This case presents a textbook example of why we must guard against the slow whittling away of constitutional rights, particularly as we apply constitutional rights adopted in an analog era to the new challenges of the digital age.
A basic understanding of the technology at issue demonstrates that the government's bare-bones affidavit supporting a warrant to search the residence of Defendant Nikolai Bosyk ("Defendant") failed to establish a fair probability that, when clicking on a link to download child pornography, someone using Defendant's IP address knew and sought out that illicit content. Indeed, rather than confronting the difficult technological questions courts must address in assessing warrant applications premised on online conduct, the majority opinion rests on analog frameworks that fail to account for the meaningful differences between the Internet and the physical world. With due respect to my colleagues in the majority, I believe the majority opinion displays a troubling incomprehension of the technology at issue in this matter. Accordingly, I respectfully dissent.
I.
This matter arose from the government's monitoring of Bulletin Board A, an "Internet-based bulletin board ... dedicated to the advertisement, distribution and production of child pornography" with over "1500 'approved users.' " J.A. 163-64.
According to an affidavit submitted by the government in support of the challenged search warrant, the government began "observ[ing] various postings" and "captur[ing] content" on Bulletin Board A in October 2015. J.A. 164; Gov't Br. at 4, 5, 13. On November 2, 2015, a Bulletin Board A member posted on a sub-forum of Bulletin Board A. That post described a particular child pornography video; posted "three different sets of twenty video thumbnail images" of the video; and included a URL 1 composed of a largely random sequence of letters and numbers, described in the affidavit alternatively as "http://[redacted].rar.html" and"http://[redacted].comxu5me9erdipp/brochure.rar.html." 2 J.A. 49.
The affidavit states that the Bulletin Board A post also provided a password, which users could input to access the content of the file associated with that unique URL. Gov't Br. at 5. Without the password, the file could not be opened and viewed. The affidavit does not identify at what time on November 2, 2015, the Bulletin Board A member made the post. And notwithstanding that the government was routinely "observ[ing]" and "captur[ing]" content on Bulletin Board A at that time, the affidavit does not state whether the URL and password had previously or subsequently been posted on Bulletin Board A or elsewhere on the Internet. J.A. 164; Gov't Br. at 4, 5, 13.
Significant to an understanding of the technology at play in this matter, Bulletin Board A did not host the URL or the content accessible through the URL. Rather, a wholly independent website "offer[ing] online file hosting and sharing services" (such as DropBox, Google Drive, or Apple iCloud)-which the affidavit refers to using the pseudonym "File Sharing Site"-hosted the URL and content. J.A. 165-66; Gov't Br. at 14. File Sharing Site is also used to store and share lawful content.
To that end, File Sharing Site's "Terms of Service" expressly prohibit users from storing or sharing "[p]ornography, nudity, sexual images and any kind of offensive images or videos." J.A. 166. According to the affidavit, law enforcement officers nonetheless had "reason to believe" that File Sharing Site "was used by [Bulletin Board A] members to store files containing child pornography and make them accessible to other members." J.A. 165-66; Gov't Br. at 14. In addition to File Sharing Site, Bulletin Board A members used "several" other "cloud-based storage services" to store and share files "depicting minors engaging in sexually explicit conduct." J.A. 165; Gov't Br. at 6.
Sometime after the November 2, 2015, post, law enforcement officers monitoring Bulletin Board A clicked on the URL, navigated to File Sharing Site, and then downloaded an encrypted video file from File Sharing Site. The officers used the password provided in the post to open the video file, which depicted child pornography.
Thereafter, the officers obtained an order directing File Sharing Site to disclose business records pertaining to unique URLs containing files that law enforcement knew to depict minors engaging in sexually explicit conduct. In response, File Sharing Site produced the "dates, times, and IP addresses connected to the downloading of the file content associated with the URLs specified in the application for the Order." J.A. 167; Gov't Br. at 6. These records revealed that at 3:23 pm on November 2, 2015, an IP address associated with Defendant's residence was "used to download or attempt to download file content associated with that URL." J.A. 167-68.
The affidavit does not explain what "download" or "attempt to download" entailed. The affidavit does not state that Defendant or anyone likely to be using Defendant's IP address was a member of Bulletin Board A-or had ever even visited Bulletin Board A-and the government subsequently conceded that "membership in Bulletin Board A could not be definitively established." Gov't Br. at 30. Nor does the affidavit state whether someone using Defendant's IP address ever used the password to open the files hosted and shared on File Sharing Site.
In addition to describing the Bulletin Board A investigation and someone using Defendant's IP address to "download or attempt to download" the child pornography stored on File Sharing Site, the affidavit does include several paragraphs describing certain characteristics of "individuals who possess or access with intent to child pornography"-individuals commonly referred to as "collectors." J.A. 168-69. But the affidavit does not state that Defendant or someone likely to be using Defendant's IP address was a "collector" of child pornography or exhibited any of the particular behaviors associated with collectors set forth in the affidavit.
Based on the foregoing information, on April 8, 2016, the magistrate judge issued a warrant authorizing the government to search Defendant's residence, including any electronic devices found therein. On April 12, 2016, law enforcement officers executed the warrant. A forensic examination of the hard drive of a laptop computer found in Defendant's residence revealed thousands of images and videos of minor children engaged in sexually explicit conduct, in folders created from April 14, 2012, to November 18, 2015.
I note that the majority opinion points out that the video available through the File Sharing Site URL was among the files found on the hard drive of Defendant's laptop. Ante at 323-24. But the majority and I agree that fact is irrelevant to the issue at hand because it is well-settled law that what an illegal search ultimately reveals has no bearing on whether the evidence the government provided to the magistrate was adequate to establish probable cause to conduct the search in the first place. Ante at 324 n.2. See United States v. Ramirez , 523 U.S. 65 , 71, 118 S.Ct. 992 , 140 L.Ed.2d 191 (1998) ("[I]n determining the lawfulness of entry and the existence of probable cause we may concern ourselves only with what the officers had reason to believe at the time of their entry. " (citation omitted) (emphasis in original)); United States v. Di Re , 332 U.S. 581 , 595, 68 S.Ct. 222 , 92 L.Ed. 210 (1948) ("We have had frequent occasion to point out that a search is not to be made legal by what it turns up. In law it is good or bad when it starts and does not change character from its success." (citation omitted)); Byars v. United States , 273 U.S. 28 , 29-30, 47 S.Ct. 248 , 71 L.Ed. 520 (1927) ("Nor is it material that the search was successful in revealing evidence of a violation of a federal statute. A search prosecuted in violation of the Constitution is not made lawful by what it brings to light; and the doctrine has never been recognized by this court, nor can it be tolerated under our constitutional system, that evidences of crime discovered by a federal officer in making a search without lawful warrant may be used against the victim of the unlawful search where a timely challenge has been interposed."); A.M. v. Holmes , 830 F.3d 1123 , 1139 (10th Cir. 2016) ("Neither the officer's subjective beliefs nor information gleaned post-hoc bear on this inquiry." (emphasis added)); McColley v. Cty. of Rensselaer , 740 F.3d 817 , 841 n.3 (2d Cir. 2014) ("Probable cause is not backward looking. Thus, the results of a search are immaterial to a determination of whether the search was supported by probable cause."); United States v. Sims , 553 F.3d 580 , 583 (7th Cir. 2009) ("[T]here is a practical reason for requiring warrants where feasible: it forces the police to make a record before the search, rather than allowing them to conduct the search without prior investigation in the expectation that if the search is fruitful a rationalization for it will not be difficult to construct, working backwards." (citation omitted)).
On October 17, 2017, the government filed a criminal complaint against Defendant, alleging one count of receipt of child pornography in violation of 18 U.S.C. § 2252 (a)(2). Homeland Security Investigations Special Agent Kristina Eyler submitted an affidavit in support of the complaint, averring that Defendant's IP address was "associated with a user attempting to download child pornography on Bulletin Board A." J.A. 11. Put differently, Special Agent Eyler's affidavit represented, without qualification, that someone using Defendant's IP address "attempt[ed] to download child pornography on Bulletin Board A ," id. (emphasis added), not File Sharing Site.
On December 14, 2017, a grand jury issued an indictment charging Defendant with one count of receipt of child pornography in violation of 18 U.S.C. § 2252 (a)(2) and (b)(1) and one count of possession of child pornography in violation of 18 U.S.C. § 2252 (a)(4)(B) and (b)(2). On January 3, 2018, Defendant filed a motion to suppress all evidence seized during the April 12, 2016, search as well as the fruits of that search. Defendant's motion to suppress argued, in part, that the affidavit provided insufficient evidence to establish probable cause to search Defendant's residence because it failed to establish a fair probability that someone using Defendant's IP address navigated through the URL posted on Bulletin Board A to the contraband stored on File Sharing Site. See, e.g. , J.A. 27 ("The instant affidavit contains no information or contentions as to [Defendant]'s involvement, access, or membership to Bulletin Board A. In fact, the affidavit makes no contention that the subject URL, purportedly containing child pornography, could have only been accessed through Bulletin Board A.").
In its opposition to Defendant's motion to suppress, the government claimed that the affidavit did, in fact, connect Defendant's IP address to the Bulletin Board A post given "the close proximity in time between the posting at Bulletin Board A and attempt to download its child pornographic content." J.A. 45 (emphasis added). By characterizing the content as the property of Bulletin Board A-not as content stored by File Sharing Site-the government invited the district court to not draw a distinction between Bulletin Board A and File Sharing Site, notwithstanding that the affidavit connected Defendant's IP address with only File Sharing Site, not Bulletin Board A.
Additionally, an unstated, but essential, premise of the government's temporal proximity argument was that someone using Defendant's IP address attempted to download the child pornography from File Sharing Site after the Bulletin Board A post prompting the investigation-a premise that the government invited the district court to indulge by relying on a case in which a district court found probable cause to issue a warrant when the allegations in the affidavit established that the download of contraband occurred soon after a link to the contraband was posted to a child pornography message board. See J.A. 45 (citing United States v. Evans , 2:16-cr-20292, Doc. No. 69, report and recommendation, at 14 (E.D. Mich. Nov. 20, 2017)). The government further rejected Defendant's argument that the File Sharing Site URL "could have been accessed through innocent means" because "there was no reason for the agent to believe the link was available anywhere other than on Bulletin Board A." J.A. 44-45.
On February 2, 2018, the district court denied Defendant's suppression motion. Ruling from the bench, the district court accepted the key factual premises relied on by the government to connect Defendant's IP address with Bulletin Board A:
What is clearly in the affidavit is that Bulletin Board A is a dedicated bulletin board to advertising distribution and production of child pornography and that it therefore, already anybody who might be on that site, there would be a reasonable belief that that person was interested in accessing that kind of information.
Then there was the posting of that particular section [of Bulletin Board A] that was clearly advertising video clips of what would absolutely be unequivocally child pornography, and the critical fact ... is that the same day that posting went up, the URL that is linked-or the IP address that is linked to a computer in the defendant's home ... attempts to or at least shows an interest in [Bulletin Board A]. In my view, that's enough for probable cause to believe that there would be a computer in that residence that would have child pornography on it.
J.A. 76-77. In other words, in accordance with the government's invitation, the district court drew no distinction between Bulletin Board A and File Sharing Site and presumed that someone using Defendant's IP address clicked on the URL navigating to the child pornography stored on File Sharing Site after seeing the URL posted on Bulletin Board A.
But the majority maintains that it is "unclear" whether the district court was referring to Bulletin Board A or File Sharing Site because the district court could have been referring to File Sharing Site, rather than Bulletin Board A when it referred to "both the 'posting' and 'the URL that is linked.' " Id . That reading is simply implausible. Clearly, the district court did not refer to the Bulletin A Board "posting" and the "URL that is linked" as two separate websites, i.e. , Bulletin Board A and File Sharing Site. Instead, the district court stated that on the "same day that posting went up, the URL that is linked -or the IP address that is linked to a computer in the defendant's home ... attempts to or at least shows an interest in that particular site ." J.A. 76-77 (emphases added). The district court therefore considered both the "posting" and the "URL that is linked," on Bulletin Board A , to be referencing a single website: Bulletin Board A. The district court discussed the URL only in the context of it being linked on Bulletin Board A, rather than it being hosted by File Sharing Site. Accordingly, the district court incorrectly assumed that Defendant's IP address demonstrated an interest in Bulletin Board A.
In short, the district court did not expressly contemplate the possibility that someone using Defendant's IP address navigated to the URL by any means other than the Bulletin Board A post. Defendant timely appealed the denial of his suppression motion.
II.
