1 1 IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MASSACHUSETTS 2 3 UNITED STATES OF AMERICA, 4 Plaintiff 5 -VS- 6 VINCENT C. ANZALONE, 7 Defendant ) ) ) ) ) Criminal No. 15-10347-PBS ) Pages 1 - 78 ) ) ) 8 MOTION HEARING 9 10 BEFORE THE HONORABLE PATTI B. SARIS UNITED STATES CHIEF DISTRICT JUDGE 11 12 A P P E A R A N C E S: 13 14 DAVID C. TOBIN, ESQ., Assistant United States Attorney, Office of the United States Attorney, 1 Courthouse Way, Room 9200, Boston, Massachusetts, 02210, for the Plaintiff. 15 16 TIMOTHY G. WATKINS, ESQ., Federal Public Defender Office, District of Massachusetts, 51 Sleeper Street, 5th Floor, 02210, for the Defendant. 17 18 19 United States District Court 1 Courthouse Way, Courtroom 19 Boston, Massachusetts 02210 October 14, 2016, 10:12 a.m. 20 21 22 23 24 25 LEE A. MARZILLI OFFICIAL COURT REPORTER United States District Court 1 Courthouse Way, Room 7200 Boston, MA 02210 (617)345-6787 2 1 I N D E X 2 WITNESS 3 DANIEL ALFIN By Mr. Tobin: By Mr. Watkins: By Mr. Tobin: 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 DIRECT CROSS REDIRECT 6 20 66 RECROSS 3 1 P R O C E E D I N G S 2 THE CLERK: Court calls Criminal Action 15-10347, 3 United States v. Anzalone. 4 themselves. Could counsel please identify 5 MR. TOBIN: 6 behalf of the United States. 7 THE COURT: 8 MR. WATKINS: 9 10 Good morning, your Honor. David Tobin on Thank you. Good afternoon, your Honor. Tim Watkins, Federal Defender Office, on behalf of Vincent Anzalone. 11 THE COURT: Thank you. Do we have a witness here? 12 MR. TOBIN: We do, your Honor. 13 THE COURT: Okay. Let me just say my time 14 limitations, I have to be at a program at 12:30, so I am 15 hoping -- what is your sense as to how long you're going to 16 need? 17 MR. TOBIN: I will not be particularly lengthy. I 18 have no exhibits and one witness, and he's more of a summary 19 witness because he's already provided now two declaration. 20 THE COURT: So say half an hour? 21 MR. TOBIN: I'd say about a half an hour. 22 THE COURT: And we'll take the declarations as 24 MR. TOBIN: Of course. 25 THE COURT: How long do you think you're going to be? 23 exhibits. 4 1 MR. WATKINS: 2 THE COURT: 3 I think we'll be done by noon. All right, if we need another day for oral argument, but I just don't want to make him come back again. 4 MR. TOBIN: One preliminary matter, if I might, your 6 THE COURT: Yes. 7 MR. TOBIN: I just want to make sure that I'm on the 5 Honor? 8 same sheet of music as the Court and that we're all on the same 9 sheet. My understanding is, the purpose of this -- 10 THE COURT: Are you singing? 11 MR. TOBIN: Well, you know, if I could carry a tune in 12 a bucket, I might, but I can't. My understanding is, the sole 13 purpose of this hearing deals with the allegation of outrageous 14 government misconduct. 15 THE COURT: Yes. 16 MR. TOBIN: And specifically the representations made 17 by Special Agent Alfin in various instances that the number of 18 users on the Playpen website did not essentially increase 19 during the time the government operated it. 20 THE COURT: I don't view it as that narrow. 21 MR. TOBIN: You don't? 22 THE COURT: About the case generally. That for sure 23 is true. It's about the allegation with respect -- I mean, 24 that's a focus, but he wrote certain things in his declaration 25 that I think are fair game to ask questions about. 5 1 MR. TOBIN: Okay, beyond the number of users? 2 THE COURT: Yes. 3 MR. TOBIN: Okay. 4 THE COURT: So, for example, one thing I'm interested 5 in because I'm supposed to balance this -- I've now looked at 6 the case law -- is he said that he saved 38 children or 36 7 children. It says 30 plus children were saved because of this 8 operation. That's a relevant statement that could be probed. 9 There was another issue that had to do with, that I'm 10 interested in, that he closed down a certain function that 11 allowed you to post produced pornography. 12 were things that were said. 13 So, I mean, there You have another question, I guess, about whether or 14 not there was a specific protocol that he was supposed to go 15 through under the regulations. 16 But it's not about -- it's not about the whole case. 17 about NIT technology. 18 just about his motion and the balancing I'm supposed to do. 19 MR. TOBIN: I mean, that's relevant, yes. It's not about the whole case. Of course. It's not It's Well, that's why I asked. I 20 just wanted to know the parameters. Now, more than I had 21 anticipated, so I hope that this witness can address everything 22 the Court is interested in. If not, we can live another day. 23 THE COURT: Yes. 24 MR. TOBIN: He's in Maryland. 25 Where is he from? today, but he works in Maryland. I mean, he's here We have planes. He can 6 1 always come back, or I can bring somebody else in if -- 2 3 THE COURT: corridor, it's not a big deal, okay? 4 5 All right, so let's pull him up. you so much for coming. 6 7 I know, take it from one who's on that MR. TOBIN: Thank You have a beautiful fall day up here. So for the record, the United States calls Special Agent Daniel Alfin. 8 9 Come on up. DANIEL ALFIN having been first duly sworn, was examined and testified as 10 follows: 11 DIRECT EXAMINATION BY MR. TOBIN: 12 Q. Good morning, sir. 13 A. Good morning. 14 Q. Would you kindly tell the Judge your full name and spell 15 your first and last name for our Court Reporter. 16 A. My name is Daniel Alfin, D-a-n-i-e-l A-l-f-i-n. 17 Q. Sir, how are you employed? 18 A. I am a special agent with the FBI. 19 Q. How long have you served in that capacity? 20 A. I have been a special agent with the FBI since 2009. 21 Q. And which unit are you currently assigned? 22 A. I'm currently assigned to FBI headquarters Criminal 23 Investigative Division, Violent Crimes Against Children 24 Section, Major Case Coordination Unit. 25 Q. And what are your primary duties and responsibilities in 7 1 that position? 2 A. 3 individuals who use various types of technology to facilitate 4 the production, distribution, and advertisement of child 5 pornography. 6 Q. 7 agent with the Federal Bureau of Investigation? 8 A. 9 Raytheon Integrated Defense Systems as a field engineer at the The Major Case Coordination Unit, I investigate And what was your employment prior to becoming a special Prior to being employed by the FBI, I was employed by 10 Naval Undersea Warfare Center in Keyport, Washington, where I 11 was responsible for managing computer networks and computer 12 servers utilized by the Navy and Marine Corps. 13 Q. 14 in the unit that you've described, have you participated in the 15 investigation sometimes referred to as Playpen or Pacifier? 16 A. I have. 17 Q. And what has your role been in that investigation? 18 A. I am the primary case agent for that investigation. 19 Q. Have you testified in courts around the country in that 20 capacity? 21 A. I have. 22 Q. And have you provided various declarations and/or 23 affidavits in that capacity? 24 A. I have. 25 Q. And you recently provided the government with a Sir, in your capacity as a special agent within the FBI, 8 1 declaration for this case, United States v. Anzalone; isn't 2 that accurate? 3 A. Yes, I did. 4 Q. And at some point you had provided a declaration and gave 5 testimony in United States v. Michaud in the Western District 6 of Washington? 7 A. Yes, that's correct. 8 Q. Are you aware that there has been some suggestion -- 9 10 THE COURT: Excuse me. Is that the only other time you've testified about it in person? 11 THE WITNESS: No, your Honor. I have provided 12 testimony in the Western District of Washington, the Western 13 District of Arkansas, the Middle District of Florida, the 14 Eastern District of Virginia. 15 Q. 16 Pacifier investigation and your role in it? 17 A. 18 jurisdictions where I have testified thus far. And that's all, just so it's clear, all in the Playpen or Yes, that's correct, and I believe those are all of the 19 THE COURT: Do you remember one more? 20 MR. WATKINS: Western District of North Carolina? 21 THE WITNESS: Western District of North Carolina was 22 for the trial of the individual who created the Playpen 23 website, so I consider that to be a somewhat different manner 24 because he was identified in a different manner than the other 25 defendants in the investigation, but, yes, I did testify in a 9 1 trial in the Western District of North Carolina. 2 Q. 3 addressed the issue as to whether or not the number of users 4 logging into Playpen increased during the period of time that 5 the government -- I'll use the term "controlled" but maybe 6 ill-advisedly -- have you testified or written declarations as 7 to whether or not the number of Playpen users increased during 8 the tenure that the government was somewhat in control of the 9 website? And in either testimony or in declarations, have you 10 A. Yes, I have. 11 Q. Okay. 12 that the number of users had in fact increased while the 13 government ran that website? 14 A. Yes, I have. 15 Q. Okay, just so the record is clear, during which period or 16 when did the government run this website? 17 A. 18 website from February 20, 2015, through March 4, 2015. 19 Q. 20 essentially the number of individual users or users that used 21 the website during that approximate two-week period? 22 A. Yes. 23 Q. And is it accurate that in your either testimony or your 24 declarations, your statement and your position has been that 25 the number of users did not essentially increase during those And are you aware that there is some suggestion The government took control of and operated the Playpen And have you been able to analyze the data and determine 10 1 two weeks? 2 A. Yes, that's correct. 3 Q. And you're comparing that to what period? 4 A. I analyzed a copy of the Playpen website that the 5 government seized from the residence of the creator of the 6 Playpen website. 7 contained certain historical data about Playpen, including when 8 members had accessed the website. 9 of the Playpen website, I was able to determine that for an That backed-up copy of the Playpen website And so analyzing that copy 10 approximate two-week period between January 31, 2015, and 11 February 14, 2015, that the Playpen website saw approximately 12 50,000 unique users a week. 13 Q. 14 in any way, shape, or form operated by the government? 15 A. 16 17 18 Now, just so it's clear, that is before it was seized or That's correct. THE COURT: And is that the exact number of days that you operated the website? MR. TOBIN: No. I think what he's giving us now is 19 not the days that the government operated the website. 20 giving us the -- 21 THE COURT: Is the number of days he analyzed the same 22 number of days exactly as the days that you operated it? 23 other words, are we dealing with apples and apples? 24 25 THE WITNESS: He's I believe the FBI operation from February 20 through March 4 would constitute 13 days, your In 11 1 Honor. 2 THE COURT: Okay. 3 Q. So the FBI, the data you have for the FBI's operation is 4 for 13 days? 5 A. Yes. 6 Q. And so I think the next logical question would be -- 7 THE COURT: 8 THE WITNESS: 9 This is 15 days, right? No? I believe January 31 through February 14 should be two weeks, 14 days, your Honor. 10 THE COURT: I guess it depends when you start and when 11 you stop. 12 Q. 13 analysis of usage or number of users from January 31, 2015, to 14 February 14, 2015, a period when the FBI had no control of the 15 website. 16 A. Approximately 50,000 a week. 17 Q. And then have you been able to analyze and to look at the 18 number of users between February 20 and March 4, that 13-day 19 period when the government was operating, in control of, or 20 supervising the website? 21 A. 22 declaration that I submitted, there are more specific numbers 23 and specific dates and times provided. 24 Q. 25 All right. I'm sorry. I think right now we're discussing your What was the number of users? It was similarly approximately 50,000 a week, and in the And how -THE COURT: When you say unique users, so if you take 12 1 somebody who keeps coming back, repeat user, you wouldn't count 2 them separately? 3 THE WITNESS: That's correct, your Honor. 4 Q. And that's because you know the unique handle or the 5 unique designation or IP address? 