The 4th Amendment, the Search Warrant, the Network Investigation Technique

After Gary Reibert was charged with “with the receipt and attempted receipt of child pornography (Count I) in violation of 18 U.S.Code § 2252A(a)(2) and (b)(1) and the accessing of a computer in interstate commerce with the intent to view child pornography (Count II) in violation of 18 U.S. Code § 2252A(a)(5)(B) during the period of November 16, 2012, and December 2, 2012”, he filed a motion to suppress certain evidence.  U.S. v. Reibert, 2015 WL 366716 (U.S. District Court for the District of Nebraska 2015).

The motion to suppress “sought to suppress evidence seized as a result of the issuance of a warrant to deploy a Network Investigative Technique (NIT) on a child pornographic website”.  U.S. v. Reibert, supra.  The opinion explains that on November 15, 2012,

Federal Bureau of Investigation Special Agent Jeffrey Tarpinian applied for and obtained a search warrant permitting the deployment of a NIT on a website. . . . Tarpinian noted the investigation concerned alleged violations of several statutes related to child pornography. . . .

Tarpinian explained Website A operated on an anonymity network, `The Onion Router’ (Tor), which protects users' privacy by masking a user's actual IP address. . . . The affidavit detailed an investigation undertaken to find and access Website A on the Tor network. . . . 

Tarpinian averred Website A is `dedicated to the advertisement and distribution of child pornography and the discussion of matters pertinent to the sexual abuse of children,’ extensively described the content of Website A, and explained how users accessed and used Website A. . . .

Tarpinian explained that each time a user of Website A accessed any page in particular sections of Website A, the NIT sent one more communications to the user's computer which would then cause the receiving or activating computer to deliver to a computer known to or controlled by the government data that would help identify the computer accessing Website A, its location, its user, and other information about the computer. . . . Tarpinian disclosed the specific information the NIT would gather and explained the limits of the NIT. . . .

U.S. v. Reibert, supra. 

It goes on to explain that on April 4, 2013, FBI Special Agent Andrea R. Kinzig

applied for and obtained a residential search warrant for Reibert's home at 1309 Kenton Way, Troy, Ohio 45373. . . . In the affidavit in support of the warrant, Kinzig provided extensive detail regarding an investigation into child pornography. . . .

Kinzig explained an internet account with IP address 50.102.45.107 was identified as accessing Website A. . . . [He] described how Website A operated, how individuals accessed it, and what messages and images Website A contained, as in the type of and quantity of child pornography. . . . Further, Kinzig explained how law enforcement officers were able to investigate users of Website A. . . .

[L]aw enforcement discovered the user with the specifically identified IP address accessed pages on Website A that contained twelve separate message threads consisting approximately of 288 images of minors, at least one hundred of which consisted of child pornography images. . . . The content of four of the message threads were detailed extensively, including descriptions of the images found within. . . .

Subsequently, law enforcement learned the IP address was assigned to Reibert's home address. . . . A search on the internet revealed Reibert lived in the Dayton, Ohio, area and he possessed special skills, abilities, and expertise in the area of computer systems. . . . Kinzig stated in her experience, individuals who access child pornography maintain hard copies of child pornographic material. . . .

Kinzig stated the individual using the target IP address displayed characteristics common with individuals who access with intent to view child pornography. . . . The affidavit extensively described how child pornography can be accessed and maintained on computers and related devices. . . . 

Kinzig averred there was probable cause to believe evidence of crimes related to child pornography would be located at the subject premises. . .

U.S. v. Reibert, supra.  The news story you can find here provides background on “Website A” and the events that led to Reibert’s being apprehended.

In moving to suppress the evidence the government acquired by using the NIT, Reibert argued that he was

entitled to a Franks hearing on the issue of whether the affidavit in support of the warrant to employ the NIT failed to include evidence that negated probable cause. He also argues the government conducted a warrantless search of Reibert's computer by employing a NIT and contends he was entitled to present testimony of an expert, Tami Loehrs, on this issue. Further, he states the search warrant permitting the NIT was a general warrant and did not permit a search of Reibert's computer, nor was it a warrant authorizing a search of Reibert's computer.

