Court reinstates evidence against Norwood man snared by FBI malware on child-porn site

A federal appeals court ruled today that prosecutors can use eight child-porn files allegedly found on Alex Levin's computer as evidence against him even though a judge in Virginia should not have issued the search warrant used to authorize the software that linked him to one of the world's largest child-porn Web sites.

Originally set up by actual child-porn purveyors, the site was taken over and run by the FBI for two months in 2015 an attempt to snare people who downloaded images and text files. A federal judge in Virginia had given the FBI permission to attach malware - called "Network Investigative Technique" (NIT) by the FBI - to downloaded files that would beam information about the user's computer and Internet connections back to the FBI, including his IP address, system name, operating system and "media access control" address.

The FBI said it needed to do this because the site, Playpen, was not readily accessible, and its users not normally easily tracked, because it relied in part on TOR, a network system that hides user's IP addresses.

In 2016, a judge in US District Court in Boston ruled federal prosecutors could not use the files as evidence against Levin because Massachusetts was out of the Virginia judge's jurisdiction. Since the search warrant was invalid, so was any evidence seized under it, the Boston judge concluded.

But in a ruling today, the US Court of Appeals for the First Circuit in Boston dismissed that ruling and reinstated the evidence, saying the FBI agents in the case were protected under a "good faith" doctrine - they did not know the Virginia judge had no jurisdiction beyond his court district at the time (the federal rule on such orders has since been modified to allow cross-jurisdictional search warrants in such cases).

To the extent that a mistake was made in issuing the warrant, it was made by the magistrate judge, not by the executing officers, and the executing officers had no reason to suppose that a mistake had been made and the warrant was invalid. ... [The] warrant was not written in general terms that would have signaled to a reasonable officer that something was amiss. The warrant in this case was particular enough to infer that, in executing it, "the [executing officers]
act[ed] with an objectively 'reasonable good-faith belief' that their conduct [was] lawful." Davis, 564 U.S. at 238.

And while the FBI did not know whom it would catch with the software, they couldn't do anything with the information they obtained without getting a second, more specific search warrant, the court continued:

In the case at hand, in contrast, the NIT warrant did not leave to the discretion of the executing officials which places should be searched, because the NIT warrant clearly specifies that only activating computers -- that is "those of any user . . . who logs into [Playpen] by entering a username and password" -- are to be searched. The NIT warrant specifies into which homes an intrusion is permitted (those where the activating computers are located), and on what basis (that the users in those homes logged into Playpen). And if the government wished to conduct any further searches of anyone's home, it would have needed obtain an additional warrant -- which is exactly what it did in this case. Therefore, the NIT warrant "was not so facially deficient that the executing officers could not reasonably have presumed it to be valid." Woodbury, 511 F.3d at 100.

The court concluded:

[B]ecause the government acted in good faith reliance on the NIT warrant, and because the deterrent effects on law enforcement do not outweigh the great cost to society of suppressing the resulting evidence, suppression is not warranted.

Innocent, etc.