United States District Court, E.D. Wisconsin
STADTMUELLER, U.S. DISTRICT JUDGE
March 1, 2016, a grand jury sitting in the Eastern District
of Wisconsin returned a two-count indictment against Marcus
A. Owens. Indictment (Docket #9). Mr. Owens is charged with
one count of knowingly receiving child pornography, in
violation of 18 U.S.C. § 2252A(a)(2), and one count of
knowingly possessing matter that contained images of child
pornography, in violation of 18 U.S.C. § 2252A(a)(5).
(Docket #9). This matter comes before the Court on Mr.
Owens's motion to suppress based on the issuing
magistrate judge's lack of jurisdiction to issue the
initial Network Investigative Technique (“NIT”)
search warrant which underlies this prosecution. (Docket
October 4, 2016, Magistrate Judge David E. Jones issued a
Report and Recommendation (“the Report”) with
this Court, recommending that the motion to suppress be
denied. (Docket #63). On October 18, 2016, Mr. Owens filed
written objections to the findings pursuant to 28 U.S.C.
§ 636(b(1)(C). (Docket #66). On October 31, 2016, the
government filed a response to the objections, (Docket #75),
and on November 7, 2016, Mr. Owens filed a reply (Docket
#79). The objections to the Report are now fully briefed and
ready for disposition. As discussed below, the Court adopts
the recommendation of Magistrate Jones and will accordingly
deny Mr. Owens's motion to dismiss the indictment.
case arises out a large-scale FBI investigation into a child
pornography website. For the purposes of this Order, the
Court presumes the parties' familiarity with the
background of this case. The parties do not dispute any of
the facts related to the present motion, and therefore the
Court will only provide a brief overview of the facts. As
discussed in detail below, numerous district courts around
the country have already considered nearly the identical
issues arising out of the investigation and warrants issued
in this case.
September 2014, FBI agents began investigating a website that
appeared to be dedicated to the advertisement and
distribution of child pornography. (Affidavit in Support of
Application for NIT Warrant (“NIT Warrant Aff.”)
¶ 11, Docket #39-2 at 5-37. The website,
“Playpen”-referred to in the warrant applications
as “Target Website” and “Website A”
respectively-had more than 150, 000 registered users and
contained tens of thousands of posts related to child
pornography. (NIT Warrant Aff. ¶¶ 10-13).
did not reside on the traditional or “open”
internet. (NIT Warrant Aff. ¶ 10). Instead, Playpen
operated only on the “Tor” network, an
open-source software tool which routes communications through
multiple computers called “nodes” in order to
mask a user's IP address. Users have to download specific
Tor software or utilize a Tor “gateway” to get
onto the Tor network and then navigate to a site like
Playpen. (NIT Warrant Aff. ¶ 7). This process is used to
keep the website user's identity anonymous. (NIT Warrant
Aff. ¶¶ 7-9).
Network Investigative Technique Warrant
February 2015, the FBI apprehended the administrator of
Playpen and took control of the website. (NIT Warrant Aff.
¶ 30). Rather than shut down Playpen, however, the FBI
operated the website from a government facility in the
Eastern District of Virginia for close to two weeks in an
effort to identify website users. On February 20, 2015, an
FBI special agent applied to a United States Magistrate Judge
in the Eastern District of Virginia for a warrant to use a
NIT to investigate Playpen's users and administrators. In
support of the warrant application, the agent submitted a
thirty-three-page affidavit that set forth his basis for
probable cause to believe that deploying the NIT would
uncover evidence and instrumentalities of certain child
exploitation crimes. See generally NIT Warrant Aff.
involved additional computer instructions that would be
downloaded to a user's computer-referred to as an
activating computer-along with the site's normal content.
NIT Warrant Aff. ¶ 33. After downloading the additional
instructions, the activating computer would transmit certain
information to the government-controlled computer located in
the Eastern District of Virginia, including: (1) the
computer's actual IP address; (2) a unique identifier to
distinguish the data from that of other computers; (3) the
computer's operating system; (4) information about
whether the NIT had already been delivered to the computer;
(5) the computer's “Host Name”; (6) the
computer's active operating system username; and (7) the
computer's “Media Access Control” address.
NIT Warrant Aff. ¶¶ 33-34, 36. The NIT would be
deployed each time a user logged onto the
government-controlled website. NIT Warrant Aff. ¶ 36.
February 20, 2015, United States Magistrate Judge Theresa
Carroll Buchanan, sitting in the Eastern District of
Virginia, signed the NIT Warrant. (NIT Warrant, Docket #39-2
at 2-4). The face of the NIT Warrant authorized the
government to search property located in the Eastern District
of Virginia. (NIT Warrant at 2). Additionally, the NIT
Warrant further described the property to be searched in
“Attachment A” to the warrant. (NIT Warrant at
A of the NIT Warrant stated that the warrant
“authorize[d] the use of [an NIT] to be deployed on the
computer server described below, obtaining information
described in Attachment B from the activating computers
described below.” (NIT Warrant at 3). It explained that
the computer server, which was located at a government
facility in the Eastern District of Virginia, was operating a
Tor network child pornography website. Further, it stated
that the activating computers were those of any user or
administrator who logged into the child pornography website.
(NIT Warrant, Docket #39-2 at 3).
B identified the property to be seized. It listed seven
pieces of information to be seized “[f]rom any
‘activating' computer”: (1) the IP address,
and the date and time the NIT determined the IP address; (2)
a unique identifier generated by the NIT; (3) the type of
operating system running on the computer; (4) information
about whether the NIT had already been delivered to the
activating computer; (5) the activating computer's Host
Name; (6) the activating computer's active operating
system username; and (7) the activating computer's media
access control address. (NIT Warrant at 4).
the use of the NIT and additional investigation, FBI agents
determined that an individual with the username
“tinderbittles” registered an account on Playpen
on February 3, 2015, and accessed the site for more than
three hours between February 3 and March 4, 2015. (Residence
Warrant Aff. ¶¶ 25-26, Docket #39-1). This user
accessed several posts that contained links to and sample
photos of child pornography. (Residence Warrant Aff.
¶¶ 27-31). Agents learned the user's IP address
via the NIT, determined the service provider of the IP
address, and linked the IP address to Mr. Owens at his home
in Kenosha, Wisconsin. (Residence Warrant Aff. ¶¶
this information, an FBI agent subsequently applied for a
warrant to search the Kenosha residence. In support of the
warrant application, the agent submitted a thirty-four-page
affidavit that set forth his basis for probable cause to
believe that the residence contained evidence relating to
federal violations concerning child pornography. (See
generally Residence Warrant Aff., Docket #39-1 at 8-41).
This affidavit recited much of the information contained in
the NIT Warrant Affidavit. See Residence Warrant Aff.
¶¶ 7-21. United States Magistrate Judge Nancy
Joseph signed the warrant on February 1, 2016. (Residence
Warrant at 1, Docket #39-1).
enforcement officers executed the warrant on February 4,
2016, and seized-among other things-an external hard drive
that contained numerous images and videos of suspected child
pornography. (Criminal Complaint ¶ 5, Docket #1). Mr.
Owens agreed to speak with law enforcement, and he admitted
to accessing certain websites that contained images of child
pornography. (Criminal Complaint ¶ 8). Based on the
evidence seized from the residence and his statement to law
enforcement, Mr. Owens was arrested pursuant to a criminal
complaint that charged him with receiving and possessing
child pornography. (See Criminal Complaint).
March 1, 2016, a grand jury indicted Mr. Owens for one count
of knowingly receiving child pornography, in violation of 18
U.S.C. § 2252A(a)(2), and one count of knowingly
possessing matter that contained images of child pornography,
in violation of 18 U.S.C. § 2252A(a)(5). (Indictment,
to 28 U.S.C. § 636(b)(1)(B), a magistrate judge may
consider potentially dispositive motions, such as a motion to
dismiss, and issue proposed recommendations to the district
judge regarding the motion. When reviewing a magistrate's
recommendation, the Court is obliged to analyze the portions
of the report to which the defendant has lodged objections
de novo. 28 U.S.C. § 636(b)(1)(C). Thus, the
Court can “accept, reject, or modify, in whole or in
part, the findings or recommendations made by the
magistrate.” Id. In other words, the
Court's de novo review of Magistrate Jones's
Report is not limited to his legal analysis alone; rather,
the Court may also review the factual findings and accept,
reject, or modify those findings as it sees fit based upon
the evidence. Id.
Owens seeks to suppress all evidence seized from his computer
through the NIT search, as well as the fruits of that search.
The Report recommends denying the motion to suppress based on
the issuing magistrate's lack of jurisdiction. Mr. Owens
objects to the recommendation and argues, among other things,
that: (1) the NIT Warrant was invalid; (2); the good faith
exception should categorically not apply to warrants issued
without jurisdiction, and (3) regardless, there was no good
faith in this case. Mr. Owens heavily relies on the reasoning
of several district courts around the country that have
granted similar motions to dismiss on this exact issue. While
the Court finds Mr. Owens's argument and the reasoning of
these district court decisions to be quite persuasive, it
nonetheless finds that Seventh Circuit precedent dictates
denying the motion to suppress. For the ...