Court Opinion

ID: 4703112
Source: CourtListenerOpinion
Date Created: 2021-07-13 14:21:43.954528+00
Date Added: 2024-06-11T08:06:29.309101
License: Public Domain

COURT OF APPEALS OF VIRGINIA

              Present: Judges Petty, Athey and Senior Judge Frank
              Argued by teleconference
UNPUBLISHED

              JAEYOUNG LEE
                                                                             MEMORANDUM OPINION* BY
              v.     Record No. 0869-20-4                                     JUDGE ROBERT P. FRANK
                                                                                   JULY 13, 2021
              COMMONWEALTH OF VIRGINIA

                                    FROM THE CIRCUIT COURT OF FAIRFAX COUNTY
                                                 John M. Tran, Judge

                               Peter D. Greenspun (Liza Greenspun Yang; Greenspun Shapiro PC,
                               on briefs), for appellant.

                               Timothy J. Huffstutter, Assistant Attorney General (Mark R.
                               Herring, Attorney General; Robert H. Anderson, III, Senior Assistant
                               Attorney General, on brief), for appellee.

                     Jaeyoung Lee, appellant, was convicted in a bench trial of one count of possessing child

              pornography and ninety-nine counts of possessing child pornography as a second or subsequent

              offense in violation of Code § 18.2-374.1:1. On appeal, he contends that the evidence was

              insufficient to prove that he knowingly possessed, either actually or constructively, the visual

              depictions of child pornography that the police found on three computer hard drive devices. For

              the following reasons, we affirm appellant’s convictions.

                                                        BACKGROUND

                     On November 1, 2017, Detective Jon Long and other police officers executed a search

              warrant at appellant’s residence at “Unit 435”in an apartment complex in Alexandria.1 Detective

                     *
                         Pursuant to Code § 17.1-413, this opinion is not designated for publication.
                     1
                         The validity of the search warrant or the scope of the search is not before us.
Long explained to appellant that he had a search warrant for his apartment. Long “gave him the

option of either staying or leaving.” Appellant walked with Long to Unit 435. Long testified

that appellant “stayed outside in the hallway” of the apartment “with his mom while the door

remained open” during the search.

       The apartment contained one bedroom and one bathroom. The bedroom closet contained

men’s clothing but no clothing for women or children. The police found, in a walk-in closet off

the bedroom, a LaCie external hard drive for a computer on a shelf behind a pair of pants. Also

in the closet was a fingerprint card bearing appellant’s name.

       The police found several backpacks of various colors in the apartment. Detective James

Lopez testified he found two black Western Digital My Password computer hard drives inside a

black and grey backpack.2 Detective Lopez first saw the backpack on a couch in the living

room. Within or beside the backpack was a bi-fold folder3 containing appellant’s application

with the U.S. Department of Justice Bureau of Alcohol, Tobacco, Firearms and Explosives to

build a firearm. The police recovered documents in the closet and living room area relating to

appellant, but no one else.

       In November of 2017, Detective Nickolas Boffi, who was then a digital forensic

examiner for the Fairfax County police, received the hard drives that the police seized from

appellant’s apartment. Boffi examined the content of the hard drives. At trial, the

Commonwealth introduced diagrams demonstrating the file structure of the three hard drives.

       2
           These three hard drive devices are the subject of this appeal.
       3
          Lopez testified that he did not have personal knowledge of where the backpack
originally was found, but that he saw a similar looking backpack hanging on the door to the
utility room. Concerning Lopez’s testimony, the trial court said, “But I could not give any
weight to Detective Lopez as to where those items were found . . . but I could not find from
that – from Detective Lopez’s testimony as to where each of – each of the accordion folder or
those personal items were actually located.” Nevertheless, the backpack was found in
appellant’s living room.
                                                 -2-
       The files on one of the Western Digital hard drives (WD-1) were structured into folders

with names such as “tara 8yr old slut,” “LS,” “preteen sluts,” “vicky,” and “candydoll.” There

was also a folder titled “preteen sluts child pornstar movies.” Boffi found child pornography

files within the designated folders. Boffi testified that anyone who plugged WD-1 into a

computer would see the file structure, which was “not hidden.” Additionally, anyone who

plugged in the hard drive to a computer would see “preteen sluts child pornstar movies” and

“candydoll” in the main folders. A person who clicked on the plus sign next to “preteen sluts

child pornstar movies” would access subfolders contained within that main folder that included

such titles indicative of child pornography as “tara 8yr old slut,” “vicky,” and “ls models.” All

of the child pornography images had been placed on the device on July 25, 2016. The source of

the child pornography was a device with a unique identification number with the last digits of

“9335-1000.”

