ComputerForensicsDigest.com

Conviction Reversed — During a computer forensics examination for alleged fraud, multiple images of child pornography were discovered on defendant's computer. A second search warrant was obtained and a federal forensics examiner eventually uncovered over 150 images of child pornography. Defendant was ultimately charged with one count of "knowingly received and attempted to receive one or more visual depictions [of minors engaged in sexually explicit conduct]," i.e., two Web site banners containing sexually explicit images of children.

 

At trial, the expert conceded that all the CP images were in the browser cache, and that there was no evidence that defendant manipulated them, or was even aware that they were there. However, he also testified to search terms and Web activity which the expert said was consistent with someone "methodically seeking out child pornography." The expert said that the arrival of various suspect images on the computer was preceded by defendant's search for child pornography, but he could not connect specific search terms to the images that formed the basis of the indictment. Defendant twice moved for acquittal, arguing that there was insufficient evidence that he "knowingly" possessed the images. The motions were denied and defendant was found guilty. The District Court sentenced him to 132 months in prison and 108 months of supervised release. Defendant challenged his conviction on appeal. The Circuit Court focused on the issue of "knowing," which the District Court defined for the jury as "an act was done, or visual depictions were received, voluntarily and intentionally, and not because of mistake or accident." The Court agreed with defendant that government presented no evidence that he had accessed the files in his browser's cache, or any evidence that he was even aware that the cache existed. Moreover, the government's own expert conceded that the pattern of searching for child pornography did not precede the images in question. The presence of contraband in the browser cache is sufficient proof of receipt, but not knowing receipt. The Court specifically rejected two government arguments: that a search for child pornography is proof that any receipt is "knowing," and that the theoretical ability to control files in the cache is the equivalent of actually controlling them. The Court also noted that there was no proof (and perhaps no way to prove) that the defendant actually saw the two banners on his monitor and therefore had knowledge of their contents. There is a lengthy dissent.