PUBLISHED
UNITED STATES COURT OF APPEALS FOR THE FOURTH CIRCUIT
No. 24-4328
UNITED STATES OF AMERICA, Plaintiff – Appellee,
v.
ANDREW DAVID KRUEGER, Defendant – Appellant.
Appeal from the United States District Court for the Eastern District of Virginia, at Alexandria. Leonie M. Brinkema, District Judge. (1:23-cr-00170-LMB-1)
Argued: May 6, 2025 Decided: July 25, 2025
Before HARRIS and QUATTLEBAUM, Circuit Judges, and KEENAN, Senior Circuit Judge.
Affirmed by published opinion. Judge Harris wrote the opinion, in which Judge Quattlebaum and Senior Judge Keenan joined.
ARGUED: Cadence Alexandra Mertz, OFFICE OF THE FEDERAL PUBLIC DEFENDER, Alexandria, Virginia, for Appellant. Rachel Lieber Rothberg, UNITED STATES DEPARTMENT OF JUSTICE, Washington, D.C., for Appellee. ON BRIEF: Geremy C. Kamens, Federal Public Defender, Patrick L. Bryant, Assistant Federal Public Defender, OFFICE OF THE FEDERAL PUBLIC DEFENDER, Alexandria, Virginia, for Appellant.
2
PAMELA HARRIS, Circuit Judge:
Andrew David Krueger was convicted of receipt and possession of child sexual abuse material in violation of 18 U.S.C. § 2252 and sentenced to 78 months’ imprisonment. Krueger now appeals his conviction, challenging the district court’s denial of his motion to suppress evidence discovered on his electronic devices pursuant to a search warrant. We agree with the district court that the search of Krueger’s devices did not violate the Fourth Amendment and thus affirm Krueger’s conviction.
I.
This is a complicated case, arising from a multi-year effort by state and federal law-
enforcement authorities to prosecute Krueger for conduct related to child pornography, or what we will call child sexual abuse material. 1 Below, we summarize the facts most relevant to the two Fourth Amendment claims Krueger raises on appeal, both of which involve alleged delays on the part of law enforcement. For context, we outline them here: Krueger argues, first, that evidence of illicit online activity in January 2019 had become “stale” by the time state officials obtained and executed a warrant based on that activity in November 2019; and second, that federal officials unreasonably delayed their application for a warrant to search the contents of devices seized by the state.
1
See United States v. Kuehner, 126 F.4th 319, 322 n.1 (4th Cir. 2025) (referring to “child pornography” as “child sexual abuse material” to “reflect more accurately the abusive and exploitative nature of child pornography”).
3
A.
This case begins in January 2019, when Virginia state police officers observed illicit online activity at Krueger’s residence over a four-day period from January 9 to January 12. The officers first identified an internet protocol (“IP”) address linked to a device downloading and uploading child sexual abuse material over the BitTorrent network, a peer-to-peer file-sharing network. With further investigation, they were able to determine that this online activity was associated with the use of devices in Krueger’s home and nearby cellular towers in Virginia.
The state police relied on this January 2019 online activity in seeking a state warrant to search Krueger’s residence, seize any devices that could be used to store and transmit child sexual abuse material, and search those devices for such material. On November 20, 2019, a state magistrate judge concluded that probable cause existed – based, again, on the four days of illicit activity in January 2019 – and issued a warrant.
The police executed the warrant the following day, on November 21, 2019, and seized several of Krueger’s electronic devices. State officers then transported the devices to a state facility for digital processing and storage. Critically, and jumping ahead a bit, Krueger’s devices remained in state custody in that facility even after state charges were dismissed and during the federal proceedings at issue here.
Before reviewing the devices’ contents, the state police made forensic copies to preserve the integrity of the original evidence. A search of the contents then revealed what the state identified as hundreds of images depicting the sexual abuse of minors. In July
4
2020, the state charged Krueger with multiple counts of possession and distribution of child sexual abuse material in violation of Virginia law.
Krueger moved to suppress the evidence collected from his devices, raising constitutional and statutory claims. The trial court granted the motion on state statutory grounds, see Virginia Code § 19.2-54, because the “affidavit” – the page on which an officer would have attested under oath to his account of the activity observed in January 2019 – was missing from the warrant application. The court did not pass on the substance of the probable cause showing made in the warrant application. After an unavailing appeal, the state dismissed its charges against Krueger in July 2022.
Krueger’s prosecution was then taken up by federal officials. In September 2022, two months after the dismissal of Krueger’s state charges, federal agents obtained copies of Krueger’s devices – still in state custody – from the state forensic lab, and applied for a new warrant in federal court to search the copies. The warrant application was supported by the affidavit of a Virginia police officer acting in his capacity as a member of the federal task force investigating Krueger, recounting the same online activity from January 2019 described in the state warrant application. That was the only basis for probable cause asserted; the affidavit expressly disclaimed reliance on the later-acquired evidence revealed by the state search of the devices.
A federal magistrate judge determined that there was probable cause to examine the contents of Krueger’s seized electronic devices – as they existed and were copied in November 2019, when state officers seized the devices – and issued a search warrant. A forensic review by federal agents again revealed at least 600 images depicting minors
5
engaged in sexually explicit conduct, and showed that Krueger had used BitTorrent – the peer-to-peer network identified by state police in January 2019 – to download such images since as early as 2008. A federal grand jury then indicted Krueger on three counts of receiving and possessing child sexual abuse materials.
B.
That brings us to the suppression motion at issue on appeal. After he was indicted in federal court, Krueger moved to suppress the evidence federal agents had collected from his electronic devices. As outlined above, he asserted two Fourth Amendment claims relevant here, both bearing on the timeline of the state and federal efforts to investigate his conduct.
First, Krueger argued that there was no probable cause to support the federal search warrant for his devices. That warrant, recall, rested on the same illicit online activity from January 2019 documented in the state warrant application. According to Krueger, that evidence became “stale” in the gap between January 2019, when the activity occurred, and November 2019, when state agents seized his devices and memorialized their contents. Whatever might have been found on his electronic devices in January 2019, Krueger contended, there was no probable cause to believe that illegal images would still be discovered on his devices eleven months later.
Second, Krueger argued that federal agents had delayed unreasonably in seeking their search warrant in September 2022. His devices, he pointed out, had been seized from him years earlier, in November 2019. And according to Krueger, that years-long gap
6
between seizure and search warrant was plainly unreasonable under the Fourth Amendment.
After an evidentiary hearing, the district court denied Krueger’s motion to suppress.
The court rejected Krueger’s argument that probable cause based on online activity observed in January 2019 had grown stale by November 2019. The court referred to case law from this circuit approving comparable time gaps in cases involving child sexual abuse material, and noted its experience with similar cases “where people are collecting and keeping the materials” for extended periods of time. J.A. 86. The court also rejected Krueger’s claim of unreasonable delay in the procurement of the federal search warrant in 2022, three years after the seizure of his devices. Noting that Krueger had not requested the timely return of his property from state custody, the court found there was no unreasonable delay that would “justify suppressing the evidence.” J.A. 84–85.
Krueger conditionally pled guilty to the charges against him, reserving his right to appeal the denial of his motion to suppress. The district court imposed a sentence of 78 months’ imprisonment, followed by 15 years of supervised release.
Krueger timely appealed, challenging only the denial of his motion to suppress.
II.
When, as here, a district court denies a motion to suppress, we review the court’s “legal conclusions de novo and its factual findings for clear error, considering the evidence in the light most favorable to the government.” United States v. Kolsuz, 890 F.3d 133, 141–42 (4th Cir. 2018). On the question of probable cause, we apply a deferential standard
7
when a warrant has been issued by a magistrate judge, asking only “whether the judge had a substantial basis for concluding that a search would uncover evidence of wrongdoing.” United States v. Bosyk, 933 F.3d 319, 325 (4th Cir. 2019) (internal quotation marks and citation omitted).
For the reasons given below, we agree with the district court that the search by federal officials of Krueger’s electronic devices pursuant to a federal search warrant did not violate the Fourth Amendment. Accordingly, we affirm Krueger’s conviction.
A.
We begin with probable cause for the federal search of Krueger’s devices and, specifically, Krueger’s claim that probable cause based on his January 2019 online activities had grown stale by the time state officers executed their search warrant in November of that year. To be clear, Krueger does not dispute that his January 2019 activities established probable cause that child sexual abuse material would be found then on his electronic devices. Instead, he argues that by November 2019, eleven months later, there was no longer a reasonable basis for believing incriminating evidence would be found on the devices. Like the district court, we disagree.
