United States v. Gabriel Werdene

PRECEDENTIAL

UNITED STATES COURT OF APPEALS
FOR THE THIRD CIRCUIT
_____________

No. 16-3588
_____________

UNITED STATES OF AMERICA

v.

GABRIEL WERDENE,

Appellant
______________

APPEAL FROM THE UNITED STATES DISTRICT
COURT
FOR THE EASTERN DISTRICT OF PENNSYLVANIA
(D.C. Crim. Action No. 2-15-cr-00434-001)
District Judge: Honorable Gerald J. Pappert
______________

Argued on October 23, 2017
______________

Before: GREENAWAY, JR., NYGAARD, FISHER, Circuit
Judges.

(Opinion Filed: February 21, 2018)
Leigh M. Skipper
Brett G. Sweitzer [Argued]
Office of the Federal Public Defender
601 Walnut Street
Suite 540 West
Philadelphia, PA 19106
Counsel for Appellant

Louis D. Lappen
Robert A. Zauzmer
Michelle L. Morgan [Argued]
Office of United States Attorney
615 Chestnut Street
Suite 1250
Philadelphia, PA 19106
Counsel for Appellee

______________

OPINION
______________

GREENAWAY, JR., Circuit Judge.

This case arises from the Federal Bureau of
Investigation’s (FBI) investigation into Playpen, a global
online forum that existed on the dark web1 and that was

1
“The dark web is a private global computer network
that enables users to conduct anonymous transactions without
revealing any trace of their location.” Ahmed
Ghappour, Searching Places Unknown: Law Enforcement

2
dedicated to the advertisement and distribution of child
pornography. The website had a substantial amount of users.
In fact, more than 150,000 users collectively engaged in over
95,000 posts with over 9,000 forum topics related to child
pornography. This appeal centers on the FBI’s decision to rely
on a single search warrant, issued in the Eastern District of
Virginia (“EDVA”), to search the computers of thousands of
Playpen users across the United States and the world using a
form of government-created malware termed a “Network
Investigative Technique” (“NIT”).

Appellant Gabriel Werdene, a citizen of Pennsylvania,
was a Playpen user whose computer was compromised by the
NIT. Subsequently, he was charged in the Eastern District of
Pennsylvania (“EDPA”) with one count of possessing child
pornography, in violation of 18 U.S.C. § 2252(a)(4)(B). He
filed a motion to suppress the evidence seized during the search
of his computer, including the information revealed by the use
of the NIT. The District Court denied the suppression motion,
holding that the NIT warrant violated the version of Fed. R.
Crim. P. 41(b) then in effect (“Rule 41(b)”)2, but that the NIT

Jurisdiction on the Dark Web, 69 STAN. L. REV. 1075, 1087
(2017).
2
The NIT warrant was issued on February 20, 2015. On
December 1, 2016, Rule 41(b) was amended to authorize
magistrate judges to issue warrants to search computers and
seize or copy electronically stored information located outside
the magistrate judge’s district if the district where the computer
or information is located has been concealed through
technological means. Fed. R. Crim. P. 41(b)(6). That Rule,
which authorizes warrants such as the NIT warrant here, is not
at issue in this appeal, and the references to “Rule 41(b)”

3
itself did not constitute a search under the Fourth Amendment
and that Werdene was not prejudiced by the error. On appeal,
Werdene contends that the District Court erred in holding that
no Fourth Amendment search took place. Further, he argues
that the issuance of the warrant violated his Fourth Amendment
rights because it lacked particularity and was issued in
violation of the jurisdictional requirements set forth in both
Rule 41(b) and the Federal Magistrates Act. The Government
concedes that a Fourth Amendment search occurred, but
contends that the NIT was authorized by Rule 41(b)(4) and
that, in any event, the good-faith exception to the exclusionary
rule precludes suppression.

We hold that the NIT warrant violated the prior version
of Rule 41(b) and that the magistrate judge exceeded her
authority under the Federal Magistrates Act. The warrant was
therefore void ab initio, and the Rule 41(b) infraction rose to
the level of a Fourth Amendment violation. However, we
agree with the Government that the good-faith exception to the
exclusionary rule may apply to warrants that are void ab initio,
which ultimately precludes suppression in this case. We
therefore will affirm on alternative grounds the District Court’s
decision to deny Werdene’s suppression motion.

throughout this opinion thus refer only to the prior version of
the Rule.

4
I. FACTS AND PROCEDURAL HISTORY

To inform our forthcoming analysis, we shall detail how
Playpen escaped traditional law enforcement detection and
how the FBI circumvented the dark web to apprehend its users.

A. Tor

The Playpen site operated on the anonymous “The
Onion Router” (“Tor”) network—a constituent part of the
“dark web”—which allows users to conceal their actual
internet protocol (“IP”) addresses while accessing the internet.3
An IP address is a unique identifier assigned by an internet
service provider to every computer having access to the
internet, including computer servers that host websites.
Websites that the computer user visits can log the computer’s
IP address, creating a digital record of activity on each website.
After lawful seizure of an illicit website under normal
circumstances, law enforcement is able to retrieve the
website’s IP log to locate and apprehend its users.

Tor, however, prevents websites from registering a
computer’s actual IP address by sending user communications
through a network of relay computers called “nodes” up until
those communications reach the website. Numerous

3
Tor was developed by the U.S. Naval research
Laboratory, and is now made available to the public at large.
It is used by myriad individuals, groups and institutions
concerned with digital privacy: journalists, military personnel,
lawyers, activists, governments, corporations, and those
engaged in nefarious enterprises.

5
intermediary computers therefore stand between the accessing
computer and the website, and the website can log the IP
address of only the “exit node”, which is the final computer in
the sequence. Accordingly, Playpen’s IP log—like that of
other Tor websites—contained only the IP addresses of the exit
nodes, rendering traditional IP identification techniques
useless.

B. The Playpen Investigation

In December 2014, a foreign law enforcement agency
informed the FBI that Playpen was being hosted by a computer
server in North Carolina. Playpen’s administrator was
identified as a person residing in Florida, who was promptly
arrested.4 The FBI then lawfully seized the server, moved it to
a government facility in EDVA, and obtained a wiretap order
to monitor communications on it. It then assumed
administrative control of Playpen and allowed the website to
operate while law enforcement officials tried to circumvent
Tor and identify Playpen’s users.

The FBI’s solution was the NIT, a form of government-
created malware that allowed the FBI to retrieve identifying
information from Playpen users located all around the world.

4
The Playpen administrator was responsible for, inter
alia, the distribution of child pornography, monitoring the
website’s activity and content, facilitating private messages
between users, instructing users how to evade detection by law
enforcement, and periodically changing the website’s address
to bypass discovery.

6
The NIT’s deployment worked in multiple steps. First, the FBI
modified Playpen’s code so that each accessing computer—
unknowingly to the user and no matter the computer’s physical
location—downloaded the NIT whenever a “user or
administrator log[ged] into [Playpen] by entering a username
and password.” App. 133. Once downloaded, the NIT
searched the accessing computer for seven discrete pieces of
identifying information: (1) an IP address; (2) a unique
identifier to distinguish the data from that of other computers;
(3) the type of operating system; (4) information about whether
the NIT had already been delivered; (5) a Host Name; (6) an
active operating system username; and (7) a Media Access
Control address. Finally, the NIT transmitted this information
back to a government-controlled computer in EDVA. The FBI
postulated that it could then rely on this information to identify
users’ premises and distinguish their computers from other
computers located within their proximity.

In February 2015, the FBI obtained a search warrant
from a magistrate judge in EDVA to deploy the NIT to all
“activating computers.” App. 106. An “activating computer”
was defined in the search warrant as the computer of “any user
or administrator who logs into [Playpen] by entering a
username and password.” Id. Further, the NIT could be
deployed to any activating computer “wherever located.” App.
136 (emphasis added). In other words, this single warrant
authorized the FBI to retrieve identifying information from
computers all across the United States, and from all around the
world. Most importantly, these computers were
overwhelmingly located outside of EDVA.

7
C. Charges Against Werdene and Suppression Motion

Analysis of the NIT data revealed the IP address of a
Playpen user, eventually identified as Werdene, residing in
Bensalem, Pennsylvania. In the final month of the website’s
operation, Werdene was logged in for approximately ten hours
and made six text postings, commenting on child pornography
and sharing links under the username “thepervert.” The FBI
obtained a separate search warrant for Werdene’s home from a
magistrate judge in EDPA, where agents seized one USB drive
and one DVD containing child pornography.5

In September 2015, Werdene was charged in EDPA
with one count of possessing child pornography, in violation
of 18 U.S.C. § 2252(a)(4)(B). He filed a motion to suppress
the evidence seized during the search of his computer,
including the information revealed by the NIT, the evidence
subsequently seized from his home, and statements that he later
made to the FBI. Werdene argued that the warrant was issued
in violation of the jurisdictional requirements set forth in Rule
41(b), and that suppression was required because the violation
was constitutional in nature and the good-faith exception to the
exclusionary rule did not apply. The Government did not
contend that the NIT warrant was explicitly authorized by Rule
41(b), but argued that the rule was flexible and expansive, and

5
Werdene does not contest the lawfulness of this search
warrant issued in EDPA. See Appellant Br. at 15 (“The only
contested issue in this case [is] the lawfulness of the search of
Mr. Werdene’s computer, via the NIT, pursuant to the warrant
issued in the Eastern District of Virginia.”).

8
 included warrants based on technological advances—such as
the NIT warrant—which came within the spirit of the rule.

The District Court denied the motion in a memorandum
and order issued on May 18, 2016. It first held that the NIT
warrant violated Rule 41(b) because the magistrate judge in
EDVA was without authority to issue a warrant to search
Werdene’s computer in EDPA. But the District Court also held
that the NIT was not a “search” within the meaning of the
Fourth Amendment because Werdene lacked a reasonable
expectation of privacy to his computer’s IP address. It
concluded that the Fourth Amendment was not implicated, and
that the Rule 41(b) violation was only “technical” in nature.
The District Court therefore denied the suppression motion on
the bases that the Government did not intentionally disregard
the Rule’s requirements and that Werdene was not prejudiced
by the violation. This appeal followed.

On June 7, 2016, Werdene pled guilty pursuant to a plea
agreement in which he reserved his right to appeal the District
Court’s ruling on the suppression motion. On September 7,
2016, the District Court accepted the recommendation of the
U.S. Probation Office and applied a downward variance from
the United States Federal Sentencing Guideline’s range of 51-
63 months. It sentenced Werdene to 24 months’ imprisonment,
a term of supervised release of five years, and restitution in the
amount of $1,500.

II. JURISDICTION AND STANDARD OF REVIEW

The District Court had original jurisdiction over this
case pursuant to 18 U.S.C. § 3231. Our jurisdiction arises from
28 U.S.C. § 1291. “We review the District Court’s denial of a
motion to suppress for clear error as to the underlying

9
 factual determinations but exercise plenary review over the
District Court’s application of law to those facts.” United
States v. Murray, 821 F.3d 386, 390–91 (3d Cir. 2016) (quoting
United States v. Stabile, 633 F.3d 219, 230 (3d Cir. 2011)).

III. DISCUSSION

This case requires us to decide a multitude of issues
regarding Rule 41 and the Fourth Amendment. First, we must
determine whether the NIT warrant violated Rule 41. If it did
not, then we will affirm the District Court because there is no
basis to grant Werdene’s suppression motion. Second, if it did
violate Rule 41, then we are required to decide whether the
breach rose to the level of a Fourth Amendment violation. To
do so, we consider whether the NIT warrant, by being issued
by a magistrate judge beyond her jurisdiction, was void ab
initio and, if so, whether such a transgression constituted a
Fourth Amendment violation in the founding era. See Virginia
v. Moore, 553 U.S. 164, 168 (2008). If we do not find that a
Fourth Amendment violation occurred, then the suppression
motion must be denied unless Werdene can prove that he was
prejudiced by the error or that the FBI acted with intentional
and deliberate disregard for Rule 41. See United States v.
Martinez-Zayas, 857 F.2d 122, 136 (3d Cir. 1988), overruled
in part on other grounds by United States v. Chapple, 985 F.2d
729 (3d Cir. 1993). Third, if a Fourth Amendment violation
did occur, then we are called upon to decide an issue of first
impression for this Court: whether the good-faith exception to
the exclusionary rule applies when a warrant is void ab initio.
If it does not, then we apply the exclusionary rule without
consideration of the good-faith exception. Fourth, if the good-
faith exception does apply, then we must determine if it
precludes suppression in this case.

10
 For the reasons discussed below, we hold that the NIT
warrant violated Rule 41(b). As a result, the magistrate judge
not only exceeded her authority under the Rule as then drafted,
but also under the Federal Magistrates Act, rendering the
warrant void ab initio and raising the magnitude of the
infraction from a technical one to a Fourth Amendment
violation. On the other hand, we also hold that the good-faith
exception applies to such warrants, which, given the
circumstances of this case, precludes suppression. We
therefore will affirm on alternative grounds the District Court’s
decision to deny Werdene’s suppression motion.

A. Federal Magistrate Judge Jurisdiction

The Federal Magistrates Act, 28 U.S.C. § 636(a),
authorizes federal magistrate judges to exercise the “powers
and duties conferred . . . by the Rules of Criminal Procedure”
in three geographic areas: “[1] within the district in which
sessions are held by the court that appointed the magistrate
judge, [2] at other places where that court may function, and
[3] elsewhere as authorized by law.” § 636(a); see also United
States v. Krueger, 809 F.3d 1109, 1118 (10th Cir. 2015)
(Gorsuch, J., concurring). Accordingly, § 636(a) creates
“jurisdictional limitations on the power of magistrate judges”
because it “expressly and independently limits where those
powers will be effective.” Krueger, 809 F.3d at 1119
(Gorsuch, J., concurring); see also United States v. Hazlewood,
526 F.3d 862, 864 (5th Cir. 2008) (“In the Federal Magistrates
Act, 28 U.S.C. § 636, Congress conferred jurisdiction to
federal magistrate-judge[s]”); N.L.R.B. v. A-Plus Roofing, Inc.,
39 F.3d 1410, 1415 (9th Cir. 1994) (“[F]ederal magistrates are
creatures of [§ 636(a)], and so is their jurisdiction.”); Gov’t of
Virgin Islands v. Williams, 892 F.2d 305, 309 (3d Cr. 1989)

11
(“The jurisdiction of federal magistrates is defined by the
Federal Magistrates Act.”).

While § 636(a) defines the geographic scope of a
magistrate judge’s powers, the Rules of Criminal Procedure—
including Rule 41(b)—define what those powers are. See
§ 636(a)(1); see also Krueger, 809 F.3d at 1119 (Gorsuch, J.,
concurring). Rule 41(b) provides that a magistrate judge may
“issue a warrant to search for and seize a person or property
located within the district.” Fed. R. Crim. P. 41(b)(1). At the
time that the NIT warrant was issued, the Rule also authorized
four exceptions to this territorial restriction: (1) for property
that might be moved outside the district before the warrant is
executed, Fed. R. Crim. P. 41(b)(2); (2) for terrorism
investigations, Fed. R. Crim. P. 41(b)(3); (3) to install a
tracking device within the magistrate judge’s district that may
track the movement of property outside that district, Fed. R.
Crim. P. 41(b)(4); and (4) to search and seize property located
outside any district but within the jurisdiction of the United
States, Fed. R. Crim. P. 41(b)(5). Notably, “[n]one of these
[Rule 41(b)] exceptions expressly allow a magistrate judge in
one jurisdiction to authorize the search of a computer in a
different jurisdiction.” United States v. Horton, 863 F.3d 1041,
1047 (8th Cir. 2017).

B. The NIT Warrant Violated Rule 41(b)

We must first determine whether the NIT warrant
violated Rule 41(b). The Government conceded below that
“[a]lthough Rule 41 does authorize a judge to issue a search
warrant for a search in another district in some circumstances,
it does not explicitly do so in these circumstances.” App. 91
(Government Br. in Opposition to Motion to Suppress)
(emphasis added). Given the concession, the Government

12
instead argued that the Rule set forth an illustrative, rather than
exhaustive, list of circumstances in which a magistrate judge
may issue a warrant.

On appeal, however, the Government curiously has
reversed course, and now contends that the NIT was in fact
explicitly authorized by Rule 41(b)(4), which provides that a
magistrate judge may “issue a warrant to install within the
district a tracking device; the warrant may authorize use of the
device to track the movement of a person or property located
within the district, outside the district, or both.” Fed. R. Crim.
P. 41(b)(4) (emphasis added).

According to the Government, under this Rule, “the
NIT warrant properly authorized use of the NIT to track the
movement of information—the digital child pornography
content requested by users who logged into Playpen’s
website—as it traveled from the server in [EDVA] through the
encrypted Tor network to its final destination: the users’
computers, wherever located.” Government Br. at 30. At that
point, the NIT caused the Playpen users’ computers to transmit
the identifying information back to the FBI over the open
internet, thus enabling law enforcement to locate and identify
the user. In the Government’s estimation, the NIT is similar to
a transmitter affixed to an automobile that is programmed to
send location-enabling signals (like GPS coordinates) back to
a government-controlled receiver because it was designed to
send location-enabling information (like an actual IP address)
back to a government-controlled computer. “Thus, although
not a physical beeper affixed to a tangible object [as was the
case in, for example, United States v. Karo, 468 U.S. 705
(1984)], the NIT operated as a digital tracking device of
intangible information within the meaning of Rule 41(b)(4).”
Id. at 32.

