UNITED STATES of America, Plaintiff - Appellee, v. Nikolai BOSYK, Defendant - Appellant. Electronic Frontier Foundation, Amicus Supporting Appellant., 933 F.3d 319

DIAZ, Circuit Judge: The basic facts are these. One day, a link appeared on a secretive online message board. Accompanying the link was a message describing its contents unmistakably as child pornography, as well as numerous thumbnail images depicting sexual molestation of a female toddler. And if you clicked the link, it took you, as promised, to multiple videos of child pornography. On that same day, an IP address associated with Nikolai Bosyk's house accessed the link. Based on these facts, the government obtained a warrant to search Bosyk's home for evidence of child pornography.

The primary question before us is whether that warrant was supported by probable cause. Concluding that it was, we affirm. I. In September 2015, a Department of Homeland Security cybercrimes unit began investigating an online message board known as "Bulletin Board A." This board was "dedicated to the advertisement, distribution and production of child pornography," and had more than 1,500 "approved users." J.A. 163-64. The site contained several forums and subforums in which members could post and view various genres of child pornography. One such posting occurred on November 2, 2015.

That day, an unidentified member of Bulletin Board A posted a message in the board's "Pre-teen Hardcore"

section describing in graphic terms the contents of four videos. J.A. 164. Below the message were three sets of 20 video thumbnail images depicting "juvenile females engaged in sexual acts." Id. And below those images was a URL link-an apparently random string of numbers and letters. The post also contained a password "which users could input to access and open the content of the file associated with that unique URL." J.A. 165. Using this password, federal investigators downloaded and viewed an encrypted file, which showed a man molesting a young girl, apparently a toddler.

Three other videos associated with the link also contained child pornography. This link and its contents were hosted by a separate filesharing site (referred to as "the File Sharing Site"). This site allows users to upload and share various media, and hosts plenty of lawful content. But the government also knew that Bulletin Board A's members used the File Sharing Site (and similar services) to share sexually explicit content with one another. So, in December 2015, investigators subpoenaed the File Sharing Site for business records related to web pages containing illicit material.

In response, the company produced records showing that on November 2, 2015, at 3:23 p.m., an IP address "was used to download or attempt to download file content associated with" the URL containing the four videos. J.A. 167-68. In other words, the records showed that on the same day that the post and link appeared on Bulletin Board A, someone using this IP address clicked that same link. By subpoenaing a broadband provider, investigators connected the IP address to Bosyk's home in Purcellville, Virginia. In April 2016, the government applied for a warrant to search Bosyk's house.

It supported the application with an affidavit sworn by DHS Special Agent Kristina Eyler, which recounted the facts above. Eyler's affidavit also described several "characteristics of individuals who possess or access with intent to view child pornography." J.A. 168. Such people, she said, may collect explicit materials and use them for arousal or to groom victims. They often store these materials electronically "for several years," and frequently keep them nearby for ease of viewing. J.A. 169.

Some individuals have been known to download, view, then delete child pornography from their electronic devices on a cyclical basis. But "evidence of such activity, including deleted child pornography, often can be located on these individuals' computers and digital devices through the use of forensic tools." J.A. 169.

Based on this information, Agent Eyler submitted that there was probable cause to suspect violations of federal laws against distributing, receiving, possessing, and accessing with intent to view child pornography, see 18 U.S.C. §§ 2252, 2252A, and that evidence of those suspected crimes would be found at Bosyk's address. A magistrate judge agreed, issuing a warrant that allowed the search of Bosyk's residence and the seizure of computers, digital devices, storage media, and related evidence.

Investigators executed the warrant four days later (on April 12, 2016) and recovered devices containing thousands of images and videos of child pornography, including the particular video described in the search warrant affidavit. Agents also found evidence that Bosyk had used an anonymous web browser to access dark-web child pornography websites, including Bulletin Board A. Bosyk was later indicted on child pornography charges. He moved to suppress the evidence obtained under the warrant and sought a hearing under Franks v.

Delaware , 438 U.S. 154, 98 S.Ct. 2674, 57 L.Ed.2d 667 (1978), to show that Eyler had misled the magistrate judge. The district court denied the motion, holding that the warrant was supported by probable cause and that, in any event, suppression would be unwarranted. Bosyk later pleaded guilty to one count of receiving child pornography and was sentenced to five years in prison. II. Having reserved the right to appeal the denial of his motion to suppress, Bosyk asks us to reverse that ruling and vacate his conviction. He raises three arguments.

First, he argues that the search of his home violated the Fourth Amendment as it wasn't supported by probable cause. Second, he contends that even if the government had cause to search his home in November 2015 (when the post appeared on Bulletin Board A and the link was accessed), it didn't in April 2016 when it actually obtained and executed the warrant. Finally, Bosyk argues that suppression is warranted under United States v. Leon , 468 U.S. 897, 104 S.Ct. 3405, 82 L.Ed.2d 677 (1984), because Eyler's affidavit was misleading and lacked any indicia of probable cause.

When considering a district court's denial of a suppression motion, we review its legal conclusions de novo, viewing the evidence in the light most favorable to the government. United States v. Kolsuz , 890 F.3d 133, 141-42 (4th Cir. 2018). For reasons that follow, we find no error. III. Before searching a home, the government generally must obtain a warrant, supported by probable cause. Fernandez v. California , 571 U.S. 292, 298, 134 S.Ct. 1126, 188 L.Ed.2d 25 (2014) ; see U.S. Const. amend. IV.

Probable cause requires only "a fair probability," and not a prima facie showing, that "contraband or evidence of a crime will be found in a particular place." Illinois v. Gates , 462 U.S. 213, 238, 103 S.Ct. 2317, 76 L.Ed.2d 527 (1983). Probable cause is therefore "not a high bar." District of Columbia v. Wesby , --- U.S. ----, 138 S. Ct. 577, 586, 199 L.Ed.2d 453 (2018) (quoting Kaley v. United States , 571 U.S. 320, 338, 134 S.Ct. 1090, 188 L.Ed.2d 46 (2014) ). And officers need not "rule out a suspect's innocent explanation for suspicious facts" to obtain a warrant. Id. at 588.

Since a magistrate judge issued the challenged warrant, our task isn't to assess probable cause de novo. Gates , 462 U.S. at 236, 103 S.Ct. 2317. Instead, we apply a deferential and pragmatic standard to determine whether the judge "had a substantial basis for concluding that a search would uncover evidence of wrongdoing." Gates , 462 U.S. at 236, 103 S.Ct. 2317 (alterations and internal quotation marks omitted). In doing so, we consider only the facts presented in the warrant application. United States v. Lyles , 910 F.3d 787, 791 (4th Cir. 2018). A.

Bosyk and his amicus (the Electronic Frontier Foundation, or "EFF") argue that the facts recounted in Agent Eyler's affidavit didn't give the government probable cause to search Bosyk's house for evidence of child pornography. They argue that the government obtained its warrant based on a "single click" of a URL, which, they say, cannot support a search of somebody's home. We disagree. The facts in the affidavit support a reasonable inference that someone using Bosyk's IP address clicked the link knowing that it contained child pornography.

This in turn makes it fairly probable that criminal evidence would have been found at Bosyk's address. The "critical fact" in this case, as the district court observed, is the timing. J.A. 76. On the very day that someone clicked the link, it appeared on a website whose purpose was to advertise and distribute child pornography to its limited membership. And it appeared in a post containing text and images that unequivocally identified its contents as child pornography.

The close timing between the link's appearance on Bulletin Board A and the click by a user's IP address is highly relevant: because the link was accessed on the same day it appeared on Bulletin Board A, it is at least reasonably probable that the user clicked the link having encountered it on that website. With this fair assumption, several inferences drop into place to support the magistrate judge's decision to issue the warrant.

If one assumes, given the close timing, that the user accessed the link after seeing it on Bulletin Board A, it's fair to conclude that the user also knew it contained child pornography, as that much was explicit from the posting. On top of that, one can fairly conclude that the same person typed the password posted on Bulletin Board A, downloaded the content, and viewed the video contained at that URL. For why else would someone who had seen the pornographic stills and read the description on Bulletin Board A click the link if not to access its contents?

Thus, if we suppose that someone accessed the link through Bulletin Board A, it's fairly probable that the same person downloaded or viewed child-pornographic images. Recall that the magistrate judge knew someone using Bosyk's home IP address had clicked the link. Given that fact-and the permissible inferences described above-we think it was fairly probable that child pornography would be found on computers or other devices within Bosyk's property. And because child pornography constitutes contraband or evidence of a crime, this is all that was needed for probable cause to search Bosyk's house.

See 18 U.S.C. §§ 2252(a)(4), 2252A(a)(5) (crime to knowingly possess or access with intent to view any video depicting child pornography); see also, e.g. , United States v. Contreras , 905 F.3d 853, 858 (5th Cir. 2018) (probable cause to search house based on two child pornography images uploaded to messaging app); United States v. Richardson , 607 F.3d 357, 361, 371 (4th Cir. 2010) (same, based on two emailed images); United States v. Vosburgh , 602 F.3d 512, 526-28 (3d Cir. 2010) (same, based on attempt to download one video).

We acknowledge that the probability of this particular version of events depends on the link being clicked after it was posted on Bulletin Board A. The affidavit doesn't specify what time on November 2, 2015, the post appeared on Bulletin Board A, meaning that the link (which was accessed at 3:23 p.m. that day) could have been clicked before its posting. This ambiguity, however, is not as fatal to probable cause as our dissenting colleague suggests. As his own analysis shows, it was almost twice as likely that the post preceded the click as the other way around.

See Dissenting Op. at 342 (Figure A) (showing more than 64% probability that link was clicked after being posted on Bulletin Board A). Thus, the much likelier scenario based on the attested facts was that the link was posted and then accessed hours later (perhaps even sooner) by Bosyk's IP address. That chronology sets in motion the series of plausible inferences described above. In short, although the search relied on a "single click" of an internet link, the click was to a video of child pornography in circumstances suggesting the person behind that click plausibly knew about and sought out that content.

We think the magistrate judge therefore had a substantial basis for concluding that searching Bosyk's address would uncover evidence of wrongdoing. B. Arguing otherwise, Bosyk and EFF train their sights on the first inference in this chain of reasoning: that the user at Bosyk's IP address quite probably knew the link contained child pornography. They note that Eyler's affidavit didn't say whether the link existed elsewhere on the internet, or whether the site linked at the URL contained content other than the illegal videos described in the affidavit.

And they also point out that the URL didn't indicate what it linked to and that, in general, the act of clicking a URL doesn't prove familiarity with its contents. We do not find these alleged shortcomings fatal to probable cause. Bosyk's main critique is that the affidavit doesn't establish whether the user who clicked on the link accessed it through Bulletin Board A. He and EFF point out that the affidavit doesn't exclude the possibility that the user might have stumbled upon the link from another, perhaps innocent, source-especially given how easily and frequently links are shared over the internet.

This is also the essence of our dissenting colleague's position. See Dissenting Op. at 342-49. The problem with this argument, however, is that it demands more proof than is required to obtain a warrant. Probable cause, as the Supreme Court has reiterated time and again, "does not require officers to rule out a suspect's innocent explanation for suspicious facts." Wesby , 138 S. Ct. at 588. Instead, the government needs to demonstrate only a fair probability that contraband or evidence of a crime will be found at the place to be searched.

To be sure, innocent reasons may explain why someone accessed a file sharing page containing child pornography. Perhaps (as our friend in dissent posits) someone received the link from a malicious sender, or was looking for innocuous material hosted at the same filesharing webpage, or truly stumbled upon the URL accidentally. But this is all conjecture-no facts in the affidavit suggested the link existed anywhere on the internet but Bulletin Board A.

And the possibility that it did doesn't defeat probable cause when it's fairly probable, given the temporal proximity, that the person clicked on the link because he saw it on Bulletin Board A and wanted to view child pornography. Indeed, given the nature of the content, we think the magistrate judge had reason to be skeptical about possible innocent explanations.

The notion advanced by EFF and accepted by our dissenting colleague that a link containing child pornography would spread throughout the internet like more benign web content seems implausible in light of the present record and the law's experience with online pedophiles. As Eyler's affidavit explained, people who possess and view child pornography often take steps to conceal their contraband material, guard it closely, and sometimes delete it to avoid detection. Cases likewise show that consumers of child pornography frequently employ complex measures to keep their online activities secret.

See, e.g. , United States v. McGarity , 669 F.3d 1218, 1230-31 (11th Cir. 2012) (child pornography ring used elaborate system of encryption, codenames, and hidden instructions to conceal activities from outsiders), abrogated on other grounds by Paroline v. United States , 572 U.S. 434, 134 S.Ct. 1710, 188 L.Ed.2d 714 (2014) ; Vosburgh , 602 F.3d at 516-17 (child pornography website used secret gateways and cumbersome links to evade detection).

Thus, the likelihood that a specific filesharing page containing child pornography would find its way to somebody uninterested in such contraband-thereby exposing its distributors to detection, capture, and loss of their materials-is probably quite low. This point bears emphasis. Our dissenting colleague is of course right that Bosyk's IP address could have connected with a link containing child pornography in a variety (though probably not "millions," see Dissenting Op. at 342-43) of different ways.

But, contrary to our friend's suggestion, these many possible alternative paths aren't of equal probability ; rather, the likelier avenues incriminate Bosyk. In the first place, the facts involve material that, for reasons just explained, is unlikely to travel widely outside child pornography circles. On top of that, there is a suspiciously short interval between such material appearing on a members-only child pornography forum and being accessed by a user at Bosyk's IP address.

Given these facts, we believe a magistrate judge could reasonably think it fairly likely-if not most likely-that the user found the link through Bulletin Board A or otherwise received it knowingly from a member of that site. See J.A. 169 (explaining that people who possess and view child pornography may "share information and materials" with one another).

Contrary to our colleague's suggestion, this belief is not "wholly unsupported speculation," Dissenting Op. at 363; rather, it is based on the contents of the affidavit, the magistrate judge's likely familiarity with online child pornography crimes, and his ability to reach "common-sense conclusions about human behavior." Gates , 462 U.S. at 231-32, 103 S.Ct. 2317 (quoting United States v. Cortez , 449 U.S. 411, 418, 101 S.Ct. 690, 66 L.Ed.2d 621 (1981) ). Bosyk's and EFF's other arguments also miss the mark.

They focus, for instance, on the fact that the URL looked like a random string of numbers and letters and therefore betrayed little about its contents. Certainly, the government could have established probable cause more easily had the link been clearer about its illicit content. But here, the URL appeared in a post that described and depicted its contents on the same day that somebody clicked it. This context provides evidence about the probable knowledge and intent of the user that is otherwise lacking from the face of the URL.

EFF and our dissenting colleague's broader arguments against the inferential value of URLs merit the same response. They point out that because URLs are often randomly generated, shortened, or masked, they don't necessarily reveal their contents to the person accessing them. Thus, EFF says, that an IP address accessed a URL associated with contraband doesn't necessarily provide cause to search property and devices related to that address. That may often be true, and in a case based purely on an IP address connecting with a URL, probable cause may be hard to establish absent other incriminating evidence.

But that is not the case before us because such evidence exists here: whoever clicked did so on the same day that the link was advertised in a closed forum dedicated to child pornography. Finally, we are unswayed by the cases Bosyk and EFF rely on. Bosyk draws heavily from United States v. Reece , an unpublished district court opinion invalidating a warrant issued as part of the same investigation of Bulletin Board A. See No. 2:16cr104, 2017 WL 11373457, at *5-6, 2017 U.S. Dist. LEXIS 220176, at *12-15 (E.D. Va. Mar. 1, 2017).

The Reece court held that because the affidavit (as here) lacked evidence that the defendant subscribed to or accessed Bulletin Board A, the only possible inference was that he "could have" accessed the video through that website. Id. at *5-6, 2017 U.S. Dist. LEXIS 220176, at *12-14. That inference, the court said, was "insufficient to support the resulting search" without the "inferential leap that Defendant must have accessed Bulletin Board A to navigate to the illicit material." Id. at *5-6, 2017 U.S. Dist. LEXIS 220176, at *14 (internal quotation marks omitted).

As we have explained, however, the law doesn't require the government to show that Bosyk "must have" accessed the video via Bulletin Board A; the fair probability that he did so is enough to sustain the search. By suggesting otherwise, the Reece court erred. In any event, Reece is distinguishable because, there, two days passed between the post on Bulletin Board A and an attempt to access the link. See id. at *2-3, 2017 U.S. Dist. LEXIS 220176, at *5-6. Here, in contrast, those two events happened on the same day.

Whether or not the facts in Reece supported probable cause, it's notable that the connection between the suspect and Bulletin Board A is much closer in this case. Cf. United States v. Evans , No. 16-20292, 2018 WL 1773308, at *3 (E.D. Mich. Apr. 12, 2018) (probable cause to search home when IP address accessed link within 25 hours of being posted on Bulletin Board A). Both Bosyk and EFF also refer frequently to the Second Circuit's divided decision in United States v. Falso , 544 F.3d 110 (2d Cir. 2008).

There, the court invalidated a search warrant based on allegations that the defendant "appeared" to have "either gained access or attempted to gain access" to a website associated with child pornography. Id. at 114 (alterations omitted). The majority found that the "inconclusive statements" about whether the defendant accessed the website, combined with the lack of details about the website itself, fell short of establishing probable cause. Id. at 121.

Concurring in the judgment, Judge Livingston faulted the majority's probable cause analysis for overlooking that the defendant's email address was found on the site, which she (reasonably, in our opinion) thought "probative evidence that Falso visited that website and either signed up or attempted to sign up for a membership." Id. at 130-31 (Livingston, J., concurring in part and concurring in the judgment). We decline to follow Falso .