6 A. 7 last time that someone accessed the website, and so in 8 analyzing the seized copies of the website, we'll only see the 9 last time that a user accessed the website, so there will only Well, the actual message board software only records the 10 be one entry per user account. 11 Q. 12 testimony seems to be that for the two-week period that you 13 analyzed before the FBI became involved, it was approximately 14 50,000 users. 15 you're not sitting there with an abacus counting one, two, 16 three, four, five, six, seven, eight, nine, ten. 17 in a way, how do you determine how many users? 18 by computer software? 19 A. 20 maintained all of the records that I analyzed, so it was a very 21 simple process of just extracting that data from the database. 22 A more detailed explanation and the tools that I use are 23 contained in my declaration, but these tools are all commonly 24 freely available. 25 calculations that I performed are also included in detail. And how did you calculate these numbers? How do you get this? I think your I mean, I assume that Explain to us Is it all done The actual message board software that Playpen ran on I think the specific very simple 13 1 It's just a simple process of calculating an average number of 2 user log-ins over the given period of time. 3 Q. 4 provided to me along with the declaration various spreadsheets 5 which were not filed with the court but were given to the 6 defense. 7 been given, can you tell us in general terms, what were on the 8 spreadsheets that you provided to me and I provided to the 9 defense? Your declaration was filed with the court, but you had Just so the Judge understands what the defense has 10 A. So the database that I analyzed contained all of the 11 relevant fields about when users had logged into the website 12 last, what their user ID was. 13 data that I analyzed into spreadsheets so that defense can look 14 at those spreadsheets and confirm that the calculations that I 15 performed are accurate. 16 of data to those spreadsheets to assist in that analysis to 17 make them easier to read. 18 Q. 19 but in the NIT search warrant affidavit, wasn't a different 20 number used for users on this website? 21 A. Yes. 22 Q. What number was used there? 23 A. The NIT warrant affidavit stated that the Playpen website 24 saw, I believe it was just over 11,000 unique users a week. 25 Q. And so I exported all of the I also added some additional columns Now, you're using the number approximately 50,000 a week, But, sir, 11,000 is a far cry from approximately 50,000. 14 1 Can you explain the apparent discrepancy? 2 3 THE COURT: 11,000 a week, but the 50,000 is for two weeks, right? 4 MR. TOBIN: 5 THE WITNESS: 6 THE COURT: 7 THE WITNESS: 8 THE COURT: 9 Well, can I just start with, so one was Q. No. No, your Honor. 50,000 a week over those two periods? Yes, your Honor. All right. So your testimony today is that it was 50,000 a week. 10 What's this 11,000 that was in the NIT warrant? Where does 11 that come from? 12 A. 13 there calculated the average number of unique user log-ins over 14 the entire length of the time that the Playpen website had 15 existed. 16 August, 2014, and so understandably, in the first days and 17 weeks of any new website, membership is very low. 18 website is first created, there's only one user, the person who 19 created the website. 20 more popular, as more people find out about it, more people 21 join and access the website. 22 in the NIT affidavit that stated approximately 11,000 was 23 calculated using the entire time frame that the website had 24 existed, so it included that initial weeks and months of the 25 website where user activity was low, and that's what took that So, in the NIT warrant, the calculation that was done And so the Playpen website came online approximately When the As time goes on, as the website becomes And so the average that was given 15 1 average and brought it down so low. 2 Now, when the FBI had control of the website, it was 3 at the height of its popularity. This is the final two weeks 4 that the website had operated, and so it wasn't brand-new. 5 Everyone knew about it. 6 calculate average user activity just on the most two popular 7 weeks of the website, you're going to have a much higher 8 number. 9 affidavit was incorrect. It was popular. And so if you This is not to say that anything in the NIT warrant It was one hundred percent correct. 10 It's just we're comparing two completely different formulas. 11 Q. Now -- 12 THE COURT: At some point early on in this litigation, 13 there had been some notion that Tor was congested or needed to 14 be fixed? 15 THE WITNESS: Yes, your Honor. When the FBI initially 16 took control of the Playpen website, it was operating very 17 slowly. 18 it's not a problem that we fully understand. 19 itself, the nonprofit who develops and maintains the Tor 20 network, they have articles on their own website that I cited 21 in one of my declarations that state as much. 22 hidden services like Playpen are slow and no one really knows 23 why, just because of the complicated setup process for 24 connecting to a Tor hidden service. 25 connectivity issues. People were having problems accessing the website, and The Tor project Sometimes Tor So we encountered I think they lasted for the first few 16 1 days of the FBI operation, and then things got better. 2 Q. 3 been some suggestion that things got better because you folks, 4 for lack of a better term, tinkered with it, fixed it, modified 5 it, did something to it to allow more of these people access to 6 it. Can you address that? 7 A. It is not accurate. 8 the government, or myself personally, made improvements to the 9 Playpen website, there is a particular post cited by an Let me ask you a question about that. I believe there's Is that accurate? In one of the motions alleging that 10 undercover FBI agent. That undercover cover FBI agent, after 11 the connectivity issues were resolved, stated that he had 12 upgraded the Token Ring to Ethernet, and that that was why the 13 website was suddenly working faster. 14 better description, a nerd joke. 15 technology that was used in the '80s. 16 in modern technology. No part of the Playpen website ever 17 relied on Token Ring. This was just the undercover agent 18 making a joke consistent with previous activity that the 19 creator of the Playpen website would have said. 20 reference to actual upgrades or improvements to the Playpen 21 website. 22 Q. 23 website was taken from the server? 24 A. Yes. 25 Q. You've been the lead agent on the case since then? This was a, for lack of a Token Ring was a networking It is generally not used It was not any And you've been on this investigation since before the 17 1 A. Yes. 2 Q. And to the best of your knowledge, has the FBI or anybody 3 in your employ or at your call done anything to increase the 4 efficiency or to allow more people onto the website? 5 A. 6 on the website both before and after the FBI takeover. 7 Q. 8 we haven't discussed because this goes beyond what I thought 9 was the scope of the hearing, so I apologize that I didn't give No, and as I stated, again, there was consistent activity I have another question, something, for what it's worth, 10 you warning, but whatever, it is what it is. There have been 11 some statements made in various affidavits or declarations 12 about the utility or the usefulness of this operation or this 13 NIT. 14 reference, there's been some suggestion or talk or 15 representation that as a result of the NIT in this 16 investigation, a certain number of people have been rescued or 17 saved from sexual exploitation. 18 A. Yes, I am. 19 Q. And just so it's clear, in any of your testimony or 20 writings, did you make a reference to the number of children or 21 children that have been saved from sexual exploitation because 22 of this investigation and the NIT? 23 A. 24 our investigations of members of the Playpen website have led 25 to the rescue of at least 38 children from hands-on sexual As you heard the Judge momentarily a few minutes ago make Yes. Are you familiar with that? In one or more of my declarations, I've stated that 18 1 abuse. 2 or higher. 3 4 As of today, I believe the number is either 49 children THE COURT: So as a result of the NIT, you're saying you did searches in homes and found these children? 5 THE WITNESS: Yes, your Honor. 6 Q. So I'm not going to ask you to go through 49 or more 7 cases, but, generally, what do you mean that children had been 8 saved or safeguarded? 9 A. What do you mean by that? In general, when search warrants were executed as a result 10 of this investigation, during the course of those subsequent 11 local investigations, it was determined generally that a child 12 in the house was being sexually abused. 13 was production of child pornography involved, sometimes there 14 was; sometimes there was not. 15 abuse with no production of child pornography. 16 our investigation has led to the identification and rescue of 17 at least 49 children in such circumstances. 18 THE COURT: Whether or not there Sometimes it was just hands-on But to date, Can you estimate the number who had the 19 child pornography posted on that website; in other words, 20 pictures of the abuse being posted? 21 THE WITNESS: To my knowledge, of those 49 children, I 22 have personal knowledge that I believe two of them had images 23 that were produced and distributed on the Playpen website. 24 majority of the children that were rescued I don't believe had 25 images or videos produced of them. I think they were just The 19 1 being abused generally by a relative. 2 3 THE COURT: involved this defendant? 4 5 THE WITNESS: To my knowledge, I don't believe there's been any allegation of hands-on offenses with this defendant. 6 7 And just to make it clear, none of that MR. TOBIN: May I have just a moment, your Honor, please. 8 I don't think I have any other questions. 9 THE COURT: 10 You've made it seem as if the production capability was still on even though you had turned it off? 11 THE WITNESS: 12 THE COURT: 13 No, so when the FBI took control -That function where somebody could post child pornography? 14 THE WITNESS: So while the FBI had control of the 15 website, people could still post child pornography images 16 there. 17 website that was called The Producer's Pen. 18 the Playpen website encouraged members to produce new images of 19 child pornography. 20 immediately upon taking it over, and it was never brought back. However, there was a specific section of the Playpen This section of The FBI shut that part of the website down 21 THE COURT: 22 THE WITNESS: Was it ever used before you shut it down? Before we shut it down, there was one 23 individual who had posted images, either images or videos of 24 child pornography that he had produced exclusively for the 25 Playpen website. That individual was identified and his 20 1 victims were rescued. 2 THE COURT: 3 THE WITNESS: As a result of this investigation? Partially. He was located in a foreign 4 country, and some of our foreign counterparts had engaged with 5 him in undercover activity. 6 effort, but we were not the lead investigative agency with 7 respect to that individual's arrest. And so we contributed to that 8 THE COURT: All right, thank you. 9 MR. TOBIN: No, no, I don't have any follow-up to 10 I'm sorry. that, so I'll sit down. 11 MR. WATKINS: May I, your Honor? 12 CROSS-EXAMINATION BY MR. WATKINS: 13 Q. Good morning, Special Agent Alfin. 14 A. Good morning. 15 Q. I just want to get the timeline a little bit. 16 already -- part of your job is monitoring child exploitation 17 websites? 18 A. Yes. 19 Q. And you began seeing links to Playpen in August of 2014, 20 which I think you've testified shortly after Playpen got going? 21 A. Correct. 22 Q. At that point you navigated yourself over to Playpen and 23 could see what was there? 24 A. Correct. 25 Q. And you saw that the site was growing, as you mentioned, You were That's fair to say. 21 1 starts out slow, but you kept on through the months keeping an 2 eye on the growth of Playpen, right? 3 A. That's fair to say, yes. 4 Q. And, of course, because it's on the Tor network, 5 difficult, if not impossible, to find out where it is? 6 A. Yes. 7 Q. In December you were given an IP address for the server 8 that Playpen was on, right? 