A newly released federal court hearing transcript reveals that one warrant issued as part of a massive child porn investigation in the US was also used to authorize government malware that targeted more than 8,000 users across 120 countries , including a “satellite provider.”

As Vice Motherboard first reported, the remarks came from the November 1 hearing in the case of United States v. Tippens and two other related cases, which are ongoing in Tacoma, Washington. These cases, and more than 100 others like them, are part of a global effort to target people suspected of accessing the now-defunct Tor-hidden child porn site known as “Playpen.”

As Colin Fieman, a federal public defender who represents David Tippens and other Playpen defendants in that area, said during the November 1 hearing in Tacoma:

Every time Your Honor grants a discovery request and we get new information, it’s like—to use an appropriate metaphor, like peeling an onion. There’s just another layer of fact there that we did not know about. I mean, we did not know this was a truly global warrant before. There are 120 countries and territories listed outside the United States that the FBI hacked into, and they also hacked into something called a “satellite provider.” So now we are into outer space as well... The privacy interest at stake here isn’t the IP address or MAC address, it’s the fact that they went into a personal computer in our clients’ homes.

Fieman asked the judge to suppress the evidence collected against his clients.

As Ars has reported, federal investigators temporarily seized Playpen in 2015 and operated it for 13 days before shutting it down. The agency then used a “network investigative technique” (NIT) as a way to ensnare site users.

That NIT, which many security experts have dubbed as malware, thwarted Tor and forced people’s computers to cough up their true IP addresses. With that, it became trivial for investigators to subpoena ISPs and determine the identities of the account holders.

Part of the controversy surrounding the Playpen affair is the fact that a more junior type of judge, known as a federal magistrate (here, Virginia-based US Magistrate Judge Theresa C. Buchanan), was the one who signed the warrant authorizing this search that not only targeted users in other parts of the United States, but abroad as well.

Under one part of the current rules of federal criminal procedure, known as Rule 41, only more senior federal judges, known as district judges, have the authority to issue out-of-district warrants. However, a change in this rule set to take effect on December 1, 2016 will expand this power to magistrate judges, absent Congressional action.

Of the more than 100 Playpen-related child pornography cases that have been prosecuted, federal judges in Iowa, Massachusetts, and Oklahoma have ruled that such a search violated current laws of federal procedure and was in fact so egregious that the evidence collected as a result should be tossed. Other judges have rebuked prosecutors for unlawful searches, but they have not gone so far as to suppress evidence.

Balancing test

In, Fieman argued that US District Judge Robert Bryan should, in fact, suppress the evidence gathered as a result of the NIT. In an exchange during the same November 1 hearing, federal prosecutors argued that the judge should do no such thing. In fact, Judge Bryan seemed a bit skeptical as to the government’s arguments.

For their legal reasoning, prosecutors and investigators relied on the portion of Rule 41 that refers to a “tracking device,” which is defined elsewhere in federal law as: “an electronic or mechanical device which permits the tracking of the movement of a person or object.” In Tippens, as in all the other Playpen cases, the “object” seems to be data—the IP address revealed by the NIT.

As Judge Bryan said:

A tracking device is not designed under Section 3117 to track other than a person or object. But in Rule 41, you are talking about information as property, and it was used apparently here to track information. You know, the language of the statutes and the rule seem to indicate that a tracking device is something very different than a computer NIT or some electronic communication between computers. I know other judges have decided that was a good niche to hang their opinion on, but I have a little trouble with that. It seems to me it’s stretching the tracking device rule and statute beyond its intended meaning.

Assistant United States Attorney Matthew Hampton told the judge that deciding to toss the evidence was “a close call at best," saying, "the costs of suppression here are tremendous. Defendants who committed horrific crimes could well be let go and go free, and the interest that would vindicate is at most a venue revision. It certainly wouldn’t deter government misconduct. What government misconduct was there? The government did what the Fourth Amendment—what is a fundamental policy of the Fourth Amendment."

Judge Bryan is expected to rule on the motion to suppress in the coming months.