 2015 the FBI received information, through its use of the NIT, about Playpen user "longrod." ECF No. 36 at 8. "Longrod" had been a Playpen member since December 31, 2014. Id. Additionally, "longrod" had logged into the website for a total of 11 hours and 45 minutes through March 1, 2015. Id. The NIT indicated that "longrod" used an IP address operated by the Internet Service Provider Comcast. Id. The FBI subsequently served Comcast with an administrative subpoena. Id. Comcast responded that the IP address associated with "longrod" was registered to a customer named D. Gurule living in Lone Tree, Colorado. Id.

The Residential Warrant

The FBI then sought and obtained a search warrant (the Residential Warrant) for Mr. Gurule's address from Magistrate Judge Nina Y. Wang of this district. ECF No. 33-1. On September 18, 2015 FBI agents executed the warrant. ECF No. 36 at 8. Upon arrival, they discovered that defendant Andrew Workman subleased a bedroom from Mr. Gurule. Id. The Agents found Mr. Workman in his bedroom actively downloading child pornography from the Internet. Id. Mr. Workman agreed to a non-custodial interview with the FBI agents. Id. at 9. He admitted that he was the user "longrod" on Playpen. Id. Additionally, he admitted to using a Tor network and a virtual private network (VPN) to hide his true location. Id.

Agents seized Mr. Workman's computer. Id. A forensic review later revealed a hidden folder under the user "Andrew" that contained approximately 1,248 images and 171 videos of child pornography. Id.

On October 7, 2015 the Grand Jury returned an indictment against Mr. Workman for one count of Receipt of Child Pornography and one count of Possession of Child Pornography in violation of 18 U.S.C. §§ 2252A(a)(2) and (a)(5)(B). ECF No. 36-1. Mr. Workman now moves to suppress all evidence obtained or derived from the NIT Warrant. ECF No. 33.

II. ANALYSIS

Mr. Workman moves to suppress the evidence obtained or derived from the NIT Warrant, arguing that the government's search of Mr. Workman's computer violated both Federal Rule of Criminal Procedure 41 and 28 U.S.C. § 636(a).¹ ECF No. 33. The government opposes the motion, arguing that the magistrate judge had authority to issue the NIT Warrant under Rule 41(b)(2) and (b)(4) and thus had authority to issue the search under 28 U.S.C. § 636(a)(1). ECF No. 36 at 9–10. Alternatively, the government asserts that even if the NIT Warrant was defective, the evidence should not be suppressed because (1) the alleged violation did not prejudice Mr. Workman, nor is there evidence of intentional and deliberate disregard of Rule 41 ; (2) the officers acted in good faith; and (3) a warrantless search was justified due to exigent circumstances. Id. at 10–11. The Court will address each argument in turn.²

A. Rule 41(b)

Mr. Workman asserts that the NIT Warrant violated Federal Rule of Criminal Procedure 41(b) because Magistrate Judge Buchanan did not have authority to authorize a search of Mr. Workman's computer, which was located outside of the Eastern District of Virginia. I agree with Mr. Workman.

First, the Court finds that Rule 41(b)(1) did not authorize the issuance of the NIT Warrant. Under Rule 41(b)(1), "[a]t the request of a federal law enforcement officer or an attorney for the government ... a magistrate judge with authority in the district ... has authority to issue a warrant to search for and seize a person or property located within the district[.]" "Property" includes both "tangible objects" and "information." Fed. R. Crim. P. 41(a)(2)(A).

Here, under Rule 41(b)(1), Magistrate Judge Buchanan had authority to issue a warrant to search for and seize property located within the Eastern District of Virginia. However, under Attachment A labeled "Place to be Searched," the NIT Warrant clearly states that it authorized the NIT to "obtain information ... from the activating computers." ECF No. 33-3 at 2. It is undisputed that the activating computer at issue here—Mr. Workman's computer—was located in the District of Colorado. Therefore, Rule 41(b)(1) did not authorize the search of Mr. Workman's computer because the place to be searched and information to be seized were located outside of the Eastern District of Virginia. See Levin , 186 F.Supp.3d at 32–33, 2016 WL 2596010, at *5 (finding that the NIT Warrant was not authorized by Rule 41(b)(1) where the defendant's computer was located in Massachusetts); United States v. Michaud , No. 3:15–CR–05351–RJB, 2016 WL 337263, at *6 (W.D. Wash. Jan. 28, 2016) (holding that the NIT Warrant was not authorized by 41(b)(1) "because the object of the search and seizure was [the defendant's] computer, not located in the Eastern District of Virginia").

However, the government contends that even if Magistrate Judge Buchanan lacked authority to issue the NIT Warrant under Rule 41(b)(1), she had authority to issue the warrant under Rule 41(b)(2) and (4). For the following reasons, I disagree.

Rule 41(b)(2) states that "a magistrate judge with authority in the district has authority to issue a warrant for a person or property outside the district if the person or property is located within the district when the warrant is issued but might move or be moved outside the district before the warrant is executed[.]" The government argues that by signing into the Playpen site, information—such as the user's IP address—traveled from the user's computer to the Playpen site, which was located in the Eastern District of Virginia. ECF No. 36 at 13. Further, the government contends that the NIT,...