That case is distinguishable because there, the affidavit contained "no allegation that [the defendant] in fact gained access" to a website containing child pornography, nor any allegation that "images of child pornography were downloadable from the site." Id. at 124 (majority opinion). Here, by contrast, the affidavit alleged that Bosyk's IP address accessed a URL whose content "consisted of four child pornography videos." J.A. 167-68.

Thus, the inference that someone at Bosyk's address "in fact accessed a website" sharing child pornography-crucially missing from Falso , 544 F.3d at 124 -is readily drawn in this case. See Vosburgh , 602 F.3d at 526-27 (probable cause to search home when IP address clicked link purporting to contain child pornography); cf. United States v. Martin , 426 F.3d 68, 75-76 (2d Cir. 2005) (probable cause to search home when email address registered there joined website sharing child pornography); United States v. Froman , 355 F.3d 882, 890-91 (5th Cir. 2004) (same).

Contrary to the dissent's suggestion, our opinion is not "at odds" with out-of-circuit decisions reviewing search warrants based on online encounters with child pornography. Dissenting Op. at 357. The cases our colleague cites differ factually from this one in meaningful respects, and therefore aren't useful precedents. See Ornelas , 517 U.S. at 698, 116 S.Ct. 1657. Still, to the extent our sister circuits have at times emphasized "additional facts ... over and above the single click of a URL that provides for download of child pornography," Dissenting Op. at 357, we are all in tune.

Here, an important additional fact is the abbreviated time frame, which lessens the likelihood that Bosyk's IP address accessed the link independently of Bulletin Board A. Accord, e.g. , United States v. Gourde , 440 F.3d 1065, 1070 (9th Cir. 2006) (en banc) (suspect's paid subscription to child pornography website reduced possibility that visit was accidental).

In sum, the magistrate judge had a substantial basis for finding probable cause to search Bosyk's house given two factual allegations-first, the appearance on Bulletin Board A of a post unambiguously promoting a link containing child pornography videos, and second, an attempt to access that link on the same day by someone at Bosyk's address. The closeness of these two events established a fair probability that child pornography or evidence of attempts to access it would be found in Bosyk's house. IV.

Alternatively, Bosyk argues that even if Agent Eyler's affidavit established probable cause to search his house in November 2015 when the link was accessed, it didn't permit a search in April 2016 when the warrant issued. "A valid search warrant may issue only upon allegations of 'facts so closely related to the time of the issue of the warrant as to justify a finding of probable cause at that time.' " United States v. McCall , 740 F.2d 1331, 1335-36 (4th Cir. 1984) (quoting Sgro v. United States , 287 U.S. 206, 210, 53 S.Ct. 138, 77 L.Ed. 260 (1932) ).

Accordingly, Bosyk argues that the warrant was based on "stale" probable cause, and thus invalid, because it issued five months after the underlying events took place. The existence of probable cause, however, can't be determined by "simply counting the number of days between the occurrence of the facts supplied and the issuance of the affidavit." Richardson , 607 F.3d at 370 (quoting McCall , 740 F.2d at 1136 ).

Instead, like probable cause more generally, staleness is judged based on "all the facts and circumstances of the case, including the nature of the unlawful activity" and "the nature of the property to be seized." Id. Importantly for this case, when it comes to child pornography, courts have largely concluded that "even a substantial delay" between download or distribution of child pornography and the issuance of a search warrant doesn't render the underlying information stale. Id.

This consensus rests, as we explained in Richardson , "on the widespread view" that "collectors and distributors of child pornography value their sexually explicit materials highly, rarely if ever dispose of such material, and store it for long periods in a secure place, typically in their homes." Id. (internal quotation marks and citations omitted); accord United States v. Raymonda , 780 F.3d 105, 114 (2d Cir. 2015) (staleness inquiry is "unique" in child pornography context); Gourde , 440 F.3d at 1072 ; United States v. Riccardi , 405 F.3d 852, 861 (10th Cir. 2005).

It also rests, in many cases, on the fact that digital media files persist for a long time and can often be forensically recovered even after being "deleted." See Richardson , 607 F.3d at 370-71 ; see also United States v. Seiver , 692 F.3d 774, 775-78 (7th Cir. 2012) (" 'Staleness' is highly relevant to the legality of a search for a perishable or consumable object, like cocaine, but rarely relevant when it is a computer file.").

As a result, in cases involving online child pornography, courts (including ours) have sustained warrants issued many months, and even years, after the events that gave rise to probable cause. See, e.g. , Contreras , 905 F.3d at 858-59 (warrant sought 11 months after suspect uploaded two images); Richardson , 607 F.3d at 371 (warrant sought four months after suspect emailed child pornography); Vosburgh , 602 F.3d at 528 (warrant sought four months after three attempts to access download link); United States v. Morales-Aldahondo , 524 F.3d 115, 119 (1st Cir. 2008) (warrant sought three years after last downloads).

In accordance with these cases, Agent Eyler's affidavit described the tendency of "individuals who possess or access with intent to view child pornography" to collect such material and hoard it for a long time. J.A. 168-69. But Bosyk says the inference that child pornography will be found months after possession or attempted possession applies only when the suspect is plausibly a "collector" of child pornography.

And, according to Bosyk, nothing in the affidavit identified him as a "collector." We agree with Bosyk to the following extent-the value of this inference "depends on the preliminary finding that the suspect is a person interested in images of child pornography." Raymonda , 780 F.3d at 114 (internal quotation marks omitted). Such a finding, as the Second Circuit has explained, "tend[s] to negate the possibility that a suspect's brush with child pornography was a purely negligent or inadvertent encounter, the residue of which was long ago expunged." Id. at 115.

Officials may support this inference with, say, information that the suspect paid for access to child pornography, had a history of possessing pornographic images, was an admitted or convicted pedophile, took elaborate steps to access illegal content, or distributed content to others. Id. at 114-15 (collecting cases). In each of these cases, it's possible to infer that the suspect is a collector of child pornography because of "circumstances suggesting that he had accessed those images willfully and deliberately, actively seeking them out to satisfy a preexisting predilection." Id. at 115.

Where we disagree with Bosyk, however, is in applying these principles. We think it was possible to infer from the affidavit that whoever clicked on the link did so willfully and deliberately because he was interested in images of child pornography. Specifically, as we have already explained, the facts in the affidavit support the inference that somebody saw the description and video thumbnails on a website devoted to child pornography, Bulletin Board A, and then deliberately sought out the video by clicking the link.

The magistrate judge could therefore further infer that someone at Bosyk's home likely downloaded, stored, and kept that content, since people "with an interest in child pornography tend to hoard their materials and retain them for a long time." Vosburgh , 602 F.3d at 528. We therefore find the warrant valid even though it issued five months after the underlying events took place. V.

Finally, we note that regardless of the warrant's validity in this case, we would nonetheless affirm as we may not suppress evidence "obtained in objectively reasonable reliance on a subsequently invalidated search warrant." United States v. Leon , 468 U.S. 897, 922, 104 S.Ct. 3405, 82 L.Ed.2d 677 (1984). Bosyk, however, invokes two exceptions that the Supreme Court has carved out of this rule.

First, he argues that the issuing judge "was misled by information in an affidavit that the affiant knew was false or would have known was false except for [her] reckless disregard for the truth." Id. at 923, 104 S.Ct. 3405 (citing Franks v. Delaware , 438 U.S. 154, 98 S.Ct. 2674, 57 L.Ed.2d 667 (1978) ). Second, he and EFF maintain that the affidavit was "so lacking in indicia of probable cause as to render official belief in its existence entirely unreasonable." Id. (quoting Brown v. Illinois , 422 U.S. 590, 611, 95 S.Ct. 2254, 45 L.Ed.2d 416 (1975) (Powell, J., concurring)). Neither exception applies.

The first exception is inapplicable because Bosyk doesn't actually identify any omitted or misstated facts in Eyler's affidavit. Instead, he complains that Eyler didn't note the absence of certain facts, such as the lack of any allegation that a user at his IP address was a member of Bulletin Board A, accessed the link through that site, or entered the password displayed there. But we agree with the government that agents need not include disclaimers specifically pointing out facts absent from the affidavit to obtain a warrant.

A warrant application is "judged on the adequacy of what it does contain, not on what it lacks, or on what a critic might say should have been added." United States v. Allen , 211 F.3d 970, 975 (6th Cir. 2000) (en banc). Here, the affidavit accurately explained that Bulletin Board A had members, that a URL was posted there, and that an IP address at Bosyk's residence accessed the URL. From these facts, along with the absence of other allegations, the magistrate judge could fairly assess the strength of the government's evidence.

Our dissenting friend believes the affidavit was materially misleading because, in his view, most factual material was unrelated to Bosyk and, therefore, served only to lend the affidavit a false appearance of substance. Dissenting Op. at 366-67 (citing United States v. Wilhelm , 80 F.3d 116, 123 (4th Cir. 1996) ). This is a blinkered reading of the affidavit.

