Friday, September 05, 2014

Child Pornography, the Password and the Operating System

After Marc Hall was “convicted of three counts of sexual exploitation of a minor for possessing three digital videos of child pornography.”  State v. Hall, 2014 WL 2557847 (Court of Appeals of Arizona 2014).  The court begins the opinion by explaining how the prosecution arose:
In November 2009, J., Hall's then-wife, woke early in the morning and observed him watching a video of what she believed to be child pornography on his computer. She put on her glasses, left the room for a while, and then returned and confronted Hall about what he was watching; he offered to let her look at his computer. 

When she looked, J. saw the titles of two files in the Windows Media Player history log strongly suggestive of child pornography, but when she tried to open them she received the error `”file does not exist.”’ After an argument with Hall, J. eventually called two friends over, who began helping her pack her possessions to prepare to leave with the children.

While J. was packing, Hall reinstalled the Windows operating system on his computer. J. left with the children later that evening, and called the police. A forensic examiner recovered numerous digital videos and photographs from the unallocated space of the hard drive in Hall's computer which the police classified as images of child sexual abuse.
State v. Hall, supra.  
Hall was charged with ten counts of sexual exploitation of a minor; a jury convicted him on three of the counts.  State v. Hall, supra.  He was “sentenced to consecutive terms of imprisonment totaling thirty years.” State v. Hall, supra.  He then appealed, arguing, in part, that “insufficient evidence supported the convictions”. State v. Hall, supra.  The Court of Appeals began its analysis of his argument by noting that it “view[s] the facts in the light most favorable to upholding the convictions.”  State v. Hall, supra.  
More precisely, Hall claimed the trial judge “erred in denying his motion for a judgment of acquittal made pursuant to Rule 20 of the Arizona Rules of Criminal Procedure because insufficient evidence supported the jury's verdicts.”  State v. Hall, supra.  The Court of Appeals noted that
[w]e review de novo whether sufficient evidence was presented at trial to support a conviction. State v. Mwandishi, 229 Ariz. 570, 278 P.3d 912 (Arizona Court of Appeals 2012). In doing so, `”we view the evidence in the light most favorable to supporting the verdict and will reverse only if there is a complete absence of substantial evidence to support the conviction.”’ State v. Ramsey, 211 Ariz. 529, 124 P.3d 756 (Arizona Court of Appeals 2005),  quoting State v. Sullivan, 187 Ariz. 599, 931 P.2d 1109 (Arizona Court of Appeals 1996). Evidence is `substantial if reasonable persons could differ on whether it establishes a fact in issue.’ Id.
State v. Hall, supra.  
Next, it explained that Hall was convicted under Arizona Code § 13–3553(A), which
requires the state to show that the defendant `knowingly . . . possess[ed] . . . any visual depiction in which a minor is engaged in exploitive exhibition or other sexual conduct.’ `Possession may be actual or constructive.’ State v. Gonsalves, 231 Ariz. 521, 297 P.3d 927 (Arizona Court of Appeals 2013). . . . Constructive possession exists when the defendant has either dominion or control over the contraband itself or the place where the exploitative materials are found. See State v. Teagle, 217 Ariz. 17, 170 P.3d 266 (Arizona Court of Appeals 2007).

The circumstances must be such that a jury can reasonably infer that the defendant had knowledge of the contraband's presence. State v.. Villavicencio, 108 Ariz. 518, 502 P.2d 1337 (Arizona Supreme Court 1972). The state may prove constructive possession through direct or circumstantial evidence. evidence. State v. Gonsalves, supra. . . .  (child pornography found in temporary internet folders, together with history of searches associated with child pornography, sufficient to show defendant knowingly received images).
State v. Hall, supra.  
The Court of Appeals then explains that after
J. confronted Hall about the exploitative images, but before police seized his computer, Hall reinstalled his computer's operating system, effectively wiping out all of its files. The three videos he was convicted of knowingly possessing were found in the `unallocated space’ of his hard drive. Unallocated space is space on a hard drive that contains deleted data, usually emptied from the operating system's trash or recycle bin folder. The examiner searched this area using specially designed forensic software. Allocated space, on the other hand, is the active space used to store all documents accessible to the user, such as user-created folders, pictures, videos, or Word documents.

A forensic examination of Hall's computer partially recreated the file system as it existed in the allocated space before he reinstalled the operating system. The examiner determined that the three videos Hall was convicted of possessing had been located in a user-created folder on the allocated portion of the hard drive before the operating system was reinstalled.

Additionally, the video viewing software bought by Hall and installed on the computer had been set to automatically scan that folder for content, enabling the user to quickly select and view those videos from within the program; this setting was manually set up by a user. The examiner also was able to retrieve the `modified’ dates associated with each video, which were October 3, August 25, and June 30, 2009. The `modified’ date indicates some manual action regarding the file was undertaken by a user, such as editing, saving, or renaming the file.
State v. Hall, supra.  
The court went on to note that Hall
told police that the computer was his and that only he knew the password. J. testified that Hall occasionally allowed her to use his computer, but that he monitored her whenever she did, she did not know the password, and could not access the computer without his assistance. She further testified she had seen two titles strongly suggestive of child pornography on the history of the media player. The web browser history confirmed Hall was the main user of the computer.

And Hall reinstalled his operating system hours after being accused of watching child pornography by J., which is circumstantial evidence suggesting he may have done so to try to destroy evidence of his activity.
State v. Hall, supra.  
The Court of Appeals therefore found that
viewing the evidence in the light most favorable to sustaining the verdicts, substantial evidence exists from which a reasonable jury could conclude that Hall knowingly possessed the videos on his computer. See State v. Ramsey, supra. . . .  Accordingly, the trial court did not err in denying Hall's Rule 20 motion based on insufficient evidence.
State v. Hall, supra.  
Hall, however, claimed his case was similar to U.S. v. Flyer, 633 F.3d 911 (U.S. Court of Appeals for the 9th Circuit 2011), in which Flyer’s computer was seized after the
Federal Bureau of Investigation determined exploitative photographs shared over the internet originated from his computer. U.S. v. Flyer, supra. The indictment charged Flyer, in relevant part, with possession of child pornography “on or about April 13, 2004,” the same day as the seizure.  Id. The images pertinent to that particular charge were found in the “unallocated space” of Flyer's hard drive when it was seized. Id. 

A forensic analysis could not determine when the files had been created, accessed, or deleted by the user. Id. The government conceded it did not present any evidence that Flyer knew the files were on the unallocated space of the computer or that he possessed the forensic software required to access the files. Id.  The court reversed Flyer's conviction on that count because `[n]o evidence indicated that on or about April 13, 2004, Flyer could recover or view any of the charged images in unallocated space or that he even knew of their presence there.’ Id. 
State v. Hall, supra.  
The Court of Appeals, though, found that the facts in this case
are distinguishable from Flyer. Hall's indictment states he knowingly possessed the videos between June 30, 2009 and November 1, 2009. Although the forensic examiner in Flyer was unable to determine when the images were created, here, the examiner was able to determine the videos were created, modified, and accessible to Hall during the dates listed in the indictment. Thus, unlike Flyer, the state in this case was able to show that, during the time listed in the indictment, Hall was able to `exercise dominion or control’ over the exploitative videos. See § 13–105(34).    
State v. Hall, supra.  
But Hall went on to argue that
`there is no evidence to indicate that the possession occurred during the time periods alleged in the indictment’ due to a fourteen-minute discrepancy in the time stamp of the computer's hard drive between the first and second forensic examination. But the examiner explained the discrepancy likely was due to the two years in between the examinations, which allowed the clock to catch up during that time.

More importantly, he also testified that the actual dates were accurate during both examinations. Hall does not explain why the difference in precise time would necessarily mean the actual recorded dates also were inaccurate. Consequently, the fourteen-minute discrepancy does not support Hall's argument.
State v. Hall, supra.  
Hall, though, also argued that the facts in U.S. v. Kuchinski, 469 F.3d (U.S. Court of Appeals for the 9th Circuit 2006), were
analogous to his case. There, the Ninth Circuit held that a court could not use exploitative images recovered from the temporary cache folder of a computer for sentencing purposes without evidence the defendant had tried to access the cache files or knew of their existence. U.S. v. Kuchinski, supra. The cache folder contains images downloaded automatically whenever a user visits an internet site, and saves those images without any action by the computer user. Id. 

Hall similarly relies on Jensen for his argument that, absent evidence he had actively searched for child pornography on the internet, insufficient evidence supported his conviction. In that case, the defendant was convicted of sexual exploitation of a minor after exploitative images were found on the defendant's computer in the temporary cache folder. State v. Jensen, 217 Ariz. 345, 173 P. 3d 1046 (Arizona Court of Appeals 2008).  

On appeal, the court found sufficient evidence supported the conviction regardless of whether Jensen was aware the images were saved to the cache folder because `he actively searched for those types of images on the computer over an extended period of time, resulting in nearly 25,000 hits for websites containing certain key phrases and combinations of words often associated with child pornography and exploitation of minors.’ Id.  Thus, the court determined, `Jensen's knowledge of receipt of illegal pornography is implicit in his intentional searches for child pornography.’ Id. 
State v. Hall, supra.  
The Court of Appeals was not convinced, explaining that in this case,
unlike the images at issue in Kuchinski and Jensen, the videos Hall was convicted of possessing were not found in the cache folder. In fact, Hall was acquitted of the charges related to exploitative images found in his computer's cache folder. The videos, on the other hand, had been located in a user-created folder; one which had been manually selected by a user to provide content for the video viewing program. And the forensic examiner was able to determine the videos' `modified’ dates, indicating a user had taken some affirmative action regarding those files. These differences make the reasoning of Kuchinksi and Jensen inapplicable to Hall's case.
State v. Hall, supra.  
Finally, Hall argued that the fact
he deleted the videos was insufficient to show he knowingly possessed them. He similarly contends that J.'s testimony that she thought she saw him viewing an exploitative video, but was unsure, was insufficient to support the jury's verdict. `No particular piece of evidence, however, is required as a prerequisite for sufficiency.’ State v. Fulminante, 193 Ariz. 485, 975 P.2d 75 (Arizona Supreme Court1999) (elements of offense must be established beyond a reasonable doubt, but `each supporting fact need not be’).

Rather, this court reviews the entire record in the light most favorable to sustaining the verdicts to determine if a `reasonable person could conclude, beyond a reasonable doubt, that [Hall] was the perpetrator.’ State v. Fulminante, supra. . . . [S]ubstantial evidence, other than Hall's deletion of the files and J.'s testimony, supports the jury's verdicts. And . . . Hall had the opportunity to cross-examine J. and draw her credibility into question.

It was the jury's task to weigh the evidence, resolve any conflicts, and assess the credibility of the witnesses, and we will not re-weigh the evidence on appeal. State v. Cid, 181 Ariz. 496, 892 P.2d 216 (Arizona Court of Appeals 1995) Thus, in light of the substantial evidence supporting the jury's verdicts, we reject this argument.
State v. Hall, supra.  
For these and other reasons, the Court of Appeals affirmed Hall’s convictions and sentences. State v. Hall, supra.  


No comments: