United States District Court, E.D. Kentucky, Northern Division, Covington
L, Banning, United States District Judge
matter is before the Court on Defendant Jeffrey Harney's
Motion for Discovery, wherein he moves the Court to order the
full production of the Government's NIT source code and a
copy of the Playpen homepage as it appeared on February 20,
2015. (Doc. # 40). The Government has filed its Response to
the Motion for Discovery (Doc. # 47), and Defendant has filed
his Reply. (Doc. # 61).
Defendant's request, this Motion for Discovery has been
held in abeyance pending Defendant's procurement of a
forensic computer expert, with whom Defendant wished to
consult about possibly offering an affidavit or other
evidence in support of Defendant's asserted need for this
discovery. See Docs. # 70, 91. At the recent Final
Pretrial Conference, defense counsel advised that his
computer expert's report is complete and has been
provided to the Government. See Doc. # 97. That
expert report has also now been filed of record. (Doc. # 96).
Defense counsel having further advised the Court that
Defendant stands on his Motion for Discovery as filed, it now
being ripe for adjudication with the filing of the expert
this Motion was initially referred to the Magistrate Judge
for adjudication pursuant to Standing Referral Order,
see Doc. # 7, given the impending trial date, the
Motion will be addressed directly by the District Court via
this Order. For the reasons set forth below, Defendant's
Motion for Discovery (Doc. # 40) will be
is charged in this case with four counts of knowingly
receiving child pornography in violation of 18 U.S.C. §
2252(a)(2), one count of knowingly possessing child
pornography in violation of 18 U.S.C. § 2252(a)(4)(B),
and a forfeiture allegation. (Doc. # 3). In his Motion for
Discovery, Defendant argues he cannot investigate potential
defenses without all of the information sought pertaining to
the NIT, the tool implemented by the FBI to assist in
identifying Defendant in this case. (Doc. # 40 at 3).
Defendant also argues that Playpen's homepage as it
appeared on February 20, 2015, is necessary to determine if
the Government's description of the website in seeking
the NIT warrant was consistent with the actual appearance of
the homepage. Id. at 3-4.
charges against Defendant stem from a Government
investigation of a website known as “Website A”
or the “Playpen” that began in 2014. The Playpen
was only accessible through The Onion Router
(“TOR”) network; a hidden network designed to
allow its users a high degree of anonymity. (Doc. # 36, at
14). In January 2015, after a foreign law-enforcement agency
provided the FBI with a suspected IP address for the Playpen
website, the FBI obtained a search warrant, seized the
server, and placed a copy of it into a Government-controlled
server in Newington, Virginia. Id. at 25-30.
February 20, 2015, the Government obtained a search warrant
granting permission to continue operating the Playpen in
order to locate and identify the administrators and users of
the website. Id. at 27. The Government could not use
publicly-available searches to accomplish this task, and thus
requested and received authorization to deploy a Network
Investigative Technique (“NIT”) on the server
located in Newington, Virginia, in order to obtain
information that could be utilized to help identify the users
of the Playpen. Id. Once the NIT was deployed,
anytime a user logged into the Playpen website using their
unique username and password, the NIT would cause the
user's computer to send certain information to a computer
controlled by the Government in the Eastern District of
Virginia. Id. at 28. The information transmitted
included: the user's IP address; a unique identifier
generated by the NIT; the type, version, and architecture of
the user's computer's operating system; information
about whether the NIT had already been delivered to that
computer; the computer's host name; the operating system
username; and the computer's media access control (MAC)
address. Id. at 29. This information would then
allow the Government to begin identifying the user.
Id. at 30.
this information, the NIT utilized several different
components to bypass the TOR network's anonymity and
access the users' information. These components were: (1)
the payload, comprised of computer instructions sent to the
defendants' computers that produced NIT results; (2) the
PCAP, which was the 2-way network data stream between the
defendants' computers and the government's computers
used to verify the accuracy of the gained information; (3)
the computer code, which was the unique code used to generate
unique identifiers related to the NIT; (4) the exploit,
meaning the code used to circumvent the TOR network's
security features; and (5) the server component, which was
the tool used to store the information gathered by the NIT.
See United States v. Jones, No. 3:16-cr-026, 2017
U.S. Dist. LEXIS 216572, *14 (S.D. Ohio Aug. 28, 2017)
(discussing the components of this same NIT); United
States v. Gaver, No. 3:16-cr-88, 2017 WL 1134814, **2-3
(S.D. Ohio Mar. 27, 2017) (same).
result of the operation of the NIT, the FBI identified
Defendant Harney as a Playpen user. (Doc. # 36, at 30-31).
More specifically, from the information gathered by the NIT,
law enforcement learned the host name and logon name used to
access the site, the computer's MAC address and operating
system. (Id. at 28). Upon further investigation,
this information was used to identify the physical address
associated with the IP address, which law enforcement
determined was Defendant's address. Id. at
29-31. A search warrant of the residence was obtained and
executed, wherein the FBI seized multiple items of electronic
media and computer equipment that the Government contends
belong to Defendant. (Doc. # 46-1 at 2). The Government
contends Defendant made a recorded statement admitting to
downloading child pornography on numerous occasions, and that
a forensic examination of some of the items seized confirmed
the presence of over 3, 640 images depicting child
pornography, including over 1, 100 videos. (Doc. # 46 at 13).
also filed a Motion to Suppress, seeking suppression of all
evidence seized as a result of the NIT search on his
computer. (Doc. # 34). The Court has previously denied this
Motion. (Doc. # 90). The current Motion for Discovery was
filed the same day as the Motion to Suppress but, as
previously stated, was held in abeyance pending
Defendant's procurement of a forensic expert.
See Docs. # 70, 91.
recent Final Pretrial Conference, defense counsel informed
the Court that the expert's report was complete and had
been provided to opposing counsel. See Doc. # 97.
Although at the Final Pretrial Conference defense counsel
seemed to indicate his willingness to proceed with the
Court's adjudication of the Motion for Discovery without
the expert report, defense counsel also informed that he
would file the expert report of record, which he did later
that day. Doc. # 96. Therefore, the Motion for Discovery is
no longer held in abeyance, and is now ripe for adjudication.
Motion for Discovery, Defendant requests “the NIT
source code in possession of the government” and a copy
of the Playpen homepage as it appeared on the day the
government sought the NIT warrant, February 20, 2015. (Doc. #
40, at 1, 4). In his Reply, Defendant clarified that his
request was for all NIT components. (Doc. # 61, at 1). The
Government has stated that it is willing to provide certain
components of the NIT software but not all of the components,
arguing they are not material to Defendant's case and,
alternatively, are subject to the law enforcement privilege.
(Doc. # 47, at 2). As for Defendant's request for the
Playpen homepage as it existed on February 20, 2015, the
Government stated it is willing to provide an offline copy of
the website for Defendant's review. Id. at 5.
Discovery of all Requested NIT Information
Rule 16 and Materiality
16(a)(1)(E) requires the government to permit a defendant to
inspect and to copy or photograph books, papers, documents,
data, photographs, tangible objects, buildings or places, or
copies or portions of any of these items, if the item is
within the government's possession, custody, or control
and: (i) the item is material to preparing the defense; (ii)
the government intends to use the item in its case-in-chief
at trial; or (iii) the item was obtained from or
belongs to the defendant. Fed. R. Crim. P. 16(a)(1)(E).
(emphasis added). The Government states the information
requested by Defendant is not information the Government
intends to use in its case-in-chief and was neither obtained
from nor ever belonged to Defendant. (Doc. # 47 at 2).
Defendant does not contest this, but instead focuses his
Reply on the materiality of the remaining NIT components.
(Doc. # 61, at 4). Therefore, the issue here is whether the
NIT components Defendant seeks and the Government is
unwilling to provide are material to preparing his defense in
Sixth Circuit has described materiality under Rule 16 as
A defendant does not satisfy [the] requirement that an object
be material to the preparation of the defendant's defense
by means of merely conclusory arguments concerning
materiality. Rather, defendant must make a prima
facie showing of materiality. Materiality under Rule 16
has not been authoritatively defined in this Circuit.
However, the Supreme Court has determined that
“defense” within the meaning of Rule 16 means the
“defendant's response to the Government's case
in chief.” Therefore, the rule applies only to
“‘shield' claims that ‘refute the
Government's arguments that the defendant committed the
crime charged.'” It follows that information which
does not counter the government's case or bolster a
defense is not material “merely because the government
may be able to use it to rebut a defense position.”
Rather, there must be an indication that pre-trial disclosure
would have enabled the defendant to “alter the quantum
of proof in his favor, ” not merely that a defendant
would have been dissuaded from proffering easily impeachable
evidence. In assessing materiality, we consider the logical
relationship between the information withheld and the issues
in the case, as well as the importance of the information in
light of the evidence as a whole.
United States v. Lykins, 428 F. App'x 621, 624
(6th Cir. 2011) (internal citations omitted). An analysis of
two cases, both cited by Defendant, and both concerning the
Government's utilization of technology to identify online
users possessing and/or sharing files containing child
pornography, is helpful to help clarify Defendant's
requirement in arguing materiality. See United States v.
Budziak, 697 F.3d 1105 (9th ...