NOT RECOMMENDED FOR PUBLICATION File Name: 25a0472n.06
No. 25-5158 FILED UNITED STATES COURT OF APPEALS Oct 17, 2025 FOR THE SIXTH CIRCUIT KELLY L. STEPHENS, Clerk
) UNITED STATES OF AMERICA, ) Plaintiff-Appellee, ) ON APPEAL FROM THE ) UNITED STATES DISTRICT v. ) COURT FOR THE WESTERN ) DISTRICT OF KENTUCKY JOSHUA WHITE, ) Defendant-Appellant. ) OPINION )
Before: SUTTON, Chief Judge; CLAY, and GIBBONS, Circuit Judges.
CLAY, Circuit Judge. After being convicted of misprision of a felony in violation of 18
U.S.C. § 4, Defendant Joshua White appeals the district court’s denial of his motions to suppress
evidence and motion for a Franks hearing. For the reasons set forth below, we AFFIRM the
district court’s judgment.
I. BACKGROUND
A. Factual History
On February 8, 2021, John Koski, a Homeland Security Investigations (“HSI”) Special
Agent, submitted an affidavit in support of an application for a warrant to search Defendant Joshua
White’s residence. The warrant affidavit provided the following facts.
A “user of the Internet account at [Defendant’s residence] has been linked to an online
community of individuals who regularly send and receive child pornography via” the target
website, which is “a hidden service website that operated on the Tor anonymity network.” Aff.
for Warrant Appl., R. 23-1, Page ID #81 (emphasis removed). The Tor network is a computer
-1- No. 25-5158, United States v. White
network designed “to facilitate anonymous communication over the Internet.” Id. at 82. To access
the Tor network, a user must install Tor software, and then to access a Tor-based website, a user
must type a series of sixteen or fifty-six algorithmically generated characters followed by “.onion.”
Id. at 82, 84. It “is much more difficult, if not impossible,” to access a Tor-based website, such as
the target website, on accident or through regular search techniques. Id. at 88.
The target website was “an active online chat site whose primary purpose was to share and
distribute child pornography.” Id. at 84. The registration page on the target website states, “Post
links with good photos and videos” depicting “[o]nly GIRLS 5 to 13 years [old].” Id. at 84–85.
To pass through the registration page and gain access to the content on the target website, a user
must create a “[n]ickname” and password. Aff. for Warrant Appl., R. 23-1, Page ID #84–85.
Registered users could upload their own digital images through links on the target website and
chat online with other registered users. The target website also listed four links to other Tor-based
websites, with descriptions such as “Forum for boy-and girlovers” and “Girls pedo portal.” Id. at
87–88. Law enforcement “accessed and downloaded child pornography files via links that were
posted on” the target website. Id. at 88. The affidavit described three images involving child
pornography “that were available on the target website.” Id. at 90 (capitalization standardized).
A foreign law enforcement agency (FLA) notified federal law enforcement that an IP
address based in the United States “was used to access online child sexual abuse and exploitation
material” via the target website on April 11, 2019. Id. at 89. The FLA advised that it had obtained
such “information through independent investigation that was lawfully authorized in the FLA’s
country pursuant to its national laws,” that the FLA “had not interfered with, accessed, searched
or seized any data from any computer in the United States,” and that United States law enforcement
“did not participate in the investigative work.” Id. at 90-91.
-2- No. 25-5158, United States v. White
Federal law enforcement confirmed that the IP address identified by the FLA belonged to
Defendant. The affidavit submitted that “[t]here is probable cause to believe that a user of the
Internet account” at Defendant’s residence accessed or attempted to access the target website “with
intent to view child pornography.” Aff. for Warrant Appl., R. 23-1, Page ID #81, 93. The affidavit
explained that individuals who access online child pornography “almost always possess and
maintain child pornographic material in the privacy and security of their home” and “retain those
materials and child erotica for many years.” Id. at 96. The affidavit described, “Some of these
individuals also have been found to download, view, and then delete child pornography on their
computers or digital devices on a cyclical and repetitive basis.” Id. The affidavit asserted that it
provided facts “necessary to establish probable cause to believe that contraband and evidence,
fruits, and instrumentalities of violations of 18 U.S.C. § 2252A(a)(5)(B) and (b)(2) (accessing with
intent to view child pornography) are presently located at [Defendant’s residence].” Id. at 77–78.
Following the magistrate judge’s issuance of a warrant, “HSI agents seized approximately
29 electronic storage devices” from Defendant’s residence on February 17, 2021, and “made
identical forensic copies of those devices.” Government’s Resp., R. 189, Page ID #849;
Presentence Investigation Report, R. 298, Page ID #2272. The government’s initial examination
of the devices revealed twenty-three images depicting child pornography and multiple internet
searches for child pornography. Several devices, however, had encryption software that prevented
the government from fully reviewing those devices.
On April 30, 2021, Defendant filed a U.S. Customs Seized Asset Claim Form, requesting
the return of his seized devices. HSI received Defendant’s claim on May 17, 2021, returned
seventeen seized devices on June 14, 2021, and returned four more devices on February 1, 2022.
The government retained the remaining four devices, which “either contained evidence of child
-3- No. 25-5158, United States v. White
pornography or contained evidence indicative of accessing child pornography,” along with digital
copies of all devices. Government’s Resp., R. 189, Page ID #849. Following an upgrade in
forensic technology, HSI “defeated the encryption” on some devices and searched those devices,
including on January 2, 2023, when an examination of one device revealed another twenty-eight
images of child pornography. Id. at 849–50; Presentence Investigation Report, R. 298, Page ID
#2273. HSI continued to search the devices and the digital copies, finding more evidence of child
pornography and encryption software.
B. Procedural History
Defendant filed two related motions to suppress evidence, arguing that the government
lacked authority to continue searching the devices and digital copies of devices and that the
government’s search through Defendant’s devices exceeded the scope of the warrant. Defendant
also filed a motion for a hearing pursuant to Franks v. Delaware, 438 U.S. 154 (1978), arguing
that the warrant affidavit included material false statements and omissions. The district court
denied the motions.
The government charged Defendant with one count of misprision of a felony in violation
of 18 U.S.C. § 4, based on his “knowledge of the actual commission of a felony” involving
possession of child pornography in violation of 18 U.S.C. § 2252A(a)(5). Superseding
Information, R. 286, Page ID #2163. Defendant pleaded guilty to misprision of a felony in
violation of 18 U.S.C. § 4, but his plea agreement reserved him the right to appeal the district
court’s order denying his suppression and Franks motions. The district court sentenced Defendant
to twelve months and one day of imprisonment. Defendant now appeals the district court’s denial
of his motion to suppress and motion for a Franks hearing.
-4- No. 25-5158, United States v. White
II. DISCUSSION
A. Motions to Suppress
1. Standard of Review
“Generally, when reviewing the denial of a defendant’s motion to suppress, ‘we review the
district court’s findings of fact for clear error and its conclusions of law de novo.’” United States
v. Bateman, 945 F.3d 997, 1004–05 (6th Cir. 2019) (quoting United States v. Moorehead, 912 F.3d
963, 966 (6th Cir. 2019)). We assess the evidence “in the light most likely to support the district
court’s decision.” Moorehead, 912 F.3d at 966 (quoting United States v. Powell, 847 F.3d 760,
767 (6th Cir. 2017)). A “denial of a motion to suppress will be affirmed on appeal if the district
court’s conclusion can be justified for any reason.” Id. (quoting United States v. Pasquarille,
20 F.3d 682, 685 (6th Cir. 1994)).
2. Analysis
The Fourth Amendment protects against “unreasonable searches and seizures.” U.S.
Const. amend. IV. As a general rule, to be reasonable under the Fourth Amendment, “a search
must be undertaken pursuant to a warrant issued upon a showing of probable cause.” United States
v. Malveaux, 350 F.3d 555, 557 (6th Cir. 2003) (quoting Knox Cnty. Educ. Ass’n v. Knox Cnty.
Bd. of Educ., 158 F.3d 361, 373 (6th Cir. 1998)). Typically, “evidence obtained in violation of the
Fourth Amendment must be excluded.” United States v. Lewis, 81 F.4th 640, 647 (6th Cir. 2023)
(citing United States v. Rice, 478 F.3d 704, 711 (6th Cir. 2007)).
a. Scope of the Warrant
At the district court, Defendant requested suppression of “all evidence searched and seized
unrelated to the instant investigation and outside the authorization” of the search warrant. Def.’s
Suppl. Mot. to Suppress, R. 173, Page ID #749. Defendant argued that the search and seizure of
-5- No. 25-5158, United States v. White
his “devices and storage of personal data, dating back dozens of years,” exceeded the scope of the
warrant in violation of the Fourth Amendment because the warrant did not describe “violations”
or establish “probable cause” relating to events before the alleged incident on April 11, 2019. Id.
at 748. On appeal, Defendant concedes that the seizure of his electronics did not exceed the scope
of the warrant: “Certainly, it was reasonable for officers to seize media storage devices and
computers, tablets, etc., to search [for] evidence of [child pornography].” Appellant’s Br. at 35.
Defendant, however, argues that “once officers determined that the devices had not been accessed
within a decade of the alleged offense, any further search into them violated the scope of the
warrant.” Id.
“A search pursuant to a valid warrant may devolve into an invalid general search if the
officers flagrantly disregard the limitations of the search warrant.” United States v. Garcia,
496 F.3d 495, 507 (6th Cir. 2007) (citation and quotations omitted) (cleaned up). “The test for
determining if the officers engaged in an impermissible general search is whether their search
unreasonably exceeded the scope of the warrant.” Id. (citing Brindley v. Best, 192 F.3d 525,
531 (6th Cir. 1999)) (emphasis removed).
Defendant provides no record citation for the proposition that officers determined that
Defendant had not accessed certain devices in over ten years, but even if officers had done so, their
search did not exceed the scope of the warrant. Although the warrant affidavit described a link
between Defendant’s IP address and the target website on April 11, 2019, the affidavit also
provided facts broadly to establish “probable cause to believe that contraband and evidence, fruits,
and instrumentalities of violations of 18 U.S.C. § 2252A(a)(5)(B) and (b)(2) (accessing with intent
to view child pornography) are presently located at [Defendant’s residence],” without specifying
any time limitation. Aff. for Warrant Appl., R. 23-1, Page ID # 77–78. The affidavit stated that
-6- No. 25-5158, United States v. White
individuals who access online child pornography “almost always possess and maintain child
pornographic material in the privacy and security of their home” and “retain those materials and
child erotica for many years.” Id. at 96. The affidavit further stated, “Some of these individuals
also have been found to download, view, and then delete child pornography on their computers or
digital devices on a cyclical and repetitive basis.” Id. Moreover, the warrant itself did not impose
any date requirement for the alleged crime. Rather, the warrant provided that the “items to be
seized” included all materials that “constitute evidence of the commission of a criminal offense,
contraband, the fruits of crime, or property designed or intended for use or which is or has
been used as the means of committing a criminal offense, namely violation of 18 U.S.C.
§ 2252A(a)(5)(B),” including “[c]omputers or storage media used as a means to commit the
violations,” on any date. Attach. B to Warrant, R. 189-1, Page ID #858. The terms of the warrant
thus did not limit the government’s search to only the items that Defendant accessed on or after
April 11, 2019. This Circuit has also recognized “on multiple occasions” that “child pornography
is not a fleeting crime,” and “is generally carried out in the secrecy of the home and over a long
period.” United States v. Frechette, 583 F.3d 374, 378 (6th Cir. 2009) (quoting United States v.
Paull, 551 F.3d 516, 522 (6th Cir. 2009)). Therefore, in searching for evidence of child
pornography, the government did not exceed the scope of the warrant, much less flagrantly and
unreasonably so, by reviewing devices that Defendant may not have accessed in the last decade.
Defendant also argues that “once officers did a preliminary search of such devices, and in
particular hard drives and other media, and determined that those devices had not been accessed
for ten years or longer, any probable cause as to those devices dissipated.” Appellant’s Br. at 35.
Even if the officers discovered in their preliminary search that Defendant had not used a device in
ten years, however, that new information did not cause probable cause to dissipate. Indeed, the
-7- No. 25-5158, United States v. White
government’s preliminary search of Defendant’s devices revealed incriminating evidence of child
pornography. The new information that Defendant may not have accessed a certain device in over
ten years did not “eliminate the probable cause that existed when the judge issued the warrant,”
particularly since the government found incriminating evidence in their preliminary search. See
United States v. Sheckles, 996 F.3d 330, 340 (6th Cir. 2021) (“Evidence should not be suppressed
if probable cause continued to exist despite the new facts.” (citation omitted)); cf. Hernandez
v. Boles, 949 F.3d 251, 259 (6th Cir. 2020) (“[I]nformation acquired from a fruitless search can
dissipate probable cause and render a subsequent search illegal.” (citation omitted)).
Accordingly, the district court did not err in holding that the government’s search did not
exceed the scope of the warrant in violation of the Fourth Amendment.
b. Continued Searches
Additionally, at the district court, Defendant requested the suppression of “all evidence
searched and seized beyond a reasonable date,” arguing that the government’s continued searches
of the devices and digital copies of devices violated the Fourth Amendment.1 Def.’s Mot. to
Suppress, R. 171, Page ID #721–22.
This Court recognizes a “general rule that a warrant authorizes only one search.” United
States v. Keszthelyi, 308 F.3d 557, 568–69 (6th Cir. 2002). However, in United States v. Castro,
this Court held that multiple searches of an electronic device may be permissible under the Fourth
Amendment: “Officers may conduct a more detailed search of an electronic device after it was
properly seized so long as the later search does not exceed the probable cause articulated in the
1 Defendant also argues that the government’s “additional searches likely violated the Civil Asset Forfeiture Reform Act.” Appellant’s Br. at 32. However, Defendant did not raise this issue in either of his motions to suppress. Since Defendant did not raise this issue in his motions, and, under his plea agreement, he waived his right to appeal any issues not included in his motions, Defendant waived this issue on appeal. See United States v. Pirosko, 787 F.3d 358, 371 (6th Cir. 2015) (holding that a defendant “waived his right” to make an argument on appeal that he did not include in his motion to suppress at the district level).
-8- No. 25-5158, United States v. White
original warrant and the device remained secured.” 881 F.3d 961, 966 (6th Cir. 2018) (citing
United States v. Evers, 669 F.3d 645, 650–52 (6th Cir. 2012)). This Court emphasized, “That is
true even if the officers conducted an initial search soon after the device’s seizure but waited
months or years to conduct a more intensive search.” Id. (citing United States v. Johnston,
789 F.3d 934, 941–43 (9th Cir. 2015)).
Under Castro, the government’s continued searches of Defendant’s devices and digital
copies of devices between 2021 and 2023 did not violate the Fourth Amendment. Defendant does
not contest that the devices were properly seized. The government’s initial examination of the
seized devices in 2021 revealed incriminating evidence of child pornography and that several
devices had encryption software preventing complete review of those devices. The government
eventually returned most of the devices to Defendant upon his request, but retained four devices,
which “either contained evidence of child pornography or contained evidence indicative of
accessing child pornography,” in addition to digital copies of all devices. Government’s Resp.,
R. 189, Page ID #849. The government continued to search those devices and eventually
overcame the encryption on some devices, finding more evidence of child pornography in 2023.
Because the devices were properly seized, probable cause had not dissipated, and the devices
remained secured, the government’s “more detailed search of an electronic device” did not violate
the Fourth Amendment, even though the government “conducted an initial search soon after the
device’s seizure but waited months or years to conduct a more intensive search.” See Castro,
881 F.3d at 966.
Defendant argues, “There is no indication in the record that in 2021” the government was
“stymied by anything, or that they were waiting for additional assistance,” so they “fully executed
the warrant in 2021, and probable cause dissipated.” Appellant’s Br. at 29–30. Yet, the record
-9- No. 25-5158, United States v. White
shows that several devices had encryption software that prevented the government from fully
reviewing those devices in 2021, and with forensic technology upgrades the government was able
to defeat the encryption software in 2023. Moreover, probable cause had not dissipated by 2021,
as the government found incriminating evidence of child pornography in their initial review of
Defendant’s devices.
Defendant argues that the government failed to act with due diligence in its search between
2021 and 2023. Besides Defendant’s conclusory assertion, however, the record does not
demonstrate that the government failed to act with diligence in its search. Moreover, regardless
of whether the government in fact acted with diligence, this Court clearly stated in Castro that
officers may wait “months or years to conduct a more intensive search” of an electronic device.
Defendant also argues that Castro does not apply in this case because “no new information”
casts a “new light on the evidence seized” from Defendant. Appellant’s Br. at 32 (quotations
omitted). It is true that the Castro Court noted that, sometimes, “law enforcement officers have
good reason to revisit previously seized, and still secured, evidence as new information casts new
light on the previously seized evidence.” 881 F.3d at 966. Such language, however, did not impose
a requirement that new information must always cast a new light on previously seized evidence in
order for officers to review it.
The district court thus did not err in concluding that the government’s continued searches
of Defendant’s devices did not violate the Fourth Amendment. Accordingly, no Fourth
Amendment violation supports suppression of evidence, and the district court properly denied
Defendant’s motions to suppress.
- 10 - No. 25-5158, United States v. White
B. Motion for a Franks Hearing
“Whether to hold an evidentiary hearing based upon a challenge to the validity of a search
warrant’s affidavit, given alleged misstatements and omissions, is committed to the sound
discretion of the district court.” United States v. Young, 847 F.3d 328, 348 (6th Cir. 2017) (citing
United States v. Graham, 275 F.3d 490, 505 (6th Cir. 2001)). We evaluate a “district court’s denial
of a Franks hearing under the same standard as for the denial of a motion to suppress: the district
court’s factual findings are reviewed for clear error and its conclusions of law are reviewed de
novo.” Bateman, 945 F.3d at 1007 (citations omitted).
To be entitled to a Franks hearing, a defendant (1) must make “a substantial preliminary
showing that the affiant knowingly and intentionally, or with reckless disregard for the truth,
included a false statement or material omission in the affidavit;” and (2) must prove “that the false
statement or material omission is necessary to the probable cause finding in the affidavit.” Young,
847 F.3d at 348–49 (quoting Pirosko, 787 F.3d at 369).
“A defendant who challenges the veracity of statements made in an affidavit that formed
the basis for a warrant has a heavy burden.” United States v. Bennett, 905 F.2d 931, 934 (6th Cir.
1990). The “affidavit supporting the search warrant” has “a presumption of validity.” Franks
v. Delaware, 438 U.S. 154, 171 (1978). The defendant must “first provide a substantial
preliminary showing” by alleging that the affiant made a false statement “either knowingly or
intentionally, or with reckless disregard for the truth.” United States v. Archibald, 685 F.3d 553,
558 (6th Cir. 2012) (quoting United States v. Mastromatteo, 538 F.3d 535, 545 (6th Cir. 2008)).
To demonstrate that an affiant made a statement “with reckless disregard for the truth,” the
- 11 - No. 25-5158, United States v. White
defendant must show “that the affiant subjectively entertained serious doubts as to the truth of his
or her allegations.” Bateman, 945 F.3d at 1008 (citations and quotations omitted) (cleaned up).
The defendant may alternatively allege that the affiant made a material omission, in which case
the defendant must meet a “higher standard to invalidate a warrant based on an omission (rather
than a false statement).” United States v. Davis, 84 F.4th 672, 682 (6th Cir. 2023) (quotation
omitted) (collecting cases). These allegations “must be accompanied by an offer of proof,”
including “a statement of supporting reasons,” in addition to “[a]ffidavits or sworn or otherwise
reliable statements of witnesses” or a satisfactory explanation of “their absence.” Franks, 438 U.S.
at 171. The defendant’s “allegations must be more than conclusory.” Bennett, 905 F.2d at 934.
“Only after the defendant makes this showing may the court consider the veracity of the statements
in the affidavit or the potential effect of any omitted information.” Archibald, 685 F.3d at 558–59.
In requesting a Franks hearing at the district court, Defendant claimed that the following
constituted material false statements and omissions in the warrant affidavit: (1) a statement that
Koski “received and reviewed several files depicting child sexual abuse materials that were
available on” the target website and provided “still images of the files referenced;” (2) a statement
that Defendant “accessed the site;” (3) an omission that Defendant’s “alleged contact with [the
target website] was of zero duration indicating such contact could have been in error or by
mistake;” and (4) an omission that Defendant did not possess the “requisite log-in name,
password,” or “credentials” for the target website.2 Def.’s Mot. for a Franks Hr’g, R. 172, Page
2 On appeal, Defendant additionally argues that “the affidavit also falsely stated that the United States was not involved in the foreign law enforcement’s inquiry” into the target website. Appellant’s Br. at 18. Defendant, however, did not raise this issue in his motion for a Franks hearing. Instead, Defendant discussed this issue in a different motion. See Mot. to Suppress “Fruit of the Poisonous Tree” Evid., R. 178, Page ID #771. Defendant’s plea agreement provides that Defendant “preserves the right to appeal the Order [R. 228] denying Defendant’s motion to suppress [R. 171] and his motion for Franks hearing [R. 172]” and “[n]o other issues are preserved for appeal.” Plea Agreement, R. 289, Page ID #2176 (emphasis added). Under the terms of Defendant’s plea agreement, Defendant “waived his right to
- 12 - No. 25-5158, United States v. White
ID #732–734. Defendant stated in his motion, “Affiant knew or should have known (1) images
shown to the magistrate judge were not on Target Website, (2) [Defendant] did not access Target
Website on the date and time indicated, (3) [Defendant] did not possess requisite log-in name,
password [or] credentials and (4) no duration infers no access or possession.” Id. at 734.
Defendant fails to make “a substantial preliminary showing” that Agent Koski knowingly
and intentionally, or with reckless disregard for the truth, included false statements and excluded
critical information in the affidavit. See Franks, 438 U.S. at 155–56. Defendant offers only bare
assertions that a purportedly false statement or omission was intentional and knowing. Defendant
does not show that Agent Koski “subjectively entertained serious doubts as to the truth of his
allegations,” such that a purportedly false statement or omission was reckless either. See Bateman,
945 F.3d at 1008 (citation modified). Defendant does not support his allegations with any
“[a]ffidavits or sworn or otherwise reliable statements of witnesses” or a satisfactory explanation
of “their absence.” See Franks, 438 U.S. at 171. Nor does Defendant support his allegations with
evidence; Defendant does not offer evidence demonstrating that certain images were not accessible
through the target website,3 or that Defendant did not access the website, or that Defendant did not
possess log-in credentials for the website, or that Defendant’s contact with the website was of no
duration. Defendant instead attacks the sufficiency of the evidence provided by the government,
but the burden of proof here lies with Defendant, not the government. See id. Defendant fails to
argue” that issue. See United States v. Vanderweele, 545 F. App’x 465, 468–69 (6th Cir. 2013) (holding that, where the defendant’s plea reserved the right to seek appellate review of only one specific motion, the defendant “waived his right” to argue any issue not raised in that motion). 3 Defendant highlights the government’s discovery response that included screenshots of the registration page, chat rules, and chat area on the target website, and claims that these screenshots show that the target website did not contain illicit images. However, the mere fact that the illicit images were not featured in three screenshots of specific portions of the target website does not demonstrate that a person could not access the images through any other portion of the target website. Defendant even concedes that the images “were available via a link from the [target website] at the time the agent accessed them.” Appellant’s Br. at 21.
- 13 - No. 25-5158, United States v. White
provide “more than conclusory” allegations. See Bennett, 905 F.2d at 934. We need not “consider
the veracity of the statements in the affidavit or the potential effect of any omitted information,”
since Defendant fails to make the preliminary showing. Archibald, 685 F.3d at 558–59 (“Without
this substantial showing, courts may not make a Franks ruling regarding the veracity of statements
made in an affidavit.”). Because Defendant did not meet his “heavy burden,” see Bennett, 905 F.2d
at 934, the district court properly denied Defendant’s request for a Franks hearing.
III. CONCLUSION
For the reasons set forth above, this Court AFFIRMS the judgment of the district court.
- 14 -