Wednesday, April 17, 2013

Computer Repair, Child Pornography and the Virus

After a jury convicted Charles D. Sprunger of “sexual exploitation of a minor” in violation of Tennessee Code § 39-17-1003 and the judge sentenced him to eight years in prison, with no prospect of early release, he appealed.  State v. Sprunger, 2013 WL 1385708 (Tennessee Court of Criminal Appeals 2013).   

The charge was “based on the discovery on his computer of more than 100 images of minors engaging in sexual activity”.  State v. Sprunger, supra. 

This, according to the opinion, is how the case began, in July of 2008:

Tammy Arellano. . . was working for a certified public accountant in Crossville. The accountant's stepson, McKinley Tabor, rented a space in the office for his computer repair business. Arellano said that her desk was positioned . . . so anyone coming to Tabor's office had to pass by her. She said the usual practice for Tabor's customers was to leave their computers with their name and telephone number on a table in front of her against the wall beside Tabor's office.

On July 8, [Sprunger] came in with his computer, saying he had talked to Tabor on the phone. [Sprunger] placed the computer on the designated table and attached a note with his name and phone number.

Tabor, an outsourced IT manager, . . . provided computer repair and consulting services, primarily for corporations. He also had a small office where individuals brought their computers for repair. 

On July 4, Tabor received a phone call from a man who identified himself as `Chuck’ and said he needed Tabor to restore data from the hard drive of his computer. Tabor told the man to bring the computer to his office the following Monday morning.

The man telephoned Tabor at 1:00 p.m. that Monday and gave him the password so he could start the computer. While the computer was starting up, Tabor and the man discussed what material he wanted Tabor to restore. Tabor then noticed an icon on the computer indicating that files were waiting to be written to CD.

The man asked Tabor to restore a specific program, as well as a Microsoft Money file. While the man was still on the phone, Tabor opened a folder on the computer to see if it contained the missing program. 

However, the folder actually contained photographs of `what appeared . . . to be pre-pubescent girls engaged in sexually suggestive poses and one of them appeared to be engaged in a sex act with an adult.’

Tabor told the man he would call him back and then notified the police. After the police arrived, the folder containing the files waiting to be written to CD was opened, and it contained images of the same nature as the ones Tabor had found earlier. 

Tabor turned the computer over to Investigator Haynes [of the Cumberland County Sheriff’s Department].

State v. Sprunger, supra. 

At Tabor’s trial, Haynes testified that he went to

Tabor's repair shop on July 8, to investigate `a computer there with . . . possible child pornography images on it.’ Tabor hooked up the computer and `brought up a page of images that appeared to be young people, eight, ten, twelve, fourteen years old, engaged in various sex acts and some in erotic poses.’ 

Haynes identified in court the computer he received from Tabor's shop and said he subsequently delivered it to the Tennessee Bureau of Investigation (`TBI’) for forensic analysis.

State v. Sprunger, supra. 

Melanie Garner, a “certified computer examiner since 2007 and a “special agent criminal investigator in the Technical Unit of the TBI,” also testified, explaining that she

conducted a forensic analysis on [Tabor’s] computer and found several folders containing sexually explicit images of young children. The images were in a backup folder dated April 7, 2008, on the main drive of the computer under `owners documents.’ . . .

Garner also found images of a young girl stored in a temporary folder waiting to be written to a CD. Garner identified a DVD containing a portion of the images retrieved from the original hard drive of the computer. Eight images were found in one folder and 120 images in another folder.

She said the images had a `fingerprint,’ meaning “basically a number, but it's a very long number and it's a unique fingerprint to that hard drive. And so that is how you verify that it's the same image.’ The fingerprint of the images linked them to [Tabor’s] computer.

Garner said that, in her expert opinion, the images recovered from [his] computer were not the result of a virus. She [said] she had never seen a virus organized in a manner that would create different folders on a computer and that the files were found in a backup folder, `which is not typical if the virus is going to attack a computer, not typical that it will attack your backup folder.’

Further, a number of the images were located in an `allocated,’ meaning `that space where these are deleted out of the recycle bin, they are put in an allocated,’ and Garner had never seen a virus attack an allocated space. For a file to take this path and end up in an allocated, an individual had to physically take control of the computer. Garner said she was `very confident’ because of the verification of the fingerprint of the hard drive that all of the images came from [Tabor’s] computer.

On cross-examination, asked if it would have been simpler for a hacker to have put the images on the computer rather than a virus, Garner said `it would not be simpler.’ She said there was no evidence a hacker had placed anything on the hard drive of [Tabor’s] computer `[b]ecause you can see in the operating system of the computer.’

State v. Sprunger, supra. 

