United States District Court, District of Columbia
D. BATES UNITED STATES DISTRICT JUDGE
McCormick was indicted on December 4, 2018, on seven counts
of Racketeer Influenced Corrupt Organization conspiracy in
violation of 18 U.S.C. § 1962(d), conspiracy to commit
bank and wire fraud in violation of 18 U.S.C. § 1349,
and aggravated identity theft in violation of 18 U.S.C.
§ 1028A. The government alleges that McCormick, under
the alias “fubar, ” engaged in a variety of
illegal activities on Darkode, an invitation-only online
forum that facilitated the sale of malware and other illicit
goods and services. Before the Court is McCormick's
motion to suppress evidence obtained pursuant to a December
2013 search warrant or, alternatively, to hold a hearing
pursuant to Franks v. Delaware, 438 U.S. 154 (1978),
about information omitted from the application for that
warrant. Defs.' Mot. to Suppress or, in the Alternative,
Request for a Franks Hr'g (“Def.'s
Mot.”) [ECF No. 27] at 5-15. The government opposes the
motion. Gov't's Opp'n to Def.'s Mot. to
Suppress (“Gov't's Opp'n”) [ECF No.
28]. For the reasons that follow, the motion is denied.
online user operating under the moniker “fubar”
came to the FBI's attention in 2009 for allegedly coding,
advertising, and selling malware. Aff. of Special Agent David
Hitchcock in Supp. of an Appl. for a Search Warrant
(“Hitchcock Aff.”), Ex. 2 to Gov't's
Opp'n [ECF No. 28- 2] ¶¶ 6-17. In January 2010,
fubar allegedly sold malware used to harvest banking
credentials to an undercover FBI agent. Id.
¶¶ 11-14. By August 2010, the FBI had traced online
activity of fubar to McCormick's parents' home
address in Cambridge, Massachusetts, where the teenaged
McCormick then resided, but FBI agents did not immediately
identify McCormick as residing at that address. See
Aug. 5, 2010, FBI communication, Ex. 3 to Def.'s Mot.
[ECF No. 27-3] at 1-2. At the time, FBI investigators
explained that fubar might not appear in law enforcement
databases because he “may be in high school and not
hav[e] a significant credit history.” Id. at
2-3. FBI agents finally matched McCormick to his online
moniker fubar in January 2011, shortly after McCormick's
eighteenth birthday. See FBI email, Ex. 2 to
Def.'s Mot. [ECF No. 27-2] at 1-2.
months that followed, McCormick finished high school and
moved away to college. In early December 2013-almost three
years after first identifying McCormick as
“fubar” and about a month after McCormick turned
twenty-one-the FBI sought a search warrant to search
McCormick's college dorm room for evidence related to his
online activities. Search Warrant, Ex. 1 to Gov't's
Opp'n [ECF No. 28-1] at 1. FBI Special Agent David
Hitchcock submitted an affidavit in support of the warrant
application. See Hitchcock Aff. In addition to
outlining the January 2010 controlled buy of malware from
fubar, the affidavit explained that the FBI had obtained
records in 2012 and 2013 from Google, Microsoft
(McCormick's employer during a summer internship), and
other sources that corroborated the connection between
McCormick and fubar. Hitchcock Aff. ¶¶ 11-14,
17a-d. Information obtained from a confidential informant in
the Darkode community had also provided evidence that fubar
continued to participate in Darkode forums and had logged in
as a Darkode administrator as recently as September 10, 2013.
Id. ¶ 7- 9. Pen trap information obtained in
early 2013 from McCormick's university further showed
that he had continued to access his fubar Darkode account
from the university. Id. ¶ 17c, 17e. The
affidavit does not mention that FBI agents made the
connection between fubar and McCormick as early as January
2011. See id.
magistrate judge issued the search warrant on December 4,
2013. Search Warrant at 1. The FBI executed the search
warrant on December 5, 2013, recovering a laptop computer,
tablet, smartphone, several external storage devices, and
some papers. Id. at 2.
alleges that “the only rational explanation” for
the years-long delay between identifying McCormick and
seeking the search warrant “was to ‘run the
clock' until [he] turned twenty-one years old and thus
would no longer have the protections of juvenile
status.” Def.'s Mot. at 15. Accordingly, McCormick
argues that probable cause was lacking for the warrant
because the information supporting the warrant was stale, and
that, in the alternative, a Franks hearing is
necessary “to investigate why the agents failed to
provide material information in the search warrant
application, namely the fact that they had identified Mr.
McCormick as their suspect nearly three years prior to the
date of application.” Id. at 1-2.
Fourth Amendment protects “[t]he right of the people to
be secure in their persons, houses, papers, and effects,
against unreasonable searches and seizures.” U.S.
Const. amend. IV. Law enforcement actions taken under a
warrant are preferred to searches and seizures without one,
and “in a doubtful or marginal case a search under a
warrant may be sustainable where without one it would
fall.” United States v. Ventresca, 380 U.S.
102, 106-07 (1965).
valid warrant to issue, “[s]ufficient information must
be presented to the magistrate to allow that official to
determine probable cause; his action cannot be a mere
ratification of the bare conclusions of others.”
Illinois v. Gates, 462 U.S. 213, 239 (1983).
However, the magistrate's task is not a technical one.
“[T]he issuing magistrate is simply to make a
practical, common-sense decision whether, given all the
circumstances set forth in the affidavit before him, . . .
there is a fair probability that contraband or evidence of a
crime will be found in a particular place.”
Id. at 238. The corresponding “duty of a
reviewing court is simply to ensure that the magistrate had a
substantial basis for concluding that probable cause
existed.” Id. at 238-39 (alterations and
citation omitted). Because “[r]easonable minds
frequently may differ on the question whether a particular
affidavit establishes probable cause, ” the Supreme
Court has “accord[ed] ‘great deference' to a
magistrate's determination” even though that
deference “is not boundless.” United States
v. Leon, 468 U.S. 897, 914 (1984) (quoting Spinelli
v. United States, 393 U.S. 410, 419 (1969)).
Motion to Suppress
first issue raised by McCormick is whether the December 2013
search warrant relied on stale information that could not
support a finding of probable cause. Def.'s Mot. 7-12.
warrant will lack adequate support-and hence be invalid-if
the facts contained in its supporting affidavit have
“become stale by the passage of time.” Sgro
v. United States, 287 U.S. 206, 215 (1932). For a valid
search warrant to issue, law enforcement officers must offer
“proof . . . of facts so closely related to the time of
the issue of the warrant as to justify a finding of probable
cause at that time.” Id. at 210.
“Whether the proof meets this test must be determined
by the circumstances of each case, ” id. at
210-11, and “different kinds of information go stale at
different rates, ” United States v. Johnson,
437 F.3d 69, 72 (D.C. Cir. 2006). In determining the
“likelihood that the evidence sought is still in place,
” courts consider
the character of the crime (chance encounter in the night or
regenerating conspiracy?), of the criminal (nomadic or
entrenched?), of the thing to be seized (perishable and
easily transferable or of enduring utility to its holder?),
of the place to be searched (mere ...