United States v. Croghan

973 F.3d 809

UNITED STATES of America, Plaintiff - Appellee

v.Beau Brandon CROGHAN, Defendant - Appellant

No. 18-3709

United States Court of Appeals, Eighth Circuit.

Submitted: May 14, 2020

Filed: August 28, 2020

Counsel who presented argument on behalf of the appellant and appeared on the brief was Bradley Ryan Hansen, AFPD, of Des Moines, IA.

Counsel who presented argument on behalf of the appellee and appeared on the brief was Shelly Sudmann, AUSA, of Council Bluffs, IA.

Before SMITH, Chief Judge, MELLOY and SHEPHERD, Circuit Judges.

SMITH, Chief Judge.

A jury convicted Beau Brandon Croghan of receipt or attempted receipt of child pornography, in violation of 18 U.S.C. § 2252A(a)(2). The district court¹ sentenced Croghan to a below-Guidelines sentence of 110 months' imprisonment. On appeal, Croghan challenges the district court's admission of certain evidence, the sufficiency of the evidence, and his sentence. We affirm.

I. Background²

A. The Tor Network

Croghan's offense occurred using the Tor network.³ The Tor network is "a network that runs on top of the regular Internet" and operates as "a series of different computers that are all around the world." Trial Tr., Vol. I, at 41, United States v. Croghan , No. 1:15-cr-00048-SMR-HCA-1 (S.D. Iowa Aug. 20, 2018), ECF No. 127. When a user connects to a website through the Tor network, the user's Internet Protocol (IP) connection is bounced through multiple computers. The user's IP address appears as the last computer funneled through the series of interconnected computers. A user must download special software and install the Tor browser on his or her computer to access the Tor network. Once the user downloads the software, he or she "can use the Tor network to access websites without revealing to those websites where [the user] actually [is]." Id. at 43. The user's IP address is unavailable, and the user remains anonymous.

"[T]he Tor network [also] has a feature which is known as Tor hidden services." Id. at 44. This feature allows the user to host a website with the same anonymity by protecting the website administrator's IP address. The website's physical location is unknown. In addition, Tor hidden services also allow the users who are accessing the website's location to be hidden. As a result, these users are "able to communicate with each other through the Tor network without ever revealing to each other where the other is in the real world." Id. at 45.

"Tor hidden services are very heavily utilized for all types of criminal activity." Id. at 50. For example, "Tor hidden services [are used] to create child pornography websites." Id. With Tor hidden services, the uniform resource locator used to access a website is "16 randomly generated letters and numbers." Id. at 46. "Within the Tor network, a user generally has to know the 16-digit or character string for a hidden service that [he or she] want[s] to access." Id. at 48–49.

B. Playpen

In August 2014, the FBI became aware of a Tor hidden service website called Playpen and began monitoring it. "Playpen was a message board-type website where people would distribute and share images and videos of child pornography." Id. at 51. Playpen "had hundreds of thousands of members" with "tens of thousands of images and videos of child pornography being shared and distributed." Id. at 52.

FBI Special Agent Daniel Alfin ("SA Alfin") was one of the agents charged with monitoring Playpen from August to December 2014. SA Alfin set up user accounts on Playpen to surveil the activity on the website. He testified that a user needed to install the Tor browser, navigate to Playpen via the 16-digit random code, and register a user account with Playpen. A user registered with Playpen by entering an e-mail address, user name, and password. Playpen encouraged anonymity by warning new users to use a fake e-mail address during the registration process. Once logged in, the user was taken to the website's index page "contain[ing] links to all of the different parts of the Playpen website, and those links were all broken down by categories like boys, girls, toddlers, incest, [etc.]" Id. at 59. The user then clicked on one of the categories displayed on the index page and was taken to the category's subforum. The subforum contained a listing of different postings that Playpen's members had created. Each of the "postings ... ha[d] titles indicative of the types of images or videos that that user was sharing." Id. of 65. After clicking on one of the topics, the user "would enter that actual posting, and at that point typically ... would see images of child pornography on [his or her] computer screen and links to download full videos." Id. SA Alfin testified that "[w]hen the image is displayed on [the user's] computer screen, that means it's been downloaded to [the user's] computer over the Internet, and now it's there on [the user's] computer screen for [the user] to see." Id. at 66. SA Alfin confirmed that when the image appears on the user's computer screen, the user has "received whatever image [the user] clicked on." Id. In summary, SA Alfin explained, the child-pornography

images were embedded within [the] post so when the user clicked on that particular post, these full-sized images were within that post and would have been downloaded to [the user's] computer and displayed on the computer screen without additional action being taken. The action to view the images was clicking on [the] post.

