Monday, August 30, 2010

Constructive Amendment, Variance and Thumbnails

As I’ve probably noted before, an indictment is a charging document which alleges that a particular person (the defendant named in the indictment) committed one or more crimes. As Wikipedia explains, an indictment is returned by a grand jury. The 5th Amendment to the U.S. Constitution requires that charges for a “capital, or otherwise infamous crime” (e.g., a felony) be brought by an indictment returned by a grand jury.


This post is about a federal case in which the defendant claimed the prosecution was impermissibly changing the charges contained in the indictment a grand jury returned against him. The case is U.S. v. Vosburgh, 602 F.3d 512 (U.S. Court of Appeals for the 3d Circuit 2010), and this is how it arose:


In July 2006, FBI Agent Wade Luders learned of Ranchi's existence from a suspect in an investigation of . . . child pornography. . . . [Ranchi is an underground Internet message board [that] allows users to post links to images and videos of child pornography.] That suspect authorized Luders to use his Ranchi handle . . . to go undercover on the board. On October 25, 2006, Luders posted six links to what purported to be child pornography. One of those links directed users to a video located at the following address: hxxp:// uploader. sytes. net/ 12/ 05/ 4 yo_ suck. rar. html. . . .


The `4yo_suck’ link . . . was. . . . a dummy link which led only to Luders's FBI computer. . . . [which] generated a log file containing the Internet Protocol addresses of every user who attempted to access the Link, and the date and time of each attempt. Among those who attempted to access the Link was a user at IP address 69.136.100.151. . . . Luders traced this IP address to Comcast Cable Communications. In response to a subpoena, Comcast informed the government that `the individual utilizing the IP address 69.136.100.151 on October 25, 2006 at [the relevant times] did so using an account subscribed to by Rod[erick] Vosburgh, residing at 37 State Rd., Apt. B4’ in Media, Pennsylvania. Luders forwarded this information to Agent David Desy in Philadelphia.


U.S. v. Vosburgh, supra. Desy confirmed that Vosburgh lived at the address given by Comcast and on February 23, 2007 got a warrant to search Vosburgh’s apartment. U.S. v. Vosburgh, supra. The officers who executed the warrant found, and collected, “pieces of smashed thumb drives,” parts of a “destroyed” hard drive and an external hard drive. U.S. v. Vosburgh, supra. An FBI computer forensics expert examined the external hard drive and found it contained a folder with hundreds of pictures of


what the government calls `child erotica” [many of which were pictures of a young Asian girl known as Loli-chan who [has posted] suggestive photos of herself on the Internet. It also contained a folder [that] contained twenty pictures of adult women in .jpeg format and a file called thumbs.db which contained 68 ‘thumbnail’ images. Two of those images were of child pornography [which became government exhibits at trial].


U.S. v. Vosburgh, supra. These images became two government exhibits which were introduced into evidence at trial. The 3d Circuit noted that


these two images did not exist as full-sized, independent picture files (such as .jpeg files) in the jap111 folder when the government seized the hard drive. Nor were full-sized .jpegs of those images recovered anywhere else on the external hard drive. Rather, they existed only as miniatures within the thumbs.db file in the jap111 folder.


U.S. v. Vosburgh, supra. We’ll come back to the thumbnails in a minute.


Vosburgh was charged, among other things, with possessing child pornography in violation of 18 U.S. Code § 2252(a)(4)(B) and was convicted on the charge (Count I of the indictment). U.S. v. Vosburgh, supra. He appealed, claiming “a new trial should be held because there was a constructive amendment of his indictment and/or a variance between the indictment and the evidence at trial.” U.S. v. Vosburgh, supra. As § 236 of the U.S. Department of Justice’s Criminal Resource Manual explains,


[I]ndictments cannot be amended. . . . If the indictment could be changed by the court or prosecutor, it would no longer be the indictment returned by the grand jury. . . . [I]n Russell v. United States, 369 U.S. 749, 769 (1962), the Court pointed out that a consequence of amending the indictment is that the defendant `could be convicted on the basis of facts not found by, and perhaps not even presented to, the grand jury which indicted him.` `Thus, the Fifth Amendment forbids amendment of an indictment by the Court, whether actual or constructive.’ United States v. Wacker, 72 F.3d 1453, 1474 (10th Cir. 1995. . . .


The 3d Circuit noted that an indictment can be constructively amended through evidence, arguments or the court’s jury instructions. U.S. v. Vosburgh, supra. It explained that a “variance occurs `where the charging terms of the indictment are not changed but when the evidence at the trial proves facts materially different from those alleged in the indictment.’” U.S. v. Vosburgh, supra (quoting U.S. v. Daraio, 445 F.3d 253 (U.S. Court of Appeals for the 3d Circuit 2006)). Basically, then, if Vosburgh was convicted of the same offense charged in the indictment based on the same facts that supported those charges, there would be no constructive amendment and no variance.


Vosburgh argued that the government changed its theory of prosecution as to which “visual depictions” of child pornography he possessed:


Vosburgh's arguments rest on his interpretation of the statutory term `visual depiction.’ The relevant definition states that a `visual depiction includes undeveloped film and videotape [or] data stored on computer disk or by electronic means which is capable of conversion into a visual image. . . . ‘ 18 U.S. Code § 2256(5).


Vosburgh argues that a `visual depiction’ is defined, not as a particular image, but as the collection of bytes that is `capable of conversion’ into that image. On that basis, he distinguishes the pornographic thumbnails in the thumbs.db file from the full-sized .jpegs of those same images that once existed in the jap111 folder. He claims that although the thumbs.db images and the full-sized .jpegs possessed on February 22, 2007 are the same pictures of naked children, those pictures are two different `visual depictions’ because each is generated by the computer's conversion of a distinct collection of bytes of data.


According to Vosburgh, he was charged only with possession of the thumbnails in the thumbs.db file, not possession of the .jpegs whose earlier existence was evidenced by those thumbnails. . . . He contends that after the evidence proved he could not have knowingly possessed the thumbs.db versions of Exhibits 14 and 15, the government realized it would not be able to convict him based on his possession of those thumbnails alone. Therefore, it changed course at closing argument: no longer was Vosburgh accused of possessing the thumbs.db images. Instead, he was accused of knowingly possessing, on or around February 22, the full-sized .jpeg versions of Exhibits 14 and 15, with his possession of the pornographic-but-hidden thumbs.db miniatures on February 27 merely serving as evidence of his knowing possession of those full-sized pictures approximately five days earlier. As a result, Vosburgh claims, the prosecution `invited conviction for something the indictment did not charge’ and thereby constructively amended the indictment. In the alternative, he argues that this inconsistency created a prejudicial variance, since he was `misled [and] surprised at trial’ about the exact images that he was on trial for possessing.


U.S. v. Vosburgh, supra (emphasis in the original). The prosecution argued that there was neither a constructive amendment nor a variance:


It maintains that its theory of prosecution was consistent from start to finish, and specifically contends that Count I did not specify whether the `visual depictions’ were the thumbnails in the thumbs.db file or the previously-existing, full-sized .jpegs. Rather, the government argues, Count I notified Vosburgh generally about the illegal `images’ he was charged with possessing, and the specific date of that possession was proved through . . . testimony at trial.


U.S. v. Vosburgh, supra. The Third Circuit agreed with the government:


[Section 2242(2)(4)(B)] does not criminalize the knowing possession of `visual depictions’ of child pornography. It criminalizes knowing possession of `books, magazines, periodicals, films, video tapes, or other matter which contain any visual depiction’ of child pornography. . . . Vosburgh is charged, not with possession of any one particular `visual depiction’ of child pornography, but with possession of `one external hard drive’ . . . that contained visual depictions of child pornography, on or about February 27, 2007. Assuming without deciding . . . the thumbs.db images of child pornography and the corresponding full-sized pictures are different `visual depictions’ within the meaning of the statute, the fact remains that both . . . were depictions of the same underlying images, located on the same external hard drive. The indictment . . . correctly identified the relevant hard drive and images. . . .


U.S. v. Vosburgh, supra (emphasis in the original). The court therefore held that the evidence at trial did not modify the elements of the crime charged, so there had been no constructive amendment of the indictment. U.S. v. Vosburgh, supra. It also found there was no variance:


If the thumbs.db and .jpeg images were . . . different `visual depictions’ of pornography, then the evidence at trial arguably proved facts materially different from those alleged in the government's response to Vosburgh's request for a bill of particulars. The issue is whether that variance `surprised or otherwise . . . prejudiced the defense,’ so as to require reversal. In our view, it did not.


U.S. v. Vosburgh, supra (quoting U.S. v. Daraio, supra). The court also noted that


Vosburgh's expert . . . came to trial prepared to refute the prior possession theory. She conducted a lengthy, in-court computer demonstration attempting to show that a person can possess a particular image in a thumbs.db file without ever having possessed a full-sized .jpeg of that same image on his hard drive. We think the fact Vosburgh's expert came to trial prepared with a powerful demonstration contradicting the government's theory of prosecution shows Vosburgh knew exactly what that theory was well before closing argument.


U.S. v. Vosburgh, supra. The 3d Circuit therefore found that even if there had been a variance between the indictment and the evidence presented at trial, the record showed that Vosburgh “prepared a strong defense that belies any claim of . . . surprise at trial.” U.S. v. Vosburgh, supra. It therefore denied his motion for a new trial. U.S. v. Vosburgh, supra.


6 comments:

Aram ZS said...

Interesting. As part of our training in network and computer security, I took a computer forensics class and one of the methods they taught us and mentioned repeatedly throughout the class was examining the thumbs.db file.

Is there precedent stating that the thumbs.db file and the images within are not sufficient as proof of previous ownership of the images? I'd be interested in hearing what his expert said to refute that as I'm hard pressed to think of a situation in which one can have images indexed in their thumb.db file which were never on their computer. I suppose that, there may be a situation in which one copies a thumbs.db file and it hasn't updated yet? Still, it would mean that the actual images had, at one point, been accessible by his computer.

Susan Brenner said...

It's a good question (re ownership).

I did a little very quick research and didn't see an obvious answer.

I'll look into it and if I can find enough for a blog post, I'll do one on that issue. If not, I'll let you know what, if anything, I find.

Anonymous said...

You missed what this case was really about. This case is much more scarier then what it seems from your post. Please check this out. http://news.cnet.com/8301-13578_3-9899151-38.html

Anonymous said...

[an interesting excerpt from the concurring opinion]

It is not disputed that when it applied for the search warrant,
the government had no idea, much less evidence, that Vosburgh
had ever possessed child pornography. All it knew was that during a two-minute period of time on one day in Vosburgh’s life, he
attempted to access the Link, and was unsuccessful. That’s it.


Given how little the government knew about Vosburgh, it somehow
believed it appropriate to spend the first fifteen pages of the
eighteen-page affidavit supporting the warrant application with
what it conceded was “boilerplate” – boilerplate which anything
but subtly suggested that Vosburgh, whose name was never mentioned, was someone the government had no reason to believe that he was – a “collector” of child pornography, a child pornographer, and perhaps even a pedophile. Moreover, the
boilerplate went into considerable detail describing, for example,
the “collection” of the “collector” as revealing his “private sexual
desires and intent” and representing his “most cherished sexual fantasies involving children,” and into graphic detail describing the numerous ways in which those fantasies can be turned into reality, including the sexual gratification a collector may derive
from actual physical contact with children.

The only purpose of those many pages of boilerplate was to assure that the warrant issued. Although there was not even an allegation that Vosburgh ever possessed child pornography, there was reason to
believe he was nonetheless a “collector” or, at least, he “could be.”

Stu said...

@ARAM ZS:

What about a hypothetical situation in which A possesses an external hard drive with a folder containing images of child pornography and a thumbs.db file with thumbnails of those images. Further suppose the drive also has a folder containing innocuous files. A later deletes the images but not the folder, leaving the thumbs.db file intact.

Now suppose B borrows A's external hard drive to obtain the innocuous files, but without knowing the contents of the other folder, simply copies the entire contents of the drive onto his or her computer. Would B not then be in possession of a thumbs.db file with thumbnails of illegal images that he or she never had access to?

Of course you could argue that B didn't knowingly possess the thumbnails, but I think this would be an example of the situation you were curious about, would it not?

Susan Brenner said...

Thanks, Stu!