NOT RECOMMENDED FOR PUBLICATION

File Name: 25a0472n.06

No. 25-5158

FILED

UNITED STATES COURT OF APPEALS Oct 17, 2025

FOR THE SIXTH CIRCUIT KELLY L. STEPHENS, Clerk

) UNITED STATES OF AMERICA,

)

Plaintiff-Appellee, ) ON APPEAL FROM THE

) UNITED STATES DISTRICT v. ) COURT FOR THE WESTERN

) DISTRICT OF KENTUCKY JOSHUA WHITE, )

Defendant-Appellant. ) OPINION

) Before: SUTTON, Chief Judge; CLAY, and GIBBONS, Circuit Judges.

CLAY, Circuit Judge. After being convicted of misprision of a felony in violation of 18 U.S.C. § 4, Defendant Joshua White appeals the district court’s denial of his motions to suppress evidence and motion for a Franks hearing. For the reasons set forth below, we AFFIRM the district court’s judgment.

I. BACKGROUND

A. Factual History

On February 8, 2021, John Koski, a Homeland Security Investigations (“HSI”) Special Agent, submitted an affidavit in support of an application for a warrant to search Defendant Joshua White’s residence. The warrant affidavit provided the following facts.

A “user of the Internet account at [Defendant’s residence] has been linked to an online community of individuals who regularly send and receive child pornography via” the target website, which is “a hidden service website that operated on the Tor anonymity network.” Aff. for Warrant Appl., R. 23-1, Page ID #81 (emphasis removed). The Tor network is a computer

-1- No. 25-5158, United States v. White network designed “to facilitate anonymous communication over the Internet.” Id. at 82. To access the Tor network, a user must install Tor software, and then to access a Tor-based website, a user must type a series of sixteen or fifty-six algorithmically generated characters followed by “.onion.” Id. at 82, 84. It “is much more difficult, if not impossible,” to access a Tor-based website, such as the target website, on accident or through regular search techniques. Id. at 88.

The target website was “an active online chat site whose primary purpose was to share and distribute child pornography.” Id. at 84. The registration page on the target website states, “Post links with good photos and videos” depicting “[o]nly GIRLS 5 to 13 years [old].” Id. at 84–85. To pass through the registration page and gain access to the content on the target website, a user must create a “[n]ickname” and password. Aff. for Warrant Appl., R. 23-1, Page ID #84–85. Registered users could upload their own digital images through links on the target website and chat online with other registered users. The target website also listed four links to other Tor-based websites, with descriptions such as “Forum for boy-and girlovers” and “Girls pedo portal.” Id. at 87–88. Law enforcement “accessed and downloaded child pornography files via links that were posted on” the target website. Id. at 88. The affidavit described three images involving child pornography “that were available on the target website.” Id. at 90 (capitalization standardized).

A foreign law enforcement agency (FLA) notified federal law enforcement that an IP address based in the United States “was used to access online child sexual abuse and exploitation material” via the target website on April 11, 2019. Id. at 89. The FLA advised that it had obtained such “information through independent investigation that was lawfully authorized in the FLA’s country pursuant to its national laws,” that the FLA “had not interfered with, accessed, searched or seized any data from any computer in the United States,” and that United States law enforcement “did not participate in the investigative work.” Id. at 90-91.

-2- No. 25-5158, United States v. White

Federal law enforcement confirmed that the IP address identified by the FLA belonged to Defendant. The affidavit submitted that “[t]here is probable cause to believe that a user of the Internet account” at Defendant’s residence accessed or attempted to access the target website “with intent to view child pornography.” Aff. for Warrant Appl., R. 23-1, Page ID #81, 93. The affidavit explained that individuals who access online child pornography “almost always possess and maintain child pornographic material in the privacy and security of their home” and “retain those materials and child erotica for many years.” Id. at 96. The affidavit described, “Some of these individuals also have been found to download, view, and then delete child pornography on their computers or digital devices on a cyclical and repetitive basis.” Id. The affidavit asserted that it provided facts “necessary to establish probable cause to believe that contraband and evidence, fruits, and instrumentalities of violations of 18 U.S.C. § 2252A(a)(5)(B) and (b)(2) (accessing with intent to view child pornography) are presently located at [Defendant’s residence].” Id. at 77–78.

Following the magistrate judge’s issuance of a warrant, “HSI agents seized approximately 29 electronic storage devices” from Defendant’s residence on February 17, 2021, and “made identical forensic copies of those devices.” Government’s Resp., R. 189, Page ID #849; Presentence Investigation Report, R. 298, Page ID #2272. The government’s initial examination of the devices revealed twenty-three images depicting child pornography and multiple internet searches for child pornography. Several devices, however, had encryption software that prevented the government from fully reviewing those devices.

On April 30, 2021, Defendant filed a U.S. Customs Seized Asset Claim Form, requesting the return of his seized devices. HSI received Defendant’s claim on May 17, 2021, returned seventeen seized devices on June 14, 2021, and returned four more devices on February 1, 2022. The government retained the remaining four devices, which “either contained evidence of child

-3- No. 25-5158, United States v. White pornography or contained evidence indicative of accessing child pornography,” along with digital copies of all devices. Government’s Resp., R. 189, Page ID #849. Following an upgrade in forensic technology, HSI “defeated the encryption” on some devices and searched those devices, including on January 2, 2023, when an examination of one device revealed another twenty-eight images of child pornography. Id. at 849–50; Presentence Investigation Report, R. 298, Page ID #2273. HSI continued to search the devices and the digital copies, finding more evidence of child pornography and encryption software.

B. Procedural History

Defendant filed two related motions to suppress evidence, arguing that the government lacked authority to continue searching the devices and digital copies of devices and that the government’s search through Defendant’s devices exceeded the scope of the warrant. Defendant also filed a motion for a hearing pursuant to Franks v. Delaware, 438 U.S. 154 (1978), arguing that the warrant affidavit included material false statements and omissions. The district court denied the motions.

The government charged Defendant with one count of misprision of a felony in violation of 18 U.S.C. § 4, based on his “knowledge of the actual commission of a felony” involving possession of child pornography in violation of 18 U.S.C. § 2252A(a)(5). Superseding Information, R. 286, Page ID #2163. Defendant pleaded guilty to misprision of a felony in violation of 18 U.S.C. § 4, but his plea agreement reserved him the right to appeal the district court’s order denying his suppression and Franks motions. The district court sentenced Defendant to twelve months and one day of imprisonment. Defendant now appeals the district court’s denial of his motion to suppress and motion for a Franks hearing.

-4- No. 25-5158, United States v. White

II. DISCUSSION

A. Motions to Suppress

1. Standard of Review

“Generally, when reviewing the denial of a defendant’s motion to suppress, ‘we review the district court’s findings of fact for clear error and its conclusions of law de novo.’” United States v. Bateman, 945 F.3d 997, 1004–05 (6th Cir. 2019) (quoting United States v. Moorehead, 912 F.3d 963, 966 (6th Cir. 2019)). We assess the evidence “in the light most likely to support the district court’s decision.” Moorehead, 912 F.3d at 966 (quoting United States v. Powell, 847 F.3d 760, 767 (6th Cir. 2017)). A “denial of a motion to suppress will be affirmed on appeal if the district court’s conclusion can be justified for any reason.” Id. (quoting United States v. Pasquarille, 20 F.3d 682, 685 (6th Cir. 1994)).

2. Analysis

The Fourth Amendment protects against “unreasonable searches and seizures.” U.S. Const. amend. IV. As a general rule, to be reasonable under the Fourth Amendment, “a search must be undertaken pursuant to a warrant issued upon a showing of probable cause.” United States v. Malveaux, 350 F.3d 555, 557 (6th Cir. 2003) (quoting Knox Cnty. Educ. Ass’n v. Knox Cnty. Bd. of Educ., 158 F.3d 361, 373 (6th Cir. 1998)). Typically, “evidence obtained in violation of the Fourth Amendment must be excluded.” United States v. Lewis, 81 F.4th 640, 647 (6th Cir. 2023) (citing United States v. Rice, 478 F.3d 704, 711 (6th Cir. 2007)).

