United States v. Donald Dorosheff

110 F.4th 999

• Court: Court of Appeals for the Seventh Circuit
• Decided: August 6, 2024
• Docket: 22-2291
• Status: Published

Opinion

In the

United States Court of Appeals for the Seventh Circuit ____________________ No. 22-2291 UNITED STATES OF AMERICA, Plaintiff-Appellee,

v.

DONALD DOROSHEFF, Defendant-Appellant. ____________________

Appeal from the United States District Court for the Central District of Illinois. No. 16-CR-30049-001 — Sue E. Myerscough, Judge. ____________________

ARGUED MAY 23, 2023 — DECIDED AUGUST 6, 2024 ____________________

Before SYKES, Chief Judge, and BRENNAN and PRYOR, Circuit Judges. SYKES, Chief Judge. This case is one of many prosecutions arising from an extensive investigation of a dark-web child- pornography website known as “Playpen.” The FBI gained control of the website’s servers in 2015 and obtained a warrant to deploy a sophisticated computer program—in the agency’s jargon, a “Network Investigative Technique” or “NIT” for short—to penetrate the dark web’s anonymizing 2 No. 22-2291

features and unmask hundreds of Playpen users. With those identities in hand, agents obtained additional warrants to search the residences and computers of the website’s users across the country. Donald Dorosheff is one of many Playpen users who were identified using the NIT program. A resident of Springfield, Illinois, he was charged in the Central District of Illinois with receiving and possessing child pornography. He sought to suppress the evidence recovered from his digital devices after he was unmasked. Like other Playpen defendants, he argued that the judicial officer who issued the NIT warrant—a magistrate judge in the Eastern District of Virgina—lacked the authority under Rule 41 of the Feder- al Rules of Criminal Procedure to authorize an electronic search extending outside her district. That lack of authority, he contended, meant that the subsequent searches of his devices violated the Fourth Amendment. The district judge agreed that Rule 41 did not authorize the issuance of the extraterritorial NIT warrant but applied the good-faith exception and declined to suppress the evidence. We have twice affirmed the application of the good-faith exception to evidence obtained in searches flowing from the Playpen NIT warrant. See United States v. Grisanti, 943 F.3d 1044 (7th Cir. 2019); United States v. Kienast, 907 F.3d 522 (7th Cir. 2018). Here Dorosheff raises a new argument based on the Justice Department’s support for an amendment to Rule 41 expressly authorizing magistrate judges to issue this kind of warrant. This evidence, he insists, demonstrates that high- ranking Department officials knew that the Playpen NIT warrant was invalid, and their knowledge should be imput- No. 22-2291 3

ed to the FBI agent who applied for the warrant, thus defeat- ing the good-faith exception. This argument is new for us but other circuits have ad- dressed and uniformly rejected it. We join the consensus and adhere to our precedent that evidence derived from the Playpen NIT warrant is admissible under the good-faith exception to the exclusionary rule. I. Background Playpen was a global online forum that enabled users to access, distribute, and discuss child pornography. Because the website existed on the dark web, a user had to download an anonymizing software called “Tor” before accessing it. Tor hid the identities of users by preventing websites from registering the Internet Protocol (“IP”) addresses of access- ing computers. With that software installed, a user could join Playpen by obtaining the site’s unique web address—a random sequence of numbers and letters—and signing up with a username and password. FBI agents arrested Playpen’s administrator and gained control of the servers in early 2015. But the FBI did not immediately shut the website down. Instead, as part of Operation Pacifier, Special Agent Douglas Macfarlane submitted a warrant application and supporting affidavit to a magistrate judge in the Eastern District of Virginia. Those documents described Playpen, Tor, and the government’s investigation in detail. They also explained the government’s plan for unmasking Playpen users with the NIT. Although the NIT was sophisticated, the proposed plan was straightforward. The FBI would keep Playpen running for a limited time. When a user accessed the website, the NIT 4 No. 22-2291

