A man from Franklin, Ohio, was sentenced to nine years in prison after pleading guilty to child pornography charges linked to the darkweb child abuse forum “Playpen.” The man lost his battle against the government after a judge ruled that the government’s malware was a legal warrantless search.
District Court Chief Judge Susan Dlott ruled on March 7 that Brandon Spicer, 43, will spend nine years in prison for a single count of receiving child pornography.
Spicer argued that the evidence against him should have been suppressed based on the illegal hacking method employed by the FBI during the investigation and the outlandish nature of the investigation itself. During the investigation into the darkweb child abuse forum known as “Playpen,” the FBI took over and operated the forum, ensnaring unsuspecting forum users. They also deployed malware to thousands of computers connected to the Tor network. Judge Dlott denied the motion to supress and Spicer pleaded guilty in March 2018.
Brandon Spicer, 43, who has been living with his mother in Alliance while awaiting sentencing, will spend a lifetime on probation after he serves his prison sentence, U.S. District Court Chief Judge Susan Dlott ruled on March 7. He reports to prison in late April.
Five men from southern Ohio were arrested from 2015 to 2017 in the government’s massive sting operation known as “Operation Pacifier,” which resulted in nearly 900 arrests worldwide.
At one point, the Playpen website was believed to be the world’s largest child pornography website — with more than 150,000 users around the world. The FBI secretly took over the Playpen child porn website for two weeks in late February and March 2015, after getting a tip from a foreign law enforcement agency that the site’s operator had accidentally revealed its IP address.
The FBI Malware
Brandon Spicer of Franklin was sentenced to 9 year for a child pornography charge.
A magistrate signed off on a search warrant allowing the FBI to operate the porn site from a government facility in Virginia. The FBI used secret spyware – a Network Investigative Technique, or NIT – to learn the identity of website visitors who normally navigated the dark web anonymously.
During that time, the FBI found Spicer. He logged onto the site on Feb. 22, 2015 under the username “MAZTER.” He had registered an account on Playpen the previous Aug. 23, 2014, and from then until March 3, 2015, he spent a total of 126 active hours on the site, according to court documents.
The FBI Raid
The FBI searched Spicer’s home in July 2015 and found more than 600 images on his computer and cellphone depicting children under 12 being sexually assaulted and abused by adult men, authorities said.
Spicer wanted the judge to throw out the evidence, arguing that the original search warrant was too broad and the FBI’s role in operating and expanding a child porn site too outrageous. But Dlott denied his motion.
Spicer pleaded guilty to receiving child pornography in March 2018.
Denial of Motion to Suppress
Order Denying Defendant’s Motion for Disclosure of Discovery, Motion to Suppress Based on Unconstitutional Deployment of Government Sponsored Malware Dubbed the “Network Investigative Technique,” and Second Motion to Suppress Evidence and Motion for Franks Hearing This case stems from a highly-publicized FBI sting operation through which the FBI covertly deployed software called “Network Investigative Technique” or “NIT” onto computers that accessed a child pornography website called “PlayPen.” Defendant Brandon Spicer was an individual who allegedly accessed the PlayPen website during this operation, which resulted in this prosecution at hand.
Three defense motions are pending before the Court: Motion for Disclosure of Discovery (Doc. 39), Motion to Suppress Based on Unconstitutional Deployment of Government Sponsored Malware Dubbed the “Network Investigative Technique” (Doc. 40), and Second Motion to Suppress Evidence and Motion for Franks Hearing (Doc. 64). For the reasons that follow, all three motions will be DENIED.
Disclosure of Discovery
The Court will adopt the reasoning set forth in Judge Rice’s opinion in Gaver, as it persuasively addresses not only the issue of suppression, but also the request for discovery of the NIT source code and a request for a Franks hearing. In addition, the facts underpinning Gaver’s prosecution are very similar. Gaver was charged with numerous counts of possession of child pornography, knowingly accessing with intent to view child pornography, and knowing receipt of child pornography. Id. at *1. The government deployed NIT onto Gaver’s computer after he logged onto the PlayPen website during the period in time when the government was operating the site from a server in Virginia for the purpose of its investigation. Id. After obtaining Gaver’s IP address and uncovering Gaver’s identity, a warrant was obtained to search his apartment in Dayton, Ohio, which uncovered computers and other items. Id. Like Spicer, Gaver filed a Motion to Suppress Evidence Based on Unconstitutional Deployment of Government-Sponsored Malware Dubbed the “Network Investigative Technique,” a Motion for Disclosure of Discovery, and a Second Motion to Suppress Evidence and Motion for Franks Hearing. Id. All three motions were denied.
Even he had, the law enforcement privilege applies, as disclosure of the exploit and server component would severely compromise future investigations and could allow others to develop counter-measures. Id. at *3-4. Defendant’s Motion for Disclosure of Discovery (Doc. 39) is, therefore, DENIED.
Suppression of NIT Evidence
Spicer moves the Court to suppress all evidence flowing from the Government’s deployment of the NIT software on his computer, including the search of his home and statements obtained from him. Spicer argues that the deployment was an illegal search under the Fourth Amendment.
In opposition, the government argues that (1) Spicer did not have a reasonable expectation of privacy in his IP address and therefore no search occurred; (2) even if a search did occur, the Magistrate Judge had authority under Rule 41(b) (4) to issue the NIT Warrant; (3) even if there was a Rule 41 violation, suppression is not the appropriate remedy; and (4) regardless, the evidence should not be suppressed under the good-faith exception of United States v. Leon, 468 U.S. 897 (1984).
Suppression of Evidence in Support of the NIT
Spicer argues that the Government intentionally or recklessly made false and misleading statements and omitted material facts in Macfarlane’s Affidavit in support of the NIT Warrant, requiring suppression and a Franks hearing. Macfarlane averred that upon arrival at the PlayPen website, a user would see “images of prepubescent females partially clothed and whose legs are spread with instructions for joining the site before one can enter.”
As to the change in the PlayPen website homepage, the Court has reviewed the differences between the two PlayPen homepages and agrees with Judge Rice that they are not materially different. Both include images that “are highly suggestive of the website’s illegal contents, particularly when paired with the website’s name, and the fact that it was accessible only through the Tor network.” Gaver, 2017 WL 1134814 at *6. “In short, even with an accurate description of the website’s logo[/images], probable cause would have existed for the issuance of the warrant.” Id. The Court is not satisfied that the Defendant has shown the false statement was made knowingly and intentionally or with reckless disregard for the truth to warrant a Franks hearing. Id. at *5.
The Court also disagrees with Spicer that Macfarlane’s Affidavit contained false and misleading statements about the location of the NIT searches for the reasons set forth by the Court in Gaver. Thus, Spicer is not entitled to a Franks hearing on this ground, either. Id. at *7. Finally, as in Gaver, the Court rejects the argument that the NIT Warrant is an unconstitutional “general” warrant. Id. at *13. For these reasons, Defendant’s Second Motion to Suppress and Motion for Franks Hearing (Doc. 64) also is DENIED.
This Court adopts the ruling of Judge Rice in United States v. Gaver, 3:16-cr-088, 2017 WL 1134814 (Decision and Entry, Mar. 27, 2017), and, in so doing, DENIES all three of Defendant’s pending motions: Motion for Disclosure of Discovery (Doc. 39), Motion to Suppress Based on Unconstitutional Deployment of Government Sponsored Malware Dubbed the “Network Investigative Technique” (Doc. 40), and Second Motion to Suppress Evidence and Motion for Franks Hearing.