# United States v. Nikolai Bosyk

> Court of Appeals for the Fourth Circuit · August 1, 2019 · 933 F.3d 319

URL: https://www.frixlaw.com/law-library/cases/4422244

## Case

- **Full name:** UNITED STATES of America, Plaintiff - Appellee, v. Nikolai BOSYK, Defendant - Appellant. Electronic Frontier Foundation, Amicus Supporting Appellant.
- **Court:** Court of Appeals for the Fourth Circuit
- **Decided:** August 1, 2019
- **Citations:** 933 F.3d 319
- **Precedential status:** Published
- **Opinion:** Opinion
- **Judges:** Wynn, Diaz, Richardson
- **Cited by:** 28 later opinions in the Frix Law Library

## Citator (automated)

- No negative treatment found by the automated citator. That is not the same as a confirmation that the case is good law; read the citing cases.
- Full citator and citing cases: https://www.frixlaw.com/law-library/cases/4422244

## How later opinions describe it (automated extraction)

- finding that courts have sustained warrants “issued many months, and even years after the events that gave rise to probable cause” in child pornography cases

## Opinion text

PUBLISHED

UNITED STATES COURT OF APPEALS
FOR THE FOURTH CIRCUIT

No. 18-4302

UNITED STATES OF AMERICA,

Plaintiff − Appellee,

v.

NIKOLAI BOSYK,
Defendant – Appellant.

------------------------------

ELECTRONIC FRONTIER FOUNDATION,

Amicus Supporting Appellant.

Appeal from the United States District Court for the Eastern District of Virginia, at
Alexandria. Leonie M. Brinkema, District Judge. (1:17-cr-00302-LMB-1)

Argued: January 31, 2019 Decided: August 1, 2019

Before WYNN, DIAZ, and RICHARDSON, Circuit Judges.

Affirmed by published opinion. Judge Diaz wrote the majority opinion, in which Judge
Richardson joined. Judge Wynn wrote a dissenting opinion.

ARGUED: William Davis Ashwell, MARK B. WILLIAMS & ASSOCIATES, PLC,
Warrenton, Virginia, for Appellant. Fletcher Nathaniel Smith III, OFFICE OF THE
UNITED STATES ATTORNEY, Alexandria, Virginia, for Appellee. Stephanie
Lacambra, ELECTRONIC FRONTIER FOUNDATION, San Francisco, California, for
Amicus Curiae. ON BRIEF: G. Zachary Terwilliger, United States Attorney, Lauren
Britsch, Trial Attorney, OFFICE OF THE UNITED STATES ATTORNEY, Alexandria,
Virginia, for Appellee. Sophia Cope, Andrew Crocker, Aaron Mackey, ELECTRONIC
FRONTIER FOUNDATION, San Francisco, California, for Amicus Curiae.

2
DIAZ, Circuit Judge:

The basic facts are these. One day, a link appeared on a secretive online message

board. Accompanying the link was a message describing its contents unmistakably as child

pornography, as well as numerous thumbnail images depicting sexual molestation of a

female toddler. And if you clicked the link, it took you, as promised, to multiple videos of

child pornography.

On that same day, an IP address associated with Nikolai Bosyk’s house accessed the

link. Based on these facts, the government obtained a warrant to search Bosyk’s home for

evidence of child pornography. The primary question before us is whether that warrant

was supported by probable cause. Concluding that it was, we affirm.

I.

In September 2015, a Department of Homeland Security cybercrimes unit began

investigating an online message board known as “Bulletin Board A.” This board was

“dedicated to the advertisement, distribution and production of child pornography,” and

had more than 1,500 “approved users.” J.A. 163–64. The site contained several forums

and subforums in which members could post and view various genres of child

pornography. 1

1
In related cases, the government has explained that Bulletin Board A is a dark web
forum, accessible only through an anonymous web browser that users must download. See
United States v. Reece, No. 2:16cr104, 2017 U.S. Dist. LEXIS 220176, at *4 (E.D. Va.
Mar. 1, 2017).

3
One such posting occurred on November 2, 2015. That day, an unidentified member

of Bulletin Board A posted a message in the board’s “Pre-teen Hardcore” section

describing in graphic terms the contents of four videos. J.A. 164. Below the message were

three sets of 20 video thumbnail images depicting “juvenile females engaged in sexual

acts.” Id. And below those images was a URL link—an apparently random string of

numbers and letters.

The post also contained a password “which users could input to access and open the

content of the file associated with that unique URL.” J.A. 165. Using this password,

federal investigators downloaded and viewed an encrypted file, which showed a man

molesting a young girl, apparently a toddler. Three other videos associated with the link

also contained child pornography.

This link and its contents were hosted by a separate filesharing site (referred to as

“the File Sharing Site”). This site allows users to upload and share various media, and

hosts plenty of lawful content. But the government also knew that Bulletin Board A’s

members used the File Sharing Site (and similar services) to share sexually explicit content

with one another. So, in December 2015, investigators subpoenaed the File Sharing Site

for business records related to web pages containing illicit material. In response, the

company produced records showing that on November 2, 2015, at 3:23 p.m., an IP address

“was used to download or attempt to download file content associated with” the URL

containing the four videos. J.A. 167–68. In other words, the records showed that on the

same day that the post and link appeared on Bulletin Board A, someone using this IP

address clicked that same link.

4
By subpoenaing a broadband provider, investigators connected the IP address to

Bosyk’s home in Purcellville, Virginia. In April 2016, the government applied for a

warrant to search Bosyk’s house. It supported the application with an affidavit sworn by

DHS Special Agent Kristina Eyler, which recounted the facts above.

Eyler’s affidavit also described several “characteristics of individuals who possess

or access with intent to view child pornography.” J.A. 168. Such people, she said, may

collect explicit materials and use them for arousal or to groom victims. They often store

these materials electronically “for several years,” and frequently keep them nearby for ease

of viewing. J.A. 169. Some individuals have been known to download, view, then delete

child pornography from their electronic devices on a cyclical basis. But “evidence of such

activity, including deleted child pornography, often can be located on these individuals’

computers and digital devices through the use of forensic tools.” J.A. 169.

Based on this information, Agent Eyler submitted that there was probable cause to

suspect violations of federal laws against distributing, receiving, possessing, and accessing

with intent to view child pornography, see 18 U.S.C. §§ 2252, 2252A, and that evidence

of those suspected crimes would be found at Bosyk’s address. A magistrate judge agreed,

issuing a warrant that allowed the search of Bosyk’s residence and the seizure of

computers, digital devices, storage media, and related evidence.

Investigators executed the warrant four days later (on April 12, 2016) and recovered

devices containing thousands of images and videos of child pornography, including the

5
particular video described in the search warrant affidavit. 2 Agents also found evidence that

Bosyk had used an anonymous web browser to access dark-web child pornography

websites, including Bulletin Board A.

Bosyk was later indicted on child pornography charges. He moved to suppress the

evidence obtained under the warrant and sought a hearing under Franks v. Delaware, 438

U.S. 154 (1978), to show that Eyler had misled the magistrate judge. The district court

denied the motion, holding that the warrant was supported by probable cause and that, in

any event, suppression would be unwarranted. 3 Bosyk later pleaded guilty to one count of

receiving child pornography and was sentenced to five years in prison.

2
As for the (undisputed) results of the search, our friend notes that what was found
has no bearing on the question of probable cause. See Dissenting Op. at 31-32. But our
substantive analysis is entirely faithful to that principle.
3
Our dissenting colleague posits that the government duped the district court into
ignoring the important distinction between Bulletin Board A and the File Sharing Site, and
into presuming that Bosyk’s IP address accessed the URL after (rather than before) its
posting on Bulletin Board A. See Dissenting Op. at 32-35. But we see little indication that
the district court misunderstood the facts. Rather, we think the court’s oral ruling as
transcribed can be read to reflect a proper understanding both of the chronology of events
and of the relationship between Bulletin Board A and the File Sharing Site. Regarding the
timing, the court said that the URL was clicked “the same day” that the posting appeared
on Bulletin Board A, J.A. 76, which is perfectly consistent with the affidavit. As for the
distinction between the two websites, the court noted that on the day in question, “the IP
address that is linked to a computer in the defendant’s home . . . attempts to or at least
shows an interest in that particular site.” J.A. 76–77. It’s admittedly unclear whether “that
particular site” refers (incorrectly) to Bulletin Board A or (correctly) to the File Sharing
Site. But the preceding sentence includes references to both the “posting” and “the URL
that is linked,” so both readings are possible. J.A. 76. Furthermore, the district court later
noted the delay “between the time of that contact with the URL” and the warrant’s issuance,
J.A. 77, suggesting the court understood that Bosyk accessed the URL and not (necessarily)
Bulletin Board A.

6
II.

Having reserved the right to appeal the denial of his motion to suppress, Bosyk asks

us to reverse that ruling and vacate his conviction. He raises three arguments. First, he

argues that the search of his home violated the Fourth Amendment as it wasn’t supported

by probable cause. Second, he contends that even if the government had cause to search

his home in November 2015 (when the post appeared on Bulletin Board A and the link was

accessed), it didn’t in April 2016 when it actually obtained and executed the warrant.

Finally, Bosyk argues that suppression is warranted under United States v. Leon, 468 U.S.

897 (1984), because Eyler’s affidavit was misleading and lacked any indicia of probable

cause.

When considering a district court’s denial of a suppression motion, we review its

legal conclusions de novo, viewing the evidence in the light most favorable to the

government. United States v. Kolsuz, 890 F.3d 133, 141–42 (4th Cir. 2018). For reasons

that follow, we find no error.

III.

Before searching a home, the government generally must obtain a warrant,

supported by probable cause. Fernandez v. California, 571 U.S. 292, 298 (2014); see U.S.

Const. amend. IV. Probable cause requires only “a fair probability,” and not a prima facie

showing, that “contraband or evidence of a crime will be found in a particular place.”

Illinois v. Gates, 462 U.S. 213, 238 (1983). Probable cause is therefore “not a high bar.”

District of Columbia v. Wesby, 138 S. Ct. 577, 586 (2018) (quoting Kaley v. United States,

7
571 U.S. 320, 338 (2014)). And officers need not “rule out a suspect’s innocent

explanation for suspicious facts” to obtain a warrant. Id. at 588.

Since a magistrate judge issued the challenged warrant, our task isn’t to assess

probable cause de novo. Gates, 462 U.S. at 236. Instead, we apply a deferential and

pragmatic standard to determine whether the judge “had a substantial basis for concluding

that a search would uncover evidence of wrongdoing.” Gates, 462 U.S. at 236 (alterations

and internal quotation marks omitted). In doing so, we consider only the facts presented

in the warrant application. United States v. Lyles, 910 F.3d 787, 791 (4th Cir. 2018).

A.

Bosyk and his amicus (the Electronic Frontier Foundation, or “EFF”) argue that the

facts recounted in Agent Eyler’s affidavit didn’t give the government probable cause to

search Bosyk’s house for evidence of child pornography. They argue that the government

obtained its warrant based on a “single click” of a URL, which, they say, cannot support a

search of somebody’s home. We disagree. The facts in the affidavit support a reasonable

inference that someone using Bosyk’s IP address clicked the link knowing that it contained

child pornography. This in turn makes it fairly probable that criminal evidence would have

been found at Bosyk’s address.

The “critical fact” in this case, as the district court observed, is the timing. J.A. 76.

On the very day that someone clicked the link, it appeared on a website whose purpose was

to advertise and distribute child pornography to its limited membership. And it appeared

in a post containing text and images that unequivocally identified its contents as child

pornography. The close timing between the link’s appearance on Bulletin Board A and the

8
click by a user’s IP address is highly relevant: because the link was accessed on the same

day it appeared on Bulletin Board A, it is at least reasonably probable that the user clicked

the link having encountered it on that website.

With this fair assumption, several inferences drop into place to support the

magistrate judge’s decision to issue the warrant. If one assumes, given the close timing,

that the user accessed the link after seeing it on Bulletin Board A, it’s fair to conclude that

the user also knew it contained child pornography, as that much was explicit from the

posting. On top of that, one can fairly conclude that the same person typed the password

posted on Bulletin Board A, downloaded the content, and viewed the video contained at

that URL. For why else would someone who had seen the pornographic stills and read the

description on Bulletin Board A click the link if not to access its contents? Thus, if we

suppose that someone accessed the link through Bulletin Board A, it’s fairly probable that

the same person downloaded or viewed child-pornographic images.