a. Scope of the Warrant

At the district court, Defendant requested suppression of “all evidence searched and seized unrelated to the instant investigation and outside the authorization” of the search warrant. Def.’s Suppl. Mot. to Suppress, R. 173, Page ID #749. Defendant argued that the search and seizure of

-5- No. 25-5158, United States v. White his “devices and storage of personal data, dating back dozens of years,” exceeded the scope of the warrant in violation of the Fourth Amendment because the warrant did not describe “violations” or establish “probable cause” relating to events before the alleged incident on April 11, 2019. Id. at 748. On appeal, Defendant concedes that the seizure of his electronics did not exceed the scope of the warrant: “Certainly, it was reasonable for officers to seize media storage devices and computers, tablets, etc., to search [for] evidence of [child pornography].” Appellant’s Br. at 35. Defendant, however, argues that “once officers determined that the devices had not been accessed within a decade of the alleged offense, any further search into them violated the scope of the warrant.” Id.

“A search pursuant to a valid warrant may devolve into an invalid general search if the officers flagrantly disregard the limitations of the search warrant.” United States v. Garcia, 496 F.3d 495, 507 (6th Cir. 2007) (citation and quotations omitted) (cleaned up). “The test for determining if the officers engaged in an impermissible general search is whether their search unreasonably exceeded the scope of the warrant.” Id. (citing Brindley v. Best, 192 F.3d 525, 531 (6th Cir. 1999)) (emphasis removed).

Defendant provides no record citation for the proposition that officers determined that Defendant had not accessed certain devices in over ten years, but even if officers had done so, their search did not exceed the scope of the warrant. Although the warrant affidavit described a link between Defendant’s IP address and the target website on April 11, 2019, the affidavit also provided facts broadly to establish “probable cause to believe that contraband and evidence, fruits, and instrumentalities of violations of 18 U.S.C. § 2252A(a)(5)(B) and (b)(2) (accessing with intent to view child pornography) are presently located at [Defendant’s residence],” without specifying any time limitation. Aff. for Warrant Appl., R. 23-1, Page ID # 77–78. The affidavit stated that

-6- No. 25-5158, United States v. White individuals who access online child pornography “almost always possess and maintain child pornographic material in the privacy and security of their home” and “retain those materials and child erotica for many years.” Id. at 96. The affidavit further stated, “Some of these individuals also have been found to download, view, and then delete child pornography on their computers or digital devices on a cyclical and repetitive basis.” Id. Moreover, the warrant itself did not impose any date requirement for the alleged crime. Rather, the warrant provided that the “items to be seized” included all materials that “constitute evidence of the commission of a criminal offense, contraband, the fruits of crime, or property designed or intended for use or which is or has been used as the means of committing a criminal offense, namely violation of 18 U.S.C. § 2252A(a)(5)(B),” including “[c]omputers or storage media used as a means to commit the violations,” on any date. Attach. B to Warrant, R. 189-1, Page ID #858. The terms of the warrant thus did not limit the government’s search to only the items that Defendant accessed on or after April 11, 2019. This Circuit has also recognized “on multiple occasions” that “child pornography is not a fleeting crime,” and “is generally carried out in the secrecy of the home and over a long period.” United States v. Frechette, 583 F.3d 374, 378 (6th Cir. 2009) (quoting United States v. Paull, 551 F.3d 516, 522 (6th Cir. 2009)). Therefore, in searching for evidence of child pornography, the government did not exceed the scope of the warrant, much less flagrantly and unreasonably so, by reviewing devices that Defendant may not have accessed in the last decade.

Defendant also argues that “once officers did a preliminary search of such devices, and in particular hard drives and other media, and determined that those devices had not been accessed for ten years or longer, any probable cause as to those devices dissipated.” Appellant’s Br. at 35. Even if the officers discovered in their preliminary search that Defendant had not used a device in ten years, however, that new information did not cause probable cause to dissipate. Indeed, the

-7- No. 25-5158, United States v. White government’s preliminary search of Defendant’s devices revealed incriminating evidence of child pornography. The new information that Defendant may not have accessed a certain device in over ten years did not “eliminate the probable cause that existed when the judge issued the warrant,” particularly since the government found incriminating evidence in their preliminary search. See United States v. Sheckles, 996 F.3d 330, 340 (6th Cir. 2021) (“Evidence should not be suppressed if probable cause continued to exist despite the new facts.” (citation omitted)); cf. Hernandez v. Boles, 949 F.3d 251, 259 (6th Cir. 2020) (“[I]nformation acquired from a fruitless search can dissipate probable cause and render a subsequent search illegal.” (citation omitted)).

Accordingly, the district court did not err in holding that the government’s search did not exceed the scope of the warrant in violation of the Fourth Amendment.

b. Continued Searches

Additionally, at the district court, Defendant requested the suppression of “all evidence searched and seized beyond a reasonable date,” arguing that the government’s continued searches of the devices and digital copies of devices violated the Fourth Amendment.1 Def.’s Mot. to Suppress, R. 171, Page ID #721–22.

This Court recognizes a “general rule that a warrant authorizes only one search.” United States v. Keszthelyi, 308 F.3d 557, 568–69 (6th Cir. 2002). However, in United States v. Castro, this Court held that multiple searches of an electronic device may be permissible under the Fourth Amendment: “Officers may conduct a more detailed search of an electronic device after it was properly seized so long as the later search does not exceed the probable cause articulated in the 1 Defendant also argues that the government’s “additional searches likely violated the Civil Asset Forfeiture Reform Act.” Appellant’s Br. at 32. However, Defendant did not raise this issue in either of his motions to suppress. Since Defendant did not raise this issue in his motions, and, under his plea agreement, he waived his right to appeal any issues not included in his motions, Defendant waived this issue on appeal. See United States v. Pirosko, 787 F.3d 358, 371 (6th Cir. 2015) (holding that a defendant “waived his right” to make an argument on appeal that he did not include in his motion to suppress at the district level).

-8- No. 25-5158, United States v. White original warrant and the device remained secured.” 881 F.3d 961, 966 (6th Cir. 2018) (citing United States v. Evers, 669 F.3d 645, 650–52 (6th Cir. 2012)). This Court emphasized, “That is true even if the officers conducted an initial search soon after the device’s seizure but waited months or years to conduct a more intensive search.” Id. (citing United States v. Johnston, 789 F.3d 934, 941–43 (9th Cir. 2015)).

Under Castro, the government’s continued searches of Defendant’s devices and digital copies of devices between 2021 and 2023 did not violate the Fourth Amendment. Defendant does not contest that the devices were properly seized. The government’s initial examination of the seized devices in 2021 revealed incriminating evidence of child pornography and that several devices had encryption software preventing complete review of those devices. The government eventually returned most of the devices to Defendant upon his request, but retained four devices, which “either contained evidence of child pornography or contained evidence indicative of accessing child pornography,” in addition to digital copies of all devices. Government’s Resp., R. 189, Page ID #849. The government continued to search those devices and eventually overcame the encryption on some devices, finding more evidence of child pornography in 2023. Because the devices were properly seized, probable cause had not dissipated, and the devices remained secured, the government’s “more detailed search of an electronic device” did not violate the Fourth Amendment, even though the government “conducted an initial search soon after the device’s seizure but waited months or years to conduct a more intensive search.” See Castro, 881 F.3d at 966.

Defendant argues, “There is no indication in the record that in 2021” the government was “stymied by anything, or that they were waiting for additional assistance,” so they “fully executed the warrant in 2021, and probable cause dissipated.” Appellant’s Br. at 29–30. Yet, the record

-9- No. 25-5158, United States v. White shows that several devices had encryption software that prevented the government from fully reviewing those devices in 2021, and with forensic technology upgrades the government was able to defeat the encryption software in 2023. Moreover, probable cause had not dissipated by 2021, as the government found incriminating evidence of child pornography in their initial review of Defendant’s devices.

