Monday, August 03, 2015

The Laptop, Slack Space and Child Pornography

After James Paul Lowe was convicted in the U.S. District Court for the Eastern District of Tennessee of “knowingly receiving, distributing, and possessing child pornography in violation of 18 U.S. Code § 2252(a)”, he appealed.  U.S. v. Lowe, 2015 WL 4529516 (U.S. Court of Appeals for the 6th Circuit 2015).  In his appeal, Lowe “concede[d] that a laptop computer found in his home contained hundreds of image and video files depicting child pornography but maintains that no rational juror could find beyond a reasonable doubt that he knew about those files or placed them there.”  U.S. v. Lowe, supra.  
The Court of Appeals began its analysis of Lowe’s argument on appeal by explaining how the conviction arose:
Between March and August 2011, a user downloaded child pornography to a laptop found in the home James Lowe shared with his wife, Stacy Lowe. The Lowes lived at 2204 Robin Street in Athens, Tennessee. Michael Lowe, a minor relative described by one witness as James Lowe's `adopted child,’ lived with James and Stacy at some point during 2011 but moved out before agents searched the home in August.

Four government witnesses testified at Lowe's trial. Bradley County Sheriff's Office Detective J.P. Allman recounted learning in early 2011 that someone was using a particular Internet Protocol (IP) address to share child pornography. On May 23, he searched for that IP address and discovered a computer sharing files with names consistent with child pornography over a peer-to-peer network. He downloaded one video and two still images of child pornography from the computer's shared folder.

Detective Allman subpoenaed AT & T for information about the account associated with the IP address. AT & T's records listed James Lowe as the account holder, 2204 Robin Street as the billing address, and Lowe. Stacy @yahoo.com as the email address associated with the account. Detective Allman conducted surveillance and determined that, as of August 2011, James and Stacy Lowe were the sole residents of 2204 Robin Street.

Detective Allman and other officers executed a search warrant on August 8. Stacy was home during the search but James was not. Law enforcement officers seized three computers: a Dell Inspiron laptop with the username `Stacy’ found in the bedroom, an HP Pavilion laptop with the username `Jamie’ found in the office, and a desktop that was also located in the office. Detective Allman testified that his role during the search was `speaking with Ms. Lowe.’ . . . He later told the jury that he learned that the laptop found in the office belonged to James Lowe. Agents also found a form on the desk in the office that listed James's name, social security number, date of birth, and the email address jamedog111@excite.com.

FBI Special Agent Stephen McFall told the jury that he examined the three hard drives and discovered that only the HP Pavilion laptop contained child pornography. Agent McFall found 639 image files and 176 video files depicting child pornography on the device.
U.S. v. Lowe, supra.
The court also noted that
[a] user named the HP Pavilion laptop `Jamie–PC’ and created a single user account, `Jamie.’ The laptop's settings did not require users to enter a password to access the `Jamie’ account or any of the laptop's files and programs. And while the Lowes password-protected their residence's wireless-internet account, the laptop automatically connected to the internet through a stored wireless password.

The laptop's desktop screen included the following shortcuts, icons, and files: the computer's recycling bin, an internet browser, iTunes, Shareaza (a peer-to-peer file-sharing program), a media player, a folder labeled Microsoft Office Programs, a PDF file labeled `2011—Auhto . . .,’ four Microsoft Excel spreadsheets labeled `Copy of Service Aut . . .,’ an MP3 music file, and what appeared to be a computer game. [At Lowe’s trial,] Agent McFall told the jury that the spreadsheets `looked like they were authorization agreements for business.’ . . .
U.S. v. Lowe, supra.
The opinion goes on to explain that Agent McFall
testified at length about the Shareaza peer-to-peer file-sharing program used to download child pornography to the HP Pavilion laptop.  Someone installed the program on February 24, 2011. Because no one overrode the program's default username setting, the Shareaza account adopted the laptop's username, `Jamie.’ But someone altered the default for the program's chat-feature username and instead entered `JA.’

Shareaza was not password-protected, and it automatically started running in the background whenever someone switched the computer on. But users had to open the program to search for files and initiate downloads.

The Shareaza home screen—which any user would see upon opening the program—showed that someone searched for terms consistent with child pornography such as `young mama’ and `PTHC’ (which stands for `pre-teen hard core’), and non-pornographic terms such as `Oceans 11,’ `Ellie Goulding,’ and `Tron.’ The list of downloads on the home screen included files named `PTHC Pedoland Frifam Heidi,’ `11 yo sleeping kid,’ and `new girl img–0063–r10.’

Files were stored in an `incomplete’ folder within Shareaza until they finished downloading, at which point they would appear in the laptop's `downloads’ folder. Agent McFall testified that files could `take a very long time to download’ and that downloading time depended on factors such as the internet connection's speed. . . .

Most of the laptop's images and videos depicting child pornography were stored in Shareaza libraries. Agent McFall also found evidence of images, some of which had been deleted, elsewhere on the laptop's hard drive. For instance, the recycling bin contained a video titled `Lolita PTHC 2011 3yo Ariel part 1.’ Agent McFall found references to the three files Detective Allman downloaded on May 23 through a text-string search, but someone deleted the actual files before agents seized the computer. He never specified whether the `downloads’ folder contained child-pornography files.
U.S. v. Lowe, supra.
The Court of Appeals continued summarizing the evidence in the case, explaining that
Agent McFall admitted that he could not pinpoint when someone searched for or initiated downloads of child pornography. But forensic analysis revealed the date and time on which partial or completed downloads appeared on the laptop's hard drive. Microsoft Windows registry data revealed that a user opened files depicting child pornography as recently as August 4.

Agent McFall also testified about the laptop's internet-usage history as recorded through `cookies.’ On numerous occasions between March and August, downloads completed within minutes of someone accessing a web-based email service or one of several retail, banking, appliance-repair, and travel websites. Agent McFall identified one date—March 10—on which a user appeared to log in to Yahoo!'s email service. When the government's attorney asked if he recalled `what the log-in was,’ he replied, `For the Yahoo mail, I don't remember exactly. I think Jamie or jame dog was part of the, part of the e-mail address.’ . . . In general, however, Agent McFall attributed no special significance to the laptop's browsing history.

Agent McFall also told jurors that a user opened an `East Tennessee Appliance Services’ invoice listing 2204 Robin Street as the business address about forty minutes before a child-pornography video finished downloading on March 3. No witness testified about what James and Stacy Lowe did for a living or whether the other two computers also contained business documents.
U.S. v. Lowe, supra.
After the prosecution had finished presenting the evidence in its case, Lowe moved        
for a judgment of acquittal at the close of the government's case and rested without putting on his own evidence. The court denied his motion but expressed some misgivings about the government's proof:

`I have to say, in this case, it has been particularly difficult, even though it's my job to do so, to discern where that line [between speculation and reasonable inference] is and where what might be a reasonable inference that can be drawn from the record evidence becomes nothing more than an invitation for the jury to speculate as to what the evidence may be or what it may show.’

. . . . After the jury found Lowe guilty on all three counts, the district court denied his post-trial motion for a judgment of acquittal. It sentenced Lowe to 150 months' imprisonment, varying significantly below the guidelines range of 210 to 240 months.
U.S. v. Lowe, supra.
The Court of Appeals began its analysis of Lowe’s arguments on appeal by explaining that it reviews
de novo the district court's judgment denying Lowe's motion for acquittal. U.S. v. Blanchard, 618 F.3d 562 (U.S. Court of Appeals for the 6th Circuit 2010). In considering Lowe's sufficiency-of-the-evidence challenge, we `view[ ] the evidence in the light most favorable to the prosecution’ and must affirm if `any rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt.’ U.S. v. Washington,715 F.3d 975 (U.S. Court of Appeals for the 6th Circuit 2013) (quoting Jacksonv. Virginia, 443 U.S. 307 (1979)). . . .

`Circumstantial evidence alone is sufficient to sustain a conviction and such evidence need not remove every reasonable hypothesis except that of guilt.’ U.S. v. Algee, 599 F.3d 506 (U.S. Court of Appeals for the 6th Circuit 2010) (quoting U.S. v. Kelley, 461 F.3d 817 (U.S. Court of Appeals for the 6th Circuit 2006)) . . . ; see also U.S. v. Garcia, 758 F.3d 714 (U.S. Court of Appeals for the 6th Circuit 2014) (affirming a firearm-possession conviction where `circumstantial evidence and a chain of inferences’ would permit a jury to conclude that the defendant actually possessed the weapon). `A convicted defendant bears ‘a very heavy burden’ to show that the government's evidence was insufficient.’ U.S. v. Tragas, 727 F.3d 610 (U.S. Court of Appeals for the 6th Circuit 2013) (quoting U.S. v. Kernell, 667 F.3d 746 (U.S. Court of Appeals for the 6th Circuit 2012)).
U.S. v. Lowe, supra (emphasis in the original).
The court then began its analysis of Lowe’s arguments, noting that
[n]otwithstanding Lowe's heavy burden, we agree with his argument that no rational juror could find him guilty beyond a reasonable doubt based on the evidence presented at trial. A juror could reasonably infer that James owned and occasionally used the laptop from (1) the device's sole username, `Jamie,’ a common diminutive of James; (2) Detective Allman's testimony that the laptop `belonged to’ James; and (3) Agent McFall's testimony about the March 10 visits to the Yahoo! email log-in page. But, without improperly stacking inferences, no juror could infer from such limited evidence of ownership and use that James knowingly downloaded, possessed, and distributed the child pornography found on the laptop.

James shared his home with two other people, both of whom could access the HP Pavilion laptop's `Jamie’ account and Shareaza file-sharing program without entering passwords. We need not decide if Detective Allman's testimony that Michael Lowe moved out in `early 2011’ and Agent McFall's testimony that someone at 2204 Robin Street used the laptop to view images as late as August 4 permitted the jury to conclude that someone other than Michael placed images on the computer. Even if a juror reasonably could rule out Michael's responsibility for at least some of the images, the remaining evidence provided no basis to determine whether James or Stacy (or both) knowingly possessed child pornography. Compare U.S. v. Moreland, 665 F.3d 137 (U.S. Court of Appeals for the 5th Circuit 2011) (reversing conviction in light of evidence that three people used the defendant's user account and the absence of evidence specifically linking the defendant to the images), with U.S. v. Koch, 625 F.3d 470 (U.S. Court of Appeals for the 8th Circuit 2010) (sustaining conviction where the defendant lived alone and the username of the computer seized from his bedroom matched his first name).
U.S. v. Lowe, supra.
It went on to point out that,
[i]mportantly, the government presented no evidence from which a juror could infer that Stacy did not use the laptop over the five-month period. First, although a juror reasonably could infer that Stacy used the `Stacy’ laptop from evidence that she was home alone during the search and that agents found that laptop powered on, the juror could not draw the additional inference that Stacy did not use the `Jamie’ laptop.

Second, no juror reasonably could conclude that James and not Stacy used the HP Pavilion laptop to save business records, open an invoice listing 2204 Robin Street as the return address, and access banking, retail, travel, and appliance-repair websites on dates when partial or complete child-pornography files appeared on the hard drive. The government presented no evidence of what James and Stacy did for a living, whether they worked inside or outside of the home, their interests and hobbies, or where they banked. Further, Agent McFall attributed no special significance to the pattern of internet activity during the period in question. Although a juror might infer from visits to appliance-repair and banking websites that an adult primarily used the computer, she could only speculate about whether the adult was James or Stacy Lowe.  See U.S. v. Moreland, supra (reversing conviction where a forensic expert admitted that the computer's internet-usage patterns did not show who visited the websites in question).
 U.S. v. Lowe, supra (emphasis in the original).
The Court of Appeals then pointed out that,
[i]n sum, the evidence presented here fell well short of what we have found sufficient to convict in other cases involving multiple possible users of a single device. In U.S. v. Oufnac, 449 F. App'x 472 (U.S. Court of Appeals for the 6th Circuit 2011), for instance, `ample other evidence’ linked the defendant to images found on a shared device. U.S. v. Oufnac, supra. Although the computer in question had three user accounts, pornographic images appeared only in Oufnac's personal `My Documents’ folder within his password-protected account. U.S. v. Oufnac, supra. Oufnac's former girlfriend testified about finding child pornography on his computer on several previous occasions. When she confronted him, he said the images were `none of her business’ but admitted that they aroused him, and, on one occasion, he agreed to destroy a compact disc on which she found `files and files and files and files’ of child pornography. U.S. v. Oufnac, supra. Oufnac also admitted to law enforcement that he recently viewed child pornography, although he later claimed that the images were `fake.’ U.S. v. Oufnac, supra.

Similarly, in U.S. v. Mellies, 329 F. App'x 592 (U.S. Court of Appeals for the 6th Circuit 2009), we sustained a defendant's conviction for possessing child pornography found on a laptop and compact discs in his home office, notwithstanding evidence that his wife and stepson occasionally used the laptop. U.S. v. Mellies, supra. The images were primarily stored in password-protected files and folders. U.S. v. Mellies, supra. Mellies was `associated with’ all but two of the hundreds of documents and thousands of emails stored on the laptop, and he was the only member of the household whose fingerprints appeared on compact discs containing child pornography. U.S. v. Mellies, supra. Further, a detective testified that Mellies told arresting officers: `I'm not a part of some sort of a ring’ and `[T]his is something that doesn't have anything to do with anybody else at all.’ U.S. v. Mellies, supra.

Of course, Oufnac and Mellies do not establish a minimum threshold for proving knowing possession of child pornography with circumstantial evidence. They do, however, identify the types of evidence on which a jury reasonably may rely to convict an individual of possessing child pornography found on a shared device. The jury heard no such evidence in Lowe's case, despite the fact that the non-password-protected laptop containing pornographic images was found in a common area of a home shared by three individuals.
U.S. v. Lowe, supra.
The Court of Appeals then outlined its conclusions and holding in this case:
Along with the lack of proof concerning who downloaded the images in the first instance, the evidence did not permit a juror to conclude that James knew the HP Pavilion laptop contained child-pornography files and permitted them to remain on the computer. Most of the images and videos depicting child pornography were stored in Shareaza libraries. Without more information about James's computer use, no juror reasonably could infer that he opened Shareaza during the five-month period in question. Further, the evidence did not suggest that someone using the laptop for innocent purposes would know about ongoing child-pornography downloads if he or she did not open Shareaza.

With respect to images stored outside of Shareaza, the evidence showed that, at most, images and videos temporarily appeared in the computer's `downloads’ folder and recycling bin. Although a juror might be able to infer that a defendant knows about pornography stored in her personal files, especially if the files contain recently opened or created documents, he could not draw the same conclusion about pornography that automatically appears in the “downloads” folder or that a user moved to the recycling bin. U.S. v. Oufnac, supra (explaining that a reasonable juror could conclude that a defendant either saved ninety-six images and videos to his personal `My Documents’ folder within his password-protected account or `at least knew of and permitted their continued existence’), with U.S. v. Moreland, supra (noting the lack of a `circumstantial indicium that established that [the defendant] knew of the images or had the ability to access them’ when images were found primarily in the hard drive's `unallocated slack spaces’).

In sum, no juror could conclude beyond a reasonable doubt from the evidence presented at trial that James Lowe knowingly received, possessed, and distributed the images and videos depicting child pornography found on the HP Pavilion laptop seized from his home.
U.S. v. Lowe, supra.
It therefore reversed Lowe’s conviction and remanded the case “for further proceedings consistent with this opinion.”  U.S. v. Lowe, supra.
You can, if you are interested, read more about the facts and outcome in this case in the news story you can find here.


No comments:

Post a Comment