USA v. Williams

1
IN THE UNITED STATES DISTRICT COURT
FOR THE WESTERN DISTRICT OF NORTH CAROLINA
ASHEVILLE DIVISION
1:23-cr-83-MR-WCM
UNITED STATES OF AMERICA )
)
v. ) MEMORANDUM AND
) RECOMMENDATION
SEAN CHRISTOPHER WILLIAMS )
)
Defendant. )
______________________________ )
This matter is before the Court on Defendant’s Motion to Suppress (Doc.
24), which has been referred to the undersigned pursuant to 28 U.S.C. § 636
for the entry of a recommendation.
I. Relevant Procedural Background
On December 5, 2023, a Bill of Indictment was filed charging Defendant
with child pornography offenses pursuant to 18 U.S.C. §§ 2252A(a)(1) and
2252A(a)(5)(B). Doc. 1.
Defendant made an initial appearance on February 25, 2025 and was
arraigned on February 28, 2025.
On November 17, 2025, Defendant filed the Motion to Suppress seeking
the suppression of three categories of evidence: 1) certain verbal statements
made by Defendant, 2) evidence obtained from electronic devices pursuant to
a state search warrant related to a narcotics investigation (the “Narcotics
Warrant,” Doc. 24-1), and 3) evidence obtained from electronic devices
Case 1:23-cr-00083-MR-WCM Document 33 Filed 02/10/26 Page 1 of 22

2
pursuant to a state search warrant related to child sexual abuse material
(“CSAM”) (the “CSAM Warrant,” Doc. 24-2).1
The Government has responded and Defendant has replied, Docs. 27, 30,
and a status conference was conducted on January 9, 2026.
II. Evidentiary Hearing
“[A]n evidentiary hearing is not always required to resolve a motion to
suppress.” United States v. Griffin, 811 F. App’x 815, 816 (4th Cir. 2020) (per
curium) (citing Fed. R. Crim. P. 12(c)).
During the status conference, the parties agreed that, in light of
information in the Government’s response, the Motion to Suppress is moot to
the extent it seeks the suppression of Defendant’s verbal statements.2 Since
Defendant’s remaining arguments pertain to the validity of the Narcotics
Warrant and the CSAM Warrant, an evidentiary hearing is not necessary. See
United States v. Wilhelm, 80 F.3d 116, 118 (4th Cir. 1996) (“When reviewing
the probable cause supporting a warrant, a reviewing court must consider only
the information presented to the magistrate who issued the warrant”); United
States v. Reed, No. 11-20288, 2011 WL 5408361, at *1 (E.D. Mich. Nov. 7, 2011)
1 The Motion to Suppress notes that a federal search warrant was subsequently
issued. Doc. 24 at 7. The Motion to Suppress does not challenge that warrant.
2 The parties also confirmed that, while the undersigned issued the federal warrant
referenced by the Motion to Suppress, the parties do not object to this Court
considering the Motion to Suppress.
Case 1:23-cr-00083-MR-WCM Document 33 Filed 02/10/26 Page 2 of 22

3
(“As the Court's consideration of Defendant's Motion requires only an
examination of the information contained within the ‘four corners’ of the search
warrant affidavit, oral argument on the Motion is unnecessary and no hearing
shall be held”); United States v. Francois, 715 F.3d 21, 32 (1st Cir. 2013) (“[A]
hearing is required only if the movant makes a sufficient threshold showing
that material facts are in doubt or dispute, and that such facts cannot reliably
be resolved on a paper record.”).
III. Factual Background3
A. The Narcotics Warrant
Officer J. Stoller of the Western Carolina University Police Department
(“WCUPD”) submitted an application and supporting affidavit (the “Narcotics
Warrant Application”) for the Narcotics Warrant, which included the following
information:
On April 29, 2023, at about 2:13am, WCUPD officers encountered a 2005
Subaru Baja (the “Vehicle”) that was parked in a closed parking lot. The
Vehicle was running and was parked in a handicapped parking space without
a handicap placard, and the driver’s side window was down. Doc. 24-1 at 5.
3 The parties’ briefing appears to include some facts that are not stated in the
materials that were submitted to the state judicial authorities when law enforcement
was seeking the Narcotics Warrant and the CSAM Warrant. As the validity of those
warrants are the remaining issues raised by the Motion to Suppress, the facts stated
in this Memorandum are limited to those presented to the state judicial authorities.
Case 1:23-cr-00083-MR-WCM Document 33 Filed 02/10/26 Page 3 of 22

