Opinion
13-24-00133-CR
11-07-2024
MARK MALONE A/K/A MARK DANIEL MALONE, Appellant, v. THE STATE OF TEXAS, Appellee.
ON APPEAL FROM THE 36TH DISTRICT COURT OF ARANSAS COUNTY, TEXAS
Before Chief Justice Contreras and Justices Benavides and Silva
OPINION
CLARISSA SILVA JUSTICE
Following a jury trial, appellant Mark Malone a/k/a Mark Daniel Malone was convicted of twenty-two counts of possession of child pornography and was sentenced to thirty-four years of imprisonment, to be served consecutively with appellant's federal sentence of ninety-seven months. See Tex. Penal Code Ann. § 43.26(a). By one issue, Malone contends that the evidence is insufficient to support the jury's verdict that he intentionally and knowingly possessed images and videos of child pornography in his mobile phone. We affirm.
Prior to the trial of this case, Malone pleaded guilty to possession of child pornography based on the same facts in federal court in United States v. Malone, case 2:21CR00736-S001 in the Southern District of Texas. See 18 U.S.C. §§ 2252A(a)(5)(B), 2252A(b)(2).
I. Background
Malone was indicted for twenty-five counts of possession of child pornography based on images and videos obtained from Malone's mobile phone. At trial, the State abandoned counts one, two, and five, and proceeded with the other twenty-two counts. The jury heard testimony from: (1) Investigator J.D. Newlin from the exploitation unit of the attorney general's office; (2) retired Sergeant Les St. James, a digital forensic analyst from the attorney general's office; and (3) Malone. The jury found appellant guilty on all counts and assessed a ten-year sentence on one of the counts and two-year sentences on the remaining counts. The trial court ordered the ten-year sentence and the two-year sentences in counts twelve through twenty-three to be served consecutively for a total of thirty-four years, and it ordered the two-year sentences for the remaining counts to be served concurrently with the thirty-four-year consecutive sentence. The trial court ordered the thirty-four-year sentence to be served consecutively to appellant's federal sentence for child pornography.
Newlin described the process that the attorney general's office employs to investigate instances involving the alleged possession of child pornography. He explained that when individuals upload a file such as a photograph or video online to social media platforms such as Google, Facebook, Instagram and MeWe, the file is given a "hash value" which "is like the fingerprint" of that file. The file retains that hash value unless it is modified. Newlin testified that electronic and internet service providers run filters for known files of child pornography and also employ "other types of filters that look at the size of arms, legs, et cetera, as well as filters for nudity, and when those match up with sizes of limbs and nudity, they flag those" files. If the providers discover files of actual or potential child pornography, they submit the files to the National Center for Missing and Exploited Children (NCMEC), which is "the clearing house for all child pornography in the United States." The NCMEC then sends those reports to the Internet Crime Against Children task force for the relevant geographic area.
Newlin testified that on January 27, 2020, he received a cyber tip from NCMEC regarding a MeWe account. Newlin explained that MeWe is social media application that is similar to Facebook where individuals can post content, send messages, and join conversations in chat rooms. MeWe had reported several files to NCMEC that included child pornography. MeWe identified the source as an account in the name of "MM" and identified the email address associated with that account as "mmalone43@gmail.com." MeWe's report provided several internet protocol (IP) addresses for the account, including the last IP address that logged into MeWe. Newlin explained that an IP address is "like the license plate for your device." Newlin testified that the IP address for the account indicated that Spectrum was the internet service provider for the account, and thus he "executed an administrative subpoena requesting subscriber information for that IP address at the date and time that the MeWe account was accessed from that place." Newlin testified that the resulting data indicated that the MeWe account was accessed from an IP address located at a residence owned by Malone's wife on Timothy Street in Aransas County, Texas. Newlin provided this information to a crime analyst, who determined that both Malone and his wife resided at the home on Timothy Street and that Malone was the girls' athletic director for Rockport Fulton High School. The analyst also determined that Malone had previously used the email address of mmalone43@gmail.com to obtain his Texas driver's license.
Newlin testified that this case "went to the front of [his] pile" because Malone, given his employment as an athletic director at a high school, had "a position of trust over children." Newlin obtained a search warrant for Malone's MeWe account and thereby secured information regarding that account, including chats that Malone had engaged in and different rooms that he had accessed. Newlin testified that the data showed "conversations" where Malone requested child pornography with the "preferred" ages of twelve to sixteen and where Malone offered "content," or "files to trade." Newlin also explained that Malone posted that he had "handle[s] on Wickr [and] Telegram," which are "totally encrypted-end-to-end communication app[lications]." Newlin further testified that Malone's account included "exchanges in a conversation" in which Malone uploaded a photograph of a pair of girl's underwear "saying [they were] my daughter's friend's panties."
On March 19, 2020, Newlin, his investigative team, and a uniformed officer executed a search warrant for the Malone residence on Timothy Street. They knocked on the door several times, announced "[s]tate police, search warrant," but received no response. Because evidence regarding child pornography is "readily destroyable by a factory reset of your device," Newlin called for the door of the residence to be breached. The team removed all occupants from the home, including Malone, his wife, and their two children, and collected all electronic devices from the home. Newlin entered the main bedroom of the residence to secure clothing for Malone, who was in his underwear, and saw Malone's cell phone on a bedside table. Newlin took the phone to Malone, asked him for the passcode, and Malone entered the passcode as Newlin held the phone. Malone verbally confirmed that his email was mmalone43@gmail.com and explained that 43 "was a combination of his basketball number and his mother's basketball number." Malone also admitted that he had a MeWe account but denied that he recalled what it was. Newlin showed him the log and the chats that he had found in the MeWe account, at which point Malone requested an attorney.
On cross examination, Newlin admitted that the information from MeWe did not include the "actual upload times" for the images and videos, and only included the "logins." However, Newlin explained that the data that they secured showed that the IP address for the residence had accessed the MeWe account five times in the two days prior to the date that Newlin requested the data. Newlin also testified that they were unable to identify the physical location for the phone when it was used to access the MeWe account.
Newlin subsequently turned the phone over to St. James in the digital forensics unit. St. James, who was retired at the time of trial, testified that he was present when the search warrant at the Malone residence was executed. He confirmed that the cell phone that he examined was the same phone that was obtained from Malone by comparing the serial number, phone number, and the international mobile equipment identity. He testified that when they collected the phone, it was placed into airplane mode to prevent a "kill command or wipe command" from destroying its data. St. James testified that he attached a micro S.D. cable to the phone and thereby connected the phone to a Universal Forensic Extraction Device, the UFED Touch2 (UFED). St. James explained that the UFED contains firmware and software that extracts data from a phone using one of three methods: logical, advanced logical, or file system. Logical extraction obtains logical files and SMS, MMS, pictures, videos, and contacts. Advanced logical extraction obtains that data plus a file system abstraction, meaning "it pulls everything, files, folders." The file system, or Android Debug Bridge (ADB) extraction system is a program that requests data from the phone.
St. James testified that it took three attempts using one or more of these extraction methods to successfully obtain approximately ninety percent of the data from Malone's phone. St. James then loaded the data into either Axiom or Physical Analyzer, which are forensic software applications, and the application parsed the data from the phone, sorting it into different locations by type. For instance, the photographs, videos, and phone calls retrieved from the phone were each placed in a different section for review. St. James testified that the phone remained in airplane mode or in a Faraday box during this process to ensure that the phone was not contaminated by any communications.
Using this process, St. James obtained 255 pictures and 243 videos of adult pornography from Malone's phone. He further obtained "285 pictures and 217 videos displaying children that appeared to be under the age of 18 engaged in explicit sexual conduct." He explained that these images and videos had various "created dates," or dates when they were placed on the phone, including March 13, 2014, March 14, 2014, and April 17, 2014. St. James explained that he did not determine where the phone was physically located on the dates and times that these events occurred. St. James testified that these items were found in the phone's trash folder, where they were placed at three different times, a few minutes apart, on March 18, 2020, the day before the search warrant was executed at Malone's residence. St. James prepared an Excel spreadsheet including all of the foregoing data and further prepared a written report regarding his findings.
Newlin testified on redirect examination that he reviewed the data that St. James obtained from Malone's phone. He reviewed the images and videos related to several of the counts in the indictment, confirmed that they were obtained from Malone's phone, and gave brief graphic and explicit verbal descriptions of the images. The State offered copies of the images and videos related to each of the counts as evidence, and the trial court admitted them. One of the images was the photograph of a pair of female panties as previously mentioned by Newlin.
Malone testified at trial that he purchased his phone secondhand, or used, in either 2015 or 2016. Further, Malone testified that many other people had access to his phone and knew his passcode, including his wife, son, and daughter; both of his assistant coaches at Rockport Fulton High School, who used it to check attendance; and the entire girls' basketball team, who used it to play music.