       Within a folder titled “Sony” on WD-1, Boffi found photographs of appellant. The

photographs of appellant were saved to the “Sony” folder on WD-1 on October 26, 2016. The

same device used to transfer the child pornography to WD-1, with the final digits of 9335-1000,

also was the source of appellant’s personal photographs.

       Boffi also examined the second Western Digital hard drive (WD-2). One folder that

would be apparent when someone connected WD-2 to a computer was labeled “New Folder,”

which contained subfolders of child pornography. One subfolder within “New Folder” was

labeled “vcb,” which, in turn, contained a further subfolder titled “Vietnamese Child Brothel.”

“Vietnamese Child Brothel” contained pictures of child pornography. WD-2 contained more

than 2,700 files, at least some of which were child pornography. Child pornography images

were placed on WD-2 on June 4 and 6, 2016, from the device with the final identifying digits of

                                               -3-
9335-1000, i.e., the same device that was the origin of the child pornography and the personal

photographs of appellant on WD-1.

        Upon examination, Boffi found that the LaCie hard drive contained three “partitions,” or

separate storage areas. Within “Partition 3,” Boffi found a folder titled “New Folder” containing

child pornography. Per Boffi’s testimony, one video of child pornography was placed on the

LaCie hard drive on March 24, 2011. The video was saved on the hard drive with the path

“\New Folder\preteen sluts child pornstar movies\tara 8 yr old slut\Tara – wants you to f***

her.” The source of the video was a device with a unique identification number ending in

“4274-1000.” Boffi testified that the titles of all folders in the file structure on the device,

including those relating to child pornography, would be visible when other files or documents

were added to the device.

        “Partition 3” of the LaCie hard drive contained a “Graduation” folder that included

pictures of appellant that were placed on the device on August 18 and 19, 2011. One of the next

major folders in the file structure was entitled “Documents,” within which Boffi found various

letters from appellant to doctors, as well as a resume associated with appellant. Another folder

named “Career” included appellant’s resume, and the “Personal” folder contained other items

connected to him. Yet another folder labeled “Pictures” included pictures of appellant as well.

        The remaining child pornography on the LaCie device for which appellant was

prosecuted was placed there on November 16, 2013. The November 16, 2013 transfer of child

pornography was within the main folder titled “New Folder” and under the subfolder “preteen

sluts child pornstar movies,” where the previously saved “tara 8 yr old slut\Tara – wants you to

f*** her” video had been placed. The pornographic videos and photographs added in 2013 were

organized within further subfolders under “New Folder” and subfolder “preteen sluts child

pornstar movies” with labels of “tara 8 yr old slut,” “liluplanet Lord of the rings,” “veronica,”

                                                 -4-
“vicky,” and “vids privat niece.” Moreover, within the subfolder “tara 8 yr old slut,” were

separate categories containing pornography labeled “tara 5 yr old” and “new!.” The source of

the pornography saved on the LaCie hard drive on November 16, 2013, was the same device

from which the pornography saved on March 24, 2011, had originated.

        On cross-examination, Boffi elaborated on certain parts of his earlier testimony. The

images on the WD-2 hard drive had been modified (or first put on a device) on February 18,

2015 and created (put on that specific hard drive) on June 4 and 6, 2016. The videos4 found on

WD-1 were placed on the hard drive on July 25, 2016. Appellant’s personal files including

appellant’s pictures had been placed on the WD-1 hard drive on October 26, 2016.

        Similarly, child pornography files were stored on WD-2 on June 4, 2016. As for the

LaCie hard drive, all but one of the child pornography files had been stored to it on November

16, 2013, and the remaining one had been stored on March 24, 2011. Appellant’s graduation

pictures and other personal documents relating to him had been placed on the hard drive on

August 18, 2011, and August 19, 2011, i.e., between the dates that the pornography was stored in

March 2011 and November 2013.

        Finally, Boffi testified that the various subfiles such as “Graduation,” “Career,” and

“Personal” would all have been created and named by the user. The user creating such a file

folder would see the file structure while doing so. A user downloading a new file to the device

would see the entire file structure, including the various references to child pornography.

        Testifying as an expert on the identification of child pornography, Detective John Spata

stated that three file folders’ titles in the file structure “stood out to” him as consistent with child

pornography. Detective Spata reviewed the images contained within one of those folders and

        4
            Preteen Sluts Child Pornstar Movies.
                                                   -5-
concluded that it included child pornography. Detective Spata further testified that he found

child pornography and appellant’s personal files within the file structures of all three hard drives.

         The trial court made certain factual findings in a memorandum opinion, and in a post-trial

opinion denying the motion to set aside the verdict, specifically that the apartment in which the

hard drives were found belonged to appellant. The trial court observed, “I have what appears to

be personal documents identifying it as a place where the Defendant feels comfortable enough to

leave such important documents.”

         The trial court further found:

                           I saw that under Exhibit 13 the owner of the photographs is
                    the same owner as some of the pornographic images. It ends with
                    893351000, which is part of the pornographic.

                            So - - so the source of this data is the same source as some
                    of the pornography that’s in this case, which is 893351000.

                            So the - - his personal data being placed and categorized in
                    these hard drives left the Court no doubt, especially because of the
                    size of the pornography that exists in these places, that he knew
                    what was in those hard drives when he downloaded the images.

                       ....

                           I could not find a reasonable explanation as to why
                    somebody would have three hard drives this size filled with these
                    images that are reflected in the evidence before the Court.

                            Some of the images, of course, are - - contain videos of a
                    great length of time. And that is the reason why I found that even
                    though this is a constructive possession case that it’s driven by
                    circumstantial evidence.

                          The circumstantial evidence left no doubt as to the
                    Defendant’s guilt in this case.

         The trial judge explicitly found as fact that, irrespective of any challenge to Boffi’s

testimony as inconsistent or incredible, “I found the dates of the creation and modification date

reliable . . . .”

                                                    -6-
        In its factual findings, the trial court determined that the LaCie hard drive had been found

“out in the open and sitting on top of a shelf in an unlocked closet” while the other two hard

drives “were associated with the backpack” that the police found in the apartment. Regarding

any claimed deficiencies in the police investigation, the court found that “when it comes to

computer related evidence there can be an indicium of trustworthiness that offsets the

inaccuracies of human investigation.”

        As for the “modified” and “created” dates of the files of child pornography, the trial court

found that the normal expectation would be that

                an image had to be first created before it could be modified and the
                date order would be the reverse of what was found. Here, the
                modified date references the last time the images was [sic]
                modified within another source and then when copied onto the
                external hard drive was [sic] “created” in the external hard drive,
                resulting in the “created” date being the later date.

        The trial court further found that “there were two sources of the child pornography that

made its way to the three hard drives” and that all but one of the transfers to the LaCie hard drive

had taken place on November 16, 2013. Further, the images had come into one primary folder

named “New Folder” that contained subfolders with such names as “Preteen Sluts Child Porn

Star Movies.” The LaCie hard drive contained photos from appellant’s graduation and other

photos from 2010 and 2011. Regarding appellant’s contention at trial that the times in which the

transfers had been recorded could have been manipulated, the trial court found that they could be

“manipulated to be different than where the transfer actually occurred, however, absent an

explanation as to why time zones would be manipulated, it is the consistency of the information

overall that lends . . . credence to the data.”

        As for the two Western Digital hard drives, again the computer data indicated “a pattern

of transfers that speaks to the regularity of the process.” Regarding WD-1, the trial court found

that “the same device that transferred the child pornography . . . was the source of personal
                                                  -7-
photos taken of the Defendant and placed into the hard drive after the child pornography had

been transferred into the external hard drive.” As for WD-2, the court found that the transfers

had occurred within two separate time periods, in June 2016.

       Finally, the circuit court noted that the folders “were all organized. There was no

indication that files were randomly copied into the hard drive without placing them into folders.”

Further, WD-1 “had the file names on top. With the exception of a handful of folders, most of

the files [on that hard drive] also had names associated with pornography. . . .” And “the number

of images and the lengths of the movies suggests that the person who assembled or stored the

materials knew what was kept” in the folders. Moreover, “an image with suggestive titles would

not be willingly transferred into and kept in an external hard drive or long exist in an external

hard drive unless it was placed and stored there knowingly.” The trial court also pointed out that

“dates and time stamps constitute circumstantial evidence of the actual transfer dates” and that

“it is pure speculation to consider the possibility of an erroneous system clock or the intentional

manipulation of the dates and time stamps produced by a computer’s operating system where the

manipulation is lacking.”

       The trial court found that appellant’s contention that the dates and times the files were

created or modified were unreliable was not a reasonable hypothesis of innocence. Further, the

files were “easily accessible by clicks on the files . . . and the presence of defendant’s personal

photos and papers showed that defendant had access to the stored files.” The trial court also

noted that the hard drives “were found separated from any active computer. There is more

intentionality with respect to what is kept and stored on such hard drives than in computers

which are generally accessible.”

                                                -8-
                                            ANALYSIS

        On appeal, appellant argues that the evidence is insufficient to show he knowingly

possessed, either actually or constructively, the child pornography found on the three external

hard drive devices. Specifically, he contends that there was insufficient evidence to prove the

apartment where the hard drives were found was his, that he ever exercised dominion and control

over the hard drives, that he knowingly possessed the images, or that any of the backpacks were

his.5

        “When reviewing the sufficiency of the evidence to support a conviction, the Court will

affirm the judgment unless the judgment is plainly wrong or without evidence to support it.”

Bolden v. Commonwealth, 275 Va. 144, 148 (2008). The relevant issue on appeal is, “upon

review of the evidence in the light most favorable to the prosecution, ‘whether any rational trier

of fact could have found the essential elements of the crime beyond a reasonable doubt.’” Pijor

v. Commonwealth, 294 Va. 502, 512 (2017) (quoting Dietz v. Commonwealth, 294 Va. 123, 132

(2017)). Thus, “[a]n appellate court does not ‘ask itself whether it believes that the evidence at

the trial established guilt beyond a reasonable doubt.’” Commonwealth v. Moseley, 293 Va.

455, 462-63 (2017) (quoting Williams v. Commonwealth, 278 Va. 190, 193 (2009)). “In sum,

‘[i]f there is evidence to support the conviction, the reviewing court is not permitted to substitute

its judgment, even if its view of the evidence might differ from the conclusions reached by the

finder of fact at the trial.’” Commonwealth v. McNeal, 282 Va. 16, 20 (2011) (quoting

Commonwealth v. Taylor, 256 Va. 514, 518 (1998)).

        “The sole responsibility to determine the credibility of witnesses, the weight to be given

their testimony, and the inferences to be drawn from proven facts lies with the fact finder.”

        5
         Appellant does not dispute that the 100 images and videos for which he was prosecuted
constituted child pornography or that the police found them on the three hard drive devices in
question.
                                               -9-
Ragland v. Commonwealth, 67 Va. App. 519, 529-30 (2017). “That responsibility lies with the

fact finder because ‘[t]his [C]ourt[,] sitting as an appellate court, and knowing nothing of the

evidence or of the witness, except as it appears on the paper, . . . [is] incompetent to decide on

the credibility of the testimony.’” McNeal, 282 Va. at 22 (quoting Brown v. Commonwealth, 29

Va. (2 Leigh) 769, 777 (1839)). Furthermore, when considering witness testimony, the fact

finder is not required to believe all aspects of a witness’s testimony; it may accept some parts as

believable and reject other parts as implausible. See id. Inconsistent or contradictory statements

by a witness do not render his or her testimony incredible, and the trier of fact is entitled to rely

upon that witness’s testimony in convicting a defendant. See Swanson v. Commonwealth, 8

Va. App. 376, 378-79 (1989). Further, it is within the province of the trier of fact to draw

inferences from the proven evidence, and its inferences are binding so long as they are

reasonable and justified. See Commonwealth v. Hudson, 265 Va. 505, 514 (2003).

       A conviction may be based on circumstantial evidence. See id. at 512. “Circumstantial

evidence, if sufficiently convincing, is as competent and entitled to the same weight as direct

testimony.” McCain v. Commonwealth, 261 Va. 483, 493 (2001). This Court does not “view[]

[circumstantial evidence] in isolation.” Kelly v. Commonwealth, 41 Va. App. 250, 259 (2003)

(en banc). Rather, the “combined force of many concurrent and related circumstances, each

insufficient in itself, may lead a reasonable mind irresistibly to a conclusion.” Dowden v.

Commonwealth, 260 Va. 459, 470 (2000) (quoting Stamper v. Commonwealth, 220 Va. 260, 273

(1979)).

       When assessing whether the circumstantial evidence excludes a reasonable hypothesis of

innocence, the Commonwealth “need only exclude reasonable hypotheses of innocence that flow

from the evidence, not those that spring from the imagination of the defendant.” Simon v.

Commonwealth, 58 Va. App. 194, 206 (2011) (quoting Hamilton v. Commonwealth, 16

                                                - 10 -
Va. App. 751, 755 (1993)). “The reasonable-hypothesis principle . . . is ‘simply another way of

stating that the Commonwealth has the burden of proof beyond a reasonable doubt.’” Moseley,

293 Va. at 464 (quoting Hudson, 265 Va. at 513). “[T]he factfinder determines which

reasonable inferences should be drawn from the evidence[] and whether to reject as unreasonable

the hypotheses of innocence advanced by a defendant.” Id. “Whether an alternate hypothesis of

innocence is reasonable is a question of fact and, therefore, is binding on appeal unless plainly

wrong.” Holloway v. Commonwealth, 57 Va. App. 658 (2011) (en banc) (quoting Archer v.

Commonwealth, 26 Va. App. 1, 12-13 (1997)).

       Under Code § 18.2-374.1:1(A) and (B), “[a]ny person who knowingly possesses child

pornography is guilty of a Class 6 felony,” and any second or subsequent such offense is a Class

5 felony. On brief, appellant correctly cites to authorities analogizing the constructive

possession issue here with constructive possession cases involving drugs. See Kobman v.

Commonwealth, 65 Va. App. 304, 307 (2015); Terlicki v. Commonwealth, 65 Va. App. 13,

24-25 (2015). The principles governing a sufficiency claim involving proof of the defendant’s

constructive possession of contraband are equally well-settled. To convict a defendant for

constructive possession, “the Commonwealth must point to evidence of acts, statements, or

conduct of the accused or other facts or circumstances which tend to show that the defendant was

aware of both the presence and character of the [contraband] and that it was subject to his

dominion and control.” Terlecki, 65 Va. App. at 24 (quoting Drew v. Commonwealth, 230 Va.

471, 473 (1986)). “Ownership or occupancy of the premises on which the contraband was found

is a circumstance probative of possession.” Id. (quoting Kromer v. Commonwealth, 45 Va. App.

812, 819 (2005)).

       We first address appellant’s contention that the evidence was insufficient to prove that

the police found the hard drive devices in appellant’s own apartment. We disagree. The trial

                                               - 11 -
court found that the apartment belonged to appellant. The trial court observed, “I have what

appears to be personal documents identifying it [the apartment] as a place where the [appellant]

feels comfortable enough to leave such important documents.” Inside the apartment the police

found appellant’s application to build a firearm, his fingerprint card, photographs of appellant,

correspondence by appellant, and appellant’s resume. There was no indication that anyone other

than appellant lived at the apartment.

       Further, Detective Long told appellant that the police had a warrant to search his

apartment. Appellant then walked with Long to Unit 435. Although given the option to leave,

appellant remained in the hallway outside the apartment with his mother during the hours that the

search was underway. Appellant would have had no reason to linger outside during the search if

the apartment was not his. The evidence thus supports the trial court’s finding of fact that the

apartment belonged to appellant.

       Nonetheless, the Commonwealth was required to prove that appellant knowingly

possessed the child pornography on the devices found in his apartment and that the contraband

was subject to his dominion and control. “While this appears to be a case consigned to the new

and evolving area of computer technology, we examine this case under familiar principles of

constructive possession of contraband.” Kromer, 45 Va. App. at 818. “We do not need to

determine whether appellant was the person” who saved the child pornography to the three

devices but, “rather, we determine whether appellant knew the images existed and, if so, did he

exercise dominion and control over them” after they were placed on the devices. Id.

