UBUNTU, TrueCrypt and Child Pornography

This is another post about a juvenile case:  “J.E.M.”, a seventeen-year-old resident of Minneapolis, appealed “his delinquency adjudication of possession of pornographic work involving minors in violation of “ Minnesota Statutes §617.247(4)(a). In re Welfare of J.E.M., 2012 WL 1389400 (Minnesota Court of Appeals 2012). 

On appeal, he argued, in part, that “the evidence was insufficient as a matter of law to prove that he possessed child pornography `knowing or with reason to know its content and character’”.  In re Welfare of J.E.M., supra.

The case began on December 29, 2008, when Officer Hanson of the Minneapolis Police Department conducted an undercover investigation into Internet child pornography using peer-to-peer networks.  In re Welfare of J.E.M., supra. The network involved in this case

relies on software that allows sharing of files such as LimeWire and Shareaza. Hanson found an IP address that indicated child pornography which corresponded to the address for J.E.M.'s, father's home in Rochester, Minnesota. Gnuwatch . . . connect[ed] with the host computer at this IP address about four times between 9:00 a.m. and 1:30 p.m. on December 29, 2008. . . .

[T]he software the investigation identified was Shareaza version 2.4 . . . and [Hanson] was able to read the identification number for the client's software. [He] also found hash values that corresponded with hash values of known images of child pornography. . . . [and] found multiple images he believed were child pornography. At trial, four of these images were offered as evidence and were proven to be child pornography from a group called the `Vicki Series’. . . .

Upon further examination of the computer, Hanson found it had four partitions on the hard drive, each running a different operating system. Two partitions, one using Windows VISTA, and a second using a Linux-based operating system called UBUNTU, required user passwords for access. The only user found for this computer was identified by [J.E.M.’s] first name.

In re Welfare of J.E.M., supra.

The Shareaza software where the child pornography was found was in the VISTA partition. In re Welfare of J.E.M., supra.  Several files “had paths or names” that indicated they contained child pornography.  In re Welfare of J.E.M., supra. Hanson found “5,250 thumbnail images in a folder called `thumbcache’”, which was in the UBUNTU partition. In re Welfare of J.E.M., supra.  He “believed” 54 of the thumbcache images contained child pornography. In re Welfare of J.E.M., supra.

Between “2:09 p.m. and 2:19 p.m. on December 29,” child pornography files on the laptop were accessed using TrueCrypt, encryption software that “allows one to change the extensions of the files so one can hide the true nature of the file.” In re Welfare of J.E.M., supra. The opinion says some files may have been deleted because the “recycle bin or folder was accessed during that time.” In re Welfare of J.E.M., supra. 

A file labeled “`.recently-used.xbel’” was in the UBUNTU partition; it was a “recently opened document list” that contained “a number of child pornography files under the directory path `file:///media/truecrypt7/stuff/pt.’” In re Welfare of J.E.M., supra. And emails “sent to a personal e-mail address associated with” J.E.M. “were reportedly received throughout the day on December 29, 2008.”  In re Welfare of J.E.M., supra.

Between “late 2008 and early 2009,” J.E.M. lived with his mother (in Minneapolis, I think?) but “also stayed with his father In Rochester, Minnesota, on occasion.”  In re Welfare of J.E.M., supra.  On December 25, 2008, he wen to his father's home, “bringing his laptop with him,” and spent the rest of his school break there. In re Welfare of J.E.M., supra. J.E.M. had his laptop until “sometime in late January or early February 2009,” when his mother took it away “for disciplinary reasons.”  In re Welfare of J.E.M., supra.

On March 10, 2009, Sergeant Teal of the Rochester Police Department got a warrant based on Hanson's report and executed it at J.E.M.’s father’s home. In re Welfare of J.E.M., supra. Teal searched the computers seized there but “did not find anything of evidentiary value.”  In re Welfare of J.E.M., supra.  When J.E.M.’s mother learned officers had seized computers from his father’s home, she “had her fiancé deliver her son's laptop to the Rochester Police Department.” In re Welfare of J.E.M., supra.

She did not know “the password to the computer or any of the programs on it” and said she never used it.  In re Welfare of J.E.M., supra.  J.E.M.’s father and his wife said they did not access or use the laptop, did not know the password for it and did not set up Shareaza on it.”  In re Welfare of J.E.M., supra. His younger brother “also stayed at his father's home during the same time” but there was “never any suggestion” that he had access to J.E.M.’s computer. In re Welfare of J.E.M., supra. 

Teal examined the laptop and found “the VISTA partition required a login password and the user profile for that partition carried [J.E.M.’s] first name.” In re Welfare of J.E.M., supra. He also found the TrueCrypt program, “which contained some encrypted files, and peer-to-peer software”, which “he identified as Shareaza or LimeWire.”  In re Welfare of J.E.M., supra.  Teal looked for “deleted files, and found images that appeared to be child pornography.”  In re Welfare of J.E.M., supra.   

Because the files “were in unallocated space, or had been deleted, they did not have identifying data on them, such as time information.” In re Welfare of J.E.M., supra.   Among the images Teal found were “the four from the `Vicki Series’ that were verified to be child pornography.”  In re Welfare of J.E.M., supra.  

J.E.M. was “charged with one count of disseminating pornographic work in violation of”  Minnesota Statutes § 617.247(3)(a) and one count of possessing pornographic work on a computer . . . in violation of” Minnesota Statutes § 617.247(4)(a).  In re Welfare of J.E.M., supra.   

At his trial, his defense expert agreed that “child pornography was downloaded from” J.E.M’s laptop on December 29, 2008 and found “no pornographic images in active folders” but found “child pornography images in thumbnails or cache files.”  In re Welfare of J.E.M., supra.  He testified that “while thumbnails may have dates on them, they do not tell you anything about the date on which the thumbnail may have actually been viewed.”  In re Welfare of J.E.M., supra.  

J.E.M.’s expert also testified that he “found no evidence of repeated viewing of child pornography”.  In re Welfare of J.E.M., supra.  He also testified that while it “appeared that the thumbnails containing child pornography referred to in Hanson's report were from Internet viewing, he could not be sure as there was no path for them.”  In re Welfare of J.E.M., supra.  Hanson, testifying in rebuttal, said “the only way a thumbnail could get from the Internet cache to the Thumbcache.db file is if the user accessed the Internet file and viewed the image.”  In re Welfare of J.E.M., supra.  

J.E.M. was convicted of possessing pornographic work involving minors but acquitted of dissemination.  In re Welfare of J.E.M., supra.  He was given a “stayed adult sentence of 15 months in prison and was placed on [Extended Jurisdiction Juvenile” probation” until he is 21.  In re Welfare of J.E.M., supra.  “Pursuant to” Minnesota Statutes § 243.166, he “must register as a predatory offender.”  In re Welfare of J.E.M., supra.  

On appeal, J.E.M. argued that the evidence did not support his conviction. In re Welfare of J.E.M., supra.  The Court of Appeals noted that to convict someone of possessing "pornographic work involving minors," the prosecution must prove beyond a reasonable doubt that he/she “`possess[ed] a pornographic work or a . . . computer . . . containing pornographic work, knowing or with reason to know’ the content and character of the work is pornographic work involving minors.”  In re Welfare of J.E.M., supra.  

 It also pointed out that a “`possessor of child pornography has ‘reason to know’ a pornographic work involves a minor where [he/she] is subjectively aware of a ‘substantial and unjustifiable risk’ that the work involves a minor.”  In re Welfare of J.E.M., supra (quoting State v. Mauer, 741 N.W.2d 107 (Minnesota Court of Appeals 2007)).

After considering the arguments and the evidence, the court found that in this case, “the circumstances formed a chain that led directly to [J.E.M.]guilt so as to exclude any reasonable inference other than guilt.” In re Welfare of J.E.M., supra.  It concluded that the “totality of the circumstances” presented by the prosecution reasonably led the trier of fact to infer that J.E.M. “`knew’ or `had reason to know’ the pornographic work on his laptop involved a minor.”  In re Welfare of J.E.M., supra.  

J.E.M. argued that “without proof that [he] knowingly obtained the files, viewed . . . or consciously failed to view [them] under circumstances that a reasonable person would have had reason to know [they]were suspect,” the prosecution hadn’t proved he “knew” or “had reason to know” beyond a reasonable doubt. In re Welfare of J.E.M., supra.  J.E.M. pointed out that there were

 

54 suspected images of child pornography in a folder containing 5,250 thumbnails, making it unlikely [he] viewed each one of these images. Even though the files containing child pornography had been accessed and moved, no evidence showed anyone doing so actually viewed the files or knew their content. Hanson also established that someone having accessed a folder in a thumbnail view causes thumbnails to be created even if the computer user has never viewed the files. 

In re Welfare of J.E.M., supra.  

The Court of Appeals found that “circumstantial evidence presented at trial” supported the prosecution’s theory that J.E.M. “was at least `subjectively aware of a “substantial and unjustifiable risk” that the work involve[d] a minor.’” In re Welfare of J.E.M., supra (quoting State v. Mauer, 741 N.W.2d 107 (Minnesota Court of Appeals 2007)). 

This included evidence that he “was using his computer on December 29, 2008, at or around the time Hanson downloaded the . . . child pornography from [his laptop,” that he “likely accessed the folder where the images were found and manipulated those files [so] they were no longer accessible” and that at the time he “accessed Shareaza through the password-protected VISTA partition the files still retained names tending to suggest” they contained child pornography. In re Welfare of J.E.M., supra.  The court also noted the “evidence that 54 child pornography thumbnails were likely accessed shortly after the download, in gallery view or at least thumbnail view.”  In re Welfare of J.E.M., supra.  

Finally, the Court of Appeals relied on Hanson’s testimony about use of the

password protected UBUNTU partition, which demonstrated the user accessed the `truecrypt7’ mounted drive, then a subfolder in the folder entitled `Shareza¤wnloads,’ and then a return to the `truecrypt7’ mounted device's `$RECYCLE.BIN.’ This occurred at 2:19 p.m. on December 29, 2008. Hanson identified 52 child pornography thumbnails also in the UBUNTU partition with last access dates of December 29, 2008, at approximately 2:18 p.m. . . .

Hanson prepared four slides which demonstrate that the computer user likely viewed these child pornography images in gallery view or that they were at least brought up in thumbnail view.  

In re Welfare of J.E.M., supra.  

The court therefore held that when

viewed in a light most favorable to the conviction, the evidence presented by the state was sufficient for the fact-finder to reasonably infer beyond a reasonable doubt that appellant constructively possessed pornographic work with reason to know that the content and character of the work was pornographic work containing minors.

In re Welfare of J.E.M., supra.  

For this and other reasons, it affirmed J.E.M.’s conviction and sentence.  In re Welfare of J.E.M., supra.