Opinion ID: 2818183
Heading Depth: 2
Heading Rank: 2

Heading: Figueroa's Defense4

Text: Bonilla, a software engineer for Hewlett Packard, was the first to testify for Figueroa. He sought to establish that various anti-virus programs found on Figueroa's computer could have been responsible for opening the child pornography files, rather than Figueroa himself. Specifically, Bonilla testified that the anti[- ]virus software Avira accesses every file on the computer to determine whether it is infected with a virus. He stated that [t]here's no way to know if the 'last access date' was changed by an anti-virus or by a user or by any other Windows application . . . that opened it. He similarly testified that 4 Figueroa testified and he called three witnesses: Anner Bonilla Rivera, a computer networking expert, and two character witnesses, Wanda Morrero and William Omar Rodriguez Ramos. We describe Figueroa's defense generally here. Some of the particulars of Figueroa's defense are discussed in more depth in relation to Figueroa's specific challenges to the sufficiency of the evidence. -8- [t]here's no way to know if PC Health virus, also found on Figueroa's computer, modified any of the files containing child pornography. Bonilla testified that a user does not have to open files on LimeWire to be able to download them.
Figueroa testified that he downloaded child pornography from LimeWire inadvertently, stating that, when I would observe it and would see child pornography, I would erase it. Figueroa estimated that he might have downloaded and viewed more than 100 videos of child pornography and more than 100 still images of child pornography, but he could not provide an exact number. He insisted that if he thought an image or video was child pornography, he would erase it. He also maintained that not all of [the images and videos shown at trial] look like child pornography. Although he admitted that he had searched on his computer for the terms young and sex together, he believed that Google would filter out any images of girls younger than 18. Figueroa further testified that he used LimeWire to create his own YouTube videos, typing in search terms to retrieve movies, photographs, and music. When he conducted those LimeWire searches, he would sometimes see child pornography, but he would erase it because [he] wasn't interested in it. Figueroa recounted an instance in which he looked for a soccer video by searching for the terms Best Goal Ever, but instead received a video of [a] -9- girl taking off her clothes and dancing nude. He deleted the video. Figueroa recounted a time when he was playing an online video game and met a person online who was trying to pass for being a girl. The girl asked Figueroa if he wanted her to send [him] pictures of her naked, to which he allegedly responded, How old are you? When the girl answered, I'm over 18, Figueroa said, Okay, that's fine. The girl then sent him photographs of her breasts, her vagina and her buttocks. Subsequently, the girl had a conversation with another player in the online video game, which Figueroa saw, and told the player that she was only sixteen-yearsold.5 Figueroa acknowledged that he kept the photographs the girl had sent him in his email account until federal agents seized his computer on May 12, 2010, at which time Figueroa used a university computer to delete the pictures from his email account. C. Figueroa's Challenges to the Sufficiency of the Evidence To support his claim that the evidence was insufficient to establish that he knowingly possessed the child pornography found on his computer, Figueroa makes the following arguments:6 (1) 5 At the time, Figueroa, the girl, and the third person who the girl had informed that she was sixteen, were all playing a video game together in which all players are able to view each other's chat conversations via a shot box. 6 In its brief on appeal, the government divides Figueroa's undifferentiated challenge to the sufficiency of the evidence in his opening brief into six categories. We find that division useful and apply it here. -10- none of the witnesses at trial could scientifically establish that he purposely intended to download any child-related pornography, and any child pornography he did download was inadvertent, (2) the seven videos and eighteen images were only partially downloaded and were therefore inaccessible to him, (3) whenever he inadvertently downloaded child pornography he deleted it, (4) anti-virus software on his computer could have accessed and modified any child pornography on his computer, (5) he afforded access to his computer to a number of other people, any of whom could have downloaded the child pornography, and finally (6) the government failed to establish that the images depicted actual children. We address each of these arguments in turn. 1. Intent to Download Child Pornography Figueroa contends that if his searches on LimeWire yielded child pornography results that were in turn downloaded onto his computer, it was inadvertent. The record suggests otherwise. Agent Colón, the computer forensics expert who examined Figueroa's computer, testified that the seven videos and eighteen images of child pornography were all contained in LimeWire folders on Figueroa's computer. Files obtained through LimeWire cannot automatically download onto a computer. A user would have to actively search for files and then select them by clicking to -11- download those files. Lieutenant Lang,7 an expert in computer forensics and peer-to-peer networking, explained that a LimeWire user employs the program's search tab to type in words such as preteen hard core, or pthc, which the user hopes will appear in a file name. Consistent with Agent Colón's testimony, Lang testified that when LimeWire search results show a file that contains the desired search term, the user must click on the file before it will download. Based on this testimony, a rational jury could have found that, in order to retrieve files with names such as porn pthc 9yo Vicki stripping and sucking (kiddie pedo illegal underage preteen) or naked penis preteen vagina little girls ass 6 year old panties gay hussyfan 7yo lolitaguy 8yr pussy pedo kiddie porn, Figueroa used search terms associated with child pornography. He then intentionally downloaded the files that the LimeWire network had shared with him in response to those search requests before any child pornography would be downloaded to the LimeWire folders on his computer. See United States v. Breton, 740 F.3d 1, 17 (1st Cir. 2014) ([A] defendant's . . . use of search terms associated with child pornography can support a finding that the defendant knew the images he retrieved contained child pornography.). 7 The government qualified Lang as an expert in peer-to-peer networking and computer forensics, without objection. -12- 2. Inaccessible Partially Downloaded Files Figueroa asserts that files on his computer that were not fully downloaded were inaccessible. Such a contention is rebutted by Lieutenant Lang and Agent Colón's trial testimony. Lang testified that under LimeWire's default settings a file will initially go to the incomplete folder and remain there until the file is complete[ly] downloaded, at which point it will move over to [a] saved [folder]. Videos and still images can be viewed by a computer user when they are located in a LimeWire incomplete folder. In fact, Lang noted, an illicit file could remain in an incomplete folder for a long time, possibly even for years, and be viewed there. Agent Colón testified that a file that has not been fully downloaded on LimeWire has a T preceding its file name. Once the file is completely downloaded, the T notation is removed and the file is automatically transferred to the saved folder. If someone attempts to view a partially downloaded file through LimeWire, the word preview is added to the T notation in the file name. Noting this testimony, Figueroa argues that, because none of the video files had preview in their titles, he could not have accessed them. Such an assertion is plainly contradicted by the trial record. Colón testified that the files could have been accessed via Windows Explorer, and no preview notation would be added to the -13- file name.8 Furthermore, Colón testified that a particular child pornography image had been accessed via Windows Explorer. Accordingly, a jury could have found that at all times the partially downloaded files were accessible to Figueroa.
Figueroa insists that whenever any unwanted child pornography was downloaded to his computer, he immediately deleted [the] same. The trial testimony rebuts this claim. At the time of the trial, seven videos and eighteen still images of child pornography were on Figueroa's computer. Agent Colón explained that one of the child pornography files in question, 9-year-old Jenny nude with legs spread wide apart, was created on March 27, 2010, had been saved in a computer folder with Figueroa's name and profile, and was still available to the computer's user when the computer was seized on May 12, 2010. In addition, on April 14, 2010, the WindowsXP operating system on Figueroa's computer created a Thumbs.db file just minutes after another child pornography file was downloaded onto the computer. Agent Colón testified that the Thumbs.db file was located in the same LimeWire folder where the child pornography videos were found, which showed that the user accessed the file using . . . Windows Explorer. The child pornography video had not been 8 Bonilla also testified that if the files were viewed using Windows Explorer, no preview notation would be added to the file. -14- deleted; rather, the Windows operating system created a little icon that would allow the images to be accessed more quickly in the future. The images of child pornography remained on Figueroa's computer when it was seized. Moreover, Bonilla, Figueroa's own expert, acknowledged in cross examination that eighteen still images and seven videos containing child pornography were found on Figueroa's computer and that none of the files had been deleted, scrubbed or sanitized by anti-virus software. Furthermore, Figueroa admitted at trial to having downloaded child pornography and failing to delete it from his computer. When asked by the government's attorney, you admit that you've had child pornography downloaded and you have seen it, correct? Figueroa responded, When I know it has been downloaded, yes. The prosecutor then asked, the truth is that this image [of child pornography], you did not delete, correct? to which Figueroa responded, Yes. Figueroa's deletion claim is groundless.
Figueroa asserts that other software such [as] an antivirus program could have been responsible for accessing or modifying the files on his computer that contained child pornography. However, he does not contend that anti-virus software was responsible for downloading child pornography onto his computer in the first place. Agent Colón did find an Avira anti-virus software program on Figueroa's computer, but testified that an -15- anti-virus program would not change the date on which a file was created, nor would it be capable of downloading child pornography. Figueroa's own computer networking expert, Bonilla, admitted that anti-virus software cannot download child pornography onto a computer.
