Opinion
3:19-cr-215
09-08-2021
United States of America, Plaintiff v. Dustin Naida, Defendant
MEMORANDUM OPINION AND ORDER
Jeffrey J. Helmick, United States District Judge
I. Introduction & Background
On April 3, 2019, the grand jury returned a two-count indictment charging Naida with: (1) one count of receipt or distribution of child pornography on or about April 14, 2017, in violation of 18 U.S.C. § 2252(a)(2); and (2) one count of possession of child pornography on or about June 26, 2017, in violation of 18 U.S.C. § 2252(a)(4)(B). (Doc. No. 1). Naida entered pleas of not guilty to these charges and proceeded to trial. After hearing testimony from six government witnesses at trial and reviewing associated exhibits, a jury unanimously found Naida guilty of both of charges. (Doc. No. 50).
In response, Naida filed a motion for a judgment of acquittal or, alternatively, a new trial. (Doc. No. 66). The government filed an opposition brief, (Doc. No. 74), and Naida filed a reply brief. (Doc. No. 76).
A. Initial Investigation
Naida's trial began with the testimony of Joshua Seney, who recounted a 2017 investigation that ultimately resulted in the child pornography charges against Naida. At the time of the 2017 investigation, Seney was the Supervisor Detective Sergeant of the Sylvania, Ohio Police Department and also worked as a United States Secret Service task force officer in computer forensics. Prior to testifying at Naida's trial, Seney retired from law enforcement after 25 years of service.
At trial, Seney testified that on April 14, 2017, he performed an undercover download using a law enforcement tool on the peer-to-peer file-sharing program BitTorrent. The BitTorrent tool downloaded 171 digital image files of suspected child pornography (including files with the name “Sandra”) from the IP address 71.72.101.61. Seney explained to the jury the methodology used to identify Dustin Naida as the subscriber of that IP address. Seney also testified that the physical address on record for this IP address was 892 East Riverview Avenue, Apartment 23 in Napoleon, Ohio 43545. Based upon this information, officers sought and obtained a search warrant for this address.
Seney explained he had seen the “Sandra” name in previous child pornography investigations as “this group of photos has been around for quite awhile.” (Doc. No. 64 at 74).
On the morning of June 26, 2017, Seney, along with agents from the United States Secret Service and officers from the Napoleon Police Department arrived at Apartment 23 to execute the search warrant. But on arrival, they discovered that Naida had moved without notifying his internet provider. United States Secret Service Special Agent Steve Snyder then contacted the property manager, who provided Naida's new address. Naida's new apartment was located approximately half a mile down the road from the old address in a different apartment complex operated by the same property management company.
Because the search warrant was for Apartment 23 and not the new address, agents could only enter and search the apartment with consent. Therefore, when agents arrived at Naida's new apartment, they knocked on the door. Naida, who was alone in the apartment at the time, answered the door and allowed the agents to enter the apartment. Once inside, the agents explained they were there pursuant to a child pornography investigation. Seney testified Naida's response to this news was “flat” or non-existent. (Doc. No. 64 at 91). Naida permitted the agents to stay.
In the living room, agents observed a Hewlett Packard laptop sitting next to Naida on the couch. Naida affirmed the laptop belonged to him and consented to its search. While Seney conducted a preliminary search of the laptop, agents questioned Naida about his knowledge of computers. Seney testified that Naida stated he had received computer training and had used peer-to-peer file sharing programs in the past. (Doc. No. 64 at 106).
Seney recounted that the preliminary search of the laptop's hard drive revealed “.lnk” files with naming conventions consistent with child pornography. Seney explained that “.lnk” files are not images but files automatically created by the operating system in a hidden folder when the user accesses and interacts with the actual file. According to Seney, the presence of “.lnk” files “shows that, one, a file was present on the system at the time with that name. And that, two, it had been interacted with at one time.” (Doc. No. 64 at 97).
For example, Seney testified that because of the presence of “.lnk” files with the name “Sandra, ” he was able to conclude the child pornography files depicting “Sandra” had been accessed and interacted with by the operating system of the laptop. (Id. at 98-99). Additionally, because all of the “Sandra” “.lnk” files began with a “G, ” Seney was able to determine the “Sandra” files were opened from an external device plugged into the computer such as a thumb drive or S.D. card. (Id. at 199-200). No external devices were plugged into the laptop when agents entered the apartment and Seney conducted his preliminary search.
It is not clear from Seney's testimony whether this was discovered during the preliminary search or subsequent forensic examination.
Following the preliminary search of the laptop, Naida was not arrested, but the laptop was seized for further investigation. Naida also turned over a hard drive connected to an Xbox gaming system in the living room and a Dragon Touch tablet. Neither the hard drive connected to the Xbox gaming system nor the Dragon Touch tablet contained evidence of child pornography. But Seney testified the tablet had been reset to factory settings, effectively erasing all data previously on the device.
After June 26, 2017, agents contacted Naida to request production of additional electronic devices. Naida turned over a Toshiba thumb drive and a Kodak memory card, but neither of these external devices were found to contain child pornography.
B. Forensic Tool Kit Report
Using a forensic tool kit (“FTK”), Seney discovered that the only non-default user account on the laptop's hard drive at the time was named “Dustin.” But Seney testified that he was able to determine that two other non-default user accounts previously resided on the laptop's hard drive. Both of those accounts were named “Rabid.” There was no testimony to suggest any of these user accounts were password-protected. But all three contained evidence of child pornography.
The thumbcache of the “Dustin” user account contained the 197 thumbnail images identified as child pornography that underlie the charge of possession of child pornography. Seney defined a thumbnail image as a preview image that is automatically generated when a user browses the folder containing the original images. (Id. at 114-15). Seney stated these thumbnail images can be enlarged to “extra large, large, medium” for previewing. (Id. at 114). Seney described the thumbcache as a hidden folder that stores thumbnail images “for user convenience to allow [him] to be more expedient to view multiple photos at once.” (Id. at 114). Seney further stated that the thumbcache could retain thumbnail images even after the original file has been deleted. (Id.). But Seney also testified that when thumbnail images are generated in the thumbcache by browsing the contents of a thumb drive, and that thumb drive is subsequently removed, the thumbnail images in the thumbcache can only be viewed with an FTK “or something similar.” (Id. at 196).
Seney was able to determine the subject thumbnail images “were generated by the computer's interaction with what appears to be an external device that was plugged into it that contained the actual files of child pornography.” (Id. at 152). The laptop's hard drive data indicated these files were located on a SanDisk Cruzer thumb drive, but no SanDisk Cruzer was recovered.
Aside from the thumbnail images in the thumbcache, the other evidence of child pornography resided in the unallocated space of the laptop's hard drive. As Seney explained, the unallocated space of the hard drive shows data from files that were once on the hard drive but have been “deleted” and are not yet overwritten. (Id. at 112). Even after the actual images and files are “deleted” from a hard drive, the data composing those images and files may remain in the unallocated space of the hard drive. But “[w]ith the unallocated space, one of the things that the operating system does is gets rid of the information pertaining to dates and time stamping, ” so the time and date the original files and images were on the hard drive cannot be determined. (Id. at 112-13).
Here, from the unallocated space, Seney was able to determine both “Rabid” user accounts and the “Dustin” user account contained “.torrent” files with names associated with child pornography. (Id. at 209). Seney explained a “.torrent” file is the “locator” “[t]hat needs to be searched for [on Bing or Google, for example, or shared via e-mail, instant messaging, or message board, ] and then loaded into your BitTorrent application, and then that starts those individual downloads of the bits and pieces of the data.” (Id. at 62). Essentially, the “.torrent” file is not the image but the tool to use on BitTorrent to locate and download the image. Although Seney did not testify that BitTorrent software was on the laptop at the time it was seized, he did affirm it is “possible to set up BitTorrent to actually use an external device with BitTorrent.” (Id. at 201).
In addition to the “.torrent” files, Seney also located “.jpg” files with names associated with child pornography in the unallocated space indicating those “.jpg” image files had previously resided in the downloads folder of the “Rabid” accounts. (Id. at 122-23, 126-33).
Finally, Seney testified the internet browsing history revealed searches for terms associated with child pornography. Specifically, Seney was able to determine that, on the afternoon of June 5, 2017, the laptop was used over the course of forty minutes to conduct Bing image searches for terms such as “young teen girls bras and braces” and “pervert daddy and daughter” and access a file with the name “selfshotteensin-panties-29.jpg.” (Id. at 163-67). This activity began minutes after the laptop was used to access bank accounts at First Federal Bank of the Midwest and USAA Federal Savings Bank. (Id. at 161-67). Representatives from these financial institutions testified that Naida owned password-protected accounts at these institutions.
C. Testimony of Krystopher Sizemort
Naida's long-time friend Krystopher Sizemort testified about Naida's home and work life. Naida and Sizemort met seven years prior to the February 2020 trial through work at Broadband Express, a contracting cable company for Time Warner Buckeye. Naida trained Sizemort for his position as a “field technician.” (Id. at 289-90). As “field technicians, ” Sizemort testified he (and Naida) would “go from house to house and fix the problems or install new cable or internet for customers.” (Id. at 289). Although Sizemort denied that the job entailed “fixing a broken computer, ” he stated it could entail setting up a customer's wireless internet by “going in the router and changing the user name and password.” (Id. at 290). Additionally, while Sizemort testified that he personally did not have any formal computer schooling, he recalled that Naida had said he had a degree in computers. (Id. at 280-81).
From mid-summer 2016 through October 31, 2016, Sizemort lived with Naida at each of Naida's two Napoleon, Ohio apartments. (Id. at 295). Naida's then-girlfriend, Kelsey, and Kelsey's two young daughters also lived with Naida at both of these apartments. Although Sizemort did not live with Naida during the subject time period of April 2017 to June 2017, Sizemort “sometimes” visited Naida's apartment to drink and play video games. (Id. at 303). The two also remained close friends; Sizemort was Naida's best man when he married Kelsey in September 2017. (Id. at 279-80, 303).
Presumably because of his friendship with Naida and occasional visits, Sizemort testified about Kelsey and Dustin's lifestyle during the relevant time period. Specifically, he stated Kelsey was working first or second shift full-time from April 2017 through June 2017. While Kelsey was at work during the day, Sizemort stated Kelsey's children were taken to a relative's home “most of the time.” (Id. at 287). Further, Sizemort stated this period was “around the time” Naida quit his job at Direct TV and “was doing some side work with his cousin.” (Id. at 287-88). But Sizemort was “not sure” whether this side work was full-time or part-time. (Id. at 288).
Sizemort did know that Naida was “often” on an electronic device. (Id. at 282). Specifically, Sizemort testified that Naida played video games “every day.” (Id. at 300). Naida played these video games on his Xbox, smart phone, and “expensive gaming laptop” Naida purchased in Kansas in December 2016. (Id. at 281-82, 292-93). Sizemort stated Naida was “protective” of his electronics such as the laptop and his preferred Xbox controller. (Id. at 282-83). But while Sizemort “d[id]n't think [he had] ever seen Kelsey use Dustin's laptop, ” he did not know whether or how much Kelsey, Dustin, or anyone else used the laptop. (Id. at 282, 296).
