Searching over 5,500,000 cases.


searching
Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

United States v. Hall

United States District Court, W.D. North Carolina, Asheville Division

December 7, 2017

UNITED STATES OF AMERICA
v.
CARL JACK HALL and MORRIS RYAN LITWACK, Defendants.

          ORDER

          Dennis L. Howell, United States Magistrate Judge

         Pending before the Court are Defendant Hall's Motion to Suppress and Dismiss, 1:16cr147 [# 18 & # 27] and Defendant Litwack's Motion to Suppress and Dismiss, 1:17cr60 [# 15]. The Government filed a Response in both cases, 1:16cr147 [# 22], 1:17cr60 [# 17]. The Court conducted a joint hearing and heard evidence and argument from the Government and Defendants. Defendants then filed Memorandums in Support of the Motions to Suppress and Dismiss, 1:16cr147 [# 33], 1:17cr60 [# 25]. The Government filed a Response to both Memorandums, 1:16cr147 [# 35], 1:17cr60 [#27]. Finally, the Government filed a Supplement to both Responses, 1:16cr147 [# 39], 1:17cv60 [# 32]. Having carefully considered the evidence, briefs, and arguments of counsel, the Court enters the following findings, conclusions, and recommendation.

         FINDINGS AND CONCLUSIONS

         I. Procedural Background

         a. Carl Jack Hall, 1:16cr147

         Defendant Hall is charged with receiving and possessing child pornography, in violation of 18 U.S.C. §§ 2252A(a)(2)(A), 2252A(a)(5)(B). On April 25, 2017, Defendant Hall filed his Motion to Suppress and Dismiss [# 18]. On May 9, 2017, the Government filed its Response to Defendant Hall's Motion to Suppress [# 22]. On July 27, 2017, Defendant Hall filed a Supplement to the Motion to Dismiss [# 27]. On August 15, 2017, the Court held a joint hearing with the Government and Defendants Hall and Litwack. On September 19, 2017, Defendant Hall filed a Memorandum in Support of his Motion to Dismiss [# 33]. On September 29, 2017, the Government filed a Response to Defendant's Memorandum [# 35]. On November 13, 2017, the Government filed a Supplemental Response [# 39].

         b. Morris Ryan Litwack, 1:17cr60

         Defendant Litwack is charged with two counts of possessing child pornography, in violation of 18 U.S.C. § 2252A(a)(5)(B). On June 15, 2017, Defendant Litwack filed his Motion to Suppress and Dismiss [# 15]. On June 22, 2017, the Government filed its Response to Defendant Litwack's Motion to Suppress [# 17]. On August 15, 2017, the Court held a joint hearing with the Government and Defendants Hall Litwack. On September 20, 2017, Defendant Litwack filed a Memorandum in Support of his Motion to Dismiss [# 25]. On September 29, 2017, the Government filed a Response to Defendant's Memorandum [# 27]. On November 13, 2017, the Government filed a Supplemental Response [# 32].

         In their Motions to Suppress and Dismiss, Defendants raise two arguments to suppress evidence or otherwise dismiss the cases against them: (1) the warrant from the Eastern District of Virginia, which led to the initial identification of defendants, was defective, overbroad, or void ab initio; and (2) the Government engaged in outrageous conduct.

         II. Factual Background

         a. Special Agent Daniel Alfin and Operation Pacifier

         Defendants called FBI Special Agent Daniel Alfin as a witness. (T. 4)[1] Alfin was the case agent for Operation Pacifier. (T. 5) Operation Pacifier was an investigation into the child pornography website Playpen. (T. 5-6) Created in approximately in 2014, Playpen was hosted on The Onion Router (Tor) network. (T. 6). Tor is free computer software that cloaks users in anonymity. (T. 7-8) Six or seven volunteer computers, called nodes, bounce a user's internet connection potentially anywhere around the world. (T. 27) Thus, Tor users are free to browse the internet and create websites while remaining undetectable because the user does not leave an identifiable footprint. (T. 7-8, 27) The United States has no restrictions regarding access to the Tor network. (T. 9)

         Initially, when Alfin discovered Playpen on the Tor network, there was little possible investigation due to Tor users' anonymity. (T. 11) While determining how to investigate Playpen, the FBI documented the content of the website. (T. 11) In December, 2014, the FBI caught a break. (T. 88) The FBI was able to locate the creator of the Playpen website due to a glitch that revealed the website creator's real Internet Protocol (IP) address. (T. 13-14) With the real IP address, the FBI was able to identify and prosecute Steven Chase as Playpen's creator. (T. 15)

         On February 20, 2015, the FBI took administrative control over Playpen for thirteen days. (T. 18, 38) Prior to the takeover, however, Special Agent Douglas MacFarlane sought a search warrant from a magistrate judge in the Eastern District of Virginia. (T. 19-20) The FBI needed a warrant because even though it could take Playpen over, it still would not be able to identify individual Playpen users. (T. 17, 89) The FBI crafted a method that would allow it to identify individual users using a warrant and called it the Network Investigative Technique (NIT). (T. 19- 20) The NIT warrant specified that the data to be collected included: (1) IP addresses; (2) a unique identifier generated by the NIT to establish the date the website was used; (3) the type of operating system used by the computer; (4) information about whether the NIT had already been delivered to the computer; (5) the computer's host name; (6) the computer's operating system username; and (7) the computer's Media Access Control (MAC) addresses. [1:16cr147 # 18, Ex. 1 at 5] [hereinafter NIT Warrant]. With an IP address, the FBI can request the Internet Service Provider deliver identifying information, such as a home address, which is based on the IP address. (T. 97) A MAC address can narrow down the specific computer used in a household. (T. 99) Individual operating system information can identify a user's account on a computer looking up child pornography. (T. 99) Additionally, the FBI obtained a Title III intercept warrant that allowed the FBI to monitor private conversations between Playpen users who used the website's chat function. (T. 54)

         In order for the FBI to obtain a user's identifying information, several steps needed to happen in order to trigger the NIT. (T. 30, 95) First, a user would have to find Playpen on the Tor network, either through an external link or via a website address consisting of sixteen random characters and ending “.onion”. (T. 96) Second, a user had to log in to Playpen with a user name and password. (T. 30, 95- 96) Third, a the user would need to navigate to a subsection of the website-Playpen had its subsections organized by content. (T. 30, 95-96) Fourth, a user would need to open a thread advertising child pornography from that subsection. (T. 30, 97) If the user downloaded content, that triggered the ability for the FBI to send hidden malware imbedded within the content. [NIT Warrant at 24]. The malware would capture a user's identifying information and transmit it back to the FBI in Virginia. Id. While other theoretical investigative techniques were available, none were likely to be realistically effective and would require a lot of time and money. (T. 117)

         Once the NIT transmitted the identifying information to the FBI in Virginia, that information was given to local FBI field offices. (T. 132) The local FBI offices would begin an investigation and apply for subsequent warrants in their respective districts. (T. 132)

         When the FBI took over Playpen, it was decided that the FBI would operate the website in the Eastern District of Virginia. (T. 20) When the FBI transferred the operation to Virginia, Playpen was taken offline for a couple of hours. (T. 22) Before taking Playpen back online, the FBI presented the NIT warrant to a magistrate in the Eastern District of Virginia. (T. 20-21) The Magistrate Judge was aware that the warrant would allow the capture of information and lead to subsequent prosecutions of individuals outside the district. (T. 20-21)

         Additionally, once the FBI had seized Playpen, it transferred Playpen's content to the National Center for Missing and Exploited Children (NCMEC). (T. 25) NCMEC identifies victims of child pornography and sends out victim notification letters when investigations are ongoing. (T. 25) Further, NCMEC let the FBI know which photos had previously been identified for victim restitution. (T. 129)

         During the thirteen days of FBI takeover, Playpen registered approximately 100, 000 new accounts-though not necessarily new users. (T. 39, 63) From time to time, the original Playpen creator would purge inactive accounts. (T. 63) So while Playpen user accounts increased from 317, 000 accounts to 417, 000 accounts under FBI control, these raw numbers do not reflect necessarily the total real number of Playpen users during its operation. (T. 62-63) Agent Alfin testified that for a website like Playpen, 100, 000 new user accounts in thirteen days was within the realm of normal activity. (T. 64) Both before and after FBI takeover, Playpen had approximately 50, 000 unique visitors a week. (T. 79)

         The only alteration the FBI made to Playpen before taking it over was to remove a section of the website called “Producer's Pen.” (T. 23) This was an area of the website that encouraged users to create new amateur child pornography. (T. 23, 37) To assuage any distrust by Playpen users, the FBI posted that the Producer's Pen section would soon be up and running again. (T. 36-37) Otherwise the website continued as it had before FBI takeover, including fluctuating website speed associated with the Tor network. (T. 25, 40-41, 70) Users remained free to upload and exchange content, including potentially new photos of victims. (T. 28) The FBI did not create new content. (T. 71) The FBI allowed Playpen to continue to function in this way because removing certain amounts or types of content can tip off users that the site is being investigated. (T. 28-29, 94) Agent Alfin testified that regarding consumers of child pornography, users of the Tor network are likely to be more tech savvy compared to non-Tor users. (T. 87)

         After thirteen days of FBI takeover, the FBI had identified approximately 8, 000 individuals to investigate. (T. 46-47) While the FBI could have continued to operate Playpen, 8, 000 new individual investigations, even spread among agencies, was determined to be a reasonable end point. (T. 47-48, 72) The FBI was keenly aware of the tightrope it walked in keeping users in the dark about the takeover. (T. 52) If a user was tipped off, he or she would likely destroy evidence (i.e., hard drive). (T. 84) Before taking down Playpen, the FBI posted to Playpen users that the site was going offline for an upgrade. (T. 85)

         Project Pacifier has led to the worldwide prosecution of over 1, 000 people and the rescue of over 200 victims of child sexual abuse. (T. 72, 103) The FBI continues to prosecute Playpen users from Project Pacifier. (T. 75)

         b. The Eastern District of Virginia and The NIT Warrant

         On February 20, 2015, Agent MacFarlane sought the NIT warrant from a magistrate siting in the Eastern District of Virginia. [NIT Warrant at 2]. The warrant was filed under seal and has been provided with redactions. Id. At that time, Playpen was located in the Eastern District of Virginia. Id. at 4. The warrant stated the places to be searched: activating computers. Id. A computer that operates the Tor network, accesses Playpen, and logs in with a username and password is an “activating computer.” Id. Thus, in order for the NIT to be launched, the computer must first log in to Playpen with a username and password. Id.

         The warrant stated the information to be seized: (1) the activating computer's actual IP address along with the time and date of that determination; (2) a unique identifier generated by the NIT to distinguish date from one activating computer from that of another; (3) the type of operating system used by the computer; (4) information about whether the NIT had already been delivered to the activating computer; (5) the activating computer's host name; (6) the activating computer's operating system username; and (7) the activating computer's MAC addresses. Id. at 5.

         The affidavit outlined the probable cause the FBI had in pursing the warrant. [NIT Warrant at 18]. In September, 2014, the FBI first became aware of Playpen. Id. Playpen's main page included “two partially clothes prepubescent females with their legs spread apart.” Id. Underneath was text stating, “No cross-boards reposts, .7z preferred, encrypt filenames, include preview, Peace out.” Id. Agent MacFarlane stated in his affidavit that these requests of users were tools of the trade for child pornographers. Id. The language represented the website's preferences, including file types and no repeat posts from other child pornography websites. Id. at 18-19. Additionally, once a user clicked the “register an account” hyperlink, Playpen offered a warning. Id. at 19. To access Playpen a user needed to input an email address. Id. The warning stated that a potential user should make a dummy login email address and ...


Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.