In an appeal involving the FBI cracking an anonymous web browser and prosecuting child porn viewers in different states, an appellate court deemed evidence gathered via a controversial computer search warrant violated the Fourth Amendment but was still admissible on a good-faith exception.

Appellant Bryan Gilbert Henderson, a California resident, challenged a California district court's denial of his motion to suppress evidence gathered through a Network Investigative Technique warrant issued by a Virginia magistrate judge. Henderson argued that the judge issuing the warrant, which allowed the FBI to search computers logged into the child porn site Playpen via the anonymous Tor browser regardless of location, violated territorial scope set by the Federal Rules of Criminal Procedure, a position with which the four-judge U.S. Court of Appeals for the Ninth Circuit panel agreed.

“In issuing such warrant, the magistrate judge in fact exceeded the bounds of the authority conferred on magistrate judges under [FRCP] Rule 41(b),” wrote Senior Judge Diarmuid O'Scannlain. “Such rule plainly does not in fact confer on the magistrate judge the authority to issue a warrant like the NIT warrant.”

In agreeing with Henderson's argument that the NIT warrant—which has been characterized as intrusive by outlets like the Electronic Frontier Foundation, who filed an amicus brief with the appellate court—violated the Fourth Amendment, the Ninth Circuit joins the Third and Eighth circuits in declining to suppress evidence over the Virginia NIT warrant despite deeming its issuance a “fundamental constitutional error.”

“The weight of authority is clear: a warrant purportedly authorizing a search beyond the jurisdiction of the issuing magistrate judge is void under the Fourth Amendment,” O'Scannlain writes. However, even if the FRCP violation was a constitutional error, “suppression of evidence obtained in violation of the Fourth Amendment is not appropriate if, as it asserts, the government acted in good faith.”

“Application of the good faith exception does not depend on the existence of a warrant, but on the executing officers' objectively reasonable belief that there was a valid warrant,” he notes. “The exception therefore may preclude suppression of evidence obtained during searches executed even when no warrant in fact existed—if the officers' reliance on the supposed warrants was objectively reasonable.”

Yet EFF senior staff attorney Andrew Crocker noted that the good faith rule provides a gateway for the government to “violate the constitution.”

“If the court is not going to strike down evidence obtained through thousands of warrantless situations … there's no situation where they're ever going to find good faith won't apply,” he said.

Henderson's counsel, Steven Kalar, the federal public defender for the Northern District of California, declined to comment. Assistant federal public defender Hanni Fakhoury argued before the Ninth Circuit.

Department of Justice appellate attorney John Taddei argued on behalf of the federal government. The DOJ did not respond to request for comment.

The investigation spawning the underlying case began in 2014 when the FBI launched an investigation into Playpen, a child porn site accessible only with a site username and password via the Tor internet network browser. The FBI managed to trace Playpen's servers to North Carolina and obtained a search warrant to seize them in January 2015. Upon moving the servers to its Virginia facility to uncover the locations and IP addresses of Playpen users, the FBI began operating the Playpen site from a government server in Virginia. Investigators obtained a court order to intercept communications between the site and its users.

The following month, an Eastern District of Virginia magistrate judge issued the NIT warrant, authorizing the search of any visitor logging in to Playpen, regardless of location. As described in the Ninth Circuit opinion, the NIT warrant authorized the use of computer code that sent “instructions” to anonymous users logging into Playpen that caused the users computers to respond with identifying information.

Defendant-appellant Henderson was identified through this process, which revealed his account had been logged into Playpen and accessed child pornography.

Henderson was indicted in the Northern District of California for receiving and possessing child pornography. He moved to suppress evidence and the trial court denied the motion. Henderson pleaded guilty to the receipt of child pornography and was sentenced to 60 months in prison, along with 10 years of supervised release.

Henderson's plea deal expressly reserved his right to pursue his appeal on the motion to suppress.