Summary
In Moran, the government's disclosure letter provided a summary paragraph for a computer expert, but the government also provided the expert's CV, the expert's report, complete with a spreadsheet and details about specific computer files and made the expert available to the defense before trial.
Summary of this case from United States v. RomanoOpinion
No. 18-5648
05-03-2019
UNITED STATES OF AMERICA, Plaintiff-Appellee, v. BRANDON MORAN, Defendant-Appellant.
NOT RECOMMENDED FOR FULL-TEXT PUBLICATION
File Name: 19a0237n.06 ON APPEAL FROM THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF KENTUCKY Before: GUY, CLAY, and GRIFFIN, Circuit Judges.
RALPH B. GUY, JR., Circuit Judge. Brandon Moran was convicted by a jury of four child pornography offenses—one count of distributing, one count of possessing, and two counts of receiving child pornography—in violation of 18 U.S.C. § 2252(a)(2) and (4)(B). Seeking a new trial on all counts, Moran contends that the district court erred by: (1) allowing an expert witness to testify to matters outside the scope of the government's pretrial disclosures; and (2) providing an inadequate answer to a question posed by the jury during deliberations. Moran also challenges the sufficiency of the evidence to support the distribution conviction, arguing that no reasonable juror could conclude that he knew the files contained child pornography at the time they were distributed. We affirm.
I.
On June 6, 2016, a computer operated by Kentucky's Internet Crimes Against Children Task Force was searching for available child pornography on a peer-to-peer network and successfully downloaded four files containing child pornography from a single IP address near Marysville, Kentucky. Alerted to the download, Kentucky State Police Detective Brian Cooper confirmed that the files contained child pornography, requested subscriber information for the associated IP address, and obtained a search warrant for the home where Brandon Moran resided with other family members.
The four files, which were the basis of the distribution count, consisted of: one video and one picture file that were both named "new pthc opva 2014 real father fucks his 13 yo daughter in the basement"; and one video and picture file that were both named "pedo Lolita pthc hussyfan two preteen lesbian to cam." There was testimony that "pthc" refers to "pre-teen hard core."
When the warrant was executed on June 14, 2016, Detective Cooper interviewed Moran's sister and nephew who lived in the home; determined that the sister's boyfriend, who was the subscriber, had not lived there in weeks; and learned that Moran's mother lived there but required care for dementia. That left 25-year-old Brandon Moran, who led Detective Cooper to his room in the basement and acknowledged that he had been using BitTorrent on the laptop computer that was sitting on a table. The interview with Moran that followed was recorded and played for the jury, although he did not testify at trial.
In that interview, Moran was advised of his right to remain silent before being questioned further. Moran then confirmed that the bedroom and computer were his; stated that the wifi connection and computer were password protected; and admitted that there was child pornography on his computer. Referring to child pornography, Moran said: "I have clicked on it, I'm not going to lie to you, sir." Moran said he had looked at all kinds of porn, but denied watching "baby porn" and claimed that he had used the search term "Lolita" to look for Japanese animated pornography. When asked how torrents worked, Moran said he did not really know but then described having downloaded and used several peer-to-peer programs—including, BitComet, BitTorrent, UTorrent, Frostwire, and Limewire. Moran also explained that a torrent download sometimes included things he did not want, such as child pornography and that he sometimes tried unsuccessfully to delete it. Near the end of the interview, Detective Cooper asked, "let me get this straight . . . [y]ou're telling me that you know there is child pornography on that computer?" And Moran answered, "Yes sir I do."
The interview also included an extended exchange about file sharing, which is relevant to the charge that Moran knowingly distributed the four files that were obtained by the state computer. During that exchange, Moran said he did not understand how peer-to-peer file sharing worked before going on to make further statements that suggested he understood well enough. For example, at one point, Moran acknowledged that someone using the correct peer-to-peer software would be able to get a picture from a share folder on his computer. And, although he denied having shared child pornography directly, he ultimately agreed that it was possible he could have shared it indirectly from a share folder because "that's how Torrent works when you download stuff."
Detective Cooper seized the laptop, which was turned over to a computer forensics examiner with the Kentucky State Police. The examiner, Mike Viergutz, who testified as an expert witness, found approximately 200 files—including 106 videos and 91 images—which Moran stipulated at trial contained or consisted of depictions of minors engaging in sexually explicit conduct. (Gov't Exh. 8.) About 20 of those files were recovered from the recycle bin. Viergutz prepared a spreadsheet with detailed information about those files, including creation date, directory path, file name, and a unique digital identifier called a "hash value." (Gov't Exh. 9.) Although none of the four files retrieved by the state computer was found on Moran's computer, file paths remained indicating that those four files had once been in the "c:\downloads folder." Viergutz testified that the only recovered internet search history that was relevant to the charges was a single parsed (i.e., partial) search on Bing for "pedo forum."
Viergutz extracted a long list of torrent files that had been downloaded to Moran's computer with various peer-to-peer programs, which included some torrents with names that suggested child pornography, two that referenced a known series of child pornography, and others that had innocuous names or characters ("FrostWire" spreadsheet). (Gov't Exh. 11.) Viergutz also found two logs on Moran's computer that were created by the BitComet software: one log showed downloads made using BitComet ("BitComet MyHistory") and the other showed files shared through BitComet ("BitComet MyShares"). (Gov't Exhs. 10a & 10b.) Those BitComet logs were the subject of the jury's question during deliberations.
The order denying Moran's post-verdict motion for judgment of acquittal specifically identified the following torrent file names found on Moran's computer as indicative of child pornography: (1) "collection01 preteen pedo underagfe pthc babyshivid Lolita maffiasex hussyfan st. Petersburg Is magazine"; (2) "Falko III (with sound)"; (3) "[pthc] falkovideo - part 3 . . . 2014 opva preteen loli 10yo 8yo 9yo 11yo 12yo pedo mom family"; (4) "1st-Studio Siberian Mouse Custom (ND_TA)"; (5) "_cp"; (6) "BabyJ-R@ck (55S) 5yo enjoys gentle fuck from very big dick (R@ygold Style RCA pedo 9yo Child sex)"; (7) "baby bj"; (8) "Izzy 8yo 1b - Deep throating"; (9) "CBaby 7 - 3yo girl eat cum (2m44s)"; (10) "awe pthc videos"; (11) Children-W"; (12) PTHC - (=^.^=) Fernanda (12yo) Cumshot In Face [child kids pedo r@ygold hussyfan]"; (13) "!!!NEW!!!PTHC - (=^^.^^=) Fernanda (12yo) Cumshot In Face [child kids pedo r@gold hussyfan]"; (14) "cP."
Testimony about how peer-to-peer networks operate was admitted primarily through Robert Couchman, the Kentucky State Police Detective who ran the state computers searching for available child pornography. Briefly, he explained that peer-to-peer networks generally, and BitTorrent specifically, use the internet to share content directly between computers that have the same or compatible client software. To find available content, BitTorrent users typically go to an index site where search terms are entered to find torrent files. The search results are hyperlinks, which look like a file name, picture, or symbol, and, when clicked on, the torrent file is downloaded by the user's client software program. The file name often indicates what the content will be, but it is possible, for example, that a file called "cat.jpg" actually is a picture of a dog. Also, the torrent file itself does not contain the content; instead, it is the "package" and provides instructions for creating a file to receive the content and includes the metadata for the locations where that content can be retrieved on the network.
Once the user clicks on a torrent file, the user's software, in this case BitComet, launches automatically to open the torrent file (similar to how Adobe launches to open a .pdf file) and then begins to retrieve the content in pieces from other computers if it is available for sharing. The pieces can consist of whole files or parts of files. If the user who downloads a torrent has not allowed sharing of files, the download speed is "choked" or slowed down greatly. BitComet allows sharing of pieces before a whole file is received, and the version of BitComet on Moran's computer allowed the user to share by default or to turn off sharing. The state computers monitored multiple networks for available content suggestive of child pornography, but the state computers were specially configured to download only from a single IP address and to prevent any content that was received from being shared.
With respect to the four files that the state computer requested and received from Moran's computer on June 6, Couchman testified in detail from a log of the communications between the computers. In short, when the state computer initiated a "handshake" at 59:17, Moran's computer responded that it did not have any of the 92 pieces of those four files available for sharing. BitComet on Moran's computer responded that it had only one piece available (which was also one complete file) at 59:47; and then it communicated that it had all four files as of 1:01:58. Sixteen second later, at 1:02:14, the state computer received the first complete piece of those files from Moran's computer; and, at 1:12:21, the state computer finished receiving all four files from Moran's computer. The log also indicated that Moran's computer was receiving those files as an "unchoked" download.
Moran moved unsuccessfully for judgment of acquittal at the close of the government's proofs and again after the defense rested without presenting any witnesses or other evidence. The jury found Moran guilty of distributing child pornography on June 6, 2016; receiving child pornography on May 15 and June 12, 2016; and possessing additional files of child pornography when his laptop computer was seized on June 14, 2016. The district court denied Moran's post-verdict motion for judgment of acquittal, and imposed a below-Guidelines sentence of 138 months of imprisonment. This appeal followed.
There appears to be no dispute that the receiving and possessing counts each involve distinct videos or images, which is necessary to avoid a violation of the Double Jeopardy Clause. See United States v. Ehle, 640 F.3d 689, 696-98 (6th Cir. 2011).
II.
Reviewing the denial of a motion for judgment of acquittal de novo, this court views the evidence in the light most favorable to the government and asks whether "any rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt." Jackson v. Virginia, 443 U.S. 307, 319 (1979); see also United States v. Humphrey, 279 F.3d 372, 378 (6th Cir. 2002). In evaluating the evidence, we "must draw all reasonable inferences from the record in favor of the prosecution and must avoid the temptation to weigh the evidence anew or assess the credibility of witnesses." United States v. Fitzgerald, 906 F.3d 437, 449 (6th Cir. 2018). Challenging only the conviction for distributing child pornography, Moran argues that the evidence could not establish that he knew the files constituted or contained child pornography at the time of distribution.
Moran accepts that distribution under 18 U.S.C. § 2252(a)(2) may be established by showing "that the defendant maintained child pornography in a shared folder, knew that doing so would allow others to download it, and another person actually downloaded it." United States v. Pirosko, 787 F.3d 358, 368 (6th Cir. 2015) (quoting United States v. Budziak, 697 F.3d 1105, 1109 (9th Cir. 2012) (following First, Eighth, and Tenth Circuits)). Although Pirosko addressed this proposition in a different context, this statement represents a consensus among the circuits that passive distribution of known child pornography made available for sharing on a peer-to-peer network constitutes distribution. As the First Circuit explained: "When an individual consciously makes files available for others to take and those files are in fact taken, distribution has occurred" and "[t]he fact that the defendant did not actively elect to transmit those files is irrelevant." United States v. Chiaradio, 684 F.3d 265, 282 (1st Cir. 2012); see also United States v. Ryan, 885 F.3d 449, 453 (7th Cir. 2018); United States v. Richardson, 713 F.3d 232, 235-36 (5th Cir. 2013).
An analogy adopted by some circuits compares the distribution of child pornography through peer-to-peer sharing "to that of the owner of a self-service gas station: although the owner might not be present and does nothing when a motorist purchases gas at the pump, the gas station owner distributes gasoline just as a computer user on a peer-to-peer network distributes child pornography—by making the material available for other users on the network just as the gasoline is available to passing motorists." Richardson, 713 F.3d at 236 (relying on United States v. Shaffer, 472 F.3d 1219, 1223-24 (10th Cir. 2007)). Of course, a gas station owner is also in the business of selling gas. But the description of passive distribution is illustrative nonetheless.
Similarly, this court has repeatedly held that a two-level sentencing enhancement for distribution of child pornography applies when files are knowingly made available through file-sharing software. See United States v. Abbring, 788 F.3d 565, 567-68 (6th Cir. 2015) (citing cases interpreting USSG § 2G2.2(b)(3)(F)). The point of using a file-sharing program, we said, "is to share, sharing creates a transfer, and transferring equals distribution." Id. at 567 (citing United States v. Connor, 521 F. App'x 493, 499-500 (6th Cir. 2013)).
Moreover, in Abbring, the enhancement applied even though the file sharing occurred at the same time the defendant was downloading the files. Id. at 567. It did not matter that the peer-to-peer software in that case did not allow users to disable automatic sharing or that files could not be moved out of the shared folder until the download had been completed. Id. at 566. This court explained that all the guidelines require "is the knowing sharing of the files." Id. at 567-68. As the Seventh Circuit concluded in Ryan, "[t]here is no reason why this same definition should not apply when interpreting 'distribute' in the criminal statute." 885 F.3d at 453.
Without denying that knowing distribution was established, Moran argues that no reasonable juror could conclude that he knew, or could have known, that those files consisted of or contained child pornography at the time they were distributed. This court has long held that § 2252(a)(2) requires knowledge of "the nature of the materials received or distributed." United States v. Brown, 25 F.3d 307, 311 (6th Cir. 1994). However, "knowledge of the contents of material 'may be proven by circumstantial evidence.'" United States v. Hentzen, 638 F. App'x 427, 431 (6th Cir. 2015) (quoting United States v. Kussmaul, 987 F.2d 345, 350 n.4 (6th Cir. 1993)).
In Hentzen, this court found that circumstantial evidence was sufficient to establish that the defendant knew the character of the material involved because there was evidence that he searched for child pornography and viewed it once it was on his computer. Id. at 431-32. That was the case despite the defendant's innocent explanations because this court "'may not reweigh the evidence, reevaluate the credibility of witnesses, or substitute our judgment for that of the jury." Id. at 431 (citation omitted); see also United States v. Haymond, 672 F.3d 948, 957 (10th Cir. 2012) (finding sufficient circumstantial evidence of knowledge where the jury could conclude the defendant used a peer-to-peer network to search for, click on, and download child pornography).
Here, there was evidence that Moran used peer-to-peer file sharing networks, understood that any downloaded files in a shared folder could be retrieved by other users on the network, and knew that child pornography was downloaded to his computer. It is true that the four files sent to the state computer were not found on Moran's computer when it was seized, which a jury could infer meant that the content was not what he was looking for. Nor did the forensic examination find internet searches for child pornography beyond a single recovered parsed search for "pedo forum." Although Moran suggested during his initial interview that he sometimes received content that he did not want, he also admitted to having clicked on child pornography and admitted that there was child pornography on his computer. In fact, the forensic examination found about 200 files of child pornography on Moran's computer, and only about 20 of them had been moved to the recycle bin. Further, plenty of the file names were consistent with Moran's stipulation that they contained or consisted of child pornography.
The jury was entitled to consider Moran's admissions along with the testimony that BitTorrent users typically go to an index site and enter search terms when looking for torrent files to download. Moreover, once a link to a torrent file is found, the user must affirmatively click on it to download the torrent file and activate BitComet to retrieve the files. Although the specific torrent file associated with the four distributed files had a non-descriptive name and only some of the other torrent file names were indicative of child pornography, the jury could infer that Moran had searched for that content and clicked on it because he expected it to be what he was looking for.
The district court emphasized that Moran's computer finished downloading all of the pieces of all four files before the state computer received anything from Moran's computer. However, it is not necessary to prove that Moran actually saw the files prior to the distribution in order for a reasonable juror to conclude that Moran knew the nature of the material that was downloaded and made available for sharing. For that reason, it does not matter how short the time was between when Moran's computer finished downloading all four files and when the state computer received the first complete piece at 1:02:14 (16 seconds), or the first complete file at 1:02:35 (2 ½ minutes), or all of the four files at 1:12:21 (12 ½ minutes).
Viewed in the light most favorable to the government, the evidence was sufficient to lead a reasonable juror to conclude beyond a reasonable doubt that Moran's search for child pornography produced a link to the torrent file in question, which Moran activated knowing that he would receive child pornography in his shared download folder. The district court did not err in denying Moran's motions for judgment of acquittal.
III.
This court reviews a district court's admission or exclusion of evidence for abuse of discretion. See United States v. White, 492 F.3d 380, 398 (6th Cir. 2007). But even when there is an abuse of discretion, we reverse only when the error affects the substantial rights of a party. Id. (citing Fed. R. Evid. 103(a) and United States v. Whittington, 455 F.3d 736, 738 (6th Cir. 2006)).
Moran contends that the district court abused its discretion by allowing Viergutz to offer certain opinion testimony as a computer forensics expert. Specifically, defense counsel objected to Viergutz's testimony that the seven files containing child pornography found in a folder called "users\Sherry\Pictures" had been "purposely put there as opposed to being directly [put] in the downloads folder by the default settings" of the peer-to-peer software. Moran argues, as he did at trial, that this opinion should have been excluded because it was outside the scope of the government's pretrial disclosures required by Federal Rule of Criminal Procedure 16(a)(1)(G).
Upon request, the government must give the defendant "a written summary of any testimony that the government intends to use under Rules 702, 703, or 705 of the Federal Rules of Evidence during its case-in-chief at trial." Fed. Rule Crim. P. 16(a)(1)(G). That summary "must describe the witness's opinions, the bases and reasons for those opinions, and the witness's qualifications." Id.; see also United States v. Davis, 514 F.3d 596, 612 (6th Cir. 2008).
Here, the government's disclosure identified Mike Viergutz as a computer forensics expert, provided a copy of his CV, and indicated that Viergutz would testify to the content of the forensics report that had also been disclosed. In relevant part, the government's letter also stated:
Viergutz will testify that when examining the computer seized from the Defendant's home, he discovered images and videos of minors engaged in sexually explicit conduct. Viergutz will explain where he found the images, how they came to reside there, the file names (some of which are indicative of child pornography), and whether the images were deleted. Viergutz will also explain that he located files indicating the computer user received and saved child pornography files.(Emphasis added.) The record reflects that Viergutz's report was disclosed to the defense, including the spreadsheet that provided details regarding the files that contained child pornography. Viergutz was also made available to defense counsel prior to trial. The district court overruled Moran's objection, finding that the testimony about where those files were located and how they got there was covered by the disclosure and was an obvious inference to be drawn from the spreadsheet of the files found.
Viergutz's report does not appear to be in the record, but we know that it included the list of files containing child pornography with details including the file path locations that were admitted at trial. Viergutz testified without objection that the version of BitComet on Moran's computer directed files to a "downloads" folder as a default. And Viergutz's testimony that the files were located in a folder other than the downloads folder fits with the government's disclosure that Viergutz would "explain where he found the images[ and] how they came to reside there." The district court did not abuse its discretion in finding that the basis for that testimony was adequately disclosed. Moreover, although the prosecutor's closing argument referenced Viergutz's testimony that a few of child pornography files were found outside of the "downloads" folder, Moran has not shown that the admission of Viergutz's opinion that those files had been deliberately moved affected Moran's substantial rights.
IV.
Finally, Moran argues that reversible error occurred because the district court failed to adequately respond to the jury's question. When, as here, an objection was made, we review the district court's response to the jury's question for an abuse of discretion. United States v. Fisher, 648 F.3d 442, 446-47 (6th Cir. 2011). This court "may reverse a judgment only if the instructions, viewed as a whole, were confusing, misleading and prejudicial." United States v. Clark, 988 F.2d 1459, 1468 (6th Cir. 1993).
If the jury is confused about an important legal issue not covered in the jury instructions, "a district court abuses its discretion by not clarifying the issue." Fisher, 648 F.3d at 447 (citing United States v. Nunez, 889 F.2d 1564, 1567-69 (6th Cir. 1989)). However, the judge "should refrain from straying beyond the purpose of jury instructions by answering jury questions that seek collateral or inappropriate advice." Id. (citing United States v. Combs, 33 F.3d 667, 670 (6th Cir. 1994)). And "the court must be careful not to invade the jury's province as fact-finder." Nunez, 889 F.2d at 1569.
During deliberations, the jury sent the following written request: "We would like to see the BitComet search history with key words that the state showed @ the end of her rebut[al]. That is if it is entered into evidence. Juror 607." It was clear to everyone—then and now—that the jury was referring to the BitComet logs admitted as Exhibits 10a and 10b. Because neither of those logs represented a search history, defense counsel proposed that the jury be told that there was no BitComet search history. The government argued that the court's response should not highlight or comment on the absence of evidence, particularly because it was clear what evidence the jury was asking to see. Rejecting defense counsel's proposed language, the district judge sent the jury the following handwritten response:
What was shown by the prosecutor during her rebuttal closing was a printout of Gov't Exh 10a & 10b, which you have on a disc in evidence. Exh 10a is the BitComet "my history" spreadsheet and Exh 10b is the BitComet "my shares" spreadsheet.(The jury's question did not involve a legal issue requiring clarification, and the district court's answer was an eminently appropriate attempt to respond to the jury's request without commenting on the evidence. The response also emphasized what the exhibits actually were—as opposed to what they were not.
Defense counsel requested that the court respond: "There is not a BitComet search history. On rebuttal, the United States showed a copy of Exhibits 10A and 10B, BitComet MyShares and MyHistory."
Moran argues on appeal that the additional clarification he requested was necessary because the existence of a BitComet search history had been suggested, albeit unintentionally, by the prosecutor during closing arguments. The record does not support this contention. First, the passage Moran quotes actually referred to the FrostWire spreadsheet of torrent files found on Moran's computer (Exhibit 9). And, the prosecutor's argument in that regard was that the jury could infer from the names of some of the torrent file that were downloaded to Moran's computer that Moran had searched for child pornography on the various peer-to-peer networks.
Second, the prosecutor also separately described the two exhibits in question as "evidence that Detective Viergutz was also able to glean directly from BitComet." Specifically, she argued that one showed "the titles of the files that were in his MyShares folder" and that the "history of BitComet" showed the file paths, file size, and the titles of "the files that he had on his computer, that he got from BitTorrent, that he downloaded via BitComet, and that he was making available for sharing with others." Defense counsel argued in closing that the government could not prove what Moran had searched for when he downloaded the torrent associated with the four files that the state computer received; that the torrent itself did not have a name indicative of child pornography; and that the file names would not have been visible when Moran decided to download them. So, in rebuttal, the prosecutor pointed to "the names of the torrent files" in the "records BitComet was keeping on the defendant's computer."
The jury was urged to look at the BitComet logs showing Moran's downloads and shared files to evaluate his assertions of accidental, inadvertent, or unintentional downloads of child pornography. The district judge did not abuse his discretion in answering the jury's question about the evidence in the way he did, and the instructions as a whole were not confusing, misleading, or prejudicial.
* * *
AFFIRMED.