United States District Court, D. Massachusetts
MEMORANDUM AND ORDER
B. Saris Chief United States District Judge.
John Tran is charged with one count of possession of child
pornography in violation of 18 U.S.C. § 2252A(a)(5)(B)
and one count of receipt of child pornography in violation of
18 U.S.C. § 2252A(a)(2)(A).
case -- like dozens of others currently pending across the
country -- arises from an FBI investigation into users of
Playpen, a child pornography website. Playpen operates on the
Tor network, which enables anonymous internet browsing. In
February 2015, the government acquired control of
Playpen's server. For two weeks, the government operated
the website. To obtain the IP addresses of the site's
users, the government applied for and received a search
warrant from a magistrate judge in the Eastern District of
Virginia. The search warrant allowed the FBI to deploy a
Network Investigative Technique (“NIT”) on
users' computers around the country. The NIT caused
users' computers to transmit identifying information,
including IP addresses, to the government.
defendant moves to dismiss the indictment on the basis that
the government acted outrageously in maintaining the child
pornography website Playpen for two weeks during the
FBI's investigation. The defendant also moves to suppress
all evidence gathered by the NIT as well as all fruits of the
allegedly unconstitutional search.
reasons set forth below, the defendant's motion to
dismiss (Docket No. 44) and motion to suppress (Docket No.
45) are DENIED.
Court has previously described the facts of the FBI's
Playpen investigation. See United States v. Anzalone
(“Anzalone II”), No. 15-10347-PBS, 2016
WL 6476939, at *1-3 (D. Mass. Oct. 28, 2016) (denying
defendant's motion to dismiss); United States v.
Anzalone (“Anzalone I”), No. CR
15-10347-PBS, 2016 WL 5339723, at *1-5 (D. Mass. Sept. 22,
2016) (denying defendant's motion to suppress). The Court
incorporates and assumes familiarity with these two opinions.
The Court offers a brief review of those facts for the
convenience of the reader.
The Tor Network
network, also known as The Onion Router, is an anonymity
network that masks a user's IP address. To access the Tor
network, a user must download an add-on to the user's
existing browser or download the Tor browser bundle. To
ensure anonymity for its users, the Tor network bounces
communications through various relay computers. When a user
accesses a website, the IP address of the last computer in
that chain is displayed, rather than the user's IP
the Tor network, sites can be designed as “hidden
services.” Hidden services allow websites and other
servers to hide their location by replacing a traditional IP
address with a Tor-based web address.
The Playpen Website
was a website dedicated largely to child pornography. Playpen
operated on Tor as a hidden service. According to Special
Agent Douglas Macfarlane's affidavit in support of the
February 20, 2015 search warrant, a user could not
inadvertently arrive at the Playpen site: “Tor hidden
services are not indexed like websites on the traditional
Internet. Accordingly, unlike on the traditional Internet, a
user may not simply perform a Google search for the name of
one of the websites on Tor to obtain and click on a link to
the site.” Macfarlane Aff. ¶ 10, Docket No. 61,
Ex. 1. To learn Playpen's unique Tor address, a user
might communicate directly with others on Tor or he might
consult another site that lists links to child pornography
hidden service sites. Agent Macfarlane concluded that
accessing Playpen “therefore requires numerous
affirmative steps by the user, making it extremely unlikely
that any user could simply stumble upon [Playpen] without
understanding its purpose and content.” Id.
Macfarlane described Playpen's homepage as it appeared on
February 18, 2015, two days before he signed the affidavit.
At the top left corner of the page, the name Playpen was
prominently displayed. On either side of the site name were
images depicting partially clothed prepubescent girls with
their legs spread apart. Below these images, the site stated:
“No cross-board reposts, .7z preferred, encrypt
filenames, include preview . . . .” Id. ¶
12. Agent Macfarlane explained that “no cross-board
reposts” was an instruction to users not to post
material appearing on other sites. The “.7z
preferred” statement referred to a method of
compressing large files for distribution. At the top right
corner, to the right of the site name, users could enter a
username and password, and select a session length. A login
button appeared to the right of those login fields.
the site name, the image of the two partially clothed girls,
and the login fields was a textbox that read: “Warning!
Only registered members are allowed to access the section.
Please login below or ‘register an account' . . .
with Playpen.” Id. The “register an
account” text was hyperlinked to the site's
registration page. Another set of login fields appeared below
this warning, asking users to enter their username, password,
minutes to stay logged in, and whether they wanted to
permanently remain logged in.
prospective user clicked the “register an
account” hyperlink, the user saw a message from the
forum operators. The message explained that the forum
required new users to enter an email address and that the
software “checks that what you enter looks
approximately valid.” Id. ¶ 13. However,
the forum operators encouraged users to enter fake email
addresses: we “do NOT want you to enter a real address,
just something that matches the firstname.lastname@example.org pattern. No
confirmation email will be sent. This board has been
intentionally configured so that it WILL NOT SEND EMAIL,
EVER.” Id. The message further cautioned new
users: “For your security you should not post
information here that can be used to identify you.”
Id. The forum operators emphasized the site's
focus on anonymity: “The website is not able to see
your IP and can not collect or send any other form of
information to your computer except what you expressly
upload, ” explaining that only a text file with the
user's username and password reside in the browser's
defendant and the government agree that one aspect of the
homepage changed between February 18, 2015, when Agent
Macfarlane last visited the Playpen site, and February 20,
2015, when Agent Macfarlane submitted the search warrant
application. On February 18, 2015, Agent Macfarlane visited
the Playpen site. He confirmed that the site's content
had not changed. However, on February 19, 2015, the day after
Agent Macfarlane's last visit and the day before he
submitted the search warrant application, the logo on
Playpen's site was altered. Instead of two prepubescent,
partially clothed girls with their legs spread, the site
featured one young girl (age unclear) wearing a short dress
and black stockings with her legs crossed. Therefore, the
affidavit incorrectly described the homepage. Agent
Macfarlane did not know of this change when he signed the
affidavit on February 20, 2015.
logging into Playpen with a username and password, visitors
to the site had access to various forums, many of which
contained child pornography. Most of Playpen's content
was not hosted directly on the Playpen site; instead, Playpen
operated primarily as a bulletin board on which users posted
links to other websites from which child pornography could be
downloaded along with preview images and the passwords needed
to download and decrypt the illegal files.
features of the site allowed for the dissemination of child
pornography: a private messaging function, an image hosting
feature, a file hosting feature, and a chat feature.
The NIT and the ...