Malone explained that he was attending a state basketball tournament with his wife when he received an alert on his phone stating that its memory was full and directing him to run a scan. He did so, selecting and deleting various files, including several images and videos of his daughter playing basketball. Malone testified that, within a week, his phone again alerted that its memory was full. At the time of this second alert, which occurred the day before he was arrested, Malone again ran a scan on his phone, revealing several file folders. Malone testified that he did not use file folders on his phone or recognize any of the indicated folders; however, the photographs and videos that he saw during the scan were the same images of his daughter playing basketball that he had previously deleted as a result of the first alert. Malone explained that he again deleted the files. According to Malone, during this process, he was playing video games while on the phone with several other coaches, and he recalled joking with his friends that it was "really weird," and that his friends told him he needed to replace his phone.
Malone denied taking one of the photographs found on the phone, depicting a female's panties, but acknowledged that he "did recognize it, the athletic floor and everything," and indicated the photograph might have been related to an issue at the high school concerning the cleanliness of the girls' locker room's floor. He recounted that the athletic department had previously encountered problems keeping the locker room clean.
Malone testified that he had entered a plea agreement in federal court wherein he pleaded guilty to the possession of child pornography. Malone testified that he did so because the federal prosecutor informed him that "this was going to be a character case," that "he was going to drag my name through the mud," and that he would involve Malone's wife and daughter. Malone testified that, at that time, his daughter was being recruited to play college basketball and his wife worked in education, so he "thought it was best for [him] to plead guilty." Malone stated that he was "never going to accuse anybody else of what-of the situation that is going on," and was "not going to accuse that this person did this or this person did this to [him]," but he intended "to protect [his] family, and [he] didn't want [his] family involved." Malone further stated that, "[i]t's a tough case." Malone also conceded that in his federal sentencing hearing, he admitted that he sent child pornography to an individual on MeWe.
When asked if he had seen any of the photographs or videos at issue, Malone stated "[a]bsolutely not." Malone directly testified that, "I have never seen these photographs, and I wish that you would not see them." Malone further stated that "I think that this stuff is just absolutely pure evil, and you can use that against me if you want to."
II. Standard of Review
"In a criminal trial, the State carries the burden of persuading the [factfinder] that the defendant is guilty of the offense beyond a reasonable doubt." Baltimore v. State, 689 S.W.3d 331, 340 (Tex. Crim. App. 2024); see Diez v. State, 693 S.W.3d 899, 923 (Tex. App.-Austin 2024, no pet. h.). In examining the sufficiency of the evidence supporting a conviction, we "consider the evidence in the light most favorable to the verdict and determine whether, based on the evidence and reasonable inferences therefrom, a rational juror could have found that the State has proven the essential elements of the crime beyond a reasonable doubt." Baltimore, 689 S.W.3d at 341; see Romo v. State, 663 S.W.3d 716, 719 (Tex. Crim. App. 2022); Diez, 693 S.W.3d at 923. The factfinder has the "full responsibility . . . to fairly resolve conflicts in the testimony, to weigh the evidence, and to draw reasonable inferences from basic facts to ultimate facts." Baltimore, 689 S.W.3d at 341; see Diez, 693 S.W.3d at 923. Stated otherwise, "[t]he factfinder exclusively determines the weight and credibility of evidence." Wise v. State, 364 S.W.3d 900, 903 (Tex. Crim. App. 2012). We "consider the cumulative force of all evidence to determine whether the evidence was sufficient to establish each element of the offense." Baltimore, 689 S.W.3d at 341 (internal footnote omitted); see Diez, 693 S.W.3d at 923. "For the evidence to be sufficient, the State need not disprove all reasonable alternative hypotheses that are inconsistent with the defendant's guilt." Wise, 364 S.W.3d at 903.
We determine the sufficiency of the evidence "by comparing the evidence produced at trial to the essential elements of the offense as defined by the hypothetically correct jury charge." Baltimore, 689 S.W.3d at 341. "A hypothetically correct jury charge accurately sets out the law, is authorized by the indictment, does not unnecessarily increase the State's burden of proof or unnecessarily restrict the State's theories of liability, and adequately describes the particular offense for which the defendant was tried." Id.
III. Possession of Child Pornography
A person commits the offense of possession of child pornography if he "knowingly or intentionally possesses, or knowingly or intentionally accesses with intent to view, visual material that visually depicts a child younger than 18 years of age at the time the image of the child was made who is engaging in sexual conduct," and "the person knows that the material depicts the child." Tex. Penal Code Ann. § 43.26(a)(1), (2); see Romo, 663 S.W.3d at 719. Under the penal code, "[p]ossession'" means actual care, custody, control, or management." Tex. Penal Code Ann. § 1.07(a)(39). "Visual material" includes:
(A) any film, photograph, videotape, negative, or slide or any photographic reproduction that contains or incorporates in any manner any film, photograph, videotape, negative, or slide; or
(B) any disk, diskette, or other physical medium that allows an image to be displayed on a computer or other video screen and any image transmitted to a computer or other video screen by telephone line, cable, satellite transmission, or other method.Id. § 43.26(b)(3). "A person acts intentionally, or with intent, with respect to the nature of his conduct or to a result of his conduct when it is his conscious objective or desire to engage in the conduct or cause the result." Id. § 6.03(a). "A person acts knowingly, or with knowledge, with respect to the nature of his conduct or to circumstances surrounding his conduct when he is aware of the nature of his conduct or that the circumstances exist." Id. § 6.03(b). "A person acts knowingly, or with knowledge, with respect to a result of his conduct when he is aware that his conduct is reasonably certain to cause the result." Id. The penal code defines "possession" of contraband as "actual care, custody, control, or management." Id. § 1.07(a)(39).
"A defendant's mere presence at the location where the contraband is found is insufficient by itself to establish actual care, custody, or control of the contraband." Bordelon v. State, 673 S.W.3d 775, 794 (Tex. App.-Dallas 2023, no pet.); see Tate v. State, 500 S.W.3d 410, 413 (Tex. Crim. App. 2016). When the contraband is not in the defendant's exclusive possession, a factfinder may nevertheless infer that the defendant intentionally or knowingly possessed the contraband if there are sufficient independent facts and circumstances or links justifying such an inference. See Tate, 500 S.W.3d at 413-14; Bordelon, 673 S.W.3d at 794 (applying this "affirmative links" test to possession of child pornography); Ballard v. State, 537 S.W.3d 517, 523-24 (Tex. App.-Houston [1st Dist.] 2017, pet. ref'd) (same); Wilson v. State, 419 S.W.3d 582, 587-88 (Tex. App.- San Antonio 2013, no pet.) (same). It is not the number of links that is significant but instead the logical force of all the evidence. Evans v. State, 202 S.W.3d 158, 162 (Tex. Crim. App. 2006); Bordelon, 673 S.W.3d at 794. This "affirmative links" rule protects the innocent bystander from conviction merely because of his fortuitous proximity to someone else's contraband. Evans, 202 S.W.3d at 161-62; Bordelon, 673 S.W.3d at 794.
"Proof of a culpable mental state almost invariably depends upon circumstantial evidence and may be inferred from any facts tending to prove its existence, including the acts, words, and conduct of the accused." Bordelon, 673 S.W.3d at 794; see Stepherson v. State, 523 S.W.3d 759, 763 (Tex. App.-Houston [14th Dist.] 2017, no pet.). Sufficient evidence to support a determination that the defendant had knowledge of the images of child pornography on his computer may include evidence that:
(1) the images of child pornography were found in different computer files, showing the images were copied or moved;
(2) the images of child pornography were found on an external hard drive or CD, which indicates the images were deliberately saved on the external devices;
(3) the images stored on the computer and the external hard drive were stored in similarly named folders;
(4) the names of the folders containing the images of child pornography necessarily were assigned by the person saving the file; or
(5) the recovery of numerous images of child pornography were recovered from the defendant's computer.Bordelon, 673 S.W.3d at 794; see Ballard, 537 S.W.3d at 523.
In Wise, the Texas Court of Criminal Appeals examined the two general approaches to framing sufficiency analyses in cases involving child pornography images discovered in an electronic device's cache or free space. See Wise, 364 S.W.3d at 904- 05. Under the "present possession" approach, courts analyze the sufficiency of the evidence to determine if the defendant had the knowledge and ability to access the files in their present format, and also consider other evidence establishing that the images were presently knowingly or were intentionally possessed. See id. at 904. Under the "evidence of" approach, courts analyze the sufficiency of the evidence to determine whether a defendant had knowingly or intentionally possessed a pornographic image at a prior point in time. See id. at 905. The court of criminal appeals ultimately determined that in determining the criminal intent necessary to possess child pornography, we analyze each case on its own facts. See id.
IV. Analysis
In his sole issue, Malone argues that the evidence is both unreliable and insufficient to sustain his conviction because the images in question were stored in the trash folder of a cellular phone that was previously owned by someone else. According to Malone, the images and videos at issue were placed into this trash folder in March and April of 2014, but the State failed to prove when he purchased the used phone.
