Policy —

Once more, a judge rules against gov’t in Tor-enabled child porn case

DOJ may appeal: "We are disappointed with the ruling and considering our options."

Once more, a judge rules against gov’t in Tor-enabled child porn case

On Wednesday, a US federal judge in Washington state tossed all the evidence in a child pornography case that was obtained via an FBI-deployed Tor exploit. Absent a successful government appeal, it seems extremely difficult for prosecutors going forward in United States v. Michaud, suggesting that judges are continuing to push back on the FBI’s deployment of hacking tools.

"It's hard to see how the government can secure a conviction without this key evidence," Ahmed Ghappour, a law professor at the University of California, Hastings, told Ars.

Judges in at least two related cases in other states have also ruled in favor of defendants, on the grounds that the Virginia-issued warrant to deploy the NIT (network investigative technique) malware was invalid from the start. Those judges found that the warrant to search their computers in other parts of the country couldn’t have had force of law in other states as issued by the Virginia magistrate judge. Other judges, meanwhile, have said that the warrants were also invalid, but they did not go so far as to suppress evidence.

"For the reasons stated orally on the record, evidence of the NIT, the search warrant issued based on the NIT., and the fruits of that warrant should be excluded and should not be offered in evidence at trial," US District Judge Robert J. Bryan wrote in the Michaud case. "The court should not now order dismissal."

As Ars has reported before, in early 2015, investigators used this NIT to penetrate the digital security of Tor users accused of accessing the Tor-hidden child pornography site called "Playpen." In yet another related case prosecuted out of New York, an FBI search warrant affidavit described both the types of child pornography available to Playpen’s 150,000 members and the malware’s capabilities.

As a way to ensnare users, the FBI took control of Playpen and ran it for 13 days before shutting it down. During that period, with many users’ Tor-enabled digital shields down—revealing their true IP addresses—the government was then able to identify and arrest the 135 child porn suspects. (However, nearly 10 times that number of IP addresses were revealed as a result of the NIT’s deployment, which could suggest that still more charges could be filed.)

This judicial order comes two weeks after the defendant’s lawyer, Colin Fieman, forcefully argued that the government must provide him and his client, Jay Michaud, access to the source code of the FBI’s NIT—which the government has done in other cases.

"The interesting thing about the government’s setback in this case is that the suppression does not turn on a technicality, and will not be fixed by a subsequent rule change," Ghappour added. "It looks like the judge decided to suppress the fruits of a hacking operation on due process grounds, reasoning the defendant’s right to a fair trial would be compromised if the evidence was used without disclosure of the source code."

The government may still appeal.

"We are disappointed with the ruling and considering our options," Peter Carr, a Department of Justice spokesman, e-mailed Ars.

UPDATE Thursday 2:40pm ET: Fieman wrote Ars, saying that "it was an important decision because the judge had to balance the government's national security claims against a defendant's right to a fair trial, and in the end found that the constitution must prevail. As for other cases, there a lot of Operation Pacifier cases all over the country and they are in earlier stages of litigation for the most part, so it is soon to say. I do hope that the decision will help prompt Congress to   block the pending changes to federal rule of criminal procedure 41, at least until the rule is revised to require greater judicial oversight of governmental hacking and internet surveillance."

Channel Ars Technica