Friday, February 25, 2011

Unallocated Space Insufficient to Establish Possession

As I’ve noted in earlier posts, the issue of whether a defendant “possessed” child pornography has, in some case, come down to the issue of whether images stored in a computer’s cache files constitute possession. This post is about a case that raises a similar, but somewhat different, issue.

The case is U.S. v. Flyer, __ F.3d __, 2011 WL 383967 (U.S. Court of Appeals for the 9th Circuit 2011), and it arose on March 9, 2004, when FBI Special Agent Robin Andrews

initiated a session on LimeWire. . . . Andrews launched LimeWire and typed in the search term `PTHC,’ an apparent acronym for `pre-teen hardcore,’ a term associated with child pornography. She identified a file titled `O-KIDDY-PTHC BW025.jpeg’ and selected a host computer that appeared to have the file available for download. Andrews clicked `browse host,’ a LimeWire feature that allows users to view all the files available for download from a host computer's `share’ folder.

The host computer Andrews had selected listed 261 files available for download, including around twenty files with titles associated with child pornography. Andrews downloaded `O-KIDDY-PTHC BW025.jpeg’ from the host computer. She tried to download a second file . . . but was unsuccessful.

On March 10, Andrews . . . again used LimeWire to search . . . `PTHC’ and determined that the same host computer had sixty files available for download with titles associated with child pornography. Andrews downloaded one file containing such a title, and tried, but was again unable, to download a second file. . . .

Andrews identified the Tucson address associated with the host computer by contacting an internet access provider in Arizona. [Andrew] Flyer lived at the Tucson address, along with his father, mother, and sister.

After securing a warrant, agents executed a search of the property on April 13, 2004. They seized from Flyer's bedroom a Gateway computer, loose media . . . and an Apple laptop. . . .

Flyer . . . admitted . . . he used the Gateway computer and Apple laptop in his bedroom, had downloaded, saved, and shared child pornography . . . and knew it was illegal to possess. . . . [He] admitted to having saved a minimal amount of child pornography onto his shared folder on LimeWire and around one hundred child pornography files on a computer.

U.S. v. Flyer, supra.

Flyer was charged with and convicted of “two counts of attempted transportation and shipping of child pornography (Counts One and Two); one count of possession of child pornography on the unallocated space of a Gateway computer hard drive (Count Three); and one count of possession of child pornography on CDs (Count Four)”, all in violation of 18 U.S. Code § 2252. U.S. v. Flyer, supra. He appealed, arguing that “the evidence was insufficient to establish the jurisdictional and intent elements of his convictions on Counts One and Two and the possession element of his conviction on Count Three.” U.S. v. Flyer, supra. (He apparently abandoned an earlier “challenge to the jurisdictional element of Count Four . . . at oral argument” on appeal. U.S. v. Flyer, supra.)

Later, I’ll say a bit about Flyer’s arguments on Counts One and Two, but this post is primarily about the Count Three possession charge. As noted above, Flyer claimed that the evidence presented at his jury trial was not sufficient to support his conviction for

possession `on or about April 13, 2004’ of child pornography on the Gateway computer in violation of 18 U.S. Code § 2252(a)(4)(B). . . . [which] provides that any person who `knowingly possesses . . . with intent to view, 1 or more books, . . . videotapes, or other matter’ containing visual depictions of a minor engaged in sexually explicit behavior shall be punished. . . . Flyer contends that the evidence is insufficient to establish that he `possesse[d]’ the files.

U.S. v. Flyer, supra.

The 9th Circuit began its analysis of Flyer’s argument by noting that “possession” is

`”[t]he fact of having or holding property in one's power; the exercise of dominion over property.”’ U.S. v. Romm, 455 F.3d 990, 999 (9th circuit 2006) (quoting BLACK'S LAW DICTIONARY 1183 (7th ed.1999)). `[T]o establish possession, the government must prove a sufficient connection between the defendant and the contraband to support the inference that the defendant exercised dominion and control over [it].’ Id. (internal quotation omitted) (alteration in the original).

U.S. v. Flyer, supra. It then explained that the images charged in Count Three were all

in `unallocated space’ on the Gateway hard drive. Unallocated space is space on a hard drive that contains deleted data, usually emptied from the operating system's trash or recycle bin folder, that cannot be seen or accessed by the user without the use of forensic software. Such space is available to be written over to store new information. Even if retrieved, all that can be known about a file in unallocated space (in addition to its contents) is that it once existed on the computer's hard drive. All other attribute -- including when the file was created, accessed, or deleted by the user -- cannot be recovered.

Files in unallocated space differ from cache files, which are a `set of files kept by a web browser to avoid having to download the same material repeatedly ... so that the same images can be redisplayed quickly when you go back to them.’ [U.S. v. Romm, supra.] Cache files are located in `an area to which the internet browser automatically stores data to speed up future visits to the same websites.’ [U.S. v. Romm, supra.] The user does not manually save the cache files, but can access them and `print, rename, [or] save [them] elsewhere, the same thing [he or she could] do with any other file’. . . . [U.S. v. Romm, supra.]

U.S. v. Flyer, supra.

Flyer argued (i) that “there was insufficient evidence to establish that he exercised dominion and control over the images recovered from the unallocated space on the hard drive” or (ii) that “even if he could be said to have `possessed’ the images before their deletion, no evidence indicated that the possession occurred during the time period charged in the indictment.” U.S. v. Flyer, supra. The Court of Appeals noted that its “precedent relating to cache files suggests that a user must have knowledge of and access to the files to exercise dominion and control over them.” U.S. v. Flyer, supra.

In Romm, supra, the 9th Circuit affirmed Romm’s conviction for possessing of child pornography images “deleted from the internet cache of his computer” because it found he had “`access to, and control over, the images . . displayed on his screen and saved to his cache.’” U.S. v. Flyer, supra (quoting U.S. v. Romm, supra). In U.S. v. Kuchinski, 469 F.3d 853 (9th Circuit 2006), the 9th Circuit held that it “could not consider images recovered from the cache” for sentencing when “no evidence indicated the defendant had tried to access the cache files or knew of their existence.” U.S. v. Flyer, supra.

Based on these precedents and its review of other cases, the 9th Circuit found that

Flyer's conviction must be reversed. . . . The government concedes that it presented no evidence Flyer knew of the presence of the files on the unallocated space of his Gateway computer's hard drive. The government also concedes it presented no evidence that Flyer had the forensic software required to see or access the files. Unlike Romm, there is no evidence here that Flyer had accessed, enlarged, or manipulated any of the charged images, and he made no admission that he had viewed the charged images on or near the time alleged in the indictment.

U.S. v. Flyer, supra.

The government argued, in response, that “evidence demonstrating that the files had at some point been deleted, resulting in their placement in unallocated space, is sufficient to establish possession.” U.S. v. Flyer, supra. The government relied on the 11th Circuit Court of Appeals’ decision in U.S. v. Shiver, 305 F. App’x 640 (2008), “for the proposition that one method for a defendant to exercise dominion and control over an image is to destroy a copy of the image located on his computer.” U.S. v. Flyer, supra.

The 9th Circuit found, however, that the

deletion of an image alone does not support a conviction for knowing possession of child pornography on or about a certain date within the meaning of § 2252(a)(4)(B). No evidence indicated that on or about April 13, 2004, Flyer could recover or view any of the charged images in unallocated space or that he even knew of their presence there.

U.S. v. Flyer, supra. The court therefore reversed Flyer’s conviction on Count Three. U.S. v. Flyer, supra.

And now a bit about Counts One and Two which charged Flyer with attempted transportation and shipping of child pornography. As I also noted above, on appeal he argued, in part, that the evidence presented at trial was not sufficient to establish the jurisdictional elements of his convictions on these two counts. U.S. v. Flyer, supra.

In ruling on his argument, the court noted that it had held, in a case involving a statute with a jurisdictional element “effectively identical to that under which Flyer was charged in Counts One and Two”, that the prosecution must show “actual transportation of child pornography across state lines.” U.S. v. Flyer, supra. That was a problem in this case:

[T]he government concedes that it presented no evidence at trial directly showing that the two files downloaded by Andrews traveled across state lines. Furthermore, Flyer cites uncontroverted expert testimony that a file shared between two users through LimeWire would not leave Tucson if, as here, both the host computer and recipient were located within that city. Andrews' intra state download of files from Flyer's computer cannot by itself . . . provide sufficient evidence to convict Flyer of attempting to cause those files' inter state or foreign movement.

U.S. v. Flyer, supra (emphasis in the original).

The court therefore reversed his convictions on Counts One and Two (and consequently did not reach his other argument that the evidence did not establish “the requisite specific intent for the crime”). U.S. v. Flyer, supra. It also remanded the case for sentencing on the only remaining count: Count Four. U.S. v. Flyer, supra.


Steve said...

So to prove possession at a certain time, does the prosecution normally have to prove that an undeleted file was accessed at a certain time?

Anonymous said...

I am glad to know that FBI agents have so much extra time on their hands that they can just sit around and surf the interwebs for dirty pictures. Those morons haven't done shit to protect us from terrorists! It has all been private citizens who have 'seen something, said something' or passangers on airliners jumping on shoe bombers and underware bombers.

We need to fire all those clowns and get new agents who protect us from real crimes!!

Did you see the part where Agent Robert J. Meshinsky addmitted to committing perjury during the trial with regards to his copying of the hard drive? Why didn't this loser go to jail, too?

FYI - It seems that 2004 was a bad year for Agent Andrews. This wasn't the only case kicked on appeal due to her screw ups.

Fima Fimovich said...

Some defendants are also blaming browser hijackers for putting illegal material on
their hard drives. In one widely reported case, a former citizen of the Soviet Union who prefers
to be known only as “Jack” was charged with possession of child pornography after twelve
pictures were found on the hard drive of his personal laptop. Traces of browsed sites can remain on computers, and it’s difficult to tell from
those traces whether a user willingly or mistakenly viewed a website. When those
traces connect to borderline-criminal websites, people may have a hard time
believing that their employee . . . hasn’t been spending an awful lot of time
cruising adult sites.
In response to a recent Wired News story about the CWS browser hijacker,
famed for peddling porn, several dozen readers sent e-mails in which they
claimed to have lost or almost lost jobs, relationships and their good reputations
when their computers were found to harbor traces of pornography that they insist
were placed on their computers by a browser hijacker.
see also Michelle Delio, Browser Hijackers Ruining Lives, Wired News, at,1377,63391-2,00.html (May 11, 2004). Jack claims
a browser hijacker must have downloaded the files to his laptop, pointing to the fact that police
found no pornography—“not even a Playboy magazine”—when they searched his house. Id.
Jack eventually pled guilty because, he says, no one would listen to his claims of innocence and
his lawyer told him he would receive a much harsher sentence if he went to trial; he received
three years felony probation and now has a felony sex conviction, which will make it difficult
for him to find employment. See id. The evidence in Jack’s case is somewhat ambiguous
because “[s]ome of the images were found in unallocated file space, and would have to have
been placed there deliberately since cached images from browsing sessions wouldn’t have been
stored in unallocated space.” Id. It is clear, though, that browser hijackers can leave traces of
embarrassing or illegal content on hard drives:
Browser hijackers are malicious programs that change browser settings,
usually altering designated default start and search pages. But some, such as
CWS, also produce pop-up ads for pornography, add dozens of bookmarks—
some for extremely hard-core pornography websites—to Internet Explorer’s
Favorites folder, and can redirect users to porn websites when they mistype

Fima Fimovich said...

came to US as Refugee on Human rights violations
in former USSR.
I had my rights violated again in Minnesota.
I was convicted for p..rn possession in 2003, felony
conviction and placed on s..x offender register in Minnesota. There was
the same situation: promise 100 years in prison if
I was not plead guilty.
Here you can find description

Since 2003 as you may understand I can not find job, only short terms
Here you can find comparison of my situation as Jew pariah in USSR
and predator pariah in US