United States v. Gabriel Werdene

This case arises from the Federal Bureau of Investigation's (FBI) investigation into Playpen, a global online forum that existed on the dark web1 and that was dedicated to the advertisement and distribution of child pornography. The website had a substantial amount of users. In fact, more than 150,000 users collectively engaged in over 95,000 posts with over 9,000 forum topics related to child pornography. This appeal centers on the FBI's decision to rely on a single search warrant, issued in the Eastern District of Virginia ("EDVA"), to search the computers of thousands of Playpen users across the United States and the world using a form of government-created malware termed a "Network Investigative Technique" ("NIT").

Appellant Gabriel Werdene, a citizen of Pennsylvania, was a Playpen user whose computer was compromised by the NIT. Subsequently, he was charged in the Eastern District of Pennsylvania ("EDPA") with one count of possessing child pornography, in violation of 18 U.S.C. § 2252(a)(4)(B). He filed a motion to suppress the evidence seized during the search of his computer, including the information revealed by the use of the NIT. The District Court denied the suppression motion, holding that the NIT warrant violated the version of Fed. R. Crim. P. 41(b) then in effect (" Rule 41(b)")2 , but that the *207NIT itself did not constitute a search under the Fourth Amendment and that Werdene was not prejudiced by the error. On appeal, Werdene contends that the District Court erred in holding that no Fourth Amendment search took place. Further, he argues that the issuance of the warrant violated his Fourth Amendment rights because it lacked particularity and was issued in violation of the jurisdictional requirements set forth in both Rule 41(b) and the Federal Magistrates Act. The Government concedes that a Fourth Amendment search occurred, but contends that the NIT was authorized by Rule 41(b)(4) and that, in any event, the good-faith exception to the exclusionary rule precludes suppression.

We hold that the NIT warrant violated the prior version of Rule 41(b) and that the magistrate judge exceeded her authority under the Federal Magistrates Act. The warrant was therefore void ab initio , and the Rule 41(b) infraction rose to the level of a Fourth Amendment violation. However, we agree with the Government that the good-faith exception to the exclusionary rule may apply to warrants that are void ab initio , which ultimately precludes suppression in this case. We therefore will affirm on alternative grounds the District Court's decision to deny Werdene's suppression motion.

I. FACTS AND PROCEDURAL HISTORY

To inform our forthcoming analysis, we shall detail how Playpen escaped traditional law enforcement detection and how the FBI circumvented the dark web to apprehend its users.

A. Tor

The Playpen site operated on the anonymous "The Onion Router" ("Tor") network-a constituent part of the "dark web"-which allows users to conceal their actual internet protocol ("IP") addresses while accessing the internet.3 An IP address is a unique identifier assigned by an internet service provider to every computer having access to the internet, including computer servers that host websites. Websites that the computer user visits can log the computer's IP address, creating a digital record of activity on each website. After lawful seizure of an illicit website under normal circumstances, law enforcement is able to retrieve the website's IP log to locate and apprehend its users.

Tor, however, prevents websites from registering a computer's actual IP address by sending user communications through a network of relay computers called "nodes" up until those communications reach the website. Numerous intermediary computers therefore stand between the accessing computer and the website, and the website can log the IP address of only the "exit node", which is the final computer in the sequence. Accordingly, Playpen's IP log-like that of other Tor websites-contained only the IP addresses of the exit nodes, rendering traditional IP identification techniques useless.

B. The Playpen Investigation

In December 2014, a foreign law enforcement agency informed the FBI that Playpen was being hosted by a computer server in North Carolina. Playpen's administrator was identified as a person residing *208in Florida, who was promptly arrested.4 The FBI then lawfully seized the server, moved it to a government facility in EDVA, and obtained a wiretap order to monitor communications on it. It then assumed administrative control of Playpen and allowed the website to operate while law enforcement officials tried to circumvent Tor and identify Playpen's users.