9 A. Yes. 10 Q. And just I'm going to break that down a little bit. 11 server and a site are two different things, right? 12 A. 13 software that was running on that server. 14 Q. 15 server-hosting company that actually had Playpen on it, right? 16 A. Yes. 17 Q. They're leasing space to all kinds of people? 18 fairly large hosting operation, right? 19 A. 20 comparatively, but it was a legitimate business in North 21 Carolina. 22 Q. 23 North Carolina, and that's where the IP address resolved it? 24 A. 25 the subject who created the website was leasing the entire Yes. A A server is just a computer, and the site is the And this case is a good example because this is a They were a legitimate business. They're a I don't know the size And that's what they did was lease space on that server in Well, generally, yes, but just to clarify, I believe that 22 1 server, not just space on one server. 2 Q. Okay, the company's entire space? 3 A. No, just -- he had one dedicated server, I believe. 4 Q. All right. 5 administrator, the person who designed the site is Steven 6 Chase, right? 7 A. Yes. 8 Q. We can say his name. 9 A. Yes. 10 Q. And also the name of the hosting service, that's redacted 11 from the affidavit, but that's public knowledge now, right? 12 A. 13 Central Logic. 14 Q. 15 they rent space to, right? 16 A. Yes. 17 Q. And one of those places was -- one of those operations was 18 Playpen? 19 A. 20 Chase was hosting the Playpen website on that server. 21 Q. 22 address that we're talking about, you were given that 23 information that despite the fact that it was on Tor, this IP 24 address had shown up at some point, right? 25 A. And, well, two things: I believe it is. Right. One, the He's been convicted, right? It was -- the name of the company was So Central Logic has a whole bunch of servers that That's common? Well, they were leasing space to Steven Chase, and Steven Turning back to the Internet protocol address, the IP Yes. 23 1 Q. And that's because the site administrator misconfigured 2 the site for a moment where it wasn't on Tor anymore, right? 3 A. Well, no, that's not accurate. 4 Q. Well, tell me how it was that an IP address shows up where 5 it's supposed to be on Tor. 6 A. 7 you create a normal website as you would any other website, but 8 then you make certain configurations to the software on the 9 server to insure that that website can now only be accessed So, generally, when you configure a Tor hidden service, 10 over the Tor network. And so in that configuration file on the 11 server, there was a typo in one of those lines of code, and so 12 that typo caused the website to be still available on the Tor 13 network, but you could also access it through the regular 14 Internet if you knew its true IP address. 15 Q. 16 IP address and gave that information to you? 17 A. 18 that information and verify that it was accurate. 19 Q. 20 to find a large child pornography website? 21 A. That is generally considered a good thing, yes. 22 Q. And so in December, that's when you identify where Central 23 Logic is, and that is where Playpen is operating from? 24 A. Yes. 25 Q. And you begin making further efforts to identify the And that's what happened, is somebody discovered its true Yes, that's correct, and then I was able to authenticate That's an extremely happy day for you, right? You're able 24 1 administrator, and that leads you to Steven Chase? 2 A. Yes, that's correct. 3 Q. In January of 2015, you obtained a search warrant to go to 4 Central Logic and get a copy of the Playpen website? 5 A. Yes, that's correct. 6 Q. So even though you did not control it until February 20, 7 beginning on a date in January, the FBI had a copy of 8 everything that was on the Playpen website, right? 9 A. As of the date that that copy was seized, yes, that's fair 10 to say. 11 Q. 12 January? 13 A. 14 the search warrant I think has been discussed publicly. 15 Q. 16 mid-January. 17 government took control of that website, you and other agents 18 knew exactly what was on it? 19 A. 20 same time period I am. 21 between the January seizure and the government takeover? 22 Q. Yes. 23 A. Yes. 24 Q. And so that would include access to all of the images and 25 videos that were then on the website, right? And what was the date that that copy was seized in It was mid-January. I don't recall the exact date, but The search warrant says January sometime, but you think So for a full at least 31 days before the Are you -- I just want to make sure you're referencing the Are you referencing the time period 25 1 A. No. So the Playpen website, after the first few days of 2 the website, the administrator, Steven Chase, disabled the 3 functionality of the website that would allow users to attach 4 images and videos directly to the website. 5 THE COURT: 6 THE WITNESS: 7 THE COURT: 8 THE WITNESS: 9 So this is after he was arrested? Before he was arrested, your Honor. So he didn't know about you yet? He did not know about me until he was arrested on February 20. 10 11 And so generally -- THE COURT: This wasn't part of the cooperation. He disabled it on his own? 12 THE WITNESS: 13 THE COURT: 14 THE WITNESS: He never cooperated, your Honor. I see. So websites like Playpen, because 15 they're operating within the Tor network, they can be very 16 slow. 17 pornography website, if you allow individuals to attach images 18 directly to their postings, it makes the website go even slower 19 because some of those images are very large; it takes a long 20 time to download them. 21 Playpen, what users will do, they will actually post the images 22 and videos on other websites, frequently not on the Tor 23 network; and so they'll upload their images and videos to these 24 other websites, encrypt them with a password, and then they'll 25 go to Playpen. And so when you have a website, a very large child And so generally with websites like They'll post a small preview image and say, "If 26 1 you want the full thing, click on this link. 2 password to download it. 3 And so this was generally how content was distributed on the 4 Playpen website. 5 Here's the Here's the password to decrypt it." And, now, at certain points in time the creator, 6 Steven Chase, did create two additional features of the Playpen 7 website that are referred to as Playpen image hosting and 8 Playpen file hosting, and these were separate Tor hidden 9 services that were part of the Playpen website where users 10 could upload images and videos without making the actual 11 website go slower. 12 did not have access to all of the images and videos that were 13 distributed through the Playpen website. 14 seizure only included the actual -- the website itself. 15 So when we seized that copy in January, we THE COURT: I believe that So when you say you seized it but didn't 16 control it, it means you just copied it and Chase didn't know 17 about it? 18 THE WITNESS: Yes, your Honor. So Chase leased, I 19 believe it was two physical servers at Central Logic in North 20 Carolina. 21 website, Chase had moved the website from one of his servers to 22 the other one. 23 I'll call Server No. 24 No. 25 Chase didn't know that we had seized that copy, and the users And so the day before we seized a copy of the So the live copy of the website was now on what 2, and so we seized a copy of Server 1, so there was no interruption to the Playpen website, 27 1 of the Playpen website never experienced any connectivity 2 issues. 3 website. So we were able to surreptitiously seize a copy of the 4 THE COURT: 5 30 days before you seized it? 6 THE WITNESS: So you knew about its operations for So I first learned that the website was 7 hosted in North Carolina, I believe it was December 23, 2014, 8 and at that point we began drafting -- well, initially we sent 9 a subpoena to the company, and then we sent -- we drafted a 10 search warrant and continued our investigation through that 11 manner. 12 13 THE COURT: Right, and then you copied it in January? Do you remember the date? 14 THE WITNESS: It was mid-January, your Honor. I 15 believe it may have been somewhere between January 14 and 15. 16 I can certainly look that information up and get it to the 17 Court afterwards. 18 THE COURT: In any event, sometime mid-January, and 19 then you actually, just so I get the timeline in, you actually 20 seize it on February 20? 21 THE WITNESS: 22 THE COURT: 23 THE WITNESS: 24 Q. 25 the server? We took control of it on February 20. So roughly a month, give or take? In between those two, yes, your Honor. But you actually seized it in January, right, you seized That's what the search warrant -- 28 1 A. We seized a copy of it. 2 server. 3 data. 4 Q. 5 specific case? 6 Logic, right? 7 A. 8 specific case? 9 Q. We didn't take the physical It was an ECPA search warrant, so we got copies of the We didn't physically take any servers. And that search warrant, that wasn't in connection to a I'm sorry. That was a search warrant directed at Central What do you mean, not directed towards a In other words, that particular search warrant has not 10 been released publicly in any case? 11 A. 12 copies of it have been provided pursuant to protective orders, 13 I believe, in some of the Playpen cases. 14 whether or not it's still under seal. 15 Q. Can you tell me which cases it was provided? 16 A. I believe we provided a copy of it in U.S. v. Michaud in 17 the Western District of Washington. 18 but I'm fairly confident that we provided it pursuant to a 19 protective order, if it's not already unsealed. 20 Q. 21 to seize the entire website, right? 22 A. 23 customer account in Central Logic. 24 Q. 25 have the ability at that point to shut it down? Uhm, I'm not sure if it's still under seal or not. So that's available. I know I don't recall I would have to verify, That search warrant authorized you It authorized us to seize copies of data from a particular Once you have seized it and know where it is, you also 29 1 A. We have the ability to shut down that particular instance 2 of the Playpen website. 3 from existence. 4 Q. 5 website that's in North Carolina, right? 6 A. 7 the copy itself. 8 capability to do that. 9 Q. We don't have the ability to remove it Well, so you asked Central Logic to make a copy of that Actually, I think we sent an FBI agent out there to make I don't think Central Logic had the You already know what's on the website because you've been 10 monitoring it, right? 11 A. 12 that the Playpen website was there, so, yes, I knew that the 13 Playpen website was on that particular server. 14 Q. 15 is indeed a website that has links to child pornography all 16 over the country, all over the world? 17 A. 18 job was to go and copy the data from the server. 19 responsible for analyzing that data. 20 Q. Sure. 21 A. I have. 22 Q. And that data confirmed what you saw in the months leading 23 up to December, right, to January? 24 A. 25 Central Logic at that time. Well, I had already logged into the website and confirmed And you have an FBI agent down there confirming that this The FBI agent that went out to seize the copy, his only He wasn't You've analyzed that data since then, right? We confirmed that the Playpen website was being hosted at 30 1 Q. And it also confirmed that there are child porn images and 2 videos and links for child porn images and videos on that site, 3 right? 4 A. Yes. 5 Q. So as of that date, there would have been no impediment to 6 simply unplugging Playpen in North Carolina and stopping it? 7 A. 8 accurate. 9 Q. We could have unplugged it in North Carolina, that's And once it's unplugged in North Carolina, that's it for 10 Playpen? People can't go to the website anymore? 11 A. Well, they can't go into it in North Carolina 12 anymore, but based on my training and experience, I think it 13 would have taken maybe a day or two for it to pop up again 14 somewhere else, just as it was up until that date. 15 Q. 16 were gaining information about Steven Chase, right? 17 A. Yes. 18 Q. And you knew -- actually, by then you knew of where he 19 lived and what he was doing on the site? 20 A. 21 remember the exact day when Steven Chase was identified. 22 Q. 23 administrator both in your sights, so to speak? 24 A. Yes, that's fair to say. 25 Q. So at that point you could have taken down the website; No. If Central Logic had -- by that time, you also knew or you It was approximately around that time frame. I don't But in mid-January, so you have the site, you have the 31 1 you could have arrested Steven Chase for operating the website. 2 He can't move it around anyplace else. 3 A. 4 and at that point it was unknown whether or not other 5 administrators had backup copies of the website that they could 6 have put back up online. 7 had everything we needed to insure that we could have shut down 8 Playpen for good. 9 Q. He can't, that's true. Playpen had three administrators, So it is not accurate to say that we For good, but you could have shut it down in North 10 Carolina from people logging onto that IP address in North 11 Carolina that was Playpen? 12 A. 13 website in North Carolina, that is true. 14 Q. 15 running someplace else? 16 else? 17 A. 18 server at any particular time. 19 conflicts and collisions within the network. 20 only current place where the Playpen website was. 21 Q. 22 only place that it was ever hosted was in North Carolina? 23 A. That's not true. 24 Q. Where else was Playpen hosted? 25 A. It was hosted at at least one or two other service Yes, we could have shut down that particular copy of the And at that point you were aware that there was no copy There was no backup server someplace Well, a Tor hidden service can only be running on one Otherwise, there would be So that was the And you've certainly learned since then that that was the 32 1 providers prior to being hosted at Central Logic. 2 Q. 3 other spots, right? 4 A. Yes. 5 Q. It moved to Central Logic when? 6 A. I believe it was October, 2014. 7 Q. So from October, 2014, right up to January, always 8 operated off of Central Logic in North Carolina? 9 A. Correct, in the early days of Playpen, it was hosted in The website itself did. Some features of the website 10 operated in other areas. 11 Q. Some features meaning the hosting and the actual images? 12 A. The file-hosting feature of the Playpen website was 13 located on a server in Canada. 14 the website was also located at Central Logic in North 15 Carolina. 16 estimate the majority of the content that was distributed 17 through the Playpen website over the course of its existence 18 was hosted at various providers, known and unknown. 19 Q. 20 site. 21 to these other places that are portions of the site? 22 A. The image uploader and the file uploader for Playpen, yes. 23 Q. The website continued to run at that point, right? 24 A. After we seized the copy in January? 25 Q. Yes. The image-hosting feature of And then the majority of the content, I would And just to be sure, these are all adjuncts to the Playpen The Playpen site is the front end of it that leads you 33 1 A. Yes. 2 Q. It ran all the way till March 4, right? 3 A. Well, it ran in North Carolina through approximately 4 February 20. 5 Q. And in the FBI in Virginia until March 4? 6 A. Correct. 7 Q. So during this time, you're continuing to go -- well, let 8 me back up. 9 get the back end of the website as well. When you seize it, it's not just the website. You You get to see what 10 the administrator sees, right? 11 A. Yes, that's true. 12 Q. And so this includes sometimes IP addresses, right? 13 of the administrators actually had their real IP addresses 14 within the site; is that true? 15 A. 16 in server logs. 17 Q. 18 that were recognizable, right? 19 A. 20 were generally either Tor nodes or virtual private network IP 21 addresses, both of which generally are not actionable. 22 even if you don't access a Tor hidden service, in the case of 23 Playpen, as I testified earlier, it was also available on the 24 regular Internet. 25 Q. Some So the primary administrator, his IP address did show up And there were some other logs with actual IP addresses There were other logs that had real IP addresses, but they And so -- For a short period of time? And so 34 1 A. Correct. 2 Q. Just to be clear, by the time you seized it in January, 3 that misconfiguration had been fixed? 4 A. 5 administrator, Steven Chase, I don't believe he ever actually 6 fixed that glitch. 7 was arrested. 8 Q. 9 December up until the time that the FBI finally shut it down, No, I don't believe it had been. I don't believe the I think it was still present up until he So just to be clear then, one could reach Playpen from 10 one could reach that without using a Tor browser? 11 A. If you knew its true IP address, yes, you could. 12 Q. In addition, when you seized the copy of the server, you 13 had the back-end information that showed you where the links on 14 the site would take one for images and videos, right? 15 A. Yes. 16 Q. So because you now had the site from both the front end 17 and the back end, you could in fact go through and download 18 videos, all of the videos and all of the images that Playpen 19 referenced there, right? 20 A. 21 website for a while. 22 website and seen the links to the images and videos. 23 wasn't any specific capability that we gained after seizing a 24 copy of it. 25 Q. That information was contained in that database. We were engaging in undercover activity on the Playpen We could have always logged onto the That That's true, but at that point you actually had the 35 1 website. 2 do anything about it? 3 you can't do anything about it because you don't know it, 4 right? 5 When you were looking at it before, right, you can't THE COURT: You'd love to shut that thing down, but Because you don't know what? 6 Q. You don't know where it is? 7 A. The actual website, correct. 8 Q. Once you did know the website in January, you could have 9 shut it down, right? 10 A. As I testified earlier, we could have taken offline the 11 copy that was in North Carolina, that is true. 12 Q. 13 There's no Playpen left anywhere, right? 14 A. That's correct. 15 Q. So that could have also happened in January the same way 16 it happened in March? 17 A. No. 18 Q. Let me -- And indeed the FBI now has taken the whole thing down. 19 THE COURT: 20 THE WITNESS: Why not? Your Honor, as I testified earlier, the 21 administrator had hosted the Playpen website at various hosting 22 providers, not just in North Carolina. 23 had multiple backup copies of the Playpen website in his 24 possession. 25 in January, it would have been a process of hours to lease And so we know that he And so if we had just knocked the server offline 36 1 server space at another company, put a copy of the Playpen 2 website back online, and then it would have been running again 3 just as it was before in North Carolina. 4 Q. But you arrested Mr. Chase later on, February? 5 A. Yes, we did. 6 Q. And he was the one with the backup copy, right? 7 A. Yes. 8 Q. And indeed, I think you already testified to this, but you 9 had his information in January when you seized the site? He had multiple backup copies of the website. 10 A. Around that time frame we had identified Mr. Chase as our 11 primary suspect, yes. 12 Q. 13 monitoring the website before you knew where it was, and then 14 after you found out that you did know where it was and could 15 seize it, did you download images or videos yourself to check 16 on victims? 17 A. I'm not sure I understand the question. 18 Q. Well, let me do it this way. 19 National Center for Missing & Exploited Children, right? 20 A. Yes, I am. 21 Q. And I'm going to refer to them as NCMEC, the acronym. 22 know that NCMEC keeps a database of hash values of images and 23 videos, right? 24 A. Yes. 25 Q. So if you had downloaded one or 10,000 or 100,000 of the So whether it was during the time that you were just You're familiar with the You 37 1 images that were up there, send them to NCMEC, NCMEC will give 2 you a report very quickly about whether those are known 3 children or not, right? 4 A. Generally, yes. 5 Q. And they will tell you where some are not, right? 6 A. So NCMEC will tell you whether or not that particular hash 7 value has been seen before, and if that hash value or if the 8 image has never been altered since its initial submission to 9 NCMEC, then those results will be accurate. So during the 10 course of our investigation, we did submit all of the images 11 and videos that we were able to capture to NCMEC. 12 Q. When did you do that? 13 A. I would estimate sometime in March, 2015. 14 Q. So that was after the FBI had shut down Playpen? 15 A. Yes. 16 Q. And you've received the results of what you sent to NCMEC 17 at this point? 18 A. Yes, we have. 19 Q. And indeed there are many, many, many, many known victims 20 that were posted up on Playpen? 21 A. Yes. 22 Q. And were those -- 23 24 25 THE COURT: I don't know what you mean by victims. You mean the Holly series? THE WITNESS: Yes, your Honor. The majority of child 38 1 pornography that was distributed through the Playpen website 2 was existing series of child pornography. 3 actual section on the Playpen website, The Producer's Pen that 4 encouraged new production, that actually only was created, I 5 think it was a day or two before the FBI seized control of the 6 website, so the majority of child pornography that was 7 distributed through Playpen were existing series. 8 Q. 9 already, there's no reason why you couldn't have sent those There was -- the And moving back, because you had the copy of the website 10 images and videos to NCMEC in January? 11 A. 12 equivalent of having copies of all of the images and videos 13 that were distributed through the website because the website 14 itself was generally not the storage location for the images 15 and videos; and so it's a lengthy manual process going through, 16 downloading everything, decrypting it, and so on. 17 Q. Decrypting it means entering in a password, right? 18 A. Yes, it does. 19 Q. And the password was available on the website and you had 20 it? 21 A. Yes. 22 Q. So when you talk about decrypting, it's not a long, 23 involved process. 24 entering it in, and, bingo, you have a whole bunch of images? 25 A. So, again, having a copy of the website is not the It's finding where that password is, Which is a lengthy process if you repeat it numerous 39 1 times. Doing it on one occasion is not a lengthy process. 2 Q. 3 March while the FBI allowed the site to run? 4 A. 5 about whether or not images that were distributed on the 6 website were in fact new or were not new, so some information 7 was sent to NCMEC during that period. 8 Q. 9 because -- why is that concerning to you? Did you do it at all in the period between January and Yes, there were some instances where there were questions And that's very concerning to you if it's new images 10 A. Well, any images of child pornography are concerning, but 11 anytime that a new series pops up, that generally means that 12 there is a child somewhere who is actively being raped. 13 Q. 14 serious, serious issue, right? 15 anywhere. 16 that? 17 A. 18 that point still has no capability to identify that child or 19 stop the rape. 20 Q. 21 image? 22 A. Which time period are you referring to? 23 Q. The time period where you talked about sending suspected 24 new images to NCMEC. 25 A. And if it's on Playpen that it first shows up, that is a It's serious if it shows up It's serious to you because now the FBI can stop Well, no, that's not an accurate statement. The FBI at Stop the posting of the image that is identified as a new Right. 40 1 Q. So if you start getting lots of responses from NCMEC, "We 2 haven't seen that image or that video before," right, then 3 Playpen is now posting brand-new content? 4 A. 5 members are posting images and videos that NCMEC has never seen 6 before. 7 the first place that it was posted. 8 Q. 9 that -- it's all serious, but it's different from something Playpen -- well, members -- under those circumstances, That's not necessarily an indication that Playpen is Absolutely, but it's a much different thing than something 10 that NCMEC has seen over and over and over again, right? 11 A. 12 13 14 Yes. It's different circumstances. THE COURT: So did that happen during that initial January time period, new material being posted? THE WITNESS: I am aware of two instances where 15 confirmed new material was posted on the Playpen website after 16 the government had the capability to do anything, no matter how 17 limited that may be. 18 individual who had posted in The Producer's Pen who I had 19 testified to earlier was identified; his victims were rescued. 20 The images that he had posted -- 21 THE COURT: 22 THE WITNESS: One of those instances was, the Is that the foreign guy? Yes, your Honor. After that material 23 was encountered, it was immediately removed from the Playpen 24 website to prevent distribution of a new series. 25 other individual during the FBI's operation who had similarly There was one 41 1 claimed to either have access to a child or be producing child 2 pornography. 3 and a lead was sent to the country that that individual was 4 believed to be in. 5 Q. 6 assertions before that the FBI was unable to monitor every 7 post, every download from Playpen during the course of this 8 investigation? 9 A. That posting was also removed from the website, And just to be clear, there have been declarations or I don't believe that's an accurate characterization. If 10 there is a specific statement in a declaration you have a 11 question about, I can address that, but I don't believe the way 12 you've described it accurately reflects the declarations. 13 Q. I'll get to that in a moment, but I still want -- 14 THE COURT: 15 MR. WATKINS: 16 THE COURT: I'm just concerned about time. I'm sorry? Yes, I'll keep it -- Because I'm not going to bring him back, 17 so I just want to make sure you get through what you've got to 18 get through. 19 MR. WATKINS: We're moving, we're moving. 20 Q. So talking again now of this period between mid-January, 21 perhaps the 15th or 16th, up through February 20 when the FBI 22 starts operating the website itself, the website is ongoing. 23 You talked -- there are other things happening in regard to the 24 investigation, right? 25 that point? You're not just sitting on your hands at 42 1 A. Correct. We are conducting surveillance on Steven Chase 2 and preparing for our investigation of other members of the 3 Playpen website. 4 Q. 5 enforcement team are trying to decide whether to keep running 6 the site under government control? 7 A. 8 not under government control. 9 Q. And at the same time, you and other members of the law Well, during this time frame that you've described, it was But I'm saying, there are discussions about whether it 10 should continue to operate, right? 11 A. 12 investigate other members of the website? 13 Q. Yes. 14 A. Yes, there were discussions had about that, about how to 15 best conduct that investigation. 16 Q. 17 right? 18 A. 19 testified to earlier. 20 Q. 21 the network investigative technique, right? 22 A. Yes. 23 Q. In regard to those discussions, who participated in those 24 discussions about whether to continue it on? 25 Whether the government should take control of it and Because one choice, though, always is just shut it down, Get everything we can and shut it down, right? We could have shut down the Playpen website, as I And there was a decision made to keep it going and to use MR. TOBIN: I'm going to object to that, your Honor. 43 1 Those are the internal deliberations of law enforcement that 2 aren't -- 3 THE COURT: 4 MR. WATKINS: 5 discussed. 6 deliberations. 7 Sustained. Your Honor, I'm not asking what they I'm asking who participated, and it's not internal I should say, where this is -- THE COURT: For me, the issue is not so much who is 8 involved. 9 of what we're doing here. 10 MR. WATKINS: If you want to limit it to who was That's what I was asking, whose decision was it to keep it up and running in government control. 13 14 That's just beyond the scope keeping it up and running it, I'm happy to have you do that. 11 12 It was to use the NIT. THE COURT: It was a two-part question. Anyway, so we're just going to limit it to, who decided to keep it going? 15 THE WITNESS: These were discussions that were had 16 between the FBI and the Department of Justice, and we 17 ultimately decided that we had a solid investigative plan, and 18 we executed it. 19 Q. 20 was Main Justice in Washington that was part of these 21 discussions? 22 A. 23 of Justice Child Exploitation and Obscenity Section. 24 Q. 25 Section? And when you talk about the Department of Justice, this Yes. We partner on this investigation with the Department And also with the Computer Crime and Intellectual Property 44 1 A. Lawyers from CCIPS may have been consulted or involved at 2 some point in time. 3 THE COURT: 4 THE WITNESS: CCIPS? I'm sorry, your Honor. The Computer 5 Crime and Intellectual Property Section at the Department of 6 Justice. 7 Q. 8 deliberations as to whether to continue the website with the 9 government operating it? So several arms of Main Justice were involved in the 10 A. 11 Justice on this operation. 12 Q. 13 Main Justice about whether to keep it going, you are also 14 drafting or getting ready to draft the NIT warrant? 15 A. Yes. 16 Q. And the people you were consulting with at Main Justice 17 are also aware of the NIT warrant? 18 Yes. We worked very closely with the Department of At the same time that you're working very closely with MR. TOBIN: Objection. 19 focus here. 20 was decided and they did it. 21 THE COURT: It goes hand in glove? Again, beyond the scope of the I mean, the NIT warrant is the NIT warrant. It I don't know -- Well, I don't know whether it is, but let 22 me just ask you, was the -- I don't want to go into the 23 techniques of the NIT at all. 24 did you decide to keep it open? 25 THE WITNESS: It's just about the issue of why We decided to keep the website running, 45 1 your Honor, because we could have just shut it down and 2 hopefully removed Playpen from existence, but it would have 3 left us with no ability to identify the members of the Playpen 4 website, the individuals who were distributing child 5 pornography or the individuals who were actual contact 6 offenders who were members of the Playpen website. 7 without going forward with this operation, we would have had no 8 capability to identify anyone other than the creator of the 9 Playpen website. And so 10 Q. 11 than you and Special Agent McFarland, who actually was the 12 affiant on the search warrant, right? 13 you talking about this, right? 14 A. 15 several individuals and levels of management from both 16 organizations. 17 Q. 18 Eastern District of Virginia to issue the NIT warrant, but this 19 went far beyond that as far as people having input? 20 A. There was an AUSA in Virginia that we worked with, yes. 21 Q. But it was not his or her decision either, right? 22 was a decision made higher up? 23 24 25 So just to be clear, when you say "we," it's much more Correct. It's not just the two of It's both the FBI and the Department of Justice, There was an Assistant U.S. Attorney involved in the MR. TOBIN: This Again, your Honor, with regard to the deliberative process at the Department of Justice -THE COURT: I'll allow that it was made higher up. 46 1 THE WITNESS: It was, your Honor. It was done with 2 the approval of executives in both the FBI and the Department 3 of Justice. 4 Q. When you say executives, FBI general counsel? 5 A. The FBI Office of General Counsel was aware of the 6 operation, yes. 7 Q. 8 want to ask that you understood that the NIT would be deployed 9 from the server to whatever computer logged into and went 10 I don't want to get into the details of the NIT, but I do through the Playpen site, right? 11 12 MR. TOBIN: THE COURT: 14 MR. WATKINS: Yes, let's just move ahead. If I may just have two quick questions on that. 16 17 That essentially is a detail, and it goes beyond the scope of this. 13 15 Objection. THE COURT: I don't know what they are, but that one is just already established, so it -- 18 MR. WATKINS: I was trying to do it as background more 19 than anything. I think this is background also. 20 Q. 21 internationally both, right? 22 A. 23 District of Virginia, and but for someone logging into the 24 server in the Eastern District of Virginia, it would remain 25 there. So you knew it was going to be deployed domestically and Well, the NIT is installed on the server in the Eastern But, yes, we reasonably believed that there were 47 1 members of the Playpen website throughout the country and 2 throughout the world. 3 Q. 4 would be identified as malware or hacking other computers? And this NIT, if it weren't the government doing it, it 5 MR. TOBIN: Objection. 6 THE COURT: Sustained. 7 MR. WATKINS: 8 Q. We're just dealing with this. I understand. Are you aware of what the vulnerable equities -- 9 MR. WATKINS: 10 THE COURT: I'm sorry? I just wondered, was there a specific 11 protocol for addressing the ethical issues that come with 12 keeping something like this alive? 13 THE WITNESS: I don't know if there is a specific 14 protocol, your Honor, but we did have discussions on that very 15 topic. 16 Playpen website, based on historical analysis of investigations 17 of individuals who trade and distribute child pornography, that 18 this was a rare opportunity to not only identify a large number 19 of distributors of child pornography but to identify and rescue 20 a large number of victims, as that is the primary focus of our 21 work is to identify and rescue victims. 22 such as the one presented in this case are incredibly rare, and 23 so the benefits of engaging in this operation, we determined 24 that they outweighed the option of just removing Playpen from 25 existence and waiting until another such website popped up It was decided that based on the population of the And so opportunities 48 1 24 hours later. 2 Q. 3 You mentioned that there was a typo in the code that made it 4 misfigured, where actually it could be seen even if you didn't 5 have a Tor browser? 6 A. Yes. 7 Q. There are also other amateurish features to it? 8 log-in page, right, you talked about that in one of your 9 affidavits? I want to talk about the actual website as you found it. 10 A. What do you mean, amateurish? 11 question. 12 Q. 13 this -- I can move my computer over here. 15 THE CLERK: I can switch it, no. Do I have One second. It's up now. 16 17 I don't understand the Well, let me put it up on the screen, if I may. 14 The MR. WATKINS: moment. Sorry, your Honor. If I may just have a Well, I'll just do it on the -- 18 THE COURT: 19 MR. WATKINS: 20 THE CLERK: What are you showing? I'm going to the document camera. Okay, I switched it to doc camera. 21 Q. This log-in page, the administrator, Steven Chase, advised 22 people just to enter in a random e-mail address because the 23 software required it, but they weren't going to do anything 24 about it, right? 25 A. Yes, that's correct. 49 1 Q. And indeed when the site first started, that didn't have 2 to happen, right? 3 password, right? 4 A. 5 could access the website as a guest, but that functionality I 6 don't think lasted for more than a week. 7 Q. 8 have put in if he knew what he was doing? 9 A. You didn't have to put in a user name or a Uhm, during the first maybe two or three days, I think you And indeed that is functionality that Steven Chase could I don't know what that has to do with him knowing or not 10 knowing what he's doing. That's just a configuration option on 11 the website. 12 Q. 13 password, he just had people put in random e-mail addresses? 14 A. 15 log-in page. 16 Q. Well, perhaps. 17 A. When you register an account on the Playpen website, you 18 have to choose your user name, and you also have to enter an 19 e-mail address. 20 a real e-mail address. 21 e-mail address like Bob@aol.com. 22 going to check to make sure it looks like a real e-mail 23 address: Don't worry, we're not going to send you any actual 24 e-mails. So create your user name, enter a fake e-mail 25 address, and then you get your account. Right, but instead of getting rid of this user name and I think you're confusing the registration page and the So tell me what the difference is. Now, the website warned you: Hey, don't enter Just enter something that looks like an The website software is just 50 1 Q. He was telling users that the software requires that? 2 A. Correct. 3 Q. But you've actually learned that the software didn't 4 require that? 5 A. No, that's not accurate. 6 Q. It could be configured so that you did not need to put in 7 an e-mail and -- 8 THE COURT: 9 MR. WATKINS: 10 11 THE COURT: Why are we doing this? I was just asking, your Honor. I know. We've just got to finish up. Are you done? 12 MR. WATKINS: I'm sorry? 13 THE WITNESS: Are we done? 14 MR. WATKINS: I've got a couple more questions, your 15 Honor, if I may. 16 I have till noon, I think. THE COURT: I know, but I don't want to stray off into 17 issues which may be relevant to the trial or something like 18 that. 19 Q. 20 the file-hosting feature was not working? 21 A. 22 learned that pursuant to the arrest of Steven Chase. 23 when we took control of the website in its initial period, that 24 file-hosting feature was not available. 25 Q. When you started up the website under government control, So the file-hosting feature was in Canada, and so we And so And how many days before you took control of the website 51 1 was the file hosting not available? 2 A. It was available up until we took control of the website. 3 Q. I see, so it was available at that time. 4 happened that day when you took it that it went down? 5 A. 6 in Canada, we contacted Canadian authorities and alerted them 7 to it. It's whatever As soon as we learned that that feature of the website was 8 THE COURT: 9 THE WITNESS: To do what? To take it down, your Honor. 10 Q. And why did you do that? 11 A. Our operation was such that we were going to take control 12 of the Playpen website, move it to our own server in the 13 Eastern District of Virginia, and operate it from there. 14 couldn't just download code from a foreign country without 15 their permission and put it up on our server, so we alerted 16 Canada. 17 feature, and then they eventually shut it down, seized a copy 18 of it, and sent us a copy of it. 19 Q. 20 understand it, you didn't move the actual server from North 21 Carolina to Virginia. 22 to Virginia, right? 23 A. 24 25 We We told them this server is the Playpen file-hosting So I just want to unpack that for a minute because, as I You made a copy of that server to move Yes, that's correct. THE COURT: How do you make a copy of a server as opposed to the software? 52 1 THE WITNESS: So, your Honor, when we arrested Steven 2 Chase at his residence in Naples, Florida, he was actively 3 logged into the administrative account of the server that was 4 hosting the website, and so we had the administrative user name 5 and password for that server. 6 we were able to remotely log into the server and download a 7 copy of the website that we -- 8 9 THE COURT: And so having that information, When you say copy the server, what you're actually doing is copying the website? 10 THE WITNESS: 11 THE COURT: 12 THE WITNESS: Yes, your Honor. That's a shorthand? Yes, your Honor. 13 Q. The server is actually the physical thing that contains 14 the website, website's data, right? 15 A. Yes. 16 THE COURT: 17 THE WITNESS: 18 THE COURT: The server is the computer, the hardware? Yes, your Honor. I just want to make sure. 19 Q. And so during that time actually Playpen is running, the 20 file-hosting service is up in Canada while you're getting the 21 copy and starting it up anew in Virginia, right? 22 A. 23 assessed the situation. 24 for the Playpen website. 25 in Canada, and from there, we put the website into what we call No. So during the search of Steven Chase's residence, we We find the usernames and passwords We determine that the file hoster is 53 1 "maintenance mode." 2 page of the website just says, "Hey, website currently down for 3 maintenance. 4 And so this makes it so that the front Come back later." So we immediately put it in the maintenance mode, and at 5 this point no features of the Playpen website are available. 6 And while it is in maintenance mode, we are transferring a copy 7 to our server in Virginia. 8 off the server in North Carolina, and we bring the website up 9 on our server in Virginia. After that, it's done. We power 10 Q. How long did that maintenance period last? 11 A. I would estimate eight to twelve hours. 12 exactly. 13 Q. 14 actual server company up there, or was it authorities in 15 Canada? 16 A. 17 Mounted Police, or the Ontario National Police. 18 remember exactly where the server was hosted, but we reached 19 out to law enforcement in Canada. 20 Q. Was that before or after the maintenance period? 21 A. Around the same time. 22 alerted Canadian officials. 23 Q. 24 you had to reboot that file-hosting service to put it back in 25 with Playpen to allow Playpen to access it? I don't remember You talked about calling up the Canadian -- was it the I believe we contacted either the RCMP, the Royal Canadian I don't While this process was going on, we And then once you started the server up again in Virginia, 54 1 A. So we never enabled access back to that server in Canada 2 while the FBI had control of it. 3 operation. 4 server that we had in Virginia after we brought the website 5 back online. 6 Canada that anyone was accessing during our operation. 7 Q. 8 Canada to the server in Virginia? 9 A. That was not a part of our We just enabled the file-hosting feature on the We did not actually keep anything running in So you moved the file-hosting service feature which was in No. It was just incorporated into the existing website 10 copy that we had moved to Virginia. 11 Q. 12 Canada on that server? 13 A. Yes, there was content on that server in Canada. 14 Q. And that server in Canada, the content there, Playpen 15 users would not be able to get to it at that point, right, 16 while the government was operating it? 17 A. 18 the plug, but, yes. 19 Q. 20 the plug while you were doing the maintenance -- 21 A. 22 exactly when they got out there and actually disconnected 23 anything from the Internet, but that portion of the website, 24 the Canada file-hosting service, was not available during the 25 FBI operation. And, as I understand it, there's also content up there in Generally, yes. I don't know exactly when Canada pulled When you say Canada pulled the plug, I thought they pulled So we alerted them during the maintenance. I don't know 55 1 Q. And so if someone clicked on a link that was supposed to 2 get them the images up there, they wouldn't be able to go 3 there? 4 A. 5 image uploader or file uploader. 6 in such a manner that just an external person with a link would 7 get an error trying to access them. 8 them from within the Playpen website. 9 Q. Correct. You couldn't just access links to the Playpen The servers were configured You had to actually access So when there is a message from the undercover to the 10 Playpen community saying "File hosting is up and running 11 again," what did that mean at the back end? 12 done at that point to make that message? 13 A. 14 the server in the Eastern District of Virginia, again, a 15 feature that existed prior to the FBI takeover of the website. 16 Q. 17 website? 18 A. 19 Tor hidden services. 20 speaks for itself. 21 images of child pornography. 22 upload larger files, generally encrypted archives that 23 contained either multiple images or larger videos. 24 Q. 25 users to upload content to Playpen? What had you all We just re-enabled that feature of the Playpen website on Sure. File hosting, what does that feature permit on the So Playpen had two different hosting features on their own One was image hosting, which generally It allowed users to upload individual File hosting allowed users to So by re-enabling that file-hosting feature, you permitted 56 1 A. To the file-hosting service, yes, we maintained that 2 existing feature of the website. 3 Q. 4 two, right? 5 A. 6 shorter, I believe, than the image uploading feature. 7 it was used less frequently than the image uploading feature. 8 Q. 9 by doing the file-hosting service feature, re-enabling it, that And the file-hosting feature was the more active of the You can upload more there? I don't believe it was more active. Its life span was I think But during the period of time the government was running, 10 did enable people to upload large files or large amounts of 11 child pornography? 12 A. As they could do before the government takeover, yes. 13 Q. As there were discussions concerning whether to continue 14 the operation of the website, there was also discussion about 15 whether to shut down portions of the website? 16 The Producer's Pen. 17 A. 18 after we assumed control of the website. 19 Q. 20 criteria about which parts of the website you would shut down 21 versus keep going? 22 A. 23 allowing a section or of operating a website that encouraged 24 active rape of children, so it was always understood that any 25 such features would be removed from the website when we assumed Yes. You talked about We did immediately shut down The Producer's Pen Following up on the Judge's question, was there any There was never any time where we entertained the idea of 57 1 control of it. 2 Q. 3 protocol, a written protocol? 4 A. Not that I'm aware of. 5 Q. So, for example, the file-hosting feature, was there a 6 discussion about whether to re-enable that or to just keep it 7 down while you operated it? 8 A. 9 don't recall specifics of them. When you say it was always understood, was there a There may have been discussions along those lines. I Obviously we came to the 10 conclusion that we were going to keep the feature alive as it 11 was before the takeover because we did. 12 Q. 13 website, whether to close that down or to mitigate what was 14 going on in other portions of the website? 15 A. 16 the website, shut down sections of the website, it generally 17 would have alerted people immediately to the FBI takeover, and 18 so we generally let the website continue as it was prior to the 19 FBI takeover. 20 Q. 21 Canada, somebody clicks on that, they get an error message. 22 A. Yes, in some circumstances. 23 Q. And there was quite a bit that was held on that Canadian 24 server, right, quite a bit of content? 25 A. Were there discussions about other portions of the So it was determined that if we had disabled features of But I think you just told us, for images that were in There were numerous images and videos. I don't know the 58 1 exact number. 2 Q. 3 of error messages off of the website, right? 4 A. 5 says "File hosting is temporarily down while we fix a bug," or 6 something of that nature, I believe. 7 Q. And then file hosting was back up? 8 A. Yes. 9 it was prior to the FBI takeover. So because of that alone, people were going to get a lot Uhm, well, no, there was a message that was posted that That feature was brought back to an active state as 10 Q. And, as I understand it, but to get to that Canadian 11 content, you still wouldn't be able to do that? 12 A. 13 after the FBI takeover. 14 Q. 15 anytime they tried to click on that content? 16 A. 17 that nature. 18 Q. 19 to keep going, were there discussion about other ways to 20 mitigate downloading of child pornography or uploading of child 21 pornography? 22 A. 23 distributed through the Playpen website was not actually on the 24 Playpen servers. 25 that server in Canada or the servers in North Carolina. That's correct, you couldn't get to that Canadian content And a user on Playpen would start to get error messages You would get a "File not found" message, something of In discussing the criteria about what to shut down or what So the majority of the child pornography that was It was a minority of the content that was on The 59 1 majority of the content that was distributed through the 2 Playpen website was hosted on external hosting providers, 3 generally outside of the United States. 4 that the FBI could have taken to remove that content. 5 wasn't under our control. 6 Q. 7 during a time they were operating Playpen, there was 67,000 8 links within the site that were accessed. 9 A. So there is no action It In previous pleadings, the government has indicated that I would have to read the pleading. Is that accurate? I don't know if that's 10 exactly what we stated in there, but if you have the document, 11 I can clarify. 12 (Pause.) 13 Q. 14 to dismiss indictment as a response to a discovery order in the 15 United States v. Michaud that's been submitted to the Court 16 before. 17 A. Okay. 18 Q. And that indicates 67,000? 19 A. Yes. 20 Q. Does it also indicate how many links went out externally? 21 22 25 I want you to look at the last paragraph on there. (Witness examining document.) A. 23 24 This is the United States' response to defendant's motion That may be on the next page. The sentence is cut off. (Document passed to the witness.) A. Thank you. (Witness examining document.) 60 1 A. No, it doesn't have any indication about that. I'm not 2 sure what line you're referencing. 3 Q. 4 external websites, right? 5 A. Yes, that's fair to say. 6 Q. And what would happen is, once somebody went to that 7 website, they might be able to download that content from that 8 website? 9 A. Yes. 10 Q. For links that went externally, unless you clicked on them 11 or some law enforcement agent clicked on them, you have no idea 12 what that content is, right? 13 A. 14 generally posted in certain categories, Preteen Hard Core 15 Girls, Boys, things of that nature, so you generally have an 16 idea of what the link is going to lead to. 17 that answers your question. 18 Q. 19 wouldn't know what that was? 20 A. 21 embedded in a particular post, you would see it when you opened 22 the post. 23 image file or the link to download the content first. 24 Q. 25 the North Carolina server, right, where you could actually take So those 67,000 links, many thousand of them went to That's also accurate. So links that were posted on the Playpen website were I'm not sure if That's the subject matter, but the specific picture, you Depending on how the post was configured, if the image was Sometimes you would have to actually click on the And that's as opposed to the images that were hosted on 61 1 a look at the images immediately? 2 A. 3 the website. 4 on Playpen image uploader in the same manner that you could on 5 external websites. 6 Q. 7 access to the back end, and you had access to the entire site 8 starting on February 20. 9 to North Carolina child porn is, and you can go directly there, I think you're drawing a distinction that doesn't exist on You could post links to images that were hosted The functionality was essentially the same. But now you have access -- since January of 2015, you had You can see exactly where the links 10 right? 11 A. 12 dates and when we had different controls of the website. 13 January we had a copy of the website itself. 14 we had copies of the image uploader or the file uploader. 15 not sure if those features existed at that particular point in 16 time. 17 control of the website, as you said. 18 Q. 19 have, for example, substituted adult pornography for that child 20 pornography image for images that were hosted in North 21 Carolina? 22 A. 23 Carolina back online, or we could have, I suppose, put adult 24 pornography in there; again, would have led people to 25 immediately acknowledge that there was clearly a law Well, wait. You've just combined two completely different So in I don't believe I'm When we took control of it in February, we did have So in February, where someone clicked on a link, you could We could have chosen not to put the images in North 62 1 enforcement takeover of the website, so that was not done. 2 Q. 3 click on the link, regardless of whether the pornography was 4 actually viewed, right? 5 is that true? 6 A. 7 had to log into the website with the user name and password. 8 Then they had to go down to one of the various sub-forums of 9 the Web; for example, Preteen Girls Videos Hard Core. And, as I understand it, the NIT went out when you would The NIT went out when the link went; So generally, in order for the NIT to be utilized, a user After 10 they were in that sub-forum, they would have to open one of the 11 postings in that forum that was advertising child pornography, 12 and that's the point where the NIT would have been downloaded 13 to their computer. 14 Q. 15 right? 16 A. Once on that thread, they can get to the actual content, In some cases -- 17 THE COURT: 18 MR. WILKINS: We're beyond. Yes. 19 Q. But at that point, you could have substituted adult porn; 20 the NIT is already gone? 21 A. 22 people off within minutes that there had been a law enforcement 23 takeover. Again, substituting adult pornography would have tipped 24 THE COURT: Let's go. 25 opportunity -- do you have -- I need to give an 63 1 MR. TOBIN: 2 MR. WATKINS: A few questions, your Honor. May I just a couple more questions here, 3 your Honor? 4 Q. 5 a day? 6 A. Yes. 7 Q. And that was by live agents in Maryland? 8 A. Yes. 9 Q. In the office that you were? 10 A. Yes. 11 Q. And, nevertheless, you can't say with any kind of 12 certainty how much child porn was downloaded or uploaded during 13 that period of time; is that true? 14 A. 15 in response to discovery requests. 16 question, I can answer it in more detail. 17 Q. 18 government can't say for sure because there was so much going 19 on, right? 20 A. As part of the monitoring, the site was monitored 24 hours We have provided statistics that we have available to us But they are estimates, right? In prior assertions, the There again, I would -- 21 22 If you have a specific THE COURT: Actually, are you referring to the 67,000 links, or is there another number out there? 23 THE WITNESS: 24 Honor. 25 Q. I'm not sure what we're discussing, your So one can click on a link, right, and then one can 64 1 download the child pornography, right? 2 A. 3 downloading child pornography? 4 navigate the website is one thing. 5 pornography is another. 6 questions accurately. 7 Q. 8 up on the screen. 9 as a separate step, right? So are you distinguishing between clicking a link and Sure. Because clicking on links to Clicking on links to child I want to make sure I'm answering the So you click on the child pornography and it comes Well, no. One can then download it to one's computer 10 A. If it's on your screen, it's already been 11 downloaded to your computer. 12 Q. 13 your actual computer? Sure, in cache, right? 14 THE COURT: 15 MR. WATKINS: It does not necessarily save to In what? Cache, c-a-c-h-e. 16 A. If it's on your computer screen, it's stored on your 17 computer. 18 on your screen, you've downloaded child porn. 19 Q. 20 much or even really an estimate of how many times that 21 happened? 22 A. 23 number of links that were clicked to external content. 24 Q. 25 hundred thousand users during that two-week period? It may be stored in different folders, but if it's Right. And the government has no way to tell exactly how I believe we provided in response to a discovery order the And you've also provided here today that there were a 65 1 A. 2 accessed the website during that time frame. 3 Q. 4 photographs and they popped up on the screen, that would be a 5 million pictures? 6 A. A hundred thousand times ten is a million, yes. 7 Q. And if they did a hundred while they were on there, then 8 we're up to ten million? 9 A. That math is also accurate. 10 Q. So indeed that could be the amount of child porn that was 11 distributed during the period of time? 12 Approximately a hundred thousand unique user accounts So if each one of those active users clicked on ten MR. TOBIN: Objection. 13 A. There is no basis for that statement. 14 Q. It could have been, I think you just told us, right? 15 16 17 MR. TOBIN: That's speculation. thousand; it could have been five. THE COURT: Sustained. It could have been a I mean, we don't know. I'm just trying to understand. 18 So there are 67,000 external links, but what is that number? 19 Is that the number of times clicked on an external link during 20 that two-week period? 21 THE WITNESS: I -- sorry, now I'm confusing the 22 various numbers. 23 believe it was 67,000 external links that were clicked on. 24 believe that's what the document said. 25 I'd have to look at the document again, but I THE COURT: All right, and during the two weeks? I 66 1 THE WITNESS: 2 THE COURT: 3 Yes, your Honor. And, to your knowledge, was most of that child porn? 4 THE WITNESS: Yes, your Honor. 5 THE COURT: Okay, thank you. 6 MR. TOBIN: Very briefly. 7 REDIRECT EXAMINATION BY MR. TOBIN: 8 Q. 9 this opportunity was incredibly rare. Mr. Tobin? During your cross-examination, you have indicated that What did you mean by 10 that? 11 A. 12 and pleadings, existed on the Tor network. 13 configure a website on the Tor network, it's called a hidden 14 service. 15 properly, it's very difficult or impossible to find both it and 16 its users. 17 advertisement of child pornography that have been around for 18 years. 19 generally do about them. 20 content, we can review the content, but we can't find the 21 creators or the users. 22 So the Playpen website, as described in various affidavits When you create and And so if you configure a Tor hidden service There are in fact hidden services dedicated to the We know about them, but there's nothing we can We can log on, we can look at the And so given the minor mistakes that Mr. Chase had 23 made in his creation of the Playpen website, it presented us 24 with an opportunity where we could both identify and arrest the 25 creator of the website, identify and arrest members of the 67 1 website, and rescue numerous victims from abuse. That's what I 2 stated was a rare opportunity. 3 Q. 4 the 67,000 links, or at least many thousands went out to your 5 external websites, meaning that they used the website, they 6 used Playpen almost as a -- they clicked on something, and they 7 were transported to a different child porn website to see a 8 specific image or images? 9 A. You indicated, as the Judge I think just went over again, Not necessarily a child porn website. So websites like 10 Playpen generally have lists of approved image and file 11 hosters. 12 United States, and they generally do not respond to law 13 enforcement inquiries. 14 will say: 15 pornography, the process generally is upload your images or 16 videos to this -- I'll throw out this website in Japan. 17 sure you name the file something like innocuous like Sailboat. 18 Make sure that the password is good. 19 hoster in Japan, they don't actually know that they're hosting 20 child pornography, and generally the only people who will know 21 how to access and download it are the members of the Playpen 22 website. 23 Q. 24 were images that folks using Playpen got to, images of child 25 pornography they got to after starting at Playpen that were These are the websites that are generally not in the And so the creators of these websites Hey, if you want to upload images or videos of child Make That way, that file But just so it's clear, at least so I understand, there 68 1 being hosted or that were residing or they were on other 2 websites? 3 A. Yes. 4 Q. And if you had shut down Playpen, abolished it entirely, 5 those other websites would not have been affected? 6 accurate? 7 A. That's correct. 8 Q. Those pictures of children would have still been on the 9 Internet? Is that the Those images and videos would -- 10 A. Yes. 11 Q. Now, when Playpen was up and running, either without the 12 government's active involvement or with the government's active 13 involvement, as we've discussed now at some length, were there 14 other child pornography websites? 15 A. Yes. 16 Q. As we speak today, are there numerous -- 17 THE COURT: Yes, I know this, Mr. Tobin. 18 MR. TOBIN: Huh? 19 okay. 20 Q. 21 22 23 General knowledge? Okay, all right, But this wasn't the only show in town? THE COURT: You say there were 67,000 links external. Was there some on the website itself? THE WITNESS: So the actual website itself was not 24 hosting the images, but there was a separate website called the 25 Playpen Image and File Uploader that were parts of the website, 69 1 but they were technically their own websites. 2 images, I believe, yes, some of the images -- 3 THE COURT: 4 THE WITNESS: 5 THE COURT: 6 So some were on the Playpen system? Yes, your Honor. But 67,000 of them were in foreign countries or elsewhere? 7 THE WITNESS: Is that correct? I believe the 67,000 number may 8 encompass all of the content. 9 THE COURT: 10 So some of it was in-house and some of it was external? 11 THE WITNESS: 12 THE COURT: 13 before. Yes, your Honor. Okay, I just didn't get that distinction All right, anything else, Mr. Watkins? 14 MR. WATKINS: 15 MR. TOBIN: Nothing for me. 16 THE COURT: Thank you. 17 THE WITNESS: 18 (Witness excused.) 19 THE COURT: Okay, so anything else? 20 MR. TOBIN: No, your Honor. 21 THE COURT: Anything from your end? 22 MR. WATKINS: 23 So for those No, your Honor. You may step down. Thank you, your Honor. Your Honor, I did file the motion to compel discovery. 24 THE COURT: 25 MR. WATKINS: Yes, yesterday. Well, just to be clear that the Court 70 1 scheduled the evidentiary hearing late last week. 2 with Mr. Tobin some of these items. 3 requested, some of them, at least, in the past. 4 discovery letter to Mr. Tobin to make sure -- 5 6 THE COURT: I discussed These are things that are I sent the I'm just saying, I just got the motion to compel yesterday. 7 MR. WATKINS: Okay. And just to finish through, I 8 told Mr. Tobin that time was of the essence. We're both very 9 busy, and he was not able to give me his definitive answer to 10 them till yesterday. Probably 20 minutes after he gave me the 11 answer, I filed the motion, so that is why it is here at this 12 time. 13 evidence that we have heard today or the testimony that we've 14 heard. But, still, I would press the items, given the kinds of 15 THE COURT: I am not prepared to deal with it. I'm 16 likely to refer this to the United States Magistrate Judge, or 17 at the very least want to see an opposition, but let's just 18 have oral argument right now. 19 20 MR. WATKINS: Judge, I mean, I think the items I requested are relevant to what -- 21 THE COURT: I don't want to have another oral 22 argument. I mean, if something comes in that's newly 23 discovered and you want to argue later, we'll deal with it, 24 but, I mean, I've now dragged this out for a while. 25 you my initial instinct that based on what I had before, it And I told 71 1 wasn't enough. However, you then added an additional fact. 2 MR. WATKINS: 3 THE COURT: Right. Which is, well, they pumped up the numbers 4 essentially. 5 different. 6 turns out not to be the case. 7 else that you see changes your mind and it's newly discovered, 8 but I haven't seen it. 9 And so I agreed to sort of hear that. It is And so that, at least based on what I'm hearing, MR. WATKINS: It's possible that something What's newly discovered is the testimony 10 we heard today about the deep involvement of Main Justice in 11 the decision to run the website, and also the lack of any kind 12 of controls and mitigation for distributing child pornography. 13 We don't know -- to the extent outrageous governmental conduct 14 depends on what shocks the conscience, what we're talking about 15 is a very, very reasoned, up-the-chain apparently decision -- I 16 don't know about reasoned but -- 17 THE COURT: I was thinking that cuts the other way. 18 It wasn't a rogue agent. It was something done in a purposeful 19 way. 20 the way I'm thinking, all right, is, the mere fact that they 21 ran it was not enough for me. 22 might have been concerned if they pumped up the numbers. 23 apparently hasn't happened. 24 encouraging production by posting new stuff? 25 happened. In other words, it wasn't some renegade here. I guess I told you that already. I That I think I was worried, were they That hasn't You could have argued -- I actually learned 72 1 something here today. 2 It was actually not just two weeks. 3 January. 4 they should have done it sooner. 5 outrageous. 6 It was actually longer than I thought. There was another month in You could argue that they shouldn't have done it; But that's not shocking and That's just a law enforcement decision. And the thing that really has got me going is saving 7 all these kids. Two of them were people who had pornography 8 posted, but the rest were just, I guess, the correlation 9 between possession and touching. They saved a bunch of kids. 10 I mean, I'm not -- I get your point, some of this, maybe they 11 could have done it quicker, or maybe there should have been a 12 protocol and there wasn't one. 13 outrageous, not when we've now done the case research on what's 14 counted as outrageous. 15 I'm just not seeing it as So at this point I'm denying it, and if new stuff 16 comes in that changes something and you want to move for it, 17 let me know, but I need to move this case forward to trial. 18 There may be something that you produce that's -- I'm not 19 closing down discovery on it. 20 of trial. 21 MR. WATKINS: I need to get this to the point Before we move to that stage, your 22 Honor, if I can make just a couple of points. One is, given 23 the testimony that there are 49 hands-on offenders that were 24 discovered, if the government can provide the names of the 25 prosecutions of those cases. I have no reason to believe or 73 1 disbelieve that there were 49 people discovered with hands-on 2 offenses. 3 THE COURT: As long as it's not confidential in an 4 ongoing investigation, and under a protective order, and not 5 mentioning the children's names. 6 there's a public prosecution, open complaint. 7 8 9 10 MR. TOBIN: That's protected. So if And I don't know specifically this. I'd be shocked if there are 49 prosecutions. THE COURT: There may not be. Whatever is public, not a private investigation. 11 MR. TOBIN: Sure. 12 THE COURT: And so what am I doing in terms of -- 13 MR. WATKINS: Just if the Court will indulge me, I 14 would like to orally move and follow up with a written motion 15 to reconsider the Court's decision on the Rule 41 motion. 16 We've now learned today that it was not just two agents and an 17 AUSA down in Eastern Virginia doing that stuff. 18 very calculated decision that went up to the highest levels of 19 the Department of Justice. 20 of good faith at this point on those local officers in either 21 getting the affidavit or executing it once they have it, I 22 think that's brought severely into doubt today, where you've 23 got the same Department of Justice asking to get this warrant 24 in the Eastern District of Virginia at the same time that they 25 are trying to get the Supreme Court to amend Rule 41. This was a To suggest that there's some kind I think 74 1 it undercuts the good-faith argument, which is what the court 2 decided a matter on. 3 allow me to supplement with a motion to reconsider. 4 5 6 7 MR. TOBIN: And, your Honor, I would object to that. THE COURT: Enough already. I mean -Denied. All right, now let me just -- when are we going to go to trial? 8 MR. TOBIN: 9 MR. WATKINS: 10 So I'm asking the Court orally today and Soon. Well, that would be nice, but what we are now in is the middle of the forensic review of the -- 11 THE COURT: 12 MR. WATKINS: That's what I'm asking you, when? Right, exactly. So we are about perhaps 13 a third of the way through there. 14 to get materials that I've been asking for for close to nine or 15 ten months. 16 THE COURT: 17 MR. WATKINS: 18 THE COURT: 19 Mr. Tobin was finally able Give me a date. For a trial? Fine. I would say February. Speedy Trial excluded, fine. We'll give you a pretrial order. 20 THE CLERK: I'll give you a pretrial order. 21 THE COURT: By the way, I have two questions that I 22 want to know. 23 NIT case law that's already evolving. 24 circuit yet? 25 Is any of this stuff -- I was fascinated by the MR. TOBIN: Has any of it hit a I don't believe so. There's been no 75 1 circuit decisions. 2 3 THE COURT: So that may actually make a difference, if either our circuit in reviewing Judge Young -- 4 MR. TOBIN: Judge, we are pursuing the appeal. 5 Obviously, there have not been arguments. 6 briefs have even been submitted by the government as of yet, 7 but that's being pursued. 8 arguments in any circuit on the actual issue. 9 10 MR. WATKINS: I don't even think I don't believe there's been any So the Solicitor General has okayed the appeal in Levin? 11 MR. TOBIN: Oh, gosh. We are pursuing an appeal. 12 don't want to say any more than that. 13 if I start talking about internal negotiations. 14 15 THE COURT: I I always get in trouble The local office wants to, but you don't know if the SG has signed off yet? 16 MR. TOBIN: I -- I'm not even saying that. I'm saying 17 my office is pursuing an appeal. 18 available for public consumption as to the AG or the Solicitor, 19 I don't know. 20 THE COURT: Okay. It's an alive issue. What's Well, let me put it this way: I am 21 going to schedule for February, and the reason I want to do 22 this is, this isn't my first rodeo, and these forensic exams 23 take -- 24 MR. TOBIN: A long time. 25 THE COURT: -- a long time. I know that. They're 76 1 expensive. 2 giving you some leeway here. 3 MR. TOBIN: 4 I know they take a long time, so that's why I'm Do you have a forensic examiner? Well, yes, we have a case agent. I might bring somebody else in if we're actually going to trial. 5 THE COURT: Someone I would consider an expert? 6 MR. TOBIN: Well, I suspect, yes. 7 THE COURT: All right, because you're going to both 8 have to exchange expert reports, so when you do the pretrial 9 order, you need to build that in because you may want to 10 challenge each other, or at least have the time to -- I mean, 11 it's complicated stuff -- to understand it. 12 give you a pretrial order, but, more importantly, what date do 13 you want in February? 14 February, so what -- So we're going to We actually are starting to clog up in 15 (Discussion between the Court and Clerk.) 16 THE COURT: Why don't we give you February 6? On 17 February 6, I'm just simply saying that there's another case 18 there that may or may not plead, but basically I've got the 19 whole month open, so -- 20 MR. WATKINS: 21 THE COURT: 22 The other question I have is, has anyone ruled on the 23 24 25 That's fine. Okay? February 6. outrageous conduct thing? MR. TOBIN: Well, I don't know if there's been rulings -- no, yes, of course, in our very own courthouse, 77 1 Judge Burroughs denied that motion. 2 THE COURT: I did see that, but have there been any -- 3 MR. TOBIN: There have been no allowances of it 4 anywhere in the country. 5 THE COURT: Anywhere in the country? 6 MR. TOBIN: No. 7 MR. WATKINS: 8 THE CLERK: Pretrial two weeks in advance? 9 THE COURT: Two weeks in advance, yes. 10 THE CLERK: So we can do a pretrial, if you're 11 Not that I'm aware of. available, January 26, January 26 at 2:00 o'clock? 12 MR. TOBIN: That's fine. 13 MR. WATKINS: 14 THE COURT: 15 any other circuit, an appeal? 16 MR. TOBIN: Very good. Thank you. And, to your knowledge, is it pending in This issue? I don't know. I don't know 17 if it's been brought up. 18 district judge has dismissed the case for outrageous government 19 misconduct. 20 couldn't be, right, because they don't know -- 21 I know that it's my belief that no Whether or not it -- no, it couldn't be, it THE COURT: Anyway, it's a more interesting question 22 than the NIT thing because it's all this interesting corner of 23 the law. 24 25 MR. TOBIN: It's been making its way through various appellate courts, as I understand. 78 1 THE COURT: 2 MR. WATKINS: It is. I understand that the Tenth Circuit is 3 close to taking a case or two cases. The cases would be 4 Arterbury, and there's a second one whose name I can't 5 remember. 6 THE COURT: That will be interesting to follow. 7 MR. TOBIN: Very much so, fascinating. 8 THE COURT: And do you envision a likely trial here? 9 MR. TOBIN: I don't have any say in that, Judge. 10 MR. WATKINS: 11 THE COURT: 12 It's difficult to tell at this point. A lot of these kinds of cases hinge on the legal issues, so I'll plan on it. 13 MR. TOBIN: Well, I mean, as the Court knows as well, 14 you know, as we all do, it is very, very rare for a child 15 pornography case to go to trial, but that doesn't mean this one 16 won't. 17 18 THE COURT: Well, there are some very important cutting-edge legal issues here, so -- 19 MR. TOBIN: Exactly, exactly. 20 THE COURT: Okay, all right, thank you. I'm going to 21 count on it as a real trial, but you will be second to my other 22 trial, so keep calling us as it goes along, all right? 23 MR. TOBIN: 24 (Adjourned, 12:05 p.m.) 25 Thank you, Judge. 79 1 C E R T I F I C A T E 2 3 4 UNITED STATES DISTRICT COURT ) DISTRICT OF MASSACHUSETTS ) ss. CITY OF BOSTON ) 5 6 7 I, Lee A. Marzilli, Official Federal Court Reporter, 8 do hereby certify that the foregoing transcript, Pages 1 9 through 78 inclusive, was recorded by me stenographically at 10 the time and place aforesaid in Criminal No. 15-10347-PBS, 11 United States of America v. Vincent C. Anzalone, and thereafter 12 by me reduced to typewriting and is a true and accurate record 13 of the proceedings. 14 Dated this 16th day of October, 2016. 15 16 17 18 19 20 21 22 23 24 25 /s/ Lee A. Marzilli __________________________________ LEE A. MARZILLI, CRR OFFICIAL COURT REPORTER