United States v. Bosyk

933 F.3d 319

UNITED STATES of America, Plaintiff - Appellee,

v.Nikolai BOSYK, Defendant – Appellant.

Electronic Frontier Foundation, Amicus Supporting Appellant.

No. 18-4302

United States Court of Appeals, Fourth Circuit.

Argued: January 31, 2019

Decided: August 1, 2019

ARGUED: William Davis Ashwell, MARK B. WILLIAMS & ASSOCIATES, PLC, Warrenton, Virginia, for Appellant. Fletcher Nathaniel Smith III, OFFICE OF THE UNITED STATES ATTORNEY, Alexandria, Virginia, for Appellee. Stephanie Lacambra, ELECTRONIC FRONTIER FOUNDATION, San Francisco, California, for Amicus Curiae. ON BRIEF: G. Zachary Terwilliger, United States Attorney, Lauren Britsch, Trial Attorney, OFFICE OF THE UNITED STATES ATTORNEY, Alexandria, Virginia, for Appellee. Sophia Cope, Andrew Crocker, Aaron Mackey, ELECTRONIC FRONTIER FOUNDATION, San Francisco, California, for Amicus Curiae.

Before WYNN, DIAZ, and RICHARDSON, Circuit Judges.

Affirmed by published opinion. Judge Diaz wrote the majority opinion, in which Judge Richardson joined. Judge Wynn wrote a dissenting opinion.

DIAZ, Circuit Judge:

The basic facts are these. One day, a link appeared on a secretive online message board. Accompanying the link was a message describing its contents unmistakably as child pornography, as well as numerous thumbnail images depicting sexual molestation of a female toddler. And if you clicked the link, it took you, as promised, to multiple videos of child pornography.

On that same day, an IP address associated with Nikolai Bosyk’s house accessed the link. Based on these facts, the government obtained a warrant to search Bosyk’s home for evidence of child pornography. The primary question before us is whether that warrant was supported by probable cause. Concluding that it was, we affirm.

I.

In September 2015, a Department of Homeland Security cybercrimes unit began investigating an online message board known as "Bulletin Board A." This board was "dedicated to the advertisement, distribution and production of child pornography," and had more than 1,500 "approved users." J.A. 163–64. The site contained several forums and subforums in which members could post and view various genres of child pornography.¹

One such posting occurred on November 2, 2015. That day, an unidentified member of Bulletin Board A posted a message in the board’s "Pre-teen Hardcore" section describing in graphic terms the contents of four videos. J.A. 164. Below the message were three sets of 20 video thumbnail images depicting "juvenile females engaged in sexual acts." Id. And below those images was a URL link—an apparently random string of numbers and letters.

The post also contained a password "which users could input to access and open the content of the file associated with that unique URL." J.A. 165. Using this password, federal investigators downloaded and viewed an encrypted file, which showed a man molesting a young girl, apparently a toddler. Three other videos associated with the link also contained child pornography.

This link and its contents were hosted by a separate filesharing site (referred to as "the File Sharing Site"). This site allows users to upload and share various media, and hosts plenty of lawful content. But the government also knew that Bulletin Board A’s members used the File Sharing Site (and similar services) to share sexually explicit content with one another. So, in December 2015, investigators subpoenaed the File Sharing Site for business records related to web pages containing illicit material. In response, the company produced records showing that on November 2, 2015, at 3:23 p.m., an IP address "was used to download or attempt to download file content associated with" the URL containing the four videos. J.A. 167–68. In other words, the records showed that on the same day that the post and link appeared on Bulletin Board A, someone using this IP address clicked that same link.

By subpoenaing a broadband provider, investigators connected the IP address to Bosyk’s home in Purcellville, Virginia. In April 2016, the government applied for a warrant to search Bosyk’s house. It supported the application with an affidavit sworn by DHS Special Agent Kristina Eyler, which recounted the facts above.

Eyler’s affidavit also described several "characteristics of individuals who possess or access with intent to view child pornography." J.A. 168. Such people, she said, may collect explicit materials and use them for arousal or to groom victims. They often store these materials electronically "for several years," and frequently keep them nearby for ease of viewing. J.A. 169. Some individuals have been known to download, view, then delete child pornography from their electronic devices on a cyclical basis. But "evidence of such activity, including deleted child pornography, often can be located on these individuals’ computers and digital devices through the use of forensic tools." J.A. 169.

Based on this information, Agent Eyler submitted that there was probable cause to suspect violations of federal laws against distributing, receiving, possessing, and accessing with intent to view child pornography, see 18 U.S.C. §§ 2252, 2252A, and that evidence of those suspected crimes would be found at Bosyk’s address. A magistrate judge agreed, issuing a warrant that allowed the search of Bosyk’s residence and the seizure of computers, digital devices, storage media, and related evidence.

Investigators executed the warrant four days later (on April 12, 2016) and recovered devices containing thousands of images and videos of child pornography, including the particular video described in the search warrant affidavit.² Agents also found evidence that Bosyk had used an anonymous web browser to access dark-web child pornography websites, including Bulletin Board A.

Bosyk was later indicted on child pornography charges. He moved to suppress the evidence obtained under the warrant and sought a hearing under Franks v. Delaware , 438 U.S. 154, 98 S.Ct. 2674, 57 L.Ed.2d 667 (1978), to show that Eyler had misled the magistrate judge. The district court denied the motion, holding that the warrant was supported by probable cause and that, in any event, suppression would be unwarranted.³ Bosyk later pleaded guilty to one count of receiving child pornography and was sentenced to five years in prison.

II.

Having reserved the right to appeal the denial of his motion to suppress, Bosyk asks us to reverse that ruling and vacate his conviction. He raises three arguments. First, he argues that the search of his home violated the Fourth Amendment as it wasn’t supported by probable cause. Second, he contends that even if the government had cause to search his home in November 2015 (when the post appeared on Bulletin Board A and the link was accessed), it didn’t in April 2016 when it actually obtained and executed the warrant. Finally, Bosyk argues that suppression is warranted under United States v. Leon , 468 U.S. 897, 104 S.Ct. 3405, 82 L.Ed.2d 677 (1984), because Eyler’s affidavit was misleading and lacked any indicia of probable cause.

When considering a district court’s denial of a suppression motion, we review its legal conclusions de novo, viewing the evidence in the light most favorable to the government. United States v. Kolsuz , 890 F.3d 133, 141–42 (4th Cir. 2018). For reasons that follow, we find no error.

III.

Before searching a home, the government generally must obtain a warrant, supported by probable cause. Fernandez v. California , 571 U.S. 292, 298, 134 S.Ct. 1126, 188 L.Ed.2d 25 (2014) ; see U.S. Const. amend. IV. Probable cause requires only "a fair probability," and not a prima facie showing, that "contraband or evidence of a crime will be found in a particular place." Illinois v. Gates , 462 U.S. 213, 238, 103 S.Ct. 2317, 76 L.Ed.2d 527 (1983). Probable cause is therefore "not a high bar." District of Columbia v. Wesby , ––– U.S. ––––, 138 S. Ct. 577, 586, 199 L.Ed.2d 453 (2018) (quoting Kaley v. United States , 571 U.S. 320, 338, 134 S.Ct. 1090, 188 L.Ed.2d 46 (2014) ). And officers need not "rule out a suspect’s innocent explanation for suspicious facts" to obtain a warrant. Id. at 588.

Since a magistrate judge issued the challenged warrant, our task isn’t to assess probable cause de novo. Gates , 462 U.S. at 236, 103 S.Ct. 2317. Instead, we apply a deferential and pragmatic standard to determine whether the judge "had a substantial basis for concluding that a search would uncover evidence of wrongdoing." Gates , 462 U.S. at 236, 103 S.Ct. 2317 (alterations and internal quotation marks omitted). In doing so, we consider only the facts presented in the warrant application. United States v. Lyles , 910 F.3d 787, 791 (4th Cir. 2018).

A.

Bosyk and his amicus (the Electronic Frontier Foundation, or "EFF") argue that the facts recounted in Agent Eyler’s affidavit didn’t give the government probable cause to search Bosyk’s house for evidence of child pornography. They argue that the government obtained its warrant based on a "single click" of a URL, which, they say, cannot support a search of somebody’s home. We disagree. The facts in the affidavit support a reasonable inference that someone using Bosyk’s IP address clicked the link knowing that it contained child pornography. This in turn makes it fairly probable that criminal evidence would have been found at Bosyk’s address.

The "critical fact" in this case, as the district court observed, is the timing. J.A. 76. On the very day that someone clicked the link, it appeared on a website whose purpose was to advertise and distribute child pornography to its limited membership. And it appeared in a post containing text and images that unequivocally identified its contents as child pornography. The close timing between the link’s appearance on Bulletin Board A and the click by a user’s IP address is highly relevant: because the link was accessed on the same day it appeared on Bulletin Board A, it is at least reasonably probable that the user clicked the...