Wednesday, November 13, 2013

Child Pornography, Pop-ups and the "Trojan virus"

-->
After a jury convicted Clark Alexander Mahoney Jr., of possessing child pornography or child erotica in violation of California Penal Code § 311.11(a), the court “granted [him] probation”.  People v. Mahoney, 2013 WL 5648729 (California Court of Appeals 2013).  He then appealed, arguing that “there was insufficient evidence to support the verdict”.  People v. Mahoney, supra.



The opinion explains that on January 4, 2010, Mahoney lived alone “at his home”, where he kept four computers.  People v. Mahoney, supra.  Through a sequence of events not described in the opinion, law enforcement officers seized the computers – a Compaq, a Hewlett Packard laptop, an Apple and an Acer “mini-notebook computer” --on January 4, 2010.  People v. Mahoney, supra.  It also explains, in great detail, what was found on each, as this goes to whether the evidence presented at trial was sufficient to prove Mahoney’s guilt beyond a reasonable doubt.  The paragraphs below summarize what it says on this issue.



On the Compaq computer, the prosecution’s expert found twelve



thumbnail size computer generated images of children having sex with adults. The images had been saved to a folder on the hard drive on October 19 and December 7, 2009, and, subsequently, the folder had been deleted. The prosecution's expert could not determine whether any of the 12 images had been viewed or how they had been deleted. The fact these images had the same creation, modification and last access date suggests they appeared on the screen while the computer user was viewing a website, but the prosecution expert could not say that the computer user opened any images beyond viewing them within Internet Explorer. 

The images had been saved to temporary Internet files. The fact that the December 7 creation time was within four minutes of the last access time suggested that they were consistent with advertisements on a web page. The evidence relating to these images was not admitted to prove the charged offense, but as evidence of [Mahoney’s] intent. . . .



Also on the Compaq were 188 thumbnail images of girls in bikinis or panties with their legs spread, with the focal point of the images being their genitals or buttocks, nine of which were shown to the jury. The images had been saved by the Compaq's operating system to temporary Internet space on the hard drive by the computer user visiting the website on which the images appeared on October 19 and December 7, 2009, and on January 3, 2010, then . . . deleted. The standard user name of `Compaq_ administrator’ was associated with these images. 

A web page for that user name was for [Mahoney]. The images would have come across the computer's monitor, but it could not be determined whether anyone had actually viewed them. . . . Also on the Compaq was a web banner graphic for a child pornography image named, `Real Preteen’ that had eventually been deleted. 

A banner graphic is saved to the hard drive when the computer user goes to the website where the graphic appears. It had been in a temporary Internet file, meaning the image had to have been displayed on a web page and the computer user had to have visited that web page. The same user name as previously mentioned was associated with this graphic as were the above-mentioned dates. . . .



Also on the Compaq were Google Internet searches for web pages associated with child model sites and child erotica-type content, with which the above-mentioned user name was associated and `the user profile identified [Mahoney] as having the email address associated with [this user name].’ They were in unallocated space. The Compaq also contained indicia of a peer-to-peer sharing network that had been used on the computer and a movie file with a title consistent with child pornography content that had been partially downloaded, suggesting that the computer user had either cancelled the download, or deleted it after it had been completed. . . .



People v. Mahoney, supra. 



On the Hewlett Packard laptop officers found sixty-four thumbnail size images of


child porn or child erotica -- nine of them, which depicted young or preteen girls in various states of undress, . . . which could be viewed by the computer user on the screen, were shown to the jury. Because they were in unallocated space, . . . it could not be determined when they were created or deleted. The 64 images had been saved to the hard drive before being deleted. The images could be consistent with an advertising page or the opening page from a model's website showing the content of that website.



The prosecution's expert was not able to say that these images were displayed on the HP's monitor, because they were in unallocated clusters, however, they were consistent with the images he found on the Compaq's hard drive, which he opined had been on its monitor, and with the images he found on the Apple brand computer's (Apple) hard drive (discussed below), some of which had been enlarged by the computer user. 

The HP laptop also contained web banner graphics of four very small images that had been spliced together to make one large, long image of preteen girls in various states of undress. . . . In the opinion of the prosecution's expert, the girls in all of the above-mentioned images were under the age of 18. . . .



Also on the HP laptop were deleted Google searches—the user name associated with them was Clark, which is [Mahoney’s] first name. The text . . . for these searches was . . . `hot preteen models,’ `nude preteen’ and `nude preteen models.’ In his opinion, the images he found on the Compaq, the HP and the Apple (discussed below) were images that would be found if a computer user entered these search terms. Google suggestions, which are suggested search terms that appear when the computer user begins typing a search term into the Google web page, are not saved to the Internet history but they are saved as a temporary file in unallocated space. . . . 
In the prosecution expert's opinion, Google suggestions would not suggest a term like `nude preteen model’ and if a computer user typed `nude’ into a search, a suggestion of `preteen’ would not be made. There were no Google suggestion for `nude preteen.’ When the prosecution's expert typed “preteen nude” into a Google search on this computer, no suggestions related to child pornography or child erotica came up. . . .


People v. Mahoney, supra. 



On the Apple computer, officers found



268 images, which had been deleted, . . . nine [of which were] shown to the jury. . . . Because the 268 images were in unallocated clusters, . . . it could not be determined when they were created or deleted. The nine images shown to the jury were of girls and boys, from infancy to early teen (all under 18), engaged in sexual acts or having their exposed genitals as the focus of the images. 

The images ranged in size from thumbnail to full-size large images. . . . Also on the Apple laptop was a web page banner for the Lolita's Kingdom web page, deleted web pages to Lolita-type sites and child model sites for child erotica and 505 images of child erotica.



People v. Mahoney, supra. Finally, on the Acer officers found “deleted web page entries showing web page names relating to child models or tiny girl pictures.” People v. Mahoney, supra. 



Mahoney apparently argued, in his defense, that a virus was responsible for the images and other materials found on his computers because the opinion explains that in the



[prosecution] expert's opinion, whether the Compaq, the HP or the Apple had a virus would be irrelevant because no virus would cause a Google search for the term `nude preteen’ to be typed in as it was on the HP. Also, the images found on all three of these computers were consistent with the types of Google searches that had been done on the HP (the user name associated with those searches was Clark), and according to the prosecution's expert, a virus would not put those images onto a computer. 

He had never seen a virus put child pornography onto a hard drive, including the virus, Trojan.  He conceded that pop-ups, which are advertisements that appear on the computer screen, could be caused by a Trojan virus.



People v. Mahoney, supra.  (When asked if he found Trojan viruses on the computer, the expert’s response was “`I said I didn't pay any attention to the viruses or Trojans, whether or not they were present.’”  People v. Mahoney, supra.)



 As to pop-ups, the prosecution expert described a “`redirect’” as occurring when a



computer user is on a website and is trying to close the website, but another screen appears, directing the user to another location. At times, a computer user clicks on a page he or she thinks he or she is going to and is actually taken to another page that has different content. 

Typically, these pop-ups or redirects can be viewed by the computer user and the user has to be on the Internet for them to occur. In the expert's opinion, pop-ups or redirects are irrelevant to this case because some user of the HP had to enter the terms `hot preteen models’ and `nude preteen.’ He had never seen a website redirect to child pornography if the computer user was not originally on a child porn site. . . .



People v. Mahoney, supra. 



That brings us to Mahoney’s expert witnesses.  The first testified that “most, if not all,” of the “248 `suspect’ images from the Compaq and the” Hewlett Packard



were from redirects and had not been clicked on and downloaded to either computer. A thumbnail image is saved to a hard drive by the computer user going to the website where the thumbnail image is located, or that website popped up, or the computer user was redirected to that website. Based on his training and experience, a computer user cannot go to a legitimate website and have a pop-up or redirect to child pornography. 



People v. Mahoney, supra. 



Mahoney’s second expert testified “differently from the first,” saying he had seen



legitimate sites redirect to child pornography sites. However, once the computer user is redirected, the redirected-to-website would be seen on the computer screen. He testified that some redirects . . . and some pop-ups . . . are outside the computer user's control and the latter may be so fast the computer user cannot intercept it or see it happening. . . . Concerning only the images on the Compaq that were dated January 3, 2010, he testified most were created within a minute of a particular time and it was the same as the modification time and access time, meaning that none had been clicked on and viewed. 

Based on what he said was the small number of suspected child pornography and child erotica images relative to the total number of images found . . . , the small size of the former images and the fact they were created, modified and accessed at the same time, he opined that they were pop-ups that appeared on some type of web page or ads or thumbnails.



People v. Mahoney, supra. 



The second defense expert also testified that



[o]ne of the five-to-seven viruses on the Compaq was a Trojan, and viruses can cause redirects, but he had never seen a virus that dropped child porn onto a computer. He found `a few’ images of child erotica on the HP and none on the Apple.



People v. Mahoney, supra. 



