Opinion ID: 4561170
Heading Depth: 2
Heading Rank: 2

Heading: Playpen

Text: In August 2014, the FBI became aware of a Tor hidden service website called Playpen and began monitoring it. “Playpen was a message board-type website where people would distribute and share images and videos of child pornography.” Id. at 51. Playpen “had hundreds of thousands of members” with “tens of thousands of images and videos of child pornography being shared and distributed.” Id. at 52. FBI Special Agent Daniel Alfin (“SA Alfin”) was one of the agents charged with monitoring Playpen from August to December 2014. SA Alfin set up user accounts on Playpen to surveil the activity on the website. He testified that a user needed to install the Tor browser, navigate to Playpen via the 16-digit random code, and register a user account with Playpen. A user registered with Playpen by entering an e-mail address, user name, and password. Playpen encouraged anonymity by warning new users to use a fake e-mail address during the registration process. Once logged in, the user was taken to the website’s index page “contain[ing] links to all of the different parts of the Playpen website, and those links were all broken down by categories like boys, girls, toddlers, incest, [etc.]” Id. at 59. The user then clicked on one of the categories displayed on the index page and was taken to the category’s subforum. The subforum contained a listing of different postings that Playpen’s members had created. Each of the “postings . . . ha[d] titles indicative of the types of -3- images or videos that that user was sharing.” Id. of 65. After clicking on one of the topics, the user “would enter that actual posting, and at that point typically . . . would see images of child pornography on [his or her] computer screen and links to download full videos.” Id. SA Alfin testified that “[w]hen the image is displayed on [the user’s] computer screen, that means it’s been downloaded to [the user’s] computer over the Internet, and now it’s there on [the user’s] computer screen for [the user] to see.” Id. at 66. SA Alfin confirmed that when the image appears on the user’s computer screen, the user has “received whatever image [the user] clicked on.” Id. In summary, SA Alfin explained, the child-pornography images were embedded within [the] post so when the user clicked on that particular post, these full-sized images were within that post and would have been downloaded to [the user’s] computer and displayed on the computer screen without additional action being taken. The action to view the images was clicking on [the] post. Trial Tr., Vol. II, at 111, United States v. Croghan, No. 1:15-cr-00048-SMR-HCA-1 (S.D. Iowa Aug. 21, 2018 ), ECF No. 128. The computer downloaded the file to the temporary storage of the user’s computer, and the image displayed on the computer. In December 2014, Playpen’s administrator misconfigured the website. As a result, when the user entered a valid e-mail address, the user received a confirmation e-mail sent over the regular Internet, not the Tor network. The confirmation e-mail showed the actual IP address for Playpen. The FBI identified Playpen’s administrator and arrested him. Following the administrator’s arrest, the FBI assumed administrative control of Playpen via a court order. The FBI continued operating the website in an attempt to identify Playpen’s users. The FBI administered Playpen from February 20, 2015, to March 4, 2015—a period of 13 days. The FBI obtained a search warrant authorizing a search of Playpen users’ computers through the use of a Network Investigative Technique (NIT). The -4- NIT sent a hidden computer code to Playpen users’ computers that instructed the computers to transfer identifying information back to an FBI computer over the regular Internet. This identifying information included the IP address, operating system information, operating system username, and Media Access Control (MAC) address of the user’s computer.