from the United States District Court for the District of
Kansas (D.C. No. 6:17-CR-10087-JTM-1)
Stephen R. McAllister, United States Attorney (Jason W. Hart,
Assistant United States Attorney, with him on the briefs),
District of Kansas, Wichita, Kansas, for
T. Hansmeier, Appellate Chief (Melody Brannon, Federal Public
Defender, Timothy J. Henry, Assistant Federal Public
Defender, with him on the briefs), Kansas City, Kansas, for
TYMKOVICH, Chief Judge, BACHARACH, and McHUGH, Circuit
McHUGH, Circuit Judge.
Eugene Cookson pleaded guilty to two counts of possessing
child pornography after the FBI identified him in the course
of its large-scale sting operation involving the website
"Playpen." At his sentencing hearing, the district
court determined Mr. Cookson's criminal history and total
offense level correlated to a Guidelines range of 97-121
months. The district court announced its intention to
sentence Mr. Cookson to a term of seventy-two months'
imprisonment. But after entertaining argument from both
parties and inviting Mr. Cookson's allocution, the
district court imposed a sentence of five years'
United States appealed, challenging Mr. Cookson's
sentence as substantively unreasonable. Mr. Cookson
cross-appealed, arguing the district court erred in refusing
to suppress evidence obtained from his computer by the FBI
pursuant to a warrant issued in the Eastern District of
affirm the district court's suppression ruling based on
our decision involving the same warrant in United States
v. Workman, 863 F.3d 1313 (10th Cir. 2017), but we
vacate Mr. Cookson's sentence as unreasonable and remand
to the district court for resentencing.
Search and Seizure
2015, the FBI tracked down and arrested the operator of
Playpen, a website that facilitated the distribution of child
pornography. Instead of discontinuing Playpen's
operations, however, the FBI decided to use the site to
locate individuals using it to access child pornography.
Workman, 863 F.3d at1315.
Playpen's users presented a challenge because Playpen was
accessible only through "Tor" (short for "The
Onion Router"), a network and software program designed
to allow users to browse the internet anonymously.
Id. at 1315. To access Playpen, users "had to
employ [Tor] software that routed . . . connections through
[a series of] third-party computers called
'nodes.'" Id. By routing connections in
this manner, Tor enabled its users to access Playpen without
disclosing their IP addresses (unique numbers assigned to a
given user's computer, see United States v.
Henderson, 595 F.3d 1198, 1200 n.1 (10th Cir. 2010)) or
other identifying information.
bypass the steps Playpen took to keep its users anonymous,
the FBI, after seizing control of the website, loaded
Playpen's contents-pornography and all-onto a government
server in the Eastern District of Virginia. Workman,
863 F.3d at 1315. The FBI then sought a warrant in the
Eastern District of Virginia which would authorize it to
deploy a network investigative technique ("NIT") on
the government server hosting Playpen. In support of their
application for a search warrant, the FBI obtained an
affidavit from Agent Douglas Macfarlane explaining the
operation of the proposed NIT as follows:
In the normal course of operation, websites send content to
visitors. A user's computer downloads that content and
uses it to display web pages on the user's computer.
Under the NIT authorized by this warrant, the TARGET WEBSITE
[Playpen], which will be located in Newington, Virginia, in
the Eastern District of Virginia, would augment that content
with additional computer instructions. When a user's
computer successfully downloads those instructions from
[Playpen] . . . the instructions, which comprise the NIT, are
designed to cause the user's . . . computer to transmit
certain information [including IP addresses] to a computer
controlled by or known to the government. . . . The NIT will
not deny the user . . . access to any data or the
functionality of the user's computer.
App. at 342-43. Essentially, when someone logged in to
Playpen by entering a username and password, the NIT would
cause that person's computer to transmit identifying
information (including the user's IP address) to the FBI.
A magistrate judge in the Eastern District of Virginia signed
the warrant, and the FBI operated Playpen with the NIT for
approximately two weeks.
February 22, 2015, someone with the username
"shishkabobs" logged into Playpen.
Shishkabobs's computer downloaded the NIT, causing it to
transmit identifying information to the FBI. Using this
identifying information, the government sought an
administrative subpoena for the Southern Kansas Telephone
Company to identify the physical address associated with the
IP address obtained from shiskabobs's computer. Based on
information received from the Southern Kansas Telephone
Company, the FBI connected shiskabobs's IP address to a
home Mr. Cookson shared with his parents and brother in
Howard, Kansas. The FBI obtained and executed a search
warrant for this home, where they found child pornography on
various devices owned by Mr. Cookson. Mr. Cookson later
confessed to using Playpen to view child pornography.
government charged Mr. Cookson with two counts of possessing
child pornography under 18 U.S.C. § 2252A(a)(5)(B). Mr.