would send instructions to that user’s computer telling it to transmit its IP address and other identifying information to a government-controlled computer. The warrant application made clear that this identifying information could be seized “[f]rom any ‘activating’ computer,” meaning any computer that logged into Playpen. And the affidavit stated that the NIT “may cause” activating computers “wherever located” to send that information to the government. The magistrate judge issued the NIT warrant in February 2015. During the short time that Playpen remained opera- tional, a user accessed the website under the name “Grite.” The IP address associated with that account belonged to Donald Dorosheff, a resident of Springfield, so an FBI agent in Illinois sought and obtained a warrant to search his apartment and any computers and computer media (like digital storage devices) inside. Agents found one video and over 1,100 images of child pornography on Dorosheff’s digital devices. Dorosheff was charged with two counts of receiving child pornography, 18 U.S.C. § 2252A(a)(2)(A) and (b)(1), and two counts of possessing child pornography, id. § 2252A(a)(5)(B) and (b)(2). He moved to suppress the evidence recovered from his digital devices on the basis that the NIT warrant—which led to the Illinois warrant—was invalid because the Virginia magistrate judge lacked the authority under Rule 41(b) to issue a warrant for a search of this type outside her district. See FED. R. CRIM. P. 41(b) (2015) (describing a magistrate judge’s authority to issue warrants). No. 22-2291 5

The district judge denied the suppression motion.1 She found that the NIT warrant was supported by probable cause but agreed with Dorosheff that the magistrate judge had exceeded the scope of her authority under Rule 41(b) to issue a warrant to search property outside her district. The judge determined, however, that the evidence recovered in the search of Dorosheff’s devices was admissible under the good-faith exception to the exclusionary rule. She reasoned that suppression wouldn’t deter police misconduct because the extent of the magistrate judge’s authority under the rule was a difficult and contested legal question, and the officers who obtained and executed the Playpen NIT warrant acted in an objectively reasonable manner in relying on the judge’s assessment of the law. Dorosheff moved for reconsideration, but the judge declined to alter her decision. Dorosheff later filed a second suppression motion raising a new argument aimed directly at the application of the good-faith exception. He argued that senior officials at the Department of Justice (“DOJ” or “the Department”) knew that the NIT warrant would violate Rule 41(b) at the time Agent Macfarlane applied for it. To support this sweeping claim, Dorosheff highlighted the DOJ’s advocacy of an amendment to Rule 41(b) that would expressly authorize this kind of remote electronic search warrant. The Depart- ment’s pursuit of the amendment, he suggested, was evi- dence that high-ranking DOJ officials knew that the NIT warrant was invalid, and under the collective-knowledge

1 Dorosheff’s first motion also challenged the Illinois warrant. But the

judge rejected his arguments about that warrant because the affidavit set forth sufficient facts to establish probable cause. 6 No. 22-2291

doctrine, this knowledge should be imputed to the agents on the ground who were involved in the warrant application. The judge rejected this argument and denied the second suppression motion. She noted that the good-faith exception considers the “culpability of the officers who obtain and execute the warrant,” not the government writ large. And Dorosheff had failed to connect any of the high-ranking officials involved in the Rule 41 amendment process to the Playpen NIT warrant application. As before, the judge ruled that the evidence recovered from Dorosheff’s devices was admissible under the good-faith exception because suppres- sion would not meaningfully deter culpable law- enforcement conduct. The case then proceeded to trial. Dorosheff waived his right to a jury and the case was tried to the court. The judge found Dorosheff guilty on all counts and imposed sentence. This appeal followed.2 II. Discussion Dorosheff challenges only the judge’s denial of his sup- pression motions. We review the judge’s legal conclusions de novo and her findings of fact for clear error. United States v. James, 571 F.3d 707, 713 (7th Cir. 2009). As in Kienast and Grisanti, we take no position on the merits of the underlying Rule 41(b) and Fourth Amendment questions; here, as in those cases, our focus is on the good-faith exception to the

2 We appointed Attorney Robert J. Palmer to represent Dorosheff pursuant to the Criminal Justice Act. He supervised law student Shane Coughlin of the University of Notre Dame Law School, who assisted him on this appeal. They have ably discharged their duties. We thank them for their service to their client and the court. No. 22-2291 7

exclusionary rule. Dorosheff has not given us a good reason to depart from our prior cases holding that the good-faith exception applies to evidence recovered in searches flowing from the Playpen NIT warrant. Because we’ve addressed this specific issue twice before, we can be brief. The exclusionary rule is a judge-made remedy “meant to deter future Fourth Amendment viola- tions,” Kienast, 907 F.3d at 527, but suppressing evidence is a “last resort, not [a] first impulse,” Hudson v. Michigan, 547 U.S. 586, 591 (2006). We apply the exclusionary rule only when its deterrence benefits “outweigh its substantial social costs.” Id. (internal quotation marks omitted). Crucially, the deterrence side of the equation focuses exclusively on “cul- pable law enforcement conduct.” Davis v. United States, 564 U.S. 229, 246 (2011). That’s what suppression must meaning- fully deter for the remedy to be appropriate. And that’s why suppressing evidence is inappropriate when doing so would “[p]enaliz[e] the officer for the magistrate’s error[] rather than his own.” United States v. Leon, 468 U.S. 897, 921 (1984). So when a law-enforcement officer acts within the scope of a warrant obtained in “objective good faith … from a judge or magistrate, … the good-faith exception generally applies even if the warrant turns out to be invalid.” Grisanti, 943 F.3d at 1049 (internal quotation marks omitted). These limits on the exclusionary rule explain why we have twice rejected efforts to suppress evidence derived from the NIT warrant. In Kienast several Playpen defendants argued that the good-faith exception is categorically inappli- cable when a judge lacks authority to issue a particular warrant but does so anyway. 907 F.3d at 527. We bypassed the complicated underlying legal questions about the magis- 8 No. 22-2291

trate judge’s authority under Rule 41(b); assuming for the sake of argument that the judge improperly issued the Playpen NIT warrant, we did not see how that flaw differed from other kinds of judicial errors. Id. at 528. Suppressing evidence because the magistrate judge misunderstood the scope of her authority—just like suppressing evidence because the magistrate erred in assessing probable cause— would “[p]enaliz[e] the officer for the magistrate’s error.” Id. (quoting Leon, 468 U.S. at 921) (first alteration in original). We also rejected the defendants’ argument that “the of- ficers should have known that the magistrate judge lacked authority to issue” the NIT warrant. Id. Whether the warrant was consistent with Rule 41(b) “pose[d] difficult conceptual questions”; that much was clear from the split that had emerged among district courts on the issue. Id. at 528–29. So if the magistrate judge made a mistake about the scope of her authority, that “would not necessarily have been obvious to the officers.” Id. at 529. A year later another Playpen defendant in our circuit tried to distinguish Kienast and avoid the good-faith excep- tion. He primarily argued that Agent Macfarlane obtained the warrant in bad faith because his affidavit suggested that all searches would take place in the magistrate judge’s district. Grisanti, 943 F.3d at 1050. We rejected this argument too. The affidavit described the NIT and stated that it could recover information from computers “wherever located” if those computers accessed Playpen. Id. (emphasis added). And Agent Macfarlane gave the judge “ample information” to enable follow-up questions about the warrant’s geograph- ic scope—and about the potential legal implications of that scope. Id. at 1051. No. 22-2291 9

Ten other circuits have encountered appeals stemming from the Playpen NIT warrant. Some have ventured into the difficult underlying Rule 41(b) and Fourth Amendment issues. See, e.g., United States v. Taylor, 935 F.3d 1279, 1285–88 (11th Cir. 2019) (holding that the magistrate judge’s issuance of the NIT warrant violated Rule 41(b) and that subsequent searches violated the Fourth Amendment). All have applied the good-faith exception.3 The common theme is one we expressed in Kienast: The legal issues surrounding Rule 41(b) were complex and unsettled when Agent Macfarlane applied for the NIT warrant, so the agents involved acted reasonably by presenting a detailed affidavit and deferring to the magis- trate judge’s resolution of any legal questions implicated by the warrant. See, e.g., United States v. Levin, 874 F.3d 316, 323 (1st Cir. 2017) (“We see no benefit in deterring such con- duct—if anything, such conduct should be encouraged[] because it leaves it to the courts to resolve novel legal is- sues.”); Taylor, 935 F.3d at 1292 (explaining that given the “complex new technology at issue,” the officers “did what we would hope and expect—they fully disclosed the me- chanics of the intended search, left the constitutional call to the magistrate judge, and acted in reasonable reliance on the resulting warrant”). And because any error resulting from

