United States v. Gabriel Werdene

883 F.3d 204
CourtCourt of Appeals for the Third Circuit
DecidedFebruary 21, 2018
Docket16-3588
StatusPublished
Cited by40 cases

This text of 883 F.3d 204 (United States v. Gabriel Werdene) is published on Counsel Stack Legal Research, covering Court of Appeals for the Third Circuit primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
United States v. Gabriel Werdene, 883 F.3d 204 (3d Cir. 2018).

Opinions

GREENAWAY, JR., Circuit Judge.

This case arises from the Federal Bureau of Investigation's (FBI) investigation into Playpen, a global online forum that existed on the dark web1 and that was dedicated to the advertisement and distribution of child pornography. The website had a substantial amount of users. In fact, more than 150,000 users collectively engaged in over 95,000 posts with over 9,000 forum topics related to child pornography. This appeal centers on the FBI's decision to rely on a single search warrant, issued in the Eastern District of Virginia ("EDVA"), to search the computers of thousands of Playpen users across the United States and the world using a form of government-created malware termed a "Network Investigative Technique" ("NIT").

Appellant Gabriel Werdene, a citizen of Pennsylvania, was a Playpen user whose computer was compromised by the NIT. Subsequently, he was charged in the Eastern District of Pennsylvania ("EDPA") with one count of possessing child pornography, in violation of 18 U.S.C. § 2252(a)(4)(B). He filed a motion to suppress the evidence seized during the search of his computer, including the information revealed by the use of the NIT. The District Court denied the suppression motion, holding that the NIT warrant violated the version of Fed. R. Crim. P. 41(b) then in effect (" Rule 41(b)")2 , but that the *207NIT itself did not constitute a search under the Fourth Amendment and that Werdene was not prejudiced by the error. On appeal, Werdene contends that the District Court erred in holding that no Fourth Amendment search took place. Further, he argues that the issuance of the warrant violated his Fourth Amendment rights because it lacked particularity and was issued in violation of the jurisdictional requirements set forth in both Rule 41(b) and the Federal Magistrates Act. The Government concedes that a Fourth Amendment search occurred, but contends that the NIT was authorized by Rule 41(b)(4) and that, in any event, the good-faith exception to the exclusionary rule precludes suppression.

We hold that the NIT warrant violated the prior version of Rule 41(b) and that the magistrate judge exceeded her authority under the Federal Magistrates Act. The warrant was therefore void ab initio , and the Rule 41(b) infraction rose to the level of a Fourth Amendment violation. However, we agree with the Government that the good-faith exception to the exclusionary rule may apply to warrants that are void ab initio , which ultimately precludes suppression in this case. We therefore will affirm on alternative grounds the District Court's decision to deny Werdene's suppression motion.

I. FACTS AND PROCEDURAL HISTORY

To inform our forthcoming analysis, we shall detail how Playpen escaped traditional law enforcement detection and how the FBI circumvented the dark web to apprehend its users.

A. Tor

The Playpen site operated on the anonymous "The Onion Router" ("Tor") network-a constituent part of the "dark web"-which allows users to conceal their actual internet protocol ("IP") addresses while accessing the internet.3 An IP address is a unique identifier assigned by an internet service provider to every computer having access to the internet, including computer servers that host websites. Websites that the computer user visits can log the computer's IP address, creating a digital record of activity on each website. After lawful seizure of an illicit website under normal circumstances, law enforcement is able to retrieve the website's IP log to locate and apprehend its users.

Tor, however, prevents websites from registering a computer's actual IP address by sending user communications through a network of relay computers called "nodes" up until those communications reach the website. Numerous intermediary computers therefore stand between the accessing computer and the website, and the website can log the IP address of only the "exit node", which is the final computer in the sequence. Accordingly, Playpen's IP log-like that of other Tor websites-contained only the IP addresses of the exit nodes, rendering traditional IP identification techniques useless.

B. The Playpen Investigation

In December 2014, a foreign law enforcement agency informed the FBI that Playpen was being hosted by a computer server in North Carolina. Playpen's administrator was identified as a person residing *208in Florida, who was promptly arrested.4 The FBI then lawfully seized the server, moved it to a government facility in EDVA, and obtained a wiretap order to monitor communications on it. It then assumed administrative control of Playpen and allowed the website to operate while law enforcement officials tried to circumvent Tor and identify Playpen's users.

The FBI's solution was the NIT, a form of government-created malware that allowed the FBI to retrieve identifying information from Playpen users located all around the world. The NIT's deployment worked in multiple steps. First, the FBI modified Playpen's code so that each accessing computer-unknowingly to the user and no matter the computer's physical location-downloaded the NIT whenever a "user or administrator log[ged] into [Playpen] by entering a username and password." App. 133. Once downloaded, the NIT searched the accessing computer for seven discrete pieces of identifying information: (1) an IP address; (2) a unique identifier to distinguish the data from that of other computers; (3) the type of operating system; (4) information about whether the NIT had already been delivered; (5) a Host Name; (6) an active operating system username; and (7) a Media Access Control address. Finally, the NIT transmitted this information back to a government-controlled computer in EDVA. The FBI postulated that it could then rely on this information to identify users' premises and distinguish their computers from other computers located within their proximity.

In February 2015, the FBI obtained a search warrant from a magistrate judge in EDVA to deploy the NIT to all "activating computers." App. 106. An "activating computer" was defined in the search warrant as the computer of "any user or administrator who logs into [Playpen] by entering a username and password." Id . Further, the NIT could be deployed to any activating computer "wherever located ." App. 136 (emphasis added). In other words, this single warrant authorized the FBI to retrieve identifying information from computers all across the United States, and from all around the world. Most importantly, these computers were overwhelmingly located outside of EDVA.

C. Charges Against Werdene and Suppression Motion

Analysis of the NIT data revealed the IP address of a Playpen user, eventually identified as Werdene, residing in Bensalem, Pennsylvania.

Free access — add to your briefcase to read the full text and ask questions with AI

Related

State Of Washington, V. Justin R. Smith
Court of Appeals of Washington, 2025
United States v. Donald Dorosheff
110 F.4th 999 (Seventh Circuit, 2024)
Zadeh v. State
Court of Special Appeals of Maryland, 2023
Barnes v. United States
M.D. Florida, 2022
United States v. Thorne
District of Columbia, 2021
United States v. Robert Caesar
2 F.4th 160 (Third Circuit, 2021)
United States v. Wagner
951 F.3d 1232 (Tenth Circuit, 2020)
United States v. Kyle Bateman
945 F.3d 997 (Sixth Circuit, 2019)
United States v. David Caswell
Eleventh Circuit, 2019
United States v. Steven Vincent Smith
935 F.3d 1279 (Eleventh Circuit, 2019)
United States v. Daryl Pawlak
935 F.3d 337 (Fifth Circuit, 2019)
United States v. Jeffrey Harney
934 F.3d 502 (Sixth Circuit, 2019)

Cite This Page — Counsel Stack

Bluebook (online)
883 F.3d 204, Counsel Stack Legal Research, https://law.counselstack.com/opinion/united-states-v-gabriel-werdene-ca3-2018.