United States District Court, W.D. Texas, San Antonio Division
RODRIGUEZ, UNITED STATES DISTRICT JUDGE.
is charged with receipt of child pornography and possession
of child pornography. Defendant seeks to suppress the
evidence in this case. The motion is denied.
December 2014, the Government became aware of a website named
Playpen that contained child pornography. One of the servers
for that website was in North Carolina. Ultimately the
Government seized that server pursuant to a warrant,
relocated the server to Virginia, and assumed the role of
administrator. When the Government was unable to identify the
identity of the approximate 150, 000 members of the website,
the Government obtained a warrant on February 20, 2015 to
deploy Network Investigative Technique (NIT) malware. The
warrant authorized the search for persons located in the
Eastern District of Virginia. The malware, however, reached
all computers accessing the website, including Defendant
Halgren's computer in San Antonio, Texas.
the malware the Government discovered that a user named
“Platch” accessed the site, and the Government
discovered the IP address associated with
“Platch.” Defendant Halgren was the user
associated with the IP address.
December 15, 2016, the Government sought a search warrant for
the Defendant's home, computers, and car. When the
warrant was executed agents questioned Halgren and he gave
incriminating statements in response to the questions. He was
arrested eight days later.
argues that the deployment of the NIT malware was a search
for Fourth Amendment purposes and that the NIT warrant lacked
particularity. The defendant argues that the NIT warrant
should have described with particularity the place to be
searched. The NIT warrant, however, captured information from
thousands of computers in 120 countries.
Defendant argues that the NIT warrant was issued in violation
of the Federal Magistrate Act and former Federal Rule of
Criminal Procedure 41 because an Eastern District of Virginia
warrant was used to search a computer located in the Western
District of Texas. Defendant further argues that since the
Magistrate Judge lacked jurisdiction to issue the NIT
warrant, the NIT warrant was void from inception.
Defendant argues that the affiant for the search warrant of
his home made false statements in his affidavit.
The NIT warrant did not lack particularity.
Magistrate Judge signed a warrant that authorized in
Attachment A (Place to be Searched) that a NIT be deployed on
the computer server already seized by the Government
(“The computer server is the server operating the Tor
network child pornography website referred to herein as the
TARGET WEBSITE, as identified by its URL . . . .”). The
Magistrate Judge further identified in Attachment A of her
Warrant that the NIT was to be deployed to obtain information
as that term was defined in Attachment B from
“activating computers.” “Activating
computers” was defined as “those of any user or
administrator who logs into the TARGET WEBSITE by entering a
username and password.” Attachment B of the Warrant
authorized the seizure of any activating computer's
actual IP address and other specific information that was
evidence of any receipt, access, or distribution of child
recognized by many courts, “Playpen operated on
‘the onion router' or ‘Tor'
network.” United States v. Matish, 193
F.Supp.3d 585, 593 (E.D. Va. 2016). Individuals download the
Tor browser from the Tor website. The “Tor network
possesses two primary purposes: (1) it allows users to access
the Internet in an anonymous fashion and (2) it allows some
websites-hidden services-to operate only within the Tor
network. Although a website's operator usually can
identify visitors to his or her site ...