Searching over 5,500,000 cases.


searching
Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

United States v. Eqal

United States District Court, E.D. Kentucky, Central Division, Lexington

September 19, 2017

UNITED STATES OF AMERICA, Plaintiff,
v.
EASA S. EQAL, Defendant.

          OPINION AND ORDER

          KAREN K. CALDWELL, CHIEF JUDGE UNITED STATES DISTRICT COURT

         This matter is before the Court on the defendant’s motion to suppress (DE 20). The Court has conducted a hearing on the motion and the parties have submitted post-hearing briefs and supplemental briefs. While the magistrate judge located in Virginia may not have had authority to issue the warrant that ultimately led to a search of defendant Easa Eqal’s computer in Kentucky, the officers relying on the warrant acted in good faith. Accordingly, the motion is DENIED.

         I. Facts

         Eqal is charged with one count of receiving child pornography in violation of 18 U.S.C. § 2252(a)(2) and one count of possessing it in violation of 18 U.S.C. § 2252(a)(4)(B).

         At the hearing on this matter, Kathryn Reed, a member of the FBI’s Child Exploitation Task Force, testified that Eqal’s case is part of a nationwide investigation. The investigation has resulted in motions to suppress in various courts across the country with differing outcomes.

         At the center of the investigation is a website called Playpen, which was dedicated to “the advertisement and distribution of child pornography.” (DE 20-2, NIT Warrant at 14.) Playpen was a “hidden service” on, what Reed described as, the “dark web.” To access the dark web, users have to download special software such as The Onion Router (“Tor”). (DE 20-2, NIT Warrant at 14.)

         Agent Reed testified that every computer has a unique IP address which is provided to users by Internet service providers like Time-Warner Cable. When a person accesses a website through normal means, the website has a record of that person’s IP address. Investigators can obtain the IP address from the website operator and then obtain the identity of the person from the Internet service provider.

         Websites on the Tor network, however, can be set up as “hidden services,” which means that the IP address for the webserver is hidden so that neither law enforcement nor the website’s users can determine the location of the computer hosting the website. (DE 20-2, NIT Warrant at 16.) Likewise, Reed explained, the IP addresses of individuals accessing hidden services on the Tor network are hidden.

         Hidden services cannot be accessed through traditional web browsers. (DE 20-3, Ky. Warrant at 11.) Even after connecting to the Tor network, in order to access the hidden services, a user must know the web address of the website the user wishes to visit. (DE 20-2, NIT Warrant at 16.) Thus, accessing hidden services like the Playpen website requires “numerous affirmative steps by the user, making it extremely unlikely that any user could have simply stumbled upon” the site. (DE 20-2, NIT Warrant at 16.)

         The Playpen website contained a warning that only registered members were allowed to access it and a hyperlink to a registration page. (DE 20-2, NIT Warrant at 13.) The registration page informed users that they were required to enter an email address that looked to be valid but that they should not enter a real email address. (DE 20-2, NIT Warrant at 13.) It also warned, “[F]or your security you should not post information here that can be used to identify you.” (DE 20-3, Ky. Warrant at 14.) The website provided other recommendations on how users could hide their identity. (DE 20-3, Ky. Warrant at 14.)

         In December 2014, an unidentified foreign law enforcement agency informed the FBI that Playpen originated from a computer with a United States-based IP address. (DE 20-2, NIT Warrant at 25.) In January 2015, the FBI obtained a search warrant for that computer server and it copied the contents of the Playpen website onto a government server. (DE 20-2, NIT Warrant at 26.)

         Because Playpen was a hidden service on the Tor network, the FBI could not obtain the identity of its users by the methods used for normal websites. For a normal website not on the Tor network, the FBI could obtain the site’s IP address logs and then utilize a publicly available resource to determine what Internet service provider owned each particular IP address. (DE 20-2, NIT Warrant at 26.) The FBI would then subpoena that service provider to determine the user to which that IP address was assigned. (DE 20-2, NIT Warrant at 26.)

         In order to obtain the identifies of the users of the Playpen website, on February 19, 2015, the FBI arrested the individual operating Playpen and assumed administrative control of the Playpen website. (DE 20-2, NIT Warrant at 27.) On February 20, 2015, the FBI obtained a search warrant from Magistrate Judge Theresa Buchanan in the Eastern District of Virginia. The warrant permitted the FBI to use a network investigative technique (NIT) to locate the administrators and users of Playpen. (DE 20-2, NIT Warrant at 28.) The NIT involved installing software onto the government’s Playpen server in Virginia.

         Websites always send instructions to their visitor’s computers, which allow the user’s computer to display web pages. (DE 20-2, NIT Warrant at 28.) With the NIT, the Playpen website – now operated by the FBI – sent additional instructions to the user’s computer. (DE 20-2, NIT Warrant at 28.) Those instructions caused the user’s computer to transmit certain information back to Virginia to a computer controlled by the government. (DE 20-2, NIT Warrant at 28.) The instructions were sent anytime a user or administrator logged onto Playpen. (DE 20-2, NIT Warrant at 30.) The information that was transmitted back to the government included the computer’s IP address, the type of operating system running on the computer, and the computer’s media access control (MAC) ...


Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.