United States v. White, CRIMINAL ACTION 3:21-cr-155-DJH

UNITED STATES OF AMERICA, Plaintiff, v. JOSHUA WHITE, Defendant.

CRIMINAL ACTION No. 3:21-cr-155-DJH

United States District Court, W.D. Kentucky, Louisville Division

March 9, 2022

MEMORANDUM OPINION AND ORDER

David J. Hale, Judge United States District Court

Defendant Joshua White moves to suppress evidence seized by law enforcement officers during a search of his residence asserting several defects in the warrant authorizing the search. (Docket No. 23) The United States opposes White's motion, arguing that the warrant was valid. (D.N. 31) For the reasons discussed below, the Court will deny White's motion to suppress.^[1]

I.

On February 8, 2021, Homeland Security Investigations Special Agent John C. Koski, Jr. submitted an affidavit in support of a warrant to search White's residence, which the magistrate judge granted. (D.N. 23-1) The affidavit alleged that a foreign law enforcement agency had notified the Federal Bureau of Investigation that an IP address^[2] located in the United States “access[ed]” the “Target Website, ” an online channel for users to “share and distribute child pornography.”^[3] (D.N. 23-1, PageID # 84, 89) The Target Website operated on the “Tor network, ” which is a computer network designed to facilitate anonymous communication over the Internet. (Id., PageID # 82) The Tor network masks a Tor user's IP address so that website operators cannot trace the address to the user. (Id.) To access the Tor network, a user must install Tor software, which is most easily accomplished by downloading a “Tor browser.” (Id.) The Tor network may be used to access open-Internet websites like www.uscourts.gov or websites that operate exclusively on the Tor network, which are also known as “hidden” or “onion” services. (Id., PageID # 83)

Unlike an open-Internet website, the Uniform Resource Locator (URL) or web address of a hidden service is made up of sixteen or fifty-six randomized characters, which a user must know exactly to access the website. (Id., PageID # 82 84) This makes hidden services such as the Target Website “much more difficult, if not impossible” to find accidentally or through a traditional search engine. (Id., PageID # 88, 91) Users interested in accessing a particular hidden service therefore usually find the URL through either an individual who knows the URL or another hidden service. (Id., PageID # 88, 91-92) Some hidden services operate as “directory sites” by maintaining a list of links to other hidden services. (Id.) The affidavit noted that the Target Website was listed on at least one directory site that “advertis[ed] hidden services dedicated to the sexual exploitation of children.” (Id., PageID # 88-89)

The Target Website homepage could be accessed only if a Tor user knew the specific randomized URL and registered for an account. (Id., PageID # 85, 91) Registration was free and required the user to create a “nickname” and a password. (Id., PageID # 85) The registration page stated, “No hurtcore, No. gore, No. zoo, No death, No. toddlers”^[4] and “Post links with good photos and videos.” (Id., PageID # 84) Once a user registered and logged onto the Target Website, the user could view the homepage, which “stated that the site was intended for users to ‘post links with good photos and videos' depicting ‘[o]nly GIRLS 5 to 13 years [old].'” (Id., PageID # 84, 91) The Target Website contained chat rooms where users could communicate with one another. (Id., PageID # 84) It also advertised links to four other hidden services, which included descriptions such as “Forum for boy-and-girlovers” and “Girls pedo portal.” (Id., PageID # 87- 88) Registered users could view a “photo archive” of images and upload links to their own digital images. (Id., PageID # 88) Law enforcement officers accessed and downloaded child pornography images via these links. (Id., PageID # 88, 90)

A foreign law enforcement agency investigating the Target Website notified the FBI that a United States-based IP address accessed the Target Website on April 11, 2019. (Id., PageID # 89, 93) The affidavit stated that the foreign agency had “a history of providing reliable, accurate information” and discovered the IP address through an investigation “that was lawfully authorized in the [foreign agency's] country pursuant to its national laws.” (Id., PageID # 89-90) The affidavit further noted that the foreign agency did not access, search, or seize “any data from any computer in the United States” to obtain the IP address and that United States law enforcement did participate in the foreign agency's investigation. (Id., PageID # 90-91) The FBI ultimately identified White as the account holder of the IP address, and Koski submitted a warrant affidavit, asserting that there was probable cause to believe that White had accessed with the intent to view child pornography. (Id., PageID # 93) The affidavit did not state how long White allegedly accessed the Target Website. (See D.N. 23-1)

On February 8, 2021, a magistrate judge issued a warrant to search White's residence and seize any computer systems found on the premises. (Id., PageID # 93, 104) The FBI executed the search on February 17, 2021. (D.N. 31, PageID # 126) On December 7, 2021, White was charged with accessing with intent to view child pornography and possession of child pornography under 18 U.S.C. § 2252A(a)(5)(B). (See D.N. 1) White moves to suppress the evidence obtained through the search, contending that the warrant failed to establish probable cause; the warrant was stale; and the foreign agency's investigation violated the Fourth Amendment. (D.N. 23) The United States opposes the motion. (D.N. 31)

II.

A. Probable Cause

Absent exigent circumstances, the Fourth Amendment requires law enforcement officers to obtain a warrant based on probable cause “from a neutral and disinterested magistrate before embarking upon a search.” Franks v. Delaware, 438 U.S. 154, 164 (1978). “A police officer has probable cause to conduct a search when the facts available to [the officer] would warrant a person of reasonable caution in the belief that contraband or evidence of a crime is present.” Florida v. Harris, 568 U.S. 237, 243 (2013) (alterations and internal quotation marks omitted). Probable cause “requires only a probability or substantial chance of criminal activity” and “depends on the totality of the circumstances.” United States v. Tagg, 886 F.3d 579, 585 (6th Cir. 2018) (quoting District of Columbia v. Wesby, 138 S.Ct. 577, 586 (2018)) (internal quotation marks omitted). “[T]he relevant inquiry” in a probable-cause determination “is not whether particular conduct is ‘innocent' or ‘guilty,' but the degree of suspicion that attaches to particular types of noncriminal acts.” Id. at 586 (quoting Wesby, 138 S.Ct. at 588) (internal quotation marks omitted). “Therefore, ‘[p]robable cause is not a high bar.'” Id. at 585 (alteration in original) (quoting Wesby, 138 S.Ct. at 586). Additionally, the issuing judge's determination “should be paid great deference, ” Illinois v. Gates, 462 U.S. 213, 236, (1983), and “be left undisturbed if there was a ‘substantial basis' for the probable-cause finding.” Tagg, 886 F.3d at 586 (quoting Gates, 462 U.S. at 238-39; United States v. King, 227 F.3d 732, 739 (6th Cir. 2000)).

White argues that the warrant affidavit failed to establish probable cause because it asserted that the Target Website did not itself contain child pornography-rather, it housed only “links to other sites alleged to contain [child] exploitative materials.” (D.N. 23, PageID # 67) White contends that without an allegation that he viewed or downloaded child pornography, merely “accessing” a website that allegedly contains links to child pornography websites is insufficient to establish probable cause. (Id.) Contrary to White's contention, however, the affidavit asserted that White accessed the Target Website and that Special Agents were able to download child pornography images directly from the Target Website. (D.N. 23-1, PageID # 88, 90; see D.N. 23, PageID # 67)

Further, the Sixth Circuit's decision in Tagg forecloses the argument that merely visiting a child-pornography website does not establish probable cause. 886 F.3d at 584. In Tagg, the court held that a warrant affidavit established probable cause when it alleged that the defendant spent five hours browsing a Tor-network child pornography website but did not assert that he viewed or downloaded any images. Id. Importantly, the court noted that “visiting or subscribing to a website containing child pornography creates a reasonable inference that the user has stored child pornography on their computer.” Id. at 586. The court based its decision in part on the unlikelihood that the defendant “stumbled upon [the Tor-based website] by accident, ” giving rise to “an inference that [he] deliberately accessed” the site. Id. at 587.

Similarly the warrant affidavit in this case described how accessing the Target Website “require[s] numerous affirmative steps by [a] user.” (D.N. 23-1, PageID # 92) A user must first download and install the Tor browser. (Id., PageID # 82) The user must also know the exact sixteen or fifty-six “algorithm-generated characters” of the Target Website, a hidden service. (Id., PageID # 84) As previously explained, a user cannot find this random combination through a traditional search engine like Google. (Id.) Rather, users usually locate the website address through either “someone ‘on the inside' who c[an] provide the exact sequence of numbers and letters to enter, ” Tagg, 886 F.3d at 587, or a directory site, a hidden service that list links to other hidden services. (D.N. 23-1, PageID # 91-92) Additionally, a user must register for an account, which requires creating a nickname and...