# Oral argument — United States v. Nikolai Bosyk > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/argument%3A61302 ## Record - **Collection:** Oral argument - **Document type:** Oral argument - **Published:** January 31, 2019 ## Text May it please the court, my name is William D. Ashwell, here for appellant Nikolai Bosyk. Also with me at council table is Stephanie LaCombra from the Electronic Frontier Foundation. We'll also be arguing based on her amicus brief that was previously filed. We're asking the court today to reverse the trial court's decision not to suppress a search warrant until April of 2016. The subject search warrant, at least the content sought from the government, Agent Ehler from Homeland Security, based on an investigation she was involved with, sought certain items from a home of Mr. Bosyk up in Leesburg, Virginia. The basis of the search warrant and the supporting affidavit really centered around an investigation on what is described in the affidavit, for lack of a better term, as Bulletin Board A. This was alleged to be a message board of sorts or a forum in which individuals could join, obtain, and share information related to what was... Draw the picture for us. I mean, this is a case, you know, I'm probably in a different age group, just because it's getting close to Judge Wilkerson, totally different. But you've got IP address, you've got all kind of URL's and websites and hosts and terms like that. But draw the picture for us as to what was done here and why you say that this was insufficient to support probable cause. Yes, sir. And I will make clear, Mr. LaCromber, I think we'll point out some finer points related to some of the technology issues, but drawing a road map for the court, which I think appropriate. In the subject affidavit, we have content that dictates that the forum that I just described requires membership and also that the subject file referenced in the URL, the content, the actual, what they're alleging to be this illicit material, was protected by a password. So that, in a basic sense, is we have a file of the content that is believed to be the basis of the search warrant and the legal act of accessing or downloading this was accessed only by a password. And according to the affidavit filed by the government, you can only even get to this through being a member of Bulletin Board A. But what's interesting... And the password for that was in the same message that included the link to this file. It's unclear in the affidavit, and I think the concerning issue to answer that question is it's unclear in the affidavit because the additional information included in the affidavit that we have these members sharing illicit material in Bulletin Board A, but where we get to the actual content is a whole other part of the interview. It's this file sharing service that's referenced in the second part of the affidavit. So think about it this way, and again, I think counsel will also elaborate on this during her time. But your representation is that the password for the file was not indicated to be on the Bulletin Board. The password for the file, according to the affidavit, would be at a point when you're trying to access or click on the subject URL, you would be prompted to put in a password, and at that time you would be able to essentially, for lack of a better term, access the videos and the illicit material. But the actual content, according to the affidavit, is hosted by a third-party website. I understand, but there's a password, right? There is a password. It's like P-W-O-R-D-1-2-3, right, whatever people use. Correct. That string of letters that we call the password, does the affidavit include where that was located? The affidavit. That information. The password? No. P-W-D. It merely, in the affidavit, references that the subject content is password protected. So, no, there's not a direct reference of where it would go or what it would do. No indications of how to get the password? Nothing. Nothing related to how to get the password. And under the circumstances, and this is largely what's in the affidavit, it's all kind of inferred. I mean, for lack of a better term, it's inferred that the members would have the password. It's inferred just from the four corners that somehow they would know this. But if you read the affidavit, it's a huge inferential leap because we don't have any sort of factual allegations that the subject of the premises, the person using the IP address, or Mr. Bosick himself, any of those at any point had a password or knew how to access that particular problem. Obviously, it would have been ideal if the government would have matched up the identity, but you're not suggesting that they needed to do that in order to search the devices at the home, do you? Under the circumstances, I don't think there needs to be necessarily a direct proof of the identity of the accessor for the search warrant purposes. But I think based on looking at the four corners of the search warrant, and especially at least for a probable cause determination, for example, in the affidavit there's a considerable portion that is strictly reserved for what's defining as what's called a child pornography collector. Well, before you get to that, I think for me what seems to me to be the government's strongest fact, and I'm not saying it's determinative, but at least the strongest fact, is the very short time frame between the posting of the URL on the bulletin board and then the clicking of that very same URL, presumably to obtain access to the file. And in that sense, this case is different from Reese, the predecessor district court opinion, where there was no indication of a temporal connection between the two. So talk to me about that and why this case isn't sufficiently different because of that to warrant that inference that you discussed. Because we're not talking about absolutes here. It's not proof beyond a reasonable doubt. It's just sufficient evidence to cause a reasonable observer to believe that there is evidence to be found or evidence of a crime that's been committed. And so why isn't that enough? Your Honor, and if my memory serves related to Reese, I think there was about a one-and-a-half, two-day gap between the click and what they were monitoring. Here, I suppose it could be, the suggestion is that it could have been almost instantaneous, certainly less than a day, I suppose, maybe hours. And I think, and this is part of the framework, too, to answer that specific inquiry, what's alleged in the affidavit and what we're discussing is, at least from the government's position, they're monitoring this link in conjunction with what they're calling Bulletin Board A. I think, and counsel will kind of get into this a little bit more as well, what I think is kind of missing from the analysis is, and I think the government would concede this particular point is, the government, although the affidavit seems to just draw this link between Bulletin Board A and then this link on the file-sharing network, the idea that this link can, could, and did exist in other mediums, I think is almost a guarantee. Because you can access it through Bulletin Board A, does not mean that's the only means that you could do that. I think I would agree with that in the abstract, if there had been a longer time frame between the link appearing in the Bulletin Board and then being clicked on by someone. But the question is whether or not it's reasonably probable to believe that because of the short time frame, it's more likely than not that the person who clicked on it obtained it through the Bulletin Board and not by some other innocent means. And as far as kind of Internet time, I mean, I think under the circumstances, what would be unique about this case is, and where I kind of disagree with the government's position on that, is, at least from the affidavit's purposes, I think there's a lot of inferences and assumptions related to this specific URL being on Bulletin Board A and thus the basis of this particular click on November 2nd. And I think under the circumstances, what is kind of the defining point here is, Bulletin Board A is described both in the criminal complaint in the record and then somewhat very briefly in the affidavit on kind of what's called the TOR network or kind of more the anonymous network. Let me ask you about this temporal proximity. The district court addressed that question and sought to distinguish Reese. And if you look at the language in which the district court used to distinguish it, it appears there could be some confusion as to whether the district court was concerned in Bulletin Board A or this independent files sharing site, which makes a critical difference in this case. And that's the huge difference. Tell me about that. Tell me how that confusion makes that difference. And I think what the Reese court used that identified more than the trial court in our case is what's... And I keep saying that inferential leap because I think that makes sense. I think the court is correct. We have Bulletin Board A, which I think the court in our particular case was referencing as far as the timing and the click. But that actual content in this URL is actually hosted by this third party. So there's not the ability for the court to look at it, at least for our purposes, and say definitively that that time stamp for the IP address attempt or click or access was something that came directly from Bulletin Board A. And I think it's contradicted by the idea that Bulletin Board A is on the anonymous TOR network and that this IP address or file sharing third party service would have been where they got this IP address. So I think you cannot do that. The upshot being is that we have no idea when this URL was posted. No. And that seems to be the point you're making here, if I'm understanding it. Correct. Not only when it was posted, but in what other mediums, where else it could have been. Posted to what? So that's, I guess, for our purposes, the affidavit, in looking at Bulletin Board A versus how it was accessed through the file sharing network. I think that's the ambiguity, at least in the face of the actual affidavit. What we do know is one website posted to that URL. We just don't know when. Correct. We do know that the Bulletin Board post with the link and Bulletin Board A was done on November 2, 2015. According to the affidavit. According to the affidavit, which is what we're taking. And so we know that happens. And then we know within a day of that, that the link, which is not sort of a generic link, but is a link with a set of alphanumeric that would not randomly be stumbled upon, was clicked within a day, right? Of it being posted on Bulletin Board A. Well, I think just to pick up on what the Court's saying, I don't think that there is the ability, at least at this juncture, to say that the subject click, which the Court referenced on November 2, close after the posting on Bulletin Board A, that the click alone constituted knowledge of the password. But so let me go back to my earlier question that I asked you, and you can look at it when you sit back down. But when I read the affidavit, and I'm at the Joint Opinion at 165, when I asked about the password, the affidavit said, this post, which is the post that includes the link and includes the thumbnail images of the juveniles engaged in sexual activity, it says, this post also contained the password. And so the reason I was asking that earlier is because that is also an indication, for probable cause purposes, that they're related. Because it's an encrypted file on an alphanumeric site that would not be stumbled upon. The password and the indication that it is child porn, based on the thumbnails, is all on Bulletin Board A. Right. And I think I'll let counsel here in a second address that issue. I think yes to the point that the affidavit contained the, assumedly, password description of what these videos or content was. But I don't think that there's a link, at least for our purposes, and we would argue for probable cause, that from the attempt to click on the URL, one, impugns actual knowledge of the password, or two, that it was entered. And that, I think, is especially why. That's what circumstantial evidence is, right? I agree there's not direct evidence, but that's what circumstantial evidence that might be enough to convict him at trial. But we're not asking that question, right? I mean, it's just is there a fair probability that it might exist, right? Right. And I think that is kind of the focus right now. What you need to be clear, at least if I understand it correctly, is that Bulletin Board A did not host this URL. That URL is completely independent of it. Right. And for that reason, you've got a file sharing website that could host, I guess, anything. And that's the whole idea. No, you don't know. It's not like this is the only thing it's doing. Just because you've got a password, it doesn't mean you're going to that. Absolutely. It's got everything in the world on it, and there's no connection between this URL and this bulletin board. The bulletin board has a point on it. The URL doesn't. And all it does is go to here, which happens to have many things coming into it. And your point is that's all it did. And probably someone could fish you to send this to your computer, and based upon this, with that one click, you get a warrant. Correct. Or you could have someone accidentally send it to you. Correct. You're going to get a warrant for it, because you went to that file sharing website that happens to have, of the many websites, this connectivity to this bulletin board. Correct. It would be different if that was a single connection. Absolutely. If that was the only thing connected to that URL, you'd be right there. That's exactly right. And I think, Your Honor, just a perfect transition, I think Ms. LaCombe is going to talk about that exact issue, which I think will be even more illustrative than maybe I've been. But I think she can address that particular issue right now. If I can turn it over. Good morning, Your Honors. May it please the Court. I'm Stephanie LaCombe from the Electronic Frontier Foundation, appearing as a friend of the Court to explain why a single click on a uniform resource locator, or URL, cannot and must not be sufficient probable cause to search an individual's home and digital devices. You had some demonstrative evidence or papers at the hand. We just got it. I had heard from the other side, so we didn't let you put that today. But if they are agreeable, then it would help the Court of Understanding will be able to receive it. But you must get that agreement from them to do that. Okay. If I may. Not at this time. But later on. Okay. All right. And I think, Your Honor, you touched on precisely why EFF is particularly concerned about this case. Because of how dynamic URLs are. Explain that. Because that's rather simplistic. It sort of goes to the heart of where we are. If what happened is a single click to what is called a file sharing service. What is that? What's a file sharing service? A file sharing service is basically a library of content. It could be media content, documents. Is there something analogous to it that's out of the context of this? It could be Dropbox. It could be Google Drive. It could be any. So Dropbox could have been this file share. Yes. That's essentially what Dropbox is. And as a result of Dropbox, you then have connectivity to all the other websites. And in this instance, Bulletin Board A loaded with porn is there. And it's up on the same day, but there's no connectivity between the two. That's correct. And all we know is this individual clicked on to the file share. Correct. Is there anything else? I mean, had he been there before? We don't have any evidence in the four corners of the affidavit to contextualize this click. But when he's clicking on this is what I'm trying to understand, I think, as Judge Wynn is. When the board has a link, and it's not, I'm going to use Dropbox. I know that's not it, but it's just easier than redacted. So it says Dropbox.com. But that's like saying you're going to the library. After that, there's a slash, and then you've got all the rest of this information. And it's this alphanumeric XU5ME9ER, right? Random alphanumeric. And that's sort of like the Dewey decimal number for that library, right? So it's like a specific book in the library. And so if you click on that particular HTML link, it's like not going to the library. It's going to the particular book. And the only thing you find at that link is the one book that you're looking for here, the one .rar file. Well, we actually don't know that, Your Honor. Because of the information that was provided, we actually don't know if that URL link is to a Dropbox account that has multiple folders in it or if it's to a particular Dropbox file. That was omitted from the four corners of the affidavit. What we know is, and the nuance, I think, that was missed. Justify what Judge Richardson, because that's intriguing. If it's like, when you go to that link, does that only go to the bullet? When you go to this Dropbox, does it only just go to the bullet, A, or are you in the library? Well, so the link is to a file sharing service that is available on the regular Internet. But it's a sub part of that file service. It may be a single book or it may be a set of books, but it's the Dewey decimal number for either that file or set of files, but just those, nothing else. It's not like you get, you know, FedEx also has a Dropbox account. You're not getting anything from FedEx, right? You're only getting that one Dewey decimal, as I'm going to sort of think about it, book. Well, Your Honor, we actually, again, we don't know if that's a book or if that's a library. Well, a book or a set of books, right? But we know it's not the whole library. My analogy, Dropbox.com is the library, right? And so it's either a single book or maybe it's a volume of books, right, that has the same Dewey decimal number, right? World Book Encyclopedia, right? It's the same Dewey decimal number, but it's a set of 25 books instead of one book. Okay. But in that context, we're going to a specific location within the library of Dropbox. Yes. We are going to what could be an account or what could be a folder of files. But we actually don't know if on the other side of that password-protected portal, because, again, you needed to enter a password to pass through and find out what was on the other side. We actually don't know if that's restricted to just the contraband material. You don't know if this link, it doesn't identify what it is. The link is just, it just gives you a link. But you don't, it doesn't say porn. It doesn't say Bulletin Board A. We don't know because we don't see the link. It's just a link. Yeah. Even if it did say that, because of how dynamic URLs are, that they can be shortened, that they can be smoothed. I may be completely confused here, but I thought the argument here was that there was just too great a possibility that this URL could have been clicked on either randomly outside of the Bulletin Board or without a connection to the Bulletin Board. But let's assume for the moment that that's not the case. I'm not suggesting that this was the case with this particular defendant. But let's say we have someone who is keenly interested in accessing child pornography. He comes across this URL on the Bulletin Board. He clicks on it. It opens up. And what do you say is behind the URL that doesn't lead to probable cause in that instance? Actually, if they had clicked on it from Bulletin Board A, they would still have been in the TOR web browser because that's where it's a hidden service. So had they actually clicked on it from Bulletin Board A, you wouldn't have been able to find the IP address. It would have been hidden behind some TOR exit node. So the fact that this individual defendant... Well, that part of this is in the affidavit, the TOR aspect of this. I believe when they were defining the network... They defined it as the TOR? They defined it as a hidden service that was available. I think in trying to say that this was... So you think that the magistrate judge in reading this would have known that Bulletin Board A was on the dark web? I believe so. If I'm wrong, please correct me. But my understanding was... The record speaks for itself. I'm just asking you what your belief is. The network that they were referring to, I believe, was TOR. I'm focusing on Paragraph 8 where the agent in this case says... He talks about the URL. He indicates that the post contained a password. He says that the HDIU downloaded a file from the URL. It was encrypted, but by using the password, the file could be opened and viewed. And he looked at it, and it contained images of child pornography. So assuming that's what the defendant did in this case, and I guess that's the inference that the government would have us draw, what is wrong with that? Is that factually incorrect? It's not factually incorrect, Your Honor. However, for it to have significance and meaning, we need to know that that's the only content that's on the other side. Now, if the account, the Dropbox account, had child porn folder but also had grandma's family photos and other business documents, you can't say that... I would hope that this court wouldn't find that to be someone who is navigating to a file sharing service available on the regular Internet. This was a bulletin board dedicated to purveyors and users of child pornography. I don't know that it would be very likely. And again, we're dealing with probabilities here, not absolutes. So why wouldn't a PC application be enough in this case, even if there were photos of grandma or grandbabies in the file? So the government makes much of this temporal connection, this temporal nexus. That's a different question, right, as to whether or not the defendant in this case got the access to the URL via the bulletin board or somewhere else out on the Web, in which case there is an argument, I suppose, that because it's a series of alphanumeric numbers and letters that don't identify the content, that someone could legitimately argue that, hey, I didn't know what was behind this thing and I clicked on it, but I'm not a child pornographer. Well, so there are two concerns with the temporal nexus. One, because we don't know the origin of the URL link that leads to the file sharing service. The government is, I guess, trying to contend that the way they arrived at that URL is most probably the only way that someone would arrive at that URL. But they don't actually provide the court with enough information to make that assumption. They don't have to say most probably that's what they did, right? I mean, to me, it seems like to me what your argument is, is there are other possibilities, right? There are other innocent explanations for what happened, right? And even if that's true, what I don't see is how the possibility that photos of grandma are there or the possibility that he got this from somewhere else or the possibility how that destroys probable cause. I get that that might be a really great defense at trial. I get that when he shows up that that might be an issue, but the question we're facing is a different one. And so just saying a possibility of an alternative explanation doesn't destroy probable cause, right? Well, I guess their argument to me is akin to saying a high school student first encountered or found out about the Civil War in their history book on a particular day at a particular time in their history class. And that anyone who navigated to or anyone who looked at that content about the Civil War that could have been available in the library, in any number of history books. But the difference there is that there's actual information, that information about the Civil War was available elsewhere, right? Yes. There's no indication here that this was – I get it's possible, right? But there's no indication that this particular alphanumeric link was available anywhere else. Well, Your Honor, if this was a Dropbox account, I actually think it should be the government's responsibility to bring enough evidence to the magistrate to say that that can be inferred. But it could have been shared. It can be inferred by the nature of the alphanumeric code, right? Like those random letters and numbers allows us to infer that it's not otherwise available. I get it. If the website was like kitchensupplies.com, you click on it, and then once you get there, it's all kinds of child porn. But this is like a very specific, like not readily, sort of just accidentally clicked on link. Well, if I'm the account holder and I want to share grandma's family photos and I circulated that on an email chain with the rest of the family, this link could very well have been shared any number of times with any number of people prior to it ever having been posted on Bulletin Board A. Could have been, right? The fact that it's possible doesn't destroy probable cause. I would actually say it's most likely that it was if it was a file sharing Dropbox account. Tell me why it's most likely that this particular alphanumeric code or alphanumeric Dewey Decimal number was shared. I don't see how you have information on that one way or the other. We don't, but I'm just saying from how