United States v. Staff Sergeant SCOTT T. SCHEMPP

UNITED STATES ARMY COURT OF CRIMINAL APPEALS Before MULLIGAN, CELTNIEKS, and BURTON Appellate Military Judges

UNITED STATES, Appellee v. Staff Sergeant SCOTT T. SCHEMPP United States Army, Appellant

ARMY 20140313

United States Army Combined Arms Support Command James W. Herring, Jr., Military Judge Colonel Ralph J. Tremaglio III, Staff Judge Advocate

For Appellant: Colonel Kevin Boyle, JA; Major Aaron R. Inkenbrandt, JA; Captain Amanda R. McNeil, JA (on brief).

For Appellee: Major A.G. Courie III, JA; Major Steven J. Collins, JA; Captain Scott L. Goble, JA (on brief).

SCHEMPP—ARMY 20140313

Appellant’s case is before this court for review under Article 66, UCMJ. Appellant’s counsel raises three assignments of error, two of which merit discussion and relief. 1

FACTS

In April of 2012, while conducting an undercover operation to identify computers trading child pornography via the internet, a Special Agent (SA) with the Naval Crime Investigative Services (NCIS) flagged appellant’s Internet Protocol (IP) address as a “download candidate” of child pornography. Further investigation revealed that appellant’s IP address, a unique number assigned by appellant’s internet service provider, actively shared images of potential child pornography with other internet users through a peer-to-peer program called “FrostWire.” The NCIS agent downloaded three digital images from appellant’s shared FrostWire folder and confirmed they were child pornography by comparing the images to the National Center for Missing and Exploited Children’s (NCMEC) database of known child victims.

NCIS, upon identifying appellant as an active duty Army soldier, transferred the case to the Army Criminal Investigation Command (CID).

Pursuant to a military magistrate’s search authorization, CID collected from appellant’s residence a Dell Alienware tower computer (Dell) and an Iomega external hard drive (Iomega). CID then obtained a second search authorization to conduct a digital forensic examination of these seized items. CID’s examination found child pornography on both devices. All of the digital images on the Iomega were recovered from unallocated space on the drive. Eight of the digital images on the Dell computer were recovered from unallocated space. The remaining 72 images and 4 videos on the Dell were in the active files.

LAW AND DISCUSSION

Article 66(c), UCMJ, establishes our statutory duty to review a record of trial for legal and factual sufficiency de novo. United States v. Walters, 58 M.J. 391, 395 (C.A.A.F. 2003). Under Article 66(c), UCMJ, we may affirm only those findings of guilty that we find correct in law and fact and determine, based on the entire record, should be affirmed. Id. The test for legal sufficiency of the evidence is whether, viewing the evidence in a light most favorable to the government, a fact-finder could rationally have found all of the essential elements of an offense beyond a reasonable doubt. Jackson v. Virginia, 443 U.S. 307, 318-19 (1979); United States v. Blocker, 32 M.J. 281, 284-85 (C.M.A. 1991). In resolving questions of legal sufficiency, this

1 We have also reviewed those matters personally raised by appellant pursuant to United States v. Grostefon, 12 M.J. 431 (C.M.A. 1982), and they are without merit.

SCHEMPP—ARMY 20140313

court is “bound to draw every reasonable inference from the evidence of record in favor of the prosecution.” United States v. Craion, 64 M.J. 531, 534 (citations omitted). In weighing factual sufficiency, we take “a fresh, impartial look at the evidence,” applying “neither a presumption of innocence nor a presumption of guilt.” United States v. Washington, 57 M.J. 394, 399 (C.A.A.F. 2002). "[A]fter weighing the evidence in the record of trial and making allowances for not having personally observed the witnesses, [we must be] convinced of the [appellant's] guilt beyond a reasonable doubt.” United States v. Turner, 25 M.J. 324, 325 (C.M.A. 1987).

1. Images Located in Unallocated Space

Appellant alleges the evidence underlying Specification 1 of The Charge and some of the evidence underlying Specification 2 of The Charge is legally insufficient to support a conviction because the images at issue were found in the unallocated space of the Dell computer and Iomega drive.

In Specification 1 of The Charge, the court found appellant guilty of, on or about 20 June 2012, knowingly possessing 83 images of child pornography on the Iomega drive. 2 In Specification 2 of The Charge, the court found appellant guilty of, on or about 20 June 2012, knowingly possessing 40 images and 2 videos containing child pornography. 3

Because of its charging decision, the Government was required to prove for both specifications that the appellant knowingly possessed the charged images and video files “on or about 20 June 2012.” Accordingly, the critical issue we must now decide is not whether the appellant knowingly possessed these images and video files at any time, but whether he possessed them on or about 20 June 2012.

We conclude appellant did not possess the 83 images underlying Specification 1 of The Charge, nor did he possess eight of the images in Specification 2 of The

2 After arraignment but before entry of pleas, Specification 1 of The Charge was amended by striking the figure “90” and substituting therefor the figure “85”. Of Specification 1 of The Charge, appellant was found Guilty, except the figure “85”, and substituting therefor the figure “83”. Of the excepted figure: Not Guilty. Of the substituted figure: Guilty.