3 See United States v. Levin, 874 F.3d 316, 321–24 (1st Cir. 2017); United

States v. Eldred, 933 F.3d 110, 118–21 (2d Cir. 2019); United States v. Werdene, 883 F.3d 204, 215–18 (3d Cir. 2018); United States v. McLamb, 880 F.3d 685, 690–91 (4th Cir. 2018); United States v. Ganzer, 922 F.3d 579, 584–90 (5th Cir. 2019); United States v. Moorehead, 912 F.3d 963, 967–71 (6th Cir. 2019); United States v. Horton, 863 F.3d 1041, 1049–52 (8th Cir. 2017); United States v. Henderson, 906 F.3d 1109, 1117–20 (9th Cir. 2018); United States v. Workman, 863 F.3d 1313, 1317–21 (10th Cir. 2017); United States v. Taylor, 935 F.3d 1279, 1288–93 (11th Cir. 2019). 10 No. 22-2291

those difficult legal questions was made by the magistrate judge rather than by the officers, the “benefits of deterrence cannot outweigh the costs” of suppression. United States v. Moorehead, 912 F.3d 963, 971 (6th Cir. 2019) (internal quota- tion marks omitted). Dorosheff offers a new argument centering on the DOJ’s advocacy of an amendment to Rule 41(b) expressly authoriz- ing magistrate judges to issue warrants like this one. These efforts, he contends, demonstrate that high-ranking Depart- ment officials knew that warrants of this type were invalid at the time, undermining our conclusions in Grisanti and Kienast that the good-faith exception applies to searches flowing from the Playpen NIT warrant. For additional support, he points to In re Warrant to Search a Target Computer at Premises Unknown, 958 F. Supp. 2d 753, 756–58 (S.D. Tex. 2013), in which a magistrate judge determined that a similar remote-access warrant exceeded his authority under Rule 41(b). As Dorosheff sees it, this evidence demonstrates that DOJ officials were aware that Rule 41(b) as then written did not authorize warrants of this type; he urges us to apply the “collective knowledge” doctrine and impute their knowledge of Rule 41(b)’s limits to the agents involved in the Playpen NIT warrant process. Our colleagues in other circuits have uniformly rejected this argument, explaining that it rests on the flawed premise that the DOJ’s support for an amendment to Rule 41(b) amounts to an “admission” that remote-access warrants like the Playpen NIT warrant were beyond the scope of the then- existing rule; our sister circuits have instead recognized that the Department’s push for an amendment was simply “an attempt to clarify an existing [rule’s] application to new No. 22-2291 11

circumstances.” United States v. Ganzer, 922 F.3d 579, 589 (5th Cir. 2019); see also Taylor, 935 F.3d at 1292 n.14 (“We see no benefit to deterring officers from attempting to describe cutting-edge countermeasures using the forms and resources at their disposal while department heads simultaneously seek to amend the rules to better address advancing technol- ogy.”); United States v. Eldred, 933 F.3d 110, 119–20 (2d Cir. 2019) (rejecting the argument that the amendment efforts and communications about such efforts render the good- faith exception inapplicable); United States v. Cookson, 922 F.3d 1079, 1088–90 (10th Cir. 2019) (same); Moorehead, 912 F.3d at 970 (same); United States v. Werdene, 883 F.3d 204, 218 nn.11–12 (3d Cir. 2018) (same). We agree with this reasoning. The DOJ’s effort to amend Rule 41 does not undermine the application of the good-faith exception to derivative evidence from the Playpen NIT warrant. The DOJ’s advocacy for a change in the rule shows only that the Department was aware of an unsettled legal issue and had urged the judiciary to update the rule to address more explicitly the special circumstances that arise when dealing with cutting-edge technology in the digital age. Cookson, 922 F.3d at 1089. Indeed, as reflected in the 2013 letter from the Acting As- sistant Attorney General to the Judicial Conference’s Adviso- ry Committee on Criminal Rules, the DOJ proposed that the rules committee consider amending Rule 41(b) to “clarify the procedural rules” that law-enforcement agents should follow when pursuing similar warrants. The Advisory Committee agreed, and the rule was eventually revised. But the “proposed and actual amendment” of Rule 41(b) “bear[s] no clear indications that the pre-amendment Rule 41 forbade 12 No. 22-2291