13
 We need not resolve Werdene’s contention that the
Government waived this argument because we find that the
Government’s tracking device analogy is inapposite. As an
initial matter, it is clear that the FBI did not believe that the
NIT was a tracking device at the time that it sought the warrant.
Warrants issued under Rule 41(b)(4) are specialized
documents that are denominated “Tracking Warrant” and
require the Government to submit a specialized “Application
for a Tracking Warrant.” See ADMINISTRATIVE OFFICE OF U.S.
COURTS, CRIMINAL FORMS AO 102 (2009) & AO 104 (2016).
Here, the FBI did not submit an application for a tracking
warrant – rather, it applied for, and received, a standard search
warrant. Indeed, the term “tracking device” is absent from the
NIT warrant application and supporting affidavit.

More importantly, the analogy does not withstand
scrutiny. The explicit purpose of the warrant was not to track
movement—as would be required under Rule 41(b)(4)—but to
“obtain[] information” from “activating computers.” App.
106. As discussed above, the NIT was designed to search—
not track—the user’s computer for the IP address and other
identifying information, and to transmit that data back to a
government-controlled server. Although the seized
information (mainly the IP address) assisted the FBI in
identifying a user, it provided no information as to the
computer’s or user’s precise and contemporary physical
location. This fact—that the NIT did not track movement—is
dispositive, because Rule 41(b)(4) is “based on the
understanding that the device will assist officers only in
tracking the movements of a person or object.” Fed. R. Crim.
P. 41 Advisory Committee’s Note (2006) (emphasis added);
see also Fed. R. Crim. P. 41(a)(2)(E) (incorporating the
definition of “tracking device” from 18 U.S.C. § 3117(b),

14
which is “an electronic or mechanical device which permits the
tracking of the movement of a person or object.” 18 U.S.C. §
3117(b) (emphasis added)). The NIT, by not
contemporaneously transmitting the location of the computers
that it searched, was therefore unlike the quintessential
tracking device that the Government used in United v. Jones,
which “track[ed] the vehicle’s movements . . . [b]y means of
signals from multiple satellites, the device established the
vehicle’s location within 50 to 100 feet, and communicated
that location by cellular phone to a Government computer.”
565 U.S. 400, 403 (2012) (emphasis added).

Furthermore, Rule 41(b)(4) requires that a tracker be
“install[ed] within the district.” Fed. R. Crim. P. 41(b)(4). It
is difficult to imagine a scenario where the NIT was “installed”
on Werdene’s computer—which was physically located in
Pennsylvania—in EDVA. The Eighth Circuit, which is the
only other Court of Appeals to address the Government’s Rule
41(b)(4) argument to date, rejected it on this basis:

The government argues that the defendants made
a “virtual” trip to the Eastern District of Virginia
to access child pornography and that
investigators “installed” the NIT within that
district. Although plausible, this argument is
belied by how the NIT actually worked: it was
installed on the defendants’ computers in their
homes in Iowa. . . . [W]e agree with the district
court that the “virtual trip” fiction “stretches the
rule too far.”

Horton, 863 F.3d at 1047-48 (citations omitted).

15
 The Government correctly contends that Rule 41 should
be read flexibly “to include within its scope electronic
intrusions authorized upon a finding of probable cause” so that
it can keep up with technological innovations. United States v.
New York Tel. Co., 434 U.S. 159, 169 (1977). However, as the
District Court aptly stated, “[e]ven a flexible application of the
Rule . . . is insufficient to allow the Court to read into it powers
possessed by the magistrate that are clearly not contemplated
and do not fit into any of the five subsections.” United States
v. Werdene, 188 F. Supp. 3d 431, 441 (E.D. Pa. 2016). For the
aforementioned reasons, the NIT was not a “tracking device”
under Rule 41(b)(4), and therefore the warrant violated the
Rule.6

C. The NIT Warrant Violated the Fourth Amendment

Since the NIT warrant violated Rule 41(b), we next
consider the nature of the violation to assess if suppression is
warranted. See United States v. Simons, 206 F.3d 392, 403 (4th
Cir. 2000) (“There are two categories of Rule 41 violations:
those involving constitutional violations, and all others.”). If
the violation is “constitutional”—i.e., a violation of the Fourth
Amendment—then suppression is governed by the

6
Having found that a Rule 41(b) violation occurred, we
need not reach here Werdene’s argument that the NIT warrant
fails the Fourth Amendment’s particularity requirement,
codified in Fed. R. Crim. P. 41(e)(2)(A). See Horton, 863 F.3d
at 1049 n.4 (“Because we find that the NIT warrant failed to
meet constitutional standards on alternative grounds, we
decline to address [the particularity] issue.”).

16
exclusionary rule standards applicable to Fourth Amendment
violations generally. See Martinez-Zayas, 857 F.2d at 136; see
also United States v. Franz, 772 F.3d 134, 145 (3d Cir. 2014)
(“The exclusionary rule is a prudential doctrine designed to
enforce the Fourth Amendment . . . .”). If, however, the
violation is not of constitutional magnitude, but rather is
“ministerial” or “technical” in nature, then suppression is
warranted only if “(1) there was ‘prejudice’ in the sense that
the search might not have occurred or would not have been so
abrasive if the Rule had been followed, or (2) there is evidence
of intentional and deliberate disregard of a provision in the
Rule.” Martinez-Zayas, 857 F.2d at 136 (quoting United States
v. Burke, 517 F.2d 377, 386-87 (2d Cir. 1975)).

The Fourth Amendment guarantees that:

[t]he right of the people to be secure in their
persons, houses, papers, and effects against
unreasonable searches and seizures, shall not be
violated, and no Warrant shall issue, but upon
probable cause, supported by Oath or
affirmation, and particularly describing the place
to be searched, and the persons or things to be
seized.

U.S. Const. amend. IV.

“[T]he overriding function of the Fourth Amendment is
to protect personal privacy and dignity against unwarranted
intrusion by the State.” Reedy v. Evanson, 615 F.3d 197, 228
(3d Cir. 2010) (quoting Schmerber v. California, 384 U.S. 757,
767 (1966)); see also United States v. Pollard, 326 F.3d 397,
410 (3d Cir. 2003) (“The Fourth Amendment’s ‘central
concern . . . is to protect liberty and privacy from arbitrary and

17
oppressive interference by government officials.’” (quoting
United States v. Ortiz, 422 U.S. 891, 895 (1975))). The Fourth
Amendment only prohibits unreasonable searches and
seizures, and the Supreme Court has counseled that the Fourth
Amendment encompasses “at a minimum, the degree of
protection it afforded when it was adopted.” Jones, 565 U.S.
at 411. Accordingly, “[w]e look to the statutes and common
law of the founding era to determine the norms that the Fourth
Amendment was meant to preserve.” Moore, 553 U.S. at 168;
see also United States v. Phillips, 834 F.3d 1176, 1179 (11th
Cir. 2016).

We must therefore determine whether the
circumstances of this case constituted a Fourth Amendment
violation during the founding era.7 “The principle animating

7
The District Court wrongly concluded that the Rule
41(b) violation did not violate the Fourth Amendment because
Werdene had no reasonable expectation of privacy in his IP
address, and accordingly, that the NIT did not conduct a
“search” within the meaning of the Fourth Amendment. Both
parties agree that this was error, and the Government explicitly
disavows this portion of the District Court’s ruling. The NIT
obtained the IP address and other identifying information from
Werdene’s home computer and not from a third party, and
Werdene had a reasonable expectation of privacy in his home
computer. See, e.g., United States v. Lifshitz, 369 F.3d 173,
190 (2d Cir. 2004) (“Individuals generally possess a reasonable
expectation of privacy in their home computers.”); Guest v.
Leis, 255 F.3d 325, 333 (6th Cir. 2001) (“Home owners would
of course have a reasonable expectation of privacy in their
homes and in their belongings—including computers—inside

18
the common law at the time of the Fourth Amendment’s
framing was clear: a warrant may travel only so far as the
power of its issuing official.” Krueger, 809 F.3d at 1124
(Gorsuch, J., concurring). The NIT warrant clearly violated
this precept. The magistrate judge not only exceeded the
territorial scope of Rule 41(b), but, as a result of that violation,
she also exceeded the jurisdiction that § 636(a) imposes on
magistrate judges. Under § 636(a), the magistrate judge was
only authorized to exercise the powers of Rule 41(b) under
three circumstances: (1) “within the district” that appointed her
– i.e., EDVA, (2) “at other places where [EDVA] may
function”, and (3) “elsewhere as authorized by law.” § 636(a).
Pennsylvania obviously does not fall within the confines of
EDVA or its places of function, and we have already held that
Rule 41(b) did not authorize the NIT warrant.

The NIT warrant was therefore void ab initio because it
violated § 636(a)’s jurisdictional limitations and was not
authorized by any positive law.8 See United States v. Master,
614 F.3d 236, 239 (6th Cir. 2010) (“[W]hen a warrant is signed
by someone who lacks the legal authority necessary to issue
search warrants, the warrant is void ab initio.” (quoting United
States v. Scott, 260 F.3d 512, 515 (6th Cir. 2001)); see also
Horton, 863 F.3d at 1049 (“[T]he NIT warrant was void ab
initio . . . .”); United States v. Baker, 894 F.2d 1144, 1147 (10th

the home.”). The deployment of the NIT therefore constituted
a “search” under the Fourth Amendment.
8
As previously noted, the state of authorizing positive
law for NIT searches has since changed with the promulgation
of Rule 41(b)(6). See supra note 2.

19
Cir. 1990) (suppressing evidence of search on Indian land
because state court lacked authority to issue search warrant).

It follows that the Rule 41(b) violation was of
constitutional magnitude because “at the time of the framing .
. . a warrant issued for a search or seizure beyond the territorial
jurisdiction of a magistrate’s powers under positive law was
treated as no warrant at all.” Krueger, 809 F.3d at 1123
(Gorsuch, J., concurring); see also Engleman v. Deputy
Murray, 546 F.3d 944, 948-49 (8th Cir. 2008) (“Under a
historical understanding of the Fourth Amendment, the
jurisdiction of the issuing judge and the executing officer is
limited, and a warrant is not valid if an officer acts outside of
that limited jurisdiction.”).

The Government retorts that the NIT warrant was valid
for the purposes of the Fourth Amendment because it met the
Supreme Court’s three constitutional requirements for validity:
it was “(1) supported by probable cause, (2) sufficiently
particular, and (3) issued by a neutral and detached
magistrate.” Government Br. at 36 (citing Dalia v. United
States, 441 U.S. 238, 255 (1979)). Furthermore, the
Government frames Rule 41(b) as a venue provision that is
entirely procedural in nature and not substantive – accordingly,
because the Fourth Amendment is silent about the proper
venue for applying for a search warrant, a Rule 41(b) violation
can “only rarely [be] deemed constitutional.” Id. at 38. But
none of this overcomes our dispositive finding that the
magistrate judge acted outside of her jurisdiction under §
636(a). As the D.C. Circuit aptly put it, “[e]ven if we assume
that an imperfect authorizing order could be thought facially
sufficient, we do not see how a blatant disregard of a . . .
judge’s jurisdictional limitation can be regarded as only

20
‘technical.’” United States v. Glover, 736 F.3d 509, 515 (D.C.
Cir. 2013).9

D. The Exclusionary Rule and Good Faith Exception

Having established that a Fourth Amendment violation
occurred, we must now address an issue of first impression for
this Court: does the good-faith exception to the exclusionary
rule apply when a warrant is void ab initio due to the magistrate
judge lacking jurisdiction to issue it? We must consider the
purpose of the exclusionary rule to address this inquiry. See
United States v. Wright, 777 F.3d 635, 640 (3d Cir. 2015)
(considering “the extent to which the violation . . . undermined
the purposes of the Fourth Amendment” when applying
exclusionary rule).

The exclusionary rule is a prudential doctrine that
“prevent[s] the government from relying at trial on evidence
obtained in violation of the [Fourth] Amendment’s strictures.”
Franz, 772 F.3d at 145. However, the rule is not intended to
remedy Fourth Amendment violations, and does not
necessarily apply each time a violation occurs. See Herring v.