The Fourth Amendment protects "[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures." U.S. Const. amend. IV. It represents the Framers' "response to the reviled 'general warrants' and 'writs of assistance' of the colonial era, which allowed British officers to rummage through homes in an unrestrained search for evidence of criminal activity." Riley v. California , 573 U.S. 373 , 403, 134 S.Ct. 2473 , 189 L.Ed.2d 430 (2014).
Recognizing that the advent of new technology-like the Internet and the ability to store vast amounts of information in small electronic devices-"enhance[s] the Government's capacity to encroach upon areas normally guarded from inquisitive eyes," the Supreme Court has rejected " 'mechanical interpretation[s]' " of the Fourth Amendment that would allow the government to "capitalize" on such technology to invade the reasonable expectations of privacy and security protected by that Amendment. Carpenter v. United States , --- U.S. ----, 138 S. Ct. 2206 , 2214, 201 L.Ed.2d 507 (2018) (quoting Kyllo v. United States , 533 U.S. 27 , 35, 121 S.Ct. 2038 , 150 L.Ed.2d 94 (2001) ). Rather, when applying the Fourth Amendment in the context of new or advancing technology-like the URL click at issue in this case-courts must seek to "assure [ ] preservation of that degree of privacy against government that existed when the Fourth Amendment was adopted." Id. (quoting Kyllo , 533 U.S. at 34 , 121 S.Ct. 2038 ).
In doing so, courts must keep in mind at least two basic Fourth Amendment "guideposts"-that the Amendment seeks "to secure the privacies of life against arbitrary power" and "to place obstacles in the way of a too permeating police surveillance." Id. (internal quotation marks and citations omitted). That is particularly true when, as here, the government seeks authority to search a home because, "when it comes to the Fourth Amendment, the home is first among equals." Florida v. Jardines , 569 U.S. 1 , 6, 133 S.Ct. 1409 , 185 L.Ed.2d 495 (2013).
"Although the text of the Fourth Amendment does not specify when a search warrant must be obtained," the Supreme Court repeatedly has recognized that " '[i]t is a basic principle of Fourth Amendment law ... that searches and seizures inside a home without a warrant are presumptively unreasonable.' " Kentucky v. King , 563 U.S. 452 , 459, 131 S.Ct. 1849 , 179 L.Ed.2d 865 (2011) (quoting Brigham City v. Stuart , 547 U.S. 398 , 403, 126 S.Ct. 1943 , 164 L.Ed.2d 650 (2006) ). Warrants are "constitutionally sound when issued by a neutral magistrate and supported by probable cause." United States v. Montieth , 662 F.3d 660 , 664 (4th Cir. 2011) ; see U.S. Const. amend. IV. The government bears the burden of demonstrating probable cause to support a search warrant. See, e.g. , id. at 665 ; Walczyk v. Rio , 496 F.3d 139 , 161 (2d Cir. 2007) ; United States v. Abboud , 438 F.3d 554 , 569 (6th Cir. 2006).
To determine whether a warrant is supported by probable cause, a magistrate must "make a practical, common-sense decision whether, given all the circumstances set forth in the affidavit[,] ... there is a fair probability that contraband or evidence of a crime will be found in a particular place." Illinois v. Gates , 462 U.S. 231 , 238 (1983). When a magistrate judge issues the challenged warrant, this Court must determine "whether the magistrate judge had a 'substantial basis' for finding probable cause." United States v. Lyles , 910 F.3d 787 , 791 (4th Cir. 2018). Accordingly, the question before this Court is whether, based on the information set forth in the affidavit, the magistrate judge had a "substantial basis" for finding that there was a "fair probability" that contraband or evidence of a crime would be found within Defendant's residence.
A.
The majority opinion concludes-and I agree-that even a "single click" of an internet link to download 3 child pornography can provide probable cause to support a search warrant if the facts set forth in the warrant application establish that "the person behind that click plausibly knew about and sought out that content."
Ante at 326. According to the majority opinion, the affidavit established that someone using Defendant's IP address "plausibly knew" that the URL linked to child pornography because the November 2, 2015, post on Bulletin Board A, in which a copy of the URL appeared, "contain[ed] text and images that unequivocally identified its contents as child pornography." Id . at 325. The majority opinion's finding of probable cause, therefore, rests entirely on the premise that the affidavit established a fair probability that someone using Defendant's IP address "clicked the link having encountered it on [Bulletin Board A]." Id . at 325.
That factual premise finds no direct support in the materials considered by the magistrate judge in granting the warrant. The affidavit does not assert that Defendant, or someone likely to be using Defendant's IP address, was a member of Bulletin Board A. Indeed, the government conceded that it could not establish whether Defendant or someone using his IP address was a member of Bulletin Board A. Gov't Br. at 30.
The affidavit also does not provide any direct evidence that Defendant or someone using Defendant's IP address had ever visited Bulletin Board A. On the contrary, the government conceded before the district court that because Bulletin Board A "was only accessible on the dark web via a special web-browser called TOR," it could not provide an electronic record establishing whether Defendant's IP address ever visited Bulletin Board A. J.A. 37-38.
Instead of relying on direct evidence, the government contends, as it did before the district court, that circumstantial evidence makes it fairly probable that someone using Defendant's IP address navigated through the Bulletin Board A post to attempt to download the child pornography hosted by File Sharing Site. In support of that argument, the government's brief makes several representations.
First, the government repeatedly represents that the post appeared on Bulletin Board A before someone using Defendant's IP address sought to access the child pornography stored by File Sharing Site. Gov't Br. at 4 ("On November 2, an IP address that resolved back to [Defendant]'s residence was recorded to trying to access a link containing child pornography that had been posted on Bulletin Board A less than 24 hours earlier ." (emphasis added)); id. at 30 ("The short duration from when the link appeared on Bulletin Board A until someone at the defendant's residence clicked on the link established a fair probability that the link had been accessed through Bulletin Board A." (emphases added)).
Second, the government represents that the "link ... originated on a dark web forum dedicated to sharing child sexual abuse content," id. at 10-11 (emphasis added), meaning Bulletin Board A. See also id . at 9 ("Probable cause existed to search [Defendant]'s home on April 12, 2016, because law enforcement determined that a computer at [Defendant]'s residence accessed a link to downloadable child pornography, which originated on a website that caters to individuals seeking child pornography ." (emphasis added)). That "originat[ion]" contention serves to reinforce the government's assertion that someone using Defendant's IP address attempted to download the child pornography from File Sharing Site after encountering the URL on Bulletin Board A-if the URL "originated" on Bulletin Board A, then someone using Defendant's IP address had to have clicked on the URL after it appeared on Bulletin Board A.
For two principal reasons, the government's temporal proximity argument fails to establish a fair probability that someone using Defendant's IP address navigated to the URL via the post in Bulletin Board A. First, the government's temporal proximity argument rests on the "critical fact" that someone using Defendant's IP address clicked on the URL after the post containing the URL appeared on Bulletin Board A-a premise that the government repeatedly asserted in its briefing and argument to the district court and this Court. But if that "critical fact" lacks support-if the click on the URL occurred before the post on Bulletin Board A-then the person using Defendant's IP address could not have encountered the URL on Bulletin Board A, and therefore could not have viewed the text and images in the Bulletin Board A post indicating the URL linked to child pornography.
That is the case. Contrary to the government's repeated representations in its briefing, the affidavit does not assert, much less establish, that someone using Defendant's IP address clicked the URL after the post containing the URL appeared on Bulletin Board A. On the contrary, whereas the affidavit reports the time someone using Defendant's IP address clicked on the File Sharing Site URL-3:23 pm on November 2, 2015-it does not report at what time that day the post first appeared on Bulletin Board A. Rather, it simply states that the post appeared on Bulletin Board A sometime on November 2, 2015. Accordingly, the post could have appeared on Bulletin Board A anytime within a window of 8 hours, 37 minutes after someone using Defendant's IP address downloaded or attempted to download the child pornography from File Sharing Site.
Significantly, notwithstanding that the government represented to both this Court and the district court that-as a matter of fact, not inference-the Bulletin Board A post appeared before someone using Defendant's IP address attempted to download the child pornography from File Sharing Site, the affidavit nowhere addressed whether the government knew, or could have known, the time of the Bulletin Board A post as a result of its ongoing observation and capturing of content on Bulletin Board A. Gov't Br. at 13. Indeed, the government never has explained to this Court or the district court why the repeated representations in its briefing as to the sequence of events does not find direct support in the facts set forth in the affidavit it submitted with the warrant application. Of course, in assessing probable cause, we do not look to the representations the government makes after the fact, but the facts the government presented to the magistrate.
Because the government's circumstantial causation argument rests on the attempted download from File Sharing Site occurring after the post appeared on Bulletin Board A, the government's failure to establish that sequence of events fatally undermines its effort to rely on temporal proximity as a circumstantial basis for proving that someone using Defendant's IP address navigated to the URL through Bulletin Board A.
Notwithstanding this fatal flaw, the majority opinion accepts the government's temporal proximity argument-and the government's crucial factual representations underlying that argument-hook, line, and sinker. Although the majority recognizes that the affidavit does not establish whether the Bulletin Board A post preceded the "attempted download" by someone using Defendant's IP address, it nevertheless contends that the "critical fact " supporting probable cause is "[t]he close timing between the link's appearance on Bulletin Board A and the click by a user's IP address." Ante at 325 (emphasis added). According to the majority, "because the link was accessed on the same day it appeared on Bulletin Board A, it is at least reasonably probable that the user clicked the link having encountered it on that website." Id . at 325. Yet, even as it acknowledges that the affidavit failed to establish the "critical fact" supporting its theory of probable cause, the majority opinion nevertheless accepts that theory wholesale. See id . at 326 ("That chronology [of the URL click following the Bulletin Board A post] sets in motion the series of plausible inferences described above.").
Notably, the majority opinion distinguishes that "critical fact"-that the click occurred after the appearance of the Bulletin Board A post-from the "inferences" it draws from that fact-most notably, that someone using Defendant's IP address encountered the link in the Bulletin Board A post, not via some other electronic pathway. Ante at 325-26, 327 (reasoning that "it's fairly probable, given the temporal proximity, that the person clicked on the link because he saw it on Bulletin Board A and wanted to view child pornography " (emphasis added)). Put differently, rather than relying on an inference from an established fact, the majority opinion impermissibly draws inferences on inferences to uphold the warrant. See Rosencranz v. United States , 356 F.2d 310 , 317 (1st Cir. 1966) (noting that a magistrate may not "reach for external facts and ... build inference upon inference in order to create a reasonable basis for his belief that a crime is presently being committed"). The majority opinion therefore improperly draws an inference of causality based on a sequence of events the government failed to establish. See Figure A (illustrating the 35.9% probability that the Bulletin Board A post followed the IP address's click of the URL).
Figure A
But that is not the only flaw with the temporal proximity argument advanced by the government and embraced by the majority opinion. The government's temporal proximity argument also rests on the wholly unsupported premise that-even if someone using Defendant's IP address had clicked on the File Sharing Site URL after the post appeared on Bulletin Board A (which, again, the affidavit does not establish)-the user navigated to the URL through the post appearing on Bulletin Board A. Indeed, the facts set forth in the affidavit fail to address, much less rule out, a multitude of ways someone using Defendant's IP address could have navigated to the File Sharing Site URL without encountering the URL on Bulletin Board A, and therefore without observing the text and images that would have put that person on notice of the download link's content. The majority nowhere meaningfully contemplates the significance of this internet technology in our role to assess probable cause.
To begin, users can encounter URLs, or hyperlinks to URLs, 4 in myriad ways-including through websites, emails, chats, text messages, comment threads, discussion boards, File Sharing Sites (such as DropBox, Google Drive, or Apple iCloud), tweets, Facebook posts, Instagram captions, Snapchat messages, embedded images or videos, unwanted pop-up windows, any combination thereof, or by any other digital means. And because a URL, or a hyperlink to a URL, can be copied with only a click of a button, a single URL can be copied and further disseminated through any or all of these ways millions of additional times, often in a matter of seconds.
Thus, it is no exaggeration to state that URLs, or hyperlinks to URLs, can be posted and disseminated millions of times anywhere by anyone. Take for example, the trailer for the movie Avengers: Endgame -which was shared through multiple online platforms such as YouTube, Facebook, and Twitter-was viewed 289 million times in the first 24 hours after it was posted online. Todd Spangler, 'Avengers: Endgame' Trailer Smashes 24-Hour Video Views Record , Variety (Dec. 8, 2018, 11:02 a.m.), https://variety.com/2018/digital/news/avengers-endgame-record-trailer-worldwide-24-hour-views-1203085074; see also Crosby v. Twitter, Inc. , 921 F.3d 617 , 625 (6th Cir. 2019) (citing sources observing that "third parties upload 300 hours of content to YouTube every minute" and Twitter "boasts hundreds of millions of users ... with over 500 million tweets per day ... [or] 6,000 tweets per second" (citations omitted)); Chloe Taylor, A Japanese Billionaire Now Has Most Retweeted Tweet Ever After Offering a $923,000 Prize , CNBC (Jan. 7, 2019) (reporting that a single tweet-only one of the numerous online vehicles for sharing a URL-was retweeted nearly five million times in a two-day period), https://www.cnbc.com/2019/01/07/yusaku-maezawa-has-most-retweeted-tweet-ever-after-offering-923000.html. In this matter, none of the facts alleged in the affidavit rule out any of these potentially millions of alternative paths-wholly unconnected to the Bulletin Board A post-through which someone using Defendant's IP address could have encountered the URL navigating to the child pornography on File Sharing Site. 5
Additionally, users can navigate to a URL in numerous ways beyond clicking on a link included in a post on a particular webpage, like Bulletin Board A. For example, a user could click on a copy of the URL posted to another website, click on a bookmark, type the URL directly into a browser's navigation bar, or click a hyperlink in an email or a news article, to name only a few. See generally Amicus Br. at 8. That is particularly true when the URL navigates to a site on the normal Internet, like File Sharing Site, as opposed to a site, like Bulletin Board A, that can only be reached using a specialty browser, like Tor.
The majority opinion maintains that the "randomness of the URL" in this case-which contains a string of letters and numbers with no discernible pattern or meaning-"helps the government, as internet users aren't likely to type a truly random string of numbers and letters into their web browser by mistake." Ante at 328 n.7. That assertion-that someone using Defendant's address typed the URL into a web browser-contradicts the probable cause theory advanced by the government and otherwise relied on in the majority opinion-that someone using Defendant's IP address intentionally clicked on the URL in the Bulletin Board A post because they believed it led to child pornography.
Additionally, the randomness of the URL weighs against a finding of probable cause because it increases the likelihood that someone using Defendant's IP address clicked on the URL without knowing the content to which it navigated. Even assuming the user actually saw the URL-which, as explained below, is not necessarily the case-the random sequence of letters and numbers would provide a user with no indication that the URL navigated to child pornography. And most significantly, the majority opinion's myopic focus on one method of navigating to a URL-typing the URL into a browser-again ignores the multitude of other equally plausible-and likely far more plausible-ways someone using Defendant's IP address could have navigated to URL, none of which ways the facts set forth in the affidavit rule out.
Importantly, users can unintentionally navigate to URLs because-as is the case with the URL clicked by someone using Defendant's IP address-URLs frequently do not provide any external indication of the content to which they navigate. For example, services like YouTube and DropBox generate random URLs that provide no information about their underlying content. Amicus Br. at 10. Other services, like Bitly, TinyURL, and Perma shorten URLs, which may otherwise provide external indicators of their content, to generic URLs that include a standard URL base, such as "https://bit.ly/," "https://tinyurl.com/," or "https://perma.cc/," followed by a random string of alphanumeric characters. See generally Robin Camille Davis, The Future of Web Citation Practices , 35 Behav. & Soc. Sci. Libr. 128-34 (2016) (explaining different URL shortening services). Such generic URLs offer no indication of the content to which they navigate.
Link shortening and disguising often serve beneficial purposes by, for example, permitting distribution of password-protected files, facilitating the sharing of less clunky links, or permitting simpler citation styles. And link shortening and disguising can serve other innocuous purposes. URL
spoofing, for example, permits one user to disguise a hyperlink as directing to specific content or a particular website, while in reality directing the unwitting user to a distinct website altogether. See Amicus Br. at 12.
One humorous form of URL spoofing is "rickrolling," one of the "Internet's oldest memes," in which individuals click on a link "expecting one thing" but are instead led to "a video of Rick Astley singing 'Never Gonna Give You Up.' " Abby Ohlheiser, I Can't Believe This Is Why People Are Tweeting Fake Celebrity News , Wash. Post (Oct. 18, 2018), https://www.washingtonpost.com/technology/2018/10/18/i-cant-believe-this-is-whypeople-are-tweeting-fake-celebrity-news/?utm_term=.e9c493b7234d. The unsuspecting individual who follows the disguised URL is said to be "rickrolled." In fact, "rickrolling" has become such a mainstream online practice that in the lead-up to the 2018 midterm elections, an online campaign aimed to "rick roll" unregistered voters into registering to vote. Id .
As the Washington Post described, doing so was easy:
First, create a link to vote.org (or whatever else you want to trick people into visiting) using a link shortener such as bit.ly. Bit.ly works pretty simply: You enter in a URL, and the site spits out a shorter version. It's a relic from a time when URL length counted toward characters on Twitter but is now used to hide the original source of links.
Id . Then, "choose the right piece of gossip," such as news of a celebrity couple split, and tweet out an attention-grabbing headline alongside the disguised Bit.ly link leading to the voter registration website. Id . Thus, with a few clicks, anyone-even users with no advanced computational skills-can disguise a link and lure an unsuspecting user to click that link. In such circumstances, the user would learn of the content to which the URL navigates only after clicking on the link.
But link shortening and disguising are also used for malicious purposes. URL spoofing can enable "phishing," which redirects a user to a facially legitimate, but fake, website in order to steal the user's personal information. A "decent fake website," which a "phisher" can set up with little difficulty, provides the phisher with complete access to the user's information and computer without "expensive and detectable malware." Quinn Norton, Phishing Is the Internet's Most Successful Con , Atlantic (Sept. 12, 2018), https://www.theatlantic.com/technology/archive/2018/09/phishing-is-the-internets-most-successful-con/569920; see also Jonnelle Marte, Can You Tell the Real TurboTax Email from the Scam? , Wash. Post (Mar. 1, 2016), https://www.washingtonpost.com/news/get-there/wp/2016/03/01/can-you-tell-which-of-these-turbotax-emails-is-real-and-which-one-is-from-a-scam-artist/?utm_term=.7ba2976355cb.
Of particular relevance, bad actors can, and have, innocuously disguised links to child pornography and then sought to extort internet users who inadvertently navigate to the child pornography by clicking on the disguised links. See, e.g. , Adam Levin, The 5 Deadly Clicks: The Links You Should Never Touch , ABC News (Oct. 6, 2013), https://abcnews.go.com/Business/links-click/story?id=20461918 (detailing a Russia-based extortion scheme in which unsuspecting users clicked a link to child pornography). Again, none of the facts in the affidavit address, much less rule out, the numerous possible ways in which someone using Defendant's IP address could have unintentionally navigated to the File Sharing Site URL hosting the child pornography.
The majority opinion adverts to one of the many alternative paths through which someone using Defendant's IP address could have navigated-intentionally or unintentionally-to the File Sharing Site URL, acknowledging that Defendant's IP address may have "received [the link] knowingly from a member of [Bulletin Board A]," rather than "f[i]nd[ing] the link through Bulletin Board A." Ante at 327-28. But the majority opinion fails to recognize that this alternative path, by itself, materially undermines its theory of probable cause. If someone using Defendant's IP address did not encounter and navigate to the File Sharing Site URL through the Bulletin Board A post, then that person did not have an opportunity to observe the text and pictures in the post indicating the nature of the content to which the URL navigated. As the majority opinion concedes, absent a fair probability that someone using Defendant's IP address "clicked the link knowing that it contained child pornography"-which would not necessarily be the case if Defendant "received [the link] knowingly from a member of [Bulletin Board A]"-then there is no basis to find probable cause. Ante at 325, 328.
In sum, there are myriad ways users can encounter and navigate to a URL-including unintentionally, particularly when, as here, the text of the URL provides no indication as to the nature of the content to which it navigates. Accordingly, even if the Bulletin Board A post preceded the attempt by someone using Defendant's IP address to download child pornography from File Sharing Site-again, a fact not established by the affidavit-there are potentially millions of paths through which someone using Defendant's IP address could have encountered and navigated to the File Sharing Site URL hosting the child pornography other than through Bulletin Board A. Put simply, the affidavit does not establish the probability of the single sequence of events upon which the majority opinion relies-that someone using Defendant's IP address navigated to the File Sharing Site URL after encountering it on Bulletin Board A. See Figure B (contrasting the majority opinion's myopic focus on one pathway between Defendant's IP address and the File Sharing Site URL with the myriad pathways, only some of which are reflected by the dashed lines, consistent with the affidavit).
Figure B
The majority acknowledges that the probability of the IP address accessing the URL through Bulletin Board A "depends on the link being clicked after it was posted on Bulletin Board A" and that the affidavit does not specify the timing of the Bulletin Board A post. Ante at 326. But, in the majority's view, the "ambiguity" regarding the timing of the Bulletin Board A post is not fatal to a probable cause finding because it "was still almost twice as likely that the post preceded the click as the other way around." Id . (citing Figure A). Therefore, the majority opinion maintains, "the much likelier scenario" was that the Bulletin Board A post preceded the URL click and was therefore accessed by Defendant's IP address through Bulletin Board A. Id . at 326.
However, the majority's analysis ignores that the probability that the Bulletin Board A post preceded the File Sharing Site URL click is only one of several layers of uncertainty governing the likelihood that someone using Defendant's IP address accessed the File Sharing Site URL through the Bulletin Board A post. Put simply, assessing whether it is fairly probable that Defendant's IP address navigated to the URL via Bulletin Board A involves a compound probability, 6 governed by the probabilities of at least two independent events: first, whether the Bulletin Board A post preceded the URL click, and second, whether Defendant's IP address encountered the URL through the Bulletin Board A post. Stated formulaically,
P{Navigated to URL via = P{Bulletin Board A Post Bulletin Board A} Preceded Click} * P{Encountered Link on Bulletin Board A} 0.641x = .641 * x x = 1
As to the first event, there is a 64 percent chance that the Bulletin Board A post temporally preceded the URL click. See supra Figure A. And as to the second event-whether Defendant's IP address accessed the File Sharing Site URL through the Bulletin Board A post-the affidavit provides no facts that in any way circumscribe the massive universe of paths someone using Defendant's IP address could have taken to the URL, meaning that that probability, under the facts set forth in the affidavit, is necessarily vanishingly small. See Figure C.
Figure C
Without additional facts further limiting the universe of possibilities, we cannot know whether it is fairly probable that the IP address encountered the URL through Bulletin Board A. All but one of these potentially millions of the paths to the File Sharing Site URL do not involve the factual scenario that the majority opinion, at the government's urging, credulously accepts-that someone using Defendant's IP address encountered the URL in the November 2, 2015, post on Bulletin Board A and, using the link in that post, sought to download the child pornography shared on File Sharing Site.
The majority opinion glosses over these myriad alternative paths of accessing the URL because in its view, these "aren't of equal probability; rather, the likelier avenues incriminate [Defendant]." Ante at 328. The majority opinion claims that the "avenue[ ]" advanced by the government-that someone using Defendant's IP address clicked on the File Sharing Site URL after encountering it in the Bulletin Board A post-is "likelier" because the "likelihood that a specific filesharing page containing child pornography would find its way to somebody uninterested in such contraband ... is probably quite low." Id.
But the majority opinion identifies no facts in the affidavit supporting its bald assertion that it is unlikely that a user would innocently access child pornography. Instead, it first cites to the affidavit's boilerplate language regarding the characteristics of individuals who "collect" child pornography. The Fourth Amendment permits courts to rely on "the affiant-officer's experience" and knowledge regarding given crimes only when the affidavit contains sufficient evidence linking an individual to that crime. Wayne R. LaFave, 2 Search & Seizure § 3.7(d) (5th ed. 2018). For example, because it is "merely common sense that a drug supplier will keep evidence of his crimes at his home," at least one court has found that informant statements, as well as corroborating record evidence, setting forth "sufficient evidence" that a defendant was a drug supplier supported probable cause to search the supplier's home. United States v. Sanchez , 555 F.3d 910 , 914 (10th Cir. 2009). But when individualized information connecting an individual to a crime is absent, an affiant-much less a court-cannot rely on generalized, boilerplate assumptions about criminal habits. See United States v. Underwood , 725 F.3d 1076 , 1082-83 (9th Cir. 2013) (concluding that a trio of facts-a detective's observation of a personal-use sized baggie of marijuana at a suspect's home, the suspect's one-time delivery of two crates to drug traffickers, and the affiant's claims based on "experience and training" regarding the general habits of drug traffickers-could not support a finding of fair probability that drug trafficking evidence would be found at defendant's home).
Here, like Underwood , the majority opinion relies on the affidavit's explanation of the generalized habits of collectors of child pornography but points to no individualized facts in this case demonstrating that someone using Defendant's IP address was, in fact, a collector of child pornography. Ante at 327-28. For example, the affidavit does not allege that someone using Defendant's IP address viewed or possessed child pornography-or even successfully downloaded the illicit content associated with the URL-let alone that the IP address had ever accessed Bulletin Board A.
Ultimately, the majority's reasoning is circular: the IP address must have accessed the URL through Bulletin Board A because the IP address was associated with a collector of child pornography, and in turn, the IP address must be associated with a collector of child pornography because the IP address accessed the URL through Bulletin Board A. But without any affidavit evidence suggesting that the IP address in fact accessed the URL through Bulletin Board A or any evidence demonstrating that the IP address belonged to a collector of child pornography, the majority opinion cannot permissibly rely on the generalized habits of those who view and possess child pornography.
Moreover, even if the majority could permissibly rely on the affidavit's boilerplate language in this case, that language does not describe the sharing habits of child pornography collectors or the "complex measures" used to conceal their online activities, and therefore that language has no bearing on the likelihood of an innocent user accessing child pornography inadvertently. Ante at 327-28. Indeed, the fact that the government elected not to include such language is telling. The template for search warrants in child pornography cases used by law enforcement officers in the Bulletin Board A investigation directs affiants that they should include boilerplate "collector" information in an affidavit "ONLY if" the affiant can "tie [collector] characteristics to the specific offender." United States v. Reece , No. 2:16cr104, 2017 U.S. Dist. LEXIS 220176 , at 22 (E.D.Va. Mar. 1, 2017). Accordingly, the government's decision not to include boilerplate language related to the "complex" sharing habits of child pornography collectors indicates that even it did not believe the evidence supported inclusion of those boilerplate facts and therefore the inferences drawn by the majority opinion. Ante at 327-28.
In support of its assertion that the "likelihood that a specific filesharing page containing child pornography would find its way to somebody uninterested in such contraband ... is probably quite low," id. , the majority opinion further relies on two out-of-circuit cases to show that "consumers of child pornography frequently employ complex measures to keep their online activities secret," and therefore that it is unlikely that someone uninterested in child pornography could, or would, access the URL in question. Ante at 327-28 (citing United States v. McGarity , 669 F.3d 1218 , 1230-31 (11th Cir. 2012), abrogated on other grounds by Paroline v. United States , 572 U.S. 434 , 134 S.Ct. 1710 , 188 L.Ed.2d 714 (2014) ; United States v. Vosburgh , 602 F.3d 512 , 516-17 (3d Cir. 2010) ).
But both of these cases-neither of which was referenced by the government in the affidavit-involve materially different facts from those at issue here. McGarity dealt with a complex online ring of child pornography users, which used codenames, encryption, and other methods of subterfuge to conceal their activities. 669 F.3d at 1229-31 . And Vosburgh involved an online message board that directed users to child pornography using constantly changing gateway websites, complicated access instructions, and "cumbersome URLs." 602 F.3d at 516-17 .
Unlike McGarity and Vosburgh , the affidavit in this case contains no analogous case-specific evidence of a complex child pornography network relying on complicated electronic concealment and security measures. Instead, it documents a single click by an unspecified user of a particular IP address of a URL containing illicit content. And even if the facts of those cases were in any way analogous to the facts set forth the affidavit-which they were not-the government elected not to reference those cases, or even the type of conduct at issue in those cases, in its warrant application. Warrant applications do not implicitly incorporate, without reference, the entire Federal Reporter. Rather, the government is obligated to put the relevant, case-specific facts in the affidavit to support probable cause. It simply failed to do so here.
Additionally, the approach taken in the majority opinion-relying on factually dissimilar cases not referenced in the warrant affidavit as evidence that there is a fair probability that a suspect committed a crime in the same manner as those earlier cases-eviscerates the Fourth Amendment's probable cause requirement. The majority opinion's reasoning rests on the unsupported, and unsupportable, premise that if a defendant committed a crime in a certain way in one case-like, for example, the McGarity defendants' use of codenames and encryption methods-then there is a fair probability that every other individual suspected of the same crime committed that crime in the same manner as the defendant in the first case.
Consider, for example, a case in which the government suspected a physician's involvement in an alleged health care fraud scheme. In an earlier health care fraud case, the government filed affidavits and obtained three search warrants, for the physician's two medical offices and his personal residence. See United States v. Srivastava , 540 F.3d 277 , 280-81 (4th Cir. 2008). In addressing the physician's motion to suppress evidence seized from his residence, among other challenges, this Court concluded that the affidavit "made compelling assertions that documents and records relating to [the physician's] medical practice-and that may constitute evidence of health care fraud-would be found in [his] residence." Id . at 289. In particular, the affidavit demonstrated that the physician "conducted a substantial part of his medical practice from [his] residence." Id . For example, the insurance billing for the physician's medical practice was conducted from his house, and his personal residence was listed as a billing address. Id . at 281. Therefore, the affidavit demonstrated probable cause that evidence of health care fraud would be found at his residence. Id . at 289. In so doing, this Court emphasized that the affidavit included case-specific facts demonstrating a nexus between the physician's residence and the evidence of health care fraud.
Under the majority opinion's analytical approach-in which one defendant's conduct may be imputed to all future individuals suspected of committing the same crime-there is a fair probability that every future health care fraud suspect conducted health care fraud in the same way as the defendant in Srivastava -namely, from their personal residence as well as their medical offices, even if the affidavit alleges no facts to support such a finding. Accordingly, under the majority opinion's flawed analysis, law enforcement would be able to procure a search warrant for a future health care fraud suspect's home, even if the affidavit does not demonstrate a nexus between her home and health care fraud, simply because health care fraud has been previously conducted in that manner. But see United States v. Brown , 828 F.3d 375 , 382 (6th Cir. 2016) ("If the affidavit does not present sufficient facts demonstrating why the police officer expects to find evidence in the residence rather than in some other place, a judge may not find probable cause to issue a search warrant.").
Such an analytical approach violates the Fourth Amendment's requirement that the "affidavit supporting the search warrant ... demonstrate a nexus between the evidence sought and the place to be searched." Id . Contrary to the majority opinion's reasoning, we cannot rely on factually unrelated cases to ascertain probable cause merely because they implicate the same crime. Rather, determining if an affidavit properly establishes a nexus is a "fact-intensive question resolved by examining the totality of circumstances presented." Id . (citations omitted).
In further support of its conclusion that Defendant's IP address is unlikely to have innocently encountered the URL in question, the majority points to the "suspiciously short interval between " the Bulletin Board A post and the URL click. Ante at 328 (emphasis added). In the majority's view, this temporal proximity is based "on the contents of the affidavit, the magistrate judge's likely familiarity with online child pornography crimes, and his ability to reach 'common-sense conclusions about human behavior.' " Id . (citations omitted).
But as explained previously, the simple fact that the Bulletin Board A post and the alleged accessing of the File Sharing Site URL took place on the same day does not support the majority opinion's inferential leap. The naked click of a URL provides very little information about how a particular IP address-or individual using that IP address-actually encountered or navigated to a URL. Simply because law enforcement officers navigated the URL through one particular pathway-clicking the URL included in the Bulletin Board A post-does not establish, in the absence of additional circumstantial evidence, a fair probability that Defendant's IP address also accessed the URL using the same pathway through the Bulletin Board A post. Because the affidavit lacks facts to circumscribe the multitude of potential paths someone using Defendant's IP address could have taken to encounter and navigate to the File Sharing Site URL, the probability that the person in fact reached the URL through the Bulletin Board A post-the foundation of the probable cause theory embraced by the majority opinion-necessarily approaches zero. This is not the "fair probability" the Fourth Amendment demands.
On the contrary, the inference advanced by the government and made up out of whole cloth by the majority opinion-that someone using Defendant's IP address navigated to the File Sharing Site URL after encountering the URL on Bulletin Board A-amounts to the type of "improbable leap" that the Fourth Amendment does not countenance. Lyles , 910 F.3d at 795 . Put differently, that inference is not the "usual inference [from] which reasonable men draw from evidence" and therefore does not constitute a "substantial basis" for issuing a warrant. Johnson v. United States , 333 U.S. 10 , 14, 68 S.Ct. 367 , 92 L.Ed. 436 (1948). 7
B.
The most troubling aspect of the majority opinion-most clearly evidenced by its reliance on the government's unsupported factual theory-is its failure to grapple with the complex and novel questions courts face when assessing probable cause premised on conduct on the Internet.
1.
Probable cause is not a "[f]inely-tuned standard[ ]" but rather "turn[s] on the assessment of probabilities in particular factual contexts." Gates , 462 U.S. at 232, 235, 103 S.Ct. 2317 . These probabilities are "incapable of precise definition or quantification into percentages" because they depend on the "totality of the circumstances." Maryland v. Pringle , 540 U.S. 366 , 371, 124 S.Ct. 795 , 157 L.Ed.2d 769 (2003). Nevertheless, the term "probabilities" necessarily contemplates that courts try to estimate (at least) outer bounds on the likelihood that contraband or evidence will be found in a particular location at a particular time. Otherwise, the probable cause inquiry would be devoid of guardrails, opening the door to the general warrants the Framers feared. To estimate those outer bounds, courts rely on facts-facts that circumscribe the universe of potential explanations and therefore allow the court to make an estimate as to the numerator and denominator determining the probability. See Lyles , 910 F.3d at 793 ("The question, as so often in Fourth Amendment cases, is what precisely the facts show."); see generally Richard Posner, Against Constitutional Theory , 73 N.Y.U. L. Rev. 1 , 3 (1998) (observing that "the greatest need of constitutional adjudicators" is "empirical knowledge").
For instance, courts often must decide whether to issue a warrant to authorize the search of a home of a suspect known to sell drugs. In determining whether a warrant should issue-whether there is a fair probability that contraband or evidence will be found at the suspect's home-courts rely on numerous circumstantial facts to guide their determination. Thus, for example, courts upholding warrants issued in such circumstances have emphasized that a recent drug sale took place within a close vicinity of the suspect's home, United States v. Jones , 159 F.3d 969 , 974 (6th Cir. 1998) ; that officers had a reasonable belief that a suspect had just left his home and was en route to a drug sale, United States v. Aguirre , 664 F.3d 606 , 611 (5th Cir. 2011) ; or that the suspect attempted to hide his residence from the police by driving "erratically" on the way back from a sale, United States v. Dessesaure , 429 F.3d 359 , 368 (1st Cir. 2005). See generally LaFave § 3.7(d) (collecting cases). By geographically and temporally tying the suspect's conduct to his residence, these additional facts-over and above the suspect's history as a drug dealer-make it more likely that the contraband or evidence will be found in the place the government seeks to search.
By contrast, when insufficient information "links the criminal [drug] activity to the defendant's residence"-for example, when the affidavit fails to describe the storage of drugs at the residence, the "geographic relationship" between the area of drug sales and the residence, or temporal proximity between evidence of drug activity at the residence and the proposed search-then the affidavit is "devoid of any basis from which the magistrate could infer that evidence of drug activity would be found at [the residence]." United States v. Lalor , 996 F.2d 1578 , 1582-83 (4th Cir. 1993). Even when a magistrate "might have been able to draw an inference from the proximity of the drug sales to the [the defendant's] residence," if the government fails to include proximity evidence in a warrant application, then the magistrate has "no basis" for finding probable cause. Id . at 1583.
Additional facts circumscribing the universe of possible explanations for potentially unlawful conduct prove especially important when, as here, the facts are consistent with an innocent explanation for the conduct. Although the Fourth Amendment's probable cause requirement "does not depend on the elimination of all innocent explanations for a situation," courts must consider the "existence of countervailing probabilities" as part of their probable cause analysis. United States v. Jackson , 415 F.3d 88 , 94 (D.C. Cir. 2005). Otherwise, nothing would prevent the government from presenting only the "most incriminating interpretation of the circumstances" and thereby depriving the magistrate of the opportunity to weigh the likelihood that contraband or evidence will be found against the likelihood that contraband is absent. Id . at 94-95.
For example, in United States v. Gary -an opinion the government relied on in its briefing to the district court, J.A. 44-45-this Court upheld a search warrant for a home that had its genesis in an anonymous tip that someone was selling drugs from that home. 528 F.3d 324 , 328 (4th Cir. 2008). Following the tip, the police removed several tied trash bags from two cans "directly behind" the home. Id . at 326. The bags contained drugs and drug distribution paraphernalia, including foil and baggies with cut corners. Id . at 326. This Court recognized the innocent possibilities that "another person placed the offending bags [containing drugs] in the trash cans, or that some other person moved the unmarked can from its correct spot behind someone else's home to a place behind [the individual's] home." Id . at 327. Nevertheless, those "mere possibilit[ies]" did not defeat probable cause to search the home. Id.
In reaching that conclusion, we emphasized several case-specific facts that rendered those innocent alternative explanations unlikely. The proximity between the trash cans and the home-the police found the trash cans directly behind the house-reduced the likelihood that contraband in the trash can was unconnected to the adjacent home because generally "trash cans placed directly behind a home are used by those who live there" and trash inside those trash cans is "usually generated by the house closest to those cans ." Id . at 327-28 (emphasis added). Other evidence further tightened the connection between the trash can and the home-a letter addressed to the house was found inside one of the trash cans, and one of the cans bore the house's street number. Id . These facts, considered together, established probable cause because they rendered "too slight" the possibility that the tied trash bags did not come from the house. Id . at 328. Importantly, unlike the majority opinion's failure to meaningfully consider the myriad ways someone using Defendant's IP address could have clicked on the File Sharing Site URL without encountering the Bulletin Board A post, the Gary Court did not dismiss out of hand potential "innocent reasons" weighing against the likelihood that drug evidence would be found in the home. Instead, this Court looked at the totality of the circumstances and cited specific facts that made those possibilities unlikely.
By contrast, in United States v. Lyles , we held that a single trash pull "revealing evidence of three marijuana stems, three empty packs of rolling papers, and a piece of mail, standing alone" did not justify a search warrant for an adjacent home. 910 F.3d at 793 . In reaching that conclusion, we highlighted several case-specific facts that rendered the case distinguishable from Gary . Whereas in Gary the trash pull revealed drug distribution paraphernalia-evidence consistent with recurrent or ongoing activity within the residence, meaning that contraband was likely still at the residence-the single trash pull in Lyles revealed only a "tiny quantity of discarded [marijuana] residue" that provided no evidence of recurrent or ongoing activity, rendering it possible, but "not probabl[e]," that drugs would be found in the home. Id . at 793-94 (citations omitted). Additionally, whereas in Gary law enforcement officers received a tip that drug distribution activities were taking place at the residence, in Lyles the affidavit submitted by the government in support of the warrant provided no evidence, beyond the evidence in the trash bag, that the residence, or individuals living therein, was involved in drug distribution activities. Id.
The types of corroborative facts present in Gary -and absent in Lyles -are especially important in cases, like the instant case, in which the government seeks to obtain a warrant based on online conduct, as the Internet significantly expands the universe of "countervailing probabilities" that courts must consider in weighing whether the government has met its burden to show that there is a fair probability that contraband will be found in the place it seeks to search. Jackson , 415 F.3d at 94 . In other words, many of the physical, spatial, and temporal limitations that historically proved invaluable in assessing probable cause do not apply in the digital context or apply in meaningfully different ways.
For example, whereas this Court could rely on geographic proximity in Gary to conclude that there was a fair probability that contraband would be found in the residence adjacent to the trash cans, geographic proximity has little or no relevance in the context of conduct on the Internet-like the alleged download of child pornography-because the Internet allows for rapid dissemination of electronically stored content throughout the world. That is to say, whereas the limited number of homes within the physical proximity of a trash can means that the probability contraband will be found at any one house near the trash can is fairly large (because the limited number of homes renders the denominator of the probability relatively small), geographic proximity does not serve to increase the probability that contraband will be found at a particular location in the Internet context.
2.
That certain facts courts historically have relied on to assess probable cause lack, or have diminished, probative value in the Internet context does not mean that the government will never be able to surmount its evidentiary burden to obtain a warrant based on Internet conduct. "Technology is both a threat and a promise." Vieth v. Jubelirer , 541 U.S. 267 , 312, 124 S.Ct. 1769 , 158 L.Ed.2d 546 (2004) (Kennedy, J., concurring in the judgment). Although new technologies can foreclose certain avenues for the government to show probable cause-such as through geographic proximity-"new technologies [also] may produce new methods" of demonstrating probable cause. Id. at 312-13 , 124 S.Ct. 1769 . For example, the ease with which Internet and telecommunications companies can capture and store information regarding an IP address's browsing behavior and online activities provides a wealth of additional information for the government to rely on in seeking to obtain a search warrant for a residence associated with the IP address. In the child pornography context, in particular, courts routinely rely on such evidence-or the absence of such evidence-to determine whether the government has met its burden to show a fair probability that evidence related to child pornography offenses will be found at a residence associated with a particular IP address.
For instance, in United States v. Gourde , 440 F.3d 1065 (9th Cir. 2006) (en banc), the Ninth Circuit found probable cause to search a defendant's residence based on facts set forth in affidavit establishing a fair probability that the suspect "inten[ded] and desire[d] to obtain illegal images," id. at 1070 . Those facts included that (1) the suspect paid for a subscription to a website, Lolitagirls.com, that "was a child pornography site whose primary content was in the form of images"; (2) electronic records from a credit card processing service revealed that in order to subscribe to the website the suspect "submitt[ed] his home address, email address and credit card data, and he consented to have $19.95 deducted from his credit card every month"; and (3) the suspect "became a member [of the website] and never looked back-his membership ended because the FBI shut down the site" several months later. Id. at 1070-71 . The Court reasoned that these facts established that the defendant "could not have become a member by accident or by a mere click of a button [.]" Id . (emphasis added). The Court relied on the circumstantial evidence regarding the defendant's Internet conduct to determine that the "countervailing probabilit[y]" that the defendant innocently visited the website was low. Jackson , 415 F.3d at 94 ; see also, e.g. , United States v. Martin , 426 F.3d 68 , 78 (2d Cir. 2005) (finding probable cause to search a residence when electronic records revealed that an individual with a particular email address "joined ... voluntarily and never cancelled his membership" to a child pornography website and that the user of the email address lived at the residence for which the warrant was sought).
In contrast, courts have declined to find probable cause when the government fails to put forward supporting facts that diminish the likelihood that a child pornography website was accessed innocently or unintentionally. For example, in United States v. Falso , the Second Circuit held that a forensic analysis of a child pornography site's server revealing that a suspect-who the affidavit reported had been charged 18 years earlier for sexually abusing a seven-year-old girl-had "either gained access or attempted to gain access" to a child pornography website did not establish probable cause to search the suspect's home, 544 F.3d at 114 . Writing for the court, then-Judge, now-Justice Sotomayor held that those facts were insufficient to establish probable cause because, unlike Martin , the affidavit included "no allegation that [the suspect] in fact gained access to the [child pornography] website, much less that he was a member or subscriber of any child-pornography site." Id. at 124 .
The Second Circuit pointed to several types of information that the government could have-but did not-adduce in preparing its warrant application that may have allowed it to satisfy the "fair probability" standard, including that the suspect (1) took actions "tend[ing] to negate the possibility that his membership or subscription was unintended," such as being a member of multiple child pornography sites or having provided personal information to join a child pornography site; (2) used an "e-mail address[ ] or screen name[ ] suggestive of an interest in collecting child pornography"; or (3) had a "criminal history relating to child pornography." Id . at 120 (collecting cases). The court further suggested that, to show it was more likely that contraband would be found at the suspect's residence, the government "could have monitored the traffic of [the child pornography] website and ascertained whether [the suspect] (and others) actually downloaded pornography from the site." Id. at 124 n.20.
The majority opinion's resolution of this case puts this Court at odds with Gourde , Martin , and Falso 8 and other circuit decisions requiring the government to adduce additional facts-over and above the single click of a URL that provides for download of child pornography-to establish probable cause to search a residence associated with the IP address responsible for the click. Unlike in Gourde , Martin , and Falso -and notwithstanding that the warrant application had its genesis in the government's monitoring of Bulletin Board A-the government concedes that its warrant application never established that someone using Defendant's IP address ever had visited Bulletin Board A, let alone consciously joined that site.
Nor does the affidavit establish any of the other types of facts Falso recognized courts use to circumscribe the universe of potential explanations for an IP address clicking on a URL linked to child pornography. The affidavit did not aver that Defendant, or someone likely to be using his IP address, used an email address or Internet screenname suggestive of an interest in child pornography; had a criminal history relating to child pornography; or ever had visited or joined other child pornography sites. Put another way, the affidavit establishes solely that someone using Defendant's IP address clicked on a URL hosted on File Sharing Site-in short, the "mere click of a button" rejected by the Ninth Circuit in Gourde . See also United States v. Coreas , 419 F.3d 151 , 156 (2d Cir. 2005) (Rakoff, J.) (rejecting the theory that the naked "clicking [of] a button" was sufficient to establish probable cause).
The majority opinion nevertheless contends that its decision is consistent with these out-of-circuit decisions because here, the "abbreviated time frame" alone suffices as an additional fact "lessen[ing] the likelihood that [Defendant's] IP address accessed the link independently of Bulletin Board A." Ante at 330. But, as explained above, the affidavit does not establish that someone using Defendant's IP address accessed the File Sharing Site URL after the Bulletin Board A post. And the additional facts relied upon by other circuits-such as whether the IP address paid for a child pornography website subscription; submitted personal information to a child pornography website; or was a member of a child pornography website-establish a much closer nexus between the suspect's IP address and a child pornography website than the purported relationship by the facts set forth in the affidavit here, which show only that the Bulletin Board A post appeared on the same day that someone using Defendant's IP address clicked on a URL to a different website .
3.
Comparing this case to Gourde , Martin , and Falso also puts in sharp relief the types of information omitted from the affidavit, but which the government may have been able to include in the affidavit to reduce the "countervailing probabilit[y]" that someone using Defendant's IP address navigated to the File Sharing Site URL via some pathway other than the Bulletin Board A post. For instance, the affidavit may have been able to provide the timestamp of the Bulletin Board A post, and thereby rule out the possibility that someone using Defendant's IP address clicked on the URL before the post appeared on Bulletin Board A. Or, the affidavit may have been able to state whether Defendant's IP address actually downloaded the child pornography hosted by File Sharing Site-meaning that the contraband was more likely stored on a computer in Defendant's residence-rather than simply "attempt[ing]" to do so. Or, the affidavit may have been able to state, based on the government's monitoring of Bulleting Board A, whether Defendant, or someone using his IP address, ever had posted to Bulletin Board A. Or, the affidavit may have addressed whether someone using Defendant's IP address had clicked the File Sharing Site URL another time. Or, the affidavit could have stated whether the IP address had clicked another URL on File Sharing Site or some other website containing child pornography. Or, the affidavit may have been able to state whether Defendant, or someone likely to be using his IP address, had committed prior offenses indicative of a potential interest in child pornography. Or, the affidavit may have been able to state, based on the records the government obtained from File Sharing Site, how many different IP addresses downloaded or attempted to download the content accessible through the URL, thereby providing some indication as to how widely the URL was disseminated.
Any one of these facts would have provided the magistrate with greater clarity as to whether there was a fair probability that someone using Defendant's IP address clicked on the URL knowing that it would likely lead to the download of child pornography, and therefore that contraband was likely to be found in Defendant's residence. Importantly, the government never has stated, either in the affidavit or in briefing, that it could not have learned of some or all of these facts before submitting the warrant request.
By allowing the government to obtain a warrant to rummage through Defendant's residence and effects based on the single click of a URL navigating to a website not devoted to child pornography, File Sharing Site, the majority opinion invites the government to submit similar bare-bones affidavits in the future. That is to say, the approach taken by the majority opinion-which relies on those representations in the government's briefing that do not find support in the affidavit submitted in support of the warrant-sends a message to government that any ambiguities or omissions in the evidence it submits in support of a warrant application will inure to its benefit.
That is precisely the wrong message for the judiciary to send to the government. As explained above, in order to assess whether there is a fair probability that contraband or evidence in a place the government seeks to search, courts need facts-we need to know "what precisely the facts show." Lyles , 910 F.3d at 793 . And it is the government's burden to put forward those facts necessary for courts to make that determination. Accordingly, rather than rewarding the government for submitting a warrant application with glaring inadequacies and omissions-like the time of the Bulletin Board A post-this Court should require the government "to comply with the well-known duty to spell out the complete factual basis for a finding of probable cause within the affidavit's four corners" and thereby advance the "preeminently worth goal" of "deterring police from submitting (and magistrates from accepting) affidavits that completely omit crucial factual allegations." Virgin Islands v. John , 654 F.3d 412 , 420 (3d Cir. 2011).
4.
The conspicuous absence of facts circumscribing the universe of countervailing probabilities also fatally undermines the efforts by my colleagues in the majority to analogize the online conduct at issue to analytical frameworks developed by courts prior to the advent of the Internet. Analogical reasoning follows a familiar four-step framework: "(1) Some fact pattern A has a certain characteristic X, or characteristics X, Y, and Z ; (2) Fact pattern B differs from A in some respects but shares characteristics X, or characteristics X, Y, and Z ; (3) The law treats A in a certain way; (4) Because B shares certain characteristics with A, the law should treat B the same way." Cass R. Sunstein, On Analogical Reasoning , 106 Harv. L. Rev. 741 , 745 (1993). It is "readily app[arent]" from this framework that "analogical reasoning does not guarantee good outcomes or truth." Id. Rather, "[f]or analogical reasoning to operate properly, we have to know that A and B are 'relevantly' similar, and that there are not 'relevant' differences between them." Id. at 745 . In cases involving new technology like the Internet, therefore, analogical reasoning is valid only if the new technology is " 'relevantly' similar" to the technology employed in the cases in which the rule or framework was developed or previously applied.
To be sure, there are cases in which new technology is " 'relevantly' similar" to technology considered in earlier cases, rendering analogies between cases involving the two types of technology valid. For instance, in determining whether social media websites constitute public forums for purposes of the First Amendment, the Supreme Court has described such sites as "the modern public square." Packingham v. North Carolina , --- U.S. ----, 137 S. Ct. 1730 , 1737, 198 L.Ed.2d 273 (2017). That analogy is " 'relevant[ly]' similar" because, at least in certain circumstances, social media sites "bear the hallmarks of a public forum" by constituting a space for unfettered "public discourse." Davison v. Randall , 912 F.3d 666 , 682 (4th Cir. 2019) ; see also, e.g. , City of Richmond v. S. Bell Tel. & Tel. Co. , 174 U.S. 761 , 776-77, 19 S.Ct. 778 , 43 L.Ed. 1162 (1899) (analogizing the telephone to the telegraph in deciding whether a telephone company's business was within the purview of a congressional act relating to telegraph companies).
But there are also cases in which analogical reasoning has proved faulty as a result of " 'relevant' differences" between the facts at issue and the cases to which courts seek to draw an analogy. For example, several courts once held that law enforcement officers could conduct a warrantless search of an arrestee's cell phone on grounds that cell phones are analogous to "container[s]"-like cigarette packs, wallets, or purses-which may be searched incident to arrest. See, e.g. , United States v. Wurie , 612 F. Supp. 2d 104 , 109-110 (D. Mass. 2009) (collecting cases), rev'd 728 F.3d 1 (1st Cir. 2013). In Riley v. California , the Supreme Court rejected that reasoning, highlighting the numerous ways in which cell phones differ from other objects arrestees keep on their person, rendering the analogy between cell phones and containers inapt. 573 U.S. at 393 , 134 S.Ct. 2473 ("Cell phones differ in both a quantitative and a qualitative sense from other objects that might be kept on an arrestee's person."). According to the Supreme Court, one crucial " 'relevant' difference" between cell phones and the type of "containers" law enforcement officers may search incident to arrest is the "immense storage capacity" of modern cell phones, which allows for the storage of a vast trove of highly personal information that, prior to the advent of modern electronic storage, could not be stored in "a container the size of [a] cigarette package." Id. at 393-95, 134 S.Ct. 2473 . Riley , therefore, stands for the general proposition that because "[c]yberspace is different from the physical world," courts "should proceed circumspectly" in analogizing analog case law to the digital context. Packingham , 137 S. Ct. at 1743-44 (Alito, J., concurring in the judgment).
Here, in appealing to the purported "temporal proximity" between the Bulletin Board A post and the click on the URL hosted by File Sharing Site, the government advances-and the majority opinion embraces-an unstated analogy to the evidentiary rule providing for authentication of a writing, communication, or other form of evidence based on "[a]ppearance, contents, substance, internal matters, or other distinctive characteristics, taken in conjunction with circumstances." Fed. R. Evid. 901(b)(4). Rule 901(b)(4) codifies and generalizes the common-law "reply-letter doctrine," which provides for authentication of a writing or communication "where it can be show that the [writing or communication] was sent in reply to a previous communication." Winel v. United States , 365 F.2d 646 , 648 (8th Cir. 1966) ; see also Charles Alan Wright & Victor James Gold, Federal Practice & Procedure: Evidence § 7109, at 83 (2000).
The majority opinion reasons that because the click (possibly) occurred soon after the Bulletin Board A post-and because the URL was composed of a distinctive string of letters and numbers-the person using Defendant's IP address who made the click must have encountered the URL on Bulletin Board A. In a nutshell, the majority opinion rests on the determination that due to temporal proximity and the unique content of the URL there is a fair probability that the click was made "in reply to" the Bulletin Board A post.
But there are " 'relevant' differences" between the factual scenario in which courts have applied the reply rule and the Internet context to which the majority opinion seeks to extend it. Most significantly, unlike with the items typically authenticated under Rule 901(b)(4) -letters, telephone calls, or even emails-URLs can be easily copied, disguised, and shared rapidly and widely-preserving no indication of their provenance-meaning that there are potentially millions of pathways through which someone using Defendant's IP address could have encountered and navigated to the File Sharing Site URL. See supra Part II.A.
That difference materially undermines the analogy to authentication under Rule 901(b)(4), which is premised on the notion that the " distinctive characteristics " of a writing make it sufficiently likely that an item of evidence is what a proponent purports it to be. Wright & Gold, Fed. Prac. & Proc.: Evid. § 7109, at 74-87 (emphasis added); see also McQueeney v. Wilmington Trust Co. , 779 F.2d 916 , 930 (3d Cir. 1985) (authenticating record based on distinctiveness of information contained therein because "[a]lthough we do not know precisely how many people had the information contained in the proffered evidence, we suspect ... that the number is small " (emphasis added)). When thousands or even millions of copies of a URL can exist on the Internet-and the government provides no factual basis for circumscribing that universe to a "small" number of relevant copies, McQueeney , 779 F.2d at 930 -one cannot reasonably determine that someone using Defendant's IP address clicked on that URL in reply to one posted copy of the URL-here, the Bulletin Board A post.
Notably, commentators have recognized that new technology allowing for easy replication and duplication of documents-akin to the easy duplication of URLs-has forced courts to reconsider which characteristics of a writing render it sufficiently distinctive to establish its provenance. Wright & Gold, Fed. Prac. & Proc.: Evid. § 7109, at 80-81 ("[W]hile earlier cases often assumed that the use of letterhead paper is sufficient to establish authenticity, that conclusion is now undermined by the current widespread availability of photocopy machines, scanners, and computer software capable of forging any letterhead."). Accordingly, the ease with which URLs can be copied and shared renders inapt the analogy upon which the majority opinion implicitly relies.
Or consider another proposed analogy advanced by one of my colleagues in the majority during oral argument:
If a package is being sent through the mail to a residence and that package contains cocaine ... and [law enforcement officers] go and say they want a search warrant for that house because the package is being delivered there, there is probable cause to search that house, right. We recognize though that it could well be and, in fact, we actually know that often ... drug dealers will send packages to their next door neighbor, for example, and try to pick them up before they are gathered. So there are always possibilities that that package could be sent to an innocent neighbor instead of the actual drug dealer. But throughout the case law we say that that may well be true-that is a possible explanation-that the receiver doesn't know that it was coming, but that doesn't destroy probable cause.
Oral Argument at 41:40-43:46; see also, e.g. , United States v. Lawson , 999 F.2d 985 , 988 (6th Cir. 1993) (reasoning that the possibility that the addressee of package containing drugs was an "innocent receiver[ ]" was "extremely remote, especially in the context of a controlled delivery of a quantity of drugs presumptively sufficient to constitute possession for resale."). Again, several aspects of this analog analogy do not map well onto the digital context.
To begin, as in the trash pull example at issue in Gary , see supra Part II.B.1, the limited number of houses "neighbor[ing]" the house to which the package of cocaine is delivered allows courts to place a lower bound on the probability that the house to which the package was delivered was, in fact, the package's intended recipient. By contrast, because URLs can be copied myriad times and rapidly disseminated to an infinite number of IP addresses around the world, geographic proximity provides no assistance to courts in assessing the probability that electronically disseminated contraband will be found in any particular location.
Second, contraband disseminated over the Internet is not subject to the same physical constraints as the package of cocaine in my colleague's hypothetical. A URL, and the content to which it navigates, can be replicated, stored, and reposted with little or no cost or effort. By contrast, a package of cocaine cannot be replicated and obtaining additional packages of cocaine is costly. Due to the cost and complexity of obtaining packages of cocaine, someone is not likely, for example, to send a package of cocaine to a large swath of innocent persons as part of an extortion scheme, as has occurred with child pornography disseminated electronically. See Levin, supra .
Third, there are more ways to disguise the content to which a URL navigates than a package of cocaine. As explained above, there are virtually an infinite number of ways that one can mask a URL, through methods such as link shortening or disguising. To be sure, there also are ways to disguise a package of cocaine-the sender, for example, can use a false return address or use a box that suggests the contents of the package are innocuous. But the methods for disguising cocaine are more limited-a given quantity of cocaine takes up a certain amount of space and has a certain weight, meaning any effort to mask a package of that quantity of cocaine is necessarily subject to certain physical limitations.
Fourth, the cocaine package can be delivered by limited means-the postal service, a commercial service like FedEx or UPS, or a private individual or group. By contrast, as explained above, the IP address could have encountered and navigated to the URL in myriad ways, only some of which provide any indication of the nature or origin of the content to which the URL navigates.
That the bare-bones facts provided in the affidavit-a single click of a random alphanumeric URL leading to a widely used file sharing website hosting downloadable child pornography on the same day as a copy of the URL appeared on a different website devoted to child pornography-render the analogies my colleagues in the majority seek to draw inapt does not mean, however, that courts can never rely on analogical reasoning to assess probable cause in the Internet context. Rather, it means that the government must put forward sufficient facts in an affidavit to establish that the online conduct at issue is " 'relevant[ly] similar" to the facts of prior cases such that the analogy the government wishes the court to draw is valid. The government simply failed to do that here.
5.
The majority opinion's resolution of this case also opens the door to the government obtaining the general warrants the Framers feared. In particular, it opens the home-"first among equals" when it "comes to the Fourth Amendment"-to sweeping governmental searches based on a single click of a URL by an Internet user, regardless of whether the government adduces facts indicating that the user intended to navigate to the URL's illicit content. Jardines , 569 U.S. at 6 , 133 S.Ct. 1409 . Several hypotheticals illustrate the dangerous scope of the majority opinion's holding.
Suppose, for example, that a businessperson is conducting Internet research related to her business when a pop-up suddenly appears stating that her computer has a virus and that she should "Click here" to start the computer's clean-up process. Thinking the pop-up window was generated by her computer's anti-virus program, she clicks the link and navigates to a URL hosted by a widely used file sharing service, like File Sharing Site, where, upon entry of a password, a user can download child pornography.
Or consider that Grandma receives an email from what appears to be a close friend. The email contains the following sentence "Click HERE for my favorite knitting website." The word "HERE" is a hyperlink, appearing to direct Grandma to that knitting website. Grandma hovers her mouse over the word "HERE," which reveals the URL. But given the URL's random alphanumeric string, it reveals nothing about its content. Believing that the URL navigates to the knitting website, Grandma clicks "HERE" and is redirected to the same file sharing service URL encountered by the businessperson.
Or consider a teenager who clicks an online post that purportedly links to the latest viral YouTube video. Unbeknownst to the teenager, the link has been spoofed to appear to look like a YouTube link. Clicking the link in fact takes the teenager to the same file sharing service URL encountered by the businessperson and Grandma.
Or consider a college student who regularly visits a popular website devoted to adult pornography. A post in a discussion forum on the website includes a random alphanumeric URL, which the post says navigates to additional free pornographic images. The student clicks the link, which navigates the student's browser to the same file sharing URL encountered by the businessperson, Grandma, and the teenager.
In each of these hypotheticals, also suppose that the same day, independently of each individual's innocent navigation to the URL, a post on a known child pornography site, like Bulletin Board A, included that same URL. The timing of the post on the child pornography site is irrelevant-it could have appeared before or after the businessperson, Grandma, the teenager, or the college student navigated to the File Sharing Site URL.
Under the majority's opinion, in each of these hypothetical scenarios, the government would be able to obtain a search warrant to conduct an invasive search of each individual's home and electronic devices for evidence of wrongdoing. Like the instant case, no additional fact in these hypotheticals demonstrates the businessperson's, Grandma's, the teenager's, or the college student's intention either to access the child pornography site or child pornography, and no limiting fact reduces the countervailing innocent probabilities.
