Wednesday, May 29, 2013

The Laptop, Malware and Child Pornography

After a jury convicted him of possessing child pornography in violation of 18 U.S. Code § 2252A(a)(5)(B) and the judge sentenced him to “sixty months' imprisonment and eight years' supervised release”, Brian Rogers appealed.  U.S. v. Rogers, __ F.3d __, 2013 WL 1799898 (U.S. Court of Appeals for the 1st Circuit 2013).

On appeal, Rogers argued that “the government did not prove that he knowingly possessed the child pornography that was found on a laptop he sold to a pawn shop.”  U.S. v. Rogers, supra.  According to the opinion, the case began on July 15, 2008, when

Rogers's then-wife, Heather Rogers, sold a laptop computer to Coastal Trading and Pawn in Brunswick, Maine. Later that day, she returned with Rogers, who sold a second laptop to the store. In keeping with Coastal Trading's usual practice, the clerk asked for, and received, the passwords to both laptops, to allow the store's staff to access the computers and restore them to their factory settings.

The next day, Coastal Trading's computer technician began the process of preparing the second laptop for resale. He turned it on and entered the password Rogers had provided. In an effort to find the program that would restore the laptop to its factory settings, he looked in the Windows recycle bin. 

There, he discovered a video file captioned `My 15–Year Old Sister.’ This discovery prompted him to search the laptop for other videos; he found `quite a few’ more. He viewed portions of a few videos and saw `[y]oung children involved in sexual acts.’ He immediately notified the store manager, who called the Brunswick police.

U.S. v. Rogers, supra.  

The opinion says that “a few days later,” Brunswick Detective William Moir collected

the laptop and the associated sales paperwork from Coastal Trading and took them to the police station. Until Moir came to collect it, the laptop remained in the store's back room, and no one accessed it. Moir, who had specialized electronic forensics training, removed the laptop's hard drive and attached it to a `write blocker,’ which allowed him to view the drive's contents without altering them. 

After finding some files with names `indicative of child pornography,’ he took the drive to the Maine State Police Computer Crimes Unit for further analysis. There, he worked with an analyst to copy and review the contents of the drive. They found both videos and still images of children engaged in sex acts.

Moir soon returned to Coastal Trading and seized the laptop Heather Rogers had sold to the store on her first visit. Nothing of significance was found on that first computer. Moir then obtained a search warrant for Rogers's home, which he and other law enforcement officers executed on July 31. 

Heather Rogers was there when they arrived; Brian Rogers returned home during the search. When the officers came upon a desktop computer and a case containing compact discs, they seized both.

U.S. v. Rogers, supra.  

The opinion explains that the hard drive “of the second laptop,” the one on which the store employee found child pornography, was subsequently searched more thoroughly:

Chris Hull, an analyst with the Computer Crimes Unit, used forensic software to examine the hard drive's contents. He found two user accounts on the drive: an account called `Mingan’ (also designated `Admin’) and a default `guest’ account. He also found six child pornography videos in a `shared’ folder associated with the `Mingan’ user account, and still images depicting child pornography in the `Temporary Internet Files’ and `lost files’ folders. 

The shared folder was created by LimeWire, a peer-to-peer file-sharing program Hull found in the recycle bin. The Temporary Internet Files folder . . . stores files from frequently visited websites that otherwise would have to be loaded remotely, with the goal of speeding up the user's web browsing experience.

U.S. v. Rogers, supra.  The opinion further explains that Hull examined the

`index.dat file,’ which records the computer user's activity. . . . The index file reflected numerous visits to websites like `’ (which was also bookmarked in the laptop's default web browser, along with `Natural Lolitas’ and `’). And Hull found `cookies’ . . . from various websites, including `son-porno-schoolgirls,’ a Yahoo user account called `Brian87_2006,’ and . . . Myspace (which appeared to be associated with the same login information as the Yahoo account). . . . 

Moir found a Myspace page for a user called `Mingan’; one of the account's three Myspace `friends’ was Heather Rogers, Brian Rogers's wife. . . . Hull determined that the password for the user account `Mingan’ . . . was `Heather,’ and the password hint associated with that account was `My baby.’

U.S. v. Rogers, supra.  

Hull also found

ten `infections,’ i.e., malware programs, on the laptop. To determine whether they might be responsible for the presence of child pornography, he installed the same infections on a test machine that replicated the conditions on the laptop and let them run for a week. No child pornography appeared on the test machine.

Hull examined the desktop computer seized from Rogers's home as well. Using the same forensic tools he used on the laptop, he uncovered child pornography images. These files were located in unallocated space, indicating the files had been deleted by a user but not yet overwritten with new data. 

He also found two user accounts on the desktop: `Bunny’ and `NEXCOM,’ the latter of which was also captioned `Mingan.’ Associated with the latter account were internet bookmarks for websites like `LolitasBBS-freeware’ and `’

U.S. v. Rogers, supra.  

As a result of all this, Rogers was charged with the offense noted above, tried, convicted and sentenced . . . and then appealed.  U.S. v. Rogers, supra.  As noted above, the only issue he raised in appealing his child pornography conviction was the argument that the evidence presented at trial was not sufficient to prove the elements of the crime beyond a reasonable doubt.  U.S. v. Rogers, supra.  

The Court of Appeals began its analysis of his argument by noting that a “sufficiency-of-the-evidence challenge to a jury's guilty verdict will not succeed unless no rational jury could have concluded that the government proved all of the essential elements of the offense beyond a reasonable doubt.”  U.S. v. Rogers, supra.  It also explained that the statute he was convicted of violating – 18 U.S. Code § 2252A(a)(5)(B) – creates

criminal penalties for any person who `knowingly possesses, or knowingly accesses with intent to view, any . . . computer disk, or any other material that contains an image of child pornography’ that was produced or transported in interstate commerce, including via computer. Here, it is undisputed that the images found on the laptop constituted child pornography and that the interstate commerce element was satisfied.

Rogers's challenge focuses instead on the question of knowing possession. To satisfy the statute's knowing-possession requirement, the government must show that Rogers possessed, and knew he possessed, child pornography. See U.S. v. X–Citement Video, Inc., 513 U.S. 64 (1994).

U.S. v. Rogers, supra.   (As this site explains, the requirement that the material involved in the commission of the offense have traveled in interstate commerce is essential in establishing that federal courts have jurisdiction to hear the case.)

The Court of Appeals then addressed Rogers’ challenge to the government’s proving he knowingly possessed child pornography.  U.S. v. Rogers, supra.  It noted, first, that

there can be no serious dispute that the child pornography found on the laptop was downloaded knowingly and deliberately. The web browser's cookies and indexed history indicated that someone had used the browser to make numerous visits to websites related to, or with names indicative of, child pornography, including `,’ `Natural Lolitas,’ and ` See U.S. v. Pruittt, 638 F.3d 763 (U.S. Court of Appeals for the 11th Circuit 2011) (conviction supported by `a record of visits to websites with a child-pornography connection’). . . .

Further, the discovery of child pornography in the Temporary Internet Files folder suggests that those images were downloaded when a user visited websites hosting them. . . . And, as the government observes, the fact that a user bookmarked some of these websites supports the conclusion that they were visited deliberately. . . .

U.S. v. Rogers, supra.  

The court noted, though, that

we must be cognizant of `the prevalence and sophistication of some computer viruses and hackers that can prey upon innocent computer users’ by placing child pornography on their machines, but `the specter of spam, viruses, and hackers must not prevent the conviction of the truly guilty.’ U.S. v. Pruitt, supra.  

Here, Hull's forensic analysis of the computer, which included running the malware `infections’ discovered on the laptop on a test machine for over a week, all but ruled out the possibility that the images had been downloaded by a virus without the user's knowledge.

And child pornography (along with a similar pattern of web browsing) was found on the desktop computer seized from Rogers's home, further diminishing the possibility that the presence of the images and videos on the laptop was inadvertent. 

Lastly, some of the files were found in the laptop's recycle bin, suggesting that someone deliberately attempted to delete them (and thus knew they had been downloaded). . . . On this record, there is no real possibility that this case involved unknowing possession. 

U.S. v. Rogers, supra.  

The Court of Appeals explained that the “only remaining question” was whether the prosecution proved that the

person who knowingly possessed the images and videos was Rogers himself. We think it did. The user account `Mingan,’ which was the only user-created account on the laptop, was strongly associated with Rogers, and child pornography videos were found in the shared folder associated with that user account. 

The password hint for the `Mingan’ account was `My baby’ and the password itself was Rogers's wife's name (Heather). Rogers provided this password to Coastal Trading when he sold the laptop, and has not pointed to evidence suggesting that anyone else knew it.

Further, Moir discovered a Myspace profile named `Mingan,’ one of whose Myspace friends was Heather Rogers. The Myspace profile appeared to share login information with a Yahoo account the laptop had been used to access: Brian87_2006. Brian . . . is Rogers's name, and he was born in 1987. . . . 

The web browser's cookies showed access to the same Yahoo account, along with visits to the disturbingly named websites discussed above. The web browser also included a bookmark for the U.S. Navy's website; Rogers was a member of the Navy at the time of his arrest.

U.S. v. Rogers, supra.  

The Court of Appeals therefore found that, “in light of all this evidence and the reasonable inferences that can be drawn from it,” the jury’s decision “to convict was wholly rational.”  U.S. v. Rogers, supra.  It explained that the evidence at trial

amply established that Rogers possessed and used the laptop, and supported the reasonable inference that he was the one who searched for and knowingly downloaded the child pornography. Rogers's suggestions that someone else somehow downloaded or placed the images and videos on the laptop are simply not supported by any evidence adduced at trial.

Hull's testimony all but extinguished the possibility that a virus put the images and videos there, and there was no suggestion that a third party could have done it after Rogers sold the laptop. Nor was there any testimony that, before the computer's sale, anyone other than Brian and Heather Rogers had access to it (assuming that she even knew the password, which is certainly possible but is not established by any evidence in the record).

Thus constrained, Rogers is forced to posit that his now-ex-wife was responsible for the child pornography found on the laptop, but that assertion finds essentially no support in the record, and the jury was entitled to dismiss it.

U.S. v. Rogers, supra.  

The court therefore rejected Rogers’ challenge to the sufficiency of the evidence and affirmed his conviction and sentence.  U.S. v. Rogers, supra.  

If you're interested, you can read a little more about the case here.

No comments: