United States v. Robert McLamb , 880 F.3d 685 ( 2018 )


Menu:
  •                                          PUBLISHED
    UNITED STATES COURT OF APPEALS
    FOR THE FOURTH CIRCUIT
    No. 17-4299
    UNITED STATES OF AMERICA,
    Plaintiff – Appellee,
    v.
    ROBERT MCLAMB,
    Defendant – Appellant,
    ------------------------------
    PRIVACY INTERNATIONAL; ELECTRONIC FRONTIER FOUNDATION;
    NATIONAL ASSOCIATION OF CRIMINAL DEFENSE LAWYERS,
    Amici Supporting Appellant.
    Appeal from the United States District Court for the Eastern District of Virginia, at
    Norfolk. Rebecca Beach Smith, Chief District Judge. (2:16-cr-00092-RBS-RJK-1)
    Argued: October 26, 2017                                     Decided: January 25, 2018
    Before DUNCAN and THACKER, Circuit Judges, and Max O. COGBURN, United
    States District Judge for the Western District of North Carolina, sitting by designation.
    Affirmed by published opinion. Judge Thacker wrote the opinion, in which Judge
    Duncan and Judge Cogburn joined.
    ARGUED: Andrew William Grindrod, OFFICE OF THE FEDERAL PUBLIC
    DEFENDER, Norfolk, Virginia, for Appellant. Richard Daniel Cooke, OFFICE OF THE
    UNITED STATES ATTORNEY, Richmond, Virginia, for Appellee. ON BRIEF:
    Geremy C. Kamens, Federal Public Defender, OFFICE OF THE FEDERAL PUBLIC
    DEFENDER, Alexandria, Virginia, for Appellant. Dana J. Boente, United States
    Attorney, Alexandria, Virginia, Elizabeth M. Yusi, Assistant United States Attorney,
    OFFICE OF THE UNITED STATES ATTORNEY, Norfolk, Virginia, for Appellee.
    Scarlet Kim, PRIVACY INTERNATIONAL, London, United Kingdom, James R.
    Theuer, JAMES R. THEUER, PLLC, Norfolk, Virginia, for Amicus Privacy
    International. Cindy Cohn, Mark Rumold, Andrew Crocker, ELECTRONIC FRONTIER
    FOUNDATION, San Francisco, California, for Amicus Electronic Frontier Foundation.
    Elizabeth Franklin-Best, BLUME FRANKLIN-BEST & YOUNG, LLC, Columbia,
    South Carolina, for Amicus National Association of Criminal Defense Lawyers.
    2
    THACKER, Circuit Judge:
    Robert McLamb (“Appellant”) challenges the district court’s order denying his
    motion to suppress evidence of child pornography contained on a hard drive recovered at
    his home. The Federal Bureau of Investigation (“FBI”) obtained the evidence in the
    course of its investigation of a child pornography website called “Playpen,” a hidden
    services message board located on the “dark web.” The dark web is a collection of
    encrypted networks providing strong privacy protections to its users.
    After locating and seizing the Playpen servers in February 2015, the FBI sought a
    warrant to deploy the Network Investigative Technique (“NIT”) to locate users accessing
    the website.   The NIT is a computer script designed to overcome the anonymity
    protections of the dark web and collect identifying information from computers accessing
    the Playpen website. A federal magistrate judge in the Eastern District of Virginia issued
    the warrant, authorizing use of the NIT on Playpen visitors for 30 days. The NIT
    identified thousands of computers across the world that accessed Playpen during the 30-
    day period. After the NIT identified Appellant as one such visitor, the FBI seized
    Appellant’s hard drive and charged him with receipt and possession of child
    pornography.
    Appellant moved to suppress the evidence on the hard drive as the fruit of an
    invalid warrant. Appellant challenged the warrant’s particularity and its execution, as
    well as the jurisdiction of the magistrate judge to authorize such a search. The district
    court denied the motion, and we affirm. Even if the warrant is unconstitutional, the
    3
    district court properly denied Appellant’s motion to suppress because the Leon good faith
    exception applies.
    I.
    The Onion Router (“Tor”) is an encrypted online network, one of several networks
    that make up the dark web. Tor uses a series of relay computers to mask the identity of
    online users. As a result, Tor obscures how, when, and where users access the internet.
    With such powerful anonymity protections, some use Tor for drug dealing, child
    pornography, and other nefarious purposes.
    Playpen was a message board on the dark web where users could upload or
    download child pornography. At one time, Playpen had over 158,000 total members and
    nearly 100,000 posts. In order to access a hidden services website like Playpen, a user
    must download Tor and enter the site’s domain name, a 16-character URL consisting of
    random letters and numbers. Playpen was not discoverable on the open web, nor could a
    search engine like Google route users to it. Playpen’s welcome page required a visitor to
    enter a username and password in order to proceed to the message board. On this
    welcome page, a banner depicted two partially clothed, prepubescent girls with their legs
    spread apart.   The banner was suggestive enough that Playpen’s content would be
    apparent to any visitor of the welcome page.
    After receiving a tip, the FBI seized the Playpen server and arrested the
    administrator of the site. Despite having possession of the server, however, the FBI was
    unable to locate Playpen users, because by virtue of their use of Tor, the users uploading
    and downloading child pornography remained anonymous. Therefore, the FBI sought to
    4
    deploy the NIT to defeat the anonymity protections of the dark web. The NIT works by
    corrupting the target server, thereby surreptitiously supplementing child pornography
    data with the NIT script:
    [NIT] is installed on the server [of a particular Tor website.] After a user of
    the [Tor website] takes certain actions, including downloading information
    from the [NIT infected] server . . . that information is supplemented with
    the NIT instructions. So the user downloads the NIT to their computer and
    takes it to their computer, wherever it may be located.
    J.A. 137. *
    Once delivered and installed to a user’s computer, the NIT deploys a “payload”
    software that searches the user’s computer for identifying information: (1) the user’s IP
    address; (2) a unique signature generated by the NIT so that user’s activities on the Tor
    network might be identified; (3) the user’s operating system; (4) whether the NIT is
    already installed on a user’s computer; (5) a host name used to identify the device in
    other kinds of electronic communication; (6) the user’s active operating system
    username; and (7) the user’s Media Access Control address, which identifies the location
    where the user’s computer connects to the internet. The NIT then transmits all of that
    data to the FBI.
    Concerned with the legality of the NIT and similar remote access investigative
    programs, the FBI sought to amend the Federal Rules of Criminal Procedure in 2014 to
    enlarge the scope of magistrate judges’ jurisdiction in issuing warrants. However, the
    *   Citations to the “J.A.” refer to the Joint Appendix filed by the parties in this
    appeal.
    5
    rule was not amended until 2016, after the events of this case. At the time of the Playpen
    investigation, lower courts differed on the permissibility of remote access investigative
    techniques. Compare United States v. Laurita, No. 8:13-cv-107, 
    2016 WL 4179365
    , at
    *6 (D. Neb. Aug. 5, 2016) (“[Rule 41] authorizes the use of a tracking device and the
    NIT is analogous to a tracking device.”), with In re Warrant to Search a Target
    Computer at Premises Unknown, 
    958 F. Supp. 2d 753
    , 757 (S.D. Tex. 2013) (concluding
    an NIT warrant exceeded the magistrate judge’s Rule 41 jurisdiction). No appellate court
    had addressed the issue. Before applying for the NIT warrant in this case, the FBI
    consulted with attorneys at the Department of Justice’s Child Exploitation and Obscenity
    Section as well as the FBI’s Remote Operations Unit.
    FBI Agent Douglas Macfarlane (“Agent Macfarlane”) authored the affidavit in
    support of the Playpen NIT warrant. The affidavit outlines Tor, details the content of
    Playpen, and devotes several pages to describing the mechanics of the NIT.            The
    magistrate judge in the Eastern District of Virginia issued the warrant. The warrant
    authorized the use of the NIT for 30 days on any user entering a username and password
    into the Playpen welcome page.
    Just over a week after the NIT went into effect, Appellant entered a username and
    password into the Playpen welcome page and entered the website, thereby triggering the
    NIT. The FBI obtained a second warrant to physically search Appellant’s home and to
    seize his computer and two hard drives. Appellant was apprehended and found with over
    2,700 images and videos of child pornography in his possession. Appellant was charged
    with four counts of receipt of child pornography in violation of 18 U.S.C. § 2252(a)(2)
    6
    and one count of possession of child pornography in violation of              18 U.S.C.
    § 2252(a)(4)(B). Appellant moved to suppress evidence of the child pornography found
    on his hard drive as fruit of an invalid warrant. The district court denied the motion.
    Appellant then entered a conditional guilty plea, reserving his right to appeal the
    suppression ruling. This timely appeal followed.
    II.
    In the context of a suppression ruling, we review legal questions de novo. United
    States v. Castellanos, 
    716 F.3d 828
    , 832 (4th Cir. 2013). Appellant challenges the NIT
    warrant’s particularity and execution, as well as the magistrate judge’s jurisdiction to
    issue it. Even if any of these alleged shortcomings amount to a constitutional violation,
    suppression is not an appropriate remedy if the good faith exception applies under United
    States v. Leon, 
    368 U.S. 897
    (1984).
    Three of our sister circuits have analyzed the same NIT warrant at issue in this
    case. Each has concluded that even if the NIT warrant violates the Fourth Amendment,
    the Leon good faith exception precludes suppression of the evidence. See United States
    v. Horton, 
    863 F.3d 1041
    (8th Cir. 2017); United States v. Levin, 
    874 F.3d 316
    (1st Cir.
    2017); United States v. Workman, 
    863 F.3d 1313
    (10th Cir. 2017). We agree.
    A.
    Suppression is “a judicially created remedy designed to safeguard Fourth
    Amendment rights generally through its deterrent effect, rather than a personal
    constitutional right of the party aggrieved.” United States v. Leon, 
    486 U.S. 897
    , 909
    (1984) (quoting United States v. Calandra, 
    414 U.S. 338
    , 348 (1974)).             “[T]he
    7
    exclusionary rule serves to deter deliberate, reckless, or grossly negligent conduct, or in
    some circumstances recurring or systemic negligence.” Herring v. United States, 
    555 U.S. 135
    , 144 (2009). Central to the question of suppression is “the culpability of the law
    enforcement conduct.” 
    Id. at 143.
    “[E]vidence should be suppressed ‘only if it can be
    said that the law enforcement officer had knowledge, or may properly be charged with
    knowledge, that the search was unconstitutional under the Fourth Amendment.” Illinois
    v. Krull, 
    480 U.S. 340
    , 348–49 (1987) (quoting United States v. Peltier, 
    422 U.S. 531
    ,
    542 (1975)). Suppression “applies only where it ‘result[s] in appreciable deterrence.’”
    
    Herring, 555 U.S. at 141
    (quoting 
    Leon, 468 U.S. at 909
    ).
    In Leon, the Supreme Court explained the limits of the good faith exception:
    Suppression . . . remains an appropriate remedy if the
    magistrate or judge in issuing a warrant was misled by
    information in an affidavit that the affiant knew was false or
    would have known was false except for his reckless disregard
    of the truth. The [good faith] exception . . . will also not
    apply in cases where the issuing magistrate wholly abandoned
    his judicial role . . . . Nor would an officer manifest objective
    good faith in relying on a warrant based on an affidavit so
    lacking in indicia of probable cause as to render official belief
    in its existence entirely unreasonable. Finally, depending on
    the circumstances of the particular case, a warrant may be so
    facially deficient . . . that the executing officers cannot
    reasonably presume it to be 
    valid. 468 U.S. at 923
    (citations omitted).
    None of these conditions apply here. There is no indication that the magistrate
    judge “wholly abandoned” its judicial role, or that the affidavit lacked an “indicia of
    probable cause.”    
    Leon, 468 U.S. at 923
    .       Nor did Agent Macfarlane mislead the
    magistrate judge with falsehoods or reckless disregard of truth. In his affidavit in support
    8
    of the warrant application, Agent Macfarlane detailed the investigatory difficulties posed
    by the dark web and devoted several pages to explaining the NIT’s mechanism.
    Although he does not specifically use the term “tracking device” in his affidavit, Agent
    Macfarlane’s detailed description of the NIT was sufficient to inform the magistrate
    judge of the scope of the warrant sought.
    Appellant notes that Agent Macfarlane identified the Eastern District of Virginia
    as the location of the search, but the NIT actually searched computers all over the world.
    Agent Macfarlane did so in the warrant application, a preprinted form inviting the affiant
    to fill in the blanks as to the magisterial district of the search. The location of the
    Playpen server, the Eastern District of Virginia, was the most sensible single district to
    identify as the “locat[ion]” of the contraband. J.A. 51. To the extent the form is
    misleading, Agent Macfarlane cured any ambiguity by informing the magistrate judge
    that the NIT would cause activating computers “wherever located” to transmit data to the
    FBI. 
    Id. at 80.
    Nor was the warrant so “facially deficient . . . that the executing officers [could
    not] reasonably presume it to be valid.” 
    Leon, 468 U.S. at 923
    . The boundaries of a
    magistrate judge’s jurisdiction in the context of remote access warrants were unclear at
    the time of the warrant application. Without judicial precedent for reference, the FBI
    consulted with attorneys from the Department of Justice Child Exploitation and
    Obscenity Section. Appellant casts the consultation in a cynical light, arguing that it
    evidences a guilty conscience. But in light of rapidly developing technology, there will
    not always be definitive precedent upon which law enforcement can rely when utilizing
    9
    cutting edge investigative techniques.    In such cases, consultation with government
    attorneys is precisely what Leon’s “good faith” expects of law enforcement. We are
    disinclined to conclude that a warrant is “facially deficient” where the legality of an
    investigative technique is unclear and law enforcement seeks advice from counsel before
    applying for the warrant.
    B.
    Appellant also claims that the good faith exception to the exclusionary rule is
    categorically inapplicable for warrants exceeding a magistrate judge’s jurisdiction.
    Because such warrants are void from inception, Appellant contends, their execution is the
    equivalent of a warrantless search. However, as noted, the Supreme Court has held that
    “the exclusionary rule is designed to deter police misconduct rather than to punish the
    errors of judges and magistrates.” 
    Leon, 468 U.S. at 916
    . Suppressing evidence merely
    because it was obtained pursuant to a warrant that reached beyond the boundaries of a
    magistrate judge’s jurisdiction would not, under the facts of this case, produce an
    “appreciable deterrence” on law enforcement. 
    Id. at 909.
    Accordingly, suppression is not appropriate.
    III.
    For the foregoing reasons, the judgment of the district court is
    AFFIRMED.
    10
    

Document Info

Docket Number: 17-4299

Citation Numbers: 880 F.3d 685

Filed Date: 1/25/2018

Precedential Status: Precedential

Modified Date: 1/12/2023