
    UNITED STATES of America v. Robert MCLAMB, Defendant.
    CRIMINAL NO. 2:16cr92
    United States District Court, E.D. Virginia, Norfolk Division.
    Signed 01/19/2017
    
      Elizabeth M. Yusi, Assistant United States Attorney, Norfolk, VA for United States of America.
    Andrew W. Grindrod, Amanda C. Conner, Office of the Federal Public Defender, Norfolk, VA, for Defendant.
   MEMORANDUM OPINION AND ORDER

REBECCA BEACH SMITH, CHIEF JUDGE

This matter comes before the court on the Defendant’s Third Motion to Suppress (“Motion”). ECF No. 45. In his Motion, the Defendant seeks to suppress “all evidence seized from [the Defendant’s] home computer by the FBI on or about February 28, 2015 through the use of a network investigative technique (“NIT”), as well as all fruits of that search.” Mot. at 1. Neither the Defendant nor the government has requested a hearing. This matter is ripe for decision. For the reasons stated herein, the Motion is DENIED.

I. FACTUAL BACKGROUND

The Defendant was charged following an investigation into a website called “Playpen,” which the government asserts operated as a child pornography site. First Mot. to Suppress, ECF No. 14, at 4. The Playpen website was unusual in that it operated on what is known as the “Tor” network. See id. The Tor network enables its users to conceal their Internet Protocol (“IP”) addresses, after they download the Tor browser from the Tor website. See id. The government, however, can still recover identifying information, despite Tor network use, by way of the NIT. Resp. to First Mot. to Suppress, ECF No. 19, at 7.

On February 19, 2015, the Federal Bureau of Investigation (“FBI”) arrested the then-operator of Playpen, gained control of the Playpen website, and thereafter operated it on a server in Virginia. Macfarlane Aff., ECF No. 14—2, ¶ 30. On February 20, 2015, the government obtained a warrant (“NIT Warrant”) enabling it to use the NIT to investigate Playpen users. NIT Search Warrant and Application, ECF 19-9. Although the NIT warrant authorized the NIT to be deployed as soon as a user logged into Playpen, here, the NIT was not deployed until a posting thread in the “kinky fetish—zoo subforum” was accessed. Resp. to Mot. to Compel, ECF No. 21, at 18.

By way of coding that the government had integrated into the Playpen website, the NIT was deployed on or about February 28, 2015, to the Defendant’s computer. See Resp., ECF No. 49, at 1-2. This code instructed the computer to send identifying information to a different, government-controlled computer. This identifying information was the only information the government obtained under the NIT Warrant. After deploying the NIT, the FBI was able to identify an IP address associated with a particular Playpen username (“slutwhore”). Resp. to First Mot. to Suppress at 7. On March 10, 2015, Cox Communications was served with a subpoena (“Cox subpoena”) seeking subscriber information associated with the IP address obtained through the February 28, 2015 NIT deployment. ECF 45-6 at 1, 4. It was pursuant to this subpoena that the government became aware of the Defendant’s name and address.

On December 1, 2015, the government obtained a residential search warrant (“Residential Warrant”) for the Defendant’s home. Resp. to First Mot. to Suppress at 7-8. The Residential Warrant was executed on December 8, 2015, while the Defendant was home. M. at 8. The Defendant acknowledged to agents that he viewed child pornography and that “slut-whore” was his username. See id. Child pornography was found on electronic devices owned by the Defendant during the execution of the Residential Warrant. Id. According to the Search Warrant Execution Log dated December 8, 2015, a copy of a warrant was provided to the Defendant at the FBI office in Chesapeake, Virginia. ECF No. 45-7 at 1. According to the Defendant, the warrant he received at that time was the Residential Warrant. Mot. at 3.

The government sought multiple éxten-sions in order to delay-service of the NIT Warrant under 18 U.S.C. § 3103a(b). Id. at 3. The extension most recently sought by the government expired on March 21, 2016. Id The NIT Warrant was provided to the Defendant through defense counsel after defense counsel “received it as part of a second discovery production made by the government in response to a specific request” on July 21, 2016. Id. at 4.

II. PROCEDURAL HISTORY

On June 22, 2016, a federal grand jury returned an indictment, which charged McLamb with four counts of receipt of child pornography, in violation of 18 U.S.C. § 2252(a)(2), and one count of possession of child pornography, in violation of 18 U.S.C. § 2252(a)(4). ECF No. 1. The court set a preliminary motions deadline of July 29, 2016. ECF No. 10. The parties’ agreed discovery order was filed on July 1, 2016. ECF No. 11. The Defendant filed the First and Second Motions to Suppress and the Motion to Compel Discovery, on July 29, 2016. ECF Nos. 14, 15, 16. These motions were denied on November 28, 2016. ECF No. 41. After the Defendant’s Motion for Leave to File a Late Motion to Suppress was granted, the Defendant filed a Third Motion to Suppress on December 19, 2016. ECF No. 45. The government filed a Response in Opposition on January 3, 2017. ECF No. 49. The Defendant did not file a reply.