Recall that the magistrate judge knew someone using Bosyk’s home IP address had

clicked the link. Given that fact—and the permissible inferences described above—we

think it was fairly probable that child pornography would be found on computers or other

devices within Bosyk’s property. And because child pornography constitutes contraband

or evidence of a crime, this is all that was needed for probable cause to search Bosyk’s

house. See 18 U.S.C. §§ 2252(a)(4), 2252A(a)(5) (crime to knowingly possess or access

with intent to view any video depicting child pornography); see also, e.g., United States v.

Contreras, 905 F.3d 853, 858 (5th Cir. 2018) (probable cause to search house based on two

child pornography images uploaded to messaging app); United States v. Richardson, 607

9
F.3d 357, 361, 371 (4th Cir. 2010) (same, based on two emailed images); United States v.

Vosburgh, 602 F.3d 512, 526–28 (3d Cir. 2010) (same, based on attempt to download one

video).

We acknowledge that the probability of this particular version of events depends on

the link being clicked after it was posted on Bulletin Board A. The affidavit doesn’t specify

what time on November 2, 2015, the post appeared on Bulletin Board A, meaning that the

link (which was accessed at 3:23 p.m. that day) could have been clicked before its posting. 4

This ambiguity, however, is not as fatal to probable cause as our dissenting colleague

suggests. As his own analysis shows, it was almost twice as likely that the post preceded

the click as the other way around. See Dissenting Op. at 43 (Figure A) (showing more than

64% probability that link was clicked after being posted on Bulletin Board A). Thus, the

much likelier scenario based on the attested facts was that the link was posted and then

accessed hours later (perhaps even sooner) by Bosyk’s IP address. That chronology sets

in motion the series of plausible inferences described above. 5

4
The government has at times represented or implied that the link was clicked after
the post. See, e.g., Appellee’s Br. at 4 (stating that link was posted “less than 24 hours
earlier” than attempted access). Bosyk has never sought to correct this impression; indeed,
his counsel advanced this chronology at oral argument. Oral Arg. at 11:15–11:31 (arguing
that click “on November 2 close after the posting on Bulletin Board A” did not necessarily
evidence knowledge of the password (emphasis added)). Nevertheless, we must “confine
our review to the facts that were before the magistrate judge,” Lyles, 910 F.3d at 791
(quotation omitted), which here do not firmly establish the timeline.
5
It’s true that in this version of events, the likelihood that the user at Bosyk’s IP
address downloaded child pornography hinges on two probabilities combined: first, that he
clicked the link after it appeared on Bulletin Board A, and, second, that (if so) he clicked
the link having seen it on Bulletin Board A. Contrary to our dissenting colleague’s

10
In short, although the search relied on a “single click” of an internet link, the click

was to a video of child pornography in circumstances suggesting the person behind that

click plausibly knew about and sought out that content. We think the magistrate judge

therefore had a substantial basis for concluding that searching Bosyk’s address would

uncover evidence of wrongdoing.

B.

Arguing otherwise, Bosyk and EFF train their sights on the first inference in this

chain of reasoning: that the user at Bosyk’s IP address quite probably knew the link

contained child pornography. They note that Eyler’s affidavit didn’t say whether the link

existed elsewhere on the internet, or whether the site linked at the URL contained content

other than the illegal videos described in the affidavit. And they also point out that the

URL didn’t indicate what it linked to and that, in general, the act of clicking a URL doesn’t

prove familiarity with its contents. We do not find these alleged shortcomings fatal to

probable cause.

Bosyk’s main critique is that the affidavit doesn’t establish whether the user who

clicked on the link accessed it through Bulletin Board A. He and EFF point out that the

suggestion, however, there’s nothing wrong with finding probable cause based on
compound probability—provided, of course, that the probabilities taken together establish
a fair likelihood of criminal conduct. But more fundamentally, we reject the dissent’s
apparent premise—that probable cause is subject to rigid statistical analysis. To the
contrary, the Supreme Court has told us in no uncertain terms that probable cause isn’t
subject to precise articulation but is instead a “commonsense, nontechnical” conception
dealing with “the factual and practical considerations of everyday life on which reasonable
and prudent men, not legal technicians, act.” Ornelas v. United States, 517 U.S. 690, 695
(1996) (internal quotation marks and citation omitted).

11
affidavit doesn’t exclude the possibility that the user might have stumbled upon the link

from another, perhaps innocent, source—especially given how easily and frequently links

are shared over the internet. This is also the essence of our dissenting colleague’s position.

See Dissenting Op. at 44-55.

The problem with this argument, however, is that it demands more proof than is

required to obtain a warrant. Probable cause, as the Supreme Court has reiterated time and

again, “does not require officers to rule out a suspect’s innocent explanation for suspicious

facts.” Wesby, 138 S. Ct. at 588. Instead, the government needs to demonstrate only a fair

probability that contraband or evidence of a crime will be found at the place to be searched.

To be sure, innocent reasons may explain why someone accessed a file sharing page

containing child pornography. Perhaps (as our friend in dissent posits) someone received

the link from a malicious sender, or was looking for innocuous material hosted at the same

filesharing webpage, or truly stumbled upon the URL accidentally. But this is all

conjecture—no facts in the affidavit suggested the link existed anywhere on the internet

but Bulletin Board A. And the possibility that it did doesn’t defeat probable cause when

it’s fairly probable, given the temporal proximity, that the person clicked on the link

because he saw it on Bulletin Board A and wanted to view child pornography. 6

6
For similar reasons, the possibility that the linked filesharing page also contained
innocent material doesn’t destroy probable cause. It is undisputed that clicking this unique
URL led to at least one video of child pornography, so the circumstances nevertheless
warrant suspicion.

12
Indeed, given the nature of the content, we think the magistrate judge had reason to

be skeptical about possible innocent explanations. The notion advanced by EFF and

accepted by our dissenting colleague that a link containing child pornography would spread

throughout the internet like more benign web content seems implausible in light of the

present record and the law’s experience with online pedophiles. As Eyler’s affidavit

explained, people who possess and view child pornography often take steps to conceal their

contraband material, guard it closely, and sometimes delete it to avoid detection. Cases

likewise show that consumers of child pornography frequently employ complex measures

to keep their online activities secret. See, e.g., United States v. McGarity, 669 F.3d 1218,

1230–31 (11th Cir. 2012) (child pornography ring used elaborate system of encryption,

codenames, and hidden instructions to conceal activities from outsiders), abrogated on

other grounds by Paroline v. United States, 572 U.S. 434 (2014); Vosburgh, 602 F.3d at

516–17 (child pornography website used secret gateways and cumbersome links to evade

detection). Thus, the likelihood that a specific filesharing page containing child

pornography would find its way to somebody uninterested in such contraband—thereby

exposing its distributors to detection, capture, and loss of their materials—is probably quite

low.

This point bears emphasis. Our dissenting colleague is of course right that Bosyk’s

IP address could have connected with a link containing child pornography in a variety

(though probably not “millions,” see Dissenting Op. at 44) of different ways. But, contrary

to our friend’s suggestion, these many possible alternative paths aren’t of equal probability;

rather, the likelier avenues incriminate Bosyk.

13
In the first place, the facts involve material that, for reasons just explained, is

unlikely to travel widely outside child pornography circles. On top of that, there is a

suspiciously short interval between such material appearing on a members-only child

pornography forum and being accessed by a user at Bosyk’s IP address. Given these facts,

we believe a magistrate judge could reasonably think it fairly likely—if not most likely—

that the user found the link through Bulletin Board A or otherwise received it knowingly

from a member of that site. See J.A. 169 (explaining that people who possess and view

child pornography may “share information and materials” with one another). Contrary to

our colleague’s suggestion, this belief is not “wholly unsupported speculation,” Dissenting

Op. at 84; rather, it is based on the contents of the affidavit, the magistrate judge’s likely

familiarity with online child pornography crimes, and his ability to reach “common-sense

conclusions about human behavior.” Gates, 462 U.S. 231–32 (quoting United States v.

Cortez, 449 U.S. 411, 418 (1981)).

Bosyk’s and EFF’s other arguments also miss the mark. They focus, for instance,

on the fact that the URL looked like a random string of numbers and letters and therefore

betrayed little about its contents. Certainly, the government could have established

probable cause more easily had the link been clearer about its illicit content. But here, the

URL appeared in a post that described and depicted its contents on the same day that

14
somebody clicked it. This context provides evidence about the probable knowledge and

intent of the user that is otherwise lacking from the face of the URL. 7

EFF and our dissenting colleague’s broader arguments against the inferential value

of URLs merit the same response. They point out that because URLs are often randomly

generated, shortened, or masked, they don’t necessarily reveal their contents to the person

accessing them. Thus, EFF says, that an IP address accessed a URL associated with

contraband doesn’t necessarily provide cause to search property and devices related to that

address. That may often be true, and in a case based purely on an IP address connecting

with a URL, probable cause may be hard to establish absent other incriminating evidence.

But that is not the case before us because such evidence exists here: whoever clicked did

so on the same day that the link was advertised in a closed forum dedicated to child

pornography.

Finally, we are unswayed by the cases Bosyk and EFF rely on. Bosyk draws heavily

from United States v. Reece, an unpublished district court opinion invalidating a warrant

issued as part of the same investigation of Bulletin Board A. See No. 2:16cr104, 2017 U.S.

Dist. LEXIS 220176, at *12–15 (E.D. Va. Mar. 1, 2017). The Reece court held that because

the affidavit (as here) lacked evidence that the defendant subscribed to or accessed Bulletin

Board A, the only possible inference was that he “could have” accessed the video through

that website. Id. at *12–14. That inference, the court said, was “insufficient to support the

7
And, in a different way, the randomness of the URL helps the government, as
internet users aren’t likely to type a truly random string of characters into their web browser
by mistake.

15
resulting search” without the “inferential leap that Defendant must have accessed Bulletin

Board A to navigate to the illicit material.” Id. at *14 (internal quotation marks omitted).

As we have explained, however, the law doesn’t require the government to show that

Bosyk “must have” accessed the video via Bulletin Board A; the fair probability that he

did so is enough to sustain the search. By suggesting otherwise, the Reece court erred.

In any event, Reece is distinguishable because, there, two days passed between the

post on Bulletin Board A and an attempt to access the link. See id. at *5–6. Here, in

contrast, those two events happened on the same day. Whether or not the facts in Reece

supported probable cause, it’s notable that the connection between the suspect and Bulletin

Board A is much closer in this case. Cf. United States v. Evans, No. 16-20292, 2018 WL

1773308, at *3 (E.D. Mich. Apr. 12, 2018) (probable cause to search home when IP address

accessed link within 25 hours of being posted on Bulletin Board A).

Both Bosyk and EFF also refer frequently to the Second Circuit’s divided decision

in United States v. Falso, 544 F.3d 110 (2d Cir. 2008). There, the court invalidated a search

warrant based on allegations that the defendant “appeared” to have “either gained access

or attempted to gain access” to a website associated with child pornography. Id. at 114

(alterations omitted). The majority found that the “inconclusive statements” about whether

the defendant accessed the website, combined with the lack of details about the website

itself, fell short of establishing probable cause. Id. at 121. Concurring in the judgment, 8

8
Judge Livingston nonetheless agreed that the government’s good faith reliance on
the warrant made suppression unnecessary. See 544 F.3d at 113, 125–29 (majority
opinion).

16
Judge Livingston faulted the majority’s probable cause analysis for overlooking that the

defendant’s email address was found on the site, which she (reasonably, in our opinion)

thought “probative evidence that Falso visited that website and either signed up or

attempted to sign up for a membership.” Id. at 130–31 (Livingston, J., concurring in part

and concurring in the judgment).

We decline to follow Falso. That case is distinguishable because there, the affidavit

contained “no allegation that [the defendant] in fact gained access” to a website containing

child pornography, nor any allegation that “images of child pornography were

downloadable from the site.” Id. at 124 (majority opinion). Here, by contrast, the affidavit

alleged that Bosyk’s IP address accessed a URL whose content “consisted of four child

pornography videos.” J.A. 167–68. Thus, the inference that someone at Bosyk’s address

“in fact accessed a website” sharing child pornography—crucially missing from Falso, 544

F.3d at 124—is readily drawn in this case. See Vosburgh, 602 F.3d at 526–27 (probable

cause to search home when IP address clicked link purporting to contain child

pornography); cf. United States v. Martin, 426 F.3d 68, 75–76 (2d Cir. 2005) (probable

cause to search home when email address registered there joined website sharing child

pornography); United States v. Froman, 355 F.3d 882, 890–91 (5th Cir. 2004) (same).

Contrary to the dissent’s suggestion, our opinion is not “at odds” with out-of-circuit

decisions reviewing search warrants based on online encounters with child pornography.

Dissenting Op. at 71. The cases our colleague cites differ factually from this one in

meaningful respects, and therefore aren’t useful precedents. See Ornelas, 517 U.S. at 698.