The FBI's solution was the NIT, a form of government-created malware that allowed the FBI to retrieve identifying information from Playpen users located all around the world. The NIT's deployment worked in multiple steps. First, the FBI modified Playpen's code so that each accessing computer-unknowingly to the user and no matter the computer's physical location-downloaded the NIT whenever a "user or administrator log[ged] into [Playpen] by entering a username and password." App. 133. Once downloaded, the NIT searched the accessing computer for seven discrete pieces of identifying information: (1) an IP address; (2) a unique identifier to distinguish the data from that of other computers; (3) the type of operating system; (4) information about whether the NIT had already been delivered; (5) a Host Name; (6) an active operating system username; and (7) a Media Access Control address. Finally, the NIT transmitted this information back to a government-controlled computer in EDVA. The FBI postulated that it could then rely on this information to identify users' premises and distinguish their computers from other computers located within their proximity.

In February 2015, the FBI obtained a search warrant from a magistrate judge in EDVA to deploy the NIT to all "activating computers." App. 106. An "activating computer" was defined in the search warrant as the computer of "any user or administrator who logs into [Playpen] by entering a username and password." Id . Further, the NIT could be deployed to any activating computer "wherever located ." App. 136 (emphasis added). In other words, this single warrant authorized the FBI to retrieve identifying information from computers all across the United States, and from all around the world. Most importantly, these computers were overwhelmingly located outside of EDVA.

C. Charges Against Werdene and Suppression Motion

Analysis of the NIT data revealed the IP address of a Playpen user, eventually identified as Werdene, residing in Bensalem, Pennsylvania. In the final month of the website's operation, Werdene was logged in for approximately ten hours and made six text postings, commenting on child pornography and sharing links under the username "thepervert." The FBI obtained a separate search warrant for Werdene's home from a magistrate judge in EDPA, where agents seized one USB drive and one DVD containing child pornography.5

In September 2015, Werdene was charged in EDPA with one count of possessing child pornography, in violation of 18 U.S.C. § 2252(a)(4)(B). He filed a motion to suppress the evidence seized during *209the search of his computer, including the information revealed by the NIT, the evidence subsequently seized from his home, and statements that he later made to the FBI. Werdene argued that the warrant was issued in violation of the jurisdictional requirements set forth in Rule 41(b), and that suppression was required because the violation was constitutional in nature and the good-faith exception to the exclusionary rule did not apply. The Government did not contend that the NIT warrant was explicitly authorized by Rule 41(b), but argued that the rule was flexible and expansive, and included warrants based on technological advances-such as the NIT warrant-which came within the spirit of the rule.

The District Court denied the motion in a memorandum and order issued on May 18, 2016. It first held that the NIT warrant violated Rule 41(b) because the magistrate judge in EDVA was without authority to issue a warrant to search Werdene's computer in EDPA. But the District Court also held that the NIT was not a "search" within the meaning of the Fourth Amendment because Werdene lacked a reasonable expectation of privacy to his computer's IP address. It concluded that the Fourth Amendment was not implicated, and that the Rule 41(b) violation was only "technical" in nature. The District Court therefore denied the suppression motion on the bases that the Government did not intentionally disregard the Rule's requirements and that Werdene was not prejudiced by the violation. This appeal followed.

On June 7, 2016, Werdene pled guilty pursuant to a plea agreement in which he reserved his right to appeal the District Court's ruling on the suppression motion. On September 7, 2016, the District Court accepted the recommendation of the U.S. Probation Office and applied a downward variance from the United States Federal Sentencing Guideline's range of 51-63 months. It sentenced Werdene to 24 months' imprisonment, a term of supervised release of five years, and restitution in the amount of $1,500.

II. JURISDICTION AND STANDARD OF REVIEW

The District Court had original jurisdiction over this case pursuant to 18 U.S.C. § 3231. Our jurisdiction arises from 28 U.S.C. § 1291. "We review the District Court's denial of a motion to suppress for clear error as to the underlying factual determinations but exercise plenary review over the District Court's application of law to those facts." United States v. Murray , 821 F.3d 386, 390-91 (3d Cir. 2016) (quoting United States v. Stabile , 633 F.3d 219, 230 (3d Cir. 2011) ).

