United States District Court, D. Massachusetts
MEMORANDUM AND ORDER
ALLISON D. BURROUGHS, U.S. DISTRICT JUDGE.
September 3, 2015, a grand jury returned a three-count
indictment against Defendant Richard Allain
(“Allain”). The indictment charged Allain with
one count of possession of child pornography, in violation of
18 U.S.C. §§ 2252A(a)(5)(B) and (b)(2), and two
counts of receipt of child pornography, in violation of 18
U.S.C. §§ 2252A(a)(2) and (b)(1). Currently pending
are Allain's Motion to Suppress [ECF No. 60] and Motion
to Dismiss Count II of the Indictment [ECF No. 62]. Both of
the pending motions relate to the FBI's 2015
investigation into “Playpen, ” a website that
facilitated the distribution of child pornography.
early 2015, after a foreign law enforcement agency informed
the FBI that it suspected a United States-based IP address
was being used to run Playpen, the FBI seized a copy of the
server hosting the site. Rather than immediately shut down
Playpen, the FBI continued to operate it for two weeks, in
order to identify users of the site. Because Playpen operated
on the “Tor” network-a network designed to
maintain a user's anonymity-the FBI could not easily
identify Playpen users, even after it had seized control of
the website. To advance its investigation, the FBI obtained a
search warrant (the “NIT Warrant”) authorizing it
to deploy a “Network Investigative Technique”
(“NIT”) onto any computers used to log into
Playpen. By installing the NIT onto Playpen users'
computers, the FBI could identify the IP addresses, and
eventually the individuals, that logged into the site. The
NIT Warrant has already been subject to significant judicial
scrutiny across the country. A majority of courts have found
that the magistrate judge who issued the NIT Warrant lacked
authority to do so, yet declined to suppress evidence.
See, e.g., United States v. Ammons, No.
3:16-CR-00011-TBR-DW, 2016 WL 4926438 (W.D. Ky. Sept. 14,
2016); United States v. Henderson, No.
15-CR-00565-WHO-1, 2016 WL 4549108 (N.D. Cal. Sept. 1, 2016);
United States v. Michaud, No. 3:15-CR-05351-RJB,
2016 WL 337263 (W.D. Wash. Jan. 28, 2016). A minority of
courts have suppressed evidence based on a finding that the
warrant was void and the good-faith exception to the
exclusionary rule did not apply. See, e.g.,
United States v. Levin, No. CR 15-10271-WGY, 2016 WL
2596010 (D. Mass. May 5, 2016); United States v.
Croghan, No. 1:15-CR-48, 2016 WL 4992105 (S.D. Iowa
Sept. 19, 2016).
about February 27, 2015, after Allain logged into Playpen,
the NIT was installed onto his computer, located in
Framingham, Massachusetts. The information gathered by the
FBI from Allain's computer forms the basis of Count 2 of
the Indictment. [ECF No. 17].
April 27, 2016, Allain filed his Motion to Suppress, in which
he moves for an order suppressing all evidence obtained by
the government using the NIT Warrant. [ECF No. 60]. Allain
raises five independent grounds for suppressing the evidence.
He contends that the NIT Warrant was: (1) not supported by
probable cause; (2) issued only after the FBI intentionally
and recklessly misled the issuing court; (3) an impermissible
general warrant; (4) contingent on a “triggering
event” that did not occur; and (5) void ab
initio, since the issuing magistrate judge did not have
authority to issue it. In his Motion to Dismiss Count II of
the Indictment, also filed on April 27, 2016, Allain claims
that by continuing to operate Playpen during its
investigation, and therefore briefly facilitating the
distribution of child pornography, the government engaged in
outrageous misconduct that warrants dismissal of the
resulting charge. [ECF No. 62]. The government filed separate
oppositions to the two motions on June 17, 2016 [ECF Nos. 69,
70], and the Court heard oral argument on July 18, 2016. [ECF
No. 76]. After oral argument, the government filed three
addendums to its response to Defendant's Motion to
Suppress [ECF Nos. 74, 77, 79], the second of which the
Defendant has moved to strike. [ECF No. 78]. In addition, the
Defendant filed a supplemental memorandum in support of his
Motion to Dismiss [ECF No. 82], and a supplemental memorandum
in support of his Motion to Suppress [ECF No. 83].
reasons stated herein, both motions are hereby
The Warrant and Relevant Factual Background
February 20, 2015, FBI Special Agent Douglas Macfarlane filed
an application for a search warrant in the Eastern District
of Virginia. [ECF No. 61-2 (the “Warrant
Application”)].The subject of that warrant was
“Playpen, ” a website “dedicated to the
advertisement and distribution of child pornography”
and “the discussion of matters pertinent to child
sexual abuse.” Playpen operated on the Tor network.
