United States v. Sanders

107 F.4th 234

UNITED STATES of America, Plaintiff - Appellee, v. Zackary Ellis SANDERS, Defendant - Appellant.

No. 22-4242

United States Court of Appeals, Fourth Circuit

Argued: March 22, 2024

Decided: July 9, 2024

Appeal from the United States District Court for the Eastern District of Virginia, at Alexandria. T. S. Ellis III, Senior District Judge. (1:20-cr-00143-TSE-1)

ARGUED: Lawrence Robbins, FRIEDMAN KAPLAN SEILER ADELMAN & ROBBINS LLP, New York, New York, for Appellant. Joseph Attias, OFFICE OF THE UNITED STATES ATTORNEY, Richmond, Virginia, for Appellee. ON BRIEF: Brandon L. Arnold, Leslie C. Esbrook, KRAMER LEVIN ROBBINS RUSSELL, Washington, D.C., for Appellant. Jessica D. Aber, United States Attorney, Aidan Taft Grano-Mickelsen, Assistant United States Attorney, Richmond, Virginia, William G. Clayman, Special Assistant United States Attorney, Jay V. Prabhu, Assistant United States Attorney, Seth M. Schlessinger, Assistant United States Attorney, OFFICE OF THE UNITED STATES ATTORNEY, Alexandria, Virginia, for Appellee.

Before NIEMEYER, KING and BENJAMIN, Circuit Judges.

Affirmed by published opinion. Judge King wrote the opinion, in which Judge Niemeyer and Judge Benjamin joined.

KING, Circuit Judge:

Following a jury trial in October 2021 in the Eastern District of Virginia, defendant Zackary Ellis Sanders was convicted of five offenses involving the illegal production of child pornography, six offenses involving the illegal receipt of child pornography, and a single offense for illegal possession of child pornography. The district court sentenced Sanders to 216 months in prison. Sanders now pursues a multifaceted appeal, maintaining that the court committed reversible error at nearly every stage of the underlying proceedings.

Sanders's appellate contentions broadly manifest in four different forms — first, that the district court erred in denying motions to suppress evidence seized pursuant to a search warrant for his residence, plus Sanders's related efforts to inquire into alleged misrepresentations in the affidavit supporting the issuance of that warrant; second, that the court erred in admitting statements Sanders made to FBI agents during the search of his residence; third, that the court improperly excluded purported evidence of the victims' voluntary participation in the production of child pornography, including expert testimony about a so-called "BDSM culture;"¹ and, fourth, that the court erred in giving three types of challenged jury instructions.

As explained herein, we reject each of Sanders's appellate contentions and affirm the judgment of the district court.

I.

Before reviewing the procedural history and assessing the legal issues presented, we will summarize the pertinent facts. The facts and reasonable inferences drawn therefrom are recited in the light most favorable to the Government, as the prevailing party at trial and in the suppression proceedings. See United States v. Burgos, 94 F.3d 849, 854 (4th Cir. 1996) (regarding jury verdict); United States v. Jones, 356 F.3d 529, 533 (4th Cir. 2004) (regarding suppression hearing).

A.

1.

In August 2019, a law enforcement agency in another country (the "Foreign Agency") provided an intelligence report to the FBI, advising that a specific Internet Protocol address (an "IP address") had accessed "child sexual abuse and exploitation material."² See J.A. 1406.³ The report of the Foreign Agency further advised that this particular IP address, on May 23, 2019, at approximately 10:00 PM EST:

[W]as used to access online child sexual abuse and exploitation material, with an explicit focus on the facilitation of sharing child abuse material (images, links and videos), emphasis on BDSM, hurtcore, gore, and death-related material including that of children. Users were required to create an account (username and password) in order to access the majority of the material.

Id. (the "August Report").⁴

A month later, in September 2019, the FBI received a second report from the Foreign Agency. This submission represented to the FBI that the information provided in the August Report was "lawfully obtained" pursuant to a warrant. See J.A. 1408. Additionally, it advised that "at no time was any computer or device interfered with in the United States," and that the Foreign Agency "did not access, search or seize any data from any computer in the United States." Id.

Soon thereafter, the Foreign Agency named and described the website that the subject IP address had used to access the child pornography — entitled "Hurt Meh." The Hurt Meh website is a so-called "TOR hidden service." The term "TOR" is a reference to the TOR network — a unique network that routes an Internet user's communications over the Internet through a randomly assigned path of relay computers. The purpose of the TOR network is to mask the IP address of the Internet user.

