United States District Court, D. Massachusetts
MEMORANDUM AND ORDER
B. Saris Chief United States District Judge.
Vincent Anzalone is charged with one count of possession of
child pornography in violation of 18 U.S.C. §
2252A(a)(5)(B) and one count of receipt of child pornography
in violation of 18 U.S.C. § 2252A(a)(2)(A).
defendant has moved to dismiss the indictment on the basis
that the government acted outrageously in maintaining the
child pornography website Playpen for two weeks during an FBI
investigation. After an evidentiary hearing, the
defendant's motion to dismiss (Docket No. 52) is
Court described the facts of this case in its order denying
the defendant's motion to suppress. United States v.
Anzalone, No. CR 15-10347-PBS, 2016 WL 5339723, at *1-5
(D. Mass. Sept. 22, 2016). The Court assumes familiarity with
Court held an evidentiary hearing on this motion on October
14, 2016, in which FBI Special Agent Daniel Alfin testified
credibly. The Court relies on the evidence at that hearing as
well as the affidavits of FBI Special Agents Douglas
Macfarlane and Daniel Alfin and the government's response
to a discovery order in a similar case in another district,
which was submitted by the defense. See Docket No.
48, Ex. 2; Docket No. 83, Ex. 1; Docket No. 78, Ex. 1.
was a website dedicated largely to child pornography.
Playpen's administrator sought to limit access to the
site to those using the Tor network. In his affidavit,
Special Agent Macfarlane described the mechanics of the Tor
network. The Tor network, also known as The Onion Router, is
an anonymity network that masks a user's IP address. To
access the Tor network, a user must download an add-on to the
user's existing browser or download the Tor browser
bundle. To ensure anonymity for its users, the Tor network
bounces communications through various relay computers. When
a user accesses a website, the IP address of the last
computer in that chain is displayed, rather than the
user's IP address. The network therefore “prevents
someone attempting to monitor an Internet connection from
learning what sites a user visits, prevents the sites the
user visits from learning the user's physical location,
and it lets the user access sites which could otherwise be
blocked.” Macfarlane Aff. ¶ 8, Docket No. 48, Ex.
the Tor network, sites can be designed as “hidden
services.” Hidden services allow websites and other
servers to hide their location. Like traditional websites,
these sites “are hosted on computer servers that
communicate through IP addresses.” Id. ¶
9. Unlike such websites, however, the “IP address for
the web server is hidden and instead is replaced with a
Tor-based web address, which is a series of
algorithm-generated characters” followed by the suffix
a misconfiguration of the server hosting Playpen, the
server's IP address was made publicly available. This
glitch offered the FBI a rare opportunity to locate the
server, find the administrator, and identify the site's
users. When the FBI learned of the server's IP address,
it secured a search warrant for the server. It executed that
search warrant in mid-January 2015 at CetriLogic, a server
hosting company located in North Carolina. The FBI obtained a
copy of the Playpen site at that time.
weeks later, on February 19, 2015, the FBI arrested Steven
Chase -- Playpen's principal administrator -- and assumed
control of Playpen, moving a copy of the site to a government
server in the Eastern District of Virginia. From that
location, the government operated the website for two weeks,
from February 20 to March 4, 2015, in order to identify the
IP addresses of Playpen users. After procuring a warrant, the
government deployed a Network Investigative Technique (NIT)
on users' computers that caused those computers to
transmit their IP address and other pieces of identifying
information back to the government. The FBI paired users'
IP addresses with the content they accessed on the site. The
government then sought additional warrants to search
users' homes for child pornography.
Playpen's content was not hosted directly on the Playpen
site; instead, Playpen operated primarily as a bulletin board
on which users posted links to other websites from which
child pornography could be downloaded along with the
passwords needed to download and decrypt the illegal files.
Users would generally post “preview” images as
the two-week period that the government operated Playpen,
these links remained mostly accessible to the site's
visitors. Users clicked on 67, 000 unique links on the
website during these two weeks. Of the 67, 000 links,
approximately 25, 000 were links to particular image files
and the majority of the images depicted child pornography.
The remaining links were to encrypted archives containing
multiple image or video files. During the government's
operation of the site, users posted 13, 000 new links. Users
had posted approximately 110, 000 links over the entire
lifespan of the site prior to the government's takeover.
government catalogued many of the images and videos that were
made available via these links. Accessing these files
required an agent to click on a link, download the files, and
then enter the provided password to view them. The government
accessed and documented approximately 48, 000 images and 200
videos that were posted sometime between the launch of the
site and the government takeover. The government documented
another 9, 000 images and 200 videos made ...