Trial Tr., Vol. II, at 111, United States v. Croghan , No. 1:15-cr-00048-SMR-HCA-1 (S.D. Iowa Aug. 21, 2018), ECF No. 128. The computer downloaded the file to the temporary storage of the user's computer, and the image displayed on the computer.

In December 2014, Playpen's administrator misconfigured the website. As a result, when the user entered a valid e-mail address, the user received a confirmation e-mail sent over the regular Internet, not the Tor network. The confirmation e-mail showed the actual IP address for Playpen. The FBI identified Playpen's administrator and arrested him. Following the administrator's arrest, the FBI assumed administrative control of Playpen via a court order. The FBI continued operating the website in an attempt to identify Playpen's users.

The FBI administered Playpen from February 20, 2015, to March 4, 2015—a period of 13 days. The FBI obtained a search warrant authorizing a search of Playpen users' computers through the use of a Network Investigative Technique (NIT). The NIT sent a hidden computer code to Playpen users' computers that instructed the computers to transfer identifying information back to an FBI computer over the regular Internet. This identifying information included the IP address, operating system information, operating system username, and Media Access Control (MAC) address of the user's computer.

C. Croghan's Conduct

During the 13-day period, the FBI successfully identified a user in Council Bluffs, Iowa. The user was "Beau2358." The e-mail address associated with Beau2358 was cbbarscene@gmail.com, and Beau2358's password for the Playpen account was gargoyle62. Beau2358 registered with Playpen on September 27, 2014. Beau2358 logged in to Playpen on four dates during the FBI's 13-day operation: February 20, 2015; March 1, 2015; March 3, 2015; and March 4, 2015. Beau2358 was actively logged in to Playpen for over 13 hours between September 27, 2014, and March 4, 2015. Beau2358 accessed 51 topics with over 600 images of child pornography while the NIT was active.

Through the NIT, the FBI "obtained the real IP address that Beau2358 was using to access the Playpen website." Trial Tr., Vol. I, at 77–78. The IP address associated with this user was 68.227.166.242 and was operated by Cox Communications. The IP address was registered to Croghan at his residence in Council Bluffs, Iowa. The host name for the computer was "Beaus." The MAC address⁴ for the computer used to access Playpen was the 12-character unique address, 24FD523B41C0. SA Alfin confirmed that the MAC address from the NIT matched the Toshiba laptop computer seized from Croghan's residence on July 21, 2015.

SA Alfin confirmed that Beau2358 "accessed" or "looked at" several different sections of Playpen: Preteen HardCore, Infants and Toddlers, Incest, and Jail Bait. Trial Tr., Vol. II, at 121. SA Alfin testified that, for example, "Beau2358 went into the Pre-teen hard core section" and "clicked on a topic."⁵ Id. at 113. SA Alfin confirmed that Beau2358 "received ... child pornography" once he "click[ed] on to the next screen" where the "first image c[ame] up or a group of images." Id. "[A]ll of the images in the posting [were] downloaded to [Beau2358's] computer over the Internet." Id. at 114; see also id. at 142 (confirming that once a user "click[s] on an image and view[s] it, [the user has] received it," "whether or not [the user] save[s] a copy to look at later"). These images "depict[ed] prepubescent children engaged in sexual activity." Id. at 114.

Special Agent Jacob Foiles ("SA Foiles") was assigned as the case agent for Beau2358. SA Foiles had to verify that "the subscriber, Beau Croghan, still reside[d] at [the Council Bluffs] address." Id. at 150. SA Foiles conducted "basic database checks, employment checks, driver's license checks," and "limited surveillance" and learned that Croghan and his wife still resided at the address provided by Cox Communications. Id. During the surveillance, SA Foiles located a wireless network that was password protected and associated with Croghan's residence and the Cox Communications subscriber subpoena.

SA Foiles also conducted an open-source internet search on Beau2358 and discovered that a user account on PrimeJailBait.com matched the user name from Playpen. Beau2358 had uploaded five images on PrimeJailBait.com. The open-source internet search also uncovered "a blog posting that was reportedly authored by a Beau Croghan." Id. at 151. In that blog post, the author mentioned that he was interested in...