Defendant argues that the government failed to act with due diligence in its search between 2021 and 2023. Besides Defendant’s conclusory assertion, however, the record does not demonstrate that the government failed to act with diligence in its search. Moreover, regardless of whether the government in fact acted with diligence, this Court clearly stated in Castro that officers may wait “months or years to conduct a more intensive search” of an electronic device. 881 F.3d at 966.

Defendant also argues that Castro does not apply in this case because “no new information” casts a “new light on the evidence seized” from Defendant. Appellant’s Br. at 32 (quotations omitted). It is true that the Castro Court noted that, sometimes, “law enforcement officers have good reason to revisit previously seized, and still secured, evidence as new information casts new light on the previously seized evidence.” 881 F.3d at 966. Such language, however, did not impose a requirement that new information must always cast a new light on previously seized evidence in order for officers to review it.

The district court thus did not err in concluding that the government’s continued searches of Defendant’s devices did not violate the Fourth Amendment. Accordingly, no Fourth Amendment violation supports suppression of evidence, and the district court properly denied Defendant’s motions to suppress.

- 10 - No. 25-5158, United States v. White

B. Motion for a Franks Hearing

1. Standard of Review

“Whether to hold an evidentiary hearing based upon a challenge to the validity of a search warrant’s affidavit, given alleged misstatements and omissions, is committed to the sound discretion of the district court.” United States v. Young, 847 F.3d 328, 348 (6th Cir. 2017) (citing United States v. Graham, 275 F.3d 490, 505 (6th Cir. 2001)). We evaluate a “district court’s denial of a Franks hearing under the same standard as for the denial of a motion to suppress: the district court’s factual findings are reviewed for clear error and its conclusions of law are reviewed de novo.” Bateman, 945 F.3d at 1007 (citations omitted).

2. Analysis

To be entitled to a Franks hearing, a defendant (1) must make “a substantial preliminary showing that the affiant knowingly and intentionally, or with reckless disregard for the truth, included a false statement or material omission in the affidavit;” and (2) must prove “that the false statement or material omission is necessary to the probable cause finding in the affidavit.” Young, 847 F.3d at 348–49 (quoting Pirosko, 787 F.3d at 369).

“A defendant who challenges the veracity of statements made in an affidavit that formed the basis for a warrant has a heavy burden.” United States v. Bennett, 905 F.2d 931, 934 (6th Cir. 1990). The “affidavit supporting the search warrant” has “a presumption of validity.” Franks v. Delaware, 438 U.S. 154, 171 (1978). The defendant must “first provide a substantial preliminary showing” by alleging that the affiant made a false statement “either knowingly or intentionally, or with reckless disregard for the truth.” United States v. Archibald, 685 F.3d 553, 558 (6th Cir. 2012) (quoting United States v. Mastromatteo, 538 F.3d 535, 545 (6th Cir. 2008)). To demonstrate that an affiant made a statement “with reckless disregard for the truth,” the

- 11 - No. 25-5158, United States v. White defendant must show “that the affiant subjectively entertained serious doubts as to the truth of his or her allegations.” Bateman, 945 F.3d at 1008 (citations and quotations omitted) (cleaned up). The defendant may alternatively allege that the affiant made a material omission, in which case the defendant must meet a “higher standard to invalidate a warrant based on an omission (rather than a false statement).” United States v. Davis, 84 F.4th 672, 682 (6th Cir. 2023) (quotation omitted) (collecting cases). These allegations “must be accompanied by an offer of proof,” including “a statement of supporting reasons,” in addition to “[a]ffidavits or sworn or otherwise reliable statements of witnesses” or a satisfactory explanation of “their absence.” Franks, 438 U.S. at 171. The defendant’s “allegations must be more than conclusory.” Bennett, 905 F.2d at 934. “Only after the defendant makes this showing may the court consider the veracity of the statements in the affidavit or the potential effect of any omitted information.” Archibald, 685 F.3d at 558–59.

