Appellant was the subject of a typical ICAC undercover operation detecting IP Addresses using peer-to-peer file sharing programs (Frostwire) to download and share child exploitation images. Upon executing a search warrant at Appellant’s house, Appellant asked permission to go back inside and get dressed. At this point Appellant woke his roommate to tell him police were there for his (Appellant’s) computer, and proceeded to place his laptop in the shower with the water running. Despite Appellant’s attempt to destroy the evidence, the computer forensic examiner was able to conduct a forensic examination and extract ample amount of evidence. As such, Appellant was convicted three counts related to transportation, receipt, and possession of child pornography. He was also convicted of obstruction of justice (computer in the shower).
Attack on computer forensic examiner expertise: Appellant argued on appeal that the computer forensic examiner with the Maryland State police “possessed insufficient specialized knowledge or skill in the software programs used to extract data from Appellant’s computer, and failed to offer testimony regarding the reliability of the forensic tools used in the examination.” The court outlined that FRE 702 is a fairly low burden, addressing each of the 4 prongs. The court also stated that “the rejection of expert testimony is the exception rather than the rule.” Moreover, when reviewed for abuse of discretion, Appellant cannot carry his burden.
The Agent explained the process she used to examine Appellant’s computer, using EnCase for both duplication and extraction. The Agent explained her credentials, knowledge, and experience, as well as the reliability of EnCase in the field.
Attack on sufficiency of the evidence: Next, Appellant argued that the district court erred in denying his motion for judgment of acquittal (de novo review). The court declined “Appellant’s invitation to find that downloading, storing, and sharing images using a peer-to peer program cannot establish knowing receipt, possession or transportation.” Rather, the court noted that the “use of a peer-to-peer file sharing program qualifies as distribution” in the context of a sentencing enhancement. The evidence supported the jury’s findings because the Agent was able to show that 570 files were available for sharing at the time of seizure and were located on C:/Users/Paul/shared. Upon opening the shared folder, it displayed the warning “You are sharing 570 files. You can control which files FrostWire shares.” The government also introduced common search terms associated with child pornography, many of which were included in file names on the laptop. Moreover, the Agent testified that “in the ten days prior to seizure, the shared folder was accessed 209 times, with 173 images containing search terms indicative of child pornography in their titles.” This evidence, plus the attempt to destroy the laptop provided the jury ample information for conviction.