3 After arraignment but before entry of please, Specification 2 of the Charge was amended by striking the figures “80” and “4” and substituting therefor the figures “41” and “3.” Of Specification 2 of The Charge, appellant was found Guilty, except the figures “41” and “3,” substituting therefor the figures “40” and “2.” Of the excepted figures: Not Guilty. Of the substituted figure: Guilty.

SCHEMPP—ARMY 20140313

Charge, which were found in unallocated space. 4 To support our conclusion, we first consider the technical aspects associated with unallocated space prior to considering whether a computer user can “possess” a digital file, either actually or constructively, if that file exists only in the unallocated space of a computer.

According to the Government’s expert witness, Special Agent (SA) JB, all of the digital files charged in Specification 1 of The Charge, and some of the digital files charged in Specification 2 of the Charge, were deleted in December 2009, so appellant had no access to them absent the use of forensic software. SA JB retrieved these images using EnCase, a forensic software program that allows deleted images in unallocated space to be seen. SA JB testified that a user does not have the ability to access a digital file once it is moved into the unallocated space. He further testified that, while freeware was available to undelete files in unallocated space, he found no evidence that appellant had acquired or used such a program. SA JB’s testimony is consistent with the definition of “unallocated space” used in federal courts. See United States v. Hill, 750 F.3d 982, 988 n.6 (8th Cir. 2014) (“Unallocated space is space on a hard drive that contains deleted data, usually emptied from the operating system’s trash or recycle bin folder, that cannot be seen or accessed by the user without the use of forensic software. Such space is available to be written over to store new information.”) (quoting United States v. Flyer, 633 F.3d 911, 918 (9th Cir. 2011)); United States v. Seiver, 692 F.3d 774, 776 (7th Cir. 2012) (explaining that when one deletes a file, that file goes into a “trash” folder; when one empties the “trash folder” the file has not left the computer because although the “trash folder is a wastepaper basket[,] it has no drainage pipe to the outside”; the file may be “recoverable by computer experts” unless it has been overwritten) (citations omitted), cert. denied sub nom Seiver v. United States, 133 S. Ct. 915 (2013). 5

“Possession,” for purposes of determining if appellant knowingly possessed child pornography, has the same definition as that used in Article 112a, UCMJ. See United States v. Navrestad, 66 M.J. 262, 267 (C.A.A.F. 2008). “Possess,” as used in that article, “means to exercise control of something. Possession may be direct

4 The following images charged in Specification 2 of The Charge were found in unallocated space: 0000.jpg; 0021.jpg; 0022.jpg; 0024.jpg; 0026.jpg; 0027.jpg; 0030.jpg; and 0033.jpg.

5 Digital files found in unallocated space or slack space have also been referred to as “orphan files” because “it is difficult or impossible to trace their origin or date of download.” United States v. Moreland, 665 F.3d 137,142 n.2 (5th Cir. 2011) (citing United States v. Kain, 589 F.3d 945, 948 (8th Cir. 2009) (stating that “[o]rphan files are files that were on the computer somewhere saved but were subsequently deleted, so the computer doesn’t know exactly where they came from”)).

SCHEMPP—ARMY 20140313

physical custody…or it may be constructive. … Possession must be knowing and conscious.” Manual for Courts-Martial, United States, pt. IV, ¶37.c.(2). In Navrestad, the Court of Appeals for the Armed Forces, using this definition of “possession,” set aside a conviction for possession of child pornography as legally insufficient where the evidence failed to show the defendant had actual or constructive possession of child pornography. Navrestad, 66 M.J. at 268.

Here, as the appellant was unable to access any of the images in unallocated space, he lacked the ability to exercise “dominion or control” over these files. Navrestad, 66 M.J. at 267; see Flyer, 633 F.3d at 919 (citing Navrestad and holding that evidence was legally insufficient to prove knowing possession on or about the date charged in the indictment); see also United States v. Kuchinski, 469 F.3d 853, 863 (9th Cir. 2006) (holding that in a situation in which “a defendant lacks knowledge about the cache files, and concomitantly lacks access to and control over those files, it is not proper to charge him with possession and control of the child pornography images located in those files, without some other indication of dominion and control over those images. To do so turns abysmal ignorance into knowledge and a less than valetudinarian grasp into dominion and control”); Moreland, 665 F.3d at 154 (holding that the evidence was legally insufficient to sustain conviction for possession of child pornography in which Government failed to prove dominion and control over the digital images and citing cases for the proposition that evidence is legally insufficient to show constructive possession based solely on the fact that the accused possessed the computer “without additional evidence of the [accused’s] knowledge and dominion or control over the images”).

As “possession” for purposes of child pornography requires the possession be both “knowing and conscious,” Navrestad, 66 M.J. at 267, we hold that the appellant did not “knowingly possess” any of the 83 digital images in Specification 1 of the Charge nor did he “knowingly possess” eight of the digital images in Specification 2 of The Charge that were all found in unallocated space on or about 20 June 2012, the date charged. 6

6 Factually, this case is similar to Flyer in that all images of child pornography charged in Flyer’s indictment had been retrieved from unallocated space. The Flyer court agreed with the general proposition that one way to exercise dominion and control over a digital file would be to delete that file; however, that alone was insufficient to prove knowing possession on the date indicated on the indictment. 633 F.3d at 919. Because the Government was unable to prove that on the date alleged in the indictment Flyer was able to access or retrieve any of the child pornography digital images, the evidence was legally insufficient. See also United States v. Nichlos 2014, NMCCA 201300321, CCA LEXIS 691 (NMCCA 18 Sep. 2014).

SCHEMPP—ARMY 20140313

We also conclude that the evidence was legally insufficient to prove appellant actually or constructively possessed the images on the date charged. For the evidence to be legally sufficient on a constructive possession theory, a person must exercise “dominion or control” over the child pornography digital files. 7 Id. Based on the technical aspects associated with unallocated space, SA JB’s testimony, and a lack of any evidence presented that the appellant was a sophisticated computer user in possession of the forensic tools or freeware necessary to retrieve digital files from unallocated space, we conclude that the evidence is legally insufficient to prove possession on or about the charged date of 20 June 2012. That is, all of the evidence underlying Specification 1 of The Charge and eight of the images underlying Specification 2 of The Charge are legally insufficient to support a finding of guilty and therefor warrants relief. We are, however, convinced beyond a reasonable doubt that appellant knowingly possessed the remaining 32 images and two videos alleged in Specification 2 of The Charge.

2. Factual Sufficiency of Images Alleged to be Child Pornography

Appellant alleges that the majority of the digital files charged were clearly not child pornography. After reviewing the remaining evidence underlying Specification 2 of The Charge, we find four of the images insufficient to support a finding of guilty beyond a reasonable doubt. 8 We will take appropriate action in our decretal paragraph. We are, however, convinced beyond a reasonable doubt that the remaining images and the video files are legally and factually sufficient to support the finding of guilty as to this specification and The Charge.

CONCLUSION

The finding of guilty of Specification 1 of The Charge is set aside and that Specification is DISMISSED. The court AFFIRMS only so much of the findings of guilty of Specification 2 of The Charge as finds that:

[Appellant] did, at or near Joint Base Langley-Eustis, on or about 20 June 2012, knowingly and wrongfully possess child pornography, to wit: 28 digital images and 2 videos of minors, or what appears to be minors, engaging in sexually explicit conduct, on a Dell Alienware Computer, such conduct being of a nature to bring discredit to the armed forces.

7 But cf. United States v. Carpegna, 2013 U.S. Dist. LEXIS 115002 at *14 (D. Mont. Aug. 14, 2013) (distinguishing Carpegna’s acts of deleting contraband from the facts in Navrestad and Flyer based on the fact that Carpegna “knew enough about the presence of the images on the laptop to ‘hit delete’ after he was finished viewing them”). 8 Images labeled 0042.jpg, 0051.jpg, 0055.jpg and 0056.jpg.

SCHEMPP—ARMY 20140313

We are able to reassess the sentence on the basis of the error noted and do so after conducting a thorough analysis of the totality of circumstances presented by appellant’s case and in accordance with the principles articulated by our superior court in United States v. Winckelmann, 73 M.J. 11, 15-16 (C.A.A.F. 2013). In evaluating the Winckelmann factors, we first find no dramatic change in the penalty landscape that might cause us pause in reassessing appellant’s sentence. Additionally, appellant was tried and sentenced at a general court-martial by a military judge and the nature of the remaining offense still captures the gravamen of the original offenses and the circumstances surrounding appellant’s conduct. Finally, based on our experience, we are familiar with the remaining offense so that we may reliably determine what sentence would have been imposed at trial. We are confident that based on the entire record and appellant’s course of conduct, the military judge would have imposed a sentence of at least that which was adjudged.

Reassessing the sentence based on the noted errors and entire record, we AFFIRM the sentence as adjudged. We find this reassessed sentence is not only purged of any error but is also appropriate. All rights, privileges, and property, of which appellant has been deprived by virtue of that portion of the findings set aside by our decision, are ordered restored.

Senior Judge MULLIGAN and Judge CELTNIEKS concur.

FOR FOR THE THE COURT: COURT:

MALCOLM H. MALCOLM H. SQUIRES, SQUIRES, JR. JR. Clerk of Court Clerk of Court

Footnotes

[26] February 2016 ---------------------------------- MEMORANDUM OPINION ---------------------------------- This opinion is issued as an unpublished opinion and, as such, does not serve as precedent. BURTON, Judge: A military judge sitting as a general court-martial convicted appellant, contrary to his pleas, of two specifications of possession of child pornography in violation of Article 134, Uniform Code of Military Justice, 10 USC § 934 (2012) [hereinafter UCMJ]. The military judge sentenced appellant to a dishonorable discharge, fifteen months of confinement and reduction to the grade of E-1. The convening authority approved the sentence as adjudged, to include 100 days of confinement credit ordered by the military judge. The automatic forfeiture of all pay and allowances was deferred and terminated on the appellant’s expiration of term of service.