First Playpen FBI Spyware Warrant Hits The Appeals Court Level; Is Upheld On 'Good Faith'

from the faith-based-decision-making dept

The first FBI Playpen investigation warrant challenge to reach the appellate level has been denied. Andrew Workman moved to suppress evidence obtained by the FBI's Network Investigative Technique (NIT) because warrant was deployed far outside its Eastern District of Virginia jurisdiction. Workman lives in Colorado.

The Tenth Circuit Appeals Court decision [PDF] starts with a light treatise on how technology is outpacing the law and the difficulties this poses for law enforcement agencies used to obtaining identifying information with nothing more than a subpoena.

The advent of the internet created new opportunities for viewers of child pornography, allowing immediate access to illicit websites. Use of these sites frequently leaves a computerized trail, allowing the FBI to find viewers of child pornography. But technological advances have allowed viewers of child pornography to access illicit websites without leaving a trail. To monitor access to one such website, the FBI has tried to keep up; in this case, the FBI seized and assumed control, using malware to identify and find the individuals accessing child pornography.

Though the FBI controlled the website, users lived throughout the nation. To find the users, the FBI needed a warrant. But, a paradox existed. The FBI maintained the website in the Eastern District of Virginia, but users were spread out all over the country. Finding those users could prove difficult because of geographic constraints on the FBI’s ability to obtain a warrant. Notwithstanding these constraints, the FBI obtained a warrant that led to the discovery of hundreds of viewers of child pornography. One was the defendant, who faced prosecution in the District of Colorado.

This gives the reader early notice on where the decision is heading. The lower court found [PDF] the FBI's warrant invalid because its NIT traveled far outside its authorized jurisdiction. The appeals court agrees the warrant is invalid, but says the evidence shouldn't be suppressed.

The district court shot down the government's arguments for the warrant's validity, pointing out that while the seized child porn server resided in Virginia, the information gathered by the FBI's malware was obtained from computers outside the district. The government also tried to portray the NIT as a tracking device, in hopes of putting its warrant back on firmer Rule 41 ground, but the lower court shot that down as well.

In this decision, the Appeals Court grants the FBI "good faith." While doing so, it directly contradicts the lower court's findings on both issues.

We start with the presumption that the executing agents “acted in good-faith reliance upon the warrant.” United States v. Campbell, 603 F.3d 1218, 1225 (10th Cir. 2010). This presumption is bolstered by what the executing agents would have known:

1. The software was installed in a government server located in the Eastern District of Virginia.

2. The magistrate judge, who issued the warrant, was in the Eastern District of Virginia.

3. All of the information yielded from the search would be retrieved in the Eastern District of Virginia.

With these facts, the executing agents could reasonably rely on the magistrate judge’s authority to issue a warrant authorizing installation of software and retrieval of information in the Eastern District of Virginia.

This was the lower court's finding:

I am not persuaded by the government’s argument. Rule 41(b)(2) applies to property located in the same district as the magistrate judge at the time the warrant is issued. As stated above, the NIT was designed to search “activating computers,” and, in this case, Mr. Workman’s computer was located in the District of Colorado when the warrant was issued. Further, there is no evidence that the property (information) to be seized, such as Mr. Workman’s IP address, was located in the Eastern District of Virginia at the time the warrant was issued either.

Here's the lower court on the "tracking device" argument:

While it is tempting to view the NIT as a tracking device, the reality of the technology at issue here is that the NIT did not “track the movement of . . . property” as Rule 41(b)(4) contemplates. The government did not obtain Mr. Workman’s IP address by tracking the data as it moved through various relay nodes back to Mr. Workman’s computer. Rather, the government, through the NIT, searched Mr. Workman’s computer and seized his IP address along with various other pieces of information.

In response, the appeals court just says the FBI needs to defer to the magistrate issuing the warrant because technical things are too complicated for agents to sufficiently grasp.

It is true that the affiant and magistrate judge never mentioned the term “tracking device,” and the FBI’s method differs from more conventional tracking devices. But the executing agents lacked precedents on these issues and could reasonably defer to the magistrate judge on these nuanced legal issues.

In fact, it's ignorance that saves the day, as it often does when courts hand down "good faith" rulings. The less law enforcement knows, the more likely it is the evidence won't be suppressed.

We expect agents executing warrants to be “reasonably well-trained,” but we do not expect them to understand legal nuances the way that an attorney would.

No, we don't expect law enforcement officers to be lawyers but we do expect them to be aware of the same jurisdictional limits the FBI was petitioning the government to have lifted. It's inconceivable the agent requesting the warrant -- an agent the government uses as an expert witness -- didn't know the reach of the NIT would extend far beyond the jurisdiction it was approved for.

Filed Under: 10th circuit, 4th amendment, fbi, good faith, network investigative technique, nit, playpen, privacy, warrant