U.S. v. Reibert, supra. 

As the opinion notes, the affidavit an officer submits to obtain a search warrant must

contain probable cause of four ingredients: time, crime, objects, and place. . . . When reviewing the sufficiency of an affidavit `[a] totality of the circumstances test is used to determine whether probable cause exists. Courts should apply a common sense approach and . . . determine whether probable cause exists.’  U.S. v. Hager, 710 F.3d 830 (U.S. Court of Appeals for the 8th Circuit 2013). . . .

U.S. v. Reibert, supra. 

As this site explains, a “Franks Hearing is a hearing to determine whether a police officer's affidavit used to obtain a search warrant that yields incriminating evidence was based on false statements by the police officer.” IF the defendant shows that the officer’s affidavit included one more false statements and IF the false statements were essential to establishing probable cause, the defendant will be allowed to prove that at a hearing.  If the defendant succeeds in that, then the warrant will be voided and evidence obtained by executing it will be suppressed.

The U.S. District Court Judge rejected Reibert’s Franks argument, holding that the

affidavit in support of the NIT warrant contained sufficient probable cause to issue the NIT warrant. In the affidavit, Tarpinian averred, with detail, the contents of a specific website which contained messages and images related to the sexual exploitation of children and the offenses related to the viewing of such material. . . . Tarpinian explained how a user could access the material. . . .

Tarpinian stated the government would employ a NIT to identify the activating computer accessing the information, its location, and potentially the user of the computer. . . . Tarpinian then provided an explanation of how the NIT functions, the NIT's purpose and necessity, and the information the NIT would collect from activating computers. . . .

Further, Tarpinian explained, based on his training and experience, he believed there existed, on the activating computers, evidence of criminal activity related to the sexual exploitation of children. . . . The NIT was not a general warrant lacking particularity as it noted the specific offenses alleged, described the places to be searched, and described the information to be seized. Upon review of the totality of the circumstances, there existed probable cause to issue the NIT warrant. Contrary to Reibert's argument the NIT violated his right to be secure from unreasonable searches and seizures; law enforcement deployed the NIT pursuant to a search warrant supported by probable cause.

U.S. v. Reibert, supra. 

When Reibert filed his motion to suppress, the U.S. District Court Judge referred it to a U.S. Magistrate Judge, who drafted a Report & Recommendation in which the Magistrate Judge analyzed Reibert’s arguments for suppressing the evidence.  U.S. v. Reibert, supra.  The Magistrate Judge submitted the Report & Recommendation to the District Court Judge, who agreed with

the judge's conclusion that Reibert failed to make the substantial preliminary showing that law enforcement intentionally or recklessly omitted information from the warrant affidavit so as to entitle him to a Franks hearing. [Reibert] argues, in effect, that the government did not disclose in affidavits that it had installed a `trojan, in essence a virus, onto [defendant Reibert's] computer.’ . . .

[Reibert] made an offer of proof on the expert testimony it would proffer in support of that contention. . . . The court has reviewed the offer of proof and agrees with the magistrate judge that it does not satisfy the heavy burden of showing an intentional falsehood or omission. The court finds no error in the magistrate judge's denial of defendant Reibert's motion for a Franks hearing.

U.S. v. Reibert, supra. 

As to Reibert’s argument that the

expert testimony of Tami Loehrs, a purported computer forensics expert, would establish that the court-authorized deployment of the NIT constituted a warrantless search of his computer `that went into [the defendant's] house, modified the workings of his computer, in order to send back data to the government.’ . . . The magistrate judge sustained the government's objection to the expert's testimony on Daubert grounds, but allowed an offer of proof with respect to her testimony. . . .

The court finds no error in the magistrate judge's Daubert ruling. Loehrs conceded that she `had no idea’ whether `the investigative technique returned any more information than it was authorized.’ . . . She also conceded that flash applications are present on many websites and flash applications can reveal the IP and user. . . . Even if allowed, her testimony does little to undermine the information contained in the affidavit that supports the NIT warrant.

U.S. v. Reibert, supra. 

The District Court Judge therefore denied Reibert’s motion to suppress.  U.S. v. Reibert, supra.