the NIT warrant, let alone that the FBI knew as much.” Cookson, 922 F.3d at 1090. Rather, the amendment history confirms what 11 circuits—including ours—have concluded: the scope of Rule 41(b) was simply “unclear at the time the NIT warrant issued,” id., so the agents involved in the investigation sensibly left the difficult legal questions to the magistrate judge and acted in good-faith reliance on the resulting warrant. Nor does a single decision from a magistrate judge in Texas support Dorosheff’s claim that DOJ officials knew the NIT warrant exceeded the scope of the old Rule 41(b). Id. at 1089; see also Werdene, 883 F.3d at 218 n.12. The 2013 In re Warrant decision might have alerted them to the uncertain legal landscape, but it hardly conclusively settled the issue. Dorosheff’s argument suffers from an additional flaw. He contends that the collective-knowledge doctrine requires us to impute the (supposed) knowledge of high-ranking DOJ officials to the FBI agents involved in the NIT warrant process. This argument misunderstands the doctrine, which permits a law-enforcement officer to rely on facts supplied by other officers to support a “stop, search, or arrest [of] a suspect … even if the officer himself” lacks “firsthand knowledge of facts that amount to the necessary level of suspicion.” United States v. Williams, 627 F.3d 247, 252 (7th Cir. 2010); see also United States v. Ellis, 499 F.3d 686, 690 (7th Cir. 2007) (explaining that “[t]his doctrine permits arresting officers to rely on the knowledge … of other officers” who communicate that knowledge). The doctrine recognizes that police “must often act swiftly” in response to developing circumstances and “cannot be expected to cross-examine their fellow officers” about the information transmitted to No. 22-2291 13

them in an ongoing investigation. United States v. Harris, 585 F.3d 394, 400 (7th Cir. 2009) (quoting United States v. Hensley, 469 U.S. 221, 231 (1985)). The collective-knowledge doctrine has no application in this context. The good-faith inquiry turns on the “objective reasonableness” of the actions of the officers who participat- ed in the warrant application and subsequent search—that is, those “who eventually executed a warrant,” “who origi- nally obtained it,” and “who provided information material to the probable-cause determination.” Leon, 468 U.S. at 923 n.24. The good-faith exception applies here because the agents involved in obtaining and executing the Playpen NIT warrant reasonably relied on the magistrate judge’s determi- nation of her authority under Rule 41(b). Dorosheff also points out that Agent Macfarlane did not use the agency’s specialized warrant application form for a so-called “tracking device” warrant, which magistrate judges may issue in some circumstances under Rule 41(b)(4). See Taylor, 935 F.3d at 1286. The government argues, as it has before, that Rule 41(b)(4) authorized the Playpen NIT war- rant because the NIT qualified as a type of “tracking device” designed to “track the movement of a person or property located within … [or] outside the [judge’s] district.” FED. R. CRIM. P. 41(b)(4). In Dorosheff’s view, Agent Macfarlane’s use of a general warrant application form—instead of a “track- ing device” application form—is evidence that he knew that the warrant he was seeking exceeded the magistrate judge’s Rule 41 authority. The argument about the form is a red herring, as five cir- cuits have recognized. See Taylor, 935 F.3d at 1285–86, 1293; Moorehead, 912 F.3d at 970–71; Werdene, 883 F.3d at 211, 218; 14 No. 22-2291

United States v. McLamb, 880 F.3d 685, 690–91 (4th Cir. 2018); Workman, 863 F.3d at 1320–21. The proper inquiry is not which form was used but whether the agents involved “act[ed] with an objectively reasonable good-faith belief that their conduct [was] lawful.” Kienast, 907 F.3d at 527 (quoting Davis, 564 U.S. at 238). Agent Macfarlane applied for a complex warrant involv- ing sophisticated technology to counteract the unique inves- tigative difficulties posed by the dark web. His job was to provide a neutral magistrate judge with accurate details about this technology, the investigation, and the proposed search so that the judge could decide any relevant legal issues. That’s what he did. See McLamb, 880 F.3d at 690 (“Although he does not specifically use the term ‘tracking device’ in his affidavit, Agent Macfarlane’s detailed descrip- tion of the NIT was sufficient to inform the magistrate judge of the scope of the warrant sought.”); Levin, 874 F.3d at 323 (noting that Agent Macfarlane’s “detailed affidavit” de- scribed the “investigation, including how the NIT works,” and information about the proposed searches). Suppressing evidence because law enforcement used a general rather than specialized warrant application form would not serve the limited purpose of the exclusionary rule: the deterrence of “sufficiently deliberate” and “suffi- ciently culpable” police conduct. Herring v. United States, 555 U.S. 135, 144 (2009). In short, we agree with the Eleventh Circuit: “[T]he officers did the best they could with what they had—a general application form that was perhaps ill- suited to the complex new technology at issue.” Taylor, 935 F.3d at 1292. This case does not implicate deliberately culpa- No. 22-2291 15

ble police conduct, so the “benefits of suppression” do not “outweigh its heavy costs.” Davis, 564 U.S. at 237. AFFIRMED