Malone further argues:
Looking at the guidance provided in [Ballard, 537 S.W.3d at 523,] to determine whether there is sufficient evidence to support a jury's determination that a defendant had knowledge of child pornography on his electronic device, [Malone] would show: (1) the child pornography was NOT found in different computer files which [courts] interpret as showing that the images or videos had been copied or moved; (2) the child pornography was NOT found on an external hard drive or a removable storage device, which the [c]ourt in Ballard held indicates the images or videos were deliberately saved on the external device; (3) the child[ ]pornography discovered in the "trash" folder on the cellular phone [was] NOT stored in similarly named folders; and (4) there were no names assigned to the folder containing the images/videos, they were only shown to be in a "trash" folder. The only Ballard factor which weighs against [Malone] was [number five], as "numerous images or videos of child pornography were recovered from the defendant's electronic devices." Id. But [Malone] argues that, if the State has failed to establish [his] knowledge of the images/videos alleged in the counts of conviction, then the [number] of images/videos contained in the trash folder of this second hand cellular phone is irrelevant. [Malone] argues that only [one] of the [five] Ballard factors being present in this case favors the position that the evidence is insufficient to show [Malone] had ever seen these images/videos.In contrast, the State asserts that the evidence was sufficient to sustain the jury's verdict based on Malone's "online activity, sharing child pornography, discussing child pornography, pleading guilty to possessing pornography, and deleting the images in question at separate times the day before his phone was seized."
Reviewing the evidence in the light most favorable to the verdict, we conclude that a rational juror could have found beyond a reasonable doubt that Malone knowingly or intentionally possessed child pornography. See Tex. Penal Code Ann. § 43.26(a)(1); Baltimore, 689 S.W.3d at 341; Romo, 663 S.W.3d at 719. At trial, Malone acknowledged that he pleaded guilty to possessing child pornography in federal court and admitted during sentencing in the federal proceeding that he sent child pornography to another individual through MeWe.
Further, Malone did not deny that the phone belonged to him at the time that the images and videos were discovered. St. James testified that the phone contained "285 pictures and 217 videos displaying children that appeared to be under the age of 18 engaged in explicit sexual conduct." Thus, numerous images of child pornography were recovered from Malone's phone. See Bordelon, 673 S.W.3d at 794 ; Ballard, 537 S.W.3d at 523. Malone acknowledged that he had possessed a MeWe account and conceded that the email address associated with the MeWe account belonged to him. Newlin testified that child pornography was uploaded to the MeWe account associated with Malone's email address through the IP at the residence on Timothy Street, and that Malone had conversations in MeWe in which he requested child pornography with the preferred ages of twelve to sixteen and offered "content" in return. See Bordelon, 673 S.W.3d at 795-96 (examining evidence that "all of the illicit activity was conducted from" appellant's personal account on a computer) (citing Ford v. State, No. 09-09-00525-CR, 2010 WL 4263764, at *6 (Tex. App.-Beaumont Oct. 27, 2010, no pet.) (mem. op., not designated for publication) (reviewing evidence associating the appellant's name, unique account details, and password with downloading child pornography)). Moreover, evidence showed that Malone attempted to delete the images and videos on two separate occasions, including the day before he was arrested. "Attempts to conceal incriminating evidence" constitute "circumstances of guilt." Guevara v. State, 152 S.W.3d 45, 50 (Tex. Crim. App. 2004); see Bordelon, 673 S.W.3d at 795; see also Martin v. State, 151 S.W.3d 236, 244 n.6 (Tex. App.-Texarkana 2004, pet. ref'd) ("It is a well-established principle that destruction of evidence is probative of guilt.").
In terms of contrary evidence, Malone denied that he knowingly possessed child pornography and denied that he had ever seen the photographs and videos at issue. Malone suggested that the child pornography on his phone was placed there by its previous owner, and further argued that the child pornography and related communications may have been placed on the phone by others who had access to his phone and knew his passcode. However, the jury heard all of this defensive evidence and did not conclude that it gave rise to reasonable doubt. We remain mindful that it is the jury's role, not ours, to determine the weight and credibility of evidence. See Wise, 364 S.W.3d at 903. And, to the extent that Malone offers other theories regarding how the child pornography appeared on his phone, the State need not disprove other reasonable alternative theories that are inconsistent with Malone's guilt in order for the evidence to be sufficient to support the conviction. See Wise, 364 S.W.3d at 903; Bordelon, 673 S.W.3d at 796.
In summary, given that we determine each case on its facts, see Wise, 364 S.W.3d at 904-05, we conclude that there are sufficient independent facts and circumstances or links justifying an inference that Malone intentionally and knowingly possessed child pornography. See Tate, 500 S.W.3d at 413-14; Bordelon, 673 S.W.3d at 794; Ballard, 537 S.W.3d at 523-24; Wilson, 419 S.W.3d at 587-88. Accordingly, we overrule the single issue presented in this appeal.
IV. Conclusion
We affirm the trial court's judgments.