Opinion
No. 3:10-cr-161.
November 30, 2010
MEMORANDUM OPINION
On June 9, 2007, the defendant Andrew J. Heller ("Heller") sold a Compaq Presario laptop computer (the "Compaq laptop") to his neighbor at a yard sale. The neighbor discovered a collection of pornography on the hard drive of the Compaq laptop. After discovering the pornography collection, the neighbor contacted authorities who inspected the Compaq laptop and after locating images of child pornography, obtained a search warrant for defendant's home. Pursuant to the search warrant executed on July 12, 2007, authorities seized, at defendant's home, three computers, five external hard drives and nearly 400 additional CDs and DVDs, three media cards and other digital media. Approximately 318 of the seized CDs and DVDs were in two separate binders. One was a black binder containing 207 CDs and the other was a tan-colored CD binder containing 111 CDs and DVDs. Authorities later determined that the entire collection of 207 CDs in the black binder and all but 26 of the 111 CDs and DVDs in the tan-colored binder contained only adult pornography. The 26 CDs and DVDs in the tan-colored binder contained both child pornography and adult pornography. Authorities also determined that none of the three computers seized at the defendant's home contained any child pornography or any digital evidence that any of the 26 CDs and DVDs containing child pornography had been viewed from those computers. On June 1, 2010, an indictment was returned against the defendant charging him with one count of possession of child pornography in violation of 18 U.S.C. 2252A(a)(5)(B). Specifically, the government alleges that the defendant knowingly possessed certain images of child pornography that appeared on the 26 CDs and DVDs in the tan-colored binder. The defendant has not been charged with any crime based on the child pornography found on the sold Compaq laptop.
The United States seeks to admit evidence at trial that child pornography was found on the Compaq laptop, including certain specific images of child pornography. It also seeks to introduce evidence that a hard drive from another laptop computer, an HP Pavilion laptop ("HP laptop"), that was issued to the defendant by his employer (and was not among the equipment seized at defendant's home on July 12, 2007), had been "wiped clean" before the defendant turned it over to authorities in May 2008. On November 24, 2010, this Court conducted an evidentiary hearing concerning these motions, following which it took the matter under advisement. For the reasons stated below, the Court concludes that the evidence that is the subject of these motions should not be admitted at trial and that the United States' motions should be denied.
I. The government's motion under Rule 404(b) (Doc. No 16).
The forensic evidence presented to the Court showed that the Compaq laptop sold at the yard sale had been used from 2001 until December 2002, and then again after it had been sold on June 9, 2007. The pornography found on the Compaq laptop was in a folder entitled "PPT," which contained twenty separate PowerPoint presentations (the "PowerPoint files"). Eighteen of those files contain only adult pornography. Two of the twenty files contain both adult and child pornography. Specifically, out of approximately 570 images on those two files approximately 200 are images of child pornography, in no particular grouping or order. Based on forensic evidence, it appears that the PowerPoint files first came into existence around May 2002 when images were taken from an unknown source, using an unidentifiable computer and placed into a PowerPoint presentation using Microsoft PowerPoint 97/98 software, or Version 8, registered to the defendant. Then on September 7, 2002, between 3:39 p.m. and 3:41 p.m., the PowerPoint files were "created" or copied onto the Compaq laptop, containing Version 9 of the Microsoft PowerPoint program, also registered to the defendant. There is no evidence that the two PowerPoint files containing child pornography were ever accessed on the Compaq laptop after they had been transferred to the Compaq laptop on September 7, 2009 and before the Compaq laptop was sold in June 2007.
The government initially identified only approximately 85 of the 570 images on the two Power Point files as containing child pornography.