Cookson moved to suppress all evidence derived from the
operation of the NIT on his computer, arguing the magistrate
judge in the Eastern District of Virginia lacked authority to
issue the NIT warrant and the warrant therefore violated the
Fourth Amendment. Specifically, Mr. Cookson argued that
magistrate judges generally may not issue warrants for the
search of persons or property outside of their district.
See 28 U.S.C. § 636(a) (provision of the
Federal Magistrates Act giving magistrate judges authority
"within the district in which [they sit]").
Although he recognized that the version of Fed. R. Crim. P.
41(b) in force at the time created a limited set of
exceptions to this general rule, including for warrants
concerning the installation of a tracking device, Mr. Cookson
contended the exceptions did not include the NIT. He further
argued that, if the district court deemed the warrant
invalid, the good-faith exception could not save the fruits
of the FBI's unconstitutional search from application of
the exclusionary rule because (1) the FBI misled the
magistrate judge in its warrant application, (2) the
magistrate abandoned her judicial role, and (3) the FBI knew
the warrant was facially deficient. See Workman, 863
F.3d at 1317-18 (setting forth circumstances in which the
good-faith exception does not apply).
district court denied the suppression motion. The court
observed that the same NIT warrant in Mr. Cookson's case
had been considered by many other trial courts across the
country. Most of these courts found the magistrate judge who
issued the NIT warrant lacked the authority to do so, yet
they declined to suppress evidence obtained as a result of
the NIT under the good-faith exception. See, e.g.,
United States v. Ammons, 207 F.Supp.3d 732 (W.D. Ky.
2016); United States v. Henderson, No.
15-CR-00565-WHO- 1, 2016 WL 4549108 (N.D. Cal. Sept. 1,
2016); United States v. Michaud, No. 3:15-CR-
05351-RJB, 2016 WL 337263 (W.D. Wash. Jan. 28, 2016). And
while two courts decided the good-faith exception did not
apply and suppressed the evidence, these decisions were later
reversed by the courts' respective circuits. See
United States v. Levin, 874 F.3d 316, 325 (1st Cir.
2017); United States v. Horton, 863 F.3d 1041, 1052
(8th Cir. 2017). The Tenth Circuit addressed the NIT warrant
in United States v. Workman, holding that, even
assuming the warrant was invalid, the good-faith exception
saved the evidence from suppression. 863 F.3d at 1319-21.
the district court agreed that the Eastern District of
Virginia magistrate judge exceeded her authority in issuing
the NIT warrant but determined Workman governed the
outcome of Mr. Cookson's case. Accordingly, the court
applied the good-faith exception and denied Mr. Cookson's
the district court denied his motion to suppress, Mr. Cookson
entered into a plea agreement as to both counts of the
indictment. As relevant here, the plea agreement set forth
Mr. Cookson's understanding that his plea entailed a
maximum sentence of twenty years' imprisonment, various
fines and assessments, and a minimum of five years'
supervised release. Mr. Cookson and the government also
agreed to a conditional plea allowing Mr. Cookson to appeal
the district court's suppression decision. The government
agreed that Mr. Cookson could remain on bond (under
conditions of supervision) pending resolution of his appeal.
to sentencing, Mr. Cookson's probation officer prepared a
Presentence Investigation Report ("PSR"). The PSR
calculated Mr. Cookson's base offense level as 18. This
base offense level increased to 28 due to a number of
adjustments pursuant to U.S.S.G. § 2G2.2, including a
two-level increase under U.S.S.G. § 2G2.2(b)(2) because
the material involved a prepubescent minor; a four-level
increase under U.S.S.G. § 2G2.2(b)(4) because the
material involved sadistic or masochistic conduct or other
depictions of violence; a two-level increase under U.S.S.G.
§ 2G2.2(b)(6) because the offense involved the use of a
computer, and a five-level increase under U.S.S.G. §
2G2.2(b)(7)(D) because Mr. Cookson possessed more than 600
images of child pornography. The PSR also listed Mr.
Cookson's adult criminal convictions, which resulted in a
criminal history score of six and placed him in a criminal
history category of III.
on an offense level of 28 and a criminal history category of
III, the PSR calculated a Guidelines range for Mr. Cookson of
97-121 months' imprisonment. Mr. Cookson's
convictions entail a maximum term of imprisonment of ...