9
The Government also contends that the NIT warrant
was not void ab initio because it could validly be executed to
search computers within EDVA. We reject this argument – the
fact that Rule 41(b) may have permitted a more limited warrant
confined solely to EDVA has no bearing on the fatal
jurisdictional issues that plagued the actual NIT warrant. See
Horton, 863 F.3d at 1049 (collecting cases) (“The possibility
that the magistrate [judge] could have executed a proper
warrant in the Eastern District of Virginia, however, does not
save this warrant from its jurisdictional error.”).

21
United States, 555 U.S. 135, 140 (2009). Put differently,
“there is no constitutional right to have the evidentiary fruits of
an illegal search or seizure suppressed at trial.” United States
v. Katzin, 769 F.3d 163, 170 (3d Cir. 2014) (en banc); see
United States v. Davis, 564 U.S. 229, 236 (2011) (noting that
the Fourth Amendment “says nothing about suppressing
evidence obtained in violation of [its] command.”); United
States v. Leon, 468 U.S. 897, 906 (1984) (“[T]he use of fruits
of a past unlawful search or seizure ‘work[s] no new Fourth
Amendment wrong.’” (quoting United States v. Calandra, 414
U.S. 338, 354 (1974))).

Rather, the exclusionary rule aims to deter government
violations of the Fourth Amendment. See Krueger, 809 F.3d
at 1125 (Gorsuch, J., concurring) (“Even when an
unreasonable search does exist, the Supreme Court has
explained, we must be persuaded that ‘appreciable deterrence’
of police misconduct can be had before choosing suppression
as the right remedy for a Fourth Amendment violation.”
(quoting Herring, 555 U.S. at 141)); see also Elkins v. United
States, 364 U.S. 206, 217 (1960) (“The [exclusionary] rule is
calculated to prevent, not repair.”). Accordingly, “[i]n
determining whether the exclusionary rule applies, we engage
in a cost-benefit analysis, balancing the ‘deterrence benefits of
suppression’ against its ‘substantial social costs.’” Franz, 772
F.3d at 145 (quoting Davis, 564 U.S. at 236). These costs
“almost always require[] courts to ignore reliable, trustworthy
evidence bearing on guilt or innocence” of the defendant and
“in many cases . . . to suppress the truth and set the criminal
loose in the community without punishment.” Davis, 564 U.S.
229, 237 (2011). As a result, “[s]uppression of evidence . . .
has always been our last resort, not our first impulse.” Hudson
v. Michigan, 547 U.S. 586, 591 (2006).

22
 In Katzin, we explained how the good-faith exception to
the exclusionary rule effectuates this balance:

Where the particular facts of a case indicate that
law enforcement officers act[ed] with an
objectively reasonable good-faith belief that
their conduct [was] lawful, or when their conduct
involve[d] only simple, isolated negligence,
there is no illicit conduct to deter. In such
circumstances, the deterrence rationale loses
much of its force and exclusion cannot pay its
way. Alternatively, where law enforcement
conduct is deliberate, reckless, or grossly
negligent or involves recurring or systemic
negligence, deterrence holds greater value and
often outweighs the associated costs.

769 F.3d at 171 (internal quotation marks and citations
omitted). We also acknowledged that the Supreme Court has
applied the good-faith exception “across a range of cases.” Id.
(quoting Davis, 564 U.S. at 238); see, e.g., Davis, 564 U.S. at
241 (good-faith exception applicable when warrant is invalid
due to later-reversed binding appellate precedent); Herring,
555 U.S. at 147-48 (undiscovered error in police-maintained
database); Arizona v. Evans, 514 U.S. 1, 14-16 (1995)
(undiscovered error in court-maintained database); Illinois v.
Krull, 480 U.S. 340, 349-50 (1987) (subsequently overturned
statute); Massachusetts v. Sheppard, 468 U.S. 981, 980 (1984)
(judicial clerical error on warrant); Leon, 468 U.S. at 922
(later-invalidated warrant).

On appeal, Werdene contends that the good-faith
exception should not apply when a Fourth Amendment
violation arises from a warrant that was void ab initio. He

23
argues that the common theme in all of the Supreme Court’s
good-faith cases is that police reasonably relied on some
positive law that was appropriately issued, even though it was
later invalidated. According to Werdene, each of those
sources—i.e., a warrant, a statute, binding case law, or non-
binding case law—had the force of law, but a warrant that is
void ab initio is different because “[a]ll proceedings of a court
beyond its jurisdiction are void.” Appellant Br. at 49 (quoting
Ex parte Watkins, 28 U.S. 193, 197 (1830)).

However, the fundamental flaw with Werdene’s
argument is that it does not appreciate the distinction between
the validity of the warrant and the deterrence rationale of the
exclusionary rule and the good-faith exception. Implicit in his
argument is the assumption that where “the magistrate lacks
authority to issue the contested warrant, the supposed ‘good
faith’ of the officer who executes the warrant can do nothing
to confer legal status upon the [void] warrant.” Master, 614
F.3d at 242. But “whether to suppress evidence under the
exclusionary rule is a separate question from whether the
Government has violated an individual’s Fourth Amendment
rights.” Katzin, 769 F.3d at 170; see also Master, 614 F.3d at
242 (“[T]he decision to exclude evidence is divorced from
whether a Fourth Amendment violation occurred.”).

Thus, in each of the Supreme Court’s good-faith
exception cases, “the Court has not focused on the type of
Fourth Amendment violation at issue, but rather confined the
‘good-faith inquiry . . . to the objectively ascertainable question
whether a reasonably well trained officer would have known
that the search was illegal’ in light of ‘all of the
circumstances.’” Horton, 863 F.3d at 1051 (quoting Herring,
555 U.S. at 145). We therefore hold that the good-faith
exception applies to warrants that are void ab initio because

24
“the issuing magistrate’s lack of authority has no impact on
police misconduct, if the officers mistakenly, but
inadvertently, presented the warrant to an innocent
magistrate.” Master, 614 F.3d at 242.10

Having determined that the good-faith exception is
applicable, we turn to whether it precludes suppression in this
case. Here, the FBI sought and received a warrant, and we
have identified only four scenarios in which reliance on a
warrant is unreasonable:

(1) the magistrate issued the warrant in
reliance on a deliberately or recklessly false
affidavit;

(2) the magistrate abandoned his judicial role
and failed to perform his neutral and detached
function;

10
The First, Fourth, Eighth, and Tenth Circuits have
each applied the good-faith exception to NIT cases. See United
States v. McLamb, 880 F.3d 685, 689 (4th Cir. 2018) (“[E]ven
if the NIT warrant violates the Fourth Amendment,
the Leon good faith exception precludes suppression of the
evidence.”); United States v. Levin, 874 F.3d 316, 324 (1st Cir.
2017) (“[B]ecause the government acted in good faith reliance
on the NIT warrant . . . suppression is not warranted.”); Horton,
863 F.3d at 1050 (“Our review of relevant Supreme Court
precedent leads us to . . . conclu[de] that the [good-faith]
exception can apply to warrants void ab initio like this one.”);
United States v. Workman, 863 F.3d 1313, 1319-21 (“The
district court did not apply the [good-faith] exception,
mistakenly thinking that it did not apply.”).

25
 (3) the warrant was based on an affidavit so
lacking in indicia of probable cause as to render
official belief in its existence entirely
unreasonable; or

(4) the warrant was so facially deficient that
it failed to particularize the place to be searched
or the things to be seized.

United States v. Pavulak, 700 F.3d 651, 664 (3d Cir. 2012)
(quoting United States v. Stearn, 597 F.3d 540, 561 n.19 (3d
Cir. 2010)). The first three scenarios are entirely inapplicable
here – Werdene contends only that the NIT warrant was
facially deficient because it allegedly did not identify the
location to be searched. But the NIT warrant adequately
described the “Place to be Searched” as the “activating
computers . . . of any user or administrator who logs into
[Playpen] by entering a username and password,” and it
described the “Information to be Seized . . . from any
‘activating’ computer’” as seven discrete pieces of
information. App. 106-07. The warrant was therefore far from
facially deficient because it specified which computers would
be searched and what information would be retrieved. See
United States v. McLamb, 880 F.3d 685, 691 (4th Cir. 2018)
(“Nor was the [NIT] warrant so ‘facially deficient . . . that the
executing officers [could not] reasonably presume it to be
valid.’” (second alteration in original) (quoting Leon, 468 U.S.
at 923)); United States v. Levin, 874 F.3d 316, 323 (1st Cir.
2017) (same).

Here, the NIT warrant was issued by a neutral and
detached, duly appointed magistrate judge, who
determined that the warrant was supported by probable

26
cause and particularly described the places to be searched
and things to be seized. This, on its own, is sufficient for
us to determine that the FBI acted in good-faith, especially
because there is no evidence that it exceeded the scope of
the warrant. See Leon, 468 U.S. at 922 (“‘[A] warrant issued
by a magistrate normally suffices to establish’ that a law
enforcement officer has ‘acted in good faith in conducting the
search.’” (quoting United States v. Ross, 456 U.S. 798, 823,
n.32 (1982))); see also Pavulak, 700 F.3d at 663 (“Ordinarily,
the ‘mere existence of a warrant . . . suffices to prove that an
officer conducted a search in good faith.’” (quoting Stearn, 597
F.3d at 561)).

The Rule 41(b) error, therefore, was committed by the
magistrate judge, not the FBI agents who reasonably relied on
the NIT warrant, and we have repeatedly recognized that
“officer[s] normally should not be penalized for the
magistrate’s mistake.” Doe v. Groody, 361 F.3d 232, 244 (3d
Cir. 2004); see also United States v. $ 92,422.57, 307 F.3d 137,
152 (3d Cir. 2002) (“When a Magistrate Judge has [issued a
warrant], law enforcement officers, who are rarely attorneys,
are entitled to rely on the Magistrate Judge’s judgment”).

More importantly, the exclusionary rule “applies only
where it ‘result[s] in appreciable deterrence.’” Herring, 555
U.S. at 141 (quoting Leon, 468 U.S. at 909) (emphasis added).
Thus, even though Rule 41(b) did not authorize the magistrate
judge to issue the NIT warrant, future law enforcement officers
may apply for and obtain such a warrant pursuant to Rule
41(b)(6), which went into effect in December 2016 to authorize

27
NIT-like warrants.11 Accordingly, a similar Rule 41(b)
violation is unlikely to recur and suppression here will have no
deterrent effect. This is dispositive because when the deterrent

11
The 2016 Fed. R. Crim. P. 41(b) Advisory Note
states:

The amendment provides that in two specific
circumstances a magistrate judge in a district
where activities related to a crime may have
occurred has authority to issue a warrant to use
remote access to search electronic storage media
and seize or copy electronically stored
information even when that media or
information is or may be located outside of the
district.

Fed. R. Crim. P. 41 Advisory Committee’s Note (2016).
Werdene concedes that Rule 41(b)(6) “authorizes warrants
such as the NIT warrant here.” Appellant Br. at 24 n.10.
However, he contends that the Department of Justice originally
sought the amendment on October 18, 2013, almost eighteen
months before the NIT warrant was issued, indicating that the
agency knew that the warrant was not authorized by Rule 41(b)
at the time. Although plausible, the amendment may also
reflect that the drafters of the Federal Rules of Criminal
Procedure did not believe that it was unreasonable for a
magistrate judge to issue a NIT warrant, and that the Rules had
simply failed to keep up with technological changes.
Werdene’s argument, on its own, is insufficient for us to
determine that the FBI did not act in good-faith.

28
value of suppression is diminished, the “deterrence rationale
loses much of its force and exclusion cannot pay its way.”
Katzin, 769 F.3d at 181 (quoting Leon, 468 U.S. at 907 n.6).12

12
Werdene proffers two additional pieces of evidence
to demonstrate that the FBI did not act in good-faith, neither of
which is compelling.

First, he contends that a published decision by the
United States District Court for the Southern District of Texas
in 2013—In re Warrant to Search a Target Computer at
Premises Unknown, 958 F. Supp. 2d 753 (S.D. Tex. 2013)—
put the FBI on notice that NIT-like warrants violate Rule 41,
which prompted the Department of Justice to seek an
amendment to the Rule. But the warrant at issue in that case
was significantly more invasive than the NIT warrant here
because the “software ha[d] the capacity to search [and
transmit] the computer’s hard drive, random access memory,
and other storage media; to activate the computer’s built-in
camera; [and] to generate latitude and longitude coordinates
for the computer’s location.” Id. at 755. The NIT had none of
these capabilities, making it entirely plausible for a reasonably
well-trained officer to presume that the NIT was not forbidden
under In re Warrant.

Furthermore, In re Warrant was decided by a single
magistrate judge in Texas – it has no binding precedential
authority and does not reflect the opinions of judges in other
jurisdictions. Contrary to Werdene’s assertions at oral
argument, the legal landscape here was entirely unlike that in
Katzin, where government agents relied on a 3-1 federal circuit
split to conduct a warrantless search. 769 F.3d at 180-81. It
was therefore entirely conceivable for the FBI to believe that

29
reasonable magistrate judges could differ on the legality of the
NIT. This view is reinforced by the fact that a number of
federal district courts have issued opinions reaching different
conclusions on NIT-related suppression motions. Compare
United States v. Levin, 186 F. Supp. 3d 26 (D. Mass. 2016)
(NIT case granting suppression), vacated and remanded, 874
F.3d at 324, with United States v. Michaud, No. 3:15-CR-
05351-RJB, 2016 WL 337263 (W.D. Wash. Jan. 28, 2016)
(NIT case denying suppression).

Second, Werdene argues that the FBI breached the
Department of Justice’s Computer Crime and Intellectual
Property Section’s revised manual for U.S. Attorney’s Offices.
See DEPARTMENT OF JUSTICE, CRIMINAL DIVISION,
COMPUTER CRIME AND INTELLECTUAL PROPERTY
SECTION, SEARCHING AND SEIZING COMPUTERS AND
OBTAINING ELECTRONIC EVIDENCE IN CRIMINAL
INVESTIGATIONS (3d ed. 2009). This manual was published
in 2009 and advises that “[a]gents should obtain multiple
warrants if they have reason to believe that a network search
will retrieve data stored in multiple locations.” Id. at 84.
However, we decline to impute to the FBI agents the same
understanding of legal nuances that is expected from the U.S.
Attorney’s Office. See United States v. Tracey, 597 F.3d 140,
152 (3d Cir. 2010) (“[T]he knowledge and understanding of
law enforcement officers and their appreciation for
constitutional intricacies are not to be judged by the standards
applicable to lawyers.” (quoting United States v. Cardall, 773
F.2d 1128, 1133 (10th Cir. 1985)); see also Workman, 863 F.3d
at 1321 (“We expect agents executing warrants to be
‘reasonably well-trained,’ but we do not expect them to
understand legal nuances the way that an attorney would.”).

30
IV. CONCLUSION

For the reasons above, we will affirm on alternative
grounds the District Court’s decision to deny Werdene’s
suppression motion.

31
United States of America v. Gabriel Werdene
No. 16-3588

NYGAARD, Circuit Judge, concurring.

I join Judge Greenaway’s well-reasoned opinion
without reservation. However, I write separately to highlight
a somewhat nuanced legal point that would go unnoticed
were I not to comment. In an attempt to save the search at
issue here from the strictures of the Fourth Amendment, the
Government not only argued for application of the good faith
exception, but also for the application of the tracking device
exception set out in Fed. R. Crim. P. 41(b)(4) in the District
Court. Anticipating that the Government might bring this
argument up on appeal, Werdene argued in his opening brief
that it was waived because the Government, contrary to its
own interests, conceded in the District Court that none of
Rule 41’s exceptions applied. And, indeed, the Government
did concede—both in their opposition to the motion to
suppress and in open court—that Rule 41 does not explicitly
authorize a judge to issue a search warrant in the
circumstances presented here. App. at 91-92, 250-251.

Now, the Government says that their tracking device
argument is not waived because we can affirm on any basis
that is supported by the record, see, e.g., Murray v. Bledsoe,
650 F.3d 246, 247 (3d Cir. 2011), and the Appellant does not
quibble with that notion. Instead, Werdene argues that this
prerogative is not available to an appellate court when a party
has conceded the point on which we wish to affirm in district
court. This is an interesting question and one that in my
nearly three decades on this court I have not encountered.

1
 The Government offers no authority to the contrary.
Werdene points to one Supreme Court opinion and a couple
of court of appeals opinions in support of his position. For
example, in Steagald v. United States, 451 U.S. 204 (1981),
the Government conceded a particular factual point in the
District Court (related to the ownership of a residence) and
did so again in opposition to the petition for certiorari in the
Supreme Court. But, in its brief to the Court, the Government
argued the very point it had previously conceded in the
District Court, maintaining that the Court could affirm by
relying on any basis present on the record. 451 U.S. at 209.
The Supreme Court, to loosely paraphrase, would have none
of it. The Court instructed that the Government loses its right
to raise factual issues in the Supreme Court “when it has
made contrary assertions in the courts below, when it has
acquiesced in contrary findings by those courts, or when it
has failed to raise such questions in a timely fashion during
the litigation.” Id. The other cases cited by the Appellant,
United States v. Ornelas-Ledesma, 16 F.3d 714, 721 (7th Cir.
1994), United States v. Albrektsen, 151 F.3d 951, 954 (10th
Cir. 1998), and United States v. Scales, 903 F.2d 765, 770
(10th Cir. 1990), all hold the Government to be bound by
concessions it made in District Court.

Our case differs slightly in that the concession here
was legal, not factual. In my view, this is a difference
without a distinction. If, as here, the issue or argument has
been conceded or waived before a district court, then we must
not affirm on that basis. Judge Greenaway elided the issue as
unnecessary to a decision in the cause before us. Slip Op. at
13. I do not disagree. I point out my thoughts on this matter
nonetheless solely to remind practitioners of that old adage,
“you cannot have it both ways.” In my opinion, conceding a

2
fact or a legal point in the District Court prevents us from
affirming on that basis.

3