Contrary to the majority's wholly unsupported speculation that the "likelihood that a specific filesharing page containing child pornography would find its way to somebody uninterested in such contraband ... is probably quite low," these hypotheticals are not far-fetched. Ante at 327-28; see, e.g. , Robert Siciliano, Why Is Child Pornography on Your PC? , HuffPost (Dec. 6, 2017), https://www.huffpost.com/entry/why-is-childpornography_b_356539? ("When you click a link in an email or a pop up advertisement in your browser, you may inadvertently download one of these viruses, which can then visit child pornography websites and download files onto your hard drive."); Viruses Frame PC Owners for Child Porn , CBS News (Nov. 9, 2009, 12:49 PM), https://www.cbsnews.com/news/viruses-frame-pc-owners-for-child-porn (describing an Associated Press investigation into numerous cases in which child pornography was placed on a computer through a virus, including one computer that was "programmed to visit as many as 40 child porn sites per minute"). And it takes little imagination to envision corporate competitors, jilted lovers, or other bad actors sending unsuspecting victims disguised links to illicit content, knowing that if their victims click on that link, the government could search their homes or businesses.
*****
In sum, taking seriously the nature of the new and advancing technology at issue, the connection my colleagues in the majority draw between the Bulletin Board A post and the click on the File Sharing Site URL does not find factual support in the government's bare-bones warrant application. A single click of a URL, absent any further factual evidence circumscribing the universe of paths through which someone using Defendant's IP address could have encountered and navigated to that URL-nearly all of which have no relation to Bulletin Board A-is insufficient to establish probable cause. Indeed, the majority opinion concedes that in a "case based purely on an IP address connecting with a URL," probable cause "may be hard to establish absent other incriminating evidence." Ante at 328. Contrary to the majority's belief, this is that case.
Physical searches of the home represent the "chief evil against which the wording of the Fourth Amendment is directed." United States v. U.S. Dist. Court (Keith) , 407 U.S. 297 , 313, 92 S.Ct. 2125 , 32 L.Ed.2d 752 (1972). The majority's unquestioning acceptance of the government's probable cause theory-that, "by [the] act of clicking a button," an individual opens the doors of his home and the electronic devices stored therein to a sweeping search by government agents-is "utterly repellent to core purposes of the Fourth Amendment." Coreas , 419 F.3d at 156 . Therefore, I dissent from the majority opinion's conclusion that the magistrate judge had a substantial basis for finding that there was a fair probability that contraband would be found at Defendant's residence.
III.
Defendant next argues that even if probable cause existed to search his residence in November 2015-when someone using Defendant's IP address sought to download child pornography from File Sharing Site-probable cause no longer existed when the government obtained the warrant and searched his residence six months later. I agree.
Defendant's argument rests on the well-established rule that a valid search warrant "may issue only upon allegations of facts so closely related to the time of the issue of the warrant as to justify a finding of probable cause at that time." United States v. McCall , 740 F.2d 1331 , 1335-36 (4th Cir. 1984) (internal quotation marks omitted). To that end, the information in the affidavit supporting the warrant must not be "too stale to furnish probable cause." Id . at 1336. Staleness is "not resolved by reference to pat formulas or simple rules." Id . Rather, "we must look to all the facts and circumstances of the case, including the nature of the unlawful activity alleged, the length of the activity, and the nature of the property to be seized." Id .
Child pornography cases present "unique" staleness questions. United States v. Raymonda , 780 F.3d 105 , 114 (2d Cir. 2015) (internal quotation marks). As the majority correctly recognizes, when assessing claims of staleness in child pornography cases, courts distinguish between categories of suspects. The first category encompasses suspects-often referred to as "collectors"-for whom "circumstances suggest[ ] [they] had accessed those images willfully and deliberately, actively seeking them out to satisfy a preexisting predilection." Id. at 114-5 . The second category encompasses those suspects for whom there is an absence of evidence of willful or deliberate interest in child pornography-suspects who may have encountered child pornography in a "purely negligent or inadvertent" manner. Id. at 115 .
In cases involving collectors, "courts have largely concluded that a delay-even a substantial delay-between distribution and the issuance of a search warrant does not render the underlying information stale." United States v. Richardson , 607 F.3d 357 , 370 (4th Cir. 2010) (rejecting that a period of four months between the defendant's email of an image depicting child pornography until the warrant was issued); see also United States v. Burkhart , 602 F.3d 1202 , 1206 (10th Cir. 2010) (noting that the " 'passage of time alone' cannot demonstrate staleness" in child pornography cases). Such an approach is warranted because collectors "value their sexually explicit materials highly, rarely if ever dispose of such material, and store it for long periods in a secure place, typically in their homes." Richardson , 607 F.3d at 370 (citations and internal quotation marks omitted); see also United States v. Sassani , 139 F.3d 895 (4th Cir. 1998) (unpublished) (collecting cases).
But as the Second Circuit has recognized, "the value of [these] inference[s] in any given case depends on the preliminary finding that the suspect is a person 'interested in' images of child pornography"-that the suspect is, in fact, a collector. Raymonda , 780 F.3d at 114 . Put simply, "the 'alleged proclivities of collectors of child pornography' ... 'are only relevant if there is probable cause to believe that [a given defendant] is such a collector.' " Id . (quoting Coreas , 419 F.3d at 156 ).
In determining whether an affidavit submitted in support of a warrant establishes a fair probability that a child pornography suspect is a collector, courts have looked to "a suspect's admission or other evidence identifying him as a 'pedophile,' " a suspect's paid access or subscription to child pornography, or a suspect's "extended history of possessing or receiving pornographic images." Raymonda , 780 F.3d at 114-15 (collecting cases). Here, the affidavit is devoid of evidence that the individual using Defendant's IP address to click on the URL was a "collector," as courts have construed that term. The affidavit presents no evidence: that Defendant, or anyone likely to be using his IP address, was a pedophile; that Defendant's IP address had ever subscribed to or paid for access to child pornography; or that someone likely to be using Defendant's IP address had ever possessed or received child pornography. The affidavit does not even aver that a device connected to Defendant's IP address downloaded-let alone opened-the child pornography stored on File Sharing Site prompting the warrant request.
In certain cases, courts have inferred that a suspect was a collector "on the basis of a single incident of possession or receipt"-when, "for example, the suspect's access to the pornographic images depended on a series of sufficiently complicated steps to suggest his willful intention to view the files" or when the defendant "subsequently redistributed that [single] file to other users." Id . at 115 (emphasis added). But in such cases the inference that the suspect was a "collector" "did not proceed merely from evidence of [ ] access to child pornography at a single time in the past." Id. Rather, the inference rested on "circumstances suggesting that [the individual] had accessed those images willfully and deliberately, actively seeking them out to satisfy a preexisting predilection." Id.
The government argues-and the majority opinion agrees-that the circumstances described in the affidavit surrounding the attempt to download child pornography from File Sharing Site on November 2, 2015, established a "fair probability" that "whoever clicked on the link did so willfully and deliberately because he was interested in images of child pornography." Ante at 331. In support of that conclusion, the majority opinion relies entirely on its determination that the information set forth in the affidavit established that it was fairly probable "that somebody saw the description and video thumbnails on a website devoted to child pornography, Bulletin Board A, and then deliberately sought out the video by clicking that link." Id .
But the affidavit fails to establish a fair probability that someone using Defendant's IP address ever visited Bulletin Board A, let alone navigated through the November 2, 2015, post on Bulletin Board A to the child pornography stored by File Sharing Site. See supra Part II. And the affidavit's averments bearing on whether Defendant's IP address was used by a collector materially differ from the cases in which this Court and other courts have rejected staleness arguments in child pornography cases.
In Richardson , for example, this Court concluded that a delay of four months did not render the probable cause finding stale " in light of the other information supplied by [the federal agent], including the previous instance in which [the defendant] used an AOL account to send such images [.]" 607 F.3d at 370 (emphasis added); see also United States v. Lacy , 119 F.3d 742 , 745 (9th Cir. 1997) (holding that ten-month-old information is not stale where the affidavit provided evidence that the defendant downloaded at least two GIFs depicting minors engaged in sexual activity); United States v. Ramsburg , 114 F. App'x 78 , 82 (4th Cir. 2004) (unpublished) (concluding that evidence was not stale when it showed the defendant had previously transmitted an image of child pornography was a member of two e-groups that regularly distributed child pornography). Accordingly, the majority errs in rejecting Defendant's staleness argument.
IV.
Finally, the majority holds that even if the search warrant was constitutionally deficient-either due to lack of probable cause or staleness-the district court did not reversibly err in refusing to suppress the evidence obtained during the search because the officers reasonably relied on the warrant in executing the search. Ante at 330. Again, I disagree.
Under the so-called "good faith" exception to the exclusionary rule, "evidence obtained pursuant to a search warrant issued by a neutral magistrate does not need to be excluded if the officer's reliance on the warrant was 'objectively reasonable.' " United States v. Doyle , 650 F.3d 460 , 467 (4th Cir. 2011) (citing United States v. Leon , 468 U.S. 897 , 922, 104 S.Ct. 3405 , 82 L.Ed.2d 677 (1984) ). Defendant argues that the government is not entitled to invoke the good faith exception for two reasons: the materials submitted to the magistrate in support of the warrant application were (1) materially misleading and (2) "so lacking in indicia of probable cause as to render official belief in its existence entirely unreasonable." Id. (quoting Leon , 468 U.S. at 922-23 , 104 S.Ct. 3405 ).
As to the first reason, the government may not seek relief under the good faith exception if "the magistrate or judge [ ] issuing the warrant was misled by information in an affidavit that the affiant knew was false or would have known was false except for [her] reckless disregard of the truth." Id. (citation omitted). One situation in which this Court has found an affidavit is sufficiently misleading to establish an absence of good faith is when the affidavit includes "puffing"-i.e., irrelevant or inapplicable information-in an apparent "attempt[ ] to endue the affidavit with the appearance of genuine substance." United States v. Perez , 393 F.3d 457 , 465 (4th Cir. 2004) (quoting United States v. Wilhelm , 80 F.3d 116 , 123 (4th Cir. 1996) ).
Here, whereas only two paragraphs of the affidavit address allegedly unlawful conduct of someone using Defendant's IP address-attempting to download child pornography from File Sharing Site-the vast majority of the content in the affidavit-nearly twenty paragraphs-relates to the government's investigation into Bulletin Board A and the behavioral characteristics of "collectors" of child pornography. By including that information, the government sought to paint a picture of Defendant as a collector of child pornography who downloaded child pornography from a website, Bulletin Board A, devoted to child pornography. Yet, none of the evidence set forth in the affidavit establishes a fair probability that Defendant ever visited Bulletin Board A, let alone navigated through the Bulletin Board A post to the File Sharing Site URL. See supra Part II. And, the affidavit fails to establish a fair probability that Defendant was a "collector" of child pornography. See supra Part III. Accordingly, unless the affidavit established any nexus between Bulletin Board A and Defendant's IP address-which it did not-the affidavit's description of Bulletin Board A and the contents of the post is not at all "crucial to understanding why the government believed [Defendant's] home would contain evidence of criminal activity." Ante at 333.
By devoting the vast majority of the affidavit to information untethered from Defendant-or even Defendant's IP address-the government made the affidavit appear as if it had "genuine substance," Wilhelm , 80 F.3d at 123 , when in fact the information in the affidavit pertaining to Defendant established only that someone using Defendant's IP address clicked on a link to a widely used File Sharing Site around the same time, but not necessarily after, a post regarding the content of the link appeared on a wholly unrelated website devoted to child pornography. Accordingly, the inclusion of the Bulletin Board A and collector information was materially misleading. See Raymonda , 780 F.3d at 124 (Chin, J., concurring in part and dissenting in part) ("Without any evidence that [the suspect] was a collector of child pornography, it was inappropriate-and heedlessly indifferent-for [the affiant] to rely on boilerplate language regarding the proclivities of collectors."); Reece, 2017 WL 11373457 , at *11-12, 2017 U.S. Dist. LEXIS 220176 , at *28-30 (finding misleading an affidavit's inclusion of extensive information regarding the Bulletin Board A investigation and "the general characteristics shared by collectors of child pornography" when the affidavit failed to establish a fair probability that the suspect ever visited Bulletin Board A or was a collector of child pornography); cf. Coreas , 419 F.3d at 156 (rejecting the use of "unparticularized allegations" to justify an otherwise inadequate warrant application).
Importantly, evidence indicates that the government knew that the inclusion of "boilerplate" language regarding collectors, in particular, is materially misleading when, as here, the affidavit does not establish that a suspect is a collector: the template for search warrants in child pornography cases used by law enforcement officers in the Bulletin Board A investigation directs affiants that they should include boilerplate "collector" information in an affidavit "ONLY if" the affiant can "tie [collector] characteristics to the specific offender." Reece, 2017 WL 11373457 , at *12, 2017 U.S. Dist. LEXIS 220176 , at 22.
An affidavit also is misleading when affiants "omit material facts with the intent to make, or in reckless disregard of whether they thereby made, the affidavit misleading." United States v. Colkley , 899 F.2d 297 , 300 (4th Cir. 1990) (citations and internal quotation marks omitted). In seeking to avoid application of the good faith exception on the basis of a material omission, a defendant must show "(1) that the officer deliberately or recklessly omitted the information at issue and (2) that the inclusion of this information would have defeated probable cause."
United States v. Andrews , 577 F.3d 231 , 238-39 (4th Cir. 2009).
Here, the affidavit includes at least one material omission-evidence regarding the time of the Bulletin Board A post. Although the district court denied Defendant's request for a Franks hearing-meaning the record is largely devoid of evidence regarding what information the government chose to leave out of the affidavit-the affidavit provides some indication that the affiant knew when the post occurred. In particular, the affidavit states law enforcement officers began "observ[ing] various postings" and "captur[ing] content" on Bulletin Board A in October 2015, before the November 2, 2015, Bulletin Board A post at issue. J.A. 164. Given that the government was engaged in ongoing monitoring of Bulletin Board A, one can reasonably infer that the government knew-or at least should have known-the time of the November 2, 2015, post. In short, the omission of the time of the Bulletin Board A post from the affidavit was at least reckless, if not deliberate. See United States v. Jacobs , 986 F.2d 1231 , 1234-35 (8th Cir. 1993) (concluding that an "omission occurred at least with reckless disregard with its effect upon the affidavit" when "[a]ny reasonable person would have known that this was the kind of thing the [magistrate] judge would wish to know").
Because the government's probable cause theory-which the majority opinion embraces-relies exclusively on the temporal relationship between the Bulletin Board A post and the click on the File Sharing Site URL, the conspicuous omission of the time of the Bulletin Board A post from the affidavit "casts substantial doubt on the probability" that the click in fact occurred after the Bulletin Board A post. Gourde , 440 F.3d at 1076 (Reinhardt, J., dissenting). That the government repeatedly has represented in briefing to both the district court and this Court that the click occurred after the post-notwithstanding the absence of evidence to that effect in the affidavit, see supra Parts I, II.A-renders the omission of the timestamp all the more problematic. And if the click in fact occurred before the Bulletin Board A post-and the government had disclosed that information in the warrant application-the government could not have established probable cause. In such circumstances, the warrant application would lack the "critical fact" upon which the majority opinion largely relies. Ante at 325.
Second, the good faith exception does not apply because the affidavit was "so lacking in indicia of probable cause as to render official belief in its existence entirely unreasonable." Doyle , 650 F.3d at 467 . Although "[m]ere insufficiency of the affidavit to support probable cause" will not preclude application of the good faith exception, when the "deficiencies in the affidavit ... [are] so great as to render it objectively unreasonable" to rely on the warrant, it will. Id . at 470.
Here, it was objectively unreasonable for the law enforcement officers conducting the search to rely on the warrant application because, at the time of the search, it was well-established that a magistrate could not issue a warrant based on evidence "too stale to furnish probable cause." McCall , 740 F.2d at 1336 (internal quotation marks omitted). And it was well-established at that time that in cases involving child pornography, months-old evidence that a suspect sought to access or download child pornography-like the click of the File Sharing Site URL-is too stale to establish probable cause, absent evidence that the suspect is a "collector." See Doyle , 650 F.3d at 474 & n.15 ; see also Raymonda , 780 F.3d at 117 (holding that evidence that suspect had "accessed thumbnails of child pornography" nine-months earlier was too stale to establish probable cause when affidavit failed to establish suspect was a collector). And it was likewise well-established at that time that an affidavit establishes a fair probability that a suspect is a collector child pornography only if the affidavit sets forth "circumstances suggesting that [the suspect] had accessed those images willfully and deliberately, actively seeking them out to satisfy a preexisting predilection." Raymonda , 780 F.3d at 115 .
As explained above, the bare-bones facts set forth in the affidavit failed to establish that someone using Defendant's IP address had sought the File Sharing Site URL "willfully and deliberately" in an effort to "satisfy a preexisting predilection." See supra Part III. That deficiency rendered it objectively unreasonable for a law enforcement officer to believe that the otherwise stale facts set forth in the affidavit were sufficient "to justify a finding of probable cause at that time." McCall , 740 F.2d at 1335-36 . That is particularly true given that the government's warrant template should have put the affiant on notice that it is improper to include boilerplate collector information absent evidence in the affidavit "t[ying] [collector] characteristics to the specific offender." Reece, 2017 WL 11373457 , at *12, 2017 U.S. Dist. LEXIS 220176 , at 22.
Other deficiencies in the affidavit also rendered any belief in the existence of probable cause unreasonable. Most glaringly, given that the government's theory of probable cause relied entirely on the "crucial fact" that the click on the File Sharing Site URL occurred soon after the Bulletin Board A post, it was objectively unreasonable to rely on the affidavit when it failed to even establish that sequence of events. See, e.g. , J.A. 61.
V.
When, as here, an unlawful search reveals evidence of suspected criminality, we must not apply unsupported inferences to bend the law to ensure that a guilty person does not go free. And though the vileness of the crime in child pornography cases often presents a strong incentive to take liberties with the protections the Constitution affords to criminal defendants, we must guard our roles as judges to resist even that temptation. See Coreas , 419 F.3d at 151 ("Child pornography is so repulsive of a crime that those entrusted to root it out may, in their zeal, be tempted to bend or even break the rules."). Because when courts give in to that temptation, "they endanger the freedom of all of us." Id. ; cf. United States v. Clayton , 68 M.J. 419 , 428 (C.A.A.F. 2010) (Ryan, J., dissenting) (lamenting that the majority opinion "appears to champion the idea that there is something de minimis about the Fourth Amendment's requirements when the thing sought by a search authorization or warrant is child pornography"). Because our Constitution does not provide individuals suspected of committing certain crimes with less fulsome protections than individuals suspected of committing other crimes, the majority opinion's approach to analyzing the contours of constitutional rights in the digital context extends beyond cases that involve suspected distribution of child pornography. That's because cases involving alleged malfeasance committed electronically-which test the boundaries of our Fourth Amendment jurisprudence-will only increase in the coming years, as it is irrefutable that "[t]ime works changes, brings into existence new conditions and purposes." Olmstead v. United States , 277 U.S. 438 , 472-73, 48 S.Ct. 564 , 72 L.Ed. 944 (1928) (Brandeis, J., dissenting). "Therefore a princip[le] to be vital must be capable of wider application than the mischief which gave it birth. This is peculiarly true of Constitutions." Id .
With great respect for my colleagues in the majority, I must conclude that today's holding belies its claim to be "sensitive to the privacy interests at stake here." Ante at 334. Instead, it clings to analog technology from the internet dark age, uses unsupported inferences, and eviscerates constitutional rights for this brave new world of digital technology.
In sum, the majority's closing statements best illustrate why our disagreement is a matter of "judicial choice" rather than "judicial duty." Surely, we all agree that we "cannot ignore that many crimes are committed with just a few clicks of a mouse." Ante at 334. We also agree that the download of child pornography presents a particularly troubling result that can arise from a "single click."
But we disagree with the "judicial choice" that confronts us. That much is revealed in Part IV of the majority opinion:
In cases like this, our job is to ask precisely what "a single click" reveals under the circumstances presented, and whether that information justifies searching a person's most private places for evidence of a crime.
Id . Here, the majority says that the "circumstances presented" indicate temporal proximity between the Bulletin Board A post and the URL click. Based on that circumstance alone, the majority claims that the "single click" of a URL demonstrates an intent to navigate to the URL's illicit content. But in this brave new world of digital technology, it's just not that simple.
Instead, our "judicial duty" is to guard against infringements on our constitutional rights. Unfortunately, the majority's "judicial choice" to use layers of unsupported inferences that do not meaningfully grapple with the technology at issue diminishes the constitutional rights of those who use the Internet-I say woe unto all users of the Internet.
Respectfully, I dissent.
A Uniform Resource Locator, or "URL," "provide[s] Internet users with the ability to access web addresses" and contains "specific protocol information needed by a web browser to direct users to a specific image, file, webpage, program, or other resource on the Internet." Br. Amicus Curiae Electronic Frontier Foundation in Supp. of Def.-App. and Reversal ("Amicus Br.") at 7. Absolute URLs include "(1) a protocol designation, (2) a root domain or host name or address, and (3) a file path or resource location." Id .
The government represented below that the two URLs reference the same URL, but that the agent "redacted more of the file name" in paragraph 8 than in paragraph 16 of the affidavit. J.A. 49. According to the government, the two URLs are "the same in substance." Id .
I take no position on whether evidence that someone using a particular IP address clicked on a link navigating to a website that displays child pornography-as opposed to a link to download child pornography-can provide probable cause to search a residence associated with that IP. See United States v. Falso , 544 F.3d 110 , 124 (2d Cir. 2008).
"The definition of a hyperlink is text or an image within a file on your computer that you can click on that gives access to another document or image. Words on a website that are underlined and highlighted in blue and that you can click on in order to open a new web page are an example of a hyperlink." Berkson v. Gogo LLC , 97 F. Supp. 3d 359 , 373 n.2 (E.D.N.Y. 2015) (citation omitted).
Relatedly, the content to which a URL navigates and the link itself could "originate[ ]" in numerous places. Because electronic content often can be easily duplicated and stored, content that first appears at one URL may appear, in short order or over a longer time horizon, at numerous other URLs and may be stored on numerous other servers. Therefore, just because a URL, or a hyperlink to a URL, appears on one webpage, like Bulletin Board A, does not mean that the content associated with that URL first appeared on the webpage. For this reason, the government's repeated representation that the child pornography hosted on File Sharing Site "originated" on Bulletin Board A finds no support in the affidavit, which establishes only that a URL navigating to at least one website hosting the content, File Sharing Site, appeared on Bulletin Board A. It is entirely consistent with the facts set forth in the affidavit that the child pornography originated some place other than Bulletin Board A, meaning that the affidavit provides little factual support for the government's theory of causation-that someone using Defendant's IP address likely learned of the child pornography through Bulletin Board A. Indeed, that the child pornography videos at issue were hosted on File Sharing Site-not Bulletin Board A-provides evidence that the child pornography-a link to that child pornography- did not "originate[ ]"]" on Bulletin Board A.
Compound probability is a "mathematical term relating to the likeliness of two independent events occurring" and is "equal to the probability of the first event multiplied by the probability of the second event." Compound Probability , Investopedia (Apr. 29, 2019), http://www.investopedia.com/terms/c/compound-probability.asp.
The majority opinion-like the district court-distinguished this case from an analogous case, United States v. Reece , No. 2:16cr104, 2017 U.S. Dist. LEXIS 220176 (E.D.Va. Mar. 1, 2017). In Reece , the defendant challenged a search warrant supported by an affidavit nearly identical to the affidavit at issue here-the key difference being that the Reece affidavit unambiguously established that the Bulletin Board A post at issue appeared before someone using the suspect's IP address clicked on the URL included in the post. The Reece court held that the government failed to establish probable cause to support issuance of a warrant to search the suspect's home. Id ., 2017 WL 11373457 , at *13-14, 2017 U.S. Dist. LEXIS 220176 at *36.
The majority opinion attempts to distinguish Reece on the basis that the time between the Bulletin Board A post and the click on the File Sharing Site URL is shorter in this case than in Reece (on the same day versus two days apart), thereby rendering "the connection between the suspect and Bulletin Board A ... much closer." Ante at 329. Again, however, the majority opinion underplays that the affidavit does not establish that the Bulletin Board A post preceded the click, materially weakening the purported "connection" between Defendant's IP address and Bulletin Board A. That stands in sharp contrast to the affidavit in Reece , which unambiguously established that the IP address attempted to download content from the URL after the Bulletin Board A post, meaning that the still-insufficient facts in Reece provided a stronger basis for finding a "connection" between the suspect and the Bulletin Board A post.
The majority opinion attempts to distinguish Falso on grounds that "there, the affidavit contained no allegation that the defendant in fact gained access to a website containing child pornography, nor any allegation that images of child pornography were downloadable from the site." Ante at 329 (internal quotation marks and alterations omitted). According to the majority opinion, the affidavit in this case is materially different because it "alleged that [Defendant]'s IP address accessed a URL" containing child pornography. Id .
But under the majority's reasoning, that difference is irrelevant. The majority opinion holds-and I agree-that to establish probable cause based on a "single click," the affidavit must establish a fair probability that "someone using [Defendant]'s IP address clicked the link knowing that it contained child pornography." Ante at 325. Under that rule, the "access[ing of] a URL" containing child pornography does not, by itself, establish probable cause. Rather, there must be "knowing" accessing of illicit content. Id. at 325-26. As explained above, the affidavit failed to establish that someone using Defendant's IP address navigated to the URL through the Bulletin Board A post, and therefore failed to establish that the person "knowing[ly]" sought to access child pornography.