The total collection of approximately 318 CDs and DVDs in the two binders seized at defendant's home contain 7,143 video files that were copied or "burned" onto those CDs and DVDs between September 8, 1999 and August 1, 2006. The images of child pornography on the 26 CDs and DVDs in the tan-colored binder appear in approximately 50 to 60 video files, or less than 1% of the total video files found at defendant's residence. These videos were downloaded onto some, unidentifiable computer between May 20, 2003 and July 5, 2003, and then copied or "burned" from that computer onto the 26 CDs and DVDs between June 14, 2003 and January 1, 2004. Both the government's and the defendant's forensic examiner agree that there is no forensic evidence linking the child pornography on the 26 CDs and DVDs to any of the computers or external hard drives seized from defendant's residence, or from other computers that defendant used at his offices. There is also no evidence that the CDs and DVDs seized from defendant's home were ever on or accessed through the Compaq laptop sold at the yard sale or that the PowerPoint files on that Compaq laptop was ever on any of the computers or hard drives found at defendant's residence or elsewhere.
In defendant's brief, the defendant stated that approximately 60 video files were found to contain child pornography. At the hearing, the government's expert testified that 54 video files were found to contain child pornography.
Although the defendant has not been charged with any crime pertaining to the images of child pornography in the two PowerPoint files on the Compaq laptop, the government seeks their admission on the grounds that these PowerPoint files are (1) intrinsic to the crime charged, or (2) admissible under Rule 404(b) to show the defendant's intent, knowledge, plan or absence of mistake with respect to the possession of child pornography found on the 26 CDs and DVDs.
a. The evidence is not intrinsic to the crime charged.
"Other acts" are intrinsic to the crime charged when they are "inextricably intertwined or both acts are part of a single criminal episode or the other acts were necessary preliminaries to the crime charged." United States v. Lighty, 616 F.3d 321, 352 (4th Cir. 2010). Evidence is intrinsic if it is necessary to "provide context relevant to the criminal charges." United States v. Cooper, 482 F.3d 658, 663 (4th Cir. 2007), and forms an integral and natural part of the witness's accounts of the circumstances surrounding the offenses for which the defendant was indicted, United States v. Edouard, 485 F.3d 1324, 1344 (11th Cir. 2007). The government argues that the PowerPoint presentations are intrinsic because (1) they give context to how the defendant was discovered by law enforcement; (2) are inextricably linked to the CDs and DVDs because they contain images of the same exact nature created within a year from each other; and (3) demonstrate a pattern of illegal activity and intent to possess child pornography. None of these positions establish that the PowerPoint files are intrinsic to the crime charged.
First, the elements of the crime charged do not require proof that the Compaq laptop contained child pornography; nor is the possession or existence of the child pornography on the Compaq laptop a necessary preliminary or follow-on step in connection with the commission of the crime charged. Second, there is insufficient evidence to establish that the assemblage and possession of both pornography collections — the PowerPoint files on the Compaq laptop and the collection on the 26 CDs and DVDs found in defendant's home — were part and parcel of the same course of conduct or a single criminal episode. Based on the forensic evidence, the creation dates for the two collections took place during different and distinct time periods, with no overlap in dates. The government emphasizes that the "creation dates" of both collections are within a year of each other, but even a much shorter interval would eliminate any inference that one collection was part of the context for the other or that both were being created or assembled as part of one inseparable effort. These findings are further supported by the lack of other similarities between the two collections. For example, there is no evidence that both collections came into defendant's possession from the same source or were viewed via a common computer. The collections are contained on different media, one is in PowerPoint on a hard drive, the other in videos on CDs or DVDs and not found on any hard drive. None of the titles in one collection are the same as those in the other: and while both collections have graphic and horrific images of both adult and child pornography, the specific content is different. There is no witness whose relevant testimony would require mention of the PowerPoint files. At most, the existence of the child pornography found on the Compaq laptop is only part of the circumstances that led to the discovery of the child pornography with which the defendant has been charged. In sum, there is no evidence that the images in the PowerPoint files and the CDs and DVDs are part of the same collection or are inextricably intertwined with or related to each other. The only commonality is that both collections are predominantly adult pornography with child pornography interspersed in a small portion of it and both have a connection to the defendant, albeit in different ways.
The government advised the Court during its hearing that some of the same children appear in both collections. The government also acknowledges, however, that the children depicted have appeared widely in available child pornography and their presence in both collections does not establish a single source for the child pornography in both collections.
In support of its position, the government relies heavily on United States v. Kennedy, United States v. Loayza, and United States v. Chin to support their argument. In each of those cases, the other act was actually connected to and gave context and understanding to the events of the underlying charged crime. For instance, in Kennedy, the intrinsic evidence explained the common source through which the defendant supplied his co-conspirator with cocaine in a larger, charged conspiracy. United States v. Kennedy, 32 F.3d 876, 885-86 (4th Cir. 1994). In Loayza, the intrinsic evidence related to the defendant's participation in a common scheme. United States v. Loayza, 107 F.3d 257, 263-64 (4th Cir. 1997). In Chin, the evidence was intrinsic because it occurred during the charged offense. United States v. Chin, 83 F.3d 83, 87 (4th Cir. 1996). Therefore, for the reasons stated, the PowerPoint presentations are not intrinsic to the crime charged and cannot be admitted on that basis.
b. The PowerPoint Files should not be admitted under Rule 404(b)
The government argues that if the evidence of child pornography on the PowerPoint files is not intrinsic to the crime charged, it is "extrinsic" evidence that is admissible under Rule 404(b) to demonstrate defendant's intent, knowledge, motive and absence of mistake.
Evidence of prior "bad acts" under Rule 404(b) are admissible when the following criteria are met: (1) the evidence must be relevant to an issue, such as an element of an offense, and must not be offered to establish the general character of the defendant; (2) the evidence must be necessary in the sense that it is probative of an essential claim or an element of the offense; (3) the evidence must be reliable proof that the defendant in fact committed the other act: and (4) the evidence's probative value must not be substantially outweighed by its unfair prejudicial effect or by other considerations pertaining to the trial process, such as the confusion of issues, the availability of other non-404(b) evidence, unwarranted distractions or time considerations. See United States v. Johnson, 617 F.3d 286, 296-97 (4th Cir. 2010) (citing United States v. Queen, 132 F.3d 991, 997 (4th Cir. 1997)); United States v. Lightly, 616 F.3d 321, 352 (4th Cir. 2010); United States v. Myers, 589 F.3d 117, 124 n. 8 (4th Cir. 2009). Although a rule of inclusion, Rule 404(b) does not authorize the admission of evidence of other wrongs solely to prove a defendant's bad character, propensity or disposition toward criminal conduct. See Queen, 132 F.3d at 994-95. Moreover, because such evidence, collateral to the crime charged, will invariably be viewed by the fact finder as reflecting such a propensity, disposition or bad character, the probative value must be carefully evaluated relative to other considerations necessary to preserve the integrity of the trial process and its fundamental premise that a defendant will be tried only for the crime charged. See Myers, 589 F.3d at 124 n. 8.
Here, the government argues that the child pornography contained in the PowerPoint files is probative of defendant's knowledge that he possessed the child pornography charged in the indictment, as well as his intent to collect the child pornography and the absence of mistake in his possession of child pornography. The Court must, therefore, consider the extent to which the evidence that the government seeks to admit establishes, in the first instance, defendant's knowledge with respect to the child pornography contained in the PowerPoint files and then consider the extent to which any such demonstrated knowledge is probative of his knowledge, intent, or absence of mistake with respect to the child pornography for which he has been charged.
The defendant disputes that he knew that the PowerPoint files contained child pornography or that he was involved in their creation or copying; and the evidence is far from clear or straightforward on that issue. Based on the forensic and other evidence presented to the Court at the hearing held on November 24, 2010, there is no direct evidence that the defendant ever viewed or accessed the two PowerPoint files that contain child pornography, or had knowledge that the PowerPoint files contained child pornography. For example, there is no evidence that after the PowerPoint files were copied onto the Compaq laptop on September 7, 2002, the two PowerPoint files containing child pornography were ever accessed until June, 2009, after the Compaq laptop was sold at the yard sale. The government did present evidence that in order to create the PowerPoint files in May of 2002, each individual image needed to be selected and placed in the presentation, that knowledge of the contents of the files would be obtained from such a process and that the defendant is linked to that process because the software used to create the presentation was registered to him. On the other hand, at the hearing, the defendant categorically denied having any knowledge of child pornography on the Compaq laptop or ever creating or copying any child pornography. Because the forensic evidence shows only that a computer containing software registered to the defendant was used to create and copy the PowerPoint files, defendant presented evidence that other persons had access to the Compaq laptop during the relevant periods. In that regard, he testified that the Compaq laptop was for the most part used as a group or departmental laptop at his office, that it was typically kept at his office and that a wide range of persons at his place of employment used or had access to the Compaq laptop. He also presented evidence that at the time the PowerPoint files were copied onto the Compaq laptop on September 7, 2002, he was attending religious services with his wife and that on the other dates and times in September 2002 when the forensic evidence showed certain PowerPoint files were accessed from the Compaq laptop, he was in travel to or in attendance at medical conferences.
As to the government's evidence that the process of creating the PowerPoint files demonstrated knowledge of their content, the defendant presented evidence that the PowerPoint files could have been created through the transfer of images in bulk, without the individual selection of those images, which, if true, substantially undercuts the strength of any inference of knowledge from the process of creating the PowerPoint files. There was evidence at the hearing that such software capable of making bulk transfers to the PowerPoint files was present on the Compaq laptop, but there was no evidence that it had been used. In short, there are numerous factual issues that would need to be considered and resolved in a certain way before a fact finder could reasonably conclude, through a series of inferences, that the defendant did, in fact, know that the PowerPoint files on the Compaq laptop contained child pornography.
The reliability of that process as a predicate for the admission of evidence under Rule 404(b) is further clouded by issues that the defendant has raised concerning the evidentiary integrity of the PowerPoint files themselves. When law enforcement authorities first reviewed the PowerPoint files on June 14, 2007 and June 27, 2007, it accessed the two files containing child pornography and in so doing eliminated information reflecting the then existing last access date. Likewise, when it analyzed the PowerPoint files in June 2007. it used certain software that resulted in 92 files being added to the Compaq laptop and the modification of 53 files already on the Compaq laptop. There is no dispute that the contents of the PowerPoint files images were unaffected, but the defendant presented evidence through its expert that there is a possibility that the government may have overwritten data that might have provided information concerning, among other things, the source of the PowerPoint images when they were created in May of 2002 or how they were created. In fact, the defendant argues that it would be unfair at this point, approaching a denial of due process, for the government to use the PowerPoint files as evidence because the defendant's ability to retrieve information embedded into the PowerPoint files has been substantially comprised through the actions of law enforcement in reviewing and analyzing the files and that such information might have allowed him to prove that he was not involved in the creation of these files.
According to defendant's expert, these 92 added files contained 127 megabytes of data and the modified 53 files contained 117 megabytes of data. In that regard, the defendant's forensic expert concluded that "All together, 245 MB of data were newly created or modified on the [Compaq laptop] computer at this time. This represents 8.7% of the user partition size or 5.9% of the entire hard drive." Report of Donald Allison ¶ 15, Exhibit 1 to Opposition to Government's Notice and Memorandum Regarding Rule 404(b) Evidence ("Allison Report"). The items created on the Compaq laptop included "Microsoft Explorer History files, Microsoft Outlook Express account databases, and two Knoppix Linux swap files used for temporary caching of files associated with an operating system that was not native to the [Compaq laptop]." Allison Report ¶ 16.
Defendant's expert claims that the government's examination of the Compaq laptop may have caused data to be overwritten including recoverable deleted files, records of internet history use, file downloads from the internet or other network, link files showing the location of data that was transferred onto the Compaq laptop; and information related to other users such as remote logins to e-mail, file shares, and network shares.
This Court cannot resolve these issues at this point, nor can the Court determine that there is any substance to defendant's claim that exculpatory data or data useful in establishing his innocence have been lost because of the government's actions. The Court must acknowledge, however, that defendant's claims of prejudice are colorable, if not substantial, and they would need to be addressed before the admission of the PowerPoint files, particularly given the lack of any forensic or other direct evidence that the defendant actually viewed the images of child pornography that are contained on the PowerPoint files.
