United States v. Daigle

Court of Appeals for the First Circuit·Decided June 10, 2026·No. 24-1889·Published

Opinion

United States Court of Appeals For the First Circuit

No. 24-1889 UNITED STATES OF AMERICA, Appellee,

v.

ROBERT DAIGLE,

Defendant, Appellant.

APPEAL FROM THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MASSACHUSETTS

[Hon. Nathaniel M. Gorton, U.S. District Judge]

Before

Barron, Chief Judge,

Lipez and Rikelman, Circuit Judges.

Zainabu Rumala, Assistant Federal Public Defender, for appellant.

Randall E. Kromm, Assistant United States Attorney, with whom Leah B. Foley, United States Attorney, was on brief, for appellee.

June 10, 2026

RIKELMAN, Circuit Judge. Robert Daigle appeals the denial of his motion to suppress evidence discovered in a search of his home. According to Daigle, the government did not establish probable cause to believe that child pornography would be found on his home computer at the time of the search. The district court concluded otherwise, relying on facts showing that, nine months earlier, a computer with an IP address tied to Daigle's residence had logged requests on a specialized network for three electronic files that contained child pornography, all within ten minutes. We conclude that these facts were sufficient to meet the probable cause standard and thus affirm.

I. BACKGROUND

A. Relevant Facts

This case arises from a decade-long investigation by law enforcement into Freenet, a peer-to-peer network that "allows users to anonymously share files, chat on message boards, and access websites within the network." To put the legal issues in context, we recount the basic mechanics of Freenet, as well as the events that led the government to Daigle. We draw the facts from the search warrant affidavit submitted in this case by Special Agent Brian O'Sullivan of the Federal Bureau of Investigation (FBI).

1. The Mechanics of Freenet To access the Freenet network, "a user must first download the Freenet software, which is free and publicly available." A computer running the Freenet software "connects directly to other computers running Freenet, which are called its 'peers.'" When a user installs Freenet, they "agree[] to provide to the network a portion of the storage space on [their] computer hard drive, so that files uploaded by Freenet users can be distributed and stored across the network."

Once a user uploads a file to Freenet, "the software breaks the file into pieces (called 'blocks') and encrypts each piece." These encrypted blocks are then "distributed randomly" and stored by peer computers. Freenet creates an "index piece," which contains a list of all the file's blocks, and assigns a "unique key -- a series of letters, numbers and special characters" -- to the file.

To download a file on Freenet, a user must have the key associated with that file. When a user tries to download a file, Freenet requests that file's blocks from other computers running the Freenet software (the peers). Instead of requesting all the blocks from one peer, Freenet "divide[s] up" the block requests "in roughly equal amounts among the user's peers." If a peer computer does not have the requested blocks, that peer will divide up the request and ask additional peers for the missing blocks,

and so on. Critically, just because a user requests a file does not guarantee that they can retrieve the blocks for that file or download it.

Freenet's design "attempts to hide" which user uploaded or downloaded a file "by making it difficult to differentiate" between the original requestor of a file and a peer who simply forwarded another peer's request for that file. Still, "Freenet warns its users in multiple ways that it does not guarantee anonymity," including by explaining on its public website that it does not mask a computer's IP address.

Although Freenet is not dedicated to child pornography, users can "advertise and distribute images and videos of child pornography" on the network.1 Importantly, Freenet does not offer a search function, meaning that a user in search of child pornography must first identify the key for a specific file and then use that key to download the file. To obtain such a key, Freenet users can go to "message boards" on the network, where other users might post messages related to child pornography. These message boards often have labels that are suggestive of the

1A peer-reviewed, publicly available academic paper studied 70,000 keys "posted to forums [on Freenet] openly dedicated to child sexual exploitation and confirmed to include known [child pornography] images." Brian N. Levine et al., Statistical Detection of Downloaders in Freenet, Procs. Inst. of Elec. & Elecs. Eng'rs Int'l Workshop on Priv. Eng'g, May 2017, at 8. That study determined that approximately 35% of Freenet's overall traffic related to requests for files using those keys. See id.

sexual exploitation of children. Freenet users can also access websites that only operate within the network, known as "Freesites." Certain Freesites contain viewable images of child pornography, along with keys related to child pornography files.

To support investigations into the sharing of child pornography on Freenet, law enforcement officers have access to a modified version of the Freenet software, which has been loaded onto government computers. This modified version is "nearly identical to Freenet," except that it permits officers to track certain information about each request for file blocks that government computers receive from Freenet users. This information includes the requesting user's IP address.

Law enforcement officers "do not target specific peers on Freenet nor do [they] solicit requests from any peers." Rather, they "collect keys associated with suspected child pornography files" and only investigate Freenet users who use those keys to request files. Officers obtain such keys from Freenet message boards, Freesites, and their prior investigations.

A peer-reviewed, publicly available academic paper describes a mathematical formula for determining whether a request for a file of interest originated from a given computer. See Brian N. Levine et al., Statistical Detection of Downloaders in Freenet, Procs. Inst. of Elec. & Elecs. Eng'rs Int'l Workshop on Priv. Eng'g, May 2017, at 8. Based on his training and experience,

O'Sullivan "believe[d] [the formula] to be a reliable method" for law enforcement officers to use in identifying which computer on the Freenet network initiated a request for child pornography files.

2. The Investigation

Using their modified version of Freenet, law enforcement officers identified a computer with an IP address of 96.230.244.94, which was running the Freenet software. Within a ten-minute timeframe, the user of that computer had requested the blocks of three different files. Officers knew that each of those three files contained child pornography. They had acquired the keys for the three files from various sources: a Freenet message board, a Freesite, and a previous investigation. But they were "not aware of how, or from where, this particular Freenet user obtained [the] key[s] in order to attempt to retrieve the files of interest."

The Freenet user initiated the three file requests on Sunday, April 11, 2021, at 7:10 PM, 7:13 PM, and 7:20 PM. Based on the mathematical formula discussed above, O'Sullivan believed that this Freenet user was "the original requestor" of the three files. Law enforcement officers linked the user's IP address to a computer located in a home in Waltham, Massachusetts, which they subsequently confirmed was Daigle's residence.

As O'Sullivan explained, requesting blocks associated with a file on Freenet is equivalent to a "user attempt[ing] to

download the file's contents from Freenet." Making such an attempt, however, does not mean that the user "retrieved all of the necessary [blocks] to successfully download the file." During their investigation, law enforcement officers were unable to confirm whether the user who had requested the three files on April 11 had in fact downloaded them.

Free access — add to your briefcase to read the full text and ask questions with AI

United States v. Daigle, (1st Cir. 2026).

United States v. Daigle (United States v. Daigle) — published by Counsel Stack Legal Research, free access to 12M+ legal documents.

Related

United States v. Vosburgh
602 F.3d 512 (Third Circuit, 2010)
United States v. Falso
544 F.3d 110 (Second Circuit, 2008)
Franks v. Delaware
438 U.S. 154 (Supreme Court, 1978)
Illinois v. Gates
462 U.S. 213 (Supreme Court, 1983)
United States v. Zayas-Diaz
95 F.3d 105 (First Circuit, 1996)
United States v. Morales-Aldahondo
524 F.3d 115 (First Circuit, 2008)
United States v. Peter John Weber
923 F.2d 1338 (Ninth Circuit, 1991)
United States v. Micah J. Gourde
440 F.3d 1065 (Ninth Circuit, 2006)
United States v. McLellan
792 F.3d 200 (First Circuit, 2015)
United States v. Flores
888 F.3d 537 (First Circuit, 2018)
United States v. Anzalone
923 F.3d 1 (First Circuit, 2019)
United States v. Roman
942 F.3d 43 (First Circuit, 2019)
United States v. Raymonda
780 F.3d 105 (Second Circuit, 2015)
United States v. Sylvestre
78 F.4th 28 (First Circuit, 2023)
United States v. Cortez
108 F.4th 1 (First Circuit, 2024)
United States v. Gonzalez
113 F.4th 140 (First Circuit, 2024)