FILED: October 9, 2019

                           UNITED STATES COURT OF APPEALS
                               FOR THE FOURTH CIRCUIT


                                         No. 18-4302
                                   (1:17-cr-00302-LMB-1)


UNITED STATES OF AMERICA,

               Plaintiff – Appellee,

v.

NIKOLAI BOSYK,

               Defendant – Appellant.

------------------------------

ELECTRONIC FRONTIER FOUNDATION,

               Amicus Supporting Appellant.



                                         ORDER


        The court denies the petition for rehearing en banc.

        A requested poll of the court failed to produce a majority of judges in regular active

service and not disqualified who voted in favor of rehearing en banc. Chief Judge Gregory,

Judge Wilkinson, Judge Niemeyer, Judge Motz, Judge King, Judge Agee, Judge Keenan,

Judge Diaz, Judge Floyd, Judge Thacker, Judge Harris, Judge Richardson, Judge
Quattlebaum, and Judge Rushing voted to deny rehearing en banc. Judge Wynn voted to

grant rehearing en banc and filed a separate statement.

       Entered at the direction of Judge Diaz.


                                                 For the Court

                                                 /s/ Patricia S. Connor, Clerk




                                            2
WYNN, Circuit Judge, statement in the denial of rehearing en banc:

       The Government in this matter leads this Court to depart from the wisdom of our

sister circuits and endorse an unsustainable approach to evaluating evolving technology.

At the core of this matter is the Government’s affidavit which states that someone using

Defendant’s IP address was in the wrong place at a certain time. Not at the wrong time—

just at a certain time.

       As I discussed in my dissent, reasoning by analogy depends on relevant similarity.

To many courts, the internet is abstract and the task of learning what a URL is—or what a

dynamic URL is, or what a URL shortener does, and what the implications may be—

represents a specialized undertaking unrelated to legal expertise, that is, something to

approach with a sense of dread. Tools like analogies that promise to reduce a technical

issue to something susceptible to the intuitive logic of the familiar become appealing. And

retrospective confirmation, such as when we can look back and see that an affidavit led to

a computer filled with child pornography, builds trust that the logic that found probable

cause was sound in the first instance. However, legal commentators have raised the alarm

about indiscriminate use of metaphors in the internet context. See, e.g., Mark A. Lemley,

Place and Cyberspace, 91 Calif. L. Rev. 521, 542 (2003) (“The cyberspace as place

metaphor can be valuable . . . [but t]he metaphor will serve its purpose only if we

understand its limitations—the ways in which the Internet is not like the physical world.”).

Sometimes, the preference to avoid taking the internet on its own terms, to avoid learning

new rules and starting from logical scratch, leads us to not question basic assumptions

when we should. This is one of those cases.
                                              3
       I offer a comparison of two analogies to illustrate the problem. Both start with what

seems like a reasonable general metaphor that describes how a human user experiences the

internet. After that point, however, based on the initial choice of metaphor, each analogy

naturally takes a different path, and the two analogies ultimately suggest opposing

conclusions. Both conclusions are “right” according to their analogy’s logic. But by the

time they reach those conclusions, both analogies have become somewhat divorced from

reality and in neither case can we go back and “check our work” without reference to the

technology that we are trying to describe.

       In the first analogy, we begin in a building. This building is the confines of the

internet. We are standing in a room and this room is a section of an internet forum, Bulletin

Board A. We see a door with a sign that advertises child pornography. The door is the

download link URL that was posted on Bulletin Board A. We open that door and encounter

both a cache of child pornography and the Defendant. If we believe the door we used was

the only door to that place—indeed, so long as the number of doors into the room is a

manageable number, or so long as we speculate on the basis of proximity that only places

like Bulletin Board A have doors that lead here—we can reasonably conclude that

Defendant is seeking child pornography.

       In the second analogy, we begin on a field. That field is the vastness of the internet.

The general area where we are standing is Bulletin Board A. We see a sign that points in

a direction and advertises child pornography. That sign is the link posted on Bulletin Board

A. We follow the sign’s instructions and eventually reach a place, where there is a cache

of child pornography on the ground. We also encounter Defendant in the immediate
                                              4
vicinity, but we did not see where he came from. Because there are no walls in this

environment to direct traffic, we cannot reasonably conclude that Defendant, like us,

followed the sign advertising child pornography.

       This second analogy does not seek to explain the internet, rather, it seeks to explain

how a foundational fault in the Government’s logic skewed the Government’s conclusion.

The Government, the magistrate judge, the district court, and the majority in this case read

the affidavit using an inapplicable logic of enclosure.        They assumed limitations—

represented by walls—that do not exist online. That said, the field analogy is also

misleading in its own way. The field’s openness suggests that we can and do see exactly

where a link will take us, which, as the amicus curiae in this case explained, is not the case.

The field analogy also risks spiraling into a detailed and unhelpful geography if used to

explain the role of the File Sharing Site. Every analogy can only go so far. This is why

courts depend on amici curiae and, more importantly, the parties themselves, to explain

technical issues in cases like this one, and to explain them well. See, e.g., In re Application

of U.S. for an Order Directing a Provider of Elec. Commc’n Serv. to Disclose Records to

Gov’t, 

, 306 n.1 (3d Cir. 2010) (thanking a group of amici led by the Electronic

Frontier Foundation for participating in a case involving an ex parte application by the

government and an issue of first impression related to the Stored Communications Act and

cell site location information).

       Examining the affidavit in this case, it is technological error to conclude that “the

records showed that . . . someone using this IP address clicked that same link.” United

States v. Bosyk, 

, 323 (4th Cir. 2019) (emphasis added). Indeed, the affidavit
                                              5
does not make this direct causal allegation. The affidavit represented that some number of

hours before or some number of hours after some anonymous actor posted a certain link

on a certain website, someone using Defendant’s IP address came into contact with some

link that was perhaps found on some website.

       The affidavit does not say that the Defendant’s IP address had ever been associated

with any child pornography activity in the past. The affidavit does not say the person using

Defendant’s IP address actually downloaded any of the password-protected files. The

affidavit does not even say that the person with Defendant’s IP address arrived at the URL

in question after the suspect link was posted on the monitored website—a bar so low that

it is alarming that the affidavit tripped over it. We know from other cases in other circuits

that such facts are relevant to finding probable cause. See, e.g., United States v. Gourde,

(9th Cir. 2006). These kinds of facts, however, are all missing here.

       In the digital age, the ubiquity of link shortening services and randomly generated

URLs renders browsing the Internet a great exercise in trusting strangers. The average

internet user does not—indeed, cannot—know with certainty that all the links they follow

will take them where they expect. The system works because we follow links on faith.

What, then, should a court assume when an affidavit alleges nothing more than that a single

click occurred? Very little, if anything.




                                             6