Opinion
H045304
09-26-2019
THE PEOPLE, Plaintiff and Respondent, v. BRANDON CONNER, Defendant and Appellant.
NOT TO BE PUBLISHED IN OFFICIAL REPORTS
California Rules of Court, rule 8.1115(a), prohibits courts and parties from citing or relying on opinions not certified for publication or ordered published, except as specified by rule 8.1115(b). This opinion has not been certified for publication or ordered published for purposes of rule 8.1115. (Monterey County Super. Ct. No. SS151256)
Defendant Brandon Conner was convicted by jury of possessing and distributing child pornography. He contends the trial court erred in admitting evidence in the form of a spreadsheet compiled by a private company listing files shared from defendant's computer, some of which were categorized as containing child pornography. Defendant argues he was denied his federal constitutional right to confrontation because the peace officer who testified about it had no personal knowledge about how the files on the spreadsheet were determined to contain child pornography. Defendant also contends there was insufficient evidence to support his convictions, that the trial court committed instructional error, and that a probation condition improperly delegated judicial authority to the probation department. Though sufficient evidence supports defendant's convictions, we conclude they must be reversed because the trial court prejudicially erred by admitting testimonial hearsay that violated defendant's right to confrontation.
I. TRIAL COURT PROCEEDINGS
Defendant was charged with one count of possessing child pornography and one count of distributing child pornography. The following is based on testimony from the jury trial.
A. PEER-TO-PEER FILE SHARING INVESTIGATION
Steven Guidi, an investigator for the Monterey County District Attorney's Office, testified about his work investigating individuals who possess and share child pornography online. Individuals use peer-to-peer networks to share child pornography, on which users can share files stored on their individual computers with other users. One network is called Gnutella. Users need software to access the Gnutella network, such as Limewire (also referred to as Limerunner) or Frostwire. The Gnutella network assigns a Global Unique Identifier to a computer when a user installs peer-to-peer software. Files shared on the network are assigned an SHA value (also referred to as a hash value) via mathematical algorithm that converts the file's "ones and zeros" into a unique alphanumeric value. The SHA value is like a file's fingerprint, and the odds against two files having the same SHA value are "astronomical." If a file is altered in any way it will receive a new SHA value.
Guidi testified that he uses law enforcement software called E-Phex to scan the Gnutella network for IP addresses sharing files with SHA values that match a law enforcement database of known child pornography. (An IP address is "the public side of your modem," meaning it is how one computer is identified by other computers on the internet.) If E-Phex finds an IP address sharing files with SHA values matching suspected child pornography it initiates a browse, which gathers a list of all files shared by that IP address. The program also attempts to download any files with SHA values associated with child pornography.
Guidi testified he ran E-Phex over the course of multiple days in March 2015 and connected to an IP address he later determined was registered to defendant. E-Phex created a spreadsheet of files that the IP address was sharing on those days, which was admitted into evidence. The spreadsheet had columns for the date of the browse, the file name, its SHA value, the Global Unique Identifier used to share the file, and the software program used to share the file (in this case, Limerunner). E-Phex highlighted in red the files with SHA values that matched the law enforcement database of child pornography. Guidi testified that several file names had words or terms commonly associated with child pornography, including "PTHC," which refers to "PreTeen HardCore."
E-Phex was able to successfully download videos containing suspected child pornography from the IP address registered to defendant. Five incomplete video files and one complete video file from the E-Phex downloads were admitted into evidence, and some were played for the jury. SHA values for at least two of those files matched files maintained on a Monterey County District Attorney's Office database of child pornography. Guidi confirmed that he had viewed the database copies of the videos with matching SHA values and that they appeared to show girls under the age of 10 engaged in sex acts with adults. Guidi testified that to share files over the Gnutella network the host computer would ordinarily need to possess a complete version of the file.
