On Petition for Review of an Order of the Board of Immigration Appeals.

Argued: March 19, 2026 Decided: June 5, 2026

Before WILKINSON, RICHARDSON, and HEYTENS, Circuit Judges.

Petition denied in part and dismissed in part by published opinion. Judge Richardson wrote the opinion, in which Judges Wilkinson and Heytens joined.

ARGUED: Jackson Erpenbach, HECKER FINK LLP, Washington, D.C., for Petitioner. Imran Raza Zaidi, UNITED STATES DEPARTMENT OF JUSTICE, Washington, D.C., for Respondent. ON BRIEF: Joshua A. Matz, HECKER FINK LLP, Washington, D.C., for Petitioner. Brett A. Shumate, Assistant Attorney General, Lindsay B. Glauner, Melissa K. Lott, Office of Immigration Litigation, Civil Division, UNITED STATES DEPARTMENT OF JUSTICE, Washington, D.C., for Respondent.

Page 2RICHARDSON, Circuit Judge:

New Jersey criminalizes knowingly storing or maintaining child sexual abuse material on a file-sharing program that makes the material available for searching or copying by other computers. That conduct creates a reasonable probability that the material will circulate and injure the children depicted. So the offense categorically qualifies as a crime of child abuse under the Immigration and Nationality Act.

Md Farid Uddin, a Bangladeshi native and Canadian citizen, was a lawful permanent resident living in New Jersey. In 2018, he was indicted for distributing, storing, and possessing sexually explicit images of children in violation of New Jersey law. In 2019, he pleaded guilty to one count under N.J. Stat. Ann. § 2C:24-4(b)(5)(a)(iii): Between August 1, 2017, and November 2, 2017, he “knowingly store[d] or maintain[ed] . . . twenty-five (25) or more items depicting the sexual exploitation or abuse of a child . . . using a file-sharing program which was designated as available for searching by or copying to one or more other computers.” J.A. 303. Uddin was sentenced and required to register as a sex offender.

After Uddin served his sentence, U.S. Immigration and Customs Enforcement detained him in Pennsylvania, and the Department of Homeland Security initiated removal proceedings. The government charged Uddin with removability under the Immigration Page 3and Nationality Act for (1) an “aggravated felony,” specifically the “sexual abuse of a minor,'¹ and (2) 'a crime of child abuse, child neglect, or child abandonment.'²

An immigration judge in Richmond, Virginia, found him removable because his statute of conviction categorically matched a crime of child abuse. The IJ also denied Uddin’s applications for cancellation of removal 3 and adjustment of status with a waiver of inadmissibility 4 'as a matter of discretion.' J.A. 56. Uddin appealed, contesting the IJ's removability finding and the IJ’s discretionary denials of his applications. The Board of Immigration Appeals issued its own opinion affirming removability and adopted the IJ’s discretionary rulings. Uddin petitioned for review in this Court.⁵

We review de novo whether Uddin’s conviction qualifies as a crime of child abuse. Herrera-Alcala v. Garland , 39 F.4th 233, 244 (4th Cir. 2022).⁶

Page 4Under the INA, removability turns on the “nature” of a conviction, not the “actual conduct.' Esquivel-Quintana v. Sessions , 581 U.S. 385, 389 (2017). The categorical approach therefore asks whether the minimum conduct criminalized by the statute qualifies as a crime of child abuse under the INA. Cruz v. Garland , 101 F.4th 361, 364 (4th Cir. 2024). This inquiry is not an exercise in “legal imagination.” Thompson v. Barr , 922 F.3d 528, 531 (4th Cir. 2019) (quoting Gonzales v. Duenas-Alvarez , 549 U.S. 183, 193 (2007)). To show the New Jersey statute is not a categorical match, there must be a 'realistic probability, not a theoretical possibility, that the State would apply its statute to' the asserted minimum conduct. Duenas-Alvarez , 549 U.S. at 193.

We must first answer a threshold question: Which version of state law governs when the statute at the time of the conduct differs from the statute at the time of the conviction ? The difference matters because a 2018 amendment added material later held overbroad. Uddin was indicted for and convicted of conduct that occurred between August 1, 2017, and November 2, 2017. At that time, New Jersey narrowly defined the prohibited Page 5materials. In February 2018, before Uddin’s indictment and guilty plea, the New Jersey Legislature added other categories of prohibited material. The state’s highest court would later find one of the added categories unconstitutionally overbroad. State v. Higginbotham , 313 A.3d 847, 859 (N.J. 2024). Uddin relies on Higginbotham to argue that the New Jersey statute sweeps beyond the INA because the amended state statute criminalized protected expression.

But Uddin looks at the wrong version of the statute. We consider the version in effect at the time of the conduct because that law defines the crime Uddin was “convicted of.” Cf. United States v. McLeod , 808 F.3d 972, 976 n.* (4th Cir. 2015) (assessing the version of the statute in effect at the time of the offenses ).⁷ An alien is removable if “convicted of” a covered offense.⁸ U.S.C. § 1227(a)(2)(E)(i). And a “conviction” is “a formal judgment of guilt of the alien entered by a court.” § 1101(a)(48)(A). A judgment of guilt rests on the law as it stood when the defendant acted—the Ex Post Facto Clause permits nothing else. See Carmell v. Texas , 529 U.S. 513, 521–22 (2000); see also State v. Perez , 106 A.3d 1212, 1221 (N.J. 2015) (holding that New Jersey law bars retroactive application of statutory amendments that alter the definitions of criminal conduct).

Here, the indictment, plea agreement, and sentencing orders all confirm that Uddin committed the offense in 2017, before the amendment became effective. Uddin was thus “convicted of” the offense as the 2017 New Jersey statute defined it—not as the Legislature Page 6expanded it months later. We apply the 2017 version of the statute, and Higginbotham does not alter our analysis.

A “crime of child abuse, child neglect, or child abandonment,” based on the text and structure of the INA, “represents a single category of crimes” with a “common thread”: These crimes “create a high risk of harm to a child, either by injuring the child directly or by putting the child in a situation likely to lead to injury.” Cruz , 101 F.4th at 365. To be a categorical match under the INA, New Jersey’s law must meet three elements: (1) an act or omission that causes harm or creates a “reasonable probability of harm” (2) to a child, and (3) a “culpable mens rea” as to the conduct at issue, not the child’s age. Id. at 369; Hsieh v. Bondi , 139 F.4th 337, 342–43 (4th Cir. 2025).

The statute makes it a crime to “knowingly store[] or maintain[] an item depicting the sexual exploitation or abuse of a child 8 using a file-sharing program which is designated as available for searching by or copying to one or more other computers.” N.J. Stat. Ann. § 2C:24-4(b)(5)(a)(iii) (2017). The disputed element here is harm: whether the minimum conduct creates a reasonable probability of harm to a child.

There can be little doubt that most violations of New Jersey’s statute harm a child. But Uddin identifies three examples of conduct that, he says, the New Jersey statute Page 7criminalizes even though they do not create a reasonable probability of harm: (1) storing, without distributing, child sexual abuse material, (2) storing, as an adolescent, an explicit image consensually sent by another adolescent, and (3) storing “morphed images,” or nonexplicit images manipulated to be illicit.⁹

Each scenario fails to account for the New Jersey statute’s element that the files be on a file-sharing program and designated as available for searching and copying . 10 § 2C:24-4(b)(5)(a)(iii). The statute defined a “file-sharing program” as any application that allows the user 'to designate files as available for searching by and copying to . . . other computers, to transmit such files directly to . . . other computers, and to request the transmission of such designated files directly from . . . other computers.' § 2C:24Page 84(b)(1).¹¹ The statutory offense is not mere possession or private storage. New Jersey courts have applied this statute exclusively to dedicated peer-to-peer file-sharing programs, such as BitTorrent or eMule.¹² These programs connect users directly to one another, making designated files discoverable and downloadable by every user on the network by default. See Metro-Goldwyn-Mayer Studios Inc. v. Grokster, Ltd. , 545 U.S. 913, 919–20 (2005); see also United States v. Stitz , 877 F.3d 533, 538 (4th Cir. 2017); State v. Lyons , 9 A.3d 596, 597–98 (N.J. Super. Ct. App. Div. 2010). No New Jersey court has applied the statute to storage of items on cloud storage services like Google Drive, Dropbox, or iCloud.¹³ Indeed, the statutory text forecloses that application: A 'file-sharing program'Page 9 is limited to programs that allow users to transmit files directly to and request transmission directly from other computers. § 2C:24-4(b)(1). That direct computer-to-computer exchange is the hallmark of peer-to-peer architecture. Grokster , 545 U.S. at 919-20. Cloud storage services, on the other hand, route files through a central server. See Riley v. California , 573 U.S. 373, 397 (2014) ('Cloud computing is the capacity of Internetconnected devices to display data stored on remote servers rather than on the device itself.”).

Files maintained on a file-sharing program are, by default, keyword searchable, publicly accessible, and exponentially replicable. See United States v. Weast , 811 F.3d 743, 748 (5th Cir. 2016). Any computer on the same network can obtain the image and subsequently transmit the content to other computers.¹⁴ That availability creates a reasonable probability of circulation. And circulation is the harm. The least of the acts prohibited by the statute—maintaining files on a publicly available network—meets Cruz 's requirement of a “reasonable probability of harm” even if no one ever downloads a file.

The Supreme Court has long recognized that the circulation of child sexual abuse material inflicts ongoing injury on the depicted child. The “use of children as subjects of pornographic materials is harmful to the physiological, emotional, and mental health of the child.” New York v. Ferber , 458 U.S. 747, 758 (1982). Harm occurs at least three times Page 10in the distribution chain. The child is first harmed by the abuse necessary to produce the materials. Paroline v. United States , 572 U.S. 434, 439–40 (2014). Second, the materials’ existence harms the child, because the materials are “a permanent record of” that abuse. Id. at 440. Finally—and most importantly here—circulation inflicts additional harm by renewing the victim’s trauma.¹⁵ Paroline , 572 U.S. at 440. Storing such material on a filesharing program where it is accessible by even one other user—much less by millions of users, hundreds of thousands of whom search for such content 16 -creates a reasonable probability of the harm circulation inflicts.