       In Kobman, 65 Va. App. at 308, this Court found the evidence insufficient to prove that

the defendant constructively possessed images of child pornography found in the “unallocated

space” of computers seized from his home. We found that “[n]o evidence established [the

defendant] had access to or used the required forensic software necessary to retrieve the deleted

                                               - 12 -
photographs” from the unallocated space. Id. “Further, no evidence showed other indicia of

knowledge, dominion, or control of the forty-five photographs found in the unallocated space on

the specific date of the indictments.” Id. We reached a different conclusion regarding nine

images found in the recycle bin of appellant’s computer, however. “Expert testimony

established that computer users can access and control files placed by the user into the recycle

bin. [The defendant] made statements indicating what the police were looking for, as reflected in

the search warrant, could be found ‘in the computer.’” Id. at 310. Considering the totality of the

evidence, we found that evidence sufficient to prove that the defendant “was aware of the

presence of the nine illicit photographs in the recycle bin and that he exercised dominion and

control over the contraband.” Id.

       The issue of constructive possession of contraband is “largely a factual one.” Raspberry

v. Commonwealth, 71 Va. App. 19, 30 (2019) (quoting Ritter v. Commonwealth, 210 Va. 732,

743 (1970)). We find that, when the facts and circumstances of this case are considered as a

whole, a reasonable finder of fact could conclude beyond a reasonable doubt that appellant

constructively possessed the child pornography on the three devices found in his apartment.

       Concerning the LaCie hard drive, Boffi testified that a video containing child

pornography was saved to the device on March 24, 2011. The pornography was deliberately

placed within Partition 3 of the device, under “My Folder” and subfolders “preteen sluts child

pornstar movies” and “tara 8 yr old slut.” Six months later, personal photographs of appellant

were placed within Partition 3 of the device in the folder entitled “Graduation.” Other

photographs and personal documents of appellant were located in other folders in Partition 3.

The evidence demonstrated that the file structure of the device, which included file names

indicative of child pornography, was not hidden and would be visible to anyone accessing the

device. In 2013, numerous items of child pornography were added to the LaCie device within

                                               - 13 -
the same path of the prior video and into the previously created “preteen sluts child pornstar

movies” subfolder. The source for the 2013 child pornography was the same as the origin of the

2011 visual depiction.

       The evidence concerning the two Western Digital hard drive devices was even more

intertwined. On two occasions in June 2016, child pornography was placed on WD-2 under

“New Folder” in subfolder “vcb” and further subfolder “Vietnamese Child Brothel.” About one

month later, and from the same source as the pornography placed on WD-2, numerous videos of

child pornography were added to “New Folder” of WD-1 under the title “preteen sluts child

pornstar movies,” the same subfolder title found on the LaCie device. Significantly, personal

photographs of appellant were placed on WD-1 on October 26, 2016, from the same source of

the child pornography previously saved on both WD-1 and WD-2. As with the LaCie hard drive,

a person accessing the two Western Digital hard drives for an innocent purpose, such as saving

his personal photos or documents, would necessarily see the titles of folders that already resided

there and indicated that they contained child pornography.

       As the trial court stated, the folders of child pornography were “organized,” and there

was no indication that “files were randomly copied into the hard drive without placing them into

folders.” We agree with the trial court’s assessment that “the number of images and the lengths

of the movies suggest that the person who assembled and stored the material into the hard drives

knew what was kept.” See United States v. Yarrington, 634 F.3d 440, 450 (8th Cir. 2011)

(evidence sufficient to sustain conviction for possessing child pornography on a hard drive,

which contained 168 images of child pornography organized into five separate folders, that also

included the defendant’s personal photos).

                                               - 14 -
       We find no evidence in the record to support appellant’s claim that the digital information

was incorrect and that the files could have been manipulated. We thus do not disturb the trial

court’s finding of fact that appellant’s hypothesis of innocence in this regard was not reasonable.

                                         CONCLUSION

       In sum, the direct and circumstantial evidence supports the factfinder’s conclusions that

appellant knew of the child pornography on the hard drive devices, that it was subject to his

dominion and control, and that he constructively possessed it. Accordingly, we do not disturb

appellant’s convictions.

                                                                                         Affirmed.

                                               - 15 -