Michael Forrest Kovach v. Commonwealth of Virginia

COURT OF APPEALS OF VIRGINIA

Present: Judges Beales, Alston and Senior Judge Haley UNPUBLISHED

Argued at Richmond, Virginia

MICHAEL FORREST KOVACH MEMORANDUM OPINION BY v. Record No. 2013-15-2 JUDGE ROSSIE D. ALSTON, JR. DECEMBER 6, 2016 COMMONWEALTH OF VIRGINIA

FROM THE CIRCUIT COURT OF WESTMORELAND COUNTY Harry T. Taliaferro, III, Judge

David B. Hargett (Hargett Law, PLC, on brief), for appellant.

Rosemary V. Bourne, Senior Assistant Attorney General (Mark R. Herring, Attorney General, on brief), for appellee.

Michael Forrest Kovach appeals his convictions of possession of child pornography in

violation of Code § 18.2-374.1:1(A), two counts of possession of child pornography as a second

or subsequent offense in violation of Code § 18.2-374.1:1(B), distribution of child pornography

in violation of Code § 18.2-374.1:1(C), and three counts of distribution of child pornography as a

second or subsequent offense in violation of Code § 18.2-374.1:1(C). Specifically, appellant

argues that the evidence was insufficient to support his convictions. We affirm in part and

reverse in part.

I. BACKGROUND

On November 19, 2013, Special Agent Mike Jedrey of the Virginia State Police began

investigating an IP address suspected of distributing child pornography. The IP address provided

him with a file list containing terms of child exploitation. From this list, Special Agent Jedrey

attempted to download some of the files to verify the content. He was able to download the files

 Pursuant to Code § 17.1-413, this opinion is not designated for publication.

using a peer-to-peer sharing platform designed to facilitate file sharing between computers. Special Agent Jedrey later traced the IP address to appellant because the address was registered to appellant’s residence.

On March 5, 2014, Special Agent Jedrey, along with several other officers, executed a search warrant of appellant’s home. Nine items were seized including a Dell Dimension 2400 Tower, an iPhone, two SD cards, three laptops, an external hard disc drive, and a large black custom computer desk top tower.

On the same day, Special Agent Jedrey interviewed appellant. Appellant stated that only he and his sons lived in the house and that he monitored the computers very carefully, controlling what information his sons could access. He also indicated that he downloaded peer-to-peer sharing software, Shareaza, on his computer and admitted to downloading adult pornography. Appellant also stated that while he was downloading these files, he viewed child pornography on a zip file1 that he downloaded using Shareaza.

At trial, Special Agent Jedrey testified about the files that came from the IP address registered to appellant’s home which Special Agent Jedrey downloaded using peer-to-peer sharing programs. As part of his investigation, Special Agent Jedrey testified that for several months he would download files that he suspected of being child pornography. Some of these images were found on a zip file on appellant’s desktop and a SD card.2 During that time the files he downloaded ultimately allowed him to obtain a search warrant for appellant’s home.

Thomas Heflin, an expert in the field of digital forensic examination, testified about what the investigators found on the items seized from appellant’s house. Child pornography was

1 A zip file is downloaded by a computer user and allows multiple pictures, videos, or any other type of file to be contained within a compressed file to provide space on a computer and make transmission more efficient. 2 A SD card is a memory card that stores files and can be inserted into a computer. - 2 -

found on a laptop, the desktop computer, and a SD card. The child pornography was found in the unallocated space3 on the desktop and in the thumb cache4 on the laptop. Heflin testified that there were videos on the SD card depicting child pornography, which the Commonwealth played at trial. Heflin also testified that when he examined the desktop the user name for the peer-to-peer sharing program installed on the computer was “Mike.”

Lawrence Daniel, an expert in forensic examination, testified that he could not tell from examining the SD card whether it had been accessed by other computers. Daniel also stated that he did not find any link file from the SD card on the laptop or the desktop, which would have appeared if a link had been opened on either device from the SD card. Further, Daniel testified that the only pictures found on the desktop and laptop computer were in the unallocated space or the thumb cache. Both the unallocated space and the thumb cache require special software to gain access to them; there was no evidence of any such programs on either the laptop or the desktop. Daniel testified that because the globally unique identifier (“GUID”) number, which Special Agent Jedrey found while downloading suspicious files using the peer-to-peer sharing program, matched appellant’s desktop, it followed that the child pornography came from appellant’s computer.

At the close of the Commonwealth’s case, appellant moved to strike the evidence on each charge. Appellant argued that the evidence presented by the Commonwealth was insufficient to support the child pornography possession and distribution charges against him. Appellant

3 Unallocated space is an area of the computer where files that users have viewed will be stored, even if they are deleted, until they are eventually overwritten. Files found in the unallocated space on a computer could not be accessed by a user without some specialized software or program. 4 A thumb cache is a Microsoft Windows database designed to store smaller versions of images that a computer user looks at in Windows Explorer. Thumb cache images on a computer cannot be accessed by a user without some specialized software or program. - 3 -

argued that the Commonwealth could not prove that appellant knowingly possessed child pornography because the only pictures found on the desktop and the laptop were in places the appellant could not access, specifically the unallocated space and the thumb cache. Appellant further argued that people who have SD cards do not necessarily know what is on them. Appellant stated that there was no way to prove appellant ever accessed, acquired, or viewed anything on the SD card containing child pornography.

In his motion to strike, appellant also argued that there was no way to prove that the people in the videos were children. He further stated that there was no way for the trial court to know which picture or video corresponded with each indictment. Ultimately, the trial court denied appellant’s motion to strike.

The trial court found appellant guilty of possession of child pornography, two counts of possession of child pornography as a second or subsequent offense, distribution of child pornography, and three counts of distribution of child pornography as a second or subsequent offense. While the trial court admitted that it was not trying to limit the possession charges to a particular exhibit, it did state that the first possession conviction was based on evidence found in the thumb cache on the desktop, the second possession conviction was based on evidence found in a Shareaza “collection” zip file, and the third possession conviction was based on evidence found in the unallocated space on the laptop. The first distribution conviction was based on one photo that Special Agent Jedrey downloaded on November 21, 2013. The second distribution conviction was based upon the evidence of all the other photographs Special Agent Jedrey downloaded on November 21, 2013. The third distribution conviction was based on all the images Special Agent Jedrey downloaded on December 9, 2013. The fourth distribution conviction was based on all the images Special Agent Jedrey downloaded on November 19,

- 4 -2013. The trial court sentenced appellant to a total of forty years in prison, with twenty-five years suspended. This appeal followed.

II. ANALYSIS

In this case, appellant challenges the trial court’s decision to deny his motion to strike the possession and distribution of child pornography charges against him. When reviewing the sufficiency of evidence on appeal, “the evidence and all reasonable inferences fairly drawn therefrom must be viewed in the light most favorable to the Commonwealth. The trial court’s judgment should be affirmed unless it appears that it is plainly wrong or without evidence to support it.” Spencer v. Commonwealth, 238 Va. 275, 283, 384 S.E.2d 775, 779 (1989) (citation omitted). The appellate court examines a trial court’s fact findings “with the highest degree of appellate deference.” Thomas v. Commonwealth, 48 Va. App. 605, 608, 633 S.E.2d 229, 231 (2006). “An appellate court does not ‘ask itself whether it believes that the evidence at the trial established guilt beyond a reasonable doubt.’” Williams v. Commonwealth, 278 Va. 190, 193, 677 S.E.2d 280, 282 (2009) (quoting Jackson v. Virginia, 443 U.S. 307, 318-19 (1979)). The only “relevant question is, after reviewing the evidence in the light most favorable to the prosecution, whether any rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt.” Sullivan v. Commonwealth, 280 Va. 672, 676, 701 S.E.2d 61, 63 (2010) (citing Jackson, 443 U.S. at 319).

A. Possession of Child Pornography

Code § 18.2-374.1:1(A) states that “[a]ny person who knowingly possesses child pornography is guilty of a Class 6 felony.” To convict appellant of possession of child pornography, the Commonwealth had to prove appellant “was aware of the presence and character of the [contraband] and that he intentionally and consciously possessed [it].” Merritt v.

Commonwealth, 55 Va. App. 719, 733, 689 S.E.2d 757, 764 (2010) (quoting Castaneda v. - 5 -

Commonwealth, 7 Va. App. 574, 583, 376 S.E.2d 82, 87 (1989)); see also Terlecki v. Commonwealth, 65 Va. App. 13, 24-25, 772 S.E.2d 777, 782-83 (2015) (holding that possession of child pornography may be analyzed under principles of constructive possession).

“Possession can be proven ‘by showing either actual or constructive possession.’” Merritt, 55 Va. App. at 733, 689 S.E.2d at 764 (quoting Birdsong v. Commonwealth, 37 Va. App. 603, 607, 560 S.E.2d 468, 470 (2002)). “Proof of constructive possession necessarily rests on circumstantial evidence; thus, ‘all necessary circumstances proved must be consistent with guilt and inconsistent with innocence and exclude every reasonable hypothesis of innocence.’” Id. (quoting Burchette v. Commonwealth, 15 Va. App. 432, 435, 425 S.E.2d 81, 83 (1992)). When proving constructive possession of contraband, as in this case, “the Commonwealth must point to evidence of acts, statements, or conduct of the accused or other facts or circumstances which tend to show that [appellant] was aware of both the presence and character of the [contraband] and that it was subject to his dominion and control.” Powers v. Commonwealth, 227 Va. 474, 476, 316 S.E.2d 739, 740 (1984) (citing Eckhart v. Commonwealth, 222 Va. 447, 450, 281 S.E.2d 853, 855 (1981)).

In this case, appellant argues that the Commonwealth’s evidence was insufficient for the trial court to convict him of the possession charges because there was no evidence that appellant had knowledge of what was on his desktop or laptop, in the unallocated space or the thumb cache. Appellant also argues that the Commonwealth did not provide evidence to support the trial court’s finding that he had knowing possession or dominion and control over the SD card found by the police.5

5 Appellant did not provide a substantial argument about the evidence found on the desktop in the Shareaza “collection” zip file which is what the trial court considered in convicting him of the second possession charge, instead appellant focused on the SD card. - 6 -

In Kobman v. Commonwealth, 65 Va. App. 304, 307-08, 777 S.E.2d 565, 567 (2015), this Court found that the