Searching over 5,500,000 cases.

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

United States v. Tran

United States District Court, D. Massachusetts

December 23, 2016

JOHN TRAN, Defendant.


          Patti B. Saris Chief United States District Judge.


         Defendant John Tran is charged with one count of possession of child pornography in violation of 18 U.S.C. § 2252A(a)(5)(B) and one count of receipt of child pornography in violation of 18 U.S.C. § 2252A(a)(2)(A).

         This case -- like dozens of others currently pending across the country -- arises from an FBI investigation into users of Playpen, a child pornography website. Playpen operates on the Tor network, which enables anonymous internet browsing. In February 2015, the government acquired control of Playpen's server. For two weeks, the government operated the website. To obtain the IP addresses of the site's users, the government applied for and received a search warrant from a magistrate judge in the Eastern District of Virginia. The search warrant allowed the FBI to deploy a Network Investigative Technique (“NIT”) on users' computers around the country. The NIT caused users' computers to transmit identifying information, including IP addresses, to the government.

         The defendant moves to dismiss the indictment on the basis that the government acted outrageously in maintaining the child pornography website Playpen for two weeks during the FBI's investigation. The defendant also moves to suppress all evidence gathered by the NIT as well as all fruits of the allegedly unconstitutional search.

         For the reasons set forth below, the defendant's motion to dismiss (Docket No. 44) and motion to suppress (Docket No. 45) are DENIED.


         The Court has previously described the facts of the FBI's Playpen investigation. See United States v. Anzalone (“Anzalone II”), No. 15-10347-PBS, 2016 WL 6476939, at *1-3 (D. Mass. Oct. 28, 2016) (denying defendant's motion to dismiss); United States v. Anzalone (“Anzalone I”), No. CR 15-10347-PBS, 2016 WL 5339723, at *1-5 (D. Mass. Sept. 22, 2016) (denying defendant's motion to suppress). The Court incorporates and assumes familiarity with these two opinions. The Court offers a brief review of those facts for the convenience of the reader.

         I. The Tor Network

         The Tor network, also known as The Onion Router, is an anonymity network that masks a user's IP address. To access the Tor network, a user must download an add-on to the user's existing browser or download the Tor browser bundle. To ensure anonymity for its users, the Tor network bounces communications through various relay computers. When a user accesses a website, the IP address of the last computer in that chain is displayed, rather than the user's IP address.

         Within the Tor network, sites can be designed as “hidden services.” Hidden services allow websites and other servers to hide their location by replacing a traditional IP address with a Tor-based web address.

         II. The Playpen Website

         Playpen was a website dedicated largely to child pornography. Playpen operated on Tor as a hidden service. According to Special Agent Douglas Macfarlane's affidavit in support of the February 20, 2015 search warrant, a user could not inadvertently arrive at the Playpen site: “Tor hidden services are not indexed like websites on the traditional Internet. Accordingly, unlike on the traditional Internet, a user may not simply perform a Google search for the name of one of the websites on Tor to obtain and click on a link to the site.” Macfarlane Aff. ¶ 10, Docket No. 61, Ex. 1. To learn Playpen's unique Tor address, a user might communicate directly with others on Tor or he might consult another site that lists links to child pornography hidden service sites. Agent Macfarlane concluded that accessing Playpen “therefore requires numerous affirmative steps by the user, making it extremely unlikely that any user could simply stumble upon [Playpen] without understanding its purpose and content.” Id.

         Agent Macfarlane described Playpen's homepage as it appeared on February 18, 2015, two days before he signed the affidavit. At the top left corner of the page, the name Playpen was prominently displayed. On either side of the site name were images depicting partially clothed prepubescent girls with their legs spread apart. Below these images, the site stated: “No cross-board reposts, .7z preferred, encrypt filenames, include preview . . . .” Id. ¶ 12. Agent Macfarlane explained that “no cross-board reposts” was an instruction to users not to post material appearing on other sites. The “.7z preferred” statement referred to a method of compressing large files for distribution. At the top right corner, to the right of the site name, users could enter a username and password, and select a session length. A login button appeared to the right of those login fields.

         Below the site name, the image of the two partially clothed girls, and the login fields was a textbox that read: “Warning! Only registered members are allowed to access the section. Please login below or ‘register an account' . . . with Playpen.” Id. The “register an account” text was hyperlinked to the site's registration page. Another set of login fields appeared below this warning, asking users to enter their username, password, minutes to stay logged in, and whether they wanted to permanently remain logged in.

         When a prospective user clicked the “register an account” hyperlink, the user saw a message from the forum operators. The message explained that the forum required new users to enter an email address and that the software “checks that what you enter looks approximately valid.” Id. ¶ 13. However, the forum operators encouraged users to enter fake email addresses: we “do NOT want you to enter a real address, just something that matches the xxx@yyy.zzz pattern. No confirmation email will be sent. This board has been intentionally configured so that it WILL NOT SEND EMAIL, EVER.” Id. The message further cautioned new users: “For your security you should not post information here that can be used to identify you.” Id. The forum operators emphasized the site's focus on anonymity: “The website is not able to see your IP and can not collect or send any other form of information to your computer except what you expressly upload, ” explaining that only a text file with the user's username and password reside in the browser's cache. Id.

         The defendant and the government agree that one aspect of the homepage changed between February 18, 2015, when Agent Macfarlane last visited the Playpen site, and February 20, 2015, when Agent Macfarlane submitted the search warrant application. On February 18, 2015, Agent Macfarlane visited the Playpen site. He confirmed that the site's content had not changed. However, on February 19, 2015, the day after Agent Macfarlane's last visit and the day before he submitted the search warrant application, the logo on Playpen's site was altered. Instead of two prepubescent, partially clothed girls with their legs spread, the site featured one young girl (age unclear) wearing a short dress and black stockings with her legs crossed. Therefore, the affidavit incorrectly described the homepage. Agent Macfarlane did not know of this change when he signed the affidavit on February 20, 2015.

         After logging into Playpen with a username and password, visitors to the site had access to various forums, many of which contained child pornography. Most of Playpen's content was not hosted directly on the Playpen site; instead, Playpen operated primarily as a bulletin board on which users posted links to other websites from which child pornography could be downloaded along with preview images and the passwords needed to download and decrypt the illegal files.

         Various features of the site allowed for the dissemination of child pornography: a private messaging function, an image hosting feature, a file hosting feature, and a chat feature.

         III. The NIT and the ...

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.