Opinion
Criminal No. 2:18-cr-165-JNL
05-22-2020
United States of America v. George Royle V
MEMORANDUM ORDER
The defendant's motion for judgment of acquittal turns on whether the prosecution proved beyond a reasonable doubt that the defendant, and not some other person, accessed the child pornography found on a MacBook laptop seized in his home. Defendant George Royle V was indicted on one count of possession of or access with intent to view child pornography in violation of 18 U.S.C. §§ 2252A(a)(5)(B), 2252A(b)(2), and 2256(8)(A). The jury returned a guilty verdict after a three-day trial. Royle moved for judgment of acquittal at the end of the prosecution's case in chief and at the end of his own, arguing that the prosecution had not met its burden of proving beyond a reasonable doubt that Royle (as opposed to another) used the laptop to access and download the illicit images. See United States v. Pothier, 919 F.3d 143 (1st Cir. 2019).
After considering the parties' arguments at trial and written supplementation, the court denies this motion. The prosecution introduced evidence from which "a rational jury could find beyond a reasonable doubt that [Royle] knew that his laptop contained the videos." Id. at 148. Specifically, the prosecution's evidence demonstrates that Royle used the MacBook consistently during this time period and that the person who used the laptop to access illicit images did so in a consistent manner across several years, thus rendering it sufficiently more likely that Royle did so and sufficiently unlikely that these were the actions of some other person or that anyone else had consistent access to the laptop. This constituted proof beyond a reasonable doubt. And though Royle renewed his Rule 29 motion on this basis at the end of his own case in chief, Royle himself testified that he accessed pornography - including child pornography - using the MacBook in question during the 2014 to 2015 timeframe. A reasonable jury could conclude from such testimony that Royle knowingly accessed and downloaded child pornography.
Royle filed a 30-page reply memorandum in contravention of Local Rule 147 without the court's leave, which he moved to obtain after the prosecution moved to strike that memorandum. The court granted Royle's motion for leave and considered the full 30-page reply which, as the parties agree, renders moot the prosecution's motion to strike (doc. no. 143). The court denies it as such.
As discussed infra Part I, the court disregards Royle's testimony for the purpose of determining whether the prosecution met its burden of proof.
I. Applicable legal standard
"No person shall . . . be deprived of life, liberty, or property, without due process of law." U.S. Const. amend. V. The Fifth Amendment's due process clause "prohibits the criminal conviction of any person except upon proof of guilt beyond a reasonable doubt." Jackson v. Virginia, 443 U.S. 307, 309 (1979). Accordingly, "[a]fter the prosecution closes its evidence or after the close of all the evidence, the court on the defendant's motion must enter a judgment of acquittal of any offense for which the evidence is insufficient to sustain a conviction." Fed. R. Crim. P. 29(a). The court may, however, "reserve decision on the motion, proceed with the trial[,] . . . submit the case to the jury, and decide the motion . . . after it returns a verdict of guilty . . . ." Id. Rule 29(b). When the court takes the latter route, as it did here, "it must decide the motion based on the evidence at the time the ruling was reserved." Id. That is, it "consider[s] only the evidence presented in the government's case-in-chief to assess whether 'a rational factfinder could find, beyond a reasonable doubt, that the prosecution successfully proved the essential elements of the crime.'" United States v. Ortiz, 447 F.3d 28, 32 (1st Cir. 2006) (quoting United States v. Moran, 312 F.3d 480, 487 (1st Cir. 2002)).
In doing so, it "take[s] all inferences in the light most favorable to the verdict . . . give[s] equal weight to both direct and circumstantial evidence, and . . . neither weigh[s] witness credibility nor require[s] the prosecution to 'eliminat[e] every possible theory consistent with the defendant's innocence[.]" Id. (quoting United States v. Rivera-Ruiz, 244 F.3d 263, 266 (1st Cir. 2001)). It focuses not "on each piece of evidence separately," but rather "evaluate[s] the sum of all the evidence and inferences drawn therefrom, and determine[s] whether that sum is enough for any reasonable jury to find all the elements of the crime proven beyond a reasonable doubt, even if the individual pieces of evidence are not enough when viewed in isolation." United States v. Santos-Soto, 799 F.3d 49, 57 (1st Cir. 2015). And it must "reject those evidentiary interpretations and illations that are unreasonable, insupportable, or overly speculative." United States v. Rodríguez- Martinez, 778 F.3d 367, 371 (1st Cir. 2015) (quoting United States v. Spinney, 65 F.3d 231, 234 (1st Cir. 1995)).
After this analysis, "[t]he verdict must stand unless the evidence is so scant that a rational factfinder could not conclude that the government proved all the essential elements of the charged crime beyond a reasonable doubt." Santos-Soto, 799 F.3d at 57 (quoting United States v. Rodríguez-Vélez, 597 F.3d 32, 39 (1st Cir. 2010)). But "[i]f the evidence viewed in the light most favorable to the verdict gives equal or nearly equal circumstantial support to a theory of guilt and a theory of innocence of the crime charged, this court must reverse the conviction" because "where an equal or nearly equal theory of guilt and a theory of innocence is supported by the evidence viewed in the light most favorable to the prosecution, a reasonable jury must necessarily entertain a reasonable doubt." United States v. Burgos, 703 F.3d 1, 10 (1st Cir. 2012) (citations omitted).
II. Background
Consistent with this standard, the following background draws on the evidence presented during the prosecution's case at trial.
A. Search of Royle's home
On the morning of July 14, 2015, Agents David Fife and Douglas McDonnell of the Federal Bureau of Investigation searched Royle's home pursuant to a search warrant obtained the day before. Agent Fife obtained the warrant after an investigation showed that a computer with an internet protocol (IP) address assigned to Royle's house at 107 Craigie Street in Portland, Maine, had shared child sexual abuse images over the Internet. Royle purchased the house in 2014, the internet service was registered in his name, and Agent Fife observed Royle standing in front of the house one week before he obtained the warrant, all leading Agent Fife to understand that Royle lived there. Royle was home alone with his two minor sons when Agent Fife executed the warrant; his former wife, Anne Hardcastle, arrived later, after Royle called her to pick up the children. Agent Fife testified that only one adult appeared to live in the home.
Fife Tr. (doc. no. 129) at 5-6; Defendant's Ex. I, Attach. D at 1. The defendant introduced Exhibit I during his cross-examination of Fife. See Fife Tr. at 19, 23.
Id. at 5-6, 27, 30, 39; Gov't Ex. 17.
Fife Tr. at 8-9.
Id. at 11.
During the search, Royle told Agent Fife that he would occasionally access his office files remotely using a MacBook laptop. Agent McDonnell found just such a computer in an upstairs room. It rested on a small desk, with a stack of papers to one side and a printer to the other. The room also contained a dresser. When Agent McDonnell found the MacBook, it was running a process through the Disk Utility program to destroy already-deleted files (or, as explained infra, "wipe" the "unallocated space") on the MacBook's hard drive. Approximately 11 or 12 hours remained before the process would complete. Agent McDonnell shut down the computer to end the process. Agents seized the MacBook and subsequently sent it to Boston for forensic testing.
Id. at 10.
Id. at 11; McDonnell Tr. (doc. no. 130) at 5-6.
McDonnell Tr. at 5-6; Gov't Ex. 1B.
Gov't Ex. 1B.
McDonnell Tr. at 6-7; Fife Tr. at 11-12.
Fife Tr. at 11-12.
Id. at 12; McDonnell Tr. at 7.
B. Forensic analysis
Special Agent Seth Plumb, a computer forensic examiner with the child and cyber exploitation group at Homeland Security Investigations, examined the MacBook. He found images depicting minors engaged in sexually explicit conduct in the MacBook's unallocated space. Generally, a given file exists in a hard drive's "allocated space." When a user deletes that file, it continues to exist on the hard drive - it is merely moved into "unallocated" or "free" space, where it may be overwritten by a new file at any time. While a computer's user generally cannot access files in unallocated space, a forensic examiner can sometimes recover such files using forensic tools. Had the erasing process that Agent McDonnell encountered before seizing the laptop in Royle's home completed, Agent Plumb testified, the files in unallocated space would have been deleted and rendered entirely unrecoverable.
Another agent, Nicole Cosola, first examined the MacBook. The results of her examination appear to have been lost. Plumb Tr. (doc. no. 131) at 15-16. But Agent Plumb demonstrated that no changes had been made to the computer's hard drive between when Cosola imaged the MacBook for examination and when he conducted his own. Id.
Id. at 29, 45-48.
See id. at 23-24.
Id. at 24.
Id. at 27.
Agent Plumb reviewed a number of files and databases remaining on the MacBook, and the prosecution presented the cumulation of that evidence as indicating that Royle used that computer to download child pornography. In addition to the image files he found in unallocated space, Agent Plumb reviewed and relied on the following databases to establish Royle's knowing use of the MacBook to access and download child pornography:
• Browser history and SessionStore artifacts from the MacBook's Firefox browser;These files and databases are described, and their relevance to the charge against Royle are discussed, in turn.
• A database of Launch Services Quarantine Events ("LSQuarantine");
• A QuickLook thumbnail cache database;
• Evidence of filesharing software and files downloaded using it.
There is evidence that both the Firefox and Safari browsers were used on the MacBook. The prosecution introduced evidence of Firefox browser use through its Exhibit 11. Evidence of Safari use appears in Defendant's Exhibit B, which was admitted without objection during the defendant's cross-examination of Agent Plumb during the case in chief.
1. Image files
Agent Plumb identified at least 17 files in the unallocated space on the MacBook's hard drive as containing images depicting minors engaged in sexually explicit conduct. Each of these files contained a series of thumbnail images apparently drawn from video files. Some of the thumbnail images had text superimposed, such as "omegle.com" and "Vichatter.net." Agent Plumb described omegle.com as a "video chat service[ ]" and observed that he had encountered images from omegle in prior child exploitation investigations. He similarly described vichatter.net as "a search term that [he had] seen before in child pornography cases," and which he "believe[d] . . . to be a child pornography website." Agent Plumb also found a series of screenshots on the MacBook containing smaller versions of certain of those image files. He described these screenshots as depicting what a user would have seen on the web browser at the time the images contained in them were viewed on the computer.
Plumb Tr. at 30-31. The prosecution introduced these images as its Exhibits 9A through 9Q.
Plumb Tr. at 43-46.
Gov't Exs. 9A, 9D, 9F, 9G, 9L; Plumb Tr. at 43-46.
Plumb Tr. at 70.
Id. at 44.
Gov't Exs. 10G, 10H, 10J, 10N, 10O, corresponding to Gov't Exs. 9G, 9H, 9I, 9J, 9N, and 9O respectively; Plumb Tr. at 47-49.
Because these files were found in the MacBook's unallocated space, they lacked any indication of their origin or when or how they were downloaded. Plumb did, however, associate the filenames of at least nine of those images to files accessed using the Firefox browser on May 7 and July 9, 2015. This association, though less than conclusive, at least creates a sound and reasonable inference that someone used the browser to view and access these specific images, which Plumb later found in the MacBook's unallocated space.
Plumb Tr. at 29-30, 169-71.
Id. at 79-85.
2. Firefox web browser
The prosecution also relied on browser-related evidence from the MacBook, including the web browsing history from the Mozilla Firefox web browser and that browser's SessionStore artifacts.
Gov't Ex. 11.
Gov't Ex. 12.
a) Browser history
The prosecution introduced the MacBook's Firefox browser history from April 2, 2015, to July 13, 2015. A browser history shows, among other things, a list of websites visited using that browser and the date and time when the visit occurred.
Gov't Ex. 11.
Plumb Tr. at 64-68.
The Firefox web browser history directly correlates with child pornography images found in the MacBook's unallocated space. For example, on May 7, 2015, the web browser history shows a visit to a website at the domain "imagetwist.com" with a filename of "4947-pul.avi.jpg.html." And one of the thumbnail images found on Royle's MacBook includes text showing that the still thumbnail image was taken from a video with the filename of "4947-pul.avi." The prosecution correlated nine other images found in the unallocated space to websites visited using Firefox on July 9, 2015.
Gov't Ex. 11 at 22.
Gov't Ex. 9A; Plumb Tr. at 79-80.
See Gov't Exs. 9B-9J & 11; Plumb Tr. at 83-85; Gov't Opp. (doc. no. 139 at 9 (chart correlating web address with exhibit text).
The Firefox web browser history also shows visits to a series of websites that appear to host either video or still images containing child pornography drawn from video chat services. For example, on May 5 and 7, 2015, the Firefox browser history indicates that someone used the MacBook to visit pages on stickamgfs.com with page titles relating to young teenagers, such as "Naked Jailbait Videos." Agent Plumb testified that images from Omegle had appeared in prior child exploitation investigations. He also testified that omegle.com and stickam.com were video chat websites, and that the stickamgfs.com websites appearing in the browser history contained still images as well as video.
Gov't Ex. 11 at 10; Plumb Tr. at 70.
Gov't Ex. 11 at 13-25. The browser history shows these visits occurring on, for example, May 5, 2015, around 2:30 a.m. Id. at 15-17. Agent Plumb testified that the times were displayed in Universal Coordinated Time on the browser history, which is four to five hours ahead of Eastern Time, depending on the time of year. Plumb Tr. at 65-66. These visits appear to have occurred, then, on May 4 at 9:30 or 10:30 p.m. in Maine. Because the parties discuss the web browser history from Exhibit 11 in UTC terms, rather than translating it into Eastern Time, the court does likewise except where expressly noted.
Id. at 70.
Id. at 70-71.
Id. at 71-72.
The Firefox web browser history also demonstrates that the MacBook was used to view a consistent type of child pornography between April and July 2015. Specifically, the titles of web pages viewed indicate that whoever used the browser during that time consistently viewed websites with filenames relating to young teenage girls, including many indicating young teenage girls being exploited through video chat services. For example, the browser history shows that websites visited on May 5, 2015 included those with filenames such as "attractive-young-teens-picture" and "lovely-fresh-hot-teens," and "selfshot-jailbait-kittens-nude." It shows sites with filenames reflecting similar content visited on May 7, June 22, July 9, and July 13, 2015.
Gov't Ex. 11 at 15.
Id. at 20, 26-27, 29-33.
According to the Firefox web history, these sites indicative of child pornography were generally visited in the evening hours, when Royle was more likely to be home. For example, the browser history indicates such activity on May 5 from 2:18 a.m. to 3:16 a.m. UTC; May 7 from 12:08 a.m. to 12:35 a.m. UTC; July 9 from 11:17 p.m. to 11:31 p.m. UTC; and July 13 from 3:11 a.m. to 3:54 a.m. UTC. These UTC times generally correspond to those between 6:00 or 7:00 p.m. and 11:00 p.m. or midnight EDT.
b) SessionStore artifacts
Agent Plumb also reviewed the Firefox browser's SessionStore artifacts, which he described as a record of the most recent use of the browser. Though it does not include information on the date and time of web visits, like the Firefox browser history, it does demonstrate searches for and access to the same consistent type of child pornography. For example, the MacBook accessed the same sort of "jailbait" pages as those listed in the browser history. It also showed that Microsoft's Bing search engine was used to search for, among other terms, "Young Teens in Swimsuits Candid," "Tween Teen Bikinis Candid," "Teen Girl Bathroom Selfies," and "High School Bikini Cheerleaders," though it does not indicate when these searches occurred.
Gov't Ex. 12; Plumb. Tr. at 87-88.
E.g., Gov't Ex. 12 at 1-3.
Id. at 2, 11, 14, 15.
3. LSQuarantine
Both the prosecution and Royle invoked the MacBook's Launch Services Quarantine Events database during the prosecution's case-in-chief. According to Agent Plumb, a MacBook's operating software keeps track of files downloaded from internet sources other than Apple's own app store. When a user attempts to open such a file, the software verifies whether the user wants to open it, requiring the user to select "yes" or "no" before proceeding. The operating software records these incidents in the "Launch Services Quarantine" or LSQuarantine database.
Gov't Ex. 14; Defendant's Ex. B.
Plumb Tr. at 95-96.
Id. at 96.
Agent Plumb reviewed the LSQuarantine database for the MacBook found in Royle's home. The prosecution introduced as an exhibit a portion of that database covering an approximately 18-month period from August 26, 2012 through January 6, 2014. Royle introduced a more comprehensive copy during Agent Plumb's cross-examination, extending back to April 2, 2005. This database extended over a longer period of time than the Firefox browser history, and showed that files with names indicative of the same type of child pornography as viewed with the Firefox browser were downloaded in August, September, November, and December 2012, and February, May, and November 2013.
Gov't Ex. 14; Defendant's Ex. B.
Gov't Ex. 14 at 1-2; Plumb Tr. at 101-02. Some of the filenames include the term "loli," which Agent Plumb testified is short for "Lolita," a common child-pornography search term. Others contain more explicit terminology.
4. QuickLook thumbnail cache
Finally, the MacBook's QuickLook thumbnail cache also indicates the presence of child pornography on the MacBook. The QuickLook thumbnail cache is a database in which the contents of a given folder are recorded when that folder is opened and viewed. At the time the record is made, files recorded in the database would have been in allocated space and accessible to the MacBook's user.
Plumb Tr. at 104.
Id. at 105.
Entries from the MacBook's QuickLook thumbnail cache showed the contents of several of the MacBook's folders, at least at the time those folders were opened. Some of those indicated the presence of the same type of child pornography as viewed using the Firefox web browser. For example, the ".Trash" folder contained a number of files with names indicative of child pornography, as well as references to video chat sites that Plumb testified often appeared in child pornography investigations, including Omegle and Younow. Other subfolders in the Desktop folder included image files with filenames indicative of child pornography, such as "young+girls+in+bikini+(8).jpg," and "Private-candid-teen-upskirt-upshorts-19.jpg."
Gov't Ex. 15 at 1; Plumb Tr. at 104-06.
Gov't Ex. 15 at 4, 6-7.
5. File-sharing software
Several of the databases discussed above also indicate that someone used the MacBook to (1) search for and download peer-to-peer file-sharing software and (2) download files indicative of child pornography using such software. Someone using peer-to-peer file-sharing software can search for specific terms and receive a list of files containing those search terms that are available for download directly from the computers of others using the same software. A user can then download some or all of those files by clicking on the relevant filenames.
Plumb Tr. at 110-11.
The Firefox browser history shows that someone searched for a way to download and downloaded the peer-to-peer file-sharing software aMule on at least April 2, 2015. The LSQuarantine database also indicates that someone searched for and downloaded peer-to-peer file-sharing software, including aMule, on several occasions: March 25, 2013 (uTorrent, Frostwire), April 12, 2013 (Cabos, FrostWire, aMule), November 9-10, 2013 (uTorrent, Frostwire, Cabos, aMule), December 21, 2013 (aMule), January 5, 2014 (aMule, Cabos, Acqlite, mlDonkey), and January 25, 2015 (Acqlite).
Gov't Ex. 11 at 1-7.
Defendant Ex. B at 90, 95, 127-28, 137-38, 158; Gov't Ex. 14 at 1-2. Agent Plumb testified that Cabos, uTorrent, FrostWire, Acqlite, mlDonkey, and aMule are peer-to-peer file sharing software. Plumb Tr. at 101-03.
The MacBook's power statistics report shows that aMule was running on the computer on July 9, 2015. And the QuickLook thumbnail cache shows that the deleted "aMule Downloads" subfolder within the Documents folder contained a large number of video and image files with names indicative of child pornography. Many names of files in the "aMule Downloads" subfolder also referenced the same video chat sites mentioned in the Firefox browser history, such as Stickam, YouNow, and Omegle. And many of those filenames also referenced underage girls engaging in sexual activity.
Id. at 116-17.
Gov't Ex. 15 at 8-33.
Id. at 8-12.
Id.
C. Other trial evidence
During the three-day trial, the prosecution elicited testimony from Agents Fife and McDonnell concerning the circumstances surrounding the seizure of Royle's MacBook, and from Agent Plumb about the contents of the MacBook. At the close of the prosecution's case, Royle moved for a judgment of acquittal under Federal Rule of Criminal Procedure 29, arguing that the prosecution failed to prove his knowing possession of the child abuse images in question because it had not proven: (1) Royle's exclusive access to the laptop as, he argued, Pothier requires when the prosecution relies on circumstantial evidence tying the defendant to the illegal computer activity; and (2) that Royle accessed and downloaded the illegal material instead of automated computer processes doing so without his knowledge.
The court took Royle's motion under advisement. See Fed. R. Crim. P. 29(b). The defendant then put on his case, consisting of a single witness - himself. Royle testified that he used the MacBook to view adult pornography and that, from time to time, child pornography appeared in the search results or on the pages he viewed. He also testified that he repeatedly searched for and downloaded peer-to-peer file-sharing software, including aMule, which he used to search for adult pornography and that, from time to time, he would inadvertently download child pornography along with the adult pornography he sought. And on cross examination, he admitted that he had "once used" the word "teen" in searching for adult pornography and had visited pornography websites with the words "teen" and "jailbait" on them.
The jury found Royle guilty on the single count against him. Royle renewed his Rule 29 motion after his own case and after the verdict, see Fed. R. Crim. P. 29(c)(1), asking the court to set aside the jury's verdict in favor of acquittal.
III. Analysis
Royle concedes that child pornography images appeared on the MacBook, but argues that the prosecution failed to prove that he was the one who downloaded them or used the MacBook to access them. In moving for judgment of acquittal after the prosecution's case, Royle made two arguments. He argued, first, that the prosecution failed to prove that he was the one who downloaded the images because it failed to prove his exclusive possession or use of the MacBook, as required - he argued - by Pothier. Second, he argued that the prosecution failed to demonstrate that he knowingly downloaded the illicit images because background processes may have accessed and downloaded them without his knowledge.
The court permitted Royle to supplement his arguments with a written memorandum, in which he emphasized the Pothier-based argument but referenced only in passing the second argument concerning background processes. As discussed below, neither argument merits acquittal.
A. Royle's access-based argument
Royle grounds his first Rule 29 argument in Pothier, a recent decision from the First Circuit Court of Appeals addressing the prosecution's burden of proving that a defendant knowingly possessed child abuse images when multiple individuals arguably had access to the computer on which they were found. After reviewing the holding in Pothier and the facts giving rise to it, the court outlines the evidence supporting Royle's use of the laptop and explains why his alternate theories are not equally plausible, as those in Pothier were.
1. United States v. Pothier
In Pothier, police officers "learned that someone using an IP address registered to William Pothier at an apartment in Exeter, New Hampshire, downloaded child pornography from a peer-to-peer file-sharing network." 919 F.3d at 144. In searching his apartment, they found his Asus laptop in the living room. Id. at 145. Ultimately, it was found to contain seven videos depicting children engaging in sexual acts in a temporary folder associated with a file-sharing program and the laptop's recycle bin. Id.
Pothier was indicted on charges of possession of child pornography and went to trial. Like Royle, he moved for judgment of acquittal at the end of the prosecution's case, "arguing that the government failed to prove beyond a reasonable doubt that he knew that the Asus laptop contained child pornography." Id. The district court denied that motion. The First Circuit Court of Appeals reversed the conviction, concluding that "the evidence was insufficient to prove beyond a reasonable doubt that he - as opposed to the other people who may have had access to the computer - downloaded the pornography." Id. at 144.
At trial, the prosecution advocated the theory that "Pothier must have known that the illicit material was on his laptop because he was the only person who otherwise used the laptop, and therefore must have been the person who downloaded" the images. Id. at 147. But there was no evidence specifically tying Pothier to use of the laptop at the time the illicit materials were downloaded. Id.
