Argued: January 31, 2019
from the United States District Court for the Eastern
District of Virginia, at Alexandria. Leonie M. Brinkema,
District Judge. (1:17-cr-00302-LMB-1)
William Davis Ashwell, MARK B. WILLIAMS & ASSOCIATES,
PLC, Warrenton, Virginia, for Appellant.
Fletcher Nathaniel Smith III, OFFICE OF THE UNITED STATES
ATTORNEY, Alexandria, Virginia, for Appellee.
Stephanie Lacambra, ELECTRONIC FRONTIER FOUNDATION, San
Francisco, California, for Amicus Curiae.
Zachary Terwilliger, United States Attorney, Lauren Britsch,
Trial Attorney, OFFICE OF THE UNITED STATES ATTORNEY,
Alexandria, Virginia, for Appellee.
Cope, Andrew Crocker, Aaron Mackey, ELECTRONIC FRONTIER
FOUNDATION, San Francisco, California, for Amicus Curiae.
WYNN, DIAZ, and RICHARDSON, Circuit Judges.
basic facts are these. One day, a link appeared on a
secretive online message board. Accompanying the link was a
message describing its contents unmistakably as child
pornography, as well as numerous thumbnail images depicting
sexual molestation of a female toddler. And if you clicked
the link, it took you, as promised, to multiple videos of
same day, an IP address associated with Nikolai Bosyk's
house accessed the link. Based on these facts, the government
obtained a warrant to search Bosyk's home for evidence of
child pornography. The primary question before us is whether
that warrant was supported by probable cause. Concluding that
it was, we affirm.
September 2015, a Department of Homeland Security cybercrimes
unit began investigating an online message board known as
"Bulletin Board A." This board was "dedicated
to the advertisement, distribution and production of child
pornography," and had more than 1, 500 "approved
users." J.A. 163-64. The site contained several forums
and subforums in which members could post and view various
genres of child pornography.
such posting occurred on November 2, 2015. That day, an
unidentified member of Bulletin Board A posted a message in
the board's "Pre-teen Hardcore" section
describing in graphic terms the contents of four videos. J.A.
164. Below the message were three sets of 20 video thumbnail
images depicting "juvenile females engaged in sexual
acts." Id. And below those images was a URL
link-an apparently random string of numbers and letters.
post also contained a password "which users could input
to access and open the content of the file associated with
that unique URL." J.A. 165. Using this password, federal
investigators downloaded and viewed an encrypted file, which
showed a man molesting a young girl, apparently a toddler.
Three other videos associated with the link also contained
link and its contents were hosted by a separate filesharing
site (referred to as "the File Sharing Site"). This
site allows users to upload and share various media, and
hosts plenty of lawful content. But the government also knew
that Bulletin Board A's members used the File Sharing
Site (and similar services) to share sexually explicit
content with one another. So, in December 2015, investigators
subpoenaed the File Sharing Site for business records related
to web pages containing illicit material. In response, the
company produced records showing that on November 2, 2015, at
3:23 p.m., an IP address "was used to download or
attempt to download file content associated with" the
URL containing the four videos. J.A. 167-68. In other words,
the records showed that on the same day that the post and
link appeared on Bulletin Board A, someone using this IP
address clicked that same link.
subpoenaing a broadband provider, investigators connected the
IP address to Bosyk's home in Purcellville, Virginia. In
April 2016, the government applied for a warrant to search
Bosyk's house. It supported the application with an
affidavit sworn by DHS Special Agent Kristina Eyler, which
recounted the facts above.
affidavit also described several "characteristics of
individuals who possess or access with intent to view child
pornography." J.A. 168. Such people, she said, may
collect explicit materials and use them for arousal or to
groom victims. They often store these materials
electronically "for several years," and frequently
keep them nearby for ease of viewing. J.A. 169. Some
individuals have been known to download, view, then delete
child pornography from their electronic devices on a cyclical
basis. But "evidence of such activity, including deleted
child pornography, often can be located on these
individuals' computers and digital devices through the
use of forensic tools." J.A. 169.
on this information, Agent Eyler submitted that there was
probable cause to suspect violations of federal laws against
distributing, receiving, possessing, and accessing with
intent to view child pornography, see 18 U.S.C.
§§ 2252, 2252A, and that evidence of those
suspected crimes would be found at Bosyk's address. A
magistrate judge agreed, issuing a warrant that allowed the
search of Bosyk's residence and the seizure of computers,
digital devices, storage media, and related evidence.
executed the warrant four days later (on April 12, 2016) and
recovered devices containing thousands of images and videos
of child pornography, including the particular video
described in the search warrant affidavit. Agents also found evidence
that Bosyk had used an anonymous web browser to access
dark-web child pornography websites, including Bulletin Board
was later indicted on child pornography charges. He moved to
suppress the evidence obtained under the warrant and sought a
hearing under Franks v. Delaware, 438 U.S. 154
(1978), to show that Eyler had misled the magistrate judge.
The district court denied the motion, holding that the
warrant was supported by probable cause and that, in any
event, suppression would be unwarranted. Bosyk later pleaded guilty
to one count of receiving child pornography and was sentenced
to five years in prison.
reserved the right to appeal the denial of his motion to
suppress, Bosyk asks us to reverse that ruling and vacate his
conviction. He raises three arguments. First, he argues that
the search of his home violated the Fourth Amendment as it
wasn't supported by probable cause. Second, he contends
that even if the government had cause to search his home in
November 2015 (when the post appeared on Bulletin Board A and
the link was accessed), it didn't in April 2016 when it
actually obtained and executed the warrant. Finally, Bosyk
argues that suppression is warranted under United States
v. Leon, 468 U.S. 897 (1984), because Eyler's
affidavit was misleading and lacked any indicia of probable
considering a district court's denial of a suppression
motion, we review its legal conclusions de novo, viewing the
evidence in the light most favorable to the government.
United States v. Kolsuz, 890 F.3d 133, 141-42 (4th
Cir. 2018). For reasons that follow, we find no error.
searching a home, the government generally must obtain a
warrant, supported by probable cause. Fernandez v.
California, 571 U.S. 292, 298 (2014); see U.S.
Const. amend. IV. Probable cause requires only "a fair
probability," and not a prima facie showing, that
"contraband or evidence of a crime will be found in a
particular place." Illinois v. Gates, 462 U.S.
213, 238 (1983). Probable cause is therefore "not a high
bar." District of Columbia v. Wesby, 138 S.Ct.
577, 586 (2018) (quoting Kaley v. United States, 571
U.S. 320, 338 (2014)). And officers need not "rule out a
suspect's innocent explanation for suspicious facts"
to obtain a warrant. Id. at 588.
magistrate judge issued the challenged warrant, our task
isn't to assess probable cause de novo. Gates,
462 U.S. at 236. Instead, we apply a deferential and
pragmatic standard to determine whether the judge "had a
substantial basis for concluding that a search would uncover
evidence of wrongdoing." Gates, 462 U.S. at 236
(alterations and internal quotation marks omitted). In doing
so, we consider only the facts presented in the warrant
application. United States v. Lyles, 910 F.3d 787,
791 (4th Cir. 2018).
and his amicus (the Electronic Frontier Foundation, or
"EFF") argue that the facts recounted in Agent
Eyler's affidavit didn't give the government probable
cause to search Bosyk's house for evidence of child
pornography. They argue that the government obtained its
warrant based on a "single click" of a URL, which,
they say, cannot support a search of somebody's home. We
disagree. The facts in the affidavit support a reasonable
inference that someone using Bosyk's IP address clicked
the link knowing that it contained child pornography. This in
turn makes it fairly probable that criminal evidence would
have been found at Bosyk's address.
"critical fact" in this case, as the district court
observed, is the timing. J.A. 76. On the very day that
someone clicked the link, it appeared on a website whose
purpose was to advertise and distribute child pornography to
its limited membership. And it appeared in a post containing
text and images that unequivocally identified its contents as
child pornography. The close timing between the link's
appearance on Bulletin Board A and the click by a user's
IP address is highly relevant: because the link was accessed
on the same day it appeared on Bulletin Board A, it is at
least reasonably probable that the user clicked the link
having encountered it on that website.
this fair assumption, several inferences drop into place to
support the magistrate judge's decision to issue the
warrant. If one assumes, given the close timing, that the
user accessed the link after seeing it on Bulletin Board A,
it's fair to conclude that the user also knew it
contained child pornography, as that much was explicit from
the posting. On top of that, one can fairly conclude that the
same person typed the password posted on Bulletin Board A,
downloaded the content, and viewed the video contained at
that URL. For why else would someone who had seen the
pornographic stills and read the description on Bulletin
Board A click the link if not to access its contents? Thus,
if we suppose that someone accessed the link through Bulletin
Board A, it's fairly probable that the same person
downloaded or viewed child-pornographic images.
that the magistrate judge knew someone using Bosyk's home
IP address had clicked the link. Given that fact-and the
permissible inferences described above-we think it was fairly
probable that child pornography would be found on computers
or other devices within Bosyk's property. And because
child pornography constitutes contraband or evidence of a
crime, this is all that was needed for probable cause to
search Bosyk's house. See 18 U.S.C. §§
2252(a)(4), 2252A(a)(5) (crime to knowingly possess or access
with intent to view any video depicting child pornography);
see also, e.g., United States v. Contreras,
905 F.3d 853, 858 (5th Cir. 2018) (probable cause to search
house based on two child pornography images uploaded to
messaging app); United States v. Richardson, 607
F.3d 357, 361, 371 (4th Cir. 2010) (same, based on two
emailed images); United States v. Vosburgh, 602 F.3d
512, 526-28 (3d Cir. 2010) (same, based on attempt to
download one video).
acknowledge that the probability of this particular version
of events depends on the link being clicked after it
was posted on Bulletin Board A. The affidavit doesn't
specify what time on November 2, 2015, the post appeared on
Bulletin Board A, meaning that the link (which was accessed
at 3:23 p.m. that day) could have been clicked before its
ambiguity, however, is not as fatal to probable cause as our
dissenting colleague suggests. As his own analysis shows, it
was almost twice as likely that the post preceded the click
as the other way around. See Dissenting Op. at 43
(Figure A) (showing more than 64% probability that link was
clicked after being posted on Bulletin Board A). Thus, the
much likelier scenario based on the attested facts was that
the link was posted and then accessed hours later (perhaps
even sooner) by Bosyk's IP address. That chronology sets
in motion the series of plausible inferences described
short, although the search relied on a "single
click" of an internet link, the click was to a video of
child pornography in circumstances suggesting the person
behind that click plausibly knew about and sought out that
content. We think the magistrate judge therefore had a
substantial basis for concluding that searching Bosyk's
address would uncover evidence of wrongdoing.
otherwise, Bosyk and EFF train their sights on the first
inference in this chain of reasoning: that the user at
Bosyk's IP address quite probably knew the link contained
child pornography. They note that Eyler's affidavit
didn't say whether the link existed elsewhere on the
internet, or whether the site linked at the URL contained
content other than the illegal videos described in the
affidavit. And they also point out that the URL didn't
indicate what it linked to and that, in general, the act of
clicking a URL doesn't prove familiarity with its
contents. We do not find these alleged shortcomings fatal to
main critique is that the affidavit doesn't establish
whether the user who clicked on the link accessed it through
Bulletin Board A. He and EFF point out that the affidavit
doesn't exclude the possibility that the user might have
stumbled upon the link from another, perhaps innocent,
source-especially given how easily and frequently links are
shared over the internet. This is also the essence of our
dissenting colleague's position. See Dissenting
Op. at 44-55.
problem with this argument, however, is that it demands more
proof than is required to obtain a warrant. Probable cause,
as the Supreme Court has reiterated time and again,
"does not require officers to rule out a suspect's
innocent explanation for suspicious facts."
Wesby, 138 S.Ct. at 588. Instead, the government
needs to demonstrate only a fair probability that contraband
or evidence of a crime will be found at the place to be
searched. To be sure, innocent reasons may explain why
someone accessed a file sharing page containing child
pornography. Perhaps (as our friend in dissent posits)
someone received the link from a malicious sender, or was
looking for innocuous material hosted at the same filesharing
webpage, or truly stumbled upon the URL accidentally. But
this is all conjecture-no facts in the affidavit suggested
the link existed anywhere on the internet but Bulletin Board
A. And the possibility that it did doesn't defeat
probable cause when it's fairly probable, given the
temporal proximity, that the person clicked on the link
because he saw it on Bulletin Board A and wanted to view
Indeed, given the nature of the content, we think the
magistrate judge had reason to be skeptical about possible
innocent explanations. The notion advanced by EFF and
accepted by our dissenting colleague that a link containing
child pornography would spread throughout the internet like
more benign web content seems implausible in light of the
present record and the law's experience with online
pedophiles. As Eyler's affidavit explained, people who
possess and view child pornography often take steps to
conceal their contraband material, guard it closely, and
sometimes delete it to avoid detection. Cases likewise show
that consumers of child pornography frequently employ complex
measures to keep their online activities secret. See,
e.g., United States v. McGarity, 669 F.3d 1218,
1230-31 (11th Cir. 2012) (child pornography ring used
elaborate system of encryption, codenames, and hidden
instructions to conceal activities from outsiders),
abrogated on other grounds by Paroline v. United
States, 572 U.S. 434 (2014); Vosburgh, 602 F.3d
at 516-17 (child pornography website used secret gateways and
cumbersome links to evade detection). Thus, the likelihood
that a specific filesharing page containing child pornography
would find its way to somebody uninterested in such
contraband-thereby exposing its distributors to detection,
capture, and loss of their materials-is probably quite low.
point bears emphasis. Our dissenting colleague is of course
right that Bosyk's IP address could have connected with a
link containing child pornography in a variety (though
probably not "millions," see Dissenting
Op. at 44) of different ways. But, contrary to our
friend's suggestion, these many possible alternative
paths aren't of equal probability; rather, the
likelier avenues incriminate Bosyk.
first place, the facts involve material that, for reasons
just explained, is unlikely to travel widely outside child
pornography circles. On top of that, there is a suspiciously
short interval between such material appearing on a
members-only child pornography forum and being accessed by a
user at Bosyk's IP address. Given these facts, we believe
a magistrate judge could reasonably think it fairly likely-if
not most likely- that the user found the link through
Bulletin Board A or otherwise received it knowingly from a
member of that site. See J.A. 169 (explaining that
people who possess and view child pornography may "share
information and materials" with one another). Contrary
to our colleague's suggestion, this belief is not
"wholly unsupported speculation," Dissenting Op. at
84; rather, it is based on the contents of the affidavit, the
magistrate judge's likely familiarity with online child
pornography crimes, and his ability to reach
"common-sense conclusions about human behavior."
Gates, 462 U.S. 231-32 (quoting United States v.
Cortez, 449 U.S. 411, 418 (1981)).
and EFF's other arguments also miss the mark. They focus,
for instance, on the fact that the URL looked like a random
string of numbers and letters and therefore betrayed little
about its contents. Certainly, the government could have
established probable cause more easily had the link been
clearer about its illicit content. But here, the URL appeared
in a post that described and depicted its contents on the
same day that somebody clicked it. This context provides
evidence about the probable knowledge and intent of the user
that is otherwise lacking from the face of the
our dissenting colleague's broader arguments against the
inferential value of URLs merit the same response. They point
out that because URLs are often randomly generated,
shortened, or masked, they don't necessarily reveal their
contents to the person accessing them. Thus, EFF says, that
an IP address accessed a URL associated with contraband
doesn't necessarily provide cause to search property and
devices related to that address. That may often be true, and
in a case based purely on an IP address connecting with a
URL, probable cause may be hard to establish absent other
incriminating evidence. But that is not the case before us
because such evidence exists here: whoever clicked did so on
the same day that the link was advertised in a closed forum
dedicated to child pornography.
we are unswayed by the cases Bosyk and EFF rely on. Bosyk
draws heavily from United States v. Reece, an
unpublished district court opinion invalidating a warrant
issued as part of the same investigation of Bulletin Board A.
See No. 2:16cr104, 2017 U.S. Dist. LEXIS 220176, at
*12-15 (E.D. Va. Mar. 1, 2017). The Reece court held
that because the affidavit (as here) lacked evidence that the
defendant subscribed to or accessed Bulletin Board A, the
only possible inference was that he "could have"
accessed the video through that website. Id. at
*12-14. That inference, the court said, was
"insufficient to support the resulting search"
without the "inferential leap that Defendant must
have accessed Bulletin Board A to navigate to the
illicit material." Id. at *14 (internal
quotation marks omitted). As we have explained, however, the
law doesn't require the government to show that Bosyk
"must have" accessed the video via Bulletin Board
A; the fair probability that he did so is enough to sustain
the search. By suggesting otherwise, the Reece court
event, Reece is distinguishable because, there, two
days passed between the post on Bulletin Board A and an
attempt to access the link. See id. at *5-6. Here,
in contrast, those two events happened on the same day.
Whether or not the facts in Reece supported probable
cause, it's notable that the connection between the
suspect and Bulletin Board A is much closer in this case.
Cf. United States v. Evans, No. 16-20292, 2018 WL
1773308, at *3 (E.D. Mich. Apr. 12, 2018) (probable cause to
search home when IP address accessed link within 25 hours of
being posted on Bulletin Board A).
Bosyk and EFF also refer frequently to the Second
Circuit's divided decision in United States v.
Falso, 544 F.3d 110 (2d Cir. 2008). There, the court
invalidated a search warrant based on allegations that the
defendant "appeared" to have "either gained
access or attempted to gain access" to a website
associated with child pornography. Id. at 114
(alterations omitted). The majority found that the
"inconclusive statements" about whether the
defendant accessed the website, combined with the lack of
details about the website itself, fell short of establishing
probable cause. Id. at 121. Concurring in the
Judge Livingston faulted the majority's probable cause
analysis for overlooking that the defendant's email
address was found on the site, which she (reasonably, in our
opinion) thought "probative evidence that Falso visited
that website and either signed up or attempted to sign up for
a membership." Id. at 130-31 (Livingston, J.,
concurring in part and concurring in the judgment).
decline to follow Falso. That case is
distinguishable because there, the affidavit contained
"no allegation that [the defendant] in fact gained
access" to a website containing child pornography, nor
any allegation that "images of child pornography were
downloadable from the site." Id. at 124
(majority opinion). Here, by contrast, the affidavit alleged
that Bosyk's IP address accessed a URL whose content
"consisted of four child pornography videos." J.A.
167-68. Thus, the inference that someone at Bosyk's
address "in fact accessed a website" sharing child
pornography-crucially missing from Falso, 544 F.3d
at 124-is readily drawn in this case. See Vosburgh,
602 F.3d at 526-27 (probable cause to search home when IP
address clicked link purporting to contain child
pornography); cf. United States v. Martin, 426 F.3d
68, 75-76 (2d Cir. 2005) (probable cause to search home when
email address registered there joined website sharing child
pornography); United States v. Froman, 355 F.3d 882,
890-91 (5th Cir. 2004) (same).
to the dissent's suggestion, our opinion is not "at
odds" with out-of-circuit decisions reviewing search
warrants based on online encounters with child pornography.
Dissenting Op. at 71. The cases our colleague cites differ
factually from this one in meaningful respects, and therefore
aren't useful precedents. See Ornelas, 517 U.S.
at 698. Still, to the extent our sister circuits have at
times emphasized "additional facts . . . over and above
the single click of a URL that provides for download of child
pornography," Dissenting Op. at 71, we are all in tune.
Here, an important additional fact is the abbreviated time
frame, which lessens the likelihood that Bosyk's IP
address accessed the link independently of Bulletin Board A.
Accord, e.g., United States v. Gourde, 440
F.3d 1065, 1070 (9th Cir. 2006) (en banc) (suspect's paid
subscription to child pornography website reduced possibility
that visit was accidental).
the magistrate judge had a substantial basis for finding
probable cause to search Bosyk's house given two factual
allegations-first, the appearance on Bulletin Board A of a
post unambiguously promoting a link containing child
pornography videos, and second, an attempt to access that
link on the same day by someone at Bosyk's address. The
closeness of these two events established a fair probability
that child pornography or evidence of attempts to access it
would be found in Bosyk's house.
Bosyk argues that even if Agent Eyler's affidavit
established probable cause to search his house in November
2015 when the link was accessed, it didn't permit a
search in April 2016 when the warrant issued. "A valid
search warrant may issue only upon allegations of 'facts
so closely related to the time of the issue of the warrant as
to justify a finding of probable cause at that
time.'" United States v. McCall, 740 F.2d
1331, 1335-36 (4th Cir. 1984) (quoting Sgro v. United
States, 287 U.S. 206, 210 (1932)). Accordingly, Bosyk
argues that the warrant was based on "stale"
probable cause, and thus invalid, because it issued five
months after the underlying events took place.
existence of probable cause, however, can't be determined
by "simply counting the number of days between the
occurrence of the facts supplied and the issuance of the
affidavit." Richardson, 607 F.3d at 370
(quoting McCall, 740 F.3d at 1136). Instead, like
probable cause more generally, staleness is judged based on
"all the facts and circumstances of the case, including
the nature of the unlawful activity" and "the
nature of the property to be seized." Id.
for this case, when it comes to child pornography, courts
have largely concluded that "even a substantial
delay" between download or distribution of child
pornography and the issuance of a search warrant doesn't
render the underlying information stale. Id. This
consensus rests, as we explained in Richardson,
"on the widespread view" that "collectors and
distributors of child pornography value their sexually
explicit materials highly, rarely if ever dispose of such
material, and store it for long periods in a secure place,
typically in their homes." Id. (internal
quotation marks and citations omitted); accord United
States v. Raymonda, 780 F.3d 105, 114 (2d Cir. 2015)
(staleness inquiry is "unique" in child pornography
context); Gourde, 440 F.3d at 1072; United
States v. Riccardi, 405 F.3d 852, 861 (10th Cir. 2005).
It also rests, in many cases, on the fact that digital media
files persist for a long time and can often be forensically
recovered even after being "deleted." See
Richardson, 607 F.3d at 370-71; see also United
States v. Seiver, 692 F.3d 774, 775-78 (7th Cir. 2012)
("'Staleness' is highly relevant to the legality
of a search for a perishable or consumable object, like
cocaine, but rarely relevant when it is a computer
result, in cases involving online child pornography, courts
(including ours) have sustained warrants issued many months,
and even years, after the events that gave rise to probable
cause. See, e.g., Contreras, 905 F.3d at
858-59 (warrant sought 11 months after suspect uploaded two
images); Richardson, 607 F.3d at 371 (warrant sought
four months after suspect emailed child pornography);
Vosburgh, 602 F.3d at 528 (warrant sought four
months after three attempts to access download link);
United States v. Morales-Aldahondo, 524 F.3d 115,
119 (1st Cir. 2008) (warrant sought three years after last
accordance with these cases, Agent Eyler's affidavit
described the tendency of "individuals who possess or
access with intent to view child pornography" to collect
such material and hoard it for a long time. J.A. 168-69. But
Bosyk says the inference that child pornography will be found
months after possession or attempted possession applies only
when the suspect is plausibly a "collector" of
child pornography. And, according to Bosyk, nothing in the
affidavit identified him as a "collector."
agree with Bosyk to the following extent-the value of this
inference "depends on the preliminary finding that the
suspect is a person interested in images of child
pornography." Raymonda, 780 F.3d at 114
(internal quotation marks omitted). Such a finding, as the
Second Circuit has explained, "tend[s] to negate the
possibility that a suspect's brush with child pornography
was a purely negligent or inadvertent encounter, the residue
of which was long ago expunged." Id. at 115.
Officials may support this inference with, say, information
that the suspect paid for access to child pornography, had a
history of possessing pornographic images, was an admitted or
convicted pedophile, took elaborate steps to access illegal
content, or distributed content to others. Id. at
114-15 (collecting cases). In each of these cases, it's
possible to infer that the suspect is a collector of child
pornography because of "circumstances suggesting that he
had accessed those images willfully and deliberately,
actively seeking them out to satisfy a preexisting
predilection." Id. at 115.
we disagree with Bosyk, however, is in applying these
principles. We think it was possible to infer from the
affidavit that whoever clicked on the link did so willfully
and deliberately because he was interested in images of child
pornography. Specifically, as we have already explained, the
facts in the affidavit support the inference that somebody
saw the description and video thumbnails on a website devoted
to child pornography, Bulletin Board A, and then deliberately
sought out the video by clicking the link. The magistrate judge could
therefore further infer that someone at Bosyk's home
likely downloaded, stored, and kept that content, since
people "with an interest in child pornography tend to
hoard their materials and retain them for a long time."
Vosburgh, 602 F.3d at 528. We therefore find the
warrant valid even though it issued five months after the
underlying events took place.
we note that regardless of the warrant's validity in this
case, we would nonetheless affirm as we may not suppress
evidence "obtained in objectively reasonable reliance on
a subsequently invalidated search warrant." United
States v. Leon, 468 U.S. 897, 922 (1984).
however, invokes two exceptions that the Supreme Court has
carved out of this rule. First, he argues that the issuing
judge "was misled by information in an affidavit that
the affiant knew was false or would have known was false
except for [her] reckless disregard for the truth."
Id. at 923 (citing Franks v. Delaware, 438
U.S. 154 (1978)). Second, he and EFF maintain that the
affidavit was "so lacking in indicia of probable cause
as to render official belief in its existence entirely
unreasonable." Id. (quoting Brown v.
Illinois, 422 U.S. 590, 611 (1975) (Powell, J.,
concurring)). Neither exception applies.
first exception is inapplicable because Bosyk doesn't
actually identify any omitted or misstated facts in
Eyler's affidavit. Instead, he complains that Eyler
didn't note the absence of certain facts, such
as the lack of any allegation that a user at his IP address
was a member of Bulletin Board A, accessed the link through
that site, or entered the password displayed there. But we
agree with the government that agents need not include
disclaimers specifically pointing out facts absent from the
affidavit to obtain a warrant. A warrant application is
"judged on the adequacy of what it does contain, not on
what it lacks, or on what a critic might say should have been
added." United States v. Allen, 211 F.3d 970,
975 (6th Cir. 2000) (en banc). Here, the affidavit accurately
explained that Bulletin Board A had members, that a URL was
posted there, and that an IP address at Bosyk's residence
accessed the URL. From these facts, along with the absence of
other allegations, the magistrate judge could fairly assess
the strength of the government's evidence.
dissenting friend believes the affidavit was materially
misleading because, in his view, most factual material was
unrelated to Bosyk and, therefore, served only to lend the
affidavit a false appearance of substance. Dissenting Op. at
90-91 (citing United States v. Wilhelm, 80 F.3d 116,
123 (4th Cir. 1996)). This is a blinkered reading of the
affidavit. Our colleague apparently believes it
"irrelevant," id. at 90, that Bulletin
Board A was a dedicated child pornography site; that a link
appeared on this site next to pornographic images; and that
the link contained videos of a girl being sexually abused.
True, these facts don't literally "address allegedly
unlawful conduct of someone using [Bosyk's] IP
address." Id. at 91. But as our analysis above
makes plain, they are nonetheless crucial to understanding
why the government believed Bosyk's home would contain
evidence of criminal activity. These details are hardly
irrelevant "puffing." Contra id.
is the dreaded "boilerplate" about collectors.
But see id. at 91-92. This information drew on
accepted case law and served to establish that Bosyk's
computer would contain child pornography (or at least its
remnants) some months after the attempted access. Our
colleague clearly disagrees with us about whether, at the end
of the day, the information in the affidavit established
probable cause. But he cannot seriously think these facts are
so immaterial to the probable cause inquiry that the sole
purpose for their inclusion was to put one over on the
magistrate judge. Cf. Wilhelm, 80 F.3d at 123
(suppressing evidence when affidavit distracted from lack of
probable cause by describing anonymous informant as "a
concerned citizen," and "a mature person" with
a "truthful demeanor").
dissenting colleague would also vacate Bosyk's conviction
because of an allegedly omitted fact-the exact timing of the
post on Bulletin Board A-that isn't in the record and,
for all we know, may not even exist. Dissenting Op. at 93-94.
We cannot do so. As our colleague well knows, a defendant
can't suppress evidence on grounds that the affiant
intentionally or recklessly omitted facts without first
making "a substantial preliminary showing" to that
effect. United States v. Tate, 524 F.3d 449, 454-55
(4th Cir. 2008) (quoting Franks, 438 U.S. at
155-56). And, importantly, that showing requires "a
detailed offer of proof" of the missing information.
Id. at 455 (quotation marks omitted); see also
Franks, 438 U.S. at 171 ("Affidavits or sworn or
otherwise reliable statements of witnesses should be
furnished, or their absence satisfactorily explained.").
Yet despite moving for a Franks hearing in the
district court, Bosyk never offered proof of any
omitted fact, nor explained why he couldn't offer such
proof. That failure precludes suppression on the basis of
intentional or reckless omissions.
Bosyk argues for suppression because, he says, the affidavit
lacked any indicia of probable cause. This argument also
fails. Suppression on such grounds is
"inappropriate" when an affidavit produces
"disagreement among thoughtful and competent judges as
to the existence of probable cause." Leon, 468
U.S. at 926. That's the case here. District court judges
have reasonably disagreed on the constitutionality of
warrants like this one. Compare J.A. 74-79 (probable
cause to search home months after IP address accessed link
posted on Bulletin Board A), Evans, 2018 WL 1773308,
at *3 (same), and United States v. Seitter, No.
17-10041-JTM, 2017 WL 4516909, at *3-4 (D. Kan. Oct. 10,
2017) (same), with Reece, 2017 U.S. Dist. LEXIS
220176, at *19-20 (no probable cause). And, as evidenced by
our separate opinions, the judges on this panel are also
divided on the question. In such circumstances, we cannot say
that it was objectively unreasonable for the government to
rely on the warrant. Leon, 468 U.S. at 926
(declining to suppress evidence when court of appeals panel
split on probable cause question); Falso, 544 F.3d
at 128-29 (same).
even if there hadn't been probable cause to search
Bosyk's house, suppression would be inappropriate because
the government obtained a warrant and reasonably relied on it
to execute the search. For this independent reason also, we
must affirm the district court's judgment.
sensitive to the privacy interests at stake here. But we also
cannot ignore that many crimes are committed with just a few
clicks of a mouse-including the very serious crime of
downloading child pornography. In cases like this, our job is
to ask precisely what "a single click" reveals
under the circumstances presented, and whether that
information justifies searching a person's most private
places for evidence of a crime. Here, the magistrate judge
who issued the warrant had a substantial basis for concluding
that it did. For that reason, the district court's denial
of Bosyk's motion to suppress is
Circuit Judge, dissenting:
case presents a textbook example of why we must guard against
the slow whittling away of constitutional rights,
particularly as we apply constitutional rights adopted in an
analog era to the new challenges of the digital age.
understanding of the technology at issue demonstrates that
the government's bare-bones affidavit supporting a
warrant to search the residence of Defendant Nikolai Bosyk
("Defendant") failed to establish a fair
probability that, when clicking on a link to download child
pornography, someone using Defendant's IP address knew
and sought out that illicit content. Indeed, rather than
confronting the difficult technological questions courts must
address in assessing warrant applications premised on online
conduct, the majority opinion rests on analog frameworks that
fail to account for the meaningful differences between the
Internet and the physical world. With due respect to my
colleagues in the majority, I believe the majority opinion
displays a troubling incomprehension of the technology at
issue in this matter. Accordingly, I respectfully dissent.
matter arose from the government's monitoring of Bulletin
Board A, an "Internet-based bulletin board . . .
dedicated to the advertisement, distribution and production
of child pornography" with over "1500 'approved
users.'" J.A. 163-64.
to an affidavit submitted by the government in support of the
challenged search warrant, the government began
"observ[ing] various postings" and
"captur[ing] content" on Bulletin Board A in
October 2015. J.A. 164; Gov't Br. at 4, 5, 13. On
November 2, 2015, a Bulletin Board A member posted on a
sub-forum of Bulletin Board A. That post described a
particular child pornography video; posted "three
different sets of twenty video thumbnail images" of the
video; and included a URL composed of a largely random sequence of
letters and numbers, described in the affidavit alternatively
and"http://[redacted].comxu5me9erdipp/brochure.rar.html." J.A. 49.
affidavit states that the Bulletin Board A post also provided
a password, which users could input to access the content of
the file associated with that unique URL. Gov't Br. at 5.
Without the password, the file could not be opened and
viewed. The affidavit does not identify at what time on
November 2, 2015, the Bulletin Board A member made the post.
And notwithstanding that the government was routinely
"observ[ing]" and "captur[ing]" content
on Bulletin Board A at that time, the affidavit does not
state whether the URL and password had previously or
subsequently been posted on Bulletin Board A or elsewhere on
the Internet. J.A. 164; Gov't Br. at 4, 5, 13.
to an understanding of the technology at play in this matter,
Bulletin Board A did not host the URL or the content
accessible through the URL. Rather, a wholly independent
website "offer[ing] online file hosting and sharing
services" (such as DropBox, Google Drive, or Apple
iCloud)-which the affidavit refers to using the pseudonym
"File Sharing Site"-hosted the URL and content.