Our colleague apparently believes it "irrelevant," id. at 366-67, that Bulletin Board A was a dedicated child pornography site; that a link appeared on this site next to pornographic images; and that the link contained videos of a girl being sexually abused. True, these facts don't literally "address allegedly unlawful conduct of someone using [Bosyk's] IP address." Id. at 366. But as our analysis above makes plain, they are nonetheless crucial to understanding why the government believed Bosyk's home would contain evidence of criminal activity. These details are hardly irrelevant "puffing." Contra id.

Neither is the dreaded "boilerplate" about collectors. But see id. at 367-68. This information drew on accepted case law and served to establish that Bosyk's computer would contain child pornography (or at least its remnants) some months after the attempted access. Our colleague clearly disagrees with us about whether, at the end of the day, the information in the affidavit established probable cause. But he cannot seriously think these facts are so immaterial to the probable cause inquiry that the sole purpose for their inclusion was to put one over on the magistrate judge. Cf.

Wilhelm , 80 F.3d at 123 (suppressing evidence when affidavit distracted from lack of probable cause by describing anonymous informant as "a concerned citizen," and "a mature person" with a "truthful demeanor"). Our dissenting colleague would also vacate Bosyk's conviction because of an allegedly omitted fact-the exact timing of the post on Bulletin Board A-that isn't in the record and, for all we know, may not even exist. Dissenting Op. at 368-69. We cannot do so.

As our colleague well knows, a defendant can't suppress evidence on grounds that the affiant intentionally or recklessly omitted facts without first making "a substantial preliminary showing" to that effect. United States v. Tate , 524 F.3d 449, 454-55 (4th Cir. 2008) (quoting Franks , 438 U.S. at 155-56, 98 S.Ct. 2674 ). And, importantly, that showing requires "a detailed offer of proof" of the missing information.

Id. at 455 (quotation marks omitted); see also Franks , 438 U.S. at 171, 98 S.Ct. 2674 ("Affidavits or sworn or otherwise reliable statements of witnesses should be furnished, or their absence satisfactorily explained."). Yet despite moving for a Franks hearing in the district court, Bosyk never offered proof of any omitted fact, nor explained why he couldn't offer such proof. That failure precludes suppression on the basis of intentional or reckless omissions. Alternatively, Bosyk argues for suppression because, he says, the affidavit lacked any indicia of probable cause. This argument also fails.

Suppression on such grounds is "inappropriate" when an affidavit produces "disagreement among thoughtful and competent judges as to the existence of probable cause." Leon , 468 U.S. at 926, 104 S.Ct. 3405. That's the case here. District court judges have reasonably disagreed on the constitutionality of warrants like this one. Compare J.A. 74-79 (probable cause to search home months after IP address accessed link posted on Bulletin Board A), Evans , 2018 WL 1773308, at *3 (same), and United States v. Seitter , No. 17-10041-JTM, 2017 WL 4516909, at *3-4 (D. Kan.

Oct. 10, 2017) (same), with Reece, 2017 WL 11373457, at *7-8, 2017 U.S. Dist. LEXIS 220176, at *19-20 (no probable cause). And, as evidenced by our separate opinions, the judges on this panel are also divided on the question. In such circumstances, we cannot say that it was objectively unreasonable for the government to rely on the warrant. Leon , 468 U.S. at 926, 104 S.Ct. 3405 (declining to suppress evidence when court of appeals panel split on probable cause question); Falso , 544 F.3d at 128-29 (same).

Accordingly, even if there hadn't been probable cause to search Bosyk's house, suppression would be inappropriate because the government obtained a warrant and reasonably relied on it to execute the search. For this independent reason also, we must affirm the district court's judgment. VI. We are sensitive to the privacy interests at stake here. But we also cannot ignore that many crimes are committed with just a few clicks of a mouse-including the very serious crime of downloading child pornography.

In cases like this, our job is to ask precisely what "a single click" reveals under the circumstances presented, and whether that information justifies searching a person's most private places for evidence of a crime. Here, the magistrate judge who issued the warrant had a substantial basis for concluding that it did. For that reason, the district court's denial of Bosyk's motion to suppress is AFFIRMED. In related cases, the government has explained that Bulletin Board A is a dark web forum, accessible only through an anonymous web browser that users must download. See United States v.

Reece , No. 2:16cr104, 2017 WL 11373457, 2017 U.S. Dist. LEXIS 220176, at *4 (E.D. Va. Mar. 1, 2017). As for the (undisputed) results of the search, our friend notes that what was found has no bearing on the question of probable cause. See Dissenting Op. at 336-37. But our substantive analysis is entirely faithful to that principle.

Our dissenting colleague posits that the government duped the district court into ignoring the important distinction between Bulletin Board A and the File Sharing Site, and into presuming that Bosyk's IP address accessed the URL after (rather than before) its posting on Bulletin Board A. See Dissenting Op. at 336-38. But we see little indication that the district court misunderstood the facts. Rather, we think the court's oral ruling as transcribed can be read to reflect a proper understanding both of the chronology of events and of the relationship between Bulletin Board A and the File Sharing Site.

Regarding the timing, the court said that the URL was clicked "the same day" that the posting appeared on Bulletin Board A, J.A. 76, which is perfectly consistent with the affidavit. As for the distinction between the two websites, the court noted that on the day in question, "the IP address that is linked to a computer in the defendant's home ... attempts to or at least shows an interest in that particular site." J.A. 76-77. It's admittedly unclear whether "that particular site" refers (incorrectly) to Bulletin Board A or (correctly) to the File Sharing Site.

But the preceding sentence includes references to both the "posting" and "the URL that is linked," so both readings are possible. J.A. 76. Furthermore, the district court later noted the delay "between the time of that contact with the URL" and the warrant's issuance, J.A. 77, suggesting the court understood that Bosyk accessed the URL and not (necessarily) Bulletin Board A. The government has at times represented or implied that the link was clicked after the post. See, e.g. , Appellee's Br. at 4 (stating that link was posted "less than 24 hours earlier" than attempted access).

Bosyk has never sought to correct this impression; indeed, his counsel advanced this chronology at oral argument. Oral Arg. at 11:15-11:31 (arguing that click "on November 2 close after the posting on Bulletin Board A" did not necessarily evidence knowledge of the password (emphasis added)). Nevertheless, we must "confine our review to the facts that were before the magistrate judge," Lyles , 910 F.3d at 791 (quotation omitted), which here do not firmly establish the timeline.

It's true that in this version of events, the likelihood that the user at Bosyk's IP address downloaded child pornography hinges on two probabilities combined: first, that he clicked the link after it appeared on Bulletin Board A, and, second, that (if so) he clicked the link having seen it on Bulletin Board A. Contrary to our dissenting colleague's suggestion, however, there's nothing wrong with finding probable cause based on compound probability-provided, of course, that the probabilities taken together establish a fair likelihood of criminal conduct.

But more fundamentally, we reject the dissent's apparent premise-that probable cause is subject to rigid statistical analysis. To the contrary, the Supreme Court has told us in no uncertain terms that probable cause isn't subject to precise articulation but is instead a "commonsense, nontechnical" conception dealing with "the factual and practical considerations of everyday life on which reasonable and prudent men, not legal technicians, act." Ornelas v. United States , 517 U.S. 690, 695, 116 S.Ct. 1657, 134 L.Ed.2d 911 (1996) (internal quotation marks and citation omitted).

For similar reasons, the possibility that the linked filesharing page also contained innocent material doesn't destroy probable cause. It is undisputed that clicking this unique URL led to at least one video of child pornography, so the circumstances nevertheless warrant suspicion. And, in a different way, the randomness of the URL helps the government, as internet users aren't likely to type a truly random string of characters into their web browser by mistake. Judge Livingston nonetheless agreed that the government's good faith reliance on the warrant made suppression unnecessary.

See 544 F.3d at 113, 125-29 (majority opinion). That was not so in Raymonda . There, the government sought a warrant based entirely on the fact that, nine months earlier, an IP address had accessed a webpage containing thumbnails of child pornography. Nothing suggested that the suspect discovered the site while searching for child pornography, or that he clicked on the thumbnails to view the full-size images. 780 F.3d at 117.

Rather, the facts were "equally consistent with an innocent user inadvertently stumbling upon a child pornography website, being horrified at what he saw, and promptly closing the window." Id. The Second Circuit therefore held that the evidence was too stale to create probable cause. Principles of judicial restraint often support skipping the probable cause question when Leon bars suppression.

But "when a Fourth Amendment case presents a novel question of law whose resolution is necessary to guide future action by law enforcement officers and magistrates, there is sufficient reason for [a court] to decide the violation issue before turning to the good-faith question." Gates , 462 U.S. at 264, 103 S.Ct. 2317 (White, J., concurring) (italics omitted). As demonstrated by the divergent decisions of district courts, this is one such case.