Though the evidence supported the conclusion that the laptop was Pothier's and that he used it on at least a handful of occasions, its presence in the common area and lack of password protection left it accessible to anyone present in the apartment. Id. at 144, 147. And there were at least three people who presumably had such access: Pothier himself, Josephine Pritchard, and "someone named Balis." Id. at 144-45.
The Court of Appeals concluded that the evidence supported not just the prosecution's theory, but also an equally probable alternative scenario: "that Pritchard or Balis used the readily available laptop during Pothier's frequent absences to download the file-sharing and file-shredding applications and the child pornography." Id. at 147. And because "[e]ach scenario is plausible, . . . to settle on one beyond reasonable doubt would require guesswork," on which "guilt beyond a reasonable doubt cannot be premised . . . ." Id. (quotations omitted).
In this case, though the prosecution could have more fully established Royle's use of the laptop and excluded use by others, it presented evidence, taken in its entirety, from which "a rational factfinder could find, beyond a reasonable doubt, that the prosecution successfully proved the essential elements of the crime." Moran, 312 F.3d at 487. Specifically, it presented evidence supporting Royle's use of the MacBook on days and at times proximate to those during which illicit material was downloaded; evidence that Royle was the MacBook's primary user and that other adults had only limited access to it; and a pattern of access to illicit material suggesting that Royle was the one who downloaded it. None of the alternative scenarios that Royle posits are plausible so as to require the guesswork that Pothier rejects.
As Royle observes, the prosecution had ample notice of Pothier, which issued almost a year before trial and which the court raised on at least two occasions, including at the close of the suppression hearing and after jury selection. See Royle Mem. (doc. no. 134) at 17 & n.9. In presenting its case, the prosecution may have relied on the representation from Royle's counsel during a chambers conference that "this is not a Pothier case." This does not, of course, relieve the prosecution of its burden. But as explained here, the prosecution proved Royle's use of and access to the MacBook such that a "rational factfinder could decide that the government carried its burden beyond a reasonable doubt." Pothier, 919 F.3d at 146 (citing United States v. Figueroa-Lugo, 793 F.3d 179, 183 (1st Cir. 2015)).
2. Royle's use of the laptop
Analogizing to Pothier, Royle first argues that the prosecution failed to prove his control of the MacBook. The two cases do have some similarities. Like the laptop in Pothier, the MacBook lacked a password at the time it was found. And, like Pothier, there is evidence (discussed more fully infra Part III.A.3) that at least one other known individual used the MacBook. But the similarities end there.
Fife Tr. at 30; McDonnell Tr. at 8.
Royle's MacBook was found not in the living room or a common space, but on the second floor of a home that he owned, on a desk that contained a variety of papers and a printer. Combined with Royle's concession that he used the MacBook for work, the MacBook's presence in such a place indicates a home office - or at least a more private space than the common room of Pothier. In Pothier, three people received mail - and arguably lived - in the residence. 919 F.3d at 144. Here, Agent Fife testified that the house appeared as though Royle was the only adult in residence. There is no evidence that any other adults lived in the home. And though Agent Fife observed a car in the driveway still registered to both Royle and Hardcastle, Royle indicated to Fife that Hardcastle was his ex-wife. A reasonable factfinder could infer that she did not live at the home from the fact that Royle had to call her to come over to pick up the children at the time of the search - before 8:00 a.m. on a weekday.
Royle stipulates that he had owned the home since 2014 and that the internet service was in his name. Gov't Ex. 17.
Royle argues that the prosecution's lack of evidence concerning the interior layout of the split-level residence leaves some ambiguity about the relative location of the common spaces and the room in which the MacBook was found. Royle Mem. at 8. But the evidence shows that Agent Fife went through the residence to get a sense of its setup and, without argument, adopted defense counsel's characterization of the MacBook as running "upstairs in a bedroom." Fife Tr. at 9, 30. And, though the court does not consider this fact for purposes of this motion, Royle admitted that it was, in fact, found in his bedroom.
Fife Tr. at 10.
Id. at 9.
Royle also observes, of course, that a laptop is by nature portable. And it is true that the prosecution introduced no direct evidence concerning the MacBook's physical whereabouts at any time except the time is was found or any person's physical proximity to the MacBook at any specific time. The prosecution could have done more to investigate and demonstrate the laptop's provenance, usage, and location. And it could have done more to shore up the evidence concerning other adults' access to the house, where the MacBook was set up and seized while running a file deletion and erasure program in what fair inferences suggested was the defendant's home office or bedroom. But unlike Pothier, the prosecution here did introduce evidence from which a rational fact-finder could conclude that Royle - and not some unknown third party - consistently used the MacBook, and that he did so to access and download the child pornography found in its unallocated space.
Royle Mem. at 22-23.
Id. at 9.
First, Royle concedes that he used the laptop. He told Agent Fife, for example, that "occasionally he would use Citrix Client" on the laptop "to remote access . . . his office files." And the MacBook contains evidence supporting his general use of it, both for work and personal reasons. The Desktop folder in the QuickLook thumbnail cache database includes several files with the word "Royle" in their names - for example, "Royle Boys.jpg," and "Royle, George 1400010680.pdf." The Documents folder in the same database also contains files with names indicating Royle's use of the computer, such as "GEORGE.docx"; documents with names indicating they were addressed to his ex-wife, Anne Hardcastle, such as "Dear Anne.docx," "My dearest Anne.docx," "Hi Anne.docx," and "Thirty love letters to Anne.docx"; and documents relating to his work as an attorney. The LSQuarantine database shows that Royle consistently used the laptop to access both his personal and work email. Entries in the LSQuarantine database show activity relating to Royle's law firm between January 2012 and August 2012 and activity relating to Royle's private and work email accounts regularly between December 2011 and May 2014.
Fife Tr. at 10; Royle Mem. at 5; Defendant's Ex. B. at 40-49 (reflecting logins to Royle's work account at secure.dwmlaw.com).
Gov't Ex. 15 at 1-2.
Id. at 7-8.
