from the United States District Court for the District of
Colorado (D.C. No. l:15-CR-00397-RBJ-l)
P. Taddei, Attorney (Robert C. Troyer, Acting United States
Attorney, Robert M. Russel, Assistant United States Attorney,
Leslie R. Caldwell, Assistant Attorney General, and Sung-Hee
Suh, Deputy Assistant Attorney General, with him on the
briefs), Office of the United States Attorney, Denver,
Colorado, for Plaintiff-Appellant.
Sanderford, Assistant Federal Public Defender (Virginia L.
Grady, Federal Public Defender, with him on the brief),
Office of the Federal Public Defender, Denver, Colorado, for
Rumold and Andrew Crocker, Electronic Frontier Foundation,
San Francisco, California, filed a brief for Amicus Curiae
Electronic Frontier Foundation.
LUCERO, BACHARACH, and PHILLIPS, Circuit Judges.
BACHARACH, Circuit Judge.
advent of the internet created new opportunities for viewers
of child pornography, allowing immediate access to illicit
websites. Use of these sites frequently leaves a computerized
trail, allowing the FBI to find viewers of child pornography.
But technological advances have allowed viewers of child
pornography to access illicit websites without leaving a
trail. To monitor access to one such website, the FBI has
tried to keep up; in this case, the FBI seized and assumed
control, using malware to identify and find the individuals
accessing child pornography.
the FBI controlled the website, users lived throughout the
nation. To find the users, the FBI needed a warrant. But, a
paradox existed. The FBI maintained the website in the
Eastern District of Virginia, but users were spread out all
over the country. Finding those users could prove difficult
because of geographic constraints on the FBI's ability to
obtain a warrant. Notwithstanding these constraints, the FBI
obtained a warrant that led to the discovery of hundreds of
viewers of child pornography. One was the defendant, who
faced prosecution in the District of Colorado.
prosecution, the district court held that the warrant was
invalid and suppressed evidence resulting from the search. We
reverse this ruling. Even when a search warrant is invalid,
the resulting evidence should not be suppressed if the
executing agents could reasonably rely on the warrant. Here,
we may assume for the sake of argument that the warrant was
invalid. But in our view, the executing agents acted in an
objectively reasonable manner. Thus, the evidence should not
have been suppressed.
The FBI finds Mr. Workman by seizing the website.
website was named "Playpen, " and it contained
thousands of images and videos of child pornography. Unlike
many websites, Playpen made it difficult to detect its users.
is often possible from communication of a user's Internet
Protocol address when accessing a website. But such
communication did not take place with Playpen. To access this
website, a user had to employ software that routed the
connections through third-party computers called
"nodes." With connections routed through a series
of nodes, users could access Playpen without communicating
their Internet Protocol addresses.
FBI set out to find the users who were viewing child
pornography on Playpen. The FBI carried out this effort by
. seizing the internet server that hosted
. loading the contents onto a government
server in the Eastern District of Virginia,
. arresting the administrator of Playpen,
. hosting Playpen from the government's
Even with these steps, the FBI remained unable to identify
and locate the individuals accessing Playpen.
these individuals, the FBI obtained a warrant from a
magistrate judge in the Eastern District of Virginia. This
warrant allowed the FBI to install software onto the Playpen
server. When Playpen was accessed, the software would
automatically install malware onto the user's computer.
This malware would search the user's computer for
identifying information, such as the Internet Protocol
address, and transmit this information to the FBI.
executed the warrant by installing this software on the
government's Playpen server in the Eastern District of
Virginia. With this software, the FBI learned that Playpen
was being accessed by someone in Colorado. With this
user's Internet Protocol address, the FBI identified the
user as Andrew Joseph Workman and obtained a search warrant
in the District of Colorado to search Mr. Workman's
the warrant, FBI agents found Mr. Workman at home in the act
of downloading child pornography onto his computer. He
confessed and was indicted for receiving and possessing child
pornography. See 18 U.S.C. § 2252A(a)(2),
Mr. Workman successfully obtains suppression of his
confession and the evidence found on his computer.
Workman moved to suppress the evidence consisting of his
confession and the child pornography found on his computer.
For this motion, Mr. Workman challenged the validity of the
warrant issued by the magistrate judge in the Eastern
District of Virginia. Mr. Workman did not question the
existence of probable cause; instead, he argued that the
warrant had been inadequately particularized and that the
magistrate judge had lacked territorial ...