This opinion is subject to revision before publication



## U NITED 

## S TATES 

## C OURT OF 

## A PPEALS

FOR THE 

### A RMED 

### F ORCES

_______________
UNITED STATES Appellee

v.

Jeremiah L. KING , Airman First Class United States Air Force , Appellant

No. 18

- 0288
Crim. App. No. 39055

Argued November 6, 2018

— Decided January 4 , 2019

Military Jud ge: L. Martin Powell

For Appellant: Captain Dustin J. Weisman (argued)

. For Appellee: Captain Zachary T. West (argued); Colonel
Julie L. Pitvorec

, Lieutenant Colonel Joseph Kubler , and Mary Ellen Payne , Esq. (on brief)

. Chief Judge STUCKY delivered the opinion of the Court, in which Judges RYAN, OHLSON, SPARKS, and
MAGGS

, joined.

_______________

Chief Judge STUCKY delivered the opinion of the Court.

In addition to other offenses, Appellant was found guilty of knowingly and wrongfully viewing three specific images of child pornography that were found in his computer’s unall ocated space and browser cache. We granted review to dete rmine whether the evidence supporting his conviction for viewing child por nography was legally sufficient. 1 Given the very low threshold required to sustain a conviction for legal sufficiency , we answer tha t question in the affirmative.

I. Procedural History

A military judge sitting alone as a general court

- martial convicted Appellant, contrary to his pleas, of one specific a-

1 In his brief, Appellant argues that the evidence supporting his conviction for attempting to view child pornography suffers the same infirmity. However, this Court only granted review in the context of Appellant’s guilty findings for actually viewing child pornography. As such, Appellant’s challenges to his attempted viewing conviction are outside the scope of the granted issue.United States v. King , No. 18

- 0288/AF Opinion of the Court

2 tion of attempting to view child pornography, one specific ation of violating a lawful general regulation, and one specification of viewing child pornography, in violation of Articles 80, 92, and 134, Uniform Code of Military Justice (UCMJ), 10 U.S.C. §§ 880, 892, 934 (2012). For his offenses , the mil itary judge sentenced Appellant to a dis honorable discharge, confinement for nine months, and reduction to the lowest enlisted grade. The convening authority approved the se ntence, and the United States Air Force Court of Criminal Appeals ( CCA ) affirmed. United States v. King , No. ACM 39055, 201 7 CCA LEXIS 501, at *1, 2017 WL 3297198, at *1 (A.F. Ct . Crim. App. Jul y 26, 2017) (unpublished).

II. Background

Photobucket, a n image

- hosting website, flagged eight images of suspected child pornography that a n individual
with a user name that included “j eremiahking” and an email
address that included “ jeremiah.king ” had uploaded to his

account us ing an Air Force Internet Protocol ( IP ) address. Photobucket sent those images to the National Center for Missing and Exploited Children (NCMEC). Through the IP

a ddress, NCMEC traced the source to a government co mputer at Eielson Air Force Base, where Air Force Office of Special Investigations ( AF OSI) agents linked the “ jerem iah.king ” email address to Appellant’s official Air Force email
address

. Soon thereafter, Special Agent (SA) Benito Rodriguez i nterviewed Appellant. Appellant told him he would go onto Photobucket while at work, search for images he liked using terms such as “dany camy” and “preteen girls,” save those images to his Photobucket user profile, and then go home and download them. Although he initially denied any wrongdoing, Appellant eventually admitted he looked at i mages of underage girls in nude poses. When pressed, he e stimated that the girls he viewed were between twelve to
thirteen y ears old. He claimed that he “was a little bit thrilled” by the images, and eventually admitted that he had
masturbated to photos he found of young girls

. Following the interview, AF OSI agents obtained a search
warrant, seized several media devices from Appellant’s
workstation and residence

, and forwarded them to the D e-United States v. King , No. 18

- 0288/AF Opinion of the Court

3 fense Computer Forensics Laboratory ( DCFL). DCFL co nducted a forensic data extraction and created a mirror

- image hard drive of the source media which they sent back to
AF OSI for review. The drive conta ined thousands of offe nsive photos. SA Rodriguez reviewed that digital copy, and, after consulting with prosecutors, helped select images for charging . DCFL then conducted a “deep dive” forensic ana lysis on those photos.

Based on the evidence derived from this investigation, Appellant was charged with attempting to view child po rnography, violating a lawful general regulation, possessing child pornography, viewing child pornography, and co mmu nicating indecent language. After a trial on the merits, Appellan t was convicted, in relevant part, of knowingly and wrongfully viewing three specific images: 011366 27, 01136666, and 01173367.

All three images were found on Appellant’s home desktop
computer. Images 01136627 and 01136666 were found in a Google Chrome cache

, while Image 01173367 was found in unallocated space. None of the im ages was found in logi cal

space on Appellant’s computer.

The Government brought in a computer forensic expert from DCFL, Bryce Blair, to explain the significance of the
files’ locat ions. Mr. Blair conducted the examination in A ppellant’s case and prepared a report on his findings. He te stified that a computer has both physical and logical space. Physical space is “all the space that’s available on the hard drive itself” while “logica l space is space that’s available to be written to; it’s the space that you have access to.” When something exists in logical space , that could either mean someone intentionally saved something, or that someone viewed something on the internet but did not intentionally
save it.

In contrast, a user would not have access to unallocated space, which is “space that’s not currently being used.” Mr. Blair testified that if a file were present in unallocated space, its presence there would indicate that that particular file had once existed on the computer in logical space but had been deleted at some point. He testified that unallocated

spa ce may “contain files that previously existed, deletedUnited States v. King , No. 18

- 0288/AF Opinion of the Court

4 files, things like that.” For images found in unallocated space, he could not determine where they came from or when the images were created , but noted that it was poss ible they came from Photobucket

. He specifically noted that Image 01173367, which was found in unallocated space, e xisted in logical space at one time but was later deleted. He further testified that two duplicates of Image 01173367 were also found in unallocated space, meaning that the i mage had existed in logical space more than once

. Mr. Blair also explained how an internet cache works. He
noted that “ [ i ] nternet cache is used by the web browsers to ultimately reduce the time that it would take a user to get to a specific webpage again. ” As an automatic function that stores files locally to provide a faster loading time, it is co mpletely outside a user’s control. It is possible for a user to run a search query that returns unintended results, and for such unintended images to be cached t o the computer wit hout the user’s knowledge. A cache may save pictures or whole webpages, and the length of time the captured data is retained is dependent on the web browser used.

Google Chrome has a built

- in cache, which “has the abi lity to cache or sav e portions of the webpage, images from the webpage, or potentially the whole webpage to your system within the cache.” Google Chrome’s cache could “potentially capture images that are not on the user screen at that sp ecific time.”

DCFL’s “deep dive” labor atory report noted that 01136627 and 01136666 were found in a Google Chrome
cache within the user account “jeremiah.” The report noted that “[t]he exis tence of these files within [certain] files su ggest that at one time the files were viewed” and that they were then “automatically cached into their respective
Chrome default cache folders.” Mr. Blair agreed that Appe llant may have seen the images

, and testified that someone on Appellant’s computer had navigated to a website contai ning these images.

Mr. Blai r testified that there was no way to know if A ppellant actually accessed the cached images. All he could tell was that Appellant “accessed a website at one time that r esulted in th[ese] image[s] automatically being cached to hisUnited States v. King , No. 18

- 0288/AF Opinion of the Court

5 system. There is no artifac t [] that would show whether the user later accessed th[ose] file[s] ....” When asked if he saw “any indication” that Appellant knew the images were being saved to his computer or that Appellant later accessed the saved images, he responded in the negative. M r. Blair fu rther noted that there was no way of knowing from any forensic determination whether a user actually saw any of the charged images. He confirmed that while Appellant went to a website with the charged photos on it, he may not have seen the speci fic images as they could have been caching
offscreen. Mr. Blair could, however, confirm that Appellant
searched for several terms indica tive of child pornography, including “skimpy preteen,” “sexy little girls,” and “Loli porn.”

III. Law and Discussion

W e review questions of legal sufficiency de novo. United
States v. Kearns , 73 M.J. 177, 180 (C.A.A.F. 2014). “ ‘ The test for legal sufficiency is whether, after viewing the ev idence in the light most favorable to the prosecution, any r ational trier of fact could have found the essential elements of
the c rime beyond a reasonable doubt. ’ ” ‘ United States v.
Gutierrez

, 73 M.J. 172, 175 (C.A.A.F. 2014) (quoting United
States v. Bennitt , 72 M.J. 266, 268 (C.A.A.F. 2013) )

. “This legal sufficiency assessment ‘draw[ s] every reasonable infe rence from the evidence of record in favor of the prosec ution.’ ” United States v. Robinson , 77 M.J. 294, 298 (C.A.A.F. 2018) (alteration in original) (quoting United States v. Plant

, 74 M.J. 297, 301 (C.A.A.F. 2015 ) ). As such, “[t] he standard for legal sufficiency involves a very low threshold to sustain
a conviction.” United States v. Navrestad , 66 M.J. 262, 269 (C.A.A.F. 2008) (Effron, C.J., joined by Stucky, J., dissen ting). “The criterion thus impinges upon ‘jury’ discretion onl y to the extent necessary to guarantee the fundamental pr otection of due process of law.” Jackson v. Virginia , 443 U.S. 307, 319 (1979).

In order to convict an accused for viewing child porno graphy under Article 134, UCMJ, the prosecution must prove : (1) that the accused knowingly and wrongfully viewed child pornography; and (2) that under the circumstances, the co nduct of the accused was to the prejudice of good order and discipline in the armed forces or was of a nature to bringUnited States v. King , No. 18

- 0288/AF Opinion of the Court

6 discredit upon the armed forces. Manual for Courts

- Martial,
United States pt. IV, ¶ 68b.b.(1) (2012 ed.) ( MCM).

In determining whether any rational trier of fact could have determined that the evidence at trial established guilt beyond a reasonable doubt, we are mindful that the term “reasonable doubt” does not mean that the evidence must be free from any conflict or that the trier of fact may not draw reasonable inferences from the evidence presented. See
United States v. Oliver , 70 M.J. 64, 68 (C.A.A.F. 2011) (re cognizing that the standard for legal sufficiency “ ‘ gives full play to the responsibility of the trier of fact fairly to resolve conflicts in the testimony, to weigh the evidence, and to
draw reasonable inferences from basic facts to ultimate
facts ’ ” (quo ting Jackson , 443 U.S. at 319 ) )

. Moreover, this Court has long recognized that the g overnment is free to meet its burden of proof with circumstantial evidence. See
Kearns , 73 M.J. at 182 (noting that the g overnment may prove intent via cir cumstantial evide nce); United States v. Young

, 64 M.J. 404, 407 (C.A.A.F. 2007) ( relying on “ev idence in the record indicating, or giving rise to an inference of, ” drug possession and distribution to uphold a conviction )

. We recognize that the ability to rely on circumstan tial evidence is especially important in cases, such as here, where the offense is normally committed in private. As the Government conceded at oral argument, direct evidence of the offense of viewing child pornography will be rare because
the offense is u sually committed in private. As a result, the government often will have to rely on circumstantial ev idence in attempting to prove the offense.

Here, the Government presented a circumstantially strong case that Appellant had sought and viewed child po rnog raphy. Appellant password

- protected his electronic d evices

, including his computers, and a search of his home desktop computer revealed thousands of offensive photos

. Appellant searched for images in Google and Bing using terms that are indicative of child pornography, and Appe llant freely admitted he viewed “thrilling” images of nude
children.

Furthermore, while the forensics failed to conclusively determine that Appellant actu ally saw the three chargedUnited States v. King , No. 18

- 0288/AF Opinion of the Court

7 images, they still gave rise to an inference that Appellant viewed the photos. For example, not only did Mr. Blair test ify that someone on Appellant’s computer visited a website containing the cached images, but the cached images were found on Appellant’s password

- protected home computer within the user account “jeremiah

. ” Furthermore, the DCFL laboratory report explicitly noted that “[t]he existence of [Images 01136627 and 01136666] within the

... files suggest that at one time the files were viewed .” ( E mphasis added

. ) Similarly, Mr. Blair testified that although Image 01173367 was found in unallocated space on Appellant’s computer , it
existed in logical space at one time and could have origina ted from Photobucket. Finally, t he two duplicates of Image 01173367, while also found in unallocated space, permit the inference that Appellant visited a website containing child pornography on multiple occasions with an awareness of its contents from prior visits.

Relying on this evidence, an d drawing all inferences in favor of the prosecution, a reasonable factfinder could have reached the conclusion that Appellant knowingly viewed the three charged files. 2

In reaching this conclusion, we necessarily reject Appe llant’s attempts to cast the l ack of conclusive forensic ev idence as a fatal flaw. As support for his position, Appellant points to the MCM ’s explanation of “wrongfulness,” which counsels us to consider whether the images were uninte ntionally or inadvertently acquired, an analysis whic h takes into consideration “the method by which the visual depiction was acquired [and] the length of time the visual depiction
was maintained.” MCM pt. IV, ¶ 68b.c.(9).

While we concede that evidence found in an area of the computer with more indicia of u ser control (e.g.

, a user

created folder ) would carry more weight than evidence found

2 This Court recognizes that the quantity and character of the information that is ascertainable from files located in unallocated space is different from the information that is ascertainable from cache files. These distinctions may prove important in future ca ses. However, we are satisfied that in this case the record is legally sufficient to support Appellant’s conv iction related to Image
01173367.United States v. King , No. 18

- 0288/AF Opinion of the Court

8 in a cache or in unallocated space, we, like the United States Court of Appeals for the Eleventh Circuit, believe that “[e]vidence that a person has sought out

— searched f or

— child pornography on the internet and has a computer co ntaining child pornography images

— whether in the hard drive, cache, or unallocated space

— can count as circumsta ntial evidence that a person has ‘knowingly receive[d]’ [or, in this case, viewed] chil d pornography.” United States v.
Pruitt , 638 F.3d 763, 766 (11 th Cir. 2011) ( second alteration in original). 3 What weight the factfinder ascribes to that e vidence is for the factfinder alone to determine. See Oliver , 70 M.J. at 68 (recognizing that the trier of fact bears the r esponsibility to weigh the evidence).

We similarly decline Appellant’s invitation to apply our logic from Navrestad , 66 M.J. 262 , a case concerning the di stribution and possession of child pornography, to the offense of viewing ch ild pornography. In Navrestad , this Court held that using a public computer to view images of child porno graphy in a Yahoo! Briefcase was legally insufficient to co nstitute possession of child pornography, as there was no i ndication the accused exercised t he required dominion or control over the contraband images. Id. at 267 . In reaching this conclusion, this Court noted that the appellant “could not access the computer’s hard drive where the Briefcase images were automatically saved” and that there was no e vidence the appellant even knew the images were being saved in the first place. Id . at 267

– 68.

The situation here is different. Possession differs in m aterial ways from mere viewing, and here, unlike in
Navrestad , the Government was not required to prove d ominion or control. As such, the presence of the charged i mages in inaccessible space takes on less significance. While an accused’s inability to access data may prove a fatal flaw in a possession case, it does not similarly cripple a viewing

3 We note that the Government conceded at oral argument that the mere presence of child pornography on an accused’s co mputer

— without additional circumstantial evidence of the kind present in this case

— would generally pres ent “a far harder case” due to the “lack of surrounding circumstances indicating an intent to pursue [such] material.”United States v. King , No. 18

- 0288/AF Opinion of the Court

9 charge, whi ch only requires that, at some point, the accused knowingly and wrongfully viewed the image. As such, Appe llant’s appeal to Navrestad and other possession cases is u navailing.

In sum, we trust that a reasonable person could have “resolve[d] conflicts in t he testimony, ... weigh[ed] the ev idence, ... [drew] reasonable inferences,” and ultimately d etermined that the evidence established Appellant’s guilt b eyond a reasonable doubt. Oliver , 70 M.J. at 68. As such, under the facts of this case, we ho ld that the evi dence wa s legally sufficient.

IV. Judgment

The judgment of the United States Air Force Court of Criminal Appeals is affirmed.