“Trojan Virus” Defense Fails

Several years ago, I did a couple of posts on the Trojan horse defense, i.e., cases in which defendants argued, more or less successfully, that they were not responsible for a crime because they were framed. 

The argument, as I explain in the prior posts, was that they were framed because someone installed a Trojan horse program on their computer and that the program, not the defendant, downloaded child pornography and/or committed some other crime(s).

I recently ran across a recent case in which the defendant made a similar argument, and so decided to do a post about this new invocation of the Trojan horse defense.  The case is U.S. v. Brown, 2012 WL 5948085 (U.S. District Court for the Eastern District of Michigan 2012), and it involves child pornography charges against Matthew Brown.

All I know about the charges, and the facts underlying them, is that on March 10, 2011 Brown was charged with (i) possessing child pornography in violation of 18 U.S. Code § 2252A(a)(5)(B) (Count One) and (ii) receiving child pornography in violation of 18 U.S. Code § 2252A(a)(2) (Count Two).  U.S. v. Brown, supra.  The case went to trial and the jury convicted him on both counts. U.S. v. Brown, supra. 

Brown then moved for a judgment of acquittal pursuant to Rule 29 of the Federal Rules of Criminal Procedure. U.S. v. Brown, supra.  It argued that “the Government failed to present sufficient evidence to support the conclusion that Brown is guilty of knowing possession and receipt of child pornography.”  U.S. v. Brown, supra.  The district court judge began her analysis of his argument by noting that in ruling on such a motion the

court must consider, `whether, after reviewing the evidence in the light most favorable to the prosecution, any rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt.’ U.S. v. Caseer, 399 F.3d 828 (U.S.Court of Appeals for the 6th Circuit 2005). . . The Court is bound to make all reasonable inferences and credibility choices in support of the jury's verdict. . . . 

The question is merely one of legal sufficiency; the court does not substitute its judgment for that of the jury, independently weigh the evidence, or judge the credibility of trial witnesses. U.S. v. Ramirez, 635 F.3d 249 (U.S. Court of Appeals for the 6th Circuit 2011)  There is a strong presumption in favor of sustaining a jury conviction. . . .

U.S. v. Brown, supra. 

The judge began with the possession charge, noting that the government had to prove, beyond a reasonable doubt, that Brown “knowingly possessed child pornography that was transported using interstate or foreign commerce.” U.S. v. Brown, supra.  Brown argued that the prosecution failed to prove he knowingly possessed the digital images found in the family's shared desktop because there was evidence that other adults had

access to the computer, specifically, [his] mother and wife, and the 25 year old babysitter. . . . Brown argues that the Government's evidence regarding undercover LimeWire sessions cannot supply the evidence that the images were stored in the family computer.

Brown notes that the Government's expert witness admitted IP addresses can be hijacked or spoofed and computers can be remotely accessed as a result of malware, making it appear as though a computer is functioning in a way that it is not actually behaving. . . . 

Brown argues that absent any forensic analysis demonstrating that the child pornography images were saved in the allocated and accessible portion of the computer, the Government failed to prove [he] possessed the . . . images.

U.S. v. Brown, supra. 

The government claimed its evidence was sufficient:  It included testimony from FBI Agent Couch, who “recorded an undercover peer-to-peer session using an enhanced version of LimeWire on December 3, 2009”.  U.S. v. Brown, supra.  He downloaded “25 images containing titles consistent with child pornography” from a computer that he determined was located in Brown’s home.  U.S. v. Brown, supra.

And FBI Agent Draudelt testified that he examined the computer seized from Brown’s home and found “LimeWire logs, link files and images of child pornography”. U.S. v. Brown, supra. He testified that “someone had installed the LimeWire program in order to download child pornography, which requires an affirmative action by the user” and that the LimeWire logs “correlated with the images Couch downloaded in his session with the computer on December 3, 2009.” U.S. v. Brown, supra.

The government presented additional, similar evidence.  U.S. v. Brown, supra. It also relied on FBI Agent Bollinger’s testimony that when the agents searched Brown’s home, he “admitted he installed LimeWire on the desktop computer and had used it to download and view child pornographic images.”  U.S. v. Brown, supra.

The judge found Brown had not “carried his heavy burden under Rule 29.”  U.S. v. Brown, supra. She found the evidence was sufficient to support his conviction on the possessing child pornography count.  U.S. v. Brown, supra.  “Brown's argument that there was insufficient evidence presented at trial is not supported, in light of the testimonies of Agents Couch, Kraudelt, and Bollinger.”  U.S. v. Brown, supra. 

She therefore held that the evidence on the possessing child pornography count was sufficient to support the jury’s verdict, and so denied Brown’s motion for a judgment of acquittal on this charge.  U.S. v. Brown, supra. 

The judge then took up Brown’s argument that he was entitled to a judgment of acquittal on the receiving child pornography count.  U.S. v. Brown, supra.  According to the opinion, Brown argued that the prosecution failed to prove that he

knowingly received two files of an identical video through the LimeWire network. Brown asserts there was no evidence showing that the videos were ever opened, viewed, or accessed. Brown argues that the videos were saved on the computer within one to two minutes after the installation of LimeWire.

Brown asserts that a Trojan downloaded virus was also downloaded on the computer via LimeWire at approximately the same time, which was deposited into the same folder, making it possible that the virus resulted in the propagation of the videos and not by a human user of the computer.

Brown states that the same video was downloaded twice -- one into a shared file and the other into an incomplete file, even though the video was fully downloaded and not incomplete. Brown claims it was more probable that a virus caused the downloading of these two identical videos. Brown asserts that his statement to Bollinger does not overcome this lack of proof.

At most, Brown claims he only admitted to viewing 100 photos of child pornography, not videos of child pornography. Brown argues that the jury's verdict on the receipt of child pornography charge should be set aside.

U.S. v. Brown, supra (emphasis in the original).

The prosecution, argued, in response, that the evidence

extracted by [FBI] Agent Kraudelt and Brown's expert, Vassel, supports the guilty verdict that Brown knowingly received the two videos of child pornography. The LimeWire logs confirmed that a user took affirmative steps to download and save the files to the computer.

The Government argues that Kraudelt's testimony that finding a virus in a music file on November 10, 2009, four minutes after the installation of LimeWire did not hinder the functionality of the peer-to-peer program, disputes Brown's claim that a virus downloaded the videos, instead of a human user.

Kraudelt testified that the virus was `inactive’, but the file in which the virus was embedded suggests the file was inadvertently acquired while a user was attempting to download child pornography. 

The Government argues that the testimonies of Kraudelt and Couch, and Brown's own expert, that there exists no virus which would cause LimeWire to download child pornography, absent the direction of a user, support the jury's verdict.

As to Brown's claim that the videos were never opened, the Government argues Brown completely ignored his own expert's testimony that the computer's most recently used files showed that a user at the computer accessed and played one of the saved videos of child pornography, not long before the execution of the search warrant.

U.S. v. Brown, supra. 

The judge ultimately found that, based on the evidence presented at trial

by the Government and the defense, there is sufficient evidence to support the jury's finding that Brown knowingly received child pornography. Without weighing the witnesses' credibility, which this Court cannot do in a Rule 29 motion, the jury's verdict supports the finding that Brown downloaded the two videos of child pornography.

The jury was free to consider the testimonies of the Agents and Brown's own expert as to whether a virus downloaded the child pornography rather than a human user. The jury returned with a verdict of guilty on the receipt of child pornography charge.

U.S. v. Brown, supra. 

She therefore denied Brown’s motion for a judgment of acquittal on the receiving child pornography count.  U.S. v. Brown, supra.