Jason Holder-Senior Attorney, National Legal Research Group
On what the court in United States v. Bosyk, 933 F.3d 319 (4th Cir. 2019), described as a "secretive online message board," id. at 322, a link appeared with a message explaining that the link would lead to multiple videos of child pornography. On the same day that this link appeared, an IP address associated with Bosyk's house accessed the link to view the advertised materials. Id. Armed with these facts, and a brief description regarding the characteristics of individuals who possess and access child pornography, investigators were able to obtain a search warrant for Bosyk's residence authorizing the seizure of "computers, digital devices, storage media, and related evidence." Id. at 323.
The search of Bosyk's house uncovered thousands of incriminating images and videos, including the very video described in the search warrant affidavit as being found by clicking on the original link. Id. Bosyk was indicted on a number of child pornography charges, and he moved to suppress the evidence obtained through the search warrant. Id. at 324. The district court denied the motion, and Bosyk pleaded guilty to one count of receiving child pornography while reserving his right to appeal. Id.
On appeal, Bosyk argued that the government obtained the warrant "based on a 'single click' of a URL, which, [he argued], cannot support a search of somebody's home." Id. at 325. The court was unpersuaded, however, noting that the timing of the "click" was the "critical fact" in supporting the warrant. See id. ("[T]he very day that someone clicked the link, it appeared on a website whose purpose was to advertise and distribute child pornography to its limited membership."). The court reasoned that because the link was accessed on the same day it appeared on the message board, "it is at least reasonably probable that the user clicked the link having encountered it on that website." Id. This assumption, in turn, allowed several inferences to drop into place to support the magistrate judge's decision to issue the warrant. These inferences included (1) that the user also knew it contained child pornography, and (2) that the same person "typed the password posted on [the message board], downloaded the content, and viewed the video contained at that URL." Id.
In an effort to counter these inferences, Bosyk argued that the affidavit "didn't say whether the link existed elsewhere on the internet, or whether the site linked at the URL contained content other than the illegal videos described in the affidavit." Id. at 327. The court was unpersuaded, however, noting that the Supreme Court has reiterated that probable cause "does not require officers to rule out a suspect's innocent explanation for suspicious facts." Id. (quoting District of Columbia v. Wesby, 138 S. Ct. 577, 588 (2018)). Innocent explanations were also unlikely in the court's view, given that "people who possess and view child pornography often take steps to conceal their contraband material, guard it closely, and sometimes delete it to avoid detection." Id. These characteristics also defeated Bosyk's challenge to the delay in time between the link being accessed (November 2015) and the warrant being issued (April 2016). See id. at 330 (even a substantial delay between download and issuance of warrant does not render the underlying information stale, because "collectors and distributors of child pornography value their sexually explicit materials highly, rarely if ever dispose of such material, and store it for long periods in a secure place, typically in their homes").
An extensive dissent cautioned that courts must "guard against the slow whittling away of constitutional rights, particularly as we apply constitutional rights adopted in an analog era to the new challenges of the digital age." Id. at 334 (Wynn, J., dissenting). In his dissent, Judge Wynn was quick to note that he agrees that "even a 'single click' of an internet link to download child pornography can provide probable cause to support a search warrant." Id. at 339 (footnote omitted). This remains true, the dissent continued, only "if the facts set forth in the warrant application establish that 'the person behind that click plausibly knew about and sought out that content.'" Id. (emphasis added). In the present case, while probable cause was premised on the link having been encountered on the secretive online message board, "the affidavit does not assert that Defendant, or someone likely to be using Defendant's IP address, was a member of [the board]." Id. at 340.
Everyday users encounter URLs in a variety of ways, "including through websites, emails, chats, text messages, comment threads, discussion boards, File Sharing Sites (such as DropBox, Google Drive, or Apple iCloud), tweets, Facebook posts, Instagram captions, Snapchat messages, embedded images or videos, unwanted pop-up windows, any combination thereof, or by any other digital mean." Id. at 343. Moreover, random URLs, link shortening, and link disguising create the possibility that users can "unintentionally navigate to URLs." Id. at 344 (emphasis added). Such practices can be used for innocuous purposes, such as "rickrolling," id. at 345, as well as nefarious ones, id. (seemingly innocuous URLs linked to child pornography for the purposes of extortion). The sheer volume of ways an individual can encounter a URL are overlooked, the dissent argued, by a "majority opinion [that] fails to recognize that this alternative path, by itself, materially undermines its theory of probable cause." Id. at 346.
Ultimately, the dissent concluded that a single click of a URL, "absent any further factual evidence circumscribing the universe of paths through which someone using Defendant's IP address could have encountered and navigated to that URL—nearly all of which have no relation to [the offending message board]-is insufficient to establish probable cause." Id. at 363-64.
