United States District Court, E.D. Michigan, Northern Division
OPINION AND ORDER DENYING MOTION TO SUPPRESS
L. LUDINGTON United States District Judge
February 20, 2015, a federal magistrate judge in the Eastern
District of Virginia signed a warrant authorizing a FBI
hacking operation designed to infiltrate a suspected child
pornography website, named
“Playpen.” After breaching the website's
security, the FBI recoded the website to request certain
information from every computer that accessed the website.
Because of that coding, accessing computers sent identifying
information to the FBI. Using the data gathered, the FBI
obtained a warrant from a magistrate judge for the Eastern
District of Michigan to search Defendant Jason John
Kahler's home and computer, located in Saginaw, Michigan.
The items seized in that search served as the basis for the
August 10, 2016, indictment which charges Kahler with
possessing prepubescent child pornography. ECF No. 1. On
December 21, 2016, Kahler filed a motion to suppress the
fruits of the original warrant which authorized the hacking
operation. ECF No. 21. On February 9, 2017, the parties
submitted a stipulation to waive oral argument on the motion.
ECF No. 29. Because the material facts are largely
undisputed, the motion to suppress will be decided based on
the arguments made in the briefing. For the reasons that
follow, the motion to suppress will be denied.
following information is primarily drawn from the affidavits
in support of the two applications for a search warrant. The
“target website” which the FBI hacked was
operated on the so-called “dark web.” The dark
web is accessed by using certain software (Tor routing
software) which routes communications through a series of
computers and thus masks the user's IP address. The Tor
software prevents websites from learning the user's
physical location and prevents individuals attempting to
monitor the user's internet usage from determining which
sites have been visited. When, as was the case for Playpen, a
website can be accessed only by users which are using Tor
Software, it is considered part of the dark web. Further, the
dark web is not indexed like the traditional internet.
Accordingly, a Tor user could not simply use a search engine
to discover and access Playpen. Rather, Playpen could be accessed
only by someone who had obtained its web address from another
source, like a user familiar with the site or an online
to the FBI's affidavit, Playpen “was a child
pornography bulletin board and website dedicated to the
advertisement and distribution of child pornography and the
discussion of matters pertinent to the sexual abuse of
children.” FBI Aff. at 12, ECF No. 21, Ex. A. Playpen
became active in approximately August 2014. As of March 4,
2015, 117, 773 posts had been made by 214, 898 total members
on Playpen. Between September 2014 and February 19, 2015, the
front page of Playpen included an image of two scantily
clothed girls. Both girls were posed salaciously and appeared
to be prepubescent. The image also included the website's
title and the following text: “No cross-board reposts,
.7z preferred, encrypt filenames, include preview.”
Gov. Resp., ECF No. 27, Ex. 1. According to the FBI Agent who
prepared the affidavit: “Based on my training and
experience, I know that: ‘no cross-board reposts'
refers to a prohibition against material that is posted on
other websites from being ‘re-posted' to [Playpen];
and ‘.7z' refers to a preferred method of
compressing large files or sets of files for
distribution.” FBI Aff. at 13.
February 19, 2015, the image on the front page was changed.
The new image depicted one girl with no visible breast
development. The girl was pictured wearing a short dress
which exposed her upper thighs and thigh-high fishnet
stockings. She was posed in a chair in a sexually suggestive
manner. The new image also included instructions which
forbade cross-posts, indicated a preference for .7z, and
directed users to encrypt the file names and include a
registered users were allowed to enter Playpen. The front
page included a hyperlink to the registration page. On that
account registration page, users were directed to enter an
“email address, ” but the page expressly
instructed users to enter a fake email address. Users were
also instructed that “‘for your security you
should not post information here that can be used to identify
you.'” Id. The registration page included
further instructions regarding best practices for hiding the
to the affidavit, Playpen included (among others) the
following forums and subforums: “(a) Jailbait - Boy;
(b) Jailbait - Girl; (c) Preteen - Boy; (d) Preteen - Girl;
(e) Pre-teen Videos - Girl HC; (f) Pre-teen Videos - Boys HC;
(g) Toddlers; and (h) Kinky Fetish - Scat.”