III. LEGAL STANDARDS

“The moving party has the burden to prove that suppression is proper.” United States v. Simons, 107 F.Supp.2d 703, 705 (E.D. Va. 2000) (citing United States v. Chaar, 137 F.3d 359, 363 (6th Cir. 1998)), aff'd, 5 Fed.Appx. 332 (4th Cir. 2001). Federal Rule of Criminal Procedure 41(f)(1)(C) requires the executing officer to' give a copy of the warrant and a receipt for any property taken to the person from whom, or from whose premises, it was taken. Rule 41(f)(2)(C), which applies to warrants for tracking devices, requires “the officer executing a tracking-device warrant” to serve “a copy of the warrant on the person ... whose property was tracked.” However, if the government so requests, “a magistrate judge ... may delay any notice required by [Rule 41] if the delay is authorized by statute.” Fed. R. Crim. P. 41(f)(3). Rule 41 also allows defendants to move for suppression, “as Rule 12 provides.” Fed. R. Crim. P. 41(h).

Non-constitutional violations of Rule 41 merit suppression, only if there is prejudice or evidence of intentional or deliberate disregard for proper procedure. United States v. Simons, 206 F.3d 392, 403 (4th Cir. 2000). Failure to leave a correct copy of a search warrant at the premises searched does not violate the Fourth Amendment. United States v. Hanton, 189 Fed.Appx. 247, 250 n.3 (4th Cir. 2006). However, failure to give the defendant a copy of the warrant at the proper time does violate Rule 41. See United States v. Riesselman, 646 F.3d 1072, 1078 (8th Cir. 2011), cert. denied, 565 U.S. 1136, 132 S.Ct. 1065, 181 L.Ed.2d 780 (2012). Whether a Rule 41 violation was intentional or deliberate is a factual matter. See id. Importantly, mere negligence is not enough to merit suppression for a violation of the notice provisions of Rule 41. See United States v. Simons, 5 Fed.Appx. 332, 332 (4th Cir. 2001).

V. ANALYSIS

The Defendant concedes that he suffered no prejudice as a result of any failure to notify him of the NIT Warrant in March of 2016. Mot. at 4. However, the Defendant argues that suppression is nonetheless warranted because “this Rule 41 violation appears to have been deliberate.” Id. The Defendant cites to the government’s multiple requests for extension in support of his argument that the government was aware of its Rule 41 obligations. Id. Further, the Defendant notes that the government only provided the NIT Warrant in response to a specific request. Id. at 4-5.

The government first points out that defense counsel was given a copy of the same NIT Warrant at issue here on March 4, 2016, in connection with a related case. Resp. at 3. The government then correctly asserts that it was not required to give the defendant a copy of the NIT Warrant at the time of the residential search, due to the extensions obtained by the government. Id Further, the government explains that, although on February 29, 2016, FBI Headquarters had sent out guidance on the need for serving the NIT Warrant on identified subjects prior to March 21, 2016, due to inadvertence, the case agent in the Defendant’s investigation did not receive the notification. Resp. at 4.

The Defendant’s Motion falls far short of evincing a deliberate violation of Rule 41(f). Standing on its own, the Defendant’s allegation that the government sought four extensions in order to comply with Rule 41(f), only to deliberately disregard the Rule instead of seeking a fifth extension, is implausible. Viewing the allegations in light of the government’s uncontested and well-supported assertion that defense counsel received the same NIT Warrant in a different ease, prior to the March 21, 2016 deadline, the Defendant’s unsupported claims that the government would deliberately serve the same warrant on one defendant, but not the other, strain believability. Indeed, the Defendant even states that any violation should only be found to be deliberate “absent evidence of some alternative explanation.” Mot. at 5. The government has provided an alternative explanation: the case agent on the Defendant’s case did not receive the notification that the Defendant needed to be served with the NIT Warrant before March 21, 2016. The Defendant has pointed to no evidence otherwise, or that indicates a deliberate violation of Rule 41(f).

Violations of Rule 41 do not justify suppression without evidence that “the purported violations were an intentional and deliberate effort to disregard or circumvent Rule 41.” United States v. Claridy, 601 F.3d 276, 283 (4th Cir. 2010). The court FINDS that there is no evidence that the government deliberately violated Rule 41(f).

V. CONCLUSION

The Defendant’s Third Motion to Suppress is DENIED. The Clerk is DIRECTED to send a copy of this Memorandum Opinion and Order to the Federal Public Defender at Norfolk and to the United States Attorney at Norfolk.

IT IS SO ORDERED. 
      
      . This identifying information included: (1) the activating computer’s IP address, and the date and time that the NIT determined what that IP address was; (2) a unique identifier generated by the NIT; (3) the type of operating system running on the computer, including type, version, and architecture;(4) information about whether the NIT has already been delivered to the activating computer; (5) the activating computer’s Host Name; (6) the activating computer’s active operating system username; and (7) the activating computer’s media access control ("MAC”) address. NIT Search Warrant and Application at 4.
     