4
Officer Charles Gooden approached the Vehicle, and observed that an
individual, who was later identified as Defendant, appeared to be asleep in the
driver’s seat. Officer Gooden also observed a small silver metal case in the
passenger seat with a metal cup that appeared to contain some sort of white
substance and a razor blade.
Officer Gooden woke Defendant, who “sat up so quickly when he saw that
it was the police, he hit the horn.” Id. Defendant became nervous, began
reaching around, and appeared to be trying to conceal something.
Officer Gooden then asked Defendant to step out of the Vehicle.
Defendant asked if he could stay inside the Vehicle, but Officer Gooden ordered
Defendant out of the Vehicle. Defendant stated “please don’t do this” several
times and kept putting his hands into his pockets despite being told not to do
so.
Officer Gooden then handcuffed Defendant. As he was being handcuffed,
Defendant stated that there were drugs in the Vehicle. During a search of
Defendant’s person, a glass pipe with residue was found in Defendant’s front
left pocket.
The Vehicle was then searched, and 411 grams of methamphetamine,
216 grams of cocaine, $100,831.00 in cash, and several sets of scales and
Case 1:23-cr-00083-MR-WCM Document 33 Filed 02/10/26 Page 4 of 22

5
ledgers4 were discovered and seized. Id. Additionally, “many hard drives,
computers, and thumb drives” were observed in the Vehicle, although only 2
hard drives, 6 thumb drives, and 1 SD card were seized. Id.
In the Narcotics Warrant Application, Officer Stoller attested, based on
his training and experience, that it is common for individuals “using, selling,
or distributing illegal narcotics to keep ledgers, record [sic], photographs, and
other information pertaining to [“trafficking methamphetamine, cocaine”] on
hard drives, thumb drives, computers, and other electronic devices….” Id. at 6.
The Narcotics Warrant was issued by a state magistrate on May 3, 2023
and authorized the search of 23 electronic devices including hard drives, thumb
drives, an SD card, and computers for evidence of drug related crimes. Id. at 4.
The Narcotics Warrant was executed on May 8, 2023. Id. at 1.
B. The CSAM Warrant
Detective Steven D. Lillard submitted an application and supporting
affidavit (the “CSAM Warrant Application”) for the CSAM Warrant, which
included the following information:
On May 8, 2023, Detective Lillard was processing one of the thumb
drives (the “Thumb Drive”) as part of the search authorized by the Narcotics
4 These ledgers were not described in further detail but since they were found in a
“silver bag” along with a large amount of cash and “several sets of scales,” the
undersigned presumes they were in paper form. Doc. 24-1 at 5.
Case 1:23-cr-00083-MR-WCM Document 33 Filed 02/10/26 Page 5 of 22

6
Warrant. Doc. 24-2 at 8. While doing so, Detective Lillard discovered a text file
entitled “backup changes.txt” that contained the following statement: “i sorted
the random pics into folders in –Backup June 17/sorted cp may 24 ams girls is
in LS folder in D drive.” Id. Based on his training and experience, Detective
Lillard believed the term “cp” referred to child pornography and that the
initials “LS” were associated with a series of child pornographic materials.
Detective Lillard also discovered three other text files that contained
what appeared to be dark web links that could be accessed via a special browser
as a means of sharing child pornography.
Detective Lillard reviewed the file path associated with the four text
files. It appeared that all four files were in a main folder titled “cp” and that
the folder structure of the thumb drive included other names associated with
CSAM. Id. at 9.5 Detective Lillard then paused his investigation to prepare the
CSAM Warrant Application.
Further in the CSAM Warrant Application, Detective Lillard explained,
based upon his “training and experience investigating child sexual abuse and
exploitation crimes,” that it was “common for collectors of child pornographic
materials to organize their collection into a custom folder structure” similar to
that found on the Thumb Drive and that it was “plausible that similar
5 The CSAM Warrant Application included a screenshot of the file tree and the file
names, some of which were explicit. See Doc. 24-2 at 9.
Case 1:23-cr-00083-MR-WCM Document 33 Filed 02/10/26 Page 6 of 22

7
structures and content would be found on the existing devices” that were in
Defendant’s possession. Id. at 10.
The CSAM Warrant was issued and executed on May 9, 2023 and
authorized the search of the same electronic devices for evidence of the North
Carolina crime of third degree sexual exploitation of a minor. Id. at 2, 10.
IV. Discussion
A. The Narcotics Warrant
Defendant argues that the Narcotics Warrant Application failed to
establish a sufficient nexus between the seized devices and evidence of drug
related offenses, and that the Narcotics Warrant was overbroad. Doc. 24 at 1.
1. Nexus
The Fourth Circuit has explained that “a judicial officer issuing a search
warrant must simply make a practical, commonsense determination—based
on the totality of the circumstances revealed in the affidavit—of whether there
is a substantial likelihood that evidence of a crime will be found in a particular
place.” United States v. Allen, 631 F.3d 164, 173 (4th Cir. 2011). “‘[T]he nexus
between the place to be searched and the items to be seized may be established
by the nature of the item and the normal inferences of where one would likely
keep such evidence.’” Id. (quoting United States v. Richardson, 607 F.3d 357,
371 (4th Cir. 2010)); see also United States v. Wienke, 733 F. App’x 65, 69 (4th
Cir. 2018) (“Whether such a nexus exists turns on ‘the nature of the item and
Case 1:23-cr-00083-MR-WCM Document 33 Filed 02/10/26 Page 7 of 22

8
the
normal inferences of where one would likely keep such evidence.’”) (quoting
United States v. Anderson, 851 F.2d 727, 729 (4th Cir. 1988) (emphasis in
original)); United States v. Orozco, 41 F.4th 403, 410 (4th Cir. 2022) (“Indeed,
a magic-words requirement for warrant affidavits runs headlong into the
Supreme Court's clear instruction that we should not add ‘[t]echnical
requirements of elaborate specificity’ into the warrant-application process, and
‘should not invalidate warrants by interpreting affidavits in a hypertechnical,
rather than commonsense, manner.’ The affidavit … need not directly link the
evidence sought with the place to be searched.”) (internal citations omitted)).
Here, Defendant argues that although the Narcotics Warrant
Application reasonably suggested that Defendant was “involved with drugs,”
it lacked sufficient facts to connect Defendant’s drug activity to any particular
electronic device.
Whether the Narcotics Warrant Application established a sufficient
nexus between Defendant’s alleged drug activity and the electronic devices
found in the Vehicle presents a close call.
The Narcotics Warrant Application explained that officers had
discovered indicia of significant drug trafficking—including 411 grams of
methamphetamine, 216 grams of cocaine, $100,831.00 in cash, and several sets
of scales and ledgers—in the Vehicle in which Defendant had been sleeping.
And the Fourth Circuit has stated that “crimes like drug trafficking” involve
Case 1:23-cr-00083-MR-WCM Document 33 Filed 02/10/26 Page 8 of 22

9
“coordination” such that it “may be reasonable to believe that [the suspect’s]
cellphone will contain evidence of his crimes.” United States v. Henderson, 136
F.4th 527, 532-33 (4th Cir. 2025) (internal citations and quotation marks
omitted); United States v. Davis, 94 F.4th 310, 320 (4th Cir. 2024) (“Here, given
the substantial quantities of controlled substances that were found on [the
defendant’s] person and in his bedroom, the extent to which they were
packaged for distribution, the evidence of drug trafficking found elsewhere in
the common areas of the residence, and the known and obvious connection
between drug trafficking and the use of cell phones, the officers executing the
search had probable cause to associate the [phone] with criminal activity.”)
(internal citations and quotation marks omitted).
Yet, the Narcotics Warrant Application did not include any specific facts
to indicate that Defendant had used a cell phone—let alone other electronic
devices—in connection with the drug crimes under investigation.
Next, an issuing judicial official is entitled to rely on an officer’s training
and experience when making a probable cause determination with respect to
a search warrant application, see United States v. Darnell Williams, 548 F.3d
311, 319-20 (4th Cir. 2008) (reversing the district court’s suppression order
because it “erroneously discounted [the officer’s] assertion of training-and-
experience-based knowledge” to tie the defendants’ drug activities to their
residences), and in this case Officer Stoller stated that it is common for
Case 1:23-cr-00083-MR-WCM Document 33 Filed 02/10/26 Page 9 of 22

10
individuals “using, selling, or distributing illegal narcotics to keep ledgers,
record [sic], photographs, and other information pertaining to [“trafficking
methamphetamine, cocaine”] on hard drives, thumb drives, computers, and
other electronic devices” Doc. 24-1 at 6.
However, the Narcotics Warrant Application provided little information
about Officer Stoller’s training and experience related specifically to controlled
substances investigations. It also did not explain why evidence of drug
trafficking, such as ledgers, would likely be found on the subject electronic
devices when ledgers (presumably in paper form) had previously been located
elsewhere in the Vehicle.
A reviewing court “must accord ‘great deference’ to the magistrate’s
assessment of the facts presented to him,” United States v. Blackwood, 913
F.2d 139, 142 (4th Cir. 1990) (quoting Spinelli v. United States, 393 U.S. 410,
419 (1969)), such that “the task of a reviewing court is not to conduct a de novo
determination of probable cause, but only to determine whether there is
substantial evidence in the record supporting the magistrate's decision to issue
the warrant.” Massachusetts v. Upton, 466 U.S. 727, 728 (1984) (citing Illinois
v. Gates, 462 U.S. 213, 214 (1983)); see also Orozco, 41 F.4th at 407 (Where a
“neutral and detached magistrate” has found probable cause exists to support
the issuance of a warrant, that initial determination of probable cause is
entitled to “great deference.”) (quoting Gates, 462 U.S. at 236 & 240).
Case 1:23-cr-00083-MR-WCM Document 33 Filed 02/10/26 Page 10 of 22

11
Nonetheless, on the record presented, the undersigned finds Defendant’s
argument as to the lack of probable cause to be persuasive. See United States
v. Dove, No. 3:23-CR-151, 2025 WL 2427703, at *5 (W.D.N.C. Aug. 22, 2025)
(finding that an affidavit in support of a state search warrant allowing the
search of the defendant’s phone lacked a sufficient nexus between the subject
phone and narcotics and firearm offenses where the affiant stated only his
conclusory “belie[f]” that the defendant used the phone to carry out the charged
offenses, spoke “only in generalities about how information on a cell phone ‘can
be evidence in a law enforcement investigation,’” did not tie that “broad
statement to drug trafficking or firearms offenses,” never discussed the
affiant’s experience “investigating such crimes,” and “never even hinted at a
connection between [the defendant’s] conduct and [the defendant’s] phone.”).
2. Overbreadth/Particularity
As for Defendant’s next argument, the Fourth Amendment provides that
warrants must “particularly describ[e] the place to be searched, and the
persons or things to be seized.” U.S. Const. amend. IV; see also United States
v. Curtis Williams, 592 F.3d 511, 519 (4th Cir. 2010) (“At its core, the Fourth
Amendment protects against general warrants that authorize ‘exploratory
rummaging in a person's belongings ... by requiring a particular description of
the things to be seized.’”) (quoting Andresen v. Maryland, 427 U.S. 463, 480
(1976)). “[A] warrant may satisfy the particularity requirement	
either by
Case 1:23-cr-00083-MR-WCM Document 33 Filed 02/10/26 Page 11 of 22

12
identifying the items to be seized by reference to a suspected criminal offense
or by describing them in a manner that allows an executing officer to know
precisely what he has been authorized to search for and seize.” United States
v. Blakeney, 949 F.3d 851, 862 (4th Cir. 2020) (emphasis in original)); see also
United States v. Jones, 31 F.3d 1304, 1313 (4th Cir. 1994) (holding that a
warrant which “confine[d] the executing inspectors’ discretion by allowing
them to seize only evidence of a particular crime” had “sufficient particularity
to satisfy the Fourth Amendment”); White v. City of Greensboro, 586 F.
Supp.3d 466, 485 (M.D.N.C. 2022) (“The Fourth Circuit has recognized ‘a
warrant need not — and in most cases, cannot — scrupulously list and
delineate each and every item to be seized’ because it is frequently ‘impossible
for law enforcement officers to know in advance exactly what ... records the
defendant maintains or how the case against him will unfold.’”) (quoting
United States v. Cobb, 970 F.3d 319, 327-28 (4th Cir. 2020), as amended (Aug.
17, 2020), cert. denied, 141 S.Ct. 1750, 209 L. Ed. 2d 513 (2021) (citation
omitted)).
Here, Defendant argues that the Narcotics Warrant improperly allowed
a “general search of twenty-three electronic devices for any evidence of
criminal activity” because it authorized law enforcement to seize “(1) any
ledgers, receipts, or information consistent with the use or sales of controlled
substances; (2) all records such as text messages, MMS messages,
Case 1:23-cr-00083-MR-WCM Document 33 Filed 02/10/26 Page 12 of 22

13
photographs, GPS locations, video data, web site searches, social media posts
and social media messages stored [and] (3) any other data showing evidence of
criminal activity.” Doc. 24 at 14; see also Doc. 24-1 at 4.
However, the Narcotics Warrant Application sought authorization to
seize “[a]ll electronic contents to include photographs, ledgers, names, phone
numbers, social media content, or any other electronic evidence
of the illegal
narcotics use, sale, distribution he is charged with” and “to search for and seize
evidence related to violation of G.S. 90-95 possession of controlled substance
and G.S. 90-113 possession of drug paraphernalia.” Doc. 24-1 at 2 (emphasis
added) & 3. In addition, the Narcotics Warrant listed seven particular crimes
related to drug activity. Doc. 24-1 at 4. See United States v. Manafort, 323 F.
Supp.3d 795, 802-03 (E.D. Va. 2018) (concluding that a search warrant met the
Fourth Amendment’s particularity requirement because it required that the
seizures be related to a list of specific crimes and “identified an illustrative list
of the records at issue”).
Accordingly, the undersigned does not find the Narcotics Warrant to be
overbroad.
3. Good Faith Exception
The Government argues, though, that even if the Narcotics Warrant was
invalid, law enforcement was permitted to rely on it in good faith pursuant to
United States v. Leon, 468 U.S. 897 (1984).
Case 1:23-cr-00083-MR-WCM Document 33 Filed 02/10/26 Page 13 of 22

14
Leon “teaches that a court should not suppress the fruits of a search
conducted under the authority of a warrant, even a ‘subsequently invalidated’
warrant, unless ‘a reasonably well trained officer would have known that the
search was illegal despite the magistrate's authorization.’” United States v.
Bynum, 293 F.3d 192, 195 (4th Cir. 2002) (quoting Leon, 468 U.S. at 922 n.23).
“This ‘good faith’ exception will be applied except in four limited
situations: (1) when the affiant based his application on knowing or reckless
falsity; (2) when the judicial officer wholly abandoned his role as a neutral and
detached decision maker and served merely as a ‘rubber stamp’ for the police;
(3) when the affidavit supporting the warrant was so lacking in indicia of
probable cause as to render official belief in its existence entirely unreasonable;
and (4) when the warrant was so facially deficient that the executing officers
could not reasonably have presumed that the warrant was valid.” United
States v. Wellman, 663 F.3d 224, 228–29 (4th Cir. 2011) (citing United States
v. Doyle, 650 F.3d 460, 467 (4th Cir. 2011)) (quoting United States v. DeQuasie,
373 F.3d 509, 519–20 (4th Cir. 2004)).
“Typically, an officer's reliance on a magistrate's decision to issue a
warrant will be deemed objectively reasonable.” United States v. Thomas, 908
F.3d 68, 72 (4th Cir. 2018). “But as Leon makes clear, when a supporting
affidavit is ‘so lacking in indicia of probable cause as to render official belief in
its existence entirely unreasonable,’ then an officer cannot be found to have
Case 1:23-cr-00083-MR-WCM Document 33 Filed 02/10/26 Page 14 of 22

15
reasonably relied on the resulting warrant, and suppression remains the
appropriate remedy.” Id. The Fourth Circuit has explained that “[t]his is a less
demanding showing than the ‘substantial basis’ threshold required to prove
the existence of probable cause in the first place.” United States v. Bynum, 293
F.3d 192, 195 (4th Cir. 2002).
In this case, law enforcement’s reliance on the Narcotics Warrant was
not unreasonable.
Defendant was found, apparently asleep, in a Vehicle that contained
significant amounts of controlled substances as well as other indicia of drug
trafficking. And while the undersigned finds, under the specific facts presented
here, that the Narcotics Warrant Application did not provide an adequate basis
to support a belief that evidence of drug crimes would be found on the electronic
devices, searches of cell phones and other electronic devices for evidence of drug
crimes have been upheld in other circumstances. See e.g., United States v.
Burgess, 576 F.3d 1078, 1090-92 (10th Cir. 2009) (affirming the denial of a
suppression motion involving a search for “computer records” and “items of
personal property which would tend to show conspiracy to sell drugs, including
pay-owe sheets, address books, rolodexes, pagers, firearms and monies”
because the search, as it related to the computer “was limited to the kind of
drug and drug trafficking information likely to be found on a computer”);
United States v. Wrenn, No. 22-12621, 2023 WL 4146439, at *5-6 (11th Cir.
Case 1:23-cr-00083-MR-WCM Document 33 Filed 02/10/26 Page 15 of 22

16
June 23, 2023) (affirming the denial of a suppression motion related to the
seizure of a laptop during an investigation for the possession of marijuana
plants and a marijuana “grow operation” based on the investigator’s statement
that, based on his training and experience, “it was common for criminals
involved in illicit drug operations to keep on their phones or computers ledgers,
correspondence, and images regarding the drugs they sold and the people to
whom they sold their drugs”); United States v. Ruiz-Ruiz, No. 22-232 (RAM),
2025 WL 1378659, at *22 (D.P.R. May 13, 2025) (denying a suppression
challenge to the sufficiency of probable cause related to a search warrant for
electronic devices because “normal inferences as to where a criminal would
hide evidence of his crime” supported seizure of electronic devices where
officers seized “roughly $500,000, marijuana plants, pills [], various electronic
devices, a bill counting machine with a monitor, a United States passport, cash
labels, two U.S.P.S. receipts, CBP documents, a digital pocket scale, and one
plastic wrapping roll” in the defendant’s residence) (citations omitted); United
States v. Coffey, No. 21-CR-00538 (JMA) (ARL), 2023 WL 8891508, at *11
(E.D.N.Y. Dec. 26, 2023) (“For example, the affidavit explains that Special
Agent Flynn ‘personally participated in the execution of search warrants and
in numerous controlled deliveries of narcotics’ where he ‘frequently found’
evidence of narcotics trafficking, ‘such as cell phones, tablets, and computers.’
Special Agent Flynn also attests that—‘based on [his] experience and
Case 1:23-cr-00083-MR-WCM Document 33 Filed 02/10/26 Page 16 of 22

17
training’—the nature of narcotics trafficking necessarily would involve those
electronic devices. Courts within this Circuit concur, routinely recognizing an
association between electronic devices and narcotics trafficking—such that
electronic devices are essentially the ‘tools of the trade.’”); but see Dove, 2025
WL 2427703.
B. The CSAM Warrant
Defendant argues that Detective Lillard exceeded the bounds of the
Narcotics Warrant by “abandoning the search for drug distribution evidence
and looking for evidence of child pornography.” Doc. 24 at 1. Defendant also
contends that the CSAM Warrant Application failed to establish a sufficient
nexus tying any device other than the Thumb Drive to evidence of CSAM.
1. Discovery of the Material Leading to the CSAM Warrant
Defendant contends that when Detective Lillard “acquired the
information suggesting possible child pornography, he necessarily relied on the
third clause [of the Narcotics Warrant allowing seizure of “any other data
showing evidence of criminal activity”], since he was acting beyond the scope
of the [Narcotics Warrant’s] first two clauses” and that Detective Lillard’s
actions indicate that he was improperly “digging through text files” to obtain
the evidence he subsequently used to obtain the CSAM Warrant. Id. at 15.
There is no indication, however, that the Narcotics Warrant did not allow
such a review. See Cobb, 970 F.3d at 329 (concluding that a search warrant
Case 1:23-cr-00083-MR-WCM Document 33 Filed 02/10/26 Page 17 of 22

18
authorizing a search of electronic files for evidence related to a murder
implicitly authorized officers to open each file to view its contents and that
“more specificity was not required under the Fourth Amendment, nor was
limiting the scope of the computer search practical or prudent under the
circumstances of this investigation.”); Curtis Williams, 592 F.3d at 521-22 (“To
conduct that search, the warrant impliedly authorized officers to open each file
on the computer and view its contents, at least cursorily, to determine whether
the file fell within the scope of the warrant's authorization—
i.e., whether it
related to the designated Virginia crimes of making threats or computer
harassment. To be effective, such a search could not be limited to reviewing
only the files’ designation or labeling, because the designation or labeling of
files on a computer can easily be manipulated to hide their substance.”) (citing
Andresen, 427 U.S. at 482 n.11).
Further, the incriminating character of the material Detective Lillard
found on the Thumb Drive was immediately apparent for purposes of the plain
view doctrine. See Horton v. California, 496 U.S. 128, 136-37 (1990) (a law
enforcement officer may seize an item in plain view when: (1) the officer did
not violate the Fourth Amendment “in arriving at the place from which the
evidence could be plainly viewed”; (2) the object's “incriminating character”
was “immediately apparent”; and (3) the officer had “a lawful right of access to
the object itself”) (internal quotation marks and citations omitted); Curtis
Case 1:23-cr-00083-MR-WCM Document 33 Filed 02/10/26 Page 18 of 22

19
Williams, 592 F.3d at 521-22 (stating that “[o]nce it is accepted that a computer
search must, by implication, authorize at least a cursory review of each file on
the computer, then the criteria for applying the plain-view exception are
readily satisfied” and that “when the officer then comes upon child
pornography, it becomes ‘immediately apparent’ that its possession by the
computer's owner is illegal and incriminating”).
2. Nexus
Defendant contends that while the CSAM Warrant Application “may
have included facts sufficient to establish probable cause to search” the Thumb
Drive, it failed to establish a sufficient nexus between the evidence on the
Thumb Drive and the other twenty-two devices. Doc. 24 at 17.
The CSAM Warrant Application, however, did not need to demonstrate
with “absolute certainty” that “evidence of a crime [would] be present in [the
place to be searched].” United States v. Sueiro, 59 F.4th 132, 140 (4th Cir.
2023). Rather, a judicial officer reviewing a requested warrant must evaluate
“the ‘totality of the circumstances’ to determine whether there is a ‘substantial
likelihood’ that evidence of a crime will be found in the place to be searched.”
Id.
Here, the CSAM Warrant Application described Detective Lillard’s
discovery of possible CSAM on the Thumb Drive as well as Detective Lillard’s
years of law enforcement experience, including his training and experience
Case 1:23-cr-00083-MR-WCM Document 33 Filed 02/10/26 Page 19 of 22

20
related to computer investigations and CSAM investigations. The CSAM
Warrant Application also described how it is “common for collectors of child
pornographic materials to organize their collection into a custom folder
structure” and set forth Detective Lillard’s belief that because the Thumb
Drive included “custom folders that appear[ed] to be user created . . . it [was]
plausible that similar structures and content would be found on the existing
devices that were in [Defendant’s] possession.” Doc. 24-2 at 10. Finally, the file
tree showed various folders with graphic names and suggested that evidence
could be found in other places. Doc. 24-2 at 9. See United States v. Bosyk, 933
F.3d 319, 322, 325-26 (4th Cir. 2019) (affirming the denial of a motion to
suppress where the search warrant authorizing the seizure of a variety of
computers and electronic devices from the defendant’s residence was based on
an investigation that showed someone using the defendant’s IP address made
a “single click” on a link directing the user to online CSAM, which link had
been posted the same day and contained a message “describing [the link’s]
contents unmistakably as child pornography”); United States v. Kuhn, No.
4:24-cr-23-D, 2025 WL 3204531, at *22-23 (E.D.N.C. Nov. 17, 2025) (denying a
motion to suppress involving a search warrant covering the defendant’s cell
phone and various chat applications therein because law enforcement was
“justified in searching other chat applications on [the defendant’s] phone given
the ‘fair probability’ that [the defendant] used them to produce, distribute,
Case 1:23-cr-00083-MR-WCM Document 33 Filed 02/10/26 Page 20 of 22

21
receive, or possess child sexual abuse material” even though investigators only
described evidence of the defendant’s use of certain chat applications in the
warrant’s affidavit).
3. Good Faith Exception
As with the Narcotics Warrant, the Government argues that even if the
CSAM Warrant was invalid, law enforcement officers were permitted to rely
on it in good faith pursuant to United States v. Leon, 468 U.S. 897 (1984).
However, the undersigned finds that it is unnecessary to address this
argument. As described above, the undersigned concludes that the CSAM
Warrant was valid. Further, in his reply, Defendant appears to address the
applicability of Leon only with respect to the Narcotics Warrant.
V. Recommendation
For the reasons stated above, the undersigned RESPECTFULLY
RECOMMENDS that Defendant’s Motion to Suppress (Doc. 24) be DENIED.
Signed:
2/10/2026
Case 1:23-cr-00083-MR-WCM Document 33 Filed 02/10/26 Page 21 of 22

22
Time for Objections
The parties are hereby advised that, pursuant to Title 28, United States
Code, Section 636(b)(1)(B), written objections to the findings of fact,
conclusions of law, and recommendation contained herein must be filed within
fourteen (14) days of service of same. Responses to the objections must be filed
within fourteen (14) days of service of the objections. Failure to file objections
to this Memorandum and Recommendation with the presiding District Judge
will preclude the parties from raising such objections on appeal. See Thomas
v. Arn, 474 U.S. 140 (1985).
Case 1:23-cr-00083-MR-WCM Document 33 Filed 02/10/26 Page 22 of 22