United States District Court, W.D. Louisiana, Shreveport Division
REPORT AND RECOMMENDATION
L. Hornsby U.S. Magistrate Judge
Charles Heath Thompson, is charged with three counts of
Access with Intent to View Child Pornography in violation of
18 U.S.C. § 2252(a)(5)(B). Before the court is
Defendant's motion to suppress all evidence derived from
a Search and Seizure Warrant issued by a Magistrate Judge for
the United States District Court for the Eastern District of
Virginia. Doc. 18. Defendant argues that the warrant was
illegal because it was issued in the Eastern District of
Virginia but obtained information from his computer located
in the Western District of Louisiana. Defendant also argues
that the Leon good faith exception does not save the
warrant. For the reasons that follow, it is recommended that
Defendant's motion to suppress be denied.
February and early March 2015, the FBI seized and, for
approximately two weeks, assumed administrative control of
“Playpen, ” a child pornography hidden-services
website. Playpen had been operating for six months on the
anonymizing “Tor” network, an acronym for The
Onion Router, which is described in more detail below. During
that period, and pursuant to a search warrant and Title III
order authorized by two different federal judges, the FBI
monitored the traffic on the website and deployed a network
investigative technique (“NIT”) for the purpose
of locating the website's users who were logged into, and
actively accessing, the child pornography website.
result of the FBI's operation, the IP addresses of many
of Playpen's users who thought they could anonymously
conceal their locations via Tor were identified. Based on the
result of the NIT warrant, the FBI office applied for and
received a search warrant from the undersigned for an address
where Defendant was living. Suspected child pornography was
located during the search.
Onion Router or “Tor”
network is similar to the traditional internet, with two
relevant differences. First, the Tor network allows users to
anonymously browse the Internet. Doc. 55-2, pp. 10-11. The
Tor network hides the true IP address by bouncing the
communications around a distributed network of relay
computers, also called “nodes, ” run by
volunteers all around the world. As a communication bounces
around the nodes, the various IP addresses of these nodes
obscure the location from which the communication is
traveling. When the user's computer eventually accesses
the website via this network of nodes, only the IP address of
the last exit node (rather than the IP address from where the
computer signal originated) appears in the website's log
of IP addresses. Doc. 55-2, p. 16.
the Tor network is different from the traditional internet in
that it allows, within the Tor network, for websites to be
configured as “hidden-services” sites. Doc. 55-2,
pp. 16-17. The IP address of a Tor hidden-services site is
replaced with a Tor-based web address-a series of
algorithm-generated characters followed by the suffix
“.onion, ” a function of which makes it
impossible to determine, through public lookups, the IP
address of a computer hosting a Tor hidden-service site. Doc.
55-2, pp. 16-17.
order to get to the URL of a hidden-services site, a user
must use Tor software and operate within the Tor network.
Doc. 55-2, p. 17. Moreover, a Tor user cannot search for a
hidden-services site on a search engine like Google. Doc.
55-2, p. 17. Instead, generally, the user must know the exact
“.onion” web address of the hidden-service site
in order to access it. Doc. 55-2, p. 17.
individual looks at a website on the Tor network, after the
computer signal travels through random nodes and eventually
makes contact with the website's server, a communication
channel is established between the computer and the server,
which allows the user to view and download what is on the
website. Doc. 55-2, p. 16-17. In the case of a computer on
the Tor network accessing a hidden-services site, neither the
computer nor the hidden-services site can see the other's
IP address. Doc. 55-2, p. 17. Instead, they are able to
communicate through the communication channel set up by the
of The Playpen Website
began operating as a hidden-services site in approximately
August 2014. Doc. 55-2, p. 18. Playpen required users to
register with a username and password. Doc. 55-2, pp. 19-20.
Upon entering the website, several forums were listed as a
sort of “Table of Contents” and accessible to
users, including forums and sub-forums for “Girls HC
[hardcore], ” “Incest, ” and
“Toddlers.” Doc. 55-2, pp. 20-23. Each forum and
sub-forum contained topics, i.e., posts often including
discussions, preview images, and image and/or video files
(either linked within the Playpen website itself or linked to
external websites) related to the particular forum topic
involving the sexual abuse of children. Doc. 55-2, pp. 20-22.
Playpen was running as a hidden-services site, the FBI was
initially unable to track where the server was located or who
was running the site, but through a chain of events
originating from a foreign law enforcement agency's tip,
the FBI was able to locate ...