Mahoney took the stand and denied (i) “he had viewed any of the images that had been shown to the jury”; (ii) “searching for or viewing any sexually explicit images of children or images of children engaging in sexual activity”; and (iii) “knowing any web pages he visited were automatically downloaded to his hard drive.” People v. Mahoney, supra. He claimed “the Apple stopped working in early 2009”, admitted to “using the Compaq on January 3, 2010, . . . but the Internet on it had given him problems.” People v. Mahoney, supra.  He also denied “doing the searches on the HP under the user name Clark for nude preteen models” and “did not recall searching the Internet for images of little girls on January 3, 2010.”  People v. Mahoney, supra. 



In arguing that the prosecution’s evidence was not sufficient to prove his guilt beyond a reasonable doubt, Mahoney claimed “there was insufficient evidence to prove he knew of the existence of the child pornography and erotica images that were in temporary Internet space.”  People v. Mahoney, supra.  In making this argument, he relied on the U.S. Court of Appeals for the 9th Circuit’s decision in U.S. v. Kuchinski, 469 F.3d 853 (2006), in which the court held that “[w]here a defendant lacks knowledge about the cache files, and concomitantly lacks access to and control over those files, it is not proper to charge him with possession and control of the child pornography images located in those files, without some other indication of dominion and control over the images.“ 



This Court of Appeals found that the 9th Circuit’s decision in Kuchinski was factually distinguishable from this case, since in that case there was



no evidence . . . that the defendant was even aware that the automatically downloaded web pages he had viewed were in the cache files of his computer. Moreover, the prosecution expert in Kuchinski testified that even most sophisticated computer users do not know that the web pages they have accessed have been automatically downloaded to his or her hard drive. 



People v. Mahoney, supra. 



The court then explained that there



was no such evidence in this case, but there was sufficient evidence from which this jury could reasonably infer that [Mahoney] knew the web pages he was visiting were being automatically downloaded to his hard drive. That circumstantial evidence was that [he] was a sophisticated computer owner and user, having owned four computers at the time of the search of his home, in addition to 18 other media devices.



Additionally, [Mahoney] testified that he had done `lots and lots [of Internet searches,]’ that he had taken classes on instructional technology, during which he learned how to make and present a PowerPoint presentation, how to put together information on a teacher website, how to use a Smart Boards in the classroom and how to run a projector and that he used a computer to do his lesson plans and play a game. He testified that he used computers both at work and at home.



He conceded that one might have the opinion that he was pretty knowledgeable about computers. The prosecutor identified the central issue in this case for the jury during her argument as follows, `Did the defendant know he possessed those images?’ 

The jury answered this question in the affirmative and there was sufficient evidence to support their implied finding. Kuchinski does not stand for the proposition that just because a web page is automatically downloaded to the hard drive by the system, it cannot be proven that defendant was aware of this.



People v. Mahoney, supra. 



Finally, Mahoney argued that “there was insufficient evidence that he knowingly possessed or controlled the child pornography or erotica images in the temporary Internet space.”  People v. Mahoney, supra.  The Court of Appeals did not agree:



[A]s to the Compaq, the jury could reasonably conclude, based on testimony by the prosecution expert, that on two separate dates, [he] viewed the computer-generated images of children having sex with adults, which could establish [Mahoney’s] intent or knowledge. The jury could also reasonably conclude that [he] viewed 188 thumbnail images of child erotica, the child pornography banner graphic for `Real Preteen’ and pornographic/erotica images of three female children all on three separate dates, as well as 200 additional images of child erotica. 

There were Google searches on the Compaq for child erotica-type content associated with [his] name, a partially downloaded or completely downloaded, then deleted, movie file consistent with child pornography and text in the network program including words related to child pornography and erotica.



On the HP, besides the 64 images of child pornography and erotica and the web banner graphic depicting child erotica, which were consistent with the images on the Compaq and the Apple, were Google searches under a user name associated with defendant for, inter alia, `nude preteen’ and `nude preteen models.’ 

In the prosecution expert's opinion, the images of child pornography and erotica found on all three computers were consistent with searches using these terms. Of the 268 child pornography and erotica images on the Apple, of particular importance were those that had been clicked on and enlarged. Also on the Apple were, inter alia, 505 images of child erotica.



The sheer volume of child pornography or erotica images, along with the Google searches tied to [Mahoney], created sufficient evidence to support the verdict. As the prosecutor poignantly asked the jury, why would the same type of images be on three of defendant's different computers if he did not interface with them?



She used the same argument to contradict the defense claim that the images were the result of a virus -- she asserted it was too much of a coincidence that child pornography and erotica ended up on three different computers as a result of viruses. Two of the three computers had searches for child pornography or erotica on them. While there was a possibility that [Mahoney] had not viewed these images, the jury was free to believe otherwise, based on the other evidence presented.



People v. Mahoney, supra. 



The court therefore affirmed Mahoney’s conviction.  You can read a little more about the prosecution in the news story you can find here.

No comments: