Judge Says FBI's Hacking Tool Deployed In Child Porn Investigation Is An Illegal Search

The judicial system doesn't seem to have a problem with the FBI acting as admins for child porn sites while conducting investigations. After all, judges have seen worse. They've OK'ed the FBI's hiring of a "heroin-addicted prostitute" to seduce an investigation target into selling drugs to undercover agents. Judges have, for the most part, allowed the ATF to bust people for robbing fake drug houses containing zero drugs -- even when the actual robbery has never taken place. Judges have also found nothing wrong with law enforcement creating its own "pedophilic organization," recruiting members and encouraging them to create child pornography.

So, when the FBI ran a child porn site for two weeks last year, its position as a child porn middleman was never considered to be a problem. The "network investigative technique" (NIT) it used to obtain identifying information about anonymous site visitors and their computer hardware, however, has resulted in a few problems for the agency.

While the FBI has been able to fend off one defendant's attempt to suppress evidence out in Washington, it has just seen its evidence disappear in another case related to its NIT and the "PlayPen" child porn site it seized (and ran) last year.

What troubles the court isn't the FBI acting as a child porn conduit in exchange for unmasking Tor users. What bothers the court is the reach of its NIT, which extends far outside the jurisdiction of the magistrate judge who granted the FBI's search warrants. This decision benefits defendant Alex Levin of Massachusetts directly. But it could also pay off for Jay Michaud in Washington.

The warrants were issued in Virginia, which is where the seized server resided during the FBI's spyware-based investigation. Levin, like Michaud, does not reside in the district where the warrant was issued (Virginia - Eastern District) and where the search was supposed to be undertaken. As Judge William Young explains, the FBI's failure to restrict itself to the location where the NIT warrants were issued makes them worthless pieces of paper outside of that district. (via Chris Soghoian)

The government argues for a liberal construction of Rule 41(b) that would authorize the type of search that occurred here pursuant to the NIT Warrant. See Gov’t’s Resp. 18-20. Specifically, it argues that subsections (1), (2), and (4) of Rule 41(b) are each sufficient to support the magistrate judge’s issuance of the NIT Warrant. Id. This Court is unpersuaded by the government’s arguments. Because the NIT Warrant purported to authorize a search of property located outside the Eastern District of Virginia, and because none of the exceptions to the general territorial limitation of Rule 41(b)(1) applies, the Court holds that the magistrate judge lacked authority under Rule 41(b) to issue the NIT Warrant.

The government deployed some spectacular theories in its effort to salvage these warrants, but the court is having none of it.

The government advances two distinct lines of argument as to why Rule 41(b)(1) authorizes the NIT Warrant. One is that all of the property that was searched pursuant to the NIT Warrant was actually located within the Eastern District of Virginia, where the magistrate judge sat: since Levin -- as a user of Website A -- “retrieved the NIT from a server in the Eastern District of Virginia, and the NIT sent [Levin’s] network information back to a server in that district,” the government argues the search it conducted pursuant to the NIT Warrant properly can be understood as occurring within the Eastern District of Virginia. Gov’t’s Resp. 20. This is nothing but a strained, after-the-fact rationalization.

As the government attempts to portray it, the search was wholly contained in Virginia because the NIT was distributed by the seized server in the FBI's control. But, as the judge notes, the search itself -- via the NIT -- did not occur in Virginia. The NIT may have originated there, but without grabbing info and data from Levin's computer in Massachusetts, the FBI would have nothing to use against the defendant.

That the Website A server is located in the Eastern District of Virginia is, for purposes of Rule 41(b)(1), immaterial, since it is not the server itself from which the relevant information was sought.

And, according to Judge Young, that's exactly what the FBI has now: nothing.

The Court concludes that the violation at issue here is distinct from the technical Rule 41 violations that have been deemed insufficient to warrant suppression in past cases, and, in any event, Levin was prejudiced by the violation. Moreover, the Court holds that the good-faith exception is inapplicable because the warrant at issue here was void ab initio.

The judge has more to say about the FBI's last ditch attempt to have the "good faith exception" salvage its invalid searches.

Even were the Court to hold that the good-faith exception could apply to circumstances involving a search pursuant to a warrant issued without jurisdiction, it would decline to rule such exception applicable here. For one, it was not objectively reasonable for law enforcement -- particularly “a veteran FBI agent with 19 years of federal law enforcement experience[,]” Gov’t’s Resp. 7-8 -- to believe that the NIT Warrant was properly issued considering the plain mandate of Rule 41(b).

The court doesn't have a problem with NITs or the FBI's decision to spend two weeks operating a seized child porn server. But it does have a problem with the government getting warrants signed in one jurisdiction and using them everywhere but.

The decision here could call into question other such warrants used extraterritorially, like the DEA's dozens of wiretap warrants obtained in California but used to eavesdrop on targets located on the other side of the country. And it may help Jay Michaud in his case, seeing as he resides a few thousand miles away from where the search was supposedly performed.

Permalink | Comments | Email This Story