Other issues exist. In order to make the required findings of knowledge with respect to the PowerPoint files, the Court would be required to conduct a "trial within the trial;" and while the concerns of confusion, prejudice, distraction and delay are substantially lessened without a jury, the Court must nevertheless consider whether that exercise is appropriate in this case solely for the purposes of determining whether to admit evidence under Rule 404(b) that is not otherwise relevant. See United States v. Hill, 322 F.3d 301 (4th Cir. 2003) (approving excluding such evidence, even when probative, where admission of the evidence would create such an exhaustive case within a case); see also United States v. Rubio, 87 F.3d 1309 (4th Cir. 1996) (approving exclusion of evidence where admission would result in a mini-trial of the witness' past act and not the charged crime).
Equally critical to the Court's analysis is whether any finding of knowledge of child pornography in the PowerPoint files is probative as to his knowledge, intent or absence of mistake as to the presence of child pornographic images in a separate and distinct collection of predominantly adult pornography. As discussed above, there is no material commonality between the two sets of predominantly adult pornography collections; and any knowledge of child pornography in the PowerPoint files would have little, if any, probative value as to whether the defendant knew that the pornography collection seized at his home contained child pornography. See United States v. Johnson, 617 F.3d 286 (4th Cir. 2010) (prior drug transactions not sufficiently related and similar to charged drug transaction to make it relevant to prove intent or knowledge.)
In summary, it is disputed, and there is no clear evidence, that the defendant ever viewed the PowerPoint files that contained child pornography. The PowerPoint files are, therefore, not sufficiently reliable as evidence of defendant's knowledge that he possessed child pornography for the purposes of their admission under Rule 404(b). Moreover, fact and evidentiary issues pertaining to the proffered evidence would no doubt dominate the trial, which would be substantially affected by that evidence even were it decided that the defendant did not know that the PowerPoint files contained child pornography. In any event, any such knowledge would have little, if any, probative value that the defendant knew that a separate and distinct collection of predominantly adult pornography contained images of child pornography. The Court therefore concludes that any probative value pertaining to the PowerPoint files is substantially outweighed by their unfair prejudicial effect and the otherwise unnecessary time, delay and effort needed to resolve disputed factual issues relating to that evidence. While these dangers associated with this evidence are substantially reduced because the defendant has waived a jury and will be tried by the Court, the considerations pertaining to the admission of evidence under Rule 404(b) are intended to preserve the integrity of the fact finding process itself. The Court would not hesitate to exclude such evidence were this case to be decided by a jury; and given, in the end, the lack of probative value that the PowerPoint files might properly have, the Court sees no reason to permit their admission in a bench trial.
At the hearing held on November 24, 2010, the government argued for the first time that the proffered evidence was also admissible under Fed.R.Evid. 414. The Court has considered that position and concludes that regardless of whether this case is within the scope of Rule 414 (or whether the government complied with the notice requirements of 414(b)), the same considerations that lead this Court to exclude the evidence under Rule 404(b) causes this Court to exclude the evidence under Rule 414. See United States v. Kelly, 510 F.3d 433, 437 (4th Cir. 2007).
II. The United States' Motion in Limine to admit evidence of the "wiped clean" hard drive. (Doc. No. 17)
In April 2008, a federal grand jury issued a subpoena to defendant's employers for defendant's work computers, which included two desktop computers and an HP laptop computer. The two desktop computers were turned over to the FBI in May 2008 and no evidence of child pornography was found on either. There are no issues before the Court with respect to these computers. However, the government seeks to introduce evidence that the hard drive that was on the defendant's HP laptop was "wiped clean" when defendant turned it into his employer on May 12, 2008 at his employer's request for the purpose of turning it over to the FBI in response to the grand jury subpoena.
Defendant acquired the HP laptop, and a docking station, in March 2006 for his work, at the expense of a private research corporation associated with one of his employers. It appears undisputed that in May 2007, Heller was required to turn in the HP laptop to his employer's information technology department in order to have encryption software installed on the computer. It also appears undisputed that after the return of the HP laptop computer, Heller experienced problems with its operations and returned it to his employer, who after re-installing the operating system returned it to Heller several weeks later. Heller claims that after receiving the HP laptop back from the IT department, it never again operated, although there is no evidence that he ever again returned the computer to his employer or complained about it. This laptop was not at defendant's home when searched on July 12, 2007, although a docking station for this laptop was observed at his home residence, in some proximity to the black and tan-colored binders.
Heller turned the HP laptop into his employer on May 12, 2008, after what the government claims was a delay on his part. On May 19, 2008, Hellers employer turned over the HP computer to the FBI without an examination. The HP laptop was apparently not examined by the FBI until after it obtained a search warrant for that purpose in October 2008; and when the FBI actually examined the HP laptop it was discovered that the HP laptop did not contain a hard drive. On December 18, 2008, a federal agent confronted Heller about the missing disk. Heller professed not to know anything about it and immediately contacted his then counsel, who later confirmed that it was in his possession. The disk was expeditiously delivered to the FBI, who upon examination determined that it contained no data and had been forensically "wiped clean." The parties have stipulated that at the time the hard drive was delivered to the FBI, it was in the same condition as when Heller delivered the HP laptop to his lawyer for examination by a forensic expert.
Based on these facts, the government seeks to introduce the "wiped clean" hard drive from the HP laptop as evidence of defendant's "consciousness of guilt." Spoliation of evidence is admissible to show the defendant's consciousness of guilt. See United States v. Van Metre, 150 F.3d 339, 353 (4th Cir. 1998). To be admissible, however, such evidence must be linked to the defendant's consciousness of guilt for the crime charged, and each link of the chain must be "sturdily supported." United States v. Hawkes, 753 F.2d 355, 359 (4th Cir. 1985). Although there are many factual issues surrounding the HP laptop's hard drive, the parties appear to agree that by the time authorities received the hard drive in May 2008, it contained no data. Based on that principle fact, the government contends that the evidence establishes consciousness of guilt for the crime charged based on the following logic: (1) the docking station for the HP laptop was observed on July 12, 2007, during the search of defendant's home, within close proximity of the CDs and DVDs, among which child pornography was subsequently found, suggesting that the HP laptop was used to view the charged child pornography; (2) defendant knew that he was under investigation for possession of child pornography, (3) defendant delayed turning in the HP laptop after he learned that it had been subpoenaed from his employer; (4) he turned in the HP laptop without the hard drive, (3) when questioned about the missing disk in December 2008, the defendant reacted physically in a way that evidences guilt.
The first issue is whether the defendant committed the act that the government argues evidences consciousness of guilt — that defendant wiped clean the hard drive. That conduct on the part of the defendant is disputed and the facts relied on do not clearly establish that the defendant did what the government claims.
The second issue is whether there is a sufficiently compelling connection between the HP laptop and the charged offense, such that had defendant wiped clean the hard drive, it would sufficiently reflect consciousness of guilt for the specific crime charged. Here, the CDs and DVDs at issue were produced between 2003 and 2004. However, the defendant did not acquire the laptop until 2006, and it could not have been used to make the charged images on those CDs and DVDs. It could have been used to view those images, of course; and there was a docking station at Heller's house. The HP laptop, however, was not at the house when searched, although the charged pornography was present. In addition, the laptop was one of three computers used for business; and there is no evidence of any connection between the CDs and DVDs and either of the other two computers or any other computer traceable to the defendant. Moreover, the government itself seems to have viewed the HP laptop as having an attenuated relationship to the crime charged as evidenced by the extensive delays in its obtaining and then examining the HP laptop. Many of these facts may cut both ways, but in any event, it is impossible to conclude without speculating that the defendant used the HP laptop to view the charged child pornography. Based on all the facts and circumstances presented to the Court, there is simply no "sturdily supported" connection between the blank hard drive and the defendant's consciousness of guilt concerning the crime charged. For the above stated reasons, the Government's Motion in Limine as to the HP Pavilion Laptop and its hard drive is DENIED.
CONCLUSION
For the above reasons, the Court will deny the United States' motion to admit certain evidence under Fed.R.Evid. 404(b) (Doc. No. 16) and its motion in limine to have admitted evidence concerning the hard drive of the HP laptop computer (Doc. No. 17).An appropriate Order will issue.
Alexandria, Virginia
November 30, 2010