In requesting a Franks hearing at the district court, Defendant claimed that the following constituted material false statements and omissions in the warrant affidavit: (1) a statement that Koski “received and reviewed several files depicting child sexual abuse materials that were available on” the target website and provided “still images of the files referenced;” (2) a statement that Defendant “accessed the site;” (3) an omission that Defendant’s “alleged contact with [the target website] was of zero duration indicating such contact could have been in error or by mistake;” and (4) an omission that Defendant did not possess the “requisite log-in name, password,” or “credentials” for the target website.2 Def.’s Mot. for a Franks Hr’g, R. 172, Page 2 On appeal, Defendant additionally argues that “the affidavit also falsely stated that the United States was not involved in the foreign law enforcement’s inquiry” into the target website. Appellant’s Br. at 18. Defendant, however, did not raise this issue in his motion for a Franks hearing. Instead, Defendant discussed this issue in a different motion. See Mot. to Suppress “Fruit of the Poisonous Tree” Evid., R. 178, Page ID #771. Defendant’s plea agreement provides that Defendant “preserves the right to appeal the Order [R. 228] denying Defendant’s motion to suppress [R. 171] and his motion for Franks hearing [R. 172]” and “[n]o other issues are preserved for appeal.” Plea Agreement, R. 289, Page ID #2176 (emphasis added). Under the terms of Defendant’s plea agreement, Defendant “waived his right to

- 12 - No. 25-5158, United States v. White ID #732–734. Defendant stated in his motion, “Affiant knew or should have known (1) images shown to the magistrate judge were not on Target Website, (2) [Defendant] did not access Target Website on the date and time indicated, (3) [Defendant] did not possess requisite log-in name, password [or] credentials and (4) no duration infers no access or possession.” Id. at 734.

Defendant fails to make “a substantial preliminary showing” that Agent Koski knowingly and intentionally, or with reckless disregard for the truth, included false statements and excluded critical information in the affidavit. See Franks, 438 U.S. at 155–56. Defendant offers only bare assertions that a purportedly false statement or omission was intentional and knowing. Defendant does not show that Agent Koski “subjectively entertained serious doubts as to the truth of his allegations,” such that a purportedly false statement or omission was reckless either. See Bateman, 945 F.3d at 1008 (citation modified). Defendant does not support his allegations with any “[a]ffidavits or sworn or otherwise reliable statements of witnesses” or a satisfactory explanation of “their absence.” See Franks, 438 U.S. at 171. Nor does Defendant support his allegations with evidence; Defendant does not offer evidence demonstrating that certain images were not accessible through the target website,3 or that Defendant did not access the website, or that Defendant did not possess log-in credentials for the website, or that Defendant’s contact with the website was of no duration. Defendant instead attacks the sufficiency of the evidence provided by the government, but the burden of proof here lies with Defendant, not the government. See id. Defendant fails to argue” that issue. See United States v. Vanderweele, 545 F. App’x 465, 468–69 (6th Cir. 2013) (holding that, where the defendant’s plea reserved the right to seek appellate review of only one specific motion, the defendant “waived his right” to argue any issue not raised in that motion). 3 Defendant highlights the government’s discovery response that included screenshots of the registration page, chat rules, and chat area on the target website, and claims that these screenshots show that the target website did not contain illicit images. However, the mere fact that the illicit images were not featured in three screenshots of specific portions of the target website does not demonstrate that a person could not access the images through any other portion of the target website. Defendant even concedes that the images “were available via a link from the [target website] at the time the agent accessed them.” Appellant’s Br. at 21.

- 13 - No. 25-5158, United States v. White provide “more than conclusory” allegations. See Bennett, 905 F.2d at 934. We need not “consider the veracity of the statements in the affidavit or the potential effect of any omitted information,” since Defendant fails to make the preliminary showing. Archibald, 685 F.3d at 558–59 (“Without this substantial showing, courts may not make a Franks ruling regarding the veracity of statements made in an affidavit.”). Because Defendant did not meet his “heavy burden,” see Bennett, 905 F.2d at 934, the district court properly denied Defendant’s request for a Franks hearing.

III. CONCLUSION

For the reasons set forth above, this Court AFFIRMS the judgment of the district court.

- 14 -