Child Pornography, Slack Space and “Possession”

After a “general court-martial composed of officer and enlisted members convicted [Shane A. Nichlos] . . . of two specifications of knowingly possessing child pornography in violation of Article 134, Uniform Code of Military Justice, 10 U.S.C. § 934”, and he was sentenced to “reduction to pay grade E–1, confinement for a period of six months, and a bad-conduct discharge”, he appealed. U.S. v. Nichlos, 2014 WL 4658951 (U.S. Navy-Marine Corps Court of Criminal Appeals 2014).  Nichlos raised four issues on appeal, but this post only examines two of them:  “that the military judge abused his discretion in failing to suppress evidence obtained from [Nichlos’] portable hard drive . . . based on an unconstitutional seizure; that his conviction for knowing possession of child pornography is legally and factually insufficient”.  U.S. v. Nichlos, supra.

The Court of Criminal Appeals began its analysis of the issues by explaining how the prosecution arose:

[Nichlos] was stationed at U.S. Fleet Activities Sasebo, Japan, aboard USS ESSEX (LHD 2). Following his promotion, [he] was required to find off-ship living accommodations. He secured a lease at an apartment building. While waiting for his lease to start, he stayed with a friend, Fire Controlman Second Class (FC2) SW. [Nichlos] was given a spare bedroom in which to sleep and store his personal belongings. Other petty officers also stayed at FC2 SW's apartment. The apartment had a common area that was used as a `crash pad’ and `an awful lot of people’ would use [it] as a place to `hang out.’ . . .

Intelligence Specialist Third Class (IT3) MD, a good friend of FC2 SW, also stored personal belongings at FC2 SW's apartment. On Thursday, 12 May 2011, IT3 MD picked up his laptop computer, a computer game, and several portable computer hard drives from FC2 SW's apartment. This gear had been stored in the common area of the apartment. One of the hard drives he believed was his and took with him was made by Western Digital. He brought his laptop, the portable hard drives, and other electronic media to his new apartment.

A day or so later, IT3 MD wanted to watch a movie. Knowing he had movies stored on his Western Digital hard drive, he accessed it and immediately realized it was not his hard drive, because he saw approximately 50 thumbnail images of young nude girls. He specifically recollected viewing an image of several young nude girls arranged in a cheerleader-type pyramid. Disturbed by the images he saw and initially thinking that he had inadvertently grabbed a portable hard drive belonging to FC2 SW, his good friend, IT3 MD accessed the root directory and ascertained that the hard drive belonged to [Nichlos].

The following Monday, still disturbed by the images he had seen, IT3 MD sought guidance from the ship's legalman chief and was advised to speak with the ship's security department. After informing security department personnel that he believed he had a portable hard drive with suspected child pornography, IT3 MD was told to retrieve the hard drive and bring it back to security department personnel.

Security department personnel contacted the Naval Criminal Investigative Service (NCIS) regarding IT3 MD's allegations and then turned the portable hard drive over to the NCIS. Special Agent LG received the Western Digital hard drive at approximately 1405 on Monday, 16 May 2011. At approximately 1430, IT3 MD signed a written sworn statement for Special Agent JP, who was working the case with Special Agent LG. . . .

At approximately 1730 that same day, NCIS agents interviewed [Nichlos]. During that interview, [he] gave consent to search his workspace aboard ESSEX, his living space at FC2 SW's apartment, and all his electronic media, to include his iPhone. He accompanied the NCIS agents to FC2 SW's apartment and cooperated fully throughout the process.

In addition to the Western Digital hard drive, NCIS agents seized [Nichlos’] Alienware laptop and iPhone, along with other electronic media. [His] electronic media items were sent to the Defense Computer Forensic Laboratory (DCFL) for forensic analysis. Forensic analysis revealed video files and digital images of child pornography [Nichlos’] laptop. It also revealed digital images of child pornography on [his] portable hard drive.

U.S. v. Nichlos, supra.

Nichlos argued, first, that the military judge erred by not suppressing the evidence obtained from his portable hard drive because it was seized and searched in violation of the 4^th Amendment. U.S. v. Nichlos, supra.  As Wikipedia explains, the 4^th Amendment gives U.S. citizens a right to be free from “unreasonable” searches and seizures. As Wikipedia also explains, a 4^th Amendment “search” occurs when law enforcement or other government conduct violates a reasonable expectation of privacy in a place or thing.  Wikipedia also notes that to have such an expectation of privacy, the person claiming to be the victim of an unreasonable search must have had (i) a subjective expectation of privacy in it (e.g., Nichlos must have believed that the hard drive was “private”) and (ii) society must accept that expectation of privacy as “reasonable.”

The Court of Criminal Appeals rather quickly dismissed Nichlos’ “search” argument, explaining that

[d]espite the fact that [Nichlos] had a bedroom at FC2 SW's apartment and stored his laptop there, he chose to leave his portable hard drive in an area where, by his own admission, `an awful lot of people’ would `hang out’ and access one another's electronic media. . . . The hard drive was neither labeled nor password protected. It was also similar to other portable hard drives located in the common area, to include the hard drive belonging to IT3 MD as evidenced by the fact that he mistakenly took it.

Additionally, the ease by which IT3 MD accessed [Nichlos’] portable hard drive and its child pornography images is further evidence that [he] did not have a reasonable expectation of privacy in this hard drive. See U.S. v. Barros, 481 F.3d 1246 (U.S. Court of Appeals for the 10th Circuit 2007) (holding that Barrows's `failure to password protect his computer, turn it off, or take any other steps to prevent third-party use’ demonstrated a lack of subjective expectation of privacy).

Based on the facts of this case, we conclude [Nichlos] did not have a subjective expectation of privacy in his portable hard drive left in the common area of FC2 SW's apartment. Additionally, we conclude -- at least with regard to the various Sailors who had unfettered access to FC2 SW's apartment and common area -- that [his] expectation of privacy was not objectively reasonable.

In this case, the military judge appeared to conclude that at the time IT3 MD took the portable hard drive, [Nichlos] had no expectation of privacy because he had left it in the common area. . . . However, as the testimony and facts developed, the military judge appeared to conclude that once IT3 MD was directed to retrieve [Nichlos’] hard drive, IT3 MD became a Government actor and this resulted in [Nichlos] developing a reasonable expectation of privacy. . . . We disagree and hold that [Nichlos] did not gain a reasonable expectation of privacy at the time IT3 MD was directed to deliver the hard drive to security personnel. . . .

U.S. v. Nichlos, supra.           

The court then took up Nichlos’ second argument on appeal, i.e., that

his conviction for knowingly possessing child pornography is factually and legally insufficient. First, [Nichlos] argues that since the three charged video files from his Alienware laptop computer were found in unallocated space the evidence was insufficient to prove `knowing possession.’ Second, [he] argues that because the digital images from his hard drive were found among nearly a thousand adult pornography images, this was insufficient to prove knowing possession. 

U.S. v. Nichlos, supra.

The appellate court began with the first argument, noting that Nichlos was charged with three “three specifications alleging [his] knowing possession of child pornography on or about 16 May 2011: three video files from [his] laptop (Specification 1); three digital images from the laptop (Specification 2); and, nine digital images from [his] portable hard drive (Specification 3).” U.S. v. Nichlos, supra. NIchlos argued, at trial, that the evidence

was insufficient to prove knowing possession in that the video files and some of the digital images had been forensically retrieved from the unallocated space of [Nichlos’] laptop and portable hard drive with no evidence as to when the files were created, accessed, or deleted.

The military judge partially agreed and acquitted [him] of the three digital images that served as the basis for Specification 2. With regard to Specification 3, the military judge acquitted [Nichlos] of seven digital images, which had been retrieved from the unallocated space on [his] portable hard drive. Because only images 8 and 9 had been retrieved in allocated space, the military judge allowed the members to consider these two images and the members convicted [Nichlos] of this specification.

U.S. v. Nichlos, supra.

The court then analyzed Nichlos’ sufficiency of the evidence argument as to the

three charged video files that were retrieved from unallocated space on [his] laptop. [Nichlos] does not contest that the girl in the three video files is, in fact, a minor. . . . Additionally, this minor is clearly involved in a sexual act and each video file is of the same minor girl. The trial counsel played a fourth video file pursuant to MIL. R. EVID. 404(b) of the same minor girl. This movie clip had a superimposed annotation in the middle of the screen with the following: `Jenny 9yo all clips.’ It was this linkage to `Jenny 9yo’ that provided the strongest circumstantial evidence of [Nichlos’] knowing possession of the three video files in unallocated space appearing to portray `Jenny 9yo.’

The Government presented a circumstantially strong case that [he] had, at some point, received, downloaded, and viewed child pornography videos. The Government called Ms. SH, a forensic expert with the Defense Computer Forensic Laboratory DCFL. In addition to her testimony, the Government relied on the forensic exploitation of [Nicklos'] laptop, portable hard drive, and iPhone to present its case.

First, the Government offered Prosecution Exhibit 3, a DCFL forensic report of [Nichlos’] iPhone. This exhibit contained three cookies revealing that on 24 December 2010, [he] had used the Google search engine and searched for and accessed a website responsive to [his] search term: `9yo Jenny pics.’

Second, the Government offered PE 4, a list of property files from LimeWire that contained the most recently downloaded files to [Nichlos’] laptop. These LimeWire property files were retrieved from unallocated space on [his laptop; however, the search terms that [he] entered and downloaded were highly indicative of child pornography and some of the downloaded files contained the unique naming convention “`9yo Jenny’ in various permutations. Because the LimeWire files were retrieved in unallocated space on [Nichlos’] laptop, Ms. SH was not able to retrieve any digital files that matched the digital files from the LimeWire download. Ms. SH testified that the file names in the LimeWire download were downloaded onto [his] laptop; however, because these files were retrieved from unallocated space, the only information attainable was the digital file names themselves.

Third, the Government offered PE 5, a list of [Nichlos’] recently accessed video files. Ms. SH conducted a search of [his] laptop for the most recently viewed movie files in the .mov and .qt format. Whenever a user accesses a movie or video file that contains the file extension .mov or .qt, a link file is automatically created by the program. . . . A link file creates a shortcut for the user and allows the user to `double-click’ on that file to access and view that particular video file. Ms. SH testified that even if the underlying digital file is deleted, the link file still exists on the computer. Additionally, Ms. SH testified that although she was not able to find the underlying video files associated with the link files, she was able to testify that at some point in time, these files had been viewed. . . . Of the ten recently viewed files that contain the .mov extension, three of them include the title `9yo Jenny.’ . . .

The Government's theory was that [Nichlos] had an interest in child pornography and a particularly unusual interest in images or video files that contained `9yo Jenny,’ the same prepubescent girl depicted in the charged video files. Based on the evidence and expert testimony that [he] had used his iPhone on 24 December 2010 to actively search for and access the website purportedly containing `9yo Jenny pics,’ this served as a circumstantial link to the charged video files of `9yo Jenny.’

U.S. v. Nichlos, supra.

The appellate court consequently found that there was “no question that [Nichlos] possessed child pornography; the question is whether [he] `knowingly possessed’ child pornography on the charged date.”  U.S. v. Nichlos, supra (emphasis in the original).

The Court of Criminal Appeals then went on to analyze that issue, noting that because of

its charging decision, the Government was required to prove [Nichlos] `knowingly possess[ed]’ the three charged video files (01864590.mpg; 01864588.mpg; and, 01864901.mpg) `on or about 16 May 2011.’ Accordingly, the critical issue we must now decide is not whether the appellant knowingly possessed these video files at any time from the date he acquired his computer until the date NCIS seized it. Instead, we must decide whether [Nichlos] knowingly possessed the three charged video files retrieved from unallocated space on or about 16 May 2011. Based on binding precedent . . . , we conclude that he did not. To support our conclusion, we first consider the technical aspects associated with unallocated space prior to considering whether a computer user can `possess’ a digital file, either actually or constructively, if that file exists only in the unallocated space of a computer.

According to . . . Ms. SH, unallocated space is the location on the computer where files are stored after having been permanently deleted. When a user permanently deletes a digital file that file continues to exist on the computer; however, it exists in unallocated space until the file is overwritten. Once a digital file is in unallocated space, the metadata associated with that file is stripped away (e.g. its name, when it was accessed, when it was viewed, when it was created, or when it was downloaded). . . . Ms. SH's testimony is consistent with federal courts that have defined unallocated space. . . . .

The CAAF has defined what constitutes `knowing possession’ for purposes of possession of child pornography. . . . To constitute `knowing possession’ for purposes of child pornography, the CAAF imported the definition of possession from the President's definition of `possess’ in Article 112a, UCMJ;^. U.S. v. Navrestad, 66 M.J. 262 (C.A.A.F. 2008).  Because Navrestad did not have actual possession or constructive possession of child pornography under that definition, the CAAF held that the evidence was legally insufficient.  Id.

In this case, the Government presented no evidence that [Nichlos] had the required forensic tools to retrieve digital files from the unallocated space of his computer. In fact, Ms. SH testified that once a digital file is in unallocated space, a user does not have the ability to access that digital file. . . . Because [Nichlos] was unable to access any of the video files in unallocated space, he lacked the ability to exercise “dominion or control” over these files. Navrestad, 66 M.J. at 267. . . .

Having defined `knowing possession’ for purposes of child pornography as requiring the possession to be both `knowing and conscious,’ Navrestad, 66 M.J. at 267, we hold that [Nichlos] did not `knowingly possess’ any of the three charged videos on the date charged (16 May 2011).  Bound by Navrestad, we also conclude that the evidence was legally insufficient to prove constructive possession on the date charged.

The CAAF has held that for the evidence to be legally sufficient on a constructive possession theory, a person must exercise `dominion or control’ over the child pornography digital files.  Navrestad, supra.  Based on the technical aspects associated with unallocated space, Ms. SH's testimony, and a lack of any evidence presented that the appellant was a sophisticated computer user in possession of the forensic tools necessary to retrieve digital files from unallocated space, we conclude that the evidence is legally insufficient to prove knowing possession on or about the charged date of 16 May 2011. 

U.S. v. Nichlos, supra.

The Court of Criminal Appeals therefore held that the “finding of guilty to Specification 1 of the Charge is set aside and that specification is dismissed.”  U.S. v. Nichlos, supra. It upheld the finding of guilty as to Specification 2 but set the sentence aside and “return[ed] the record to the Judge Advocate General for remand to an appropriate CA with a rehearing on the sentence authorized.”  U.S. v. Nichlos, supra.