the Internet works, if you have a file sharing account and you're storing information, most people are storing it in order to share the information that they've collected. Right, but that's you because you're sharing pictures of kids and puppies and things, right? But if you're a child porn person, there's a different story, right? Yes, and there was no way for the user here to know whether it was kittens and puppies or child porn from just the URL, which is... You simply need to have a fair probability that there's more than one potential means to connect it. There's no greater probability it could have gone to a board meeting than any of the others. And it could have clicked to anything out there. You've got multiple means of it. I think the key, and you guys, when you come back, you need to make it clear that it is the independent nature of this website from the bulletin board. I think if we, as the district court obviously confused the two when you said particular site, that's where it missed the boat on this. And when you come back, you need to make that clearer. But we need to hear from the government. I'm giving you ample time. I appreciate it. You do have additional time, and I want to make sure that we get all our questions in because this is an interesting case to us. May I please report? I'm Nathaniel Smith. I'm an assistant United States attorney. I'm here with Warren Rich, who is a trial attorney from the Department of Justice. Judge Winn, I think the key point in this case is that the temporal element does link the file sharing site to bulletin board A. Because what we have is a link to the file sharing site that appeared on bulletin board A on November 2, 2015. And on that same day, as the affidavit notes in paragraph 7, a computer at the defendant's residence accessed that link. So there is a reasonable inference to be made there, Judge Winn. One click to the Dropbox type file sharing. Correct. But the one click. But did it have to be that particular one? Doesn't that click? I mean, you've got a situation where it could be pop-up. You don't have to necessarily go to a porn site with it. Well, so the posting that outlined what the contents of the link were, was on bulletin board A. No question. No question about that. But the click wasn't to bulletin board A. Well, let's just. That was to the file sharing. And the file sharing itself has a whole bunch of things coming into it. Yeah, but as Judge Richardson pointed out, that particular link doesn't go to those whole bunch of other things. That particular link only goes to the child pornography. He never clicked it. He did click it. Clicked that, but it went to the file sharing, which opened up this. It went to the file sharing site for a particular downloadable file, which was the child pornography. And then someone could enter a password, which was noted, Judge Richardson, in paragraph 8. The password was on bulletin board A. And then once you entered the password, you could download the child pornography. Mr. Smith, just so I'm clear, and I think you've answered this question, but I want to sort of hit on it again. Once you clicked on the URL, and assuming you had access to the password, Grandma's pictures weren't on that site, right? Correct. What was on the site was the child pornography. And that was it. There was nothing else, no other innocuous material on that site. Correct. There was just the child pornography. And that's what paragraph 8 tells us. And if you thought that Grandma's pictures were on there, then what you would say is that paragraph 8 was false, and you'd have a Franks problem. I mean, if, for example, the reality of the world was that you clicked on that link and you went there and Grandma's there and recipes and kittens and all those things are there, then what they would need to have done in this scenario is say the agent's And they have not made that claim that it was false in that respect. Yeah, they have not made that claim that it was false in that respect. Because it wasn't false in that respect. It wasn't false in that respect. And we can have confidence that it was the child pornography, because as paragraph 8 stated, the agent went to Bulletin Board A, clicked on that link, entered the password, and what the agent got was child pornography. This is what happens. It goes to the particular website. There is a link that goes to Bulletin Board A. Or what is it? What's the connection to Bulletin Board A? The link was on Bulletin Board A, and then from clicking the link on Bulletin Board A, it takes you to the file sharing site. Is there anything on that link that identifies Bulletin Board A? No, Your Honor. Could it have been if the link had said kitchen sink, That's enough, too? Is there anything that tells you that link is going to Bulletin Board A? No, but I think one of the things... So what do you get the information he knows is going to Bulletin Board A? Your Honor, I think what the court should keep in mind, respectfully, is that this is contraband. Oh, I'm aware that contraband is described. What I'm also aware of is that it could have been someone sends this fish dish through the computer, pops up on any one of our computers, and you're telling me that's enough. Because it connects, because it's posted on Bulletin Board A. Respectfully, Your Honor, what I'm suggesting with the contraband analogy is if you have a kilo of cocaine and you're distributing it, you're not distributing it to people who don't want a kilo of cocaine because it's contraband, because there's consequences to being caught with distributing cocaine. Don't you want to make the assumption before you even go there that that person is doing that? What if the person isn't distributing anything and he happens to hit on this link? Well, people don't distribute child pornography to folks that don't want child pornography. People don't take fishing in that sense, where you could have an innocent website that comes to you accidentally on this thing. But that's the problem with this case. You've got one click, and all you had to do was get something else to link him up to it. Well, we do have something else to link him up to it, respectfully, Judge Wynn, and that's Bulletin Board A, and that's why the temporal nature of when the link was clicked after it appeared on Bulletin Board A is so important. This is not a time period where the defendant clicked on the link three days later or five days later or a week later. It happened on the same day. So that gives the court some reasonable confidence that the source of the child pornography was actually Bulletin Board A. And so I think that that's a very, very important point, and I think that's what Judge Nachmanoff was using when he approved the search warrant as the magistrate judge, and I think when Judge Brinkham was reviewing the probable cause analysis, that's what she came back to as well. Let me just tell you what's scary, because I'm not arguing with you, and I think this is very close in many regards, but I'm thinking you've got Grandma sitting around on a computer. She clicks a link. That link, you know how the sky has its links. It happens to go to child porn, to a child porn site, and it happens that that same day there was child porn that was posted on that same day. Aren't we there in the same place? Well, I think to the same URL, there's child porn posted that same day. Grandma just happened to hit that link. That link went there, and it happened to be on that same day, child porn posted. That can happen any day of the week, because people are sending you stuff, and if you click on a link, it can take you somewhere you don't want to go. Of course, the law says if you receive porn, if you immediately delete it, you're good. That's a defense, because you didn't intend to receive that, but you've got to do that in order to get the defense of it. But I'm thinking, and I understand that if you look at the ultimate result, it's always easy to look at 2020 and say, okay, look, this guy really was guilty. He did all this stuff. But I'm thinking about the implications of saying all you've got to do is have someone who clicked onto it. It goes to that site, and then show that same day there was stuff that was put on the URL. That's the end of it. That's all you have in this case, right? Well, no, I don't think that's all we have in this case. Tell me what else do you have? Well, of course, there's the temporal nature. There's the nature of child pornography being contraband, so it's not likely to be shared. No, no, I'm talking about established probable cause. I'm not talking about what the facts are. Yeah, there's pornography. That's terrible stuff. I understand that. But that has nothing to do with trying to establish probable cause and to search this man's house because a computer from there clicked a link that went to a porn site that happened to have had the same day something downloaded onto it. But in the point I think you're trying to get to here is that the possibility of an affirmative defense to criminal charges, which is what Judge Winstead's describing, doesn't destroy probable cause. Correct, Your Honor. It might not allow him to be convicted, right? So if you accidentally clicked on it and you deleted it right away, you would have an affirmative defense that you didn't knowingly possess it. You didn't intend to possess it. But that's a defense at trial, not a defense at the probable cause stage for a search warrant. Hold it granted, but let's make sure we're not talking about the trial. We're talking about probable cause to search someone's home because simply they clicked on a link that went to this site that just happens to have the same day this URL was put in it. I mean, that can happen any day. Your Honor, I definitely understand your concern. And that's all you have. Respectfully, I disagree. I think that there's two or three different things. First is the temporal nature of the link. Is Bulletin A the exclusive poster of this link? I don't think there was any reason at the time to believe that it appeared anywhere else. Is there anything in the affidavit that says to the contrary, that it was posted anywhere else? And we're looking at it based on the four corners of the affidavit, right? And if the affidavit was false because it was posted other places, the defendants have a burden to make a frank showing that you intentionally omitted information that was material. Correct. The defendant has to prove his innocence. That is, that there's nothing here to show this thing is the only thing that's posted there. So the defendant has to now come in and prove that he's innocent of something that the government didn't prove? No, I don't think that's correct at all, Your Honor, because this is a problem caused for a search warrant. A search warrant is an investigatory tool. And so the search warrant can often determine, once you get the devices, whether or not the click was intentional or not. Sometimes searches actually exonerate defendants, not incriminate them. So this was an investigatory tool. And I think this brings us to a key point between how the appellant sees this case and how the law of probable cause for a search warrant differs. This is not probable cause to arrest the defendant. This was not a probable cause for an arrest warrant. This was simply probable cause to search the devices and the defendant's residence because there was a fair probability that the evidence saw, which was the contraband, would be in the place to be sought. And that's what the law is on probable cause for a search warrant. And so we had an IP address that registered back to the defendant's residence that showed that he accessed the link that contained child pornography on the same day that it was posted to a website dedicated to child pornography. Under a probable cause for a search warrant analysis, that is all that is needed. Now, the question of whether he's guilty of intentionally looking at child pornography or intentionally receiving child pornography, those are things that can be determined from further investigation after the search warrant is done. So everybody who clicks on a link of this sort immediately, your home or subject, just because you clicked on it? No. What more did you hear? Again, Your Honor, respectfully, it's the temporal link between a website that is dedicated to child pornography and the click on the link. It's not just the click on the link. This was not a click of the link that was three days after it was posted on Bulletin Board A. This was not five days after it was posted on Bulletin Board A. Anybody that clicks to a website that happens to have had child porn listed on that URL that day can have a house searched. What? Anybody. Correct? Because that's the temporal. I just took the temporal out. Okay, they did it the same day. And he clicked on it the same day. Those people are in a pool of folks whose home can be searched right now. Well, let's just change the hypothetical. No, no, deal with that hypothetical because that took your temporalness out of it. So now tell me how does that now fit? But if the temporal link is to a website that is dedicated to child pornography, yes, there is the possibility, as Judge Richardson said, that an innocent person might click on it. Thousands of websites. But that's the probability of that happening. Thousands of websites out there. I understand, Your Honor, but we're talking about one particular website. I understand that. That contains child pornography that is connected inferentially to a website dedicated to child pornography. That's the inferential part about it. And so that's what we're dealing with, probable cause. And so we're dealing with whether it's probable to believe that there's that connection. I think we probably are at an impasse on where we're going to go on it. I'm going to say I don't think the Fourth Amendment looks backwards in all these cases. And this is a dangerous situation from my perspective. Maybe I'm not getting it correct. But I believe it could happen to anybody on planet Earth who has a computer to do just what happened here. And those links don't say this is pornography. It was on the bulletin. It could say good morning, America. And you click on it. And boom, you find yourself there. You can make the assumption that pornography, this guy could be distributed a whole bit, but it could be anybody. And once you establish same day on the URL porn was listed there, go look at his house and look at everything in there. So let me make an analogy and see if it helps us at all here. If a package is being sent through the mail to a residence and that package contains cocaine, so the dog sniffs it and they do a controlled delivery. And they go and say we want a search warrant for that house because the package is being delivered. There's probable cause to search that house. We recognize, though, that it could well be. And, in fact, we actually know that often defendants will send or drug dealers will send packages to their next door neighbor, for example, and try to pick them up before they're gathered. So there are always possibilities that that package could be sent to an innocent neighbor instead of the actual drug dealer. But throughout the case law, we say that may well be true. That is a possible explanation that it was not the receiver doesn't know that it's coming. But that doesn't destroy probable cause, right? Absolutely. I think you articulated it very well. The connection between that and the use of the Internet and the use of multiple websites and the manner in which the Internet happened by just a click. We're not talking about something being delivered, something you ordered, something that the other factors that are there. There are so many other factors there. Do you make any connection between that? Well, Your Honor, again, I understand your point. I'm interested. Can you make some connection between that analogy and the use of the Internet in this case? Because I don't see – there are so many other factors in that analogy that bears on probable cause that none exists here. What we have is a click on a link, a single click on a link. It goes to a particular place that just happens on a URL that they need to download into multiple sites there. That's it. I think, just to answer your question briefly, the point I'm agreeing with Judge Richardson, and I think it's more apropos even with the Internet, is that there's millions of possibilities of what could happen on the Internet on any given day. But when you're dealing with the universe of the facts of this case – But you don't get to pick one of the million. That's right. And say one of the million is bad, and therefore he must have done this. No, I think that's why our case law has consistently recognized that there's no bright-line rules in probable cause analysis for search warrants. That's why it's a totality of the circumstances analysis. So if there's a hypothetical that comes up, the magistrate judge will look at it on the face of those facts. All you needed was another factor. All you needed was – it wouldn't have taken much more to connect this individual there. Any other type of factor could have done it. I mean, had he done it before? Was there some other indication he'd used this site? I mean, it wouldn't have taken much to go there. One click? I think it would have taken a lot because the nature of the investigation concerned a dark web website where you couldn't determine who was using it. The only reason the IP address was recorded is because when you clicked on the link, it took you outside of the TOR network into the file-sharing service where your IP address could have been recorded. And that brings up the point again about the nature of child pornography. They were on a website on the dark web where their activity couldn't have been traced because they were scared about getting caught. That's the nature of contraband. They were very careful not to get caught. But by clicking on that file-sharing service, it took them outside of the TOR network. Their IP address was able to be connected, and that's how law enforcement was able to catch them. But I think it sets a very difficult precedent if we're saying, well, if a child pornography person hides their link by not showing that it's child pornography on the face of its link and they can evade law enforcement detection, I don't know that that's a precedent that this court wants to set. I want to make a statement. Can you speak briefly to staleness? Yes. Basically on staleness with digital evidence. Staleness concerns really whether or not the evidence is going to be in the place to be searched sometime after the search warrant. And I think that this court has held repeatedly that in the context of child pornography where the files are likely to be on the computer months, sometimes even years later, that staleness is not as big of a factor as it would be in a different case such as with drugs where drugs can be moved, used, or discarded. It looks like in this case, this affidavit was, maybe it wasn't, but if you can answer this, do, that the affidavit and the language that was used in the affidavit about describing characteristics of individuals who possess or access with intent to view child pornography and then also using the collector language was in direct response to the less than favorable result in the Reese case where the affidavit strictly talked about collectors. But it struck me that this language was sort of had the, has defendants coming and going. You're either a collector, in which case you can, the government argues that because you're a collector, you're not likely to be able to, you're not likely to delete or otherwise get rid of your collection, or you're someone who accesses pornography with the intent to view it, but you might delete it right after viewing it, in which case we got you anyway. So talk to me about that. It seems a little bit inconsistent. I don't think it's inconsistent. I think it's just the nature of physical evidence, Your Honor. And I think there's some people who use child pornography, and I think there's the wide body of research and that the courts recognize that most people who look at child pornography value their collections and so hold it. But we have seen that there are people who actually... But the key point here is that whether a defendant collects the child pornography or whether the defendant deletes the evidence, through forensic analysis, those files can often be recovered. And so the concern for staleness, either way it's not there because the evidence is going to be able to be recovered. And I think I'm running out of time here. The five months that is at issue in this search warrant is well within the time frame because the Fourth Circuit has recognized that in a child pornography context up to a year is okay. It doesn't have a staleness issue. And the final thing I want to say, Your Honor, is that if the court is inclined to find that there is no probable cause, there is no indication that there was any sort of misrepresentations or omissions from this affidavit. And so the Leon Goodfaith exception would apply in that circumstance. Thank you very much. We have just a few minutes in rebuttal. Thank you, Your Honor. My EFF's main concern is that without a rule by this court confirming that an attempt to access a URL alone is not probable cause for a search, we run the risk of bad actors weaponizing URL spoofing to silence or harass unsuspecting victims. But that wouldn't be the rule in this case. The rule would be if we agreed with the government that accessing a URL within hours of that URL being posted on a bulletin board dedicated to child pornography provides sufficient evidence to grant a warrant. That's not suggesting that this is a blanket rule that anytime someone accesses a URL that that gives free reign to the government to do what it likes. Well, there are two nuances there, Your Honor. One is that the URL is not, it hasn't been established within the four corners of the affidavit. What I'm saying, and I don't mean to interrupt you, I want you to answer this, is that every case it's fact specific. There's no blanket rule that would apply across the board with respect to the government being able to make this connection that they're attempting to make in this case, and that's my point. Insofar as it's possible to encompass this, I think it's really important for the court to so hold that a single click on a URL shouldn't be enough. And because of the risk that we run that bad actors can use this technique, trolls could then, any website that allows for user commentary would then run the risk of a troll that doesn't like a particular website might post a comment with a URL link that they know links to a file sharing service that would be investigated. And by the time anyone clicks on that link, even if they realize, oh I've navigated to a place I don't want to go to, their IP address is already logged for law enforcement to be able to go and search. So the concern you've got is the planting of evidence basically, right? Because of how easy it is for people to share URLs, if the court were to find that this was enough, that a single click on a URL, even one that has been investigated by law enforcement in the way that it was investigated here, if that were enough, anyone who accidentally or served that URL in a completely different context would run the risk of having their home searched. Again, that possibility that there's a troll. Nothing in the record suggests that it's a real possibility that a troll could do that. It's not just a real possibility, it's almost a guarantee with how the internet works. Where in the record am I looking at for that? As a friend of the court, I'm trying to contextualize how the internet works for the court. This would become so easy to exploit. That's what our users are concerned about. Because of how URL spoofing works, because of link shorteners, it would be incredibly easy for anyone who would come across this kind of URL. Let's be clear, it's not actually a link to the specific file, it's a link to a portal on a file sharing service. So no one has to actually possess any... Paragraph 8 here says it's a link to a specific file. The affidavit here says, I went to this link and it found this file. I get that it may be in a different case, but here they actually say what's there in paragraph 8. All that they say in paragraph 8 is, we don't have the full URL, but it's just a URL. It's the URL that we're concerned about. The URL, even though it goes to a specific place, you don't actually need to access what's on the other side of that to share that link. I can copy and paste. If I'm a bad actor, and I can navigate the dark web, and I see this on a bulletin board, and I know that context in which I've encountered it, and I choose to share it in a completely different context, all of the people that I share that with will have no idea that that's what they're doing and that their IP address is being logged for later investigation. That's so completely easy to do if the court doesn't make this rule. Thank you both and all for your arguments. We'll come down and greet the court and proceed. We'll proceed to the next case. --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/argument%3A61302. Public record. Not legal advice.