III. Motion for Judgment of Acquittal
“A Rule 29 motion is a challenge to the sufficiency of the evidence.” United States v. Jones, 102 F.3d 804, 807 (6th Cir. 1996); Fed. R. Crim. P. 29. A defendant challenging the sufficiency of the evidence “bears a very heavy burden.” United States v. Tocco, 200 F.3d 401, 424 (6th Cir. 2000). “[T]he relevant question is whether, after viewing the evidence in the light most favorable to the prosecution, any rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt.” Jackson v. Virginia, 443 U.S. 307, 319 (1979) (emphasis in original); United States v. Garrido, 467 F.3d 971, 984 (6th Cir. 2006). “[T]he granting of a motion for acquittal ‘… will be confined to cases where the prosecution's failure is clear.'” United States v. Connery, 867 F.2d 929, 930 (6th Cir. 1989) (quoting Burks v. United States, 437 U.S. 1, 17 (1978)).
I may only reverse the jury's verdict for insufficient evidence if that judgment “is not supported by substantial and competent evidence upon the record as a whole.” United States v. Chavis, 296 F.3d 450, 455 (6th Cir. 2002) (quotation marks and citation omitted). “Circumstantial evidence alone is sufficient to sustain a conviction and such evidence need not remove every reasonable hypothesis except that of guilt. The jury may draw any reasonable inferences from direct, as well as circumstantial, proof.” United States v. Kelley, 461 F.3d 817, 825 (6th Cir. 2006) (internal quotation marks omitted and citation omitted); see also Desert Palace, Inc. v. Costa, 539 U.S. 90, 100 (2003) (noting that “we have never questioned the sufficiency of circumstantial evidence in support of a criminal conviction, even though proof beyond a reasonable doubt is required”). But “[a]lthough circumstantial evidence alone can support a conviction, there are times that it amounts to only a reasonable speculation and not to sufficient evidence.” Newman v. Metrish, 543 F.3d 793, 796 (6th Cir. 2008). I may not weigh the evidence, consider the credibility of witnesses, or substitute my own judgment for that of the jury. Id.
The jury found Naida guilty of one count of receipt or distribution of child pornography, in violation of 18 U.S.C. § 2252(a)(2), and one count of possession of child pornography, in violation of 18 U.S.C. § 2252(a)(4)(B). (Doc. No. 50). To find Naida guilty of either of these offenses, the jury must have concluded beyond a reasonable doubt that Naida acted “knowingly.” 18 U.S.C. §§ 2252(a)(2) & (a)(4)(B). Naida asserts no reasonable jury could have done so based on the evidence presented. Specifically, Naida contends:
(1) insufficient evidence existed to exclude Mr. Naida's wife as a user of the computer, which required a judgment of acquittal under United States v. Lowe, 795 F.3d 519 (6th Cir. 2015), and (2) Mr. Naida could not have been convicted of possession on or about the date in the indictment because the only images that the government established were on Mr. Naida's computer in that time window were inaccessible thumbcache images.(Doc. No. 66 at 3).
A. United States v. Lowe
Naida contends his case is “striking[ly] similar[]” to Lowe, in which the Sixth Circuit reversed the Lowe's conviction due to insufficient evidence to show that the defendant, and not the defendant's wife, knowingly received, distributed, and possessed child pornography. (Id. at 15).
The investigation in Lowe began with the discovery that a user of the IP address associated with the residence of the defendant, James Lowe, was using a peer-to-peer file-sharing network to share files with names associated with child pornography. 795 F.3d at 250. Just as Seney did here using the BitTorrent tool, the detective in Lowe used the peer-to-peer network to download one video and two still images of child pornography from the shared folder associated with the defendant's IP address. Id. Thereafter, the detective conducted surveillance of the home and determined the sole occupants of the home were the defendant and his wife, Stacy. Id. Officers then procured and executed a search warrant of the home and seized three computers: one laptop with the username “Stacy” in the bedroom, one desktop in the office, and one laptop with the username “Jamie” in the office. Id. at 521.
Only the hard drive of the laptop named “Jamie-PC, ” with the single user account “Jamie, ” was found to contain child pornography. Id. But neither the “Jamie” account nor any of the files or programs on it were password-protected. Id. Specifically, the detective testified the peer-to-peer file-sharing program from which child pornography was searched, shared, and downloaded was not password-protected and automatically started running in the background when the computer was turned on. Id. The detective also testified that, although the peer-to-peer file-sharing program account adopted the username “Jamie” by default, “someone altered the default for the program's chat-feature username and instead entered ‘JA.'” Id.
Due to the way the peer-to-peer file-sharing program worked, the detective in Lowe “could not pinpoint when someone searched for or initiated downloads of child pornography.” Id. at 522. Forensic analysis could reveal the date and time downloads were complete, but the detective “testified that files could ‘take a very long time to download' and that downloading time depended on factors such as the internet connection's speed.” Id. at 521-22.
Even so, the detective could determine that, on “numerous occasions” during the relevant time period, “downloads completed within minutes of someone accessing a web-based email service or one of several retail, banking, appliance-repair, and travel websites.” Id. at 522. Specifically, on March 10, the detective testified that someone logged into an email address with “Jamie or jame dog” in close proximity to a completed download. Id. Beyond this log-in, the detective “attributed no special significance to the laptop's browsing history.” Id. Additionally, though the detective testified “that a user opened an ‘East Tennessee Appliance Services' invoice listing 2204 Robin Street as the business address about forty minutes before a child-pornography video finished downloading on March 3, ” there was no testimony “about what James and Stacy Lowe did for a living or whether the other two computers also contained business documents.” Id.