III. DISCUSSION

This case requires us to decide a multitude of issues regarding Rule 41 and the Fourth Amendment. First, we must determine whether the NIT warrant violated Rule 41. If it did not, then we will affirm the District Court because there is no basis to grant Werdene's suppression motion. Second, if it did violate Rule 41, then we are required to decide whether the breach rose to the level of a Fourth Amendment violation. To do so, we consider whether the NIT warrant, by being issued by a magistrate judge beyond her jurisdiction, was void ab initio and, if so, whether such a transgression constituted a Fourth Amendment violation in the founding era. See Virginia v. Moore , 553 U.S. 164, 168, 128 S.Ct. 1598, 170 L.Ed.2d 559 (2008). If we do not find that a Fourth Amendment violation occurred, then the suppression motion must be denied unless Werdene can prove that he was prejudiced by the error or that the FBI acted with *210intentional and deliberate disregard for Rule 41. See United States v. Martinez-Zayas , 857 F.2d 122, 136 (3d Cir. 1988), overruled in part on other grounds by United States v. Chapple , 985 F.2d 729 (3d Cir. 1993). Third, if a Fourth Amendment violation did occur, then we are called upon to decide an issue of first impression for this Court: whether the good-faith exception to the exclusionary rule applies when a warrant is void ab initio . If it does not, then we apply the exclusionary rule without consideration of the good-faith exception. Fourth, if the good-faith exception does apply, then we must determine if it precludes suppression in this case.

For the reasons discussed below, we hold that the NIT warrant violated Rule 41(b). As a result, the magistrate judge not only exceeded her authority under the Rule as then drafted, but also under the Federal Magistrates Act, rendering the warrant void ab initio and raising the magnitude of the infraction from a technical one to a Fourth Amendment violation. On the other hand, we also hold that the good-faith exception applies to such warrants, which, given the circumstances of this case, precludes suppression. We therefore will affirm on alternative grounds the District Court's decision to deny Werdene's suppression motion.

A. Federal Magistrate Judge Jurisdiction

The Federal Magistrates Act, 28 U.S.C. § 636(a), authorizes federal magistrate judges to exercise the "powers and duties conferred ... by the Rules of Criminal Procedure" in three geographic areas: "[1] within the district in which sessions are held by the court that appointed the magistrate judge, [2] at other places where that court may function, and [3] elsewhere as authorized by law." § 636(a) ; see also United States v. Krueger , 809 F.3d 1109, 1118 (10th Cir. 2015) (Gorsuch, J., concurring). Accordingly, § 636(a) creates "jurisdictional limitations on the power of magistrate judges" because it "expressly and independently limits where those powers will be effective." Krueger , 809 F.3d at 1119 (Gorsuch, J., concurring); see also United States v. Hazlewood , 526 F.3d 862, 864 (5th Cir. 2008) ("In the Federal Magistrates Act, 28 U.S.C. § 636, Congress conferred jurisdiction to federal magistrate-judge[s]"); N.L.R.B. v. A-Plus Roofing, Inc. , 39 F.3d 1410, 1415 (9th Cir. 1994) ("[F]ederal magistrates are creatures of [ § 636(a) ], and so is their jurisdiction."); Gov't of Virgin Islands v. Williams , 892 F.2d 305, 309 (3d Cr. 1989) ("The jurisdiction of federal magistrates is defined by the Federal Magistrates Act.").

While § 636(a) defines the geographic scope of a magistrate judge's powers, the Rules of Criminal Procedure-including Rule 41(b) -define what those powers are. See § 636(a)(1) ; see also Krueger , 809 F.3d at 1119 (Gorsuch, J., concurring). Rule 41(b) provides that a magistrate judge may "issue a warrant to search for and seize a person or property located within the district." Fed. R. Crim. P. 41(b)(1). At the time that the NIT warrant was issued, the Rule also authorized four exceptions to this territorial restriction: (1) for property that might be moved outside the district before the warrant is executed, Fed. R. Crim. P. 41(b)(2) ; (2) for terrorism investigations, Fed. R. Crim. P. 41(b)(3) ; (3) to install a tracking device within the magistrate judge's district that may track the movement of property outside that district, Fed. R. Crim. P. 41(b)(4) ; and (4) to search and seize property located outside any district but within the jurisdiction of the United States, Fed. R. Crim. P. 41(b)(5). Notably, "[n]one of these [ Rule 41(b) ] exceptions expressly allow a magistrate judge in one jurisdiction to authorize the search of a computer in a different *211jurisdiction." United States v. Horton , 863 F.3d 1041, 1047 (8th Cir. 2017).

