United States v. Nikolai Bosyk
933 F.3d 319 (2019)
Premium Feature
Subscribe to Lexplug to listen to the Case Podcast.
Rule of Law:
Probable cause to issue a search warrant for a residence exists when an IP address associated with that residence is used to access a link to child pornography on the same day the link is posted with an explicit description on a website dedicated to the distribution of such material.
Facts:
- In September 2015, the Department of Homeland Security (DHS) began investigating 'Bulletin Board A,' an online message board dedicated to child pornography with over 1,500 approved users.
- On November 2, 2015, an unidentified member posted a message on Bulletin Board A's 'Pre-teen Hardcore' section, which graphically described child pornography videos, included thumbnail images of the videos, and provided a URL link and password.
- The content at the URL was hosted on a separate, independent 'File Sharing Site,' which also hosted lawful content but was known to be used by members of Bulletin Board A.
- On the same day, November 2, 2015, at 3:23 p.m., records from the File Sharing Site showed that an IP address was used to download or attempt to download the file content from that specific URL.
- Through a subpoena to a broadband provider, DHS investigators connected the IP address to the home of Nikolai Bosyk.
- The government's warrant application did not specify the exact time on November 2, 2015, that the link was posted to Bulletin Board A.
Procedural Posture:
- In April 2016, the government applied for a warrant to search Nikolai Bosyk's residence, which a magistrate judge issued.
- Government agents executed the warrant and recovered devices containing child pornography.
- Bosyk was indicted in the U.S. District Court on child pornography charges.
- Bosyk filed a motion to suppress the evidence, arguing the warrant lacked probable cause.
- The district court denied the motion to suppress.
- Bosyk entered a conditional guilty plea, reserving his right to appeal the denial of his suppression motion.
- Bosyk, as appellant, appealed the district court's ruling to the U.S. Court of Appeals for the Fourth Circuit; the United States is the appellee.
Premium Content
Subscribe to Lexplug to view the complete brief
You're viewing a preview with Rule of Law, Facts, and Procedural Posture
Issue:
Does probable cause to search a residence for evidence of child pornography exist when an IP address associated with that home is used to access a URL containing child pornography on the same day that the URL was posted with graphic descriptions on a members-only online message board dedicated to child pornography?
Opinions:
Majority - Diaz
Yes. A sufficient nexus to establish probable cause exists when there is close temporal proximity between a link's appearance on a specialized illicit website and its access from a particular IP address. The critical fact is the timing; the IP address associated with Bosyk's home accessed the link on the very same day it was posted with an unequivocal description of its contents on Bulletin Board A. This temporal proximity makes it fairly probable that the user encountered the link on that board, knew its illegal nature, and deliberately clicked it. Probable cause requires only a 'fair probability,' not certainty, and law enforcement is not required to rule out all possible innocent explanations for suspicious facts. The five-month delay between the click and the warrant does not render the information stale because the affidavit established that collectors of child pornography often retain such materials for long periods, and the facts supported an inference that the user was such a collector.
Dissenting - Wynn
No. The warrant was not supported by probable cause because the government's affidavit relied on a series of unsupported inferences and displayed a misunderstanding of internet technology. The affidavit failed to establish the 'critical fact' that the click occurred after the link was posted on Bulletin Board A, as it did not state the time of the post. Furthermore, there are millions of alternative ways a URL can be disseminated online—via email, other websites, or malicious schemes—and the affidavit provided no facts to make it probable that the user encountered the link on Bulletin Board A specifically. A single, naked click of a random-looking URL leading to a general-purpose file-sharing site is insufficient to establish the user's knowledge and intent, and allowing a search on this basis opens the door to general warrants based on accidental or tricked clicks.
Analysis:
This decision clarifies the standard for probable cause in the context of digital evidence, establishing that strong circumstantial evidence, like close temporal proximity, can create a sufficient nexus between an IP address and knowledge of a crime. It lowers the evidentiary bar for law enforcement to obtain warrants based on a 'single click,' without needing direct proof that the suspect was a member of or visited the illicit forum where the link originated. The ruling deepens a judicial split on how to apply traditional Fourth Amendment principles to the unique and complex nature of internet activity, potentially impacting future cases involving online privacy and criminal investigations.
Unlock the full brief for United States v. Nikolai Bosyk