Based on the evidence presented, the jury found James Lowe guilty of knowingly receiving, distributing, and possessing child pornography in violation of 18 U.S.C. § 2252(a). Id. The district court denied Lowe's post-trial motion for acquittal, and Lowe appealed. Id.
On appeal, the court agreed with James and concluded that although “[a] juror could reasonably infer that James owned and occasionally used the laptop” from the evidence presented, “no juror could infer from such limited evidence of ownership and use that James knowingly downloaded, possessed, and distributed the child pornography found on the laptop” “without improperly stacking inferences.” Id. The court explained,
Importantly, the government presented no evidence from which a juror could infer that Stacy did not use the laptop over the five-month period. First, although a juror reasonably could infer that Stacy used the “Stacy” laptop from evidence that she was home alone during the search and that agents found that laptop powered on, the juror could not draw the additional inference that Stacy did not use the “Jamie” laptop. Second, no juror reasonably could conclude that James and not Stacy used the HP Pavilion laptop to save business records, open an invoice listing 2204 Robin Street as the return address, and access banking, retail, travel, and appliance-repair websites on dates when partial or complete child-pornography files appeared on the hard drive. The government presented no evidence of what James and Stacy did for a living, whether they worked inside or outside of the home, their interests and hobbies, or where they banked. Further, Agent McFall attributed no special significance to the pattern of internet activity during the period in question. Although a juror might infer from visits to appliance-repair and banking websites that an adult primarily used the computer, she could only speculate about whether the adult was James or Stacy Lowe.Id. at 523-24.
Naida asserts the same is true here. Naida does not dispute that, like Lowe, any reasonable juror could have concluded he owned and occasionally used the laptop in question. But he contends no rational factfinder could have concluded beyond a reasonable doubt that he, and not his then-girlfriend, now-wife, Kelsey, knowingly received, possessed, and distributed child pornography.
The government first argues “Lowe is factually distinguishable as the jury here had evidence that specifically eliminated others' access and use of the laptop that the jury in Lowe did not have.” (Doc. No. 74 at 33) (emphasis in original). In support, the government cites Sizemort's testimony for its assertion that Kelsey “did not use the laptop.” (Doc. No. 74 at 33). On direct examination, Sizemort stated he “d[id]n't think [he had] ever seen Kelsey use Dustin's laptop” and that Naida was “protective” of his electronics. (Doc. No. 64 at 282-83) (emphasis added).
But Sizemort did not live with the couple during the time Naida owned the laptop and admitted he did not actually know whether or how much Kelsey used the laptop. (Id. at 296). Moreover, the government does not point to testimony from any other witness about whether Kelsey used the laptop. Therefore, even viewing this testimony in the light most favorable to the prosecution, no reasonable juror could conclude Kelsey “did not use” the laptop that was not password-protected and found in their shared home without additional evidence.
The government next argues that, unlike Lowe, evidence was presented in this case “about what the defendant did for a living, whether he worked inside or outside of the home, his interests and hobbies, or where he banked to assist jurors in determining whether he had knowledge about computers or the file-sharing program used to commit the child pornography offense.” (Doc. No. 74 at 33).
It is true the jury heard testimony about Naida's technology-related occupation, education, hobbies, and financial transactions. Additionally, Seney testified that Naida admitted to using peer-to-peer file-sharing programs in the past. Viewing this evidence in the light most favorable to the prosecution, any reasonable juror could conclude Dustin had the skillset to use a peer-to-peer file-sharing program to commit the offense and the knowledge of computers used to conceal the evidence.
In addition to his ability to commit the offense, there is also evidence to show Dustin, and not Kelsey, was interested in child pornography. Specifically, the laptop's June 5, 2017 browsing activity suggests Dustin was the laptop's user that searched for child pornography.
Seney testified that, between 2:41 p.m. and 2:49 p.m. EST on June 5, 2017, Dustin's laptop was used to access First Federal Bank of the Midwest and USAA Federal Savings Bank webpages, including those associated with logging in to accounts of those institutions. (Doc. No. 64 at 161-63). Then, between 2:55 p.m. and 3:37 EST, the laptop was used to search for terms associated with child pornography. (Id. at 163-68).
Records custodians from First Federal Bank of the Midwest and USAA Federal Savings Bank confirmed Dustin had accounts at these institutions and stated Dustin was the sole account holder and only authorized user on each of these accounts at the time. (Doc. No. 64 at 250-51; 265-68). These accounts were both set up using the email address “Rabidwolf43545@yahoo.com” - the same email address associated with Dustin's social media accounts. (Doc. No. 64 at 251, 266-68).
The First Federal Bank account was revised on April 24, 2019, to add “Kelsey M. Naida.” (Doc. No. 64 at 251-52).
Each records custodian testified that these accounts could be accessed online only by using the username and password created by the account holder. (Doc. No. 64 at 257, 269). The USAA records custodian testified Dustin's username and password were entered to log into his account from a computer between 1:48 p.m. and 2:53 p.m. from the IP address 71.72.101.64. (Doc. No. 64 at 273-74). The First Federal records custodian testified the same IP address was used that afternoon to access Dustin's First Federal account using the username “Rabidwolf43545.” (Doc. No. 64 at 258-59).
Aside from the computer forensic evidence, the jury also heard testimony that, in June 2017, Dustin was only “doing some side work with his cousin” and was often home alone while Kelsey worked full-time during first or second shift. (Id. at 287-88). The jury also heard testimony that Dustin was home alone exactly three weeks later during the mid-morning of Monday, June 26, 2017, when the agents arrived at the apartment.
Taking this evidence together in the light most favorable to the prosecution, a reasonable juror could conclude Dustin was the laptop's user who searched for child pornography on the afternoon of June 5, 2017.
Naida attempts to minimize the importance of the June 5, 2017 activity by comparing it to the March 10 incident in Lowe on which a download of child pornography was completed within minutes of someone accessing a Yahoo email address associated with the defendant. But the March 10 activity in Lowe is factually distinguishable from the June 5 activity here.
First, in Lowe, the agent “could not pinpoint when someone searched for or initiated downloads of child pornography.” 795 F.3d at 522. Instead, the agent could only determine “the date and time on which partial or completed downloads appeared on the laptop's hard drive.” Id. The agent also “testified that files could ‘take a very long time to download' and that downloading time depended on factors such as the internet connection's speed.” Id. at 521. Therefore, although forensic evidence showed a user had logged into an email account associated with the defendant within minutes of the time a download completed, the agent could not determine when a user took the step of knowingly searching for or initiating the download of child pornography.
Here, Seney could determine when the terms associated with child pornography were searched and not merely when a download was completed. Therefore, a reasonable juror could draw the inference that the same user of Dustin's laptop logged in to two of Dustin's bank accounts minutes before searching for terms associated with child pornography for approximately forty minutes. No reasonable juror could conclude the same from the temporal proximity evidence presented in Lowe.
Second, in Lowe, there also was no testimony from which any “juror reasonably could conclude that James and not Stacy used the HP Pavilion laptop to save business records, open an invoice listing 2204 Robin Street as the return address, and access banking, retail, travel, and appliance-repair websites on dates when partial or complete child-pornography files appeared on the hard drive.” 795 F.3d at 523. Without such evidence, the Lowe court concluded “[a] juror could reasonably infer that James…occasionally used the laptop from… [the agent]'s testimony about the March 10 visits to the Yahoo! email log-in page. But, without improperly stacking inferences, no juror could infer from such limited evidence of … use that James knowingly downloaded, possessed, and distributed the child pornography found on the laptop.” Id.
Here, the laptop was used not merely used to log in to a personal email account but two password-protected bank accounts owned solely by Dustin. Further, there was testimony from which a reasonable juror could conclude Kelsey was working at the time of this hour-long browsing session, thereby eliminating her access to the laptop during the relevant time period. Therefore, unlike Lowe, a juror in this case could reasonably infer Dustin not only “occasionally used” the laptop from the June 5 activity, but also that he “occasionally used” the laptop to search for child pornography while Kelsey was at work. See, e.g., United States v. Gray, 641 Fed.Appx. 462, 467-68 (6th Cir 2016) (The defendant “had the time and opportunity to search, download, view, and delete the child pornography” while home alone.).
Still, Naida contends the June 5 activity cannot serve as evidence of either charged offense without improperly stacking inferences because it “was not connected in any way to either the images recovered from the thumbcache or the April 14 download.” (Doc. No. 66 at 17-18). But the Sixth Circuit has found that “[w]hen ‘[s]earch terms specific to child pornography' are found on a computer, it is persuasive circumstantial evidence that the user ‘knowingly possessed child pornography.'” United States v. Johnson, 775 Fed.Appx. 794, 800 (6th Cir 2019) (quoting Gray, 641 Fed.Appx. at 468). The Gray court also cited search term evidence as circumstantial evidence that the defendant “knowingly received” child pornography. 641 Fed.Appx. at 468. Therefore, even though the terms were searched after the April 14 download and did not result in the thumbcache located on the laptop on June 26, the forty-minute search of various terms associated with child pornography is circumstantial evidence that Dustin was interested in and knowingly sought out child pornography.
Ultimately, “[c]ircumstantial evidence alone is sufficient to sustain a conviction and such evidence need not remove every reasonable hypothesis except that of guilt.” United States v. Algee, 599 F.3d 506, 512 (6th Cir. 2010) (further citation omitted). Here, viewing the evidence in favor of the government and drawing all reasonable inferences in the government's favor, any rational factfinder could have concluded beyond a reasonable doubt that Dustin, and not Kelsey, was the user responsible for creation of the evidence of child pornography located on the laptop.
B. Count Two: Knowing Possession
Count Two of the indictment charged Naida with knowingly possessing child pornography “[o]n or about June 26, 2017.” (Doc. No. 1). As the government makes clear, in finding Naida guilty of this charge, the jury must have concluded Naida “kn[e]w about the thumbcache and thus, knowingly possessed the child pornography in the thumbcache on June 26, 2017.” (Doc. No. 74 at 36). Naida contends no reasonable juror could have concluded he knowingly possessed the thumbnail images of child pornography because the thumbcache is a hidden folder and because the thumbnail images could not be accessed on the laptop without a special program.
The Sixth Circuit has not directly faced a situation like that presented in this case but has encountered a similar situation in United States v. Johnson, 775 Fed.Appx. 794 (6th Cir. 2019). There, the court stated:
When images are only recovered from a computer system's cache, rather than organized on a hard drive or other storage media in a more intentional manner, it is sometimes more difficult for the government to show that a defendant knowingly possessed the child pornography. See, e.g., United States v. Kuchinski, 469 F.3d 853, 863 (9th Cir. 2006) (holding that sentencing enhancement was erroneous without proof defendant knew about or controlled child pornography found in internet cache). Nevertheless, with sufficient proof of knowledge, cached thumbnail images can be the basis of conviction. See United States v. Huyck, 849 F.3d 432, 443 (8th Cir. 2017) (upholding conviction based on cached thumbnails present on an external hard drive). And circumstantial evidence of knowledge may be sufficient to support a jury's guilty verdict. Id.; see also United States v. Breton, 740 F.3d 1, 17 (1st Cir. 2014).Id. at 800.
In Johnson, the jury found the defendant guilty of possession of child pornography based on thirty-six “thumbnail images that were saved to the system's cache folder when someone using the computer viewed video files of child pornography from an encrypted external drive.” Id. “The thumbnail files show[ed] that they were created on the system the same day defendant arrived in Detroit and checked into his hotel.” Id. Although law enforcement recovered many external devices from the defendant's hotel room and home, all were “encrypted in a way that prevented law enforcement analysis.” Id. at 799-800. Still, the Sixth Circuit upheld the jury's verdict based on circumstantial evidence including the defendant's exclusive control of the laptop, “search terms specific to child pornography, ” “the presence of myriad encrypted media devices, ” and other “surrounding evidence of defendant's sexual interest in children.” Id.
Naida's case is similar to Johnson in that the basis for the possession charge are thumbnail images saved to the cache of the laptop when an external device was plugged into the laptop. But Johnson is distinguishable because of the government's theory of possession. In Johnson, the government's theory was “that defendant knowingly possessed child pornography on the encrypted external media and plugged the external devices into the computer to view it.” Id. at 800. Hence, it was the defendant's possession of those encrypted external media devices that resulted in the conviction; the presence of the thumbnail images on the laptop was evidence that the defendant had knowledge of and access to child pornography stored on the encrypted external media devices.
Here, the government does not seek to prove Naida possessed the SanDisk Cruzer, which was never recovered but believed to contain the original images. Instead, the government's theory is that Naida possessed the cached thumbnail images themselves.
Those courts of appeal who have faced this theory of possession of cached images have illustrated the complexity of the issue. Most have determined that to possess cached images, the defendant must have “the knowledge and ability to access the images and to exercise dominion or control over them.” United States v. Moreland, 665 F.3d 137, 150 (5th Cir. 2011); see also, United States v. Flyer, 633 F.3d 911, 919 (9th Cir. 2011) (“Our precedent relating to cache files suggests that a user must have knowledge of and access to the files to exercise dominion and control over them.”); United States v. Tucker, 305 F.3d 1193, 1204 (10th Cir. 2002) (upholding the conviction when: (1) the defendant knew the images he viewed on a web page would be sent to the browser cache file and saved on his hard drive; and (2) the agent testified a user “could access an image in a cache file [and] ‘do almost anything with it.'”). But see, e.g., Breton, 740 F.3d at 17-18 (upholding the conviction even though the defendant “may not have known that Yahoo Messenger had saved these particular image files in this particular location” without any discussion of whether the defendant could access that hidden folder).
Following the majority of circuits that have spoken to this issue, I conclude that to find Naida guilty of possession of child pornography, the jury must have concluded Naida knew of the thumbcache and could access and control the thumbnail images within it. This does not conflict with my instruction to the jury stating,
(B) The law recognizes two kinds of “possession” -- actual possession and constructive possession. Either one of these, if proved by the government, is enough to convict.
(1) To establish actual possession, the government must prove that the defendant had direct, physical control over the visual depictions, and knew that he had control of it.
(2) To establish constructive possession, the government must prove that the defendant had the right to exercise physical control over the visual depictions, and knew that he had this right, and that he intended to exercise physical control over visual depictions at some time, either directly or through other persons.
(3) For example, if you left something with a friend intending to come back later and pick it up, or intending to send someone else to pick it up for you, you would have constructive possession of it while it was in the actual possession of your friend.
(4) But understand that just being present where something is located does not equal possession. The government must prove that the defendant had actual or constructive possession of the visual depictions, and knew that he did, for you to find him guilty of this crime. This, of course, is all for you to decide.(Doc. No. 53 at 22-23) (emphasis in original).
Naida contends he could not have knowingly possessed the thumbnail images because the thumbcache could not be accessed without specialized software and no such software was located on the laptop. (Doc. No. 66 at 20-23). The government counters that, “[c]ontrary to claims that it requires special equipment, as the Ninth Circuit in Kuchinski noted, ‘A user, who knows what he is doing, can … get access to the cache files.'” (Doc. No. 74 at 37 (citing United States v. Kuchinski, 469 F.3d 853, 862 (9th Cir. 2006))). But whether the cache in question is accessible is one of fact, not law - or precedent.
Here, Seney testified the thumbcache could not be accessed without an FTK or something similar. (Doc. No. 64 at 196). Because of this, Naida's case is more like Flyer where the images could not “be seen or accessed by the user without the use of forensic software, ” 633 F.3d at 918, than Kuchinski. In Flyer,
The government … presented no evidence that [the defendant] had the forensic software required to see or access the files, [and u]nlike [United States v. Romm, 455 F.3d 990 (9th Cir. 2006)], there [was] no evidence … that [the defendant] had accessed, enlarged, or manipulated any of the charged images, and he made no admission that he had viewed the charged images on or near the time alleged in the indictment.Id. at 919.
The same is true here. There is no evidence that the laptop contained the specialized software required to access the thumbcache on June 26, 2017, when it was seized. Further, there is no evidence to suggest Naida ever accessed the thumbcache or viewed the thumbnail images therein. Without this, no reasonable juror could have concluded that, “on or about June 26, 2017, ” Naida “could recover or view any of the charged images.” Flyer, 633 F.3d at 920.
Because there is no evidence from which any reasonable juror could conclude beyond a reasonable doubt that Naida could access and exercise control over the thumbnail images on or about June 26, 2017, or intended to do so in the future, the guilty verdict for possession of child pornography must be vacated.
IV. Motion for New Trial
A defendant may move for a new trial, and “the court may vacate any judgment and grant a new trial if the interest of justice so requires.” Fed. R. Crim. P. 33(a). “If the court enters a judgment of acquittal after a guilty verdict, the court must also conditionally determine whether any motion for a new trial should be granted if the judgment of acquittal is later vacated or reversed.” Fed. R. Crim. P. 29(d)(1). “Motions for a new trial are not favored and are granted only with great caution.” United States v. Garner, 529 F.2d 962, 969 (6th Cir. 1976). “The defendant bears the burden of proving that a new trial should be granted.” United States v. Davis, 15 F.3d 526, 531 (6th Cir. 1994).
Naida moves for a new trial on both Counts One and Two because: (1) the verdicts were against the weight of the evidence; (2) the FTK reports should not have been provided to the jury, in full; and (3) the jury impermissibly relied on the June 5, 2017 computer activity. Naida also contends a new trial should be granted on Count Two because the court's answer to the jury's second question may have misled the jury.
A. Weight of the Evidence
“A motion for a new trial under Rule 33 . . . may be premised upon the argument that the jury's verdict was against the manifest weight of the evidence. Generally, such motions are granted only in the extraordinary circumstance where the evidence preponderates heavily against the verdict.” United States v. Hughes, 505 F.3d 578, 592-93 (6th Cir. 2007) (quotation marks omitted). “When considering a motion for new trial based upon the weight of the evidence, district judges can act in the role of a ‘thirteenth juror' and consider the credibility of the witnesses and the weight of the evidence to insure that there is not a miscarriage of justice.” United States v. Lutz, 154 F.3d 581, 589 (6th Cir. 1998).
As I stated above, because there is no evidence that Naida had access to the thumbnail images in the thumbcache, I find the jury's guilty verdict on Count Two - possession of child pornography - to be against the manifest weight of the evidence. Therefore, in the event the judgment of acquittal on Count Two is later vacated or reversed, Naida's motion for a new trial is granted. See Fed. R. Crim. P. 29(d)(1).
To satisfy his burden that a new trial should be granted with respect to Count One, Naida contends the evidence did not establish that: (1) he was the computer expert the government painted him to be; (2) he ever used the filesharing program at issue in this case; and (3) he, and not another user of the laptop, was responsible for the evidence of child pornography located on the laptop.
Even if Naida was not an expert computer user, as the government alleged, there is sufficient evidence from which I could conclude beyond a reasonable doubt that Naida possessed the requisite skill in technology to use BitTorrent to commit the offense and conceal the evidence of child pornography on the laptop. After all, Naida was educated at ITT Technical Institute, worked in internet installation, and had an affinity for electronics in his personal life. Additionally, aside from the fact that Naida admitted to using a peer-to-peer file-sharing program previously, Seney testified that there was evidence that the “Rabid” and “Dustin” user accounts previously contained “.torrent, ” suggesting BitTorrent was once installed on Naida's computer. (Doc. No. 64 at 209). There was no evidence that any other user of the laptop possessed the skillset to use a peer-to-peer file-sharing program or conceal evidence of child pornography.
Beyond Naida's ability to commit this offense and conceal the evidence of its commission, the June 5 search shows Dustin was the laptop's user who was interested in child pornography. There was no evidence to suggest any other user of the laptop searched for child pornography or had any interest in it.
Because there was sufficient evidence for me to conclude Naida had an interest in child pornography and the ability to use BitTorrent to share child pornography, I do not find the jury's guilty verdict as to Count One - distribution of child pornography - to be against the manifest weight of the evidence. Therefore, Naida's motion for a new trial on Count One is denied.
B. FTK Report
During trial, Naida objected to the admission of the full FTK report, arguing the jury could be confused by the parts of the report that were not discussed in court. (Doc. No. 65 at 50-51). In response, I asked, “are there portions that you can point me to that are prejudicial from the defense standpoint? There's an argument the entire report has -- has prejudicial effect, but can you identify anything for me specifically other than generally confusion of the issues?” (Id. at 51). Naida could not. (Id.).
Prior to making his blanket objection to the extensive report, Naida never claimed he had not received the report or that he did not have an opportunity to review the report. Now, Naida renews his objection to the full submission of the FTK report and identifies specific sections he asserts are prejudicial.
First, Naida identifies “the Suspect Apartment tab, [and] the ‘Comments' entry at the top of the page state as follows: ‘Suspect Apartment- images located within the thumbcache files depicting the apartment that we spoke with Dustin Naida at depicting an unknown red headed female in various states of nudity. She appears to be over the age of 18.'” (Doc. No. 66 at 30).
During trial, Naida objected to the line of questioning regarding the images in the thumbcache of a “partially clothed” “adult female obviously over the age of 18.” (Doc. No. 64 at 134). All agreed these images were of Naida's wife. (Id. at 136-37). After considering counsel's arguments at side bar, I sustained the objection. (Id. at 140).