Figueroa argues that the child pornography found on his computer could have been downloaded by a number of people to whom he afforded access or even by an unknown party capable of breaking into his home router signal. Figueroa testified, however, that he was the primary user of the computer located in his bedroom and that he downloaded LimeWire. Figueroa acknowledged that he likely downloaded and viewed more than 100 videos and 100 images of child pornography after he installed LimeWire on his computer: MS. HERNANDEZ: So how many other child pornography images or videos did you download into your computer that you had to erase? FIGUEROA: Well, when I would check them and see that I had downloaded child pornography, I would erase them. It was a good amount. MS. HERNANDEZ: So how many videos would you say that you downloaded? FIGUEROA: I don't know a specific number, but it was a good amount. . . . MS. HERNANDEZ: And you admit, then, that you have downloaded child pornography through LimeWire? FIGUEROA: Admitting in the sense that I didn't know what I was downloading, and then I would observe it and would see child pornography, I would erase it. MS. HERNANDEZ: So how many other videos of child pornography have you seen, other than -16- the ones that we found in your computer now, that you deleted? . . . More than one hundred? FIGUEROA: Yes, but that doesn't mean that I would see the entire video. In addition, all of the child pornography videos found on Figueroa's computer were saved to the computer's C drive in a file titled Documents and Settings\ Alejandro\My Documents\ LimeWire\ Incomplete and all of the still images were saved to the folder Alejandro\ My Documents\ LimeWire\ Saved folder. From this evidence a rational jury could conclude that it was Figueroa, not one of his friends or an unknown user, who downloaded the files. See United States v. Koch, 625 F.3d 470, 478 (8th Cir. 2010) (stating that a conviction was supported by the fact that user names on both the computer and flash drive [on which child pornography were found] were variations on [the defendant's] first name). Moreover, Agent Colón testified that Figueroa used his personal email address to chat on the computer within minutes of the creation of child pornography files. Furthermore, multiple child pornography files were created on the computer at times between 4:00 a.m. and 4:30 a.m, suggesting that Figueroa himself downloaded the files. See United States v. Salva-Morales, 660 F.3d 72, 75 (1st Cir. 2011) (per curiam) (asserting that because downloaded child pornography files were accessed between 2:00 a.m. and 3:00 a.m., it is a reasonable inference that [the defendant] was the one accessing the files at these times). Figueroa admitted that the room in which the Compaq -17- Presario desktop computer was found was his bedroom. There was no evidence that anyone else slept in the room or was present during the early morning hours. Figueroa argues that the time at which the files were downloaded is irrelevant because when files are selected as part of a bulk download, LimeWire cannot begin all the downloads simultaneously. He contends that files that were downloaded at 4:00 a.m. could have been selected early during the day but downloaded at a later time. Figueroa presented no evidence at trial to suggest that LimeWire files selected for download do not begin to download immediately. In fact, Agent Colón testified that a Limewire file begins to download the moment the user selects the file for download. The jury was permitted to accept as true Agent Colón's testimony.
Finally, Figueroa claims that the government failed to prove beyond a reasonable doubt that the still images and videos contained depictions of actual children engaged in sexually explicit activity. In a child pornography case, [t]he prosecution must prove beyond a reasonable doubt that the image is of an actual child in order to establish guilt. United States v. RodriguezPacheco, 475 F.3d 434, 439 (1st Cir. 2007). However, [t]here is no per se rule that the prosecution is required to produce expert testimony in every case to establish that the depicted child is -18- real, for either guilt or sentencing purposes. United States v. Hoey, 508 F.3d 687, 691 (1st Cir. 2007). Rather, juries are capable of distinguishing between real and virtual images, without expert assistance. Rodriguez-Pacheco, 475 F.3d at 441. In the instant case, the prosecutors showed the jury eighteen still images and seven videos of alleged child pornography found on Figueroa's computer. Despite the fact that it was not required to do so, the government also presented expert testimony that the images and videos contained actual minors. Agent Colón, who had performed computer forensics work in dozens of child pornography cases, testified that he found 18 images and 7 videos that contained minors in lasciv[i]ous exhibition of the genitalia on Figueroa's computer. Lieutenant Lang, who had investigated hundreds of child pornography cases, examined the files associated with Figueroa's IP address and stated, Yes, that's definitely child pornography. He testified that he recognized one of the videos associated with Figueroa's IP address because he had previously seen the video in another child pornography case, which had an identified victim and was a bad piece of child pornography. The images and videos introduced into evidence, in conjunction with the testimony of two experts, were sufficient for a rational jury to conclude beyond a reasonable doubt that the files on Figueroa's computer depicted images of actual children engaged in sexually explicit conduct. -19- For all of the reasons stated above, Figueroa's sufficiency of the evidence argument fails.9