Searching over 5,500,000 cases.

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

United States v. Harney

United States District Court, E.D. Kentucky, Northern Division, Covington

March 1, 2018



          David L, Banning, United States District Judge

         This matter is before the Court on Defendant Jeffrey Harney's Motion for Discovery, wherein he moves the Court to order the full production of the Government's NIT source code and a copy of the Playpen homepage as it appeared on February 20, 2015. (Doc. # 40). The Government has filed its Response to the Motion for Discovery (Doc. # 47), and Defendant has filed his Reply. (Doc. # 61).

         At Defendant's request, this Motion for Discovery has been held in abeyance pending Defendant's procurement of a forensic computer expert, with whom Defendant wished to consult about possibly offering an affidavit or other evidence in support of Defendant's asserted need for this discovery. See Docs. # 70, 91. At the recent Final Pretrial Conference, defense counsel advised that his computer expert's report is complete and has been provided to the Government. See Doc. # 97. That expert report has also now been filed of record. (Doc. # 96). Defense counsel having further advised the Court that Defendant stands on his Motion for Discovery as filed, it now being ripe for adjudication with the filing of the expert report.

         Although this Motion was initially referred to the Magistrate Judge for adjudication pursuant to Standing Referral Order, see Doc. # 7, given the impending trial date, the Motion will be addressed directly by the District Court via this Order. For the reasons set forth below, Defendant's Motion for Discovery (Doc. # 40) will be denied.

         I. BACKGROUND

         Defendant is charged in this case with four counts of knowingly receiving child pornography in violation of 18 U.S.C. § 2252(a)(2), one count of knowingly possessing child pornography in violation of 18 U.S.C. § 2252(a)(4)(B), and a forfeiture allegation. (Doc. # 3). In his Motion for Discovery, Defendant argues he cannot investigate potential defenses without all of the information sought pertaining to the NIT, the tool implemented by the FBI to assist in identifying Defendant in this case. (Doc. # 40 at 3). Defendant also argues that Playpen's homepage as it appeared on February 20, 2015, is necessary to determine if the Government's description of the website in seeking the NIT warrant was consistent with the actual appearance of the homepage. Id. at 3-4.

         A. Factual Background[1]

         The charges against Defendant stem from a Government investigation of a website known as “Website A” or the “Playpen” that began in 2014. The Playpen was only accessible through The Onion Router (“TOR”) network; a hidden network designed to allow its users a high degree of anonymity. (Doc. # 36, at 14). In January 2015, after a foreign law-enforcement agency provided the FBI with a suspected IP address for the Playpen website, the FBI obtained a search warrant, seized the server, and placed a copy of it into a Government-controlled server in Newington, Virginia. Id. at 25-30.

         On February 20, 2015, the Government obtained a search warrant granting permission to continue operating the Playpen in order to locate and identify the administrators and users of the website. Id. at 27. The Government could not use publicly-available searches to accomplish this task, and thus requested and received authorization to deploy a Network Investigative Technique (“NIT”) on the server located in Newington, Virginia, in order to obtain information that could be utilized to help identify the users of the Playpen. Id. Once the NIT was deployed, anytime a user logged into the Playpen website using their unique username and password, the NIT would cause the user's computer to send certain information to a computer controlled by the Government in the Eastern District of Virginia. Id. at 28. The information transmitted included: the user's IP address; a unique identifier generated by the NIT; the type, version, and architecture of the user's computer's operating system; information about whether the NIT had already been delivered to that computer; the computer's host name; the operating system username; and the computer's media access control (MAC) address. Id. at 29. This information would then allow the Government to begin identifying the user. Id. at 30.

         To gain this information, the NIT utilized several different components to bypass the TOR network's anonymity and access the users' information. These components were: (1) the payload, comprised of computer instructions sent to the defendants' computers that produced NIT results; (2) the PCAP, which was the 2-way network data stream between the defendants' computers and the government's computers used to verify the accuracy of the gained information; (3) the computer code, which was the unique code used to generate unique identifiers related to the NIT; (4) the exploit, meaning the code used to circumvent the TOR network's security features; and (5) the server component, which was the tool used to store the information gathered by the NIT. See United States v. Jones, No. 3:16-cr-026, 2017 U.S. Dist. LEXIS 216572, *14 (S.D. Ohio Aug. 28, 2017) (discussing the components of this same NIT); United States v. Gaver, No. 3:16-cr-88, 2017 WL 1134814, **2-3 (S.D. Ohio Mar. 27, 2017) (same).

         As a result of the operation of the NIT, the FBI identified Defendant Harney as a Playpen user. (Doc. # 36, at 30-31). More specifically, from the information gathered by the NIT, law enforcement learned the host name and logon name used to access the site, the computer's MAC address and operating system. (Id. at 28). Upon further investigation, this information was used to identify the physical address associated with the IP address, which law enforcement determined was Defendant's address. Id. at 29-31. A search warrant of the residence was obtained and executed, wherein the FBI seized multiple items of electronic media and computer equipment that the Government contends belong to Defendant. (Doc. # 46-1 at 2). The Government contends Defendant made a recorded statement admitting to downloading child pornography on numerous occasions, and that a forensic examination of some of the items seized confirmed the presence of over 3, 640 images depicting child pornography, including over 1, 100 videos. (Doc. # 46 at 13).

         B. Procedural History

         Defendant also filed a Motion to Suppress, seeking suppression of all evidence seized as a result of the NIT search on his computer. (Doc. # 34). The Court has previously denied this Motion. (Doc. # 90). The current Motion for Discovery was filed the same day as the Motion to Suppress but, as previously stated, was held in abeyance pending Defendant's procurement of a forensic expert. See Docs. # 70, 91.

         At the recent Final Pretrial Conference, defense counsel informed the Court that the expert's report was complete and had been provided to opposing counsel. See Doc. # 97. Although at the Final Pretrial Conference defense counsel seemed to indicate his willingness to proceed with the Court's adjudication of the Motion for Discovery without the expert report, defense counsel also informed that he would file the expert report of record, which he did later that day. Doc. # 96. Therefore, the Motion for Discovery is no longer held in abeyance, and is now ripe for adjudication.

         II. ANALYSIS

         In his Motion for Discovery, Defendant requests “the NIT source code in possession of the government” and a copy of the Playpen homepage as it appeared on the day the government sought the NIT warrant, February 20, 2015. (Doc. # 40, at 1, 4). In his Reply, Defendant clarified that his request was for all NIT components.[2] (Doc. # 61, at 1). The Government has stated that it is willing to provide certain components of the NIT software but not all of the components, arguing they are not material to Defendant's case and, alternatively, are subject to the law enforcement privilege. (Doc. # 47, at 2). As for Defendant's request for the Playpen homepage as it existed on February 20, 2015, the Government stated it is willing to provide an offline copy of the website for Defendant's review. Id. at 5.

         A. Discovery of all Requested NIT Information

         1. Rule 16 and Materiality

         Rule 16(a)(1)(E) requires the government to permit a defendant to inspect and to copy or photograph books, papers, documents, data, photographs, tangible objects, buildings or places, or copies or portions of any of these items, if the item is within the government's possession, custody, or control and: (i) the item is material to preparing the defense; (ii) the government intends to use the item in its case-in-chief at trial; or (iii) the item was obtained from or belongs to the defendant. Fed. R. Crim. P. 16(a)(1)(E). (emphasis added). The Government states the information requested by Defendant is not information the Government intends to use in its case-in-chief and was neither obtained from nor ever belonged to Defendant. (Doc. # 47 at 2). Defendant does not contest this, but instead focuses his Reply on the materiality of the remaining NIT components. (Doc. # 61, at 4). Therefore, the issue here is whether the NIT components Defendant seeks and the Government is unwilling to provide are material to preparing his defense in this matter.

         The Sixth Circuit has described materiality under Rule 16 as follows:

A defendant does not satisfy [the] requirement that an object be material to the preparation of the defendant's defense by means of merely conclusory arguments concerning materiality. Rather, defendant must make a prima facie showing of materiality. Materiality under Rule 16 has not been authoritatively defined in this Circuit. However, the Supreme Court has determined that “defense” within the meaning of Rule 16 means the “defendant's response to the Government's case in chief.” Therefore, the rule applies only to “‘shield' claims that ‘refute the Government's arguments that the defendant committed the crime charged.'” It follows that information which does not counter the government's case or bolster a defense is not material “merely because the government may be able to use it to rebut a defense position.” Rather, there must be an indication that pre-trial disclosure would have enabled the defendant to “alter the quantum of proof in his favor, ” not merely that a defendant would have been dissuaded from proffering easily impeachable evidence. In assessing materiality, we consider the logical relationship between the information withheld and the issues in the case, as well as the importance of the information in light of the evidence as a whole.

United States v. Lykins, 428 F. App'x 621, 624 (6th Cir. 2011) (internal citations omitted). An analysis of two cases, both cited by Defendant, and both concerning the Government's utilization of technology to identify online users possessing and/or sharing files containing child pornography, is helpful to help clarify Defendant's requirement in arguing materiality. See United States v. Budziak, 697 F.3d 1105 (9th ...

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.