Again, though Naida does not contend he did not have the opportunity to review the report and discover the now-disputed tab and comment, he failed to object prior to the report's submission to the jury. I agree the description in the comment appears to have been admitted in violation of my order. But because there is no suggestion that the images themselves were admitted and because the description of the individual depiction is of an adult, and not a minor, I do not find the admission of this tab and comment so harmful or unduly prejudicial as to warrant a new trial.
Naida next contends the “Playtoy Sparkle” and “Sandra” tabs are confusing to the jury and potentially prejudicial. These tabs contain files dated before Naida possessed the computer as well as files with innocent names such as “Solitaire.dll.” (Doc. No. 66 at 31). Naida asserts that due to their location in these tabs, and the associated testimony related to names associated with child pornography, a juror could conclude the innocent-named files were an attempt to “deliberately mask” illicit files. (Id.). Because of this, Naida argues he was prejudiced by his inability to cross-examine Seney about “the meaning of those files populating in the ‘Sandra' tab.” (Id.). But Naida's counsel had the opportunity to cross-examine Seney on this report, including these tabs and their contents. Additionally, whatever prejudice which may have occurred, if any, from the dated and innocently-named files in these tabs does not rise to the level warranting a new trial.
Because Naida failed to object to the inclusion of the subject tabs prior to the report's admission into evidence and because these identified sections are not unduly prejudicial, admission of the full FTK report does not warrant a new trial.
C. June 5, 2017 Search Terms
Naida next asserts the jury impermissibly relied on the June 5, 2017 search of terms associated with child pornography. Essentially, Naida argues this search was unduly prejudicial because the search did not result in the thumbcache images or the April 14 download. But as discussed above, the Sixth Circuit has found that “[w]hen ‘[s]earch terms specific to child pornography' are found on a computer, it is persuasive circumstantial evidence that the user ‘knowingly possessed child pornography.'” United States v. Johnson, 775 Fed.Appx. 794, 800 (6th Cir 2019) (quoting Gray, 641 Fed.Appx. at 468). The Gray court also cited search term evidence as circumstantial evidence that the defendant “knowingly received” child pornography. 641 Fed.Appx. at 468. Therefore, I do not find admission of the June 5 search unduly prejudicial. Instead, these searches are recognized as proper circumstantial evidence. As such, the testimony regarding the June 5 search does not warrant a new trial.
D. Answer to Jury Question
During deliberations, the jury asked the following question: “Does the file constitute possession or does the artifact constitute possession.” (Doc. No. 50-2 at 1). After conferring with counsel for both sides, I answered: “The answer to this question appears to be a factual determination for the jury. Again, please refer to the jury instructions.” (Id. at 2). Naida contends this may have misled the jury because to convict Naida of Count Two, the jury was required to conclude Naida possessed a “visual depiction” and because only one of the following six “artifacts” discussed during the trial satisfied the “visual depiction” requirement: “(1) filesharing search terms, (2) filesharing file names, (3) unallocated space references, (4) recent document .lnk files, (5) MS Paint prefetch files, and (6) thumbcache images.” (Doc. No. 66 at 34).
When faced with a jury question, the court “should refrain from straying beyond the purpose of jury instructions by answering jury questions that seek collateral or inappropriate advice.” United States v. Fisher, 648 F.3d 442, 447 (6th Cir. 2011) (citing United States v. Combs, 33 F.3d 667, 670 (6th Cir. 1994)). But “[w]here there is evidence that the jury is confused over an important legal issue that was not covered by the original jury instructions, ” the court must give a supplemental instruction clarifying that issue. Fisher, 648 F.3d at 447 (citing United States v. Nunez, 889 F.2d 1564, 1567-69 (6th Cir. 1989)).
The jury instructions provided the elements of possession of child pornography, in violation of 18 U.S.C. § 2252(a)(4)(B), as follows:
(A) First: That the defendant knowingly possessed one or more books, magazines, periodicals, films, video tapes, or other matter containing a visual depiction;
(B) Second: That the production of the visual depiction involved the use of a minor engaging in sexually explicit conduct;
(C) Third: That the visual depiction was of a minor engaging in sexually explicit conduct;
(D) Fourth: That the defendant knew the visual depiction involved a minor engaging in sexually explicit conduct; and
(E) Fifth: That the visual depictions had been mailed, shipped, or transported using any means or facility of interstate or foreign commerce, including a computer.(Doc. No. 53 at 17) (emphasis added). The instructions then defined “visual depiction” to include: “any photograph, film, video or picture, including undeveloped film and videotape, and data stored on computer disk or by electronic means which is capable of conversion into a visual image, whether or not stored in permanent format.” (Id. at 18).
Naida does not dispute the accuracy of these jury instructions or suggest the definition of “visual depiction” was in some way inadequate. Naida also does not contend this question sought clarification of an “important legal issue.” Instead, Naida essentially asserts I should have instructed the jury that the thumbcache images were the only “artifacts” considered “visual depictions” for purposes of Count Two.
But answering in this manner would have not only exceeded the scope of the question, but also “stray[ ] beyond the purpose of jury instructions by answering jury questions that seek collateral or inappropriate advice.” Fisher, 648 F.3d at 447. Therefore, I find my answer advising the jury that this was a factual determination to be made by them with the aid of the jury instructions was not misleading and is not grounds for a new trial.
V. Conclusion
For the reasons stated above, Naida's motion for acquittal or, alternatively, a new trial is granted in part, and denied in part. As to Count One, distribution of child pornography, the motion is denied. As to Count Two, possession of child pornography, the motion for acquittal is granted, and the motion for a new trial is conditionally granted.
So Ordered.