E.g., Defendant's Ex. B 39 (2011); id. at 40-41, 49-50. 56-58, 61, 63, 66, 68-71, 74-75 (2012); id. at 81-85, 90-95, 98-102, 108-23, 126-27, 130-35 (2013); id. at 137-42, 145-56 (2014). Entries referencing "DWM" and "dwmlaw" relate to Royle's legal work. Plumb Tr. at 218-19.
The LSQuarantine database also demonstrates that someone used the MacBook to download child pornography during that same timeframe. For example, files with names indicative of child pornography were downloaded between August and December 2012, and in February, May, and November 2013. In fact, on multiple occasions, the LSQuarantine database shows that Royle accessed his email on the same day - and sometimes within hours - of someone using the MacBook to search for child pornography featuring young teenage girls. For example, he accessed his personal email account around 9:22 p.m. on November 4, 2013, just ten minutes before someone used the MacBook's Safari browser to search for "young+self+shot." On August 29, 2012, he accessed his work email around 11:30 p.m. and, just over an hour later, someone accessed omegle videos using the MacBook's Safari browser. He likewise accessed his work email account on May 22, 2013 around 4:40 p.m.; that night around 11:00 p.m., someone used the MacBook's Safari browser to access "camgirl" videos.
Gov't Ex. 14 at 1-2; Plumb Tr. at 101-02.
Defendant's Ex. B at 127; Plumb Tr. at 103. Exhibit B lists times in Eastern Standard or Eastern Daylight Time.
Defendant's Ex. B at 61.
Id. at 99-100.
Royle observes, correctly, that Agent Plumb did not testify about the email-related entries from the LSQuarantine database. But he did testify as to the function of the LSQuarantine database as recording downloaded files that a user attempted to open. And the defendant elicited testimony from Agent Plumb concerning entries from the Mail program suggesting Royle used a private Gmail account, as well as his DWM email account, for attorney activities. Agent Plumb's testimony on this point could have been more robust. Still, the nature of the exhibit, and these entries in particular, permit a rational factfinder to extrapolate Royle's use of the device to access his email. For example, entries related to his personal email account list a Gmail account with an address indicative of Royle's name in the column labeled "LSQSenderAddress" and "George Royle V" in the column "LSQSenderName." Though, as Royle observes, it is possible that someone else using the laptop received email from Royle at these times, the number and extent of these entries render it exceedingly likely, and thus much more plausible, that Royle himself accessed his email at these times.
See Reply at 11-16.
See Plumb Tr. at 98-99.
Id. at 217-19.
Evidence drawn from the Firefox browser demonstrates that the pattern of access to child pornography featuring young teenage girls continued through 2015. Though it does not establish that he ever used Firefox to access his email, the browser evidence does demonstrate that he used the browser to access the same variety of illicit images and websites as those accessed during the 2012-2014 timeframe as established by the LSQuarantine data. As explained supra Part II.A.2.a, the Firefox browser history shows that someone continued the pattern of access to pornography featuring young teenage girls on May 5, May 7, June 22, July 9, and July 13, 2015, and accessed "jailbait" video or image files during the same timeframe through, for example, Omegle.com. The Firefox browser's SessionStore artifacts likewise demonstrates access to the same sort of images and videos.
Gov't Ex. 11 at 15, 20, 26-27, 29-33.
Id. at 13-25.
Gov't Ex. 12 at 1-3, 11, 14, 15.
The persistent search for and evidence of use of peer-to-peer file-sharing software also supports the theory that Royle used the MacBook to access child pornography. As both the LSQuarantine and Firefox browsing history show, someone used the MacBook to search for and download file-sharing software on several occasions between March 2013 and April 2015 - the same period during which Royle consistently used the MacBook to access his personal and work email accounts.
The prosecution argues that Royle's effort to delete files from the MacBook's unallocated space on the morning of the search further supports Royle's culpability. See Gov't Mem. (doc. no. 139) at 28-29. Though the evidence is consistent that Royle was unaware of the impending search, e.g., Fife Tr. at 24, it may well be that he initiated the erase function because he knew that files in the unallocated space contained illicit images. While the prosecution offered no evidence about Royle's reasons for wiping the MacBook, a common-sense inference that a possessor of contraband could once or occasionally seek to conceal evidence of that unlawful possession is both reasonable and permissible. In any event, the evidence supports the verdict even without that inference.
The Quicklook thumbnail cache also indicates that Royle used the file-sharing software aMule to download child pornography. Specifically, files with names indicative of the same type of child pornography accessed using the Firefox browser and indicated in the LSQuarantine database appeared in a folder with a name indicating that aMule was used to download them. Though the files themselves were no longer available, "[t]he presence of files with names indicative of child pornography—even absent further proof of what, if anything, those files contained—tends to make it more probable that [a defendant] knowingly was involved with child pornography." United States v. Breton, 740 F.3d 1, 14 (1st Cir. 2014).
As Royle observes, "no line item in the LSQuarantine database reflecting apparent use of the laptop by Defendant overlaps in time with any line item the government identified as an instance of the laptop accessing contraband." This may be true. But the evidence outlined here, viewed in the light most favorable to the verdict, creates reasonable inferences from which a rational fact-finder could conclude that Royle not only used the laptop on a regular basis between 2012 and 2015, but - as the MacBook's most consistent user - was also was the one who used it to access a consistent form of child pornography during the same time period. None of Royle's alternative theories, outlined below, cast reasonable doubt on that conclusion.
Royle Mem. at 5.
3. Royle's alternative theories
"If the evidence viewed in the light most favorable to the verdict gives equal or nearly equal circumstantial support to a theory of guilt and a theory of innocence of the crime charged, this court must reverse the conviction." United States v. Burgos, 703 F.3d 1, 10 (1st Cir. 2012). Seeking acquittal on this basis, Royle puts forth a theory of innocence grounded in four alternative scenarios - that is, four other people or categories of people who might have downloaded child pornography to Royle's laptop. Royle did not argue these other individuals' access to the jury - nor could he, plausibly, after admitting that the MacBook was his; that he did not lend it to anyone between April and July of 2015; that he conducted the late-night or early-morning browsing activity reflected by the evidence; that he divorced in 2014; and that he was the only adult living at his residence at the time of the search. He also admitted to using the word "teen" as a search term for pornography, and that he had been to websites that referred to "jailbait" and "teens" and that "included pictures of underage children . . . on occasion."
