## UNITED STATES ARMY COUR T OF CRIMINAL APPEALS

Before MULLIGAN, CELTNIEKS, and BURTON Appellate Military Judges

UNITED STATES, Appellee

v. Staff Sergeant SCOTT T. SCHEMPP United States Army, Appellant

ARMY 20140313

United States Army Combin ed Arms Support Command James W. Herring, Jr ., Military Judge Colonel Ralph J. Tremaglio III, Staff Judge Advocate

For Appellant: Colone l Kevin Boyle, JA; Major Aar on R. Inkenbrandt, JA; Captain Amanda R. McNeil, JA (on brief).

For Appellee: Major A. G. Courie III, JA; Major Steven J. Collin s, JA; Captain Scott L. Goble, JA (on brief).

26 February 2016

---------------------------------- MEMORANDUM OPINION

----------------------------------

This opinion is issued as an unpublished opin ion and, as such, does not serve as precedent.

BURTON, Judge:

A military judge sitting as a general court-martial convicted appellant, contrary to his plea s, of two specifications of po ssession of chil d pornography in violation of Article 134, Un iform Code of Military Jus tice, 10 USC § 934 (2012) [hereinafter UCMJ]. The military judge sentenced ap pellant to a dishonorable discharge, fifteen months of confinement and re duction to the gr ade of E-1. The convening authority approved the sentence as adjudged, to in clude 100 days of confinement credit ordered by the military judge. The au tomatic forfeiture of all pay and allowances was defe rred and terminated on the appellant’s expiration of

term of service.SCHEMPP—ARMY 20140313

2 Appellant’s case is befo re this court for review under Article 66, UCMJ. Appellant’s counsel raises th ree assignments of error, two of which merit discussion

and relief. 1

FACTS

In April of 2012, while conducting an undercover operation to identify computers trading chil d pornography via the internet, a Special Agent (SA) with the Naval Crime Investigative Serv ices (NCIS) flagged appellant’s Internet Protocol (IP)

address as a “download cand idate” of child pornography. Furt her investigation revealed that appellant’s IP address, a unique number assign ed by appellant’s internet service provider, actively shared images of potential ch ild pornography with other internet users through a peer-to-peer program calle d “FrostWire.” The NCIS agent downloaded three digital images from appellant’s shared Fr ostWire folder and confirmed they were child pornography by comparing the images to the National Center for Missing and Exploited Childr en’s (NCMEC) databa se of known child

victims.

NCIS, upon identifying appe llant as an active duty Army soldier, transferred the case to the Army Criminal Investigation Command (CID).

Pursuant to a mili tary magistrate’s search au thorization, CID collected from appellant’s residence a Dell Alienware tower computer (De ll) and an Iomega external hard drive (Iomega). CID then obtained a second search authorization to conduct a digital forensic examination of these seized items. CID’s examination found child pornogra phy on both devices. All of the digital images on the Iomega

were recovered from unallocated space on the drive. Eigh t of the digital images on the Dell computer were reco vered from unallocated space. The remaining 72 images

and 4 videos on the Dell were in the active files.

LAW AND DISCUSSION

Article 66(c), UCMJ, establishes our statut ory duty to review a record of trial for legal and factual su fficiency de novo. United States v. Walters , 58 M.J. 391, 395 (C.A.A.F. 2003). Unde r Article 66(c), UCMJ, we may affirm only those findings of guilty that we find corr ect in law and fact and determine, based on the entire record,

should be affirmed. Id . The test for legal sufficiency of the evidence is whether, viewing the evidence in a light most favora ble to the government, a fact-finder could rationally have found all of the essential el ements of an offense beyond a reasonable

doubt. Jackson v. Virginia , 443 U.S. 307, 318-19 (1979); United States v. Blocker

, 32 M.J. 281, 284-85 (C.M.A. 19 91). In resolving questions of legal sufficiency, this

1 We have also reviewed th ose matters personall y raised by appell ant pursuant to United States v. Grostefon , 12 M.J. 431 (C.M.A. 1982), an d they are without merit.SCHEMPP—ARMY 20140313

3 court is “bound to draw ever y reasonable infere nce from the evidence of record in favor of the pr osecution.” United States v. Craion , 64 M.J. 531, 534 (citations omitted). In weighing fact ual sufficiency, we take “a fr esh, impartial look at the evidence,” applying “neither a presumption of innocen ce nor a presumption of guilt.” United States v. Washington , 57 M.J. 394, 399 (C.A .A.F. 2002). "[A]fter weighing the evidence in the record of tr ial and making allowa nces for not having personally observed th e witnesses, [we must be] conv inced of the [a ppellant's] guilt beyond a reason able doubt.” United States v. Turner , 25 M.J. 3 24, 325 (C.M.A. 1987).

1. Images Located in Unallocated Space

Appellant alleges the evid ence underlying Specificati on 1 of The Charge and some of the evidence underlying Specif ication 2 of The Charge is legally insufficient to support a conv iction because the images at issue were found in the unallocated space of the Dell co mputer and Iomega drive.

In Specification 1 of The Charge, the court found ap pellant guilty of, on or about 20 June 2012, knowingl y possessing 83 images of child pornography on the Iomega drive. 2 In Specification 2 of The Charge, the court fo und appellant guilty of,

on or about 20 June 2012, knowingly posses sing 40 images and 2 videos containing child pornography. 3

Because of its charging de cision, the Government wa s required to prove for both specifications that the appellant knowingly possessed the ch arged images and

video files “on or a bout 20 June 2012.” Ac cordingly, the critical issue we must now

decide is not whether the appellant knowingly possessed these images and video files at any time, but whet her he possessed them on or about 20 June 2012.

We conclude appellant di d not possess the 83 images underlying Specification 1 of The Charge, nor did he possess eight of the images in Specification 2 of The

2 After arraignment but before entry of pleas, Specificat ion 1 of The Charge was amended by striking the figure “90” and substituting therefor the figure “85”. Of Specification 1 of The Charge , appellant was found Guilty, except the figure “85”, and substituting therefor the fi gure “83”. Of the excepted figure: Not Guilty. Of the substituted figu re: Guilty.

3 After arraignment but before entry of please, Specific ation 2 of the Charge was amended by striking the figures “80” and “4” and substituting therefor the figures “41” and “3.” Of Specific ation 2 of The Char ge, appellant was fo und Guilty, except the figures “41” and “3,” su bstituting therefor the figur es “40” and “2.” Of the excepted figures: Not Guilty. Of the substituted figure: Guilty.SCHEMPP—ARMY 20140313

4 Charge, which were found in unallocat ed space. 4 To support our conclusion, we first consider the technical aspects associated wi th unallocated space prior to considering whether a computer user can “possess” a digital file, either actually or constructively, if that file exists only in th e unallocated space of a computer.

According to the Government’s expert w itness, Special Agen t (SA) JB, all of the digital files char ged in Specification 1 of The Charge, and some of the digital files charged in Spec ification 2 of the Charge, were deleted in December 2009, so appellant had no access to them absent the us e of forensic software. SA JB retrieved these images using EnCase, a forensic software program that allows deleted images in unallocated space to be seen. SA JB testified that a user does not have the ability to access a digital fi le once it is moved into the unallocated space. He further testified that, while freeware was available to undelete files in unallocated space, he

found no evidence that appellant had acquired or used such a pr ogram. SA JB’s testimony is consistent with the definition of “unallocated spac e” used in federal

courts. See United States v. Hill , 750 F.3d 982, 988 n .6 (8th Ci r. 2014) (“Unallocated space is sp ace on a hard drive that contains deleted data, usually emptied from the operating system ’s trash or recycle bin folder , that cannot be seen or accessed by the user with out the use of forens ic software. Such space is available

to be written over to store new information.”) (quoting United States v. Flyer , 633 F.3d 911, 918 (9th Cir. 2011)); United States v. Seiver , 692 F.3d 774, 7 76 (7th Cir. 2012) (explaining th at when one deletes a file, that file goes into a “trash” folder; when one empties the “trash folder” the file has not left th e computer because although the “trash fold er is a wastepaper basket[,] it has no drainage pipe to the outside”; the file may be “r ecoverable by computer expe rts” unless it has been overwritten) (cita tions omitted), cert. denied sub nom Se iver v. United States , 133 S. Ct. 915 (2013). 5

“Possession,” for purposes of determ ining if appellant knowingly possessed child pornography, has the same definition as that used in Article 112a, UCMJ. See

United States v. Navrestad , 66 M.J. 262, 267 (C.A .A.F. 2008). “Pos sess,” as used in that article, “means to exer cise control of something. Possession may be direct

4 The following images charged in Specif ication 2 of The Char ge were found in unallocated space: 0000.j pg; 0021.jpg; 0022.jpg; 0024. jpg; 0026.jpg; 0027.jpg; 0030.jpg; and 0033.jpg.

5 Digital files found in unallocated space or slac k space have also been referred to as “orphan files” because “it is di fficult or impossible to trace their origin or date of

download.” United States v. Moreland , 665 F.3d 137,142 n.2 (5th Cir. 2011) (citing

United States v. Kain , 589 F.3d 945, 948 (8th Cir. 2009) (stating that “[o]rphan files are files that were on the computer somewhere saved but were subsequently deleted, so the computer doesn’t know exactly where they came from”)).SCHEMPP—ARMY 20140313

5 physical custody...or it may be constructive. ... Possessi on must be knowing and

conscious.” Manual for Courts-M artial, United States, pt. IV, ¶ 37.c.(2). In

Navrestad , the Court of Appeals fo r the Armed Forces, usin g this definition of “possession,” set aside a conv iction for possession of child pornography as legally

insufficient where the evidence failed to show the defendan t had actual or constructive possession of child pornography

. Navrestad , 66 M.J. at 268.

Here, as the appellant was unable to a ccess any of the imag es in unallocated space, he lacked the ability to exercise “dominion or co ntrol” over these files.

Navrestad , 66 M.J. at 267; see Flyer , 633 F.3d at 919 (citing Navrestad and holding that evidence was legally insufficient to pr ove knowing possession on or about the date charged in the indictment); see also United States v. Kuchinski , 469 F.3d 853, 863 (9th Cir. 2006) (holding that in a situ ation in which “a defendant lacks knowledge about th e cache files, a nd concomitantly lacks acce ss to and co ntrol over those files, it is not proper to charge hi m with possession and control of the child pornography images located in those files, without some other indication of

dominion and control ove r those images. To do so turns abys mal ignorance into knowledge and a less than valetudinarian grasp in to dominion an d control”);

Moreland , 665 F.3d at 154 (holding that the evidence was legally insufficient to sustain conviction for posses sion of child pornog raphy in which Government failed to prove dominion and cont rol over the digital images and citing cases for the proposition that evidence is legally insu fficient to show cons tructive possession based solely on the fact that the accused possessed the co mputer “without additional evidence of the [accused’s] knowledge an d dominion or control over the images”).

As “possession” for purp oses of child pornography requires the possession be both “knowing and conscious,” Navrestad , 66 M.J. at 267, we hold that the appellant did not “knowingly possess ” any of the 83 di gital images in Specification 1 of the Charge nor did he “knowingly possess” ei ght of the digital images in Specification 2 of The Charge that were all found in unallocated space

on or about 20 June 2 012, the date charged. 6

6 Factually, this case is similar to Flyer in that all images of child pornography charged in Flyer’s indictment had be en retrieved from unallocated space. The Flyer court agreed with the general proposition that one way to exercise dominion and control over a digital file would be to delete that file; however, th at alone was insu fficient to prove knowing possession on the date indicated on the indict ment. 633 F.3d at 919. Because the Government was unable to prove th at on the date allege d in the indictment Flyer was able to access or retrieve a ny of the child pornogra phy digital images, the evidence was legally insufficient. See also United States v. Nichlos 2014, NMCCA 201300321, CCA LEXIS 691 (NMCCA 18 Sep. 2014).SCHEMPP—ARMY 20140313

6 We also conclude that the evidence was legally insufficient to prove appellant actually or constructively possessed the images on th e date charge d. For the evidence to be legally sufficient on a cons tructive possession th eory, a person must
exercise “dominion or co ntrol” over the child po rnography digital files. 7 Id . Based on the technical aspect s associated with un allocated space, SA JB’s testimony, and a lack of any evidence presented that the appellant was a sophisticated computer user in possession of the fo rensic tools or freeware necessar y to retrieve digital files from unallocated space, we conclu de that the evidence is le gally insuffici ent to prove possession on or about the char ged date of 20 June 2012. That is, all of the evidence underlying Specification 1 of The Charge and eight of the imag es underlying Specification 2 of The Charge are legally insufficient to support a findi ng of guilty

and therefor warrants relief . We are, however, convin ced beyond a reasonable doubt that appellant knowingly poss essed the remaining 32 imag es and two videos alleged in Specification 2 of The Charge.

2. Factual Sufficiency of Images Alleged to be Child Pornography

Appellant alleges that the majority of the digital files charged were clearly not child pornography. After reviewing the remaining evidence underlying Specification 2 of The Charge, we find four of the im ages insufficient to support a finding of guilty beyond a reasonable doubt. 8 We will take appropriate action in our decretal paragraph. We are, howe ver, convinced beyond a re asonable doubt that the remaining images and the video files are le gally and factually sufficient to support the finding of guilty as to this specification and The Charge.

CONCLUSION

The finding of guilty of Specification 1 of The Charge is set aside and that Specification is DISMISSED. The court AFFIRMS only so much of the findings of guilty of Specification 2 of The Charge as finds that:

[Appellant] did, at or n ear Joint Base Langley- Eustis, on or about 20 June 2012, knowingly and wrongfully possess child po rnography, to wit: 28 digital images and 2 videos of minors, or what appears to be minors, engaging in se xually explicit conduc t, on a Dell Alienware Computer, such conduct being of a nature to bring discredit to the

armed forces.

7 But cf. United States v. Carpegna , 2013 U.S. Dist. LEXIS 115002 at *14 (D. Mont. Aug. 14, 2013) (disti nguishing Carpegna’s acts of deleting contraband from the facts

in Navrestad and Flyer based on the fact that Carpegna “knew enough about the presence of the images on the laptop to ‘hit delete’ after he was finished viewing them”).

8 Images labeled 0 042.jpg, 0051.jpg, 0 055.jpg and 0056.jpg.SCHEMPP—ARMY 20140313

7 We are able to reassess th e sentence on the basis of the error noted and do so after conducting a thorough analysis of the totality of circ umstances presented by appellant’s case and in accordance with th e principles articulat ed by our superior

court in United States v. Winckelmann , 73 M.J. 11, 15-16 (C .A.A.F. 2013). In evaluating the Winckelmann factors, we first find no dr amatic change in the penalty landscape that might cause us pause in reassessi ng appellant’s sentence. Additionally, appellant was tried and sentenced at a general court-martial by a military judge and the nature of the remain ing offense still captures the gravamen of the original offenses and the circumstan ces surrounding appellant’s conduct. Finally, based on our ex perience, we are familiar with the remaining offense so that we may reliably determine what sentence w ould have been imposed at trial. We are

confident that based on the entire record and appellant’s course of conduct, the military judge would have im posed a sentence of at leas t that which was adjudged.

Reassessing the sentence based on th e noted errors and entire record, we AFFIRM the sentence as adjudged. We fi nd this reassessed se ntence is not only purged of any error but is also appropriate. All rights, privileges, and property, of which appellant has been deprived by virtue of that portion of th e findings set aside by our decision, are ordered restored.

Senior Judge MULLIGAN and Judge CELTNIEKS concur.

FOR THE COURT:

MALCOLM H. SQUIRES, JR.

Clerk of Court MALCOLM H. SQUIRES, JR.

Clerk of Court FOR THE COURT: