United States v. Andrew Moorehead

912 F.3d 963
CourtCourt of Appeals for the Sixth Circuit
DecidedJanuary 9, 2019
Docket18-5216
StatusPublished
Cited by51 cases

This text of 912 F.3d 963 (United States v. Andrew Moorehead) is published on Counsel Stack Legal Research, covering Court of Appeals for the Sixth Circuit primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
United States v. Andrew Moorehead, 912 F.3d 963 (6th Cir. 2019).

Opinion

COLE, Chief Judge.

This case is one of many that have arisen from the government's investigation into a child pornography website known as "Playpen." Andrew Moorehead was indicted for possession and receipt of child pornography based on his activity on the website. He moved to suppress the evidence against him, arguing that it was obtained *965 as a result of an invalid warrant. The district court denied his motion, and Moorehead now appeals. Because the good-faith exception to the exclusionary rule applies, we affirm.

I.

In December 2014, a foreign law enforcement agency informed the FBI of its suspicion that an IP address in the United States was associated with Playpen. After accessing Playpen and verifying the nature of its contents, the FBI obtained and executed a search warrant at Centrilogic, a server hosting company in North Carolina that owned the IP address. The FBI seized the server that was assigned the relevant IP address and confirmed that it contained a copy of Playpen. The agents relocated a copy of the server to a government facility in Newington, Virginia. Because of a server misconfiguration, the government was able to identify the administrator of Playpen and gain administrative control of the website. For approximately two weeks, the FBI continued to operate Playpen from a government-controlled computer server at its facility in Newington.

Even with administrative control, however, the government was unable to identify the individuals who logged into Playpen because the website operates on the Onion Router ("Tor")-an anonymity network that masks computer users' IP addresses. Ordinarily, when the government seizes control of an illicit website, law enforcement officers can access the website's IP log-which records the IP addresses that have accessed the website-and use the log to locate and apprehend the website's users. But because Playpen was operating on Tor, the IP addresses of the users were hidden, and traditional investigative techniques were unavailable.

To combat the problem of user anonymity, the FBI turned to counter-technology called the Network Investigative Technique ("NIT"). The NIT works as follows:

• When a user logs into Playpen by entering a username and password, the NIT is downloaded on the user's computer.
• Once downloaded, the NIT obtains the following information from the user's computer: (1) the IP address; (2) a unique identifier that distinguishes the data from that of other computers; (3) the type of operating system; (4) information regarding whether the NIT has already been delivered to that computer; (5) the Host Name; (6) an active operating system username; and (7) a Media Access Control address.
• That information is then sent to a computer controlled by the government in Newington.

The government sought a warrant in the Eastern District of Virginia authorizing use of the NIT. Specifically, the warrant sought to "cause an activating computer- wherever located -to send [identifying information] to a computer controlled by or known to the government." (Mot. Suppress, Ex. 3, R. 45-3, PageID 452) (emphasis added.) The affidavit in support of the warrant described the large number of Playpen users: "[O]ver 1,500 unique users visit[ ] the website daily and over 11,000 unique users visit[ ] the website over the course of a week." ( Id. at PageID 441.) On February 20, 2015, a magistrate judge in the Eastern District of Virginia signed a warrant authorizing the government to deploy the NIT on "any user or administrator who logs into [Playpen] by entering a username and password" (the "NIT Warrant"). ( Id. at PageID 421-422.)

Between March 1, 2015 and March 5, 2015, a user named "logidragon321" logged into Playpen for a little over three and a half hours. On March 2, 2015, while "logidragon321"

*966 was logged into Playpen, law enforcement personnel deployed the NIT and identified the IP address associated with the username. An administrative subpoena was sent to Jackson Energy Authority, the Internet Service Provider that operated the IP address. The subpoena response indicated that Rebecca Moorehead was paying for the Internet service at a residence in Tennessee, and an open source database revealed that she and Andrew Moorehead were the occupants of the residence.

On September 22, 2015, the government obtained a residential warrant for the Moorehead property, and officers executed the warrant on September 24, 2015, seizing Andrew Moorehead's computer equipment. During the execution of the search warrant, Moorehead admitted that he used the Internet to view child pornography and that "logidragon321" was his user name.

Moorehead was indicted by a federal grand jury for one count of possession of child pornography in violation of 18 U.S.C. § 2252 (a)(4)(B) and one count of receipt of child pornography in violation of 18 U.S.C. § 2252 (a)(2). He filed a motion to suppress the evidence obtained from the government's use of the NIT, arguing that the NIT Warrant violated Federal Rule of Criminal Procedure 41 and 28 U.S.C. § 636 (a) because it was executed outside of the magistrate judge's territorial jurisdiction. On June 6, 2017, the district court denied Moorehead's motion to suppress.

Subsequently, Moorehead pleaded guilty to receipt of child pornography and the government agreed to dismiss the possession charge. The plea agreement reserved Moorehead's right to appeal the denial of his motion to suppress.

On February 27, 2018, Moorehead was sentenced to 97 months' imprisonment. Moorehead filed a timely notice of appeal the following day.

II.

On appeal from the denial of a motion to suppress, "we review the district court's findings of fact for clear error and its conclusions of law de novo." United States v. Buford , 632 F.3d 264 , 268 (6th Cir. 2011) (citation omitted). The evidence is reviewed "in the light most likely to support the district court's decision." United States v. Powell , 847 F.3d 760 , 767 (6th Cir. 2017), cert. denied , --- U.S.

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Cite This Page — Counsel Stack

Bluebook (online)
912 F.3d 963, Counsel Stack Legal Research, https://law.counselstack.com/opinion/united-states-v-andrew-moorehead-ca6-2019.