Haynes testified that he got a search warrant, which officers executed at Tabor’s home, a house he said was “located in a `completely secluded area surrounded by `woods, underbrush.’”  State v. Sprunger, supra. They searched the house, which “`was in “absolute total disarray, just junk, dirty clothes, bags of trash”’”. State v. Sprunger, supra. 

“Between 500 and 1000 DVDs were” on shelves along the walls.  State v. Sprunger, supra. The officers “confiscated a desktop computer in the upstairs loft area and two laptop computers in a downstairs closet.” State v. Sprunger, supra. Haynes said the officers “did not find any pornography in” Tabor’s home.  State v. Sprunger, supra

Tabor, the “forty-two-year-old defendant”, testified at trial that he worked between

seventy and eighty hours a week at his landscaping business and acknowledged that he was a recluse. He said he occasionally had guests, but they had nothing to do with his computer. He said he bought and watched movies because he did not have cable television. 

He had Internet service but discontinued it the day after Haynes came to his house. He denied ever seeing the images on his computer and said he did not know how they had gotten onto his computer.

He said that the only thing he had ever burned from his computer was `an annoying pop-up that said do you want to make a back-up of this computer, or a system backup or something like that. And the thing kept popping up every time I turned the computer on, I got tired of it and I burned it.’

State v. Sprunger, supra. 

On appeal, Sprunger argued that the evidence presented at trial was not sufficient to support his conviction, i.e., did not prove beyond a reasonable doubt that he violated Tennessee Code § 39-17-1003.  State v. Sprunger, supra.   

The appellate court began its analysis of his argument by noting that § 39-17-1003 “makes it a Class B felony for `any person to knowingly possess material that includes a minor engaged in (1) [s]exual activity; or (2) [s]imulated sexual activity that is patently offensive . . . [i]f the number of individual images, materials, or combination of images and materials, exceeds one hundred (100).’” State v. Sprunger, supra. 

The Court of Criminal Appeals also explained that because a

jury conviction removes the presumption of innocence with which a defendant is initially cloaked and replaces it with one of guilt, on appeal a convicted defendant has the burden of demonstrating that the evidence is insufficient. . . . Thus, we must consider `whether, after viewing the evidence in the light most favorable to the prosecution, any rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt.’ Jackson v. Virginia, 443 U.S. 307, 319 (1979).

State v. Sprunger, supra. 

It also noted that

[a]ll questions involving the credibility of witnesses, the weight and value to be given the evidence, and all factual issues are resolved by the trier of fact. See State v. Pappas, 754 S.W.2d 620 (Tennessee Court of Criminal Appeals 1987). `A guilty verdict by the jury, approved by the trial judge, accredits the testimony of the witnesses for the State and resolves all conflicts in favor of the theory of the State.’ State v. Grace, 493 S.W.2d 474 (Tennessee Supreme Court 1973).

State v. Sprunger, supra. 

As to the rationale for the rule concerning the credibility of witnesses, the Tennessee Supreme Court explained, in an earlier case, that it

`rests on a sound foundation. The trial judge and the jury see the witnesses face to face, hear their testimony and observe their demeanor on the stand. Thus the trial judge and jury are the primary instrumentality of justice to determine the weight and credibility to be given to the testimony of witnesses. In the trial forum alone is there human atmosphere and the totality of the evidence cannot be reproduced with a written record in this Court.’

State v. Sprunger, supra (quoting Bolin v. State, 219 Tenn. 4, 405 S.W.2d 768 (1966)).

The Court of Criminal Appeals then applied these principles to the evidence in this case and concluded that

[v]iewed in the light most favorable to the State, the evidence established that [Sprunger] took his computer to McKinley Tabor's repair business where Tabor discovered numerous photographs of `what appeared . . . to be pre-pubescent girls engaged in sexually suggestive poses and one of them appeared to be engaged in a sex act with an adult.’

TBI Special Agent Garner . . . analyzed [Sprunger’s] computer and found over 100 sexually explicit images of young children. She testified that the fingerprint of the images specifically linked them to [Sprunger’s] computer and that there was no evidence the computer had been infected with a virus or that someone had hacked into it.

[Sprunger] told Haynes he had viewed pornography on the Internet and lived alone and was the only one who had access to his computer. [Sprunger] testified that he was the only one who used the computer, and Tabor testified that [he] had provided him with the password to start the computer. We conclude, therefore, that the evidence is sufficient to sustain [Sprunger’s] conviction.

State v. Sprunger, supra. 

Unfortunately, I do not have access to the appellate briefs in this case, so I can only surmise that, based on the court’s comments about viruses and hackers, Sprunger relied primarily on the SODDI defense.  That is, that he relied, at least in part, on the theory that someone else – using a virus or hacking into his computer – was responsible for the child pornography found on his computer.

If you would like to read a little more about the trial, check out the news story you can find here. 

No comments: