CyberTip-Based Warrants and the Leon Good-Faith Exception: NCMEC Reliability as “Indicia of Probable Cause”

Case: United States v. Kevan Carter Gibbs, II (11th Cir. Sept. 17, 2026)

1. Introduction

In United States v. Kevan Carter Gibbs, II, the Eleventh Circuit revisited a recurring Fourth Amendment question framed in Justice Cardozo’s famous formulation—whether a criminal should “go free because the constable has blundered.” People v. Defore, 150 N.E. 585, 587 (1926). The case arose from a report that suspected child sexual abuse material (CSAM) had been uploaded to a cloud account managed by Synchronoss (linked to a Verizon subscriber). Synchronoss reported the suspected CSAM to the National Center for Missing and Exploited Children (NCMEC) through its CyberTipline, and NCMEC forwarded the report to law enforcement pursuant to 18 U.S.C. § 2258A.

Tallahassee Police Detective Paul Osborn sought a state warrant to search the relevant Synchronoss account. The search produced images of sexual abuse; subsequent investigative steps (including a pen register/trap-and-trace and cell-phone searches) led to Gibbs’s arrest and federal charges under 18 U.S.C. §§ 2251 and 2252A.

The central issue on appeal was not whether the affidavit actually established probable cause (the government did not defend probable cause), but whether suppression was nevertheless required or whether the United States v. Leon good-faith exception allowed the evidence to be used.

2. Summary of the Opinion

The district court had suppressed all evidence, finding the affidavit “bare-bones” and “conclusory,” emphasizing its failure to describe the images or explain how the CyberTip was generated or reviewed, and expressing concern that extraneous definitions (e.g., “Hash Value”) could have misled the issuing judge. The Eleventh Circuit disagreed, concluding that the affidavit provided enough context about (1) the CyberTip pipeline and (2) NCMEC’s role and reliability for an officer to reasonably rely on the warrant.

Judge Newsom concurred, calling it a “close case” and the affidavit “bad,” but agreed that it was not “completely bankrupt” and that review by a legal advisor and issuance by a judge strongly supported objective reasonableness.

3. Analysis

A. Precedents Cited

1) The governing Fourth Amendment framework

• United States v. Leon, 468 U.S. 897 (1984): The cornerstone. The court applied Leon’s rule that evidence obtained under a warrant later found invalid can still be admitted if officers acted in objectively reasonable good faith. The opinion also invoked Leon’s identification of classic “no good-faith” scenarios and cited Nathanson v. United States and Aguilar v. Texas as paradigms of affidavits so deficient that reliance would be unreasonable.
• United States v. Martin, 297 F.3d 1308 (11th Cir. 2002): Provided the Eleventh Circuit’s four circumstances where good faith does not apply—especially the third (an affidavit “so lacking in indicia of probable cause” that belief in probable cause is “entirely unreasonable”). Martin also supported the point that affidavits may be imperfect and still permit good-faith reliance.
• Illinois v. Gates, 462 U.S. 213 (1983): Supplied the “fair probability” definition of probable cause and the “totality of the circumstances” approach. The majority used Gates to reject any rigid requirement that a CSAM affidavit must include an image description to create indicia of probable cause.

2) What makes an affidavit “bare-bones” for good-faith purposes

• United States v. McCall, 84 F.4th 1317 (11th Cir. 2023) and United States v. Morales, 987 F.3d 966 (11th Cir. 2021): Together supplied the key operational test: an affidavit is too thin when it provides “no hint” why evidence would be found; and the standard is whether reliance was “plainly incompetent.” These cases anchored the court’s conclusion that the CyberTip allegations were at least a “hint” linking the account to contraband.
• Messerschmidt v. Millender, 565 U.S. 535 (2012) and Malley v. Briggs, 475 U.S. 335 (1986): Reinforced the “plainly incompetent”/reasonable-officer framing. The majority used them (via McCall) to emphasize the high bar for denying good faith.

3) Informant reliability and hearsay-based affidavits

• Jones v. United States, 362 U.S. 257 (1960), overruled on other grounds by United States v. Salvucci, 448 U.S. 83 (1980): Supported the proposition that an affidavit can rest on a trustworthy source without detailed contraband description. The majority analogized NCMEC (and the CyberTip process) to a reliable informant.
• United States v. Harris, 403 U.S. 573 (1971): Used to illustrate that informant basis-of-knowledge and situational credibility can compensate for limited descriptive detail about contraband.
• Nathanson v. United States, 290 U.S. 41 (1933) and Aguilar v. Texas, 378 U.S. 108 (1964), abrogated on other grounds by Gates: Used as the “too conclusory” boundary. The majority distinguished Osborn’s affidavit from the “mere suspicion/belief” in Nathanson and the unsupported “credible person” claim in Aguilar by pointing to the CyberTip pipeline and statutory context (including the “actual knowledge” reporting obligation).
• United States v. Brundidge, 170 F.3d 1350 (11th Cir. 1999): Invoked to rebut the claim that police must independently corroborate an informant before seeking a warrant; corroboration is “desirable” but not always required where veracity and basis-of-knowledge are sufficiently shown.
• Florida v. J.L., 529 U.S. 266 (2000): Cited for the general proposition (in the reasonable suspicion context) that known informants are stronger than anonymous ones; the majority used it by analogy because Synchronoss and NCMEC were identified entities.

4) Child-exploitation investigative sources and CyberTip credibility

• United States v. Sotelo, 130 F.4th 1229 (11th Cir. 2025): Although a restitution case, it supported the broader proposition that NCMEC outputs carry “indicia of reliability” given NCMEC’s unique institutional role.
• United States v. Landreneau, 967 F.3d 443 (5th Cir. 2020): Quoted for the observation that NCMEC cyber-tips “regularly form the basis of investigations” and their reliability is “rarely questioned,” bolstering the majority’s trustworthiness analysis.
• United States v. Braun, No. 25-2740 (7th Cir. Aug. 20, 2026): A recent, closely analogous CyberTip case. The Eleventh Circuit relied on Braun to show that explanation of the CyberTip pipeline and an officer’s experience with CyberTips can support probable cause (and a fortiori good-faith reliance), even without an officer viewing or describing the images in the application.
• United States v. Lapsins, 570 F.3d 758 (6th Cir. 2009) and United States v. Chrobak, 289 F.3d 1043 (8th Cir. 2002): Cited to acknowledge that describing alleged child pornography can establish probable cause, but not to create a mandatory requirement.

5) Reliance on legal review and judicial authorization

• Herring v. United States, 555 U.S. 135 (2009): Used to frame objective reasonableness in part by considering “a particular officer’s knowledge and experience,” supporting reliance where an experienced investigator acts without misconduct.
• Massachusetts v. Sheppard, 468 U.S. 981 (1984) and United States v. Taxacher, 902 F.2d 867 (11th Cir. 1990): Cited for the proposition that seeking lawyer input supports good faith. The affidavit’s stated review by a police legal advisor was thus a significant fact.
• United States v. Robinson, 336 F.3d 1293 (11th Cir. 2003): Supported considering affidavit facts as part of the good-faith inquiry and noted the lack of evidence of intentional omissions or falsity.
• United States v. Gregory, 128 F.4th 1228 (11th Cir. 2025): Referenced to underscore that intentional deception or misconduct would undermine good faith—none was shown here.
• United States v. Stowers, 32 F.4th 1054 (11th Cir. 2022): Quoted (via McCall) for the general rule that reliance on court orders is objectively reasonable in “all but the most unusual circumstances.”

6) Exclusionary rule as a last resort

• Hudson v. Michigan, 547 U.S. 586 (2006) and Davis v. United States, 564 U.S. 229 (2011): Framed suppression as a “remedy of last resort” justified by deterrence value. The court concluded deterrence was minimal where an officer executed a warrant based on a congressionally designed reporting regime and a judicially approved warrant.
• United States v. Ventresca, 380 U.S. 102 (1965): Appeared in the concurrence (via McCall) for the principle that “marginal cases” should not trigger suppression—a theme consistent with the majority’s approach.

B. Legal Reasoning

1) The court’s posture: assuming no probable cause

A key structural feature of the decision is the government’s litigation choice: it did not defend probable cause, arguing only good faith. The Eleventh Circuit therefore “assume[d], without deciding,” that probable cause was absent. That assumption focused the analysis on whether the affidavit was so deficient that no reasonable officer could rely on it, and whether reliance was objectively reasonable given the circumstances.

2) “Indicia of probable cause” supplied by the CyberTip pipeline and institutional trustworthiness

The district court characterized the affidavit as conclusory because it did not describe the alleged CSAM or explain who reviewed what. The Eleventh Circuit agreed the affidavit was “all too brief,” but held it was not Nathanson- or Aguilar-level bare-bones because it contained:

• Identified sources (Synchronoss and NCMEC), not an unnamed “credible person”;
• A statutory context: under 18 U.S.C. § 2258A(a)(1)(A), providers report upon “actual knowledge,” which—while not guaranteeing accuracy—supports an inference that the reporter has a concrete basis;
• A plausible basis-of-knowledge: an administrator of the platform is “in a position to know” what is on the platform;
• Institutional reliability: NCMEC’s congressionally created clearinghouse role, its long-standing function as a repository, and the court’s prior recognition of NCMEC reliability in United States v. Sotelo.

On this view, even without image descriptions, the affidavit provided more than “no hint” of why evidence would be found—there was a concrete allegation: the account had been used to upload suspected CSAM, reported through a structured statutory reporting mechanism.

3) Rejecting defendant’s three counterarguments

• Need for corroboration: The court acknowledged corroboration would have strengthened the showing, but relied on Aguilar’s recognition that affidavits may be hearsay-based and on United States v. Brundidge for the proposition that corroboration is not categorically required when an affidavit establishes basis-of-knowledge and veracity.
• Extraneous definitions (e.g., “Hash Value”): The court labeled the drafting “sloppy” but treated it as non-dispositive because the extraneous terms did not appear in the probable-cause narrative and thus were unlikely to have misled the issuing judge.
• Possibility no one actually viewed the images: The court treated this as an argument for certainty rather than reasonableness. Good faith turns on whether reliance was “entirely unreasonable,” not on whether alternative scenarios are imaginable.

4) Independent good-faith reliance: experience, legal review, and judicial authorization

Even beyond the affidavit’s “indicia,” the court emphasized that reliance was objectively reasonable because:

• Detective Osborn had extensive child-exploitation investigative experience and had investigated hundreds of CyberTips (Herring);
• His affidavit was reviewed and approved by a police legal advisor (Massachusetts v. Sheppard; United States v. Taxacher);
• A judge issued the warrant, and officers generally may rely on court orders absent “most unusual circumstances” (United States v. Stowers; United States v. McCall);
• There was no showing of deception, reckless falsity, or omission-based misconduct (United States v. Gregory; United States v. Robinson).

Judge Newsom’s concurrence sharpened this point: it is extraordinarily difficult to call an officer “unreasonable” for relying on a warrant after both legal counsel and a neutral magistrate sign off—especially absent evidence of deliberate or reckless wrongdoing.

C. Impact

1) Practical effect in CSAM/CyberTip investigations

The decision materially strengthens the government’s ability—at least in the Eleventh Circuit—to defend CyberTip-initiated searches under the Leon good-faith exception, even when the first affidavit is thin. It signals that an affidavit’s failure to include image descriptions, hash matches, or an explicit statement that anyone viewed the files will not necessarily be fatal to admissibility if the affidavit ties the suspect account to an NCMEC-forwarded report and invokes the CyberTip reporting framework.

2) Institutional validation of NCMEC as a reliability anchor

By treating NCMEC’s role and track record as a significant indicator of reliability, the opinion encourages future warrant applications to foreground:

• the statutory duties under 18 U.S.C. § 2258A;
• the provider’s basis for reporting (e.g., human review, automated detection, categorization tools);
• the officer’s experience with NCMEC CyberTips.

3) Drafting incentives and the “close case” warning

The concurrence is a cautionary note to law enforcement and prosecutors: this affidavit was “bad” and the case “close.” That framing may incentivize better practice—adding a brief description of the flagged material, clarifying whether and how it was reviewed, and avoiding irrelevant boilerplate—to reduce litigation risk, particularly if future panels or district courts read the concurrence as marking the outer boundary of what “good faith” will tolerate.

4) Doctrinal containment: the court does not decide probable cause

Because the Eleventh Circuit assumed no probable cause, the decision’s precedential force is concentrated on good faith, not on a definitive rule that CyberTips alone always establish probable cause. The court’s message is narrower: CyberTip-based affidavits can be sufficient to avoid the “so lacking” category, making suppression inappropriate under Leon.

4. Complex Concepts Simplified

• Probable cause: A commonsense, practical likelihood—“a fair probability”—that evidence of a crime will be found in the place to be searched (Illinois v. Gates).
• Exclusionary rule: A judge-made remedy that keeps unlawfully obtained evidence out of trial to deter police misconduct.
• Good-faith exception: Even if a search is later found unlawful, evidence may be admitted if officers reasonably relied on a warrant (United States v. Leon).
• “So lacking in indicia of probable cause”: The affidavit is not merely weak; it is so empty that no reasonable officer could think it supports a warrant (United States v. Martin; United States v. McCall).
• CyberTip / NCMEC: CyberTip reports are submissions (often from platforms) about suspected CSAM to NCMEC, which then forwards actionable tips to law enforcement under 18 U.S.C. § 2258A.
• Fruit of the poisonous tree: If the initial search is unlawful, later evidence discovered because of it may also be suppressed—unless an exception (like good faith) applies.
• Pen register / trap-and-trace: Tools that capture dialing/routing/addressing/signaling information (metadata), not the contents of communications.
• Hash value: A digital fingerprint of a file. Matching hashes can suggest files are identical. Here, “hash” was discussed in boilerplate but not shown to be used in the affidavit’s probable-cause narrative.

5. Conclusion

United States v. Kevan Carter Gibbs, II establishes a consequential Eleventh Circuit benchmark for CyberTip-driven child-exploitation investigations: even where a warrant affidavit is sparse and may fail to establish probable cause, it can still carry enough “indicia of probable cause” to trigger Leon good faith when it identifies NCMEC and the reporting provider, links the suspect account to the tip, and situates the tip within the § 2258A reporting framework. The opinion underscores suppression’s deterrence-focused purpose (Hudson; Davis) and treats NCMEC’s institutional role and repeated use in law enforcement as a significant reliability marker—while the concurrence warns that this case approaches the edge of what good faith should tolerate.