It is true that probable cause is time-specific, and that facts said to support probable cause must “justify a finding of probable cause at th[e] time” a warrant issues. See United States v. Ebert, 61 F.4th 394, 401 (4th Cir. 2023) (quoting United States v. McCall, 740 F.2d 1331, 1335–36 (4th Cir. 1984)). But when it comes to child sexual abuse material, as the district court recognized, the consensus among courts, including ours, is that “even a substantial delay” between suspect online activity and the issuance of a search warrant
8
“doesn’t render the underlying information stale.” Bosyk, 933 F.3d at 330; see also, e.g., Ebert, 61 F.4th at 401; United States v. Richardson, 607 F.3d 357, 370 (4th Cir. 2010). Indeed, courts evaluating warrants in such cases “have sustained warrants issued many months, and even years, after the events that gave rise to probable cause.” Bosyk, 933 F.3d at 331.
That is so for two primary reasons. First, there is the “collector” inference – the “widespread view” that collectors of child sexual abuse material value that material highly, so rarely dispose of it and instead “store it for long periods in a secure place, typically in their homes.” Id. at 330 (quoting Richardson, 607 F.3d at 370). Second, there is the fact that “digital media files persist for a long time,” id. at 331, and that even if a defendant deletes a file “from a hard drive or other computer media, a computer expert is still likely to retrieve . . . [it] through scientific examination of the computer,” Richardson, 607 F.3d at 371 (internal quotation marks and citation omitted).
Krueger focuses on the first of these rationales, arguing that no collector inference is warranted in his case. According to Krueger, there is no factual basis for believing he is actually a collector who values (and is thus likely to hoard) child sexual abuse material, rather than someone who encountered such material inadvertently and would have immediately expunged it. For support, he points to the Second Circuit’s decision in United States v. Raymonda, 780 F.3d 105, 115–17 (2015), holding that application of the collector inference must be based on something more than a one-time encounter with a few pages of a website containing links to child sexual abuse material – circumstances “at least equally
9
consistent” with “an innocent user inadvertently stumbling upon a child pornography website, being horrified at what he saw, and promptly closing the window,” id. at 117.
We agree with Krueger’s premise, but not his conclusion. Our court has already approved Raymonda’s general reasoning, agreeing that the “value of [the collector] inference ‘depends on the preliminary finding that the suspect is a person interested in images of child pornography,’” rather than the hypothetical inadvertent stumbler. Bosyk, 933 F.3d at 331 (quoting Raymonda, 780 F.3d at 114). But the facts presented in the warrant application here amply support such a “preliminary finding.” See id. According to the affidavit in support of the warrant application, Krueger’s January 2019 encounters with illicit activity occurred not once on a single afternoon, as in Raymonda, 780 F.3d at 117, but repeatedly, over four days. They included the downloading and uploading, on multiple occasions, of full images of minors engaged in sexually explicit conduct. Cf. Raymonda, 780 F.3d at 117 (noting lack of evidence that defendant ever clicked on a thumbnail link to view a full-sized image). And Krueger’s use of the BitTorrent peer-to- peer network would have required the taking of “elaborate steps to access illegal content,” making it “possible to infer that [he] is a collector . . . actively seeking [] out [images] to satisfy a preexisting predilection.” Bosyk, 933 F.3d at 331 (distinguishing Raymonda); see also United States v. Owens, 18 F.4th 928, 931–32 (7th Cir. 2021) (describing multi-step process for users to interface with BitTorrent network to view full images). On the facts in this affidavit, in other words, the magistrate judge could infer that Krueger was a “person interested in images of child pornography,” Bosyk, 933 F.3d at 331, and therefore likely to collect and retain such images for extended periods of time.
10
Moreover, the collector inference is only one of two reasons why illicit online activity in January 2019 could still give rise to probable cause for a search eleven months later. There also is the fact that even if Krueger did not seek to hoard child sexual abuse material as a collector, and instead tried to delete that material back in January 2019, it still could have been retrieved during an expert forensic search after Krueger’s devices were seized eleven months later. See, e.g., Ebert, 61 F.4th at 401 (explaining that such material “can be retrieved during a digital search even after its ostensible deletion”). Indeed, the affidavit in this case explains in detail the process by which a forensic analysis may be able to recover computer files or their remnants long after they are deleted, or discover indirect evidence bearing on how a computer has been used in the past. And Krueger contests none of this.
In sum, the magistrate judge who issued the federal warrant in this case had a substantial basis – indeed, two substantial bases – for concluding that a search of the contents of Krueger’s devices as of their seizure in November 2019 would uncover evidence of wrongdoing, notwithstanding the eleven months that had elapsed since the illicit activity in January 2019. 2 We thus agree with the district court that the federal
2
The question for the federal magistrate judge, recall, was whether there was probable cause for a search of forensic copies of Krueger’s electronic devices, made when the devices were in state custody after their seizure by state officials in November 2019. If there was probable cause to believe illegal images would be found on Krueger’s devices in November 2019, then there was probable cause to believe the same images would be found when federal agents in 2022 searched the forensic copies that were made to memorialize those contents in November 2019.
11
warrant in this case was supported by probable cause, consistent with the Fourth Amendment.
B.
Krueger’s second argument is that even if the federal search warrant was valid, federal agents waited too long to obtain it. The Supreme Court has held that after seizing an item, police must obtain a search warrant within a reasonable amount of time. See Segura v. United States, 468 U.S. 796, 812 (1984) (“[A] seizure reasonable at its inception because based upon probable cause may become unreasonable as a result of its duration[.]”). Here, Krueger argues, the delay between the seizure of his devices in November 2019 and the federal warrant application in September 2022 – roughly three years – is obviously outside what could be considered reasonable under the Fourth Amendment. And even if we excuse the failure of federal officials to seek a warrant while his state charges were pending, Krueger says, that still leaves a period of months during which federal officers should have but did not seek a search warrant.
It makes no difference here whether we are considering a gap of years or months, because Krueger’s argument fails at the threshold. The Fourth Amendment “unreasonable delay” doctrine protects property interests, and specifically, an individual’s possessory interest in property that belongs to him but has been seized by law enforcement officers. See United States v. Pratt, 915 F.3d 266, 271 (4th Cir. 2019). Even a seizure lawful at its inception – here, the November 2019 seizure of Krueger’s electronic devices – can violate the Fourth Amendment if its duration unreasonably infringes possessory interests. Id. And when property has been seized by law enforcement pending a search, “[t]he longer the
12
police take to seek a warrant, the greater the infringement on the person’s possessory interest will be, for the obvious reason that a longer seizure is a greater infringement [] than a shorter one.” United States v. Burgard, 675 F.3d 1029, 1033 (7th Cir. 2012). That is why the Fourth Amendment requires police officers to diligently pursue a search warrant once they have seized a person’s property. See United States v. Mitchell, 565 F.3d 1347, 1352 (11th Cir. 2009) (“[T]he purpose of securing a search warrant soon after a suspect is dispossessed of [property] is to ensure its prompt return should the search reveal no [] incriminating evidence[.]”). And it is why, as Krueger says, courts generally cabin “reasonable” delays in seeking a warrant to days, not months or years. See, e.g., Burgard, 675 F.3d at 1035 (six-day delay did not extend seizure unreasonably); Mitchell, 565 F.3d at 1352 (three-week delay unreasonably extended seizure); Pratt, 915 F.3d at 272–73 (31- day delay unreasonably extended seizure).
But none of that helps Krueger here, because in this unusual case, the time taken by federal authorities to obtain a federal warrant had no effect on the length of the seizure in question. Krueger’s devices were seized by state police officers pursuant to a state warrant in November 2019, and then retained in state custody throughout both the state and federal phases of these criminal proceedings. Nothing about the federal warrant – allowing a search of copies of the devices’ contents, while the devices themselves remained with the state – had anything to do with the length of time for which Krueger was deprived of a possessory interest in his devices. Krueger has pointed to no record evidence suggesting that the state might have released his property sooner had the federal authorities more promptly sought their warrant. And as the district court referenced, J.A. 84, Krueger never
13
asserted any interest in his property until a year after federal officials had obtained and executed their warrant – and he did so by making inquiries with the state, because it was the state that had seized and still retained his devices.
One way to think about the fundamental disconnect in Krueger’s “unreasonable delay” argument is that he has asserted his claim against the wrong sovereign. The seizure of his property – and hence any undue infringement on his possessory interests in that property – was executed and maintained by the Commonwealth of Virginia, not by the federal government. Any purported “delay” by police officers working in a federal capacity had no effect on the length of the seizure of Krueger’s devices by the state, and thus could not have caused or contributed to an unreasonable seizure of Krueger’s property. Accordingly, Krueger’s “unreasonably delay” claim provides no ground for suppressing evidence collected by federal officials pursuant to an otherwise valid federal warrant.
III.
For the foregoing reasons, we hold that the district court correctly denied Krueger’s suppression motion and affirm Krueger’s conviction.
AFFIRMED