Searching over 5,500,000 cases.

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

United States v. Thompson

United States District Court, W.D. Louisiana, Shreveport Division

June 24, 2019




          Mark L. Hornsby U.S. Magistrate Judge


         Defendant, Charles Heath Thompson, is charged with three counts of Access with Intent to View Child Pornography in violation of 18 U.S.C. § 2252(a)(5)(B). Before the court is Defendant's motion to suppress all evidence derived from a Search and Seizure Warrant issued by a Magistrate Judge for the United States District Court for the Eastern District of Virginia. Doc. 18.[1] Defendant argues that the warrant was illegal because it was issued in the Eastern District of Virginia but obtained information from his computer located in the Western District of Louisiana. Defendant also argues that the Leon good faith exception does not save the warrant. For the reasons that follow, it is recommended that Defendant's motion to suppress be denied.[2]


         In late February and early March 2015, the FBI seized and, for approximately two weeks, assumed administrative control of “Playpen, ” a child pornography hidden-services website. Playpen had been operating for six months on the anonymizing “Tor” network, an acronym for The Onion Router, which is described in more detail below. During that period, and pursuant to a search warrant and Title III order authorized by two different federal judges, the FBI monitored the traffic on the website and deployed a network investigative technique (“NIT”) for the purpose of locating the website's users who were logged into, and actively accessing, the child pornography website.

         As a result of the FBI's operation, the IP addresses of many of Playpen's users who thought they could anonymously conceal their locations via Tor were identified. Based on the result of the NIT warrant, the FBI office applied for and received a search warrant from the undersigned for an address where Defendant was living. Suspected child pornography was located during the search.

         The Onion Router or “Tor”

         The Tor network is similar to the traditional internet, with two relevant differences. First, the Tor network allows users to anonymously browse the Internet. Doc. 55-2, pp. 10-11. The Tor network hides the true IP address by bouncing the communications around a distributed network of relay computers, also called “nodes, ” run by volunteers all around the world. As a communication bounces around the nodes, the various IP addresses of these nodes obscure the location from which the communication is traveling. When the user's computer eventually accesses the website via this network of nodes, only the IP address of the last exit node (rather than the IP address from where the computer signal originated) appears in the website's log of IP addresses. Doc. 55-2, p. 16.

         Second, the Tor network is different from the traditional internet in that it allows, within the Tor network, for websites to be configured as “hidden-services” sites. Doc. 55-2, pp. 16-17. The IP address of a Tor hidden-services site is replaced with a Tor-based web address-a series of algorithm-generated characters followed by the suffix “.onion, ” a function of which makes it impossible to determine, through public lookups, the IP address of a computer hosting a Tor hidden-service site. Doc. 55-2, pp. 16-17.

         In order to get to the URL of a hidden-services site, a user must use Tor software and operate within the Tor network. Doc. 55-2, p. 17. Moreover, a Tor user cannot search for a hidden-services site on a search engine like Google. Doc. 55-2, p. 17. Instead, generally, the user must know the exact “.onion” web address of the hidden-service site in order to access it. Doc. 55-2, p. 17.

         When an individual looks at a website on the Tor network, after the computer signal travels through random nodes and eventually makes contact with the website's server, a communication channel is established between the computer and the server, which allows the user to view and download what is on the website. Doc. 55-2, p. 16-17. In the case of a computer on the Tor network accessing a hidden-services site, neither the computer nor the hidden-services site can see the other's IP address. Doc. 55-2, p. 17. Instead, they are able to communicate through the communication channel set up by the Tor network.

         Investigation of The Playpen Website

         Playpen began operating as a hidden-services site in approximately August 2014. Doc. 55-2, p. 18. Playpen required users to register with a username and password. Doc. 55-2, pp. 19-20. Upon entering the website, several forums were listed as a sort of “Table of Contents” and accessible to users, including forums and sub-forums for “Girls HC [hardcore], ” “Incest, ” and “Toddlers.” Doc. 55-2, pp. 20-23. Each forum and sub-forum contained topics, i.e., posts often including discussions, preview images, and image and/or video files (either linked within the Playpen website itself or linked to external websites) related to the particular forum topic involving the sexual abuse of children. Doc. 55-2, pp. 20-22.

         Because Playpen was running as a hidden-services site, the FBI was initially unable to track where the server was located or who was running the site, but through a chain of events originating from a foreign law enforcement agency's tip, the FBI was able to locate ...

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.