United States v. Pawlak, Criminal No. 3:16–CR–306–D(1)

237 F.Supp.3d 460

UNITED STATES of America, Plaintiff,

v.Daryl Glenn PAWLAK, Defendant.

Criminal No. 3:16–CR–306–D(1)

United States District Court, N.D. Texas, Dallas Division.

Signed February 17, 2017

Jamie Lynn Hoxie, United States Attorneys Office, Dallas, TX, for Plaintiff.

MEMORANDUM OPINION AND ORDER

SIDNEY A. FITZWATER, UNITED STATES DISTRICT JUDGE

The instant motions to suppress and dismiss the indictment challenge the Federal Bureau of Investigation's ("FBI's") seizure of a computer server that hosted a child pornography website called "Playpen," and the FBI's ensuing operation of the website on a government server. Following a hearing, and for the reasons that follow, the court denies defendant Daryl Glenn Pawlak's ("Pawlak's") motions.¹

I

The facts of this case that are material to the court's decision are undisputed.² In early 2015, acting on a tip from a foreign law enforcement agency, the FBI located and seized a computer server that contained a child pornography website called Playpen. Playpen existed as a hidden website on the Tor Network,³ also known as the dark web. Through sophisticated encryption, the Tor Network anonymizes and actively conceals identifying information about website users, including a user's true Internet Protocol ("IP") address. To access Playpen, it was necessary for users to know the website's address on the Tor Network. Users could not, for example, stumble upon Playpen while browsing the Internet. Once on the Playpen website, users logged in with dedicated usernames and passwords. Playpen offered users various forums for different child pornography topics, including "Incest" and "Toddlers." Inside each forum were discussion posts, images, and videos related to the particular topic.

Because the Tor Network anonymizes its users, the FBI could not uncover who was operating or accessing the Playpen website through normal investigative techniques. The FBI devised a plan to investigate Playpen's users, who would normally be untraceable. The plan called for the FBI to copy the Playpen server and continue to operate the Playpen website on the FBI server. While operating the website, the FBI would use a network investigative technique ("NIT") that allowed it to retrieve information from the computers of the persons who logged in to the Playpen website. The NIT—computer code developed by the FBI—would be attached to various files uploaded to Playpen. When the website user downloaded a file, the NIT would force the user's computer to send to the FBI the user's actual IP address and other identifying information. With the actual IP address, the FBI could identify and locate the user.

Acting according to the plan, the FBI copied the Playpen server and brought it to a government facility located in the Eastern District of Virginia. On February 20, 2015 the FBI applied for and obtained from a United States Magistrate Judge of the Eastern District of Virginia a search warrant (the "NIT Warrant") authorizing the FBI to deploy the NIT program for a period of up to 30 days. The FBI also obtained from a United States District Judge a Title III order authorizing the FBI to intercept private messages and private chats in real time on the Playpen website. But the government acknowledges that Pawlak's username did not engage in private messages or chats during the period of time the FBI monitored communications under the Title III order.

On or about March 4, 2015, Pawlak accessed the Internet from his residence using a laptop computer that his employer, Sigma Cubed, had issued. Using the Tor Network, he logged in to the Playpen website and clicked on a post entitled, "My daughter 5yo-photo 2015." As the content from this post downloaded onto the laptop, the NIT computer code was sent automatically. The NIT relayed Pawlak's IP address and other information back to the FBI in the Eastern District of Virginia.

Based on this information, the FBI issued a subpoena to AT & T, the Internet service provider connected with Pawlak's IP address, and learned that Pawlak's wife was the account holder associated with the address. The FBI obtained a warrant to search Pawlak's residence, but it did not find computers containing child pornography. While executing the warrant, agents called Pawlak's wife's cell phone, and Pawlak answered. He volunteered the details of how he accessed and viewed child pornography. Thereafter, the FBI contacted Pawlak's current employer, Independence Oil Field Chemicals, and his previous employer, Sigma Cubed, to request access to the work computers issued to him. The companies granted permission, and upon searching these computers, the FBI found hundreds of images of child pornography.

The grand jury later indicted Pawlak for the offenses of receipt of child pornography, in violation of 18 U.S.C. § 2252A(a)(2)(A), and possession of child pornography involving a prepubescent minor, in violation of 18 U.S.C. § 2252A(a)(5)(B). Pawlak moves to suppress all information obtained by the NIT that was authorized pursuant to the application for Title III interception on or about February 20, 2015 in the Eastern District of Virginia and the application for the search of computers that access the Playpen website on or about February 20, 2015. He also moves to dismiss the indictment. The government opposes both motions.