Specifying ostensibly less abusive production methods does not make the materials’ presence on a file-sharing program harmless. Take explicit images consensually taken and exchanged between adolescents. Uddin tries to portray this conduct as common, low risk, and even “healthy,” arguing that it’s comparable to consensual sexual activity between two 17-year-old children.

Page 11The example misreads the statute. The statute does not criminalize two 17-yearolds for privately exchanging messages. Rather, it punishes a defendant—of any age—for knowingly storing such an image on a file-sharing program “designated as available for searching by or copying to one or more other computers.' § 2C:24-4(b)(1). That availability element transforms the otherwise private exchange in Uddin’s example into publication.

Uddin's own cases distinguish sexting from sexual intercourse and describe the harms inherent even in self-produced materials. They recognize that memorializing adolescent sexual activity causes distinct harms to the child, regardless of any “consent” to the underlying activity. See A.H. v. State , 949 So. 2d 234, 236-39 (Fla. Dist. Ct. App. 2007) (noting that the memorialization of legal teenage sexual activity may cause “psychological trauma”); United States v. Streett , 434 F. Supp. 3d 1125, 1189-90 (D.N.M. 2020) (noting that self-produced child pornography is “intrinsically related to” and causes similar harms as adult-produced child pornography). New Jersey recognizes this harm too. See N.J. Stat. Ann. § 18A:35-4.32(b) (“[A] sexual image of any person under the age of 18 is child sexual abuse or exploitation material.”). Nor do the harms to the depicted child evaporate merely because the offender is also young. State ex rel. A.B. , 744 A.2d 709, 711 (N.J. Super. Ct. Ch. Div. 1999); see § 2A:4A-71.1(c)(1) (diverting some underage defendants away from adult prosecution, but making clear that the underlying conduct is criminal). Here, the “danger” lies in the “dissemination of the photography beyond the intended recipient' into the stream of child sexual abuse material. Streett , 434 F. Supp. 3d at 1137–38. Storage on a file-sharing program facilitates that very dissemination.

Page 12Manipulation of non-explicit images of real children fares no better.¹⁷ Even where the child was not physically harmed during production, morphed images “implicate the interests of real children,” and create real victims by their production. Ashcroft v. Free Speech Coal. , 535 U.S. 234, 242, 250 (2002). They “are like traditional child pornography in that they are records of the harmful sexual exploitation of children,” United States v. Anderson , 759 F.3d 891, 896 (8th Cir. 2014), and children are 'sexually exploited and psychologically harmed by the existence of the images.” Shoemaker v. Taylor , 730 F.3d 778, 786 (9th Cir. 2013). The depicted children may be harmed “by the knowledge of [the images’] continued circulation.” United States v. Hotaling , 634 F.3d 725, 728 (2d Cir. 2011). A file-sharing program’s capacity to spread such images—indefinitely and to an ever-wider audience—creates a reasonable probability that circulation of the manipulated images will harm the depicted child. See Ferber , 458 U.S. at 758; Paroline , 572 U.S. at 440.

Uddin downplays the ongoing harms to children from storage on a platform designed for circulation. His attempts to minimize the brutality of producing sexually exploitative depictions of children do not carve out a version of the offense that is Page 13meaningfully less harmful. Even the least culpable conduct covered by the statute creates a “reasonable probability” of harm to the depicted child.

We lack jurisdiction to review the agency’s discretionary denial of cancellation of removal and adjustment of status.⁸ U.S.C. § 1252(a)(2)(B)(i). That bar reaches not only the ultimate decision but also the factual determinations that underlie it, including the relative weight assigned to favorable and unfavorable equities. Patel v. Garland , 596 U.S. 328, 339 (2022). But § 1252(a)(2)(D) permits us to review “questions of law,” including the application of a legal standard to settled facts. Wilkinson v. Garland , 601 U.S. 209, 212 (2024); Gomis v. Holder , 571 F.3d 353, 358 (4th Cir. 2009).

In challenging the discretionary denial of cancellation of removal, Uddin fails to present a question of law. Rather, Uddin seeks to recast the weight the agency assigned the equities-a classic discretionary merits determination-as legal error. But the agency considered the facts before it and explained why it gave “little weight” to certain evidence. J.A. 60. Uddin also claims the IJ misstated the law as requiring knowingly downloading child sexual abuse material. But the record will not bear that theory. The IJ consistently referred to the fact that Uddin “knowingly stored or maintained ” the materials. J.A. 60; see also id. at 59 & 60 n.7. The IJ merely gave little weight to Uddin's claim that he accidentally downloaded the materials because Uddin knowingly maintained them after learning of their existence. That weighing is what § 1252(a)(2)(B)(i) places beyond our reach.

Page 14* * *

The petition for review is

DENIED IN PART AND DISMISSED IN PART .