B. The NIT Warrant Violated Rule 41(b)

We must first determine whether the NIT warrant violated Rule 41(b). The Government conceded below that "[a]lthough Rule 41 does authorize a judge to issue a search warrant for a search in another district in some circumstances, it does not explicitly do so in these circumstances ." App. 91 (Government Br. in Opposition to Motion to Suppress) (emphasis added). Given the concession, the Government instead argued that the Rule set forth an illustrative, rather than exhaustive, list of circumstances in which a magistrate judge may issue a warrant.

On appeal, however, the Government curiously has reversed course, and now contends that the NIT was in fact explicitly authorized by Rule 41(b)(4), which provides that a magistrate judge may "issue a warrant to install within the district a tracking device; the warrant may authorize use of the device to track the movement of a person or property located within the district, outside the district, or both." Fed. R. Crim. P. 41(b)(4) (emphasis added).

According to the Government, under this Rule, "the NIT warrant properly authorized use of the NIT to track the movement of information-the digital child pornography content requested by users who logged into Playpen's website-as it traveled from the server in [EDVA] through the encrypted Tor network to its final destination: the users' computers, wherever located." Government Br. at 30. At that point, the NIT caused the Playpen users' computers to transmit the identifying information back to the FBI over the open internet, thus enabling law enforcement to locate and identify the user. In the Government's estimation, the NIT is similar to a transmitter affixed to an automobile that is programmed to send location-enabling signals (like GPS coordinates) back to a government-controlled receiver because it was designed to send location-enabling information (like an actual IP address) back to a government-controlled computer. "Thus, although not a physical beeper affixed to a tangible object [as was the case in, for example, United States v. Karo , 468 U.S. 705, 104 S.Ct. 3296, 82 L.Ed.2d 530 (1984) ], the NIT operated as a digital tracking device of intangible information within the meaning of Rule 41(b)(4)." Id . at 32.

We need not resolve Werdene's contention that the Government waived this argument because we find that the Government's tracking device analogy is inapposite. As an initial matter, it is clear that the FBI did not believe that the NIT was a tracking device at the time that it sought the warrant. Warrants issued under Rule 41(b)(4) are specialized documents that are denominated "Tracking Warrant" and require the Government to submit a specialized "Application for a Tracking Warrant." See ADMINISTRATIVE OFFICE OF U.S. COURTS, CRIMINAL FORMS AO 102 (2009) & AO 104 (2016). Here, the FBI did not submit an application for a tracking warrant-rather, it applied for, and received, a standard search warrant. Indeed, the term "tracking device" is absent from the NIT warrant application and supporting affidavit.

More importantly, the analogy does not withstand scrutiny. The explicit purpose of the warrant was not to track movement-as would be required under Rule 41(b)(4) -but to "obtain[ ] information" from "activating computers." App. 106. As discussed above, the NIT was designed to search -not track -the user's computer for the IP address and other identifying information, and to transmit that data *212back to a government-controlled server. Although the seized information (mainly the IP address) assisted the FBI in identifying a user, it provided no information as to the computer's or user's precise and contemporary physical location. This fact-that the NIT did not track movement -is dispositive, because Rule 41(b)(4) is "based on the understanding that the device will assist officers only in tracking the movements of a person or object." Fed. R. Crim. P. 41 Advisory Committee's Note (2006) (emphasis added); see also Fed. R. Crim. P. 41(a)(2)(E) (incorporating the definition of "tracking device" from 18 U.S.C. § 3117(b), which is "an electronic or mechanical device which permits the tracking of the movement of a person or object." 18 U.S.C. § 3117(b) (emphasis added) ). The NIT, by not contemporaneously transmitting the location of the computers that it searched, was therefore unlike the quintessential tracking device that the Government used in United States v. Jones , which "track[ed] the vehicle's movements ... [b]y means of signals from multiple satellites, the device established the vehicle's location within 50 to 100 feet, and communicated that location by cellular phone to a Government computer." 565 U.S. 400, 403, 132 S.Ct. 945, 181 L.Ed.2d 911 (2012) (emphasis added).

Furthermore, Rule 41(b)(4) requires that a tracker be "install[ed] within the district." Fed. R. Crim. P. 41(b)(4). It is difficult to imagine a scenario where the NIT was "installed" on Werdene's computer-which was physically located in Pennsylvania-in EDVA. The Eighth Circuit, which is the only other Court of Appeals to address the Government's Rule 41(b)(4) argument to date, rejected it on this basis:

The government argues that the defendants made a "virtual" trip to the Eastern District of Virginia to access child pornography and that investigators "installed" the NIT within that district. Although plausible, this argument is belied by how the NIT actually worked: it was installed on the defendants' computers in their homes in Iowa.... [W]e agree with the district court that the "virtual trip" fiction "stretches the rule too far."

Horton , 863 F.3d at 1047-48 (citations omitted).

The Government correctly contends that Rule 41 should be read flexibly "to include within its scope electronic intrusions authorized upon a finding of probable cause" so that it can keep up with technological innovations. United States v. New York Tel. Co. , 434 U.S. 159, 169, 98 S.Ct. 364, 54 L.Ed.2d 376 (1977). However, as the District Court aptly stated, "[e]ven a flexible application of the Rule ... is insufficient to allow the Court to read into it powers possessed by the magistrate that are clearly not contemplated and do not fit into any of the five subsections." United States v. Werdene , 188 F.Supp.3d 431, 441 (E.D. Pa. 2016). For the aforementioned reasons, the NIT was not a "tracking device" under Rule 41(b)(4), and therefore the warrant violated the Rule.6

C. The NIT Warrant Violated the Fourth Amendment

Since the NIT warrant violated Rule 41(b), we next consider the nature of the violation to assess if suppression is warranted. See *213United States v. Simons , 206 F.3d 392, 403 (4th Cir. 2000) ("There are two categories of Rule 41 violations: those involving constitutional violations, and all others."). If the violation is "constitutional"-i.e., a violation of the Fourth Amendment-then suppression is governed by the exclusionary rule standards applicable to Fourth Amendment violations generally. See Martinez-Zayas , 857 F.2d at 136 ; see also United States v. Franz , 772 F.3d 134, 145 (3d Cir. 2014) ("The exclusionary rule is a prudential doctrine designed to enforce the Fourth Amendment...."). If, however, the violation is not of constitutional magnitude, but rather is "ministerial" or "technical" in nature, then suppression is warranted only if "(1) there was 'prejudice' in the sense that the search might not have occurred or would not have been so abrasive if the Rule had been followed, or (2) there is evidence of intentional and deliberate disregard of a provision in the Rule." Martinez-Zayas , 857 F.2d at 136 (quoting United States v. Burke , 517 F.2d 377, 386-87 (2d Cir. 1975) ).

The Fourth Amendment guarantees that:

[t]he right of the people to be secure in their persons, houses, papers, and effects against unreasonable searches and seizures, shall not be violated, and no Warrant shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

U.S. Const. amend. IV.

"[T]he overriding function of the Fourth Amendment is to protect personal privacy and dignity against unwarranted intrusion by the State." Reedy v. Evanson , 615 F.3d 197, 228 (3d Cir. 2010) (quoting Schmerber v. California , 384 U.S. 757, 767, 86 S.Ct. 1826, 16 L.Ed.2d 908 (1966) ); see also United States v. Pollard , 326 F.3d 397, 410 (3d Cir. 2003) ("The Fourth Amendment's 'central concern ... is to protect liberty and privacy from arbitrary and oppressive interference by government officials.' " (quoting United States v. Ortiz, 422 U.S. 891, 895, 95 S.Ct. 2585, 45 L.Ed.2d 623 (1975) ) ). The Fourth Amendment only prohibits unreasonable searches and seizures, and the Supreme Court has counseled that the Fourth Amendment encompasses "at a minimum, the degree of protection it afforded when it was adopted." Jones , 565 U.S. at 411, 132 S.Ct. 945. Accordingly, "[w]e look to the statutes and common law of the founding era to determine the norms that the Fourth Amendment was meant to preserve." Moore , 553 U.S. at 168, 128 S.Ct. 1598 ; see also United States v. Phillips , 834 F.3d 1176, 1179 (11th Cir. 2016).

We must therefore determine whether the circumstances of this case constituted a Fourth Amendment violation during the founding era.7 "The principle animating *214the common law at the time of the Fourth Amendment's framing was clear: a warrant may travel only so far as the power of its issuing official." Krueger , 809 F.3d at 1124 (Gorsuch, J., concurring). The NIT warrant clearly violated this precept. The magistrate judge not only exceeded the territorial scope of Rule 41(b), but, as a result of that violation, she also exceeded the jurisdiction that § 636(a) imposes on magistrate judges. Under § 636(a), the magistrate judge was only authorized to exercise the powers of Rule 41(b) under three circumstances: (1) "within the district" that appointed her-i.e., EDVA, (2) "at other places where [EDVA] may function", and (3) "elsewhere as authorized by law." § 636(a). Pennsylvania obviously does not fall within the confines of EDVA or its places of function, and we have already held that Rule 41(b) did not authorize the NIT warrant.

The NIT warrant was therefore void ab initio because it violated § 636(a) 's jurisdictional limitations and was not authorized by any positive law.8 See United States v. Master , 614 F.3d 236, 239 (6th Cir. 2010) ("[W]hen a warrant is signed by someone who lacks the legal authority necessary to issue search warrants, the warrant is void ab initio .") (quoting United States v. Scott , 260 F.3d 512, 515 (6th Cir. 2001) ); see also Horton , 863 F.3d at 1049 ("[T]he NIT warrant was void ab initio ...."); United States v. Baker , 894 F.2d 1144, 1147 (10th Cir. 1990) (suppressing evidence of search on Indian land because state court lacked authority to issue search warrant).

It follows that the Rule 41(b) violation was of constitutional magnitude because "at the time of the framing ... a warrant issued for a search or seizure beyond the territorial jurisdiction of a magistrate's powers under positive law was treated as no warrant at all." Krueger , 809 F.3d at 1123 (Gorsuch, J., concurring); see also Engleman v. Deputy Murray , 546 F.3d 944, 948-49 (8th Cir. 2008) ("Under a historical understanding of the Fourth Amendment, the jurisdiction of the issuing judge and the executing officer is limited, and a warrant is not valid if an officer acts outside of that limited jurisdiction.").

The Government retorts that the NIT warrant was valid for the purposes of the Fourth Amendment because it met the Supreme Court's three constitutional requirements for validity: it was "(1) supported by probable cause, (2) sufficiently particular, and (3) issued by a neutral and detached magistrate." Government Br. at 36 (citing Dalia v. United States , 441 U.S. 238, 255, 99 S.Ct. 1682, 60 L.Ed.2d 177 (1979) ). Furthermore, the Government frames Rule 41(b) as a venue provision that is entirely procedural in nature and not substantive-accordingly, because the Fourth Amendment is silent about the proper venue for applying for a search warrant, a Rule 41(b) violation can "only rarely [be] deemed constitutional." Id . at 38. But none of this overcomes our dispositive finding that the magistrate judge acted outside of her jurisdiction under § 636(a). As the D.C. Circuit aptly put it, "[e]ven if we assume that an imperfect authorizing order could be thought facially sufficient, we do not see how a blatant disregard of a ... judge's jurisdictional limitation can be regarded as only 'technical.' " United States v. Glover , 736 F.3d 509, 515 (D.C. Cir. 2013).9

*215D. The Exclusionary Rule and Good Faith Exception

Having established that a Fourth Amendment violation occurred, we must now address an issue of first impression for this Court: does the good-faith exception to the exclusionary rule apply when a warrant is void ab initio due to the magistrate judge lacking jurisdiction to issue it? We must consider the purpose of the exclusionary rule to address this inquiry. See United States v. Wright , 777 F.3d 635, 640 (3d Cir. 2015) (considering "the extent to which the violation ... undermined the purposes of the Fourth Amendment" when applying exclusionary rule).

The exclusionary rule is a prudential doctrine that "prevent[s] the government from relying at trial on evidence obtained in violation of the [Fourth] Amendment's strictures." Franz , 772 F.3d at 145. However, the rule is not intended to remedy Fourth Amendment violations, and does not necessarily apply each time a violation occurs. See Herring v. United States , 555 U.S. 135, 140, 129 S.Ct. 695, 172 L.Ed.2d 496 (2009). Put differently, "there is no constitutional right to have the evidentiary fruits of an illegal search or seizure suppressed at trial." United States v. Katzin , 769 F.3d 163, 170 (3d Cir. 2014) (en banc); see Davis v. United States , 564 U.S. 229, 236,