Still, to the extent our sister circuits have at times emphasized “additional facts . . . over

17
and above the single click of a URL that provides for download of child pornography,”

Dissenting Op. at 71, we are all in tune. Here, an important additional fact is the

abbreviated time frame, which lessens the likelihood that Bosyk’s IP address accessed the

link independently of Bulletin Board A. Accord, e.g., United States v. Gourde, 440 F.3d

1065, 1070 (9th Cir. 2006) (en banc) (suspect’s paid subscription to child pornography

website reduced possibility that visit was accidental).

In sum, the magistrate judge had a substantial basis for finding probable cause to

search Bosyk’s house given two factual allegations—first, the appearance on Bulletin

Board A of a post unambiguously promoting a link containing child pornography videos,

and second, an attempt to access that link on the same day by someone at Bosyk’s address.

The closeness of these two events established a fair probability that child pornography or

evidence of attempts to access it would be found in Bosyk’s house.

IV.

Alternatively, Bosyk argues that even if Agent Eyler’s affidavit established probable

cause to search his house in November 2015 when the link was accessed, it didn’t permit

a search in April 2016 when the warrant issued. “A valid search warrant may issue only

upon allegations of ‘facts so closely related to the time of the issue of the warrant as to

justify a finding of probable cause at that time.’” United States v. McCall, 740 F.2d 1331,

1335–36 (4th Cir. 1984) (quoting Sgro v. United States, 287 U.S. 206, 210 (1932)).

Accordingly, Bosyk argues that the warrant was based on “stale” probable cause, and thus

invalid, because it issued five months after the underlying events took place.

18
The existence of probable cause, however, can’t be determined by “simply counting

the number of days between the occurrence of the facts supplied and the issuance of the

affidavit.” Richardson, 607 F.3d at 370 (quoting McCall, 740 F.3d at 1136). Instead, like

probable cause more generally, staleness is judged based on “all the facts and

circumstances of the case, including the nature of the unlawful activity” and “the nature of

the property to be seized.” Id.

Importantly for this case, when it comes to child pornography, courts have largely

concluded that “even a substantial delay” between download or distribution of child

pornography and the issuance of a search warrant doesn’t render the underlying

information stale. Id. This consensus rests, as we explained in Richardson, “on the

widespread view” that “collectors and distributors of child pornography value their

sexually explicit materials highly, rarely if ever dispose of such material, and store it for

long periods in a secure place, typically in their homes.” Id. (internal quotation marks and

citations omitted); accord United States v. Raymonda, 780 F.3d 105, 114 (2d Cir. 2015)

(staleness inquiry is “unique” in child pornography context); Gourde, 440 F.3d at 1072;

United States v. Riccardi, 405 F.3d 852, 861 (10th Cir. 2005). It also rests, in many cases,

on the fact that digital media files persist for a long time and can often be forensically

recovered even after being “deleted.” See Richardson, 607 F.3d at 370–71; see also United

States v. Seiver, 692 F.3d 774, 775–78 (7th Cir. 2012) (“‘Staleness’ is highly relevant to

the legality of a search for a perishable or consumable object, like cocaine, but rarely

relevant when it is a computer file.”).

19
As a result, in cases involving online child pornography, courts (including ours)

have sustained warrants issued many months, and even years, after the events that gave

rise to probable cause. See, e.g., Contreras, 905 F.3d at 858–59 (warrant sought 11 months

after suspect uploaded two images); Richardson, 607 F.3d at 371 (warrant sought four

months after suspect emailed child pornography); Vosburgh, 602 F.3d at 528 (warrant

sought four months after three attempts to access download link); United States v. Morales-

Aldahondo, 524 F.3d 115, 119 (1st Cir. 2008) (warrant sought three years after last

downloads).

In accordance with these cases, Agent Eyler’s affidavit described the tendency of

“individuals who possess or access with intent to view child pornography” to collect such

material and hoard it for a long time. J.A. 168–69. But Bosyk says the inference that child

pornography will be found months after possession or attempted possession applies only

when the suspect is plausibly a “collector” of child pornography. And, according to Bosyk,

nothing in the affidavit identified him as a “collector.”

We agree with Bosyk to the following extent—the value of this inference “depends

on the preliminary finding that the suspect is a person interested in images of child

pornography.” Raymonda, 780 F.3d at 114 (internal quotation marks omitted). Such a

finding, as the Second Circuit has explained, “tend[s] to negate the possibility that a

suspect’s brush with child pornography was a purely negligent or inadvertent encounter,

the residue of which was long ago expunged.” Id. at 115. Officials may support this

inference with, say, information that the suspect paid for access to child pornography, had

a history of possessing pornographic images, was an admitted or convicted pedophile, took

20
elaborate steps to access illegal content, or distributed content to others. Id. at 114–15

(collecting cases). In each of these cases, it’s possible to infer that the suspect is a collector

of child pornography because of “circumstances suggesting that he had accessed those

images willfully and deliberately, actively seeking them out to satisfy a preexisting

predilection.” Id. at 115.

Where we disagree with Bosyk, however, is in applying these principles. We think

it was possible to infer from the affidavit that whoever clicked on the link did so willfully

and deliberately because he was interested in images of child pornography. Specifically,

as we have already explained, the facts in the affidavit support the inference that somebody

saw the description and video thumbnails on a website devoted to child pornography,

Bulletin Board A, and then deliberately sought out the video by clicking the link. 9 The

magistrate judge could therefore further infer that someone at Bosyk’s home likely

downloaded, stored, and kept that content, since people “with an interest in child

pornography tend to hoard their materials and retain them for a long time.” Vosburgh, 602

F.3d at 528. We therefore find the warrant valid even though it issued five months after

the underlying events took place.

9
That was not so in Raymonda. There, the government sought a warrant based
entirely on the fact that, nine months earlier, an IP address had accessed a webpage
containing thumbnails of child pornography. Nothing suggested that the suspect
discovered the site while searching for child pornography, or that he clicked on the
thumbnails to view the full-size images. 780 F.3d at 117. Rather, the facts were “equally
consistent with an innocent user inadvertently stumbling upon a child pornography
website, being horrified at what he saw, and promptly closing the window.” Id. The
Second Circuit therefore held that the evidence was too stale to create probable cause.

21
V.

Finally, we note that regardless of the warrant’s validity in this case, we would

nonetheless affirm as we may not suppress evidence “obtained in objectively reasonable

reliance on a subsequently invalidated search warrant.” United States v. Leon, 468 U.S.

897, 922 (1984). 10

Bosyk, however, invokes two exceptions that the Supreme Court has carved out of

this rule. First, he argues that the issuing judge “was misled by information in an affidavit

that the affiant knew was false or would have known was false except for [her] reckless

disregard for the truth.” Id. at 923 (citing Franks v. Delaware, 438 U.S. 154 (1978)).

Second, he and EFF maintain that the affidavit was “so lacking in indicia of probable cause

as to render official belief in its existence entirely unreasonable.” Id. (quoting Brown v.

Illinois, 422 U.S. 590, 611 (1975) (Powell, J., concurring)). Neither exception applies.

The first exception is inapplicable because Bosyk doesn’t actually identify any

omitted or misstated facts in Eyler’s affidavit. Instead, he complains that Eyler didn’t note

the absence of certain facts, such as the lack of any allegation that a user at his IP address

was a member of Bulletin Board A, accessed the link through that site, or entered the

password displayed there. But we agree with the government that agents need not include

10
Principles of judicial restraint often support skipping the probable cause question
when Leon bars suppression. But “when a Fourth Amendment case presents a novel
question of law whose resolution is necessary to guide future action by law enforcement
officers and magistrates, there is sufficient reason for [a court] to decide the violation issue
before turning to the good-faith question.” Gates, 462 U.S. at 264 (White, J., concurring)
(italics omitted). As demonstrated by the divergent decisions of district courts, this is one
such case.

22
disclaimers specifically pointing out facts absent from the affidavit to obtain a warrant. A

warrant application is “judged on the adequacy of what it does contain, not on what it lacks,

or on what a critic might say should have been added.” United States v. Allen, 211 F.3d

970, 975 (6th Cir. 2000) (en banc). Here, the affidavit accurately explained that Bulletin

Board A had members, that a URL was posted there, and that an IP address at Bosyk’s

residence accessed the URL. From these facts, along with the absence of other allegations,

the magistrate judge could fairly assess the strength of the government’s evidence.

Our dissenting friend believes the affidavit was materially misleading because, in

his view, most factual material was unrelated to Bosyk and, therefore, served only to lend

the affidavit a false appearance of substance. Dissenting Op. at 90-91 (citing United States

v. Wilhelm, 80 F.3d 116, 123 (4th Cir. 1996)). This is a blinkered reading of the affidavit.

Our colleague apparently believes it “irrelevant,” id. at 90, that Bulletin Board A was a

dedicated child pornography site; that a link appeared on this site next to pornographic

images; and that the link contained videos of a girl being sexually abused. True, these facts

don’t literally “address allegedly unlawful conduct of someone using [Bosyk’s] IP

address.” Id. at 91. But as our analysis above makes plain, they are nonetheless crucial to

understanding why the government believed Bosyk’s home would contain evidence of

criminal activity. These details are hardly irrelevant “puffing.” Contra id.

Neither is the dreaded “boilerplate” about collectors. But see id. at 91-92. This

information drew on accepted case law and served to establish that Bosyk’s computer

would contain child pornography (or at least its remnants) some months after the attempted

access. Our colleague clearly disagrees with us about whether, at the end of the day, the

23
information in the affidavit established probable cause. But he cannot seriously think these

facts are so immaterial to the probable cause inquiry that the sole purpose for their inclusion

was to put one over on the magistrate judge. Cf. Wilhelm, 80 F.3d at 123 (suppressing

evidence when affidavit distracted from lack of probable cause by describing anonymous

informant as “a concerned citizen,” and “a mature person” with a “truthful demeanor”).

Our dissenting colleague would also vacate Bosyk’s conviction because of an

allegedly omitted fact—the exact timing of the post on Bulletin Board A—that isn’t in the

record and, for all we know, may not even exist. Dissenting Op. at 93-94. We cannot do

so. As our colleague well knows, a defendant can’t suppress evidence on grounds that the

affiant intentionally or recklessly omitted facts without first making “a substantial

preliminary showing” to that effect. United States v. Tate, 524 F.3d 449, 454–55 (4th Cir.

2008) (quoting Franks, 438 U.S. at 155–56). And, importantly, that showing requires “a

detailed offer of proof” of the missing information. Id. at 455 (quotation marks omitted);

see also Franks, 438 U.S. at 171 (“Affidavits or sworn or otherwise reliable statements of

witnesses should be furnished, or their absence satisfactorily explained.”). Yet despite

moving for a Franks hearing in the district court, Bosyk never offered proof of any omitted

fact, nor explained why he couldn’t offer such proof. That failure precludes suppression

on the basis of intentional or reckless omissions.

Alternatively, Bosyk argues for suppression because, he says, the affidavit lacked

any indicia of probable cause. This argument also fails. Suppression on such grounds is

“inappropriate” when an affidavit produces “disagreement among thoughtful and

competent judges as to the existence of probable cause.” Leon, 468 U.S. at 926. That’s

24
the case here. District court judges have reasonably disagreed on the constitutionality of

warrants like this one. Compare J.A. 74–79 (probable cause to search home months after

IP address accessed link posted on Bulletin Board A), Evans, 2018 WL 1773308, at *3

(same), and United States v. Seitter, No. 17-10041-JTM, 2017 WL 4516909, at *3–4 (D.

Kan. Oct. 10, 2017) (same), with Reece, 2017 U.S. Dist. LEXIS 220176, at *19–20 (no

probable cause). And, as evidenced by our separate opinions, the judges on this panel are

also divided on the question. In such circumstances, we cannot say that it was objectively

unreasonable for the government to rely on the warrant. Leon, 468 U.S. at 926 (declining

to suppress evidence when court of appeals panel split on probable cause question); Falso,

544 F.3d at 128–29 (same).

Accordingly, even if there hadn’t been probable cause to search Bosyk’s house,

suppression would be inappropriate because the government obtained a warrant and

reasonably relied on it to execute the search. For this independent reason also, we must

affirm the district court’s judgment.

VI.

We are sensitive to the privacy interests at stake here. But we also cannot ignore

that many crimes are committed with just a few clicks of a mouse—including the very

serious crime of downloading child pornography. In cases like this, our job is to ask

precisely what “a single click” reveals under the circumstances presented, and whether that

information justifies searching a person’s most private places for evidence of a crime.

25
Here, the magistrate judge who issued the warrant had a substantial basis for concluding

that it did. For that reason, the district court’s denial of Bosyk’s motion to suppress is

AFFIRMED.

26
WYNN, Circuit Judge, dissenting:

This case presents a textbook example of why we must guard against the slow

whittling away of constitutional rights, particularly as we apply constitutional rights

adopted in an analog era to the new challenges of the digital age.

A basic understanding of the technology at issue demonstrates that the government’s

bare-bones affidavit supporting a warrant to search the residence of Defendant Nikolai

Bosyk (“Defendant”) failed to establish a fair probability that, when clicking on a link to

download child pornography, someone using Defendant’s IP address knew and sought out

that illicit content. Indeed, rather than confronting the difficult technological questions

courts must address in assessing warrant applications premised on online conduct, the

majority opinion rests on analog frameworks that fail to account for the meaningful

differences between the Internet and the physical world. With due respect to my colleagues

in the majority, I believe the majority opinion displays a troubling incomprehension of the

technology at issue in this matter. Accordingly, I respectfully dissent.

I.

This matter arose from the government’s monitoring of Bulletin Board A, an

“Internet-based bulletin board . . . dedicated to the advertisement, distribution and

production of child pornography” with over “1500 ‘approved users.’” J.A. 163–64.

According to an affidavit submitted by the government in support of the challenged

search warrant, the government began “observ[ing] various postings” and “captur[ing]

content” on Bulletin Board A in October 2015. J.A. 164; Gov’t Br. at 4, 5, 13. On

November 2, 2015, a Bulletin Board A member posted on a sub-forum of Bulletin Board

27
A. That post described a particular child pornography video; posted “three different sets

of twenty video thumbnail images” of the video; and included a URL 1 composed of a

largely random sequence of letters and numbers, described in the affidavit alternatively as

“http://[redacted].rar.html” and“http://[redacted].comxu5me9erdipp/brochure.rar.html.” 2

J.A. 49.

The affidavit states that the Bulletin Board A post also provided a password, which

users could input to access the content of the file associated with that unique URL. Gov’t

Br. at 5. Without the password, the file could not be opened and viewed. The affidavit

does not identify at what time on November 2, 2015, the Bulletin Board A member made

the post. And notwithstanding that the government was routinely “observ[ing]” and

“captur[ing]” content on Bulletin Board A at that time, the affidavit does not state whether

the URL and password had previously or subsequently been posted on Bulletin Board A

or elsewhere on the Internet. J.A. 164; Gov’t Br. at 4, 5, 13.

Significant to an understanding of the technology at play in this matter, Bulletin

Board A did not host the URL or the content accessible through the URL. Rather, a wholly

1
A Uniform Resource Locator, or “URL,” “provide[s] Internet users with the ability
to access web addresses” and contains “specific protocol information needed by a web
browser to direct users to a specific image, file, webpage, program, or other resource on
the Internet.” Br. Amicus Curiae Electronic Frontier Foundation in Supp. of Def.–App.
and Reversal (“Amicus Br.”) at 7. Absolute URLs include “(1) a protocol designation, (2)
a root domain or host name or address, and (3) a file path or resource location.” Id.
2
The government represented below that the two URLs reference the same URL,
but that the agent “redacted more of the file name” in paragraph 8 than in paragraph 16 of
the affidavit. J.A. 49. According to the government, the two URLs are “the same in
substance.” Id.

28
independent website “offer[ing] online file hosting and sharing services” (such as

DropBox, Google Drive, or Apple iCloud)—which the affidavit refers to using the

pseudonym “File Sharing Site”—hosted the URL and content. J.A. 165–66; Gov’t Br. at

14. File Sharing Site is also used to store and share lawful content.

To that end, File Sharing Site’s “Terms of Service” expressly prohibit users from

storing or sharing “[p]ornography, nudity, sexual images and any kind of offensive images

or videos.” J.A. 166. According to the affidavit, law enforcement officers nonetheless had

“reason to believe” that File Sharing Site “was used by [Bulletin Board A] members to

store files containing child pornography and make them accessible to other members.” J.A.

165–66; Gov’t Br. at 14. In addition to File Sharing Site, Bulletin Board A members used

“several” other “cloud-based storage services” to store and share files “depicting minors

engaging in sexually explicit conduct.” J.A. 165; Gov’t Br. at 6.

Sometime after the November 2, 2015, post, law enforcement officers monitoring

Bulletin Board A clicked on the URL, navigated to File Sharing Site, and then downloaded

an encrypted video file from File Sharing Site. The officers used the password provided

in the post to open the video file, which depicted child pornography.

Thereafter, the officers obtained an order directing File Sharing Site to disclose

business records pertaining to unique URLs containing files that law enforcement knew to

depict minors engaging in sexually explicit conduct. In response, File Sharing Site

produced the “dates, times, and IP addresses connected to the downloading of the file

content associated with the URLs specified in the application for the Order.” J.A. 167;

Gov’t Br. at 6. These records revealed that at 3:23 pm on November 2, 2015, an IP address

29
associated with Defendant’s residence was “used to download or attempt to download file

content associated with that URL.” J.A. 167–68.

The affidavit does not explain what “download” or “attempt to download” entailed.

The affidavit does not state that Defendant or anyone likely to be using Defendant’s IP

address was a member of Bulletin Board A—or had ever even visited Bulletin Board A—

and the government subsequently conceded that “membership in Bulletin Board A could

not be definitively established.” Gov’t Br. at 30. Nor does the affidavit state whether

someone using Defendant’s IP address ever used the password to open the files hosted and

shared on File Sharing Site.

In addition to describing the Bulletin Board A investigation and someone using

Defendant’s IP address to “download or attempt to download” the child pornography stored

on File Sharing Site, the affidavit does include several paragraphs describing certain

characteristics of “individuals who possess or access with intent to child pornography”—

individuals commonly referred to as “collectors.” J.A. 168–69. But the affidavit does not

state that Defendant or someone likely to be using Defendant’s IP address was a “collector”

of child pornography or exhibited any of the particular behaviors associated with collectors

set forth in the affidavit.

Based on the foregoing information, on April 8, 2016, the magistrate judge issued a

warrant authorizing the government to search Defendant’s residence, including any

electronic devices found therein. On April 12, 2016, law enforcement officers executed

the warrant. A forensic examination of the hard drive of a laptop computer found in

30
Defendant’s residence revealed thousands of images and videos of minor children engaged

in sexually explicit conduct, in folders created from April 14, 2012, to November 18, 2015.

I note that the majority opinion points out that the video available through the File

Sharing Site URL was among the files found on the hard drive of Defendant’s laptop. Ante

at 5–6. But the majority and I agree that fact is irrelevant to the issue at hand because it is

well-settled law that what an illegal search ultimately reveals has no bearing on whether

the evidence the government provided to the magistrate was adequate to establish probable

cause to conduct the search in the first place. Ante at 6 n.2. See United States v. Ramirez,

523 U.S. 65, 71 (1998) (“[I]n determining the lawfulness of entry and the existence of

probable cause we may concern ourselves only with what the officers had reason to

believe at the time of their entry.” (citation omitted) (emphasis in original)); United States

v. Di Re, 332 U.S. 581, 595 (1948) (“We have had frequent occasion to point out that a

search is not to be made legal by what it turns up. In law it is good or bad when it starts

and does not change character from its success.” (citation omitted)); Byars v. United States,

273 U.S. 28, 29–30 (1927) (“Nor is it material that the search was successful in revealing

evidence of a violation of a federal statute. A search prosecuted in violation of the

Constitution is not made lawful by what it brings to light; and the doctrine has never been

recognized by this court, nor can it be tolerated under our constitutional system, that

evidences of crime discovered by a federal officer in making a search without lawful

warrant may be used against the victim of the unlawful search where a timely challenge

has been interposed.”); A.M. v. Holmes, 830 F.3d 1123, 1139 (10th Cir. 2016) (“Neither

the officer’s subjective beliefs nor information gleaned post-hoc bear on this inquiry.”

31
(emphasis added)); McColley v. Cty. of Rensselaer, 740 F.3d 817, 841 n.3 (2d Cir. 2014)

(“Probable cause is not backward looking. Thus, the results of a search are immaterial to a

determination of whether the search was supported by probable cause.”); United States v.

Sims, 553 F.3d 580, 583 (7th Cir. 2009) (“[T]here is a practical reason for requiring

warrants where feasible: it forces the police to make a record before the search, rather than

allowing them to conduct the search without prior investigation in the expectation that if

the search is fruitful a rationalization for it will not be difficult to construct, working

backwards.” (citation omitted)).

On October 17, 2017, the government filed a criminal complaint against Defendant,

alleging one count of receipt of child pornography in violation of 18 U.S.C. § 2252(a)(2).

Homeland Security Investigations Special Agent Kristina Eyler submitted an affidavit in

support of the complaint, averring that Defendant’s IP address was “associated with a user

attempting to download child pornography on Bulletin Board A.” J.A. 11. Put differently,

Special Agent Eyler’s affidavit represented, without qualification, that someone using

Defendant’s IP address “attempt[ed] to download child pornography on Bulletin Board A,”

id. (emphasis added), not File Sharing Site.

On December 14, 2017, a grand jury issued an indictment charging Defendant with

one count of receipt of child pornography in violation of 18 U.S.C. § 2252(a)(2) and (b)(1)

and one count of possession of child pornography in violation of 18 U.S.C. § 2252(a)(4)(B)

and (b)(2). On January 3, 2018, Defendant filed a motion to suppress all evidence seized

during the April 12, 2016, search as well as the fruits of that search. Defendant’s motion

to suppress argued, in part, that the affidavit provided insufficient evidence to establish

32
probable cause to search Defendant’s residence because it failed to establish a fair

probability that someone using Defendant’s IP address navigated through the URL posted

on Bulletin Board A to the contraband stored on File Sharing Site. See, e.g., J.A. 27 (“The

instant affidavit contains no information or contentions as to [Defendant]’s involvement,

access, or membership to Bulletin Board A. In fact, the affidavit makes no contention that

the subject URL, purportedly containing child pornography, could have only been accessed

through Bulletin Board A.”).

In its opposition to Defendant’s motion to suppress, the government claimed that

the affidavit did, in fact, connect Defendant’s IP address to the Bulletin Board A post given

“the close proximity in time between the posting at Bulletin Board A and attempt to

download its child pornographic content.” J.A. 45 (emphasis added). By characterizing

the content as the property of Bulletin Board A—not as content stored by File Sharing

Site—the government invited the district court to not draw a distinction between Bulletin

Board A and File Sharing Site, notwithstanding that the affidavit connected Defendant’s

IP address with only File Sharing Site, not Bulletin Board A.

Additionally, an unstated, but essential, premise of the government’s temporal

proximity argument was that someone using Defendant’s IP address attempted to download

the child pornography from File Sharing Site after the Bulletin Board A post prompting

the investigation—a premise that the government invited the district court to indulge by

relying on a case in which a district court found probable cause to issue a warrant when the

allegations in the affidavit established that the download of contraband occurred soon after

a link to the contraband was posted to a child pornography message board. See J.A. 45

33
(citing United States v. Evans, 2:16-cr-20292, Doc. No. 69, report and recommendation, at

14 (E.D. Mich. Nov. 20, 2017). The government further rejected Defendant’s argument

that the File Sharing Site URL “could have been accessed through innocent means”

because “there was no reason for the agent to believe the link was available anywhere other

than on Bulletin Board A.” J.A. 44–45.

On February 2, 2018, the district court denied Defendant’s suppression motion.

Ruling from the bench, the district court accepted the key factual premises relied on by the

government to connect Defendant’s IP address with Bulletin Board A:

What is clearly in the affidavit is that Bulletin Board A is a dedicated bulletin
board to advertising distribution and production of child pornography and
that it therefore, already anybody who might be on that site, there would be
a reasonable belief that that person was interested in accessing that kind of
information.

Then there was the posting of that particular section [of Bulletin Board A]
that was clearly advertising video clips of what would absolutely be
unequivocally child pornography, and the critical fact . . . is that the same
day that posting went up, the URL that is linked—or the IP address that is
linked to a computer in the defendant’s home . . . attempts to or at least shows
an interest in [Bulletin Board A]. In my view, that’s enough for probable
cause to believe that there would be a computer in that residence that would
have child pornography on it.

J.A. 76–77. In other words, in accordance with the government’s invitation, the district

court drew no distinction between Bulletin Board A and File Sharing Site and presumed

that someone using Defendant’s IP address clicked on the URL navigating to the child

pornography stored on File Sharing Site after seeing the URL posted on Bulletin Board A.

But the majority maintains that it is “unclear” whether the district court was

referring to Bulletin Board A or File Sharing Site because the district court could have been

34
referring to File Sharing Site, rather than Bulletin Board A when it referred to “both the

‘posting’ and ‘the URL that is linked.’” Id. That reading is simply implausible. Clearly,

the district court did not refer to the Bulletin A Board “posting” and the “URL that is

linked” as two separate websites, i.e., Bulletin Board A and File Sharing Site. Instead, the

district court stated that on the “same day that posting went up, the URL that is linked—or

the IP address that is linked to a computer in the defendant’s home . . . attempts to or at

least shows an interest in that particular site.” J.A. 76–77 (emphases added). The district

court therefore considered both the “posting” and the “URL that is linked,” on Bulletin

Board A, to be referencing a single website: Bulletin Board A. The district court discussed

the URL only in the context of it being linked on Bulletin Board A, rather than it being

hosted by File Sharing Site. Accordingly, the district court incorrectly assumed that

Defendant’s IP address demonstrated an interest in Bulletin Board A.

In short, the district court did not expressly contemplate the possibility that someone

using Defendant’s IP address navigated to the URL by any means other than the Bulletin

Board A post. Defendant timely appealed the denial of his suppression motion.

II.

The Fourth Amendment protects “[t]he right of the people to be secure in their

persons, houses, papers, and effects, against unreasonable searches and seizures.” U.S.

Const. amend. IV. It represents the Framers’ “response to the reviled ‘general warrants’

and ‘writs of assistance’ of the colonial era, which allowed British officers to rummage

35
through homes in an unrestrained search for evidence of criminal activity.” Riley v.

California, 573 U.S. 373, 403 (2014).

Recognizing that the advent of new technology—like the Internet and the ability to

store vast amounts of information in small electronic devices—“enhance[s] the

Government’s capacity to encroach upon areas normally guarded from inquisitive eyes,”

the Supreme Court has rejected “‘mechanical interpretation[s]’” of the Fourth Amendment

that would allow the government to “capitalize” on such technology to invade the

reasonable expectations of privacy and security protected by that Amendment. Carpenter

v. United States, 138 S. Ct. 2206, 2214 (2018) (quoting Kyllo v. United States, 533 U.S.

27, 35 (2001)). Rather, when applying the Fourth Amendment in the context of new or

advancing technology—like the URL click at issue in this case—courts must seek to

“assure [] preservation of that degree of privacy against government that existed when

the Fourth Amendment was adopted.” Id. (quoting Kyllo, 533 U.S. at 34).

In doing so, courts must keep in mind at least two basic Fourth Amendment

“guideposts”—that the Amendment seeks “to secure the privacies of life against arbitrary

power” and “to place obstacles in the way of a too permeating police surveillance.” Id.

(internal quotation marks and citations omitted). That is particularly true when, as here,

the government seeks authority to search a home because, “when it comes to the Fourth

Amendment, the home is first among equals.” Florida v. Jardines, 569 U.S. 1, 6 (2013).

“Although the text of the Fourth Amendment does not specify when a search

warrant must be obtained,” the Supreme Court repeatedly has recognized that “‘[i]t is a

basic principle of Fourth Amendment law . . . that searches and seizures inside a home

36
without a warrant are presumptively unreasonable.’” Kentucky v. King, 563 U.S. 452, 459

(2011) (quoting Brigham City v. Stuart, 547 U.S. 398, 403 (2006)). Warrants are

“constitutionally sound when issued by a neutral magistrate and supported by probable

cause.” United States v. Montieth, 662 F.3d 660, 664 (4th Cir. 2011); see U.S. Const.

amend. IV. The government bears the burden of demonstrating probable cause to support

a search warrant. See, e.g., id. at 665; Walczyk v. Rio, 496 F.3d 139, 161 (2d Cir. 2007);

United States v. Abboud, 438 F.3d 554, 569 (6th Cir. 2006).

To determine whether a warrant is supported by probable cause, a magistrate must

“make a practical, common-sense decision whether, given all the circumstances set forth

in the affidavit[,] . . . there is a fair probability that contraband or evidence of a crime will

be found in a particular place.” Illinois v. Gates, 462 U.S. 231, 238 (1983). When a

magistrate judge issues the challenged warrant, this Court must determine “whether the

magistrate judge had a ‘substantial basis’ for finding probable cause.” United States v.

Lyles, 910 F.3d 787, 791 (4th Cir. 2018). Accordingly, the question before this Court is

whether, based on the information set forth in the affidavit, the magistrate judge had a

“substantial basis” for finding that there was a “fair probability” that contraband or

evidence of a crime would be found within Defendant’s residence.

A.

37
The majority opinion concludes—and I agree—that even a “single click” of an

internet link to download 3 child pornography can provide probable cause to support a

search warrant if the facts set forth in the warrant application establish that “the person

behind that click plausibly knew about and sought out that content.” Ante at 11. According

to the majority opinion, the affidavit established that someone using Defendant’s IP address

“plausibly knew” that the URL linked to child pornography because the November 2, 2015,

post on Bulletin Board A, in which a copy of the URL appeared, “contain[ed] text and

images that unequivocally identified its contents as child pornography.” Id. at 8. The

majority opinion’s finding of probable cause, therefore, rests entirely on the premise that

the affidavit established a fair probability that someone using Defendant’s IP address

“clicked the link having encountered it on [Bulletin Board A].” Id. at 9.

That factual premise finds no direct support in the materials considered by the

magistrate judge in granting the warrant. The affidavit does not assert that Defendant, or

someone likely to be using Defendant’s IP address, was a member of Bulletin Board A.

Indeed, the government conceded that it could not establish whether Defendant or someone

using his IP address was a member of Bulletin Board A. Gov’t Br. at 30.

The affidavit also does not provide any direct evidence that Defendant or someone

using Defendant’s IP address had ever visited Bulletin Board A. On the contrary, the

3
I take no position on whether evidence that someone using a particular IP address
clicked on a link navigating to a website that displays child pornography—as opposed to a
link to download child pornography—can provide probable cause to search a residence
associated with that IP. See United States v. Falso, 544 F.3d 110, 124 (2d Cir. 2008).

38
government conceded before the district court that because Bulletin Board A “was only

accessible on the dark web via a special web-browser called TOR,” it could not provide an

electronic record establishing whether Defendant’s IP address ever visited Bulletin Board

A. J.A. 37–38.

Instead of relying on direct evidence, the government contends, as it did before the

district court, that circumstantial evidence makes it fairly probable that someone using

Defendant’s IP address navigated through the Bulletin Board A post to attempt to download

the child pornography hosted by File Sharing Site. In support of that argument, the

government’s brief makes several representations.

First, the government repeatedly represents that the post appeared on Bulletin Board

A before someone using Defendant’s IP address sought to access the child pornography

stored by File Sharing Site. Gov’t Br. at 4 (“On November 2, an IP address that resolved

back to [Defendant]’s residence was recorded to trying to access a link containing child

pornography that had been posted on Bulletin Board A less than 24 hours earlier.”

(emphasis added)); id. at 30 (“The short duration from when the link appeared on Bulletin

Board A until someone at the defendant’s residence clicked on the link established a fair

probability that the link had been accessed through Bulletin Board A.” (emphases added)).

Second, the government represents that the “link . . . originated on a dark web forum

dedicated to sharing child sexual abuse content,” id. at 10–11 (emphasis added), meaning

Bulletin Board A. See also id. at 9 (“Probable cause existed to search [Defendant]’s home

on April 12, 2016, because law enforcement determined that a computer at [Defendant]’s

residence accessed a link to downloadable child pornography, which originated on a

39
website that caters to individuals seeking child pornography.” (emphasis added)). That

“originat[ion]” contention serves to reinforce the government’s assertion that someone

using Defendant’s IP address attempted to download the child pornography from File

Sharing Site after encountering the URL on Bulletin Board A—if the URL “originated” on

Bulletin Board A, then someone using Defendant’s IP address had to have clicked on the

URL after it appeared on Bulletin Board A.

For two principal reasons, the government’s temporal proximity argument fails to

establish a fair probability that someone using Defendant’s IP address navigated to the

URL via the post in Bulletin Board A. First, the government’s temporal proximity

argument rests on the “critical fact” that someone using Defendant’s IP address clicked on

the URL after the post containing the URL appeared on Bulletin Board A—a premise that

the government repeatedly asserted in its briefing and argument to the district court and

this Court. But if that “critical fact” lacks support—if the click on the URL occurred before

the post on Bulletin Board A—then the person using Defendant’s IP address could not have

encountered the URL on Bulletin Board A, and therefore could not have viewed the text

and images in the Bulletin Board A post indicating the URL linked to child pornography.

That is the case. Contrary to the government’s repeated representations in its

briefing, the affidavit does not assert, much less establish, that someone using Defendant’s

IP address clicked the URL after the post containing the URL appeared on Bulletin Board

A. On the contrary, whereas the affidavit reports the time someone using Defendant’s IP

address clicked on the File Sharing Site URL—3:23 pm on November 2, 2015—it does not

report at what time that day the post first appeared on Bulletin Board A. Rather, it simply

40
states that the post appeared on Bulletin Board A sometime on November 2, 2015.

Accordingly, the post could have appeared on Bulletin Board A anytime within a window

of 8 hours, 37 minutes after someone using Defendant’s IP address downloaded or

attempted to download the child pornography from File Sharing Site.

Significantly, notwithstanding that the government represented to both this Court

and the district court that—as a matter of fact, not inference—the Bulletin Board A post

appeared before someone using Defendant’s IP address attempted to download the child

pornography from File Sharing Site, the affidavit nowhere addressed whether the

government knew, or could have known, the time of the Bulletin Board A post as a result

of its ongoing observation and capturing of content on Bulletin Board A. Gov’t Br. at 13.

Indeed, the government never has explained to this Court or the district court why the

repeated representations in its briefing as to the sequence of events does not find direct

support in the facts set forth in the affidavit it submitted with the warrant application. Of

course, in assessing probable cause, we do not look to the representations the government

makes after the fact, but the facts the government presented to the magistrate.

Because the government’s circumstantial causation argument rests on the attempted

download from File Sharing Site occurring after the post appeared on Bulletin Board A,

the government’s failure to establish that sequence of events fatally undermines its effort

to rely on temporal proximity as a circumstantial basis for proving that someone using

Defendant’s IP address navigated to the URL through Bulletin Board A.

Notwithstanding this fatal flaw, the majority opinion accepts the government’s

temporal proximity argument—and the government’s crucial factual representations

41
underlying that argument—hook, line, and sinker. Although the majority recognizes that

the affidavit does not establish whether the Bulletin Board A post preceded the “attempted

download” by someone using Defendant’s IP address, it nevertheless contends that the

“critical fact” supporting probable cause is “[t]he close timing between the link’s

appearance on Bulletin Board A and the click by a user’s IP address.” Ante at 8–9

(emphasis added). According to the majority, “because the link was accessed on the same

day it appeared on Bulletin Board A, it is at least reasonably probable that the user clicked

the link having encountered it on that website.” Id. at 9. Yet, even as it acknowledges that

the affidavit failed to establish the “critical fact” supporting its theory of probable cause,

the majority opinion nevertheless accepts that theory wholesale. See id. at 10 (“That

chronology [of the URL click following the Bulletin Board A post] sets in motion the series

of plausible inferences described above.”).

Notably, the majority opinion distinguishes that “critical fact”—that the click

occurred after the appearance of the Bulletin Board A post—from the “inferences” it draws

from that fact—most notably, that someone using Defendant’s IP address encountered the

link in the Bulletin Board A post, not via some other electronic pathway. Ante at 8–9, 12

(reasoning that “it’s fairly probable, given the temporal proximity, that the person clicked

on the link because he saw it on Bulletin Board A and wanted to view child pornography”

(emphasis added)). Put differently, rather than relying on an inference from an established

fact, the majority opinion impermissibly draws inferences on inferences to uphold the

warrant. See Rosencranz v. United States, 356 F.2d 310, 317 (1st Cir. 1966) (noting that a

magistrate may not “reach for external facts and . . . build inference upon inference in order

42
to create a reasonable basis for his belief that a crime is presently being committed”). The

majority opinion therefore improperly draws an inference of causality based on a sequence

of events the government failed to establish. See Figure A (illustrating the 35.9%

probability that the Bulletin Board A post followed the IP address’s click of the URL).

Figure A

But that is not the only flaw with the temporal proximity argument advanced by the

government and embraced by the majority opinion. The government’s temporal proximity

argument also rests on the wholly unsupported premise that—even if someone using

Defendant’s IP address had clicked on the File Sharing Site URL after the post appeared

on Bulletin Board A (which, again, the affidavit does not establish)—the user navigated to

the URL through the post appearing on Bulletin Board A. Indeed, the facts set forth in the

affidavit fail to address, much less rule out, a multitude of ways someone using Defendant’s

IP address could have navigated to the File Sharing Site URL without encountering the

43
URL on Bulletin Board A, and therefore without observing the text and images that would

have put that person on notice of the download link’s content. The majority nowhere

meaningfully contemplates the significance of this internet technology in our role to assess

probable cause.

To begin, users can encounter URLs, or hyperlinks to URLs, 4 in myriad ways—

including through websites, emails, chats, text messages, comment threads, discussion

boards, File Sharing Sites (such as DropBox, Google Drive, or Apple iCloud), tweets,

Facebook posts, Instagram captions, Snapchat messages, embedded images or videos,

unwanted pop-up windows, any combination thereof, or by any other digital means. And

because a URL, or a hyperlink to a URL, can be copied with only a click of a button, a

single URL can be copied and further disseminated through any or all of these ways

millions of additional times, often in a matter of seconds.

Thus, it is no exaggeration to state that URLs, or hyperlinks to URLs, can be posted

and disseminated millions of times anywhere by anyone. Take for example, the trailer for

the movie Avengers: Endgame—which was shared through multiple online platforms such

as YouTube, Facebook, and Twitter—was viewed 289 million times in the first 24 hours

after it was posted online. Todd Spangler, ‘Avengers: Endgame’ Trailer Smashes 24-Hour

Video Views Record, Variety (Dec. 8, 2018, 11:02 a.m.),

4
“The definition of a hyperlink is text or an image within a file on your computer
that you can click on that gives access to another document or image. Words on a website
that are underlined and highlighted in blue and that you can click on in order to open a new
web page are an example of a hyperlink.” Berkson v. Gogo LLC, 97 F. Supp. 3d 359, 373
n.2 (E.D.N.Y. 2015) (citation omitted).

44
https://variety.com/2018/digital/news/avengers-endgame-record-trailer-worldwide-24-

hour-views-1203085074; see also Crosby v. Twitter, Inc., 921 F.3d 617, 625 (6th Cir.

2019) (citing sources observing that “third parties upload 300 hours of content to YouTube

every minute” and Twitter “boasts hundreds of millions of users . . . with over 500 million

tweets per day . . . [or] 6,000 tweets per second” (citations omitted)); Chloe Taylor, A

Japanese Billionaire Now Has Most Retweeted Tweet Ever After Offering a $923,000

Prize, CNBC (Jan. 7, 2019) (reporting that a single tweet—only one of the numerous online

vehicles for sharing a URL—was retweeted nearly five million times in a two-day period),

https://www.cnbc.com/2019/01/07/yusaku-maezawa-has-most-retweeted-tweet-ever-

after-offering-923000.html. In this matter, none of the facts alleged in the affidavit rule

out any of these potentially millions of alternative paths—wholly unconnected to the

Bulletin Board A post—through which someone using Defendant’s IP address could have

encountered the URL navigating to the child pornography on File Sharing Site. 5

5
Relatedly, the content to which a URL navigates and the link itself could
“originate[]” in numerous places. Because electronic content often can be easily duplicated
and stored, content that first appears at one URL may appear, in short order or over a longer
time horizon, at numerous other URLs and may be stored on numerous other servers.
Therefore, just because a URL, or a hyperlink to a URL, appears on one webpage, like
Bulletin Board A, does not mean that the content associated with that URL first appeared
on the webpage. For this reason, the government’s repeated representation that the child
pornography hosted on File Sharing Site “originated” on Bulletin Board A finds no support
in the affidavit, which establishes only that a URL navigating to at least one website hosting
the content, File Sharing Site, appeared on Bulletin Board A. It is entirely consistent with
the facts set forth in the affidavit that the child pornography originated some place other
than Bulletin Board A, meaning that the affidavit provides little factual support for the
government’s theory of causation—that someone using Defendant’s IP address likely
learned of the child pornography through Bulletin Board A. Indeed, that the child
pornography videos at issue were hosted on File Sharing Site—not Bulletin Board A—

45
Additionally, users can navigate to a URL in numerous ways beyond clicking on a

link included in a post on a particular webpage, like Bulletin Board A. For example, a user

could click on a copy of the URL posted to another website, click on a bookmark, type the

URL directly into a browser’s navigation bar, or click a hyperlink in an email or a news

article, to name only a few. See generally Amicus Br. at 8. That is particularly true when

the URL navigates to a site on the normal Internet, like File Sharing Site, as opposed to a

site, like Bulletin Board A, that can only be reached using a specialty browser, like Tor.

The majority opinion maintains that the “randomness of the URL” in this case—

which contains a string of letters and numbers with no discernible pattern or meaning—

“helps the government, as internet users aren’t likely to type a truly random string of

numbers and letters into their web browser by mistake.” Ante at 15 n.7. That assertion—

that someone using Defendant’s address typed the URL into a web browser—contradicts

the probable cause theory advanced by the government and otherwise relied on in the

majority opinion—that someone using Defendant’s IP address intentionally clicked on the

URL in the Bulletin Board A post because they believed it led to child pornography.

Additionally, the randomness of the URL weighs against a finding of probable

cause because it increases the likelihood that someone using Defendant’s IP address

clicked on the URL without knowing the content to which it navigated. Even assuming

the user actually saw the URL—which, as explained below, is not necessarily the case—

the random sequence of letters and numbers would provide a user with no indication that

provides evidence that the child pornography—a link to that child pornography—did not
“originate[]”]” on Bulletin Board A.
46
the URL navigated to child pornography. And most significantly, the majority opinion’s

myopic focus on one method of navigating to a URL—typing the URL into a browser—

again ignores the multitude of other equally plausible—and likely far more plausible—

ways someone using Defendant’s IP address could have navigated to URL, none of which

ways the facts set forth in the affidavit rule out.

Importantly, users can unintentionally navigate to URLs because—as is the case

with the URL clicked by someone using Defendant’s IP address—URLs frequently do not

provide any external indication of the content to which they navigate. For example,

services like YouTube and DropBox generate random URLs that provide no information

about their underlying content. Amicus Br. at 10. Other services, like Bitly, TinyURL,

and Perma shorten URLs, which may otherwise provide external indicators of their content,

to generic URLs that include a standard URL base, such as “https://bit.ly/,”

“https://tinyurl.com/,” or “https://perma.cc/,” followed by a random string of alphanumeric

characters. See generally Robin Camille Davis, The Future of Web Citation Practices, 35

Behav. & Soc. Sci. Libr. 128–34 (2016) (explaining different URL shortening services).

Such generic URLs offer no indication of the content to which they navigate.

Link shortening and disguising often serve beneficial purposes by, for example,

permitting distribution of password-protected files, facilitating the sharing of less clunky

links, or permitting simpler citation styles. And link shortening and disguising can serve

other innocuous purposes. URL spoofing, for example, permits one user to disguise a

hyperlink as directing to specific content or a particular website, while in reality directing

the unwitting user to a distinct website altogether. See Amicus Br. at 12.

47
One humorous form of URL spoofing is “rickrolling,” one of the “Internet’s oldest

memes,” in which individuals click on a link “expecting one thing” but are instead led to

“a video of Rick Astley singing ‘Never Gonna Give You Up.’” Abby Ohlheiser, I Can’t

Believe This Is Why People Are Tweeting Fake Celebrity News, Wash. Post (Oct. 18, 2018),

https://www.washingtonpost.com/technology/2018/10/18/i-cant-believe-this-is-why-

people-are-tweeting-fake-celebrity-news/?utm_term=.e9c493b7234d. The unsuspecting

individual who follows the disguised URL is said to be “rickrolled.” In fact, “rickrolling”

has become such a mainstream online practice that in the lead-up to the 2018 midterm

elections, an online campaign aimed to “rick roll” unregistered voters into registering to

vote. Id.

As the Washington Post described, doing so was easy:

First, create a link to vote.org (or whatever else you want to trick people into
visiting) using a link shortener such as bit.ly. Bit.ly works pretty simply: You
enter in a URL, and the site spits out a shorter version. It’s a relic from a time
when URL length counted toward characters on Twitter but is now used to
hide the original source of links.

Id. Then, “choose the right piece of gossip,” such as news of a celebrity couple split, and

tweet out an attention-grabbing headline alongside the disguised Bit.ly link leading to the

voter registration website. Id. Thus, with a few clicks, anyone—even users with no

advanced computational skills—can disguise a link and lure an unsuspecting user to click

that link. In such circumstances, the user would learn of the content to which the URL

navigates only after clicking on the link.

But link shortening and disguising are also used for malicious purposes. URL

spoofing can enable “phishing,” which redirects a user to a facially legitimate, but fake,

48
website in order to steal the user’s personal information. A “decent fake website,” which

a “phisher” can set up with little difficulty, provides the phisher with complete access to

the user’s information and computer without “expensive and detectable malware.” Quinn

Norton, Phishing Is the Internet’s Most Successful Con, Atlantic (Sept. 12, 2018),

https://www.theatlantic.com/technology/archive/2018/09/phishing-is-the-internets-most-

successful-con/569920; see also Jonnelle Marte, Can You Tell the Real TurboTax Email

from the Scam?, Wash. Post (Mar. 1, 2016), https://www.washingtonpost.com/news/get-

there/wp/2016/03/01/can-you-tell-which-of-these-turbotax-emails-is-real-and-which-one-

is-from-a-scam-artist/?utm_term=.7ba2976355cb.

Of particular relevance, bad actors can, and have, innocuously disguised links to

child pornography and then sought to extort internet users who inadvertently navigate to

the child pornography by clicking on the disguised links. See, e.g., Adam Levin, The 5

Deadly Clicks: The Links You Should Never Touch, ABC News (Oct. 6, 2013),

https://abcnews.go.com/Business/links-click/story?id=20461918 (detailing a Russia-based

extortion scheme in which unsuspecting users clicked a link to child pornography). Again,

none of the facts in the affidavit address, much less rule out, the numerous possible ways

in which someone using Defendant’s IP address could have unintentionally navigated to

the File Sharing Site URL hosting the child pornography.

The majority opinion adverts to one of the many alternative paths through which

someone using Defendant’s IP address could have navigated—intentionally or

unintentionally—to the File Sharing Site URL, acknowledging that Defendant’s IP address

may have “received [the link] knowingly from a member of [Bulletin Board A],” rather

49
than “f[i]nd[ing] the link through Bulletin Board A.” Ante at 13. But the majority opinion

fails to recognize that this alternative path, by itself, materially undermines its theory of

probable cause. If someone using Defendant’s IP address did not encounter and navigate

to the File Sharing Site URL through the Bulletin Board A post, then that person did not

have an opportunity to observe the text and pictures in the post indicating the nature of the

content to which the URL navigated. As the majority opinion concedes, absent a fair

probability that someone using Defendant’s IP address “clicked the link knowing that it

contained child pornography”—which would not necessarily be the case if Defendant

“received [the link] knowingly from a member of [Bulletin Board A]”—then there is no

basis to find probable cause. Ante at 8, 14.

In sum, there are myriad ways users can encounter and navigate to a URL—

including unintentionally, particularly when, as here, the text of the URL provides no

indication as to the nature of the content to which it navigates. Accordingly, even if the

Bulletin Board A post preceded the attempt by someone using Defendant’s IP address to

download child pornography from File Sharing Site—again, a fact not established by the

affidavit—there are potentially millions of paths through which someone using

Defendant’s IP address could have encountered and navigated to the File Sharing Site URL

hosting the child pornography other than through Bulletin Board A. Put simply, the

affidavit does not establish the probability of the single sequence of events upon which the

majority opinion relies—that someone using Defendant’s IP address navigated to the File

Sharing Site URL after encountering it on Bulletin Board A. See Figure B (contrasting the

majority opinion’s myopic focus on one pathway between Defendant’s IP address and the

50
File Sharing Site URL with the myriad pathways, only some of which are reflected by the

dashed lines, consistent with the affidavit).

Figure B

The majority acknowledges that the probability of the IP address accessing the URL

through Bulletin Board A “depends on the link being clicked after it was posted on Bulletin

Board A” and that the affidavit does not specify the timing of the Bulletin Board A post.

Ante at 10. But, in the majority’s view, the “ambiguity” regarding the timing of the Bulletin

Board A post is not fatal to a probable cause finding because it “was still almost twice as

likely that the post preceded the click as the other way around.” Id. (citing Figure A).

51
Therefore, the majority opinion maintains, “the much likelier scenario” was that the

Bulletin Board A post preceded the URL click and was therefore accessed by Defendant’s

IP address through Bulletin Board A. Id. at 10.

However, the majority’s analysis ignores that the probability that the Bulletin Board

A post preceded the File Sharing Site URL click is only one of several layers of uncertainty

governing the likelihood that someone using Defendant’s IP address accessed the File

Sharing Site URL through the Bulletin Board A post. Put simply, assessing whether it is

fairly probable that Defendant’s IP address navigated to the URL via Bulletin Board A

involves a compound probability, 6 governed by the probabilities of at least two

independent events: first, whether the Bulletin Board A post preceded the URL click, and

second, whether Defendant’s IP address encountered the URL through the Bulletin Board

A post. Stated formulaically,

P{Navigated to URL via = P{Bulletin Board A Post
Bulletin Board A} Preceded Click} *
P{Encountered Link on Bulletin
Board A}

0.641x = .641 * x

x≤1

6
Compound probability is a “mathematical term relating to the likeliness of two
independent events occurring” and is “equal to the probability of the first event multiplied
by the probability of the second event.” Compound Probability, Investopedia (Apr. 29,
2019), http://www.investopedia.com/terms/c/compound-probability.asp.

52
As to the first event, there is a 64 percent chance that the Bulletin Board A post

temporally preceded the URL click. See supra Figure A. And as to the second event—

whether Defendant’s IP address accessed the File Sharing Site URL through the Bulletin

Board A post—the affidavit provides no facts that in any way circumscribe the massive

universe of paths someone using Defendant’s IP address could have taken to the URL,

meaning that that probability, under the facts set forth in the affidavit, is necessarily

vanishingly small. See Figure C.

Figure C

53
Without additional facts further limiting the universe of possibilities, we cannot

know whether it is fairly probable that the IP address encountered the URL through

Bulletin Board A. All but one of these potentially millions of the paths to the File Sharing

Site URL do not involve the factual scenario that the majority opinion, at the government’s

urging, credulously accepts—that someone using Defendant’s IP address encountered the

URL in the November 2, 2015, post on Bulletin Board A and, using the link in that post,

sought to download the child pornography shared on File Sharing Site.

The majority opinion glosses over these myriad alternative paths of accessing the

URL because in its view, these “aren’t of equal probability; rather, the likelier avenues

incriminate [Defendant].” Ante at 13. The majority opinion claims that the “avenue[]”

advanced by the government—that someone using Defendant’s IP address clicked on the

File Sharing Site URL after encountering it in the Bulletin Board A post—is “likelier”

because the “likelihood that a specific filesharing page containing child pornography would

find its way to somebody uninterested in such contraband . . . is probably quite low.” Id.

But the majority opinion identifies no facts in the affidavit supporting its bald

assertion that it is unlikely that a user would innocently access child pornography. Instead,

it first cites to the affidavit’s boilerplate language regarding the characteristics of

individuals who “collect” child pornography. The Fourth Amendment permits courts to

rely on “the affiant-officer’s experience” and knowledge regarding given crimes only when

the affidavit contains sufficient evidence linking an individual to that crime. Wayne R.

LaFave, 2 Search & Seizure § 3.7(d) (5th ed. 2018). For example, because it is “merely

54
common sense that a drug supplier will keep evidence of his crimes at his home,” at least

one court has found that informant statements, as well as corroborating record evidence,

setting forth “sufficient evidence” that a defendant was a drug supplier supported probable

cause to search the supplier’s home. United States v. Sanchez, 555 F.3d 910, 914 (10th

Cir. 2009). But when individualized information connecting an individual to a crime is

absent, an affiant—much less a court—cannot rely on generalized, boilerplate assumptions

about criminal habits. See United States v. Underwood, 725 F.3d 1076, 1082–83 (9th Cir.

2013) (concluding that a trio of facts—a detective’s observation of a personal-use sized

baggie of marijuana at a suspect’s home, the suspect’s one-time delivery of two crates to

drug traffickers, and the affiant’s claims based on “experience and training” regarding the

general habits of drug traffickers—could not support a finding of fair probability that drug

trafficking evidence would be found at defendant’s home).

Here, like Underwood, the majority opinion relies on the affidavit’s explanation of

the generalized habits of collectors of child pornography but points to no individualized

facts in this case demonstrating that someone using Defendant’s IP address was, in fact, a

collector of child pornography. Ante at 13. For example, the affidavit does not allege that

someone using Defendant’s IP address viewed or possessed child pornography—or even

successfully downloaded the illicit content associated with the URL—let alone that the IP

address had ever accessed Bulletin Board A.

Ultimately, the majority’s reasoning is circular: the IP address must have accessed

the URL through Bulletin Board A because the IP address was associated with a collector

of child pornography, and in turn, the IP address must be associated with a collector of

55
child pornography because the IP address accessed the URL through Bulletin Board A.

But without any affidavit evidence suggesting that the IP address in fact accessed the URL

through Bulletin Board A or any evidence demonstrating that the IP address belonged to a

collector of child pornography, the majority opinion cannot permissibly rely on the

generalized habits of those who view and possess child pornography.

Moreover, even if the majority could permissibly rely on the affidavit’s boilerplate

language in this case, that language does not describe the sharing habits of child

pornography collectors or the “complex measures” used to conceal their online activities,

and therefore that language has no bearing on the likelihood of an innocent user accessing

child pornography inadvertently. Ante at 13. Indeed, the fact that the government elected

not to include such language is telling. The template for search warrants in child

pornography cases used by law enforcement officers in the Bulletin Board A investigation

directs affiants that they should include boilerplate “collector” information in an affidavit

“ONLY if” the affiant can “tie [collector] characteristics to the specific offender.” United

States v. Reece, No. 2:16cr104, 2017 U.S. Dist. LEXIS 220176, at 22 (E.D.Va. Mar. 1,

2017). Accordingly, the government’s decision not to include boilerplate language related

to the “complex” sharing habits of child pornography collectors indicates that even it did

not believe the evidence supported inclusion of those boilerplate facts and therefore the

inferences drawn by the majority opinion. Ante at 13.

In support of its assertion that the “likelihood that a specific filesharing page

containing child pornography would find its way to somebody uninterested in such

contraband . . . is probably quite low,” id., the majority opinion further relies on two out-

56
of-circuit cases to show that “consumers of child pornography frequently employ complex

measures to keep their online activities secret,” and therefore that it is unlikely that

someone uninterested in child pornography could, or would, access the URL in question.

Ante at 12–13 (citing United States v. McGarity, 669 F.3d 1218, 1230–31 (11th Cir. 2012),

abrogated on other grounds by Paroline v. United States, 572 U.S. 434 (2014); United

States v. Vosburgh, 602 F.3d 512, 516–17 (3d Cir. 2010)).

But both of these cases—neither of which was referenced by the government in the

affidavit—involve materially different facts from those at issue here. McGarity dealt with

a complex online ring of child pornography users, which used codenames, encryption, and

other methods of subterfuge to conceal their activities. 669 F.3d at 1229–31. And

Vosburgh involved an online message board that directed users to child pornography using

constantly changing gateway websites, complicated access instructions, and “cumbersome

URLs.” 602 F.3d at 516–17.

Unlike McGarity and Vosburgh, the affidavit in this case contains no analogous

case-specific evidence of a complex child pornography network relying on complicated

electronic concealment and security measures. Instead, it documents a single click by an

unspecified user of a particular IP address of a URL containing illicit content. And even if

the facts of those cases were in any way analogous to the facts set forth the affidavit—

which they were not—the government elected not to reference those cases, or even the type

of conduct at issue in those cases, in its warrant application. Warrant applications do not

implicitly incorporate, without reference, the entire Federal Reporter. Rather, the

57
government is obligated to put the relevant, case-specific facts in the affidavit to support

probable cause. It simply failed to do so here.

Additionally, the approach taken in the majority opinion—relying on factually

dissimilar cases not referenced in the warrant affidavit as evidence that there is a fair

probability that a suspect committed a crime in the same manner as those earlier cases—

eviscerates the Fourth Amendment’s probable cause requirement. The majority opinion’s

reasoning rests on the unsupported, and unsupportable, premise that if a defendant

commited a crime in a certain way in one case—like, for example, the McGarity

defendants’ use of codenames and encryption methods—then there is a fair probability that

every other individual suspected of the same crime committed that crime in the same

manner as the defendant in the first case.

Consider, for example, a case in which the government suspected a physician’s

involvement in an alleged health care fraud scheme. In an earlier health care fraud case,

the government filed affidavits and obtained three search warrants, for the physician’s two

medical offices and his personal residence. See United States v. Srivastava, 540 F.3d 277,

280–81 (4th Cir. 2008). In addressing the physician’s motion to suppress evidence seized

from his residence, among other challenges, this Court concluded that the affidavit “made

compelling assertions that documents and records relating to [the physician’s] medical

practice—and that may constitute evidence of health care fraud—would be found in [his]

residence.” Id. at 289. In particular, the affidavit demonstrated that the physician

“conducted a substantial part of his medical practice from [his] residence.” Id. For

example, the insurance billing for the physician’s medical practice was conducted from his

58
house, and his personal residence was listed as a billing address. Id. at 281. Therefore, the

affidavit demonstrated probable cause that evidence of health care fraud would be found

at his residence. Id. at 289. In so doing, this Court emphasized that the affidavit included

case-specific facts demonstrating a nexus between the physician’s residence and the

evidence of health care fraud.

Under the majority opinion’s analytical approach—in which one defendant’s

conduct may be imputed to all future individuals suspected of committing the same

crime—there is a fair probability that every future health care fraud suspect conducted

health care fraud in the same way as the defendant in Srivastava—namely, from their

personal residence as well as their medical offices, even if the affidavit alleges no facts to

support such a finding. Accordingly, under the majority opinion’s flawed analysis, law

enforcement would be able to procure a search warrant for a future health care fraud

suspect’s home, even if the affidavit does not demonstrate a nexus between her home and

health care fraud, simply because health care fraud has been previously conducted in that

manner. But see United States v. Brown, 828 F.3d 375, 382 (6th Cir. 2016) (“If the affidavit

does not present sufficient facts demonstrating why the police officer expects to find

evidence in the residence rather than in some other place, a judge may not find probable

cause to issue a search warrant.”).

Such an analytical approach violates the Fourth Amendment’s requirement that the

“affidavit supporting the search warrant . . . demonstrate a nexus between the evidence

sought and the place to be searched.” Id. Contrary to the majority opinion’s reasoning, we

cannot rely on factually unrelated cases to ascertain probable cause merely because they

59
implicate the same crime. Rather, determining if an affidavit properly establishes a nexus

is a “fact-intensive question resolved by examining the totality of circumstances

presented.” Id. (citations omitted).

In further support of its conclusion that Defendant’s IP address is unlikely to have

innocently encountered the URL in question, the majority points to the “suspiciously short

interval between” the Bulletin Board A post and the URL click. Ante at 14 (emphasis

added). In the majority’s view, this temporal proximity is based “on the contents of the

affidavit, the magistrate judge’s likely familiarity with online child pornography crimes,

and his ability to reach ‘common-sense conclusions about human behavior.’” Id. (citations

omitted).

But as explained previously, the simple fact that the Bulletin Board A post and the

alleged accessing of the File Sharing Site URL took place on the same day does not support

the majority opinion’s inferential leap. The naked click of a URL provides very little

information about how a particular IP address—or individual using that IP address—

actually encountered or navigated to a URL. Simply because law enforcement officers

navigated the URL through one particular pathway—clicking the URL included in the

Bulletin Board A post—does not establish, in the absence of additional circumstantial

evidence, a fair probability that Defendant’s IP address also accessed the URL using the

same pathway through the Bulletin Board A post. Because the affidavit lacks facts to

circumscribe the multitude of potential paths someone using Defendant’s IP address could

have taken to encounter and navigate to the File Sharing Site URL, the probability that the

person in fact reached the URL through the Bulletin Board A post—the foundation of the

60
probable cause theory embraced by the majority opinion—necessarily approaches zero.

This is not the “fair probability” the Fourth Amendment demands.

On the contrary, the inference advanced by the government and made up out of

whole cloth by the majority opinion—that someone using Defendant’s IP address

navigated to the File Sharing Site URL after encountering the URL on Bulletin Board A—

amounts to the type of “improbable leap” that the Fourth Amendment does not

countenance. Lyles, 910 F.3d at 795. Put differently, that inference is not the “usual

inference [from] which reasonable men draw from evidence” and therefore does not

constitute a “substantial basis” for issuing a warrant. Johnson v. United States, 333 U.S.

10, 14 (1948). 7

7
The majority opinion—like the district court—distinguished this case from an
analogous case, United States v. Reece, No. 2:16cr104, 2017 U.S. Dist. LEXIS 220176
(E.D.Va. Mar. 1, 2017). In Reece, the defendant challenged a search warrant supported by
an affidavit nearly identical to the affidavit at issue here—the key difference being that the
Reece affidavit unambiguously established that the Bulletin Board A post at issue appeared
before someone using the suspect’s IP address clicked on the URL included in the post.
The Reece court held that the government failed to establish probable cause to support
issuance of a warrant to search the suspect’s home. Id. at *36.

The majority opinion attempts to distinguish Reece on the basis that the time
between the Bulletin Board A post and the click on the File Sharing Site URL is shorter in
this case than in Reece (on the same day versus two days apart), thereby rendering “the
connection between the suspect and Bulletin Board A . . . much closer.” Ante at 16. Again,
however, the majority opinion underplays that the affidavit does not establish that the
Bulletin Board A post preceded the click, materially weakening the purported “connection”
between Defendant’s IP address and Bulletin Board A. That stands in sharp contrast to the
affidavit in Reece, which unambiguously established that the IP address attempted to
download content from the URL after the Bulletin Board A post, meaning that the still-
insufficient facts in Reece provided a stronger basis for finding a “connection” between the
suspect and the Bulletin Board A post.

61
B.

The most troubling aspect of the majority opinion—most clearly evidenced by its

reliance on the government’s unsupported factual theory—is its failure to grapple with the

complex and novel questions courts face when assessing probable cause premised on

conduct on the Internet.

1.

Probable cause is not a “[f]inely-tuned standard[]” but rather “turn[s] on the

assessment of probabilities in particular factual contexts.” Gates, 462 U.S. at 232, 235.

These probabilities are “incapable of precise definition or quantification into percentages”

because they depend on the “totality of the circumstances.” Maryland v. Pringle, 540 U.S.

366, 371 (2003). Nevertheless, the term “probabilities” necessarily contemplates that

courts try to estimate (at least) outer bounds on the likelihood that contraband or evidence

will be found in a particular location at a particular time. Otherwise, the probable cause

inquiry would be devoid of guardrails, opening the door to the general warrants the Framers

feared. To estimate those outer bounds, courts rely on facts—facts that circumscribe the

universe of potential explanations and therefore allow the court to make an estimate as to

the numerator and denominator determining the probability. See Lyles, 910 F.3d at 793

(“The question, as so often in Fourth Amendment cases, is what precisely the facts show.”);

see generally Richard Posner, Against Constitutional Theory, 73 N.Y.U. L. Rev. 1, 3

(1998) (observing that “the greatest need of constitutional adjudicators” is “empirical

knowledge”).

62
For instance, courts often must decide whether to issue a warrant to authorize the

search of a home of a suspect known to sell drugs. In determining whether a warrant should

issue—whether there is a fair probability that contraband or evidence will be found at the

suspect’s home—courts rely on numerous circumstantial facts to guide their determination.

Thus, for example, courts upholding warrants issued in such circumstances have

emphasized that a recent drug sale took place within a close vicinity of the suspect’s home,

United States v. Jones, 159 F.3d 969, 974 (6th Cir. 1998); that officers had a reasonable

belief that a suspect had just left his home and was en route to a drug sale, United States v.

Aguirre, 664 F.3d 606, 611 (5th Cir. 2011); or that the suspect attempted to hide his

residence from the police by driving “erratically” on the way back from a sale, United

States v. Dessesaure, 429 F.3d 359, 368 (1st Cir. 2005). See generally LaFave § 3.7(d)

(collecting cases). By geographically and temporally tying the suspect’s conduct to his

residence, these additional facts—over and above the suspect’s history as a drug dealer—

make it more likely that the contraband or evidence will be found in the place the

government seeks to search.

By contrast, when insufficient information “links the criminal [drug] activity to the

defendant’s residence”—for example, when the affidavit fails to describe the storage of

drugs at the residence, the “geographic relationship” between the area of drug sales and the

residence, or temporal proximity between evidence of drug activity at the residence and

the proposed search—then the affidavit is “devoid of any basis from which the magistrate

could infer that evidence of drug activity would be found at [the residence].” United States

v. Lalor, 996 F.2d 1578, 1582–83 (4th Cir. 1993). Even when a magistrate “might have

63
been able to draw an inference from the proximity of the drug sales to the [the defendant’s]

residence,” if the government fails to include proximity evidence in a warrant application,

then the magistrate has “no basis” for finding probable cause. Id. at 1583.

Additional facts circumscribing the universe of possible explanations for potentially

unlawful conduct prove especially important when, as here, the facts are consistent with an

innocent explanation for the conduct. Although the Fourth Amendment’s probable cause

requirement “does not depend on the elimination of all innocent explanations for a

situation,” courts must consider the “existence of countervailing probabilities” as part of

their probable cause analysis. United States v. Jackson, 415 F.3d 88, 94 (D.C. Cir. 2005).

Otherwise, nothing would prevent the government from presenting only the “most

incriminating interpretation of the circumstances” and thereby depriving the magistrate of

the opportunity to weigh the likelihood that contraband or evidence will be found against

the likelihood that contraband is absent. Id. at 94–95.

For example, in United States v. Gary—an opinion the government relied on in its

briefing to the district court, J.A. 44–45—this Court upheld a search warrant for a home

that had its genesis in an anonymous tip that someone was selling drugs from that home.

528 F.3d 324, 328 (4th Cir. 2008). Following the tip, the police removed several tied trash

bags from two cans “directly behind” the home. Id. at 326. The bags contained drugs and

drug distribution paraphernalia, including foil and baggies with cut corners. Id. at 326.

This Court recognized the innocent possibilities that “another person placed the offending

bags [containing drugs] in the trash cans, or that some other person moved the unmarked

can from its correct spot behind someone else’s home to a place behind [the individual’s]

64
home.” Id. at 327. Nevertheless, those “mere possibilit[ies]” did not defeat probable cause

to search the home. Id.

In reaching that conclusion, we emphasized several case-specific facts that rendered

those innocent alternative explanations unlikely. The proximity between the trash cans and

the home—the police found the trash cans directly behind the house—reduced the

likelihood that contraband in the trash can was unconnected to the adjacent home because

generally “trash cans placed directly behind a home are used by those who live there” and

trash inside those trash cans is “usually generated by the house closest to those cans.” Id.

at 327–28 (emphasis added). Other evidence further tightened the connection between the

trash can and the home—a letter addressed to the house was found inside one of the trash

cans, and one of the cans bore the house’s street number. Id. These facts, considered

together, established probable cause because they rendered “too slight” the possibility that

the tied trash bags did not come from the house. Id. at 328. Importantly, unlike the majority

opinion’s failure to meaningfully consider the myriad ways someone using Defendant’s IP

address could have clicked on the File Sharing Site URL without encountering the Bulletin

Board A post, the Gary Court did not dismiss out of hand potential “innocent reasons”

weighing against the likelihood that drug evidence would be found in the home. Instead,

this Court looked at the totality of the circumstances and cited specific facts that made

those possibilities unlikely.

By contrast, in United States v. Lyles, we held that a single trash pull “revealing

evidence of three marijuana stems, three empty packs of rolling papers, and a piece of mail,

standing alone” did not justify a search warrant for an adjacent home. 910 F.3d at 793. In

65
reaching that conclusion, we highlighted several case-specific facts that rendered the case

distinguishable from Gary. Whereas in Gary the trash pull revealed drug distribution

paraphernalia—evidence consistent with recurrent or ongoing activity within the residence,

meaning that contraband was likely still at the residence—the single trash pull in Lyles

revealed only a “tiny quantity of discarded [marijuana] residue” that provided no evidence

of recurrent or ongoing activity, rendering it possible, but “not probabl[e],” that drugs

would be found in the home. Id. at 793–94 (citations omitted). Additionally, whereas in

Gary law enforcement officers received a tip that drug distribution activities were taking

place at the residence, in Lyles the affidavit submitted by the government in support of the

warrant provided no evidence, beyond the evidence in the trash bag, that the residence, or

individuals living therein, was involved in drug distribution activities. Id.

The types of corroborative facts present in Gary—and absent in Lyles—are

especially important in cases, like the instant case, in which the government seeks to obtain

a warrant based on online conduct, as the Internet significantly expands the universe of

“countervailing probabilities” that courts must consider in weighing whether the

government has met its burden to show that there is a fair probability that contraband will

be found in the place it seeks to search. Jackson, 415 F.3d at 94. In other words, many of

the physical, spatial, and temporal limitations that historically proved invaluable in

assessing probable cause do not apply in the digital context or apply in meaningfully

different ways.

For example, whereas this Court could rely on geographic proximity in Gary to

conclude that there was a fair probability that contraband would be found in the residence

66
adjacent to the trash cans, geographic proximity has little or no relevance in the context of

conduct on the Internet—like the alleged download of child pornography—because the

Internet allows for rapid dissemination of electronically stored content throughout the

world. That is to say, whereas the limited number of homes within the physical proximity

of a trash can means that the probability contraband will be found at any one house near

the trash can is fairly large (because the limited number of homes renders the denominator

of the probability relatively small), geographic proximity does not serve to increase the

probability that contraband will be found at a particular location in the Internet context.

2.

That certain facts courts historically have relied on to assess probable cause lack, or

have diminished, probative value in the Internet context does not mean that the government

will never be able to surmount its evidentiary burden to obtain a warrant based on Internet

conduct. “Technology is both a threat and a promise.” Vieth v. Jubelirer, 541 U.S. 267,

312 (2004) (Kennedy, J., concurring in the judgment). Although new technologies can

foreclose certain avenues for the government to show probable cause—such as through

geographic proximity—“new technologies [also] may produce new methods” of

demonstrating probable cause. Id. at 312–13. For example, the ease with which Internet

and telecommunications companies can capture and store information regarding an IP

address’s browsing behavior and online activities provides a wealth of additional

information for the government to rely on in seeking to obtain a search warrant for a

residence associated with the IP address. In the child pornography context, in particular,

courts routinely rely on such evidence—or the absence of such evidence—to determine

67
whether the government has met its burden to show a fair probability that evidence related

to child pornography offenses will be found at a residence associated with a particular IP

address.

For instance, in United States v. Gourde, 440 F.3d 1065 (9th Cir. 2006) (en banc),

the Ninth Circuit found probable cause to search a defendant’s residence based on facts set

forth in affidavit establishing a fair probability that the suspect “inten[ded] and desire[d] to

obtain illegal images,” id. at 1070. Those facts included that (1) the suspect paid for a

subscription to a website, Lolitagirls.com, that “was a child pornography site whose

primary content was in the form of images”; (2) electronic records from a credit card

processing service revealed that in order to subscribe to the website the suspect

“submitt[ed] his home address, email address and credit card data, and he consented to

have $19.95 deducted from his credit card every month”; and (3) the suspect “became a

member [of the website] and never looked back—his membership ended because the FBI

shut down the site” several months later. Id. at 1070–71. The Court reasoned that these

facts established that the defendant “could not have become a member by accident or by a

mere click of a button[.]” Id. (emphasis added). The Court relied on the circumstantial

evidence regarding the defendant’s Internet conduct to determine that the “countervailing

probabilit[y]” that the defendant innocently visited the website was low. Jackson, 415 F.3d

at 94; see also, e.g., United States v. Martin, 426 F.3d 68, 78 (2d Cir. 2005) (finding

probable cause to search a residence when electronic records revealed that an individual

with a particular email address “joined . . . voluntarily and never cancelled his membership”

68
to a child pornography website and that the user of the email address lived at the residence

for which the warrant was sought).

In contrast, courts have declined to find probable cause when the government fails

to put forward supporting facts that diminish the likelihood that a child pornography

website was accessed innocently or unintentionally. For example, in United States v.

Falso, the Second Circuit held that a forensic analysis of a child pornography site’s server

revealing that a suspect—who the affidavit reported had been charged 18 years earlier for

sexually abusing a seven-year-old girl—had “either gained access or attempted to gain

access” to a child pornography website did not establish probable cause to search the

suspect’s home, 544 F.3d at 114. Writing for the court, then-Judge, now-Justice Sotomayor

held that those facts were insufficient to establish probable cause because, unlike Martin,

the affidavit included “no allegation that [the suspect] in fact gained access to the [child

pornography] website, much less that he was a member or subscriber of any child-

pornography site.” Id. at 124.

The Second Circuit pointed to several types of information that the government

could have—but did not—adduce in preparing its warrant application that may have

allowed it to satisfy the “fair probability” standard, including that the suspect (1) took

actions “tend[ing] to negate the possibility t

[Text truncated at 120,000 characters. The full text is on the page linked above.]

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/cases/4422244. Public record. Not legal advice.