B. SEARCH OF DEFENDANT'S ELECTRONIC DEVICES
Based on the E-Phex information, a search warrant was obtained for defendant's residence (where he lived with his wife and no other individuals). Defendant's cellular phone, his wife's cellular phone, and three computers were seized pursuant to the warrant. Two of the computers were turned off at the time, but a password-protected Dell desktop computer was running. The wireless router broadcasting the internet to the residence was also password-protected. Guidi plugged a thumb drive containing a program called osTriage into the Dell computer. That program automatically searches the computer for peer-to-peer information and checks the computer for keywords associated with child pornography. The osTriage program recovered multiple files with a ".lnk" extension and names matching some of the partial files downloaded by the E-Phex program. Guidi explained that .lnk files are similar to shortcuts that can be clicked to open a file stored on a computer's hard drive. Their presence on a computer means that the actual file associated with that file name was (or still is) on the computer, and that a user opened the file.
Guidi later performed a forensic search of the Dell computer. Without forensic search software, neither child pornography nor relevant peer-to-peer software would have been visible. However, the forensic search was able to access even files that a user had deleted at some point. (Guidi explained that after a file is deleted some of its data remains on the computer's hard drive in unallocated space until it is overwritten by new data.) Guidi discovered a properties file related to the Limerunner peer-to-peer software (the same program discovered to have been sharing files when E-Phex scanned the computer in March 2015). The properties file indicated Limerunner had been last accessed in April 2015, a few days before the search warrant was executed. The folder from which files were shared over Limerunner had been set to "users/Connerfamily/documents/Brandon." That folder also contained defendant's résumé and some of his military paperwork. There was a separate folder on the computer ("users/Connerfamily/documents/Sonia") for defendant's wife's files. The forensic search uncovered portions of three suspected child pornography videos (one portion was over nine minutes long), and more than five images of suspected child pornography. That media was admitted into evidence, and the prosecution played parts of some of the videos for the jury. Some of the images were also published to the jury.
The prosecution asked Guidi about a series of text messages exchanged between defendant and his wife in late March 2015. The messages suggested that his wife spent at least one night in San Francisco, and the metadata for a photograph found on one of their cellular phones supported that theory.
C. CHILD RESCUE COALITION EVIDENCE
The following evidence was admitted under Evidence Code sections 1101 and 1108, over defense objections. San Jose Police Department Sergeant Sean Pierce testified about information he obtained from a private company called the Child Rescue Coalition. The Child Rescue Coalition uses automated web crawling software to search peer-to-peer networks for IP addresses that are sharing SHA values matching a private database of suspected child pornography. Law enforcement officers with relevant training receive a login to access the Child Rescue Coalition database and download spreadsheets of data associated with those IP addresses. Pierce testified that he had used the private database when he was a member of an Internet Crimes Against Children Taskforce. While he was on that taskforce he regularly used the database, and he had never found errors in the file categorization system. For this case, Pierce testified that he received the IP address registered to defendant from Guidi and obtained information for that IP address from the Child Rescue Coalition.
A spreadsheet containing that data was admitted into evidence. It contains a list of files shared by the IP address registered to defendant for a period from August 2014 through April 2015. Several of those files are tagged as "child notable," which Pierce explained meant that "either a known victim or a law enforcement agency -- law enforcement officer somewhere in the country has viewed that item and determined it to be child pornography. So it could be either/or." He testified that several files on the list had file names consistent with child pornography, including use of the "PTHC" acronym. The spreadsheet showed that the IP address registered to defendant was sharing suspected child pornography during the same period that the cellular phone evidence indicated defendant's wife was in San Francisco.
D. CLOSING ARGUMENT, VERDICT, AND SENTENCING
During closing argument, the prosecution relied heavily on the Child Rescue Coalition evidence. The prosecutor told the jury it would have access to the Child Rescue Coalition spreadsheet during deliberations, and stated that when going through it "you are going to find files that contain the search term 'Pthc, preteen hardcore,' over 250 times, from August 2014, until April 2015." The prosecutor used the evidence to rebut the theory that someone other than defendant was responsible for the child pornography, arguing "this idea of someone randomly coming into his house, logging on to his computer, 250 times over the course of less than a year, I'll let you determine whether that's reasonable doubt." The prosecutor also connected the Child Rescue Coalition evidence with the cellular phone evidence to argue that defendant's wife could not have shared the files during the period she was in San Francisco. The prosecutor used the spreadsheet to support a modus operandi argument related to the acronym PTHC, stating that if "you look at the files that are associated with child pornography, over 250 in the Care Coalition records ... [and] all the files that we found during E-Phex, that I've already show[n] you, there is one common term." To argue absence of mistake, the prosecutor noted "he shared it before 250 times." And during rebuttal the prosecutor argued "[i]t's true that someone could have broken into his house 250 times over the course of a year, secretly downloaded child pornography to the Brandon folder, shared it across the peer-to-peer network, secretly deleted it, so as to frame him. But that's just an imagination. That's imaginary."
While deliberating, the jury submitted one question: "Does using a peer-to-peer network imply intent to distribute or exchange?" There is no reported discussion about a response, but a court exhibit (signed by the judge and both attorneys) indicates the court gave the following response: "For guidance, I direct your attention to instructions #223 and #224, along with all the other instructions." The jury returned guilty verdicts on both charged counts. The trial court suspended imposition of sentence and placed defendant on three years' formal probation.
II. DISCUSSION
A. CIRCUMSTANTIAL EVIDENCE WAS SUFFICIENT TO SUPPORT THE CONVICTIONS
"In assessing the sufficiency of the evidence, we review the entire record in the light most favorable to the judgment to determine whether it discloses evidence that is reasonable, credible, and of solid value such that a reasonable trier of fact could find the defendant guilty beyond a reasonable doubt." (People v. Bolin (1998) 18 Cal.4th 297, 331.) We presume the "existence of every fact that the trier of fact could reasonably deduce from the evidence" to support the judgment. (People v. Medina (2009) 46 Cal.4th 913, 919.) To overturn a conviction, "it must clearly appear that upon no hypothesis whatever is there sufficient substantial evidence to support it." (People v. Redmond (1969) 71 Cal.2d 745, 755.)
For the possession count, the prosecution had to prove that between March 12 and March 15, 2015 defendant knowingly possessed or controlled images or videos involving the use of a person under 18, knowing that the matter depicts a person under 18 personally engaging in or simulating sexual conduct. (Pen. Code, § 311.11, subd. (a).) For the distribution count, the prosecution had to prove that during the same date range defendant knowingly possessed images or videos and offered to distribute, or actually distributed those images or videos with knowledge that they depict a person under 18 personally engaging in or simulating sexual conduct. (Pen. Code, § 311.2, subd. (c).)
Defendant does not contest the jury's implicit findings that images and videos admitted into evidence depicted persons younger than 18 years old engaging in or simulating sexual conduct. Defendant argues there was insufficient evidence (1) that the offending media were possessed and distributed during the relevant charging period, and (2) that defendant was the person who possessed and distributed the media. Defendant also raises the possibility that the material was obtained by mistake and quickly deleted.
As to the timing of possession and distribution, defendant focuses on the media located in the Dell computer's unallocated space to argue that because that data did not contain metadata or timestamps, there "is no evidence that the deleted files on the unallocated space of the computer were possessed during the dates charged." Similarly, defendant argues that the lack of timestamps and the presence of the files in unallocated space could mean "the computer user got an undesired item and discarded it." But those arguments ignore the E-Phex evidence. Guidi explained that the E-Phex spreadsheet showed the IP address registered to defendant was sharing files with SHA values associated with child pornography on the relevant charging dates. Guidi testified that he personally compared at least some of the suspected child pornography SHA values shared using that IP address against the Monterey County District Attorney's Office's database of child pornography to verify that the files did indeed contain child pornography. And the jury could independently determine the content of the files Guidi was able to download using E-Phex because they were admitted into evidence. That Guidi was able to use E-Phex to download multiple child pornography video files from the IP address registered to defendant also demonstrates distribution. The foregoing amply supports the jury's implicit findings of possession, distribution, and lack of mistake.
As for identifying defendant as the individual who possessed and distributed the illegal content, both the Dell computer (where Limerunner had been installed, and remnants of child pornography remained) and the residence's wireless router were password-protected, making it highly unlikely that anyone other than defendant or his wife was responsible for possessing and distributing the child pornography. As for evidence pointing to defendant being the perpetrator, as opposed to his wife, the shared folder used by Limerunner had been set to: "users/Connerfamily/documents/Brandon." Brandon is defendant's first name, and that folder had other documents associated with defendant including his résumé and military paperwork. A separate folder contained defendant's wife's files. The existence of separate folders—and assignment of the Limerunner shared folder to a folder associated with defendant rather than his wife—supports the inference that defendant was the person who possessed and distributed the child pornography. Though perhaps not compelling standing alone, from the content of the pornography (female children with adult males) a reasonable juror could infer it was more likely an adult male would be interested in possessing and distributing that material than an adult female. Taken together, the foregoing is sufficient to support the jury's implicit finding that it was defendant who possessed and distributed the child pornography.
Defendant's arguments to the contrary fail to acknowledge the strong E-Phex evidence, and they are also otherwise unpersuasive. He argues there was no direct evidence that he possessed or distributed the pornography, that he searched for pornography, or that he was the computer user during the charging period. We agree, but the conviction is supported by circumstantial evidence. (People v. Pierce (1979) 24 Cal.3d 199, 210 ["Circumstantial evidence may be sufficient to connect a defendant with the crime and to prove his guilt beyond a reasonable doubt."].) Defendant complains that the forensic examination of the Dell computer was "cursory," and argues that Guidi should have discussed the search terms saved by the peer-to-peer program. But only remnants of the Limerunner software remained on the computer by the time Guidi performed the forensic search, and those remnants apparently did not include the program's search history. And since the evidence presented by the prosecution was sufficient, a more detailed forensic review was unnecessary. Defendant makes other arguments that merely go to the weight of the evidence, including: that no pornography was found on other electronic devices; that neither defendant nor his wife admitted possessing or distributing the pornography; that there was no description about the installation process for Limerunner; that there was no evidence as to when the pornography was added to the computer; and that there was no evidence as to who created the .lnk files. Though such evidence may have strengthened the prosecution's case, its absence does not mean the evidence presented was insufficient. Finally, although defendant extensively summarizes several cases addressing the sufficiency of the evidence to support convictions for possessing child pornography and similar crimes, he fails to meaningfully connect those authorities to this case, and none compels a finding that the evidence here was insufficient.
As we find the foregoing evidence sufficient to convict defendant of possessing and distributing child pornography, we do not address whether the Child Rescue Coalition evidence might have provided even greater support for the convictions.
B. THE CHILD RESCUE COALITION EVIDENCE VIOLATED DEFENDANT'S SIXTH AMENDMENT RIGHTS
Defendant argues that the Child Rescue Coalition spreadsheet contained testimonial hearsay such that its admission violated his federal constitutional right to confrontation under Crawford v. Washington (2004) 541 U.S. 36 (Crawford) and its progeny. The People respond that the spreadsheet either was not hearsay because it was machine-generated, or was admissible under the business records exception to the hearsay rule. The People fail to address the federal constitutional issue.
As we previously described, the Child Rescue Coalition spreadsheet was introduced through the testimony of San Jose Police Department Sergeant Pierce. The spreadsheet showed a list of files that the IP address registered to defendant shared online between August 2014 and April 2015. Nearly 200 of those files were categorized on the spreadsheet as "child notable," which Pierce testified meant they either involved a known victim or "a law enforcement agency -- law enforcement officer somewhere in the country has viewed that item and determined it to be child pornography."
Defense counsel cross-examined Pierce extensively about the child notable designations. When asked how the Child Rescue Coalition knows whether SHA values are associated with child pornography, Pierce responded: "So I don't know where they get -- I'm sure they get them from law enforcement." He acknowledged that the Child Rescue Coalition could not independently verify whether the files contained child pornography because it is a private company whose own possession of the files to view them would be illegal. When asked about the database, he responded "I'm not sure where they obtain their [child notable] hash sets." He agreed that if the Child Rescue Coalition was "given incorrect information, then they would be searching for things that may not be child pornography[.]" And he testified that when he personally investigates this type of crime he generally verifies the suspected child pornography by comparing the SHA values in the Child Rescue Coalition database against the San Jose Police Department's library of known child pornography. He acknowledged he did not do so in this case because he was not the investigator and he was asked only to download the information from the Child Rescue Coalition and send it to Guidi. There was no evidence that Guidi compared the files characterized as "child notable" by the Child Rescue Coalition to known images of child pornography.
The trial court addressed admission of the Child Rescue Coalition spreadsheet both in limine and at an Evidence Code section 402 hearing. Defense counsel's objections focused on a lack of foundation. The prosecution raised the Crawford issue at the Evidence Code section 402 hearing, stating: "the question, which hasn't been raised, and in full candor to the court, I think is a good argument, is a Crawford question." The prosecutor argued that defendant's confrontation rights would not be impaired because San Jose Police Department Sergeant Pierce would testify about the records, and defense counsel "can confront on all these questions that [counsel] has raised in argument" about the reliability of the records. Defense counsel responded that Pierce did not have adequate personal knowledge to address the confrontation issue. Defense counsel argued Pierce should be able to "explain the record he received, but not anything about how that was maintained or protected." Counsel continued that Pierce could not "establish[] the veracity of the document and the information within it."
The trial court found the spreadsheet admissible, reasoning: "It seems to me that the records are not an extra layer. What's being presented in court is the information. There is no -- it's not as if there is somebody who is testifying that somebody else did something." The court continued that even if the spreadsheet were hearsay, "it's properly permitted as a business record." The trial court ultimately admitted the evidence under both Evidence Code section 1101 (to show absence of mistake) and Evidence Code section 1108 as evidence of uncharged sexual offenses committed by defendant (specifically, as other violations of Pen. Code, §§ 311.2 and 311.11). It did not address the Crawford issue.
1. Crawford v. Washington
The Sixth Amendment's confrontation clause guarantees that in "all criminal prosecutions, the accused shall enjoy the right ... to be confronted with the witnesses against him." (U.S. Const., 6th Amend.; see also Cal. Const., art. I, §§ 15, 24.) In Crawford, the United States Supreme Court decided that the confrontation clause bars admission of "testimonial hearsay" statements of a witness unless that witness was unavailable to testify, and the defendant had had a prior opportunity for cross-examination. (Crawford, supra, 541 U.S. at pp. 53-54.) Machine-generated information that is produced automatically without human input is not hearsay. (People v. Goldsmith (2014) 59 Cal.4th 258, 274.) And business records may be admissible as an exception to the hearsay rule if certain foundational elements are satisfied. (Evid. Code, § 1271.)
Even where a hearsay exception applies, admissibility is limited by the confrontation clause if a statement is "testimonial." A testimonial statement is " 'made under circumstances which would lead an objective witness reasonably to believe that the statement would be available for use at a later trial.' " (Crawford, supra, 541 U.S. at p. 52; see also Davis v. Washington (2006) 547 U.S. 813, 822 (Davis) [statements are testimonial "when the circumstances objectively indicate that there is no ... ongoing emergency, and that the primary purpose of the interrogation is to establish or prove past events potentially relevant to later criminal prosecution"].) Though we ordinarily review a trial court's evidentiary decisions for abuse of discretion (People v. Jones (1998) 17 Cal.4th 279, 308), we independently determine whether a statement is testimonial hearsay for confrontation clause purposes (People v. Nelson (2010) 190 Cal.App.4th 1453, 1466).
2. The Child Rescue Coalition Spreadsheet Contains Hearsay
The People argue that the spreadsheet is not hearsay because it is merely "computer generated information about what files appellant's unique computer GUID was sharing from his unique IP address on a peer-to-peer computer network." Though it appears much of the information on the spreadsheet was machine-generated and therefore not hearsay, the People's argument does not address the "child notable" designations. Unlike the other information on the spreadsheet, the child notable designations involved human input. Those designations were placed on particular SHA values based on reports from law enforcement that the files with those SHA values contain child pornography. That deliberative process renders the child notable designations on the spreadsheet hearsay.
The People argue in the alternative that the spreadsheet was admissible as a business record. "Evidence of a writing made as a record of an act, condition, or event is not made inadmissible by the hearsay rule when offered to prove the act, condition, or event if: [¶] (a) The writing was made in the regular course of a business; [¶] (b) The writing was made at or near the time of the act, condition, or event; [¶] (c) The custodian or other qualified witness testifies to its identity and the mode of its preparation; and [¶] (d) The sources of information and method and time of preparation were such as to indicate its trustworthiness." (Evid. Code § 1271.)
The problem with admitting the child notable designations as business records is one of untrustworthiness. The People contend that "Pierce checked those child pornography files against a law enforcement library of known child pornography to verify that the files contained child pornography because [the Child Rescue Coalition] cannot legally and does not possess those files." That contention misstates the record. Pierce testified that, as a general matter, he would check the child notable SHA values against his police database when he personally investigated individuals suspected of sharing child pornography. But he acknowledged that he did not do so in this case because the request from Guidi was merely to download the information from the Child Rescue Coalition and send it to him. Pierce also testified that he did not know where the Child Rescue Coalition obtained the reports that resulted in designating certain SHA values "child notable," and stated only that he was "sure they get them from law enforcement." Without any independent verification that the child notable designations on the Child Rescue Coalition spreadsheet actually correspond to child pornography, the trial court erred in admitting the spreadsheet under the business records exception.
3. The Child Notable Designations Are Testimonial Hearsay
The purpose of designating certain SHA values as "child notable" was to establish or prove past events (that the files contain child pornography) potentially relevant to later criminal prosecution. (Davis, supra, 547 U.S. at p. 822; see United States v. Bates (11th Cir. 2016) 665 Fed.Appx. 810, 814-815 [finding spreadsheet from predecessor company to Child Rescue Coalition was testimonial hearsay; "the government used the reports to ... prove that the files Bates downloaded were child pornography."].) Indeed, Pierce testified that the very purpose of the Child Rescue Coalition as a company is to capture IP addresses sharing known child pornography so the information can be used by law enforcement. We therefore conclude that admitting the evidence violated defendant's right to confront the witness or witnesses responsible for assigning the child notable designations. We note, however, that our opinion should not be construed as forbidding the use of evidence such as the Child Rescue Coalition spreadsheet, with appropriate attention to the confrontation issues discussed here.
4. The Errors Were Prejudicial
A federal constitutional error is reversible unless the People can show that the error was harmless beyond a reasonable doubt. (Chapman v. California (1967) 386 U.S. 18, 24.) The People argue any error was harmless because the evidence supporting the two counts was overwhelming. Though we agree the prosecution's case was strong, that does not make the erroneous admission of highly prejudicial evidence harmless. The Child Rescue Coalition spreadsheet aided the prosecution's case in several ways. It helped prove that the child pornography was not accidentally acquired by showing the files had been shared from defendant's computer hundreds of times over the course of several months. It strengthened the prosecution's argument that defendant, rather than his wife, was the perpetrator by showing that pornography was being shared while defendant's wife was in San Francisco. And it was admitted under Evidence Code section 1108 as evidence of defendant's bad character. The prosecutor focused heavily on the Child Rescue Coalition spreadsheet throughout closing and rebuttal argument. On more than 10 occasions during argument the prosecutor referred to the Child Rescue Coalition spreadsheet to argue that defendant shared child pornography 250 times. Given the strength the inadmissible evidence added to the prosecution's case, and the outsized focus the prosecutor placed on that evidence during closing argument, we cannot conclude that admitting the evidence was harmless beyond a reasonable doubt. In light of this conclusion and the reversal it necessitates, we need not reach defendant's arguments about jury instructions or probation conditions.
III. DISPOSITION
The order granting probation is reversed and the matter is remanded for possible retrial.
/s/_________
Grover, J.
WE CONCUR:
/s/_________
Mihara, Acting P. J. /s/_________
Danner, J.