A federal judge in Virginia has ruled that a case against Edward Matish, a man accused of downloading child pornography, should stand—preserving the defendant’s upcoming trial date. Also on Wednesday, an FBI agent explicitly denied that the "network investigative technique" (NIT) used to locate Matish and break through his Tor-enabled defenses is malware.

In two separate orders handed down on Thursday, US District Judge Henry Coke Morgan, Jr. denied Matish’s two attempts to have the charges dismissed. Matish’s federal public defender had argued that his client was coerced into signing a statement confessing to his alleged crimes. Judge Morgan disagreed with the arguments presented by Matish's legal team.

"There is no evidence to support Defendant's claim that he made his statement involuntarily," he wrote in his orders. "Defendant put on no evidence during the hearing to support the allegations made in his brief. The evidence before the Court shows that the agents never threatened to prosecute Defendant or his family if he did not provide a statement."

US v. Matish is one of at least 135 cases currently being prosecuted nationwide stemming from the FBI’s investigation of the Tor-hidden child pornography site called "Playpen."

As Ars has reported before, to breach the security normally afforded by Tor, the FBI deployed a "network investigative technique" (NIT). In a related case prosecuted out of New York, an FBI search warrant affidavit described both the pornography available to Playpen’s 150,000 members and the NIT's capabilities.

How about the source code?

As a way to ensnare users, the FBI took control of Playpen and ran it for 13 days in 2015 before shutting it down. During that period, with many users’ Tor-enabled digital shields down—revealing their true IP addresses—the government was able to identify and arrest the 135 child porn suspects.

However, nearly 10 times that number of IP addresses was revealed as a result of the NIT’s deployment, which could suggest that still more charges could be filed. An exploit that reveals a Tor user’s true IP address without the user’s prior authorization, even if they are accused of downloading something as illegal as child porn, is indeed by most accounts a piece of malicious software, or malware.

Unlike a recent case in Washington state, the validity of the authorizing warrant in Matish's case was not in question. The warrant was both issued in and targeted a search in the Eastern District of Virginia.

Authorities maintain that the use of the NIT was practically surgical. Earlier in the week, FBI Special Agent Daniel Alfin previously rejected Matish’s expert’s testimony that the NIT is, in fact, malware.

Matish’s expert, Matthew Miller, a computer science professor at the University of Nebraska, noted that the government had given up the entire NIT source code in an earlier different but similar case in Nebraska.

As Alfin wrote:

As another threshold matter, I would note that I do not consider the NIT used by the FBI to be "malware," though the experts retained by Mr. Matish describe the NIT in such terms. The word malware is an amalgamation of the words "malicious" and "software". The NIT utilized in this investigation was court-authorized and made no changes to the security settings of the target computers to which it was deployed. As such, I do not believe it is appropriate to describe its operation as "malicious." ... I have personally executed the NIT on a computer under my control and observed that it did not disable the security firewall, make any changes to the security settings on my computer, or otherwise render it more vulnerable to intrusion than it already was. Additionally, it did not "infect" my computer or leave any residual malware on my computer.

Alfin went on to describe how because the data stream from what was allegedly Matish's computer back to a government server was not encrypted, it can easily be reviewed by his legal team.

That explanation did not sit well with Christopher Soghoian, a technologist with the American Civil Liberties Union.

This is like the FBI saying they stored crime scene evidence in a ziplock instead of a signed, sealed evidence bag. https://t.co/ItyVibDtfG — Christopher Soghoian (@csoghoian) June 3, 2016

Matish, 23, is scheduled to begin his jury trial on June 14, 2016 in Newport News, Virginia.