Id. at 14. The FBI affiant indicated that, based on
his training and experience, he knew “that
‘jailbait' refers to underage but post-pubescent
minors; [and] the abbreviation ‘HC' means hardcore
(i.e., depictions of penetrative sexually explicit
conduct).” Id. Playpen included a forum where
members could exchange usernames for a Tor-based instant
messaging service which the FBI agent knew to be commonly
used by individuals “engaged in the online sexual
exploitation of children.” Id. Playpen
included text-only sections where, according to the FBI
affidavit, members discussed methods and tactics for the
perpetuation of child sexual abuse. The website also included
a private message function which users used to correspond
more discretely. At least one post on the website revealed
that private messages were being sent to discuss sexual abuse
of children perpetrated by the users themselves.
December 2014, a foreign law enforcement agency informed the
FBI that it suspected the target website's originating IP
address was based in the United States. After further
investigation, the FBI located the server hosting the target
website, in North Carolina, and the residence of the
website's administrator, located in Florida. The FBI
seized the server, transported it to a government facility in
Virginia, and assumed administrative control of Playpen.
Rather than closing the website, the FBI chose to briefly
operate Playpen in order to identify users of the website.
Despite the FBI's control over Playpen, the Tor software
through which members accessed the site prevented the FBI
from obtaining identifying information from the users.
overcome the anonymity granted by the Tor software, the FBI
sought a warrant authorizing a “Network Investigative
Technique” (“NIT”). That technique works as
follows: Typically, users view a webpage by communicating
with the website. The user's computer requests access to
a certain webpage, and the website then sends content to the
user's computer. The user's computer receives that
information and uses it to display the webpage. The NIT
augments the instructions sent by the webpage and causes the
user's computer to transmit identifying information from
that computer, including the computer's IP address,
operating system, operating system username, and network
United States Magistrate Judge for the Eastern District of
Virginia approved the FBI's search and seizure warrant,
thus authorizing use of the NIT. After the FBI implemented
the NIT, Defendant Kahler's computer made two postings on
the target website on two different days. Based on the
information the NIT revealed, the FBI sought and obtained a
warrant to search Kahler's residence and computer.
Pornographic images of minors were seized during the search.
After that search, Kahler was charged with possessing
prepubescent child pornography. This motion to suppress
Fourth Amendment provides:
The right of the people to be secure in their persons,
houses, papers, and effects, against unreasonable searches
and seizures, shall not be violated, and no Warrants shall
issue, but upon probable cause, supported by Oath or
affirmation, and particularly describing the place to be
searched, and the persons or things to be seized.
U.S. Const. amend. IV.
speaking, the requirement that searches be reasonable means
law enforcement officials must obtain a judicially approved
warrant beforehand. Riley v. California, 134 S.Ct.
2473, 2482 (2014). To satisfy the warrant requirement, a
detached, neutral judge must find that there is probable
cause that evidence of a crime will be found. United
States v. Leon, 468 U.S. 897, 913- 15 (1984).
“[G]reat deference” is given to a
magistrate's determination that probable cause exists.
Id. at 914. And there is a “presumption of
validity with respect to the affidavit supporting the search
warrant.” Franks v. Delaware, 438 U.S. 154,
171 (1978). However, if a defendant shows that the warrant
affidavit included deliberate falsehoods or otherwise
demonstrates a reckless disregard for the truth and the
finding of probable cause was dependent on those falsehoods,
the defendant is entitled to a hearing. Id.
the defendant shows that the Fourth Amendment was violated,
“suppression is not an automatic consequence.”
Herring v. United States, 555 U.S. 135, 137 (2009).
The key inquiry is whether “the culpability of the
police” and the need “to deter wrongful police
conduct” justifies suppression. Id. Because
the purpose of exclusion is deterrence, exclusion is not an
individual right, even when the defendant's Fourth
Amendment rights have been violated. Id. at 141.
Exclusion is a last resort, not a “first
impulse.” Hudson v. Michigan, 547 U.S. 586,
591 (2006). Even if exclusion would provide some marginal
deterrence, that benefit must outweigh the costs of
exclusion. Pennsylvania Bd. of Prob. & Parole v.
Scott, 524 U.S. 357, 369 (1998). Generally speaking,
“the exclusionary rule serves to deter deliberate,
reckless, or grossly negligent conduct, or in some