Typically, visitors to a public website can be identified by
their IP address, but on the Tor network, IP addresses are
masked, thus enabling users to access websites anonymously.
To access the Tor network, a user must install Tor software
either by downloading an add-on to their web browser or by
downloading the free “Tor browser bundle.”
Id. ¶ 7.
Playpen operated as a “hidden service” within the
Tor network. Id. ¶ 6. Hidden websites within
Tor operate the same as other public websites except that the
IP address for the web server is hidden and replaced with a
Tor-based web address, which is a series of sixteen
algorithm-generated characters followed by the suffix
“.onion.” Thus, at the time the Warrant
Application was submitted, the web address for Playpen was
upf45jv3bziuctml.onion. Id. As described in the
Warrant Application, “[a] user can only reach these
‘hidden services' if the user is using the Tor
client and operating the Tor network.” Id.
¶ 9. “Even after connecting to the Tor network . .
. a user must know the web address of the website in order to
access the site.” Id. ¶ 10. Because
Playpen was a hidden website on the Tor network, users had to
take many affirmative steps to locate the site, making it
“extremely unlikely that any user could simply stumble
upon [Playpen] without understanding its purpose and
content.” Id. ¶ 10.
after locating Playpen, its content was only accessible to
users who registered a username and then logged into the
site. Upon arriving at the Playpen homepage, a user was
prompted to either register an account or login using a
pre-existing username and password. In order to register an
account, users were required to accept Playpen's
registration terms, which stated, among other things, that
“the forum operators do NOT want you to enter a real
[e-mail] address, ” “[users] should not post
information [in their profile] that can be used to identify
you, ” “it is impossible for the staff or the
owners of this forum to confirm the true identity of users,
” “[t]his website is not able to see your IP,
” and “[f]or your own security when browsing . .
disable sending of the ‘referer' header.”
Id. ¶ 13.
logged into Playpen, users had complete access to all of
Playpen's sections, forums, and sub-forums, where they
could upload material and view material uploaded by others.
The Warrant Application included a listing of the sections,
forums, and sub-forums on Playpen, along with the
corresponding number of topics and posts in each, which
Special Agent Macfarlane observed upon accessing the site.
Based on his review of Playpen's different forums,
Special Agent Macfarlane concluded that the “the
majority contained discussions, as well as numerous images
that appeared to depict child pornography (‘CP')
and child erotica of prepubescent females, males, and
toddlers.” Id. ¶ 18. The FBI's review
of Playpen revealed links to numerous depictions of what
appeared to be child pornography. This included:
• An image of a prepubescent or early pubescent female
being orally penetrated by the penis of a naked male. [ECF
No.61-2 ¶ 18].
• A video of a prepubescent female, naked from the waist
down, being anally penetrated by the penis of a naked adult
male. Id. ¶ 18.
• Images focused on the nude genitals of a prepubescent
female. Id. ¶ 23.
• A video of an adult male masturbating and ejaculating
into the mouth of a nude prepubescent female. Id.
• An image of two prepubescent females lying on a bed
with their genitals exposed. Id. ¶ 25.
• An image of four females, including at least two
prepubescent females, performing oral sex on one another.
Id. ¶ 25.
addition, according to the Warrant Application, Playpen
contained certain features, such as private messaging and
image hosting, that facilitated the distribution of child
pornography. Id. ¶¶ 22-25.
The NIT Warrant
Warrant Application, Special Agent Macfarlane stated that
there was “probable cause to believe there exists
evidence, fruits, and instrumentalities of criminal activity
related to the sexual exploitation of children on computers
that access [Playpen], in violation of 18 U.S.C. §§
2251 and 2252A, ” and that the search authorized by the
NIT Warrant would help the FBI to identify the computers used
to log into Playpen, the locations of the computers, and the
users of the computers. [ECF No. 61-2 ¶ 48].
Warrant authorized the FBI to deploy the NIT onto any
“activating” computer, defined as the computer
“of any user or administrator who logs into [Playpen]
by entering a username and password.” Id.,
Att. A. When deployed, the NIT would cause the user's
computer to send the following information back to a
government-controlled computer in the Eastern District of
1) the computer's actual IP address and the date and time
that the NIT determines what that IP address is;
2) a unique identifier generated by the NIT to distinguish
data from that of other computers;
3) the type of operating system running on the computer;
4) information about whether the NIT has already been
delivered to the ...