II

The court first considers Pawlak's motion to suppress evidence that he alleges was collected in violation of the Fourth Amendment.⁴

The general rule under the Fourth Amendment is that searches of private property are reasonable if conducted pursuant to a valid warrant issued upon probable cause. See, e.g., Katz v. United States , 389 U.S. 347, 357, 88 S.Ct. 507, 19 L.Ed.2d 576 (1967). "A defendant normally bears the burden of proving by a preponderance of the evidence that the challenged search or seizure was unconstitutional." United States v. Waldrop , 404 F.3d 365, 368 (5th Cir. 2005) (citing United States v. Guerrero–Barajas , 240 F.3d 428, 432 (5th Cir. 2001) ). "The exclusionary rule prohibits introduction at trial of evidence obtained as the result of an illegal search or seizure." United States v. Runyan , 275 F.3d 449, 466 (5th Cir. 2001). The exclusionary rule also "encompass[es] evidence that is the indirect product or ‘fruit’ of unlawful police conduct." Id. (citing Wong Sun v. United States , 371 U.S. 471, 488, 83 S.Ct. 407, 9 L.Ed.2d 441 (1963) ).

III

The court considers first the legality of the search. Pawlak contends that the search was unlawful because it exceeded the scope of the NIT Warrant. Pawlak maintains that the warrant "states that the property to be seized—the data including the identifiers from the Activating Computers—was ... located in the Eastern District of Virginia," and authorized a search only of "one FBI computer server located in the Eastern District of Virginia hosting child pornography." D. Br. 13–14. This is a mischaracterization of the NIT Warrant.

The NIT Warrant includes a standard court form that incorporates Attachments A and B. Although the form states that the property is located in the Eastern District of Virginia, it also specifically cites, and implicitly incorporates, Attachments A and B. Attachment A, entitled "Place to be Searched," provides that the NIT warrant authorizes the use of an NIT to be deployed on the computer server described in Attachment A to obtain information described in Attachment B from the activating computers described in Attachment A. Attachment A identifies the computer server as "the server operating the Tor network child pornography website referred to herein as the TARGET WEBSITE, as identified by its URL [website redacted by the court] which will be located at a government facility in the Eastern District of Virginia." Gov't Br. Attach. A at 4. Attachment A identifies the "[t]he activating computers" as "those of any user or administrator who logs into the TARGET WEBSITE by entering a username and password." Id. Attachment B, entitled "Information to be Seized," provides that specific information is to be seized "[f]rom any ‘activating’ computer described in Attachment A." Gov't Br. Attach. B at 5. The NIT Warrant therefore authorizes the search and seizure of the server operating the Tor Network child pornography website, which is located at a government facility in the Eastern District of Virginia, and the activating computers, wherever located. It is not limited in scope to one FBI computer server located in the Eastern District of Virginia.⁵

IV

Pawlak also challenges the validity of the NIT Warrant on the ground that it was an improper general warrant.

A

Under the Fourth Amendment, "no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." U.S. Const. amend. IV. "Because indiscriminate searches and seizures conducted under the authority of ‘general warrants' were the immediate evils that motivated the framing and adoption of the Fourth Amendment, that Amendment requires that the scope of every authorized search be particularly described." Walter v. United States , 447 U.S. 649, 657, 100 S.Ct. 2395, 65 L.Ed.2d 410 (1980) (internal quotation marks and citation omitted). "The requirement that warrants shall particularly describe the things to be seized makes general searches under them impossible and prevents the seizure of one thing under a warrant describing another." Marron v. United States , 275 U.S. 192, 196, 48 S.Ct. 74, 72 L.Ed. 231 (1927). In other words, the Fourth Amendment proscribes "issuance of general warrants allowing officials to burrow through a person's possessions looking for any evidence of a crime." United States v. Kimbrough , 69 F.3d 723, 727 (5th Cir. 1995) (citing Andresen v. Maryland , 427 U.S. 463, 480, 96 S.Ct. 2737, 49 L.Ed.2d 627 (1976) ). For example, in United States v. Quinlan , 149 F.3d 1179, 1998 WL 414295, at *1(5th Cir. 1998) (per curiam) ...