Playpen operated a “dark web” site that served, until it was shut down by the FBI, as a Walmart for child pornography. The clandestine website required a “mask” before a user could access the computer housing the site. That mask was a web browser called “Tor” which hid the user’s online “face” from others using the internet. A user’s online face is their “IP address,” which is a unique number given to every computer connected to the internet.
Secrecy is important to those accessing sites on the “dark web” for illicit reasons, such as locating, viewing and downloading child pornography. Tor effectively masks an IP address preventing law enforcement from tracing a user’s identity and locating their address.
In addition, Tor also makes it difficult, if not impossible, for websites like Playpen to track a user’s child pornography preferences or allow users to interact with each other. Playpen got around this problem by requiring its users to create an identifying “pseudonym” before accessing the website. This allowed Playpen to track the user’s child pornographic preferences but did not let the site identify the user once he or she left the website.
Police Find Ways to Identify Secret Users of Porn Sites
In a March 27, 2018 decision, United States v. Tagg, the Sixth Circuit Court of Appeals explained the downfall of Playpen:
“ … Tor can also hide a website from all search engines entirely. In other words, a website operating on the Tor network can require you to know the exact combination of letters and numbers comprising a website’s URL before permitting you to see its content. And unlike intuitive URLs like cnn.com or nytimes.com, the URL of a secret Tor website like Playpen is randomized—for example, upf45jv3bziuctml.onion. Absent some statistically impossible stroke of luck, a site like Playpen is ‘an island that cannot be found, except by those who already known where it is.’ To access such a website, a newcomer must generally befriend someone who knows the URL, usually the website owner or another frequent user.
“But just like in real life, nothing on the internet can be kept totally secret. Police or malicious website owners have discovered ways to work around Tor’s ‘mask’ and identity the people who visit a website. This is done by embedding software in the fabric of the website, which creates a digital ‘fingerprint’ identifying each user’s IP address. Police can then link the ‘fingerprint’ to a user’s ‘pseudonym,’ and track what the person has viewed on the website. The police can also use a computer’s IP address to discern its physical location through publicly available databases and routine subpoenas to companies like AT&T and Comcast. Thus, armed with the user’s digital fingerprint, the police can show a judge (a) what the user has viewed, and (b) where the user’s computer is located in the real world.”
Warrant Issued on Residence Associated with Child Porn
Derek Michael Tagg’s downfall occurred when the FBI gained control of Playpen which led the law enforcement agency in September 2015 to seek, and secure, a Residential Warrant to search Tagg’s residence looking for child pornography. The FBI presented digital evidence to the federal magistrate judge that Tagg had spent five hours browsing Playpen obviously viewing child pornography. The search of Tagg’s computer discovered more than 20,000 files of child pornography stored there.
Motion to Suppress Granted
However, the district judge to whom Tagg’s case was assigned after he was indicted under 18 U.S.C. § 2252A(a)(2) and (a)(5)(B) with one count of receiving and one count of possessing child pornography suppressed all evidence seized from Tagg’s home. The judge found that the FBI did not have probable cause to search Tagg’s residence because the warrant did not state that he had viewed any illegal images at his residence.
The Sixth Circuit reversed the district court’s ruling, finding that its prior precedents had clearly established the circuit’s view that the mere visiting, as well as actually subscribing, to a website containing child pornography creates a “reasonable inference that the user has stored child pornography on their computer,” regardless if the site contains lawful content.
The appeals court stressed its continued adherence to the rule that in our digital age, there must be more than a mere belief that a person has committed a crime before the police can search his or her home—there must be evidence, a nexus between the individual and the crime committed before a residential warrant can be executed.
Nexus Between Website and IP Address
The three-judge panel, however, noted that this nexus is established in child porn cases “when law enforcement connects the IP address used to access a website to the physical location identified by the warrant.” The panel reasoned that child pornography is “typically” an offense committed in the secrecy of the home where the material can either be viewed or stored on electronic devices.
2252A criminalizes not only the possession of child pornography but accessing any computer with the intent to the view the material. Tagg admitted that he accessed Playpen but said he did so by accident. The appeals court discounted this argument, pointing out that Tagg had to obtain Playpen’s URL from someone else. The court also called attention to the fact that during the five hours he remained on the site, he clicked on more than 160 hyperlinks advertising child pornography.
Access with Intent to View is Criminal
But, in reality, inferential evidence is not necessary. “The applicable criminal statute does not require a showing that Tagg actually viewed illegal content on the site. The access-with-intent offense is complete the moment that the elements of access and intent coincide … Thus, even if the person never viewed illegal child pornography, knowingly accessing a child-pornography website with the intent to view illegal materials is itself a criminal act.”
In a nutshell, probable cause for the Residential Warrant in Tagg’s case was established solely because he visited Playpen.