If an Internet user wishes to access the TOR network, he must use the "TOR browser" — which can be obtained for free by downloading it from the private entity that maintains the TOR network. When using the TOR browser, an Internet user can access "open" Internet websites — such as google.com or wikipedia.org. The TOR browser, however, makes it possible for users to access websites that are accessible only to users operating within the TOR network. These TOR-based websites are called "hidden services." See J.A. 1443. And, as identified above, Hurt Meh was one of these hidden services.

There are additional differences between TOR-based hidden services and open websites. The website addresses of a TOR hidden service are comprised of a string of randomly generated characters followed by an ".onion" suffix. The nature of hidden TOR-based services means that they are "much more difficult" to locate through a typical Internet search, as compared to an open Internet website. See J.A. 1448. Usually, to locate a specific hidden service, a TOR user would have to access a TOR directory — which is also a TOR hidden service — that would identify and advertise the web addresses for multiple other hidden services. These combined features create anonymity and obscurity, making TOR hidden services, the TOR browser, and the TOR network, very appealing vehicles for criminal activity. They have particularly been a boon for the online sexual exploitation of children.

Hurt Meh is one such website. It is an online bulletin board, dedicated to the advertisement and distribution of child pornography, and it was operational from July 2016 until June 2019.⁵ The homepage for the Hurt Meh website contained a search bar and various links, including a link titled "Announcements." See J.A. 1777. If a TOR user clicked on the "Announcements" link, a message called "Welcome, Please read before registering" would be visible. Id. at 1444. The content of the message provided:

Welcome abusers and abusees and those that enjoy watching. This website was created to host videos, photos and discussions of 18 (twinks) and younger of Hurtcore materials (videos & pictures) as well as discussion of such . . . . PS Please register to see all the forums, and use strong password for user profile.

Id. No pornographic material was displayed on Hurt Meh's homepage. To access such material, the TOR user had to create a username and password.

The FBI was well aware of the above-described nature of Hurt Meh and TOR when it received the initial reports from the Foreign Agency. Notably, the FBI and other domestic law enforcement agencies had a longstanding relationship with the Foreign Agency and had developed a regular and mutually beneficial practice of sharing reliable investigative information concerning TOR users who appear to be engaged in online sexual exploitation. See J.A. 1448.

2.

Based on the foregoing, the FBI opened an investigation into the IP address identified in the August Report. The IP address was associated with an 11,000-square-foot mansion in McLean, Virginia, where the then 24-year-old defendant Zackary Sanders was known to reside with his parents. As part of the investigation, FBI Special Agent Ford prepared a 36-page affidavit (the "Affidavit"), summarizing not only the FBI's investigation, but also, inter alia, the nature of Hurt Meh, the TOR network, and the various reports received from the Foreign Agency. Of relevance to Sanders's appellate contentions today are the Affidavit's ¶¶ 23 and 25, which specify information contained in the Foreign Agency's shared reports and domestic law enforcement's relationship with the Foreign Agency. Those two paragraphs of Agent Ford's Affidavit relate, in relevant part:

23. In August 2019, [the Foreign Agency] . . . notified the FBI that the [Foreign Agency] determined that on May 23, 2019, a user of IP address [omitted] accessed online child sexual abuse and exploitation material via a website that the [Foreign Agency] named and described as [Hurt Meh].

25. The [Foreign Agency] . . . advised U.S. law enforcement that it obtained that information through independent investigation that was lawfully authorized in the [Foreign Agency]'s country pursuant to its national laws. The [Foreign Agency] further advised U.S. law enforcement that the [Foreign Agency] had not interfered with, accessed, searched, or seized any data from any computer in the United States in order to obtain that IP address information.

See J.A. 1447-48.

The Affidavit also describes pertinent characteristics of individuals who access child pornography on the Internet. Such persons, according to the Affidavit, may electronically possess, collect, and maintain such materials. Those materials are stored electronically, thereby making evidence of such activity, including even deleted child pornography, recoverable on those individuals' computers for a long period.

On February 10, 2020 — approximately nine months after the target IP address had accessed the Hurt Meh website — the FBI submitted Agent Ford's Affidavit to the district court in Eastern Virginia, and requested...