Rather than allow public, but still-classified materials found on WikiLeaks to be exposed in court, federal prosecutors in Tacoma, Washington, have dropped two cases related to child pornography. Those two counts were against a man accused of downloading such materials through Playpen, a now-defunct child-pornography website that was hidden through Tor.

The move, which took place earlier this month, means that David Tippens will only face one remaining count of possession of child pornography, which carries no minimum sentence.

Tippens, like all of the over 200 Playpen prosecutions unfolding nationwide, was discovered through the government seizure and temporary operation of Playpen. During that 13-day period in 2015, federal authorities deployed an exploit to logged-in users of the site, which had the effect of forcing users’ computers to expose their true IP address. With such information, translating an IP address into a person’s name became trivial for the investigators. The Department of Justice has called this exploit a "network investigative technique," (NIT) while many security experts have dubbed it as "malware."

These prosecutions, which are still unfolding nationwide, have raised significant questions as to what the limits of government surveillance should be—and how much judicial and legislative oversight exists for authorized government hacking.

Earlier this week, three advocacy organizations put out a lengthy legal guide for criminal defense attorneys who are struggling to deal with understanding this cutting-edge area of the law.

“The interests of justice are served”

In Tippens, the government decided to make such a move rather than allow attorneys for the defendant to present still-classified material discovered on WikiLeaks as trial exhibits. In March, during trial, the defense attorneys told the court they wished to present exhibits showing the government’s ability to, as the judge summarized earlier this month, "hack into a computer without leaving any trace that it had been hacked or that an exploit had been placed on it."

The result is that Tippens "would not be able to determine whether child pornography had been planted or whether security settings had been modified."

During trial, prosecutors acknowledged that the material the defense wished to present was classified and that the materials therefore should be excluded. Because of that declaration, and the inability to present classified material that may possibly be helpful to the defense, the defense asked the judge to dismiss Counts 1 (receipt of child pornography) and 3 (transportation of child pornography).

As US District Judge Robert Bryan concluded in his March 16 order:

The Court finds that the interests of justice are served by this dismissal action. At its own peril, the Government elected to prosecute Receipt and Transportation counts partially reliant on evidence of timestamp metadata, while also electing to withhold NIT code and Defendant's proposed exhibits. Withholding the material effectively prevented Defendant from presenting his proposed exhibits in support of Defendant’s vulnerability theory, that there was an increased likelihood of a third party hack in the form of planted contraband or modified security settings. Withholding also limited Defendant's ability to attack the Government's long-held position that "reverse engineering" Defendant's computer would reveal that there was no third party attack. See, e.g., Dkt. 58-1 at 5, 6 (declaration of Dr. Brian Levine); Dkt. 102 at 67 (testimony of Dr. Brian Levine); Dkt. 103 at 64, 65 (oral argument). Finally, withholding precluded Defendant from relying on the proposed exhibits to attack the Government’s credibility as to representations made at ex parte and in camera CIPA hearings, and the Court's earlier finding that the NIT code was not "relevant and helpful" to the defense.

Amok time

Colin Fieman, the federal public defender assigned to Tippens (who also successfully got a similar case dropped in early March ) would not tell Ars precisely what information on WikiLeaks he had wanted to introduce in court.

"Although the documents are now public, they are still classified, and I need to be circumspect about recirculating information in them," Fieman e-mailed. "However, I can tell you that some of the documents of particular interest relate to the government's ability to alter time stamps and other metadata without leaving a forensic trail, and [its ability to] otherwise use malware that evades 'reverse engineering' by defense experts."

Ars further asked if the defense team had located these documents on its own or if someone else had brought them to the team's attention. Fieman replied:

We found them. The Wiki disclosure came shortly before we started the Tippens trial, and we spent a lot of time combing through the documents and consulting with our experts to identify potentially helpful information. Fortunately, most federal defenders have the resources needed to do this type of work, even at the last minute with a trial looming, because it took a major team effort to find useful information with so little time left before the trial started. The sad part is that, of course, the government knew about this information, and while DOJ has an ethical and legal obligation to disclose information that is material to the defense, the government not only did not disclose the information, but tried to prevent us from using it on behalf of our client even after it came to light.

Bradley Moss, a Washington, DC-based attorney who frequently deals with national security law, told Ars that this tactic could be repeated in other Playpen cases.

"There's nothing to stop the other [federal defenders] from employing it," he wrote. "In fact, I'm surprised they all haven't done so."

Meanwhile, Peter Carr, a spokesman for the Department of Justice, e-mailed Ars: "We'll decline to comment."