Though Royle testified that he only used the search term "teen" once, as discussed supra Part II.B.2, evidence from the MacBook's Firefox web browser (which Royle admitted to using) includes a variety of searches for pornographic images of teenage girls.
Of course, for purposes of this motion, the court considers only the evidence presented during the prosecution's case-in-chief. Ortiz, 447 F.3d at 32. And Pothier undermines Royle's conviction if the alternative scenarios he poses reach a level of plausibility such that, based on that evidence, a jury must engage in "guesswork" to "settle . . . beyond a reasonable doubt" on one theory over another. Pothier, 919 F.3d at 147. But Royle's alternative scenarios do not meet this standard. The evidence presented during the prosecution's case-in-chief, viewed in the light most favorable to the verdict, firmly supports the prosecution's theory - that Royle used the laptop to download child pornography - as well as the jury's verdict and offers only minimal support for Royle's alternatives.
Royle argues that one or more of his former wife, an unidentified white female, child-care workers, and the general public may have downloaded child pornography onto his MacBook. But even conceding that at least Hardcastle had occasional access to the MacBook, it is not equally plausible that these individuals used the MacBook to access or download the child pornography at issue in this case. These individuals' mere access to the laptop therefore does not mandate overturning the jury's verdict under Pothier.
Hardcastle. First, the evidence shows that Royle's former wife, Anne Hardcastle, not only had access to but actually used the MacBook between 2012 and 2014. The LSQuarantine report reflects that someone used the MacBook's Safari internet browser to access email accounts hosted at ppg.com, coca-cola.com, aol.com, and gmail.com associated with Hardcastle 17 times between January 2012 and January 2014: 12 times in 2012, four in 2013, and once in January 2014. The prosecution also failed to introduce any evidence about when Hardcastle and Royle separated or divorced, or whether Hardcastle continued to spend any significant amount of time at Royle's house after the divorce. And, as Royle points out, the car that Agent Fife observed in his driveway remained registered to both Royle and Hardcastle.
See Royle Mem. at 5-6 (aggregating data from Exhibit B). There is no evidence that Royle had email addresses associated with these domain names. Though the prosecution posits that these entries indicated an attempt to open emails or email attachments sent from Hardcastle's email accounts, Opp. at 27, the court credits Royle's interpretation for purposes of this motion.
Fife Tr. at 26-27.
Royle argues that proof that Hardcastle used the MacBook at all "[n]essitates [d]oubt." But even assuming that the evidence establishes her use, it does not establish an equally probable alternative scenario in which she used it to access or download child pornography. Though Hardcastle may have used the MacBook 17 times between 2012 and January 2014, there is no evidence that she accessed it at any point after January 2014. As discussed supra, the evidence indicates that the pattern of access to a specific type of child pornography continued into July 2015, when there is no evidence of Hardcastle's access to the MacBook and by which point Royle referred to her as his "ex-wife." And as also discussed supra, the only evidence concerning Hardcastle's habitation is that she did not live in the home where the MacBook was found at the time of the search.
Reply at 10.
Fife Tr. at 34.
See id. at 10.
Nor is there any correlation between the times that Hardcastle demonstrably used the MacBook and access to files or websites bearing titles indicative of child pornography. Whereas the LSQuarantine database shows that Royle used the MacBook for both personal and business reasons far more regularly than Hardcastle during that time period and, further, demonstrates that Royle used the MacBook on days when it was also used to access child pornography.
Thus, though Hardcastle accessed the MacBook at some point, the pattern of pornography accessed and its continuation well past the time when Hardcastle demonstrably accessed the MacBook renders it far less probable that she used it to access files indicative of child pornography for the four-year duration indicated by the LSQuarantine database and browser history or to download the child pornography ultimately found on it.
Unknown female. Second, Royle posits that an "unknown white female" may have accessed the laptop because, on July 6, 2015, Agent Fife observed Royle and an "unknown white female" (who Royle suggests "may or may not have been Hardcastle") standing outside Royle's home. The record contains no other evidence about this person. There is no indication that, like the roommates in Pothier, she lived at or had regular access to the home, or that she at any time accessed or had access to the MacBook found in the upstairs room. And because the evidence indicated that Royle was the only adult living in the house, the scenario in which this unidentified individual downloaded the child pornography found on the MacBook is not equally probable as the scenario in which Royle himself did.
Royle Mem. at 9; Fife Tr. at 27.
Fife Tr. at 10.
The general public. Royle also posits that anyone at all could have accessed the MacBook. On July 8, 2015, Agent Fife observed the house empty with its front door standing wide open in the early and late evening hours. This happened "less than 24 hours before the laptop purportedly accessed several of the illicit images offered into evidence . . . ." Royle also points to several instances of someone using the MacBook to "access[ ] the internet on weekdays during business hours" between December 2012 and May 2015 when, presumably, Royle was at work. Based on this, he proposes that a jury could conclude that almost anyone accessed his MacBook to download these images.
Royle Mem. at 10; Fife Tr. at 27.
Royle Mem. at 9-10.
Id. at 7-8.
But these scenarios are not equally plausible as the one in which Royle himself accessed and downloaded the images. Given the frequency and length of time that someone used the MacBook to access sites indicative of the same type of child pornography between 2012 and 2015, often late in the evening, it is far less likely that random strangers (or even acquaintances) did so through an unsecured door than that Royle did so himself. And several of the dates highlighted by Royle as days the laptop was used to access sites indicative of child pornography while he was at work were holidays—and thus days that Royle was more likely to be home.
These include New Year's Eve (12/31/12); Martin Luther King Jr. Day (1/21/13, 1/20/14); and President's Day (2/18/13). Several of the remaining days Royle highlights were Mondays, and others include days that a working individual might take off work, including the Friday before Memorial Day (5/24/13) and the Tuesday before Thanksgiving (11/26/13).
Child-care workers. Finally, Royle hypothesizes that, because Royle appeared to live alone with two children under the age of 10, there is a "strong inference . . . that child-care providers," such as babysitters, nannies, or relatives and friends, "would also have had access to the residence" and, presumably, the MacBook. But Pothier turned on the plausible access of known individuals to an unprotected laptop found in a common area, 919 F.3d at 147-49, not the speculative access of unknown and unidentified individuals to a laptop found in a room that appeared to be a bedroom or home office. Royle offers nothing more than speculation in arguing that (1) child care workers were in the home at all and (2) they consistently used the same laptop that he used for work to access child pornography over a 4-year period. Given that websites with titles indicative of child pornography were often accessed in the late evening hours, it is exceedingly more likely that Royle himself accessed those websites than that an unspecified child-care worker used his laptop to do so.
Royle Mem. at 10.
B. Knowledge element
Royle focuses his memorandum on his argument that the prosecution failed to satisfy Pothier by excluding the possibility that someone else used his MacBook to access and download the child pornography found there. He neither reiterates nor incorporates his arguments, made orally at trial, that automatic processes internal to the MacBook (specifically "caching" and "prefetching") downloaded the child pornography found there, unbeknownst to him, and that the prosecution failed to prove otherwise through the less than satisfactory testimony of Agent Plumb. In fact, he mentions these processes - and his argument based on them - only in passing while discussing Agent Plumb's lack of familiarity with them. By failing to raise it in his memorandum, Royle has arguably waived this line of reasoning. See United States v. Tkhilaishvili, 926 F.3d 1, 11 (1st Cir. 2019). But the court addresses it here in the interest of completeness.
See id.. at 2, 11-12, 15.
The law penalizes those who "knowingly possess[ ], or knowingly access[ ] with intent to view" images of child pornography transported through interstate commerce. 18 U.S.C. § 2252A(5)(B). An action is taken "knowingly" if is "done voluntarily and intentionally and not because of mistake or accident." United States v. Figueroa-Lugo, 793 F.3d 179, 193 (1st Cir. 2015) (internal quotations omitted). The prosecution bears the burden of proving this element beyond a reasonable doubt.
Agent Plumb described "prefetching," at least with respect to Windows computers, as the process in which "files that [have] previously been accessed are . . . prioritized in a way to allow them to be in active memory quicker." He professed no familiarity with the process on Apple computers or "in terms of browsers," though on further questioning agreed that "prefetching" may indicate "a process that's happening separate from the user that is silently reaching out to other items and caching them." "Caching," he explained, was an "automated process" wherein the browser saved items that appear on a webpage "to a certain degree within the computer" so that "if you are to go back to that page . . . it will be available to you more quickly . . . ." And, given that the illicit images were found in the MacBook's unallocated space, without any evidence of when or how the files were downloaded, Plumb conceded that he could not exclude the possibility that the images were downloaded automatically through one of these processes.
Plumb Tr. at 132.
Id. at 130-32.
Id. at 135.
Id. at 119-20.
Id. at 170-76.
At trial, Royle argued that these automated processes may have accounted for the presence of child pornography on the MacBook and, if so, then Royle did not knowingly possess the images located there. But Agent Plumb's testimony was unequivocal that these processes do not apply to peer-to-peer file-sharing software. The undisputed evidence is that someone used the MacBook's Firefox browser to search for and download such peer-to-peer file-sharing software as aMule on multiple occasions over a period of time. Files with names clearly indicative of child pornography were found in the QuickLook thumbnail cache database - tellingly, in a folder called "aMule Downloads." And, as discussed supra, "[t]he presence of files with names indicative of child pornography—even absent further proof of what, if anything, those files contained—tends to make it more probable that [a defendant] knowingly was involved with child pornography." Breton, 740 F.3d at 14.
Id. at 225.
See Defendant Ex. B at 90, 95, 127-28, 137-38, 158; Gov't Ex. 14 at 1-2.
See Gov't Ex. 15 at 8-33.
Thus, even if Agent Plumb's testimony on cross examination about automated processes introduced some doubt about whether Royle intentionally downloaded images viewed using the Firefox browser, evidence introduced by the prosecution supports the reasonable inference that he downloaded peer-to-peer file-sharing software, which he then used to search for and download child pornography. And this evidence further supports the inference that Royle knowingly obtained child pornography. Royle is, accordingly, not entitled to a judgment of acquittal on this basis.
The court does not (and, as discussed above, need not) consider Royle's testimony for purposes of resolving this motion. See Ortiz, 447 F.3d at 32. But he did provide evidence that he continued to visit websites and to download images through peer-to-peer software after recognizing that those sites and downloads contained child pornography. That is, he testified that he regularly viewed and searched for adult pornography using a browser; that he at least once used the term "teen" to search for such pornography; that sometimes he would inadvertently access child pornography while searching for the adult variety; and that, from time to time, pornography websites would automatically open browser tabs or popups containing child pornography without action on his part. He also testified that he would sometimes download child pornography alongside adult pornography when mass-downloading files using peer-to-peer software. He testified that, whenever this happened, he immediately deleted or closed the illegal material. But the fact that he continued to visit websites or to mass-download files using peer-to-peer software after these occurrences supports the jury's conclusion that he knowingly accessed and downloaded child pornography.
IV. Conclusion
Faced in advance of trial with knowledge that this case shares some similarities with Pothier, the prosecution could have obtained and presented more thorough evidence establishing Royle's use of the MacBook found in his home to access and download child pornography. Even so, as explained above, the evidence presented during its case in chief permits a rational factfinder to conclude that Royle was the one who did so and that he did so knowingly. His motion for a judgment of acquittal under Rule 29 is therefore DENIED.
SO ORDERED.
/s/_________
Joseph N. Laplante
United States District Judge Dated: May 22, 2020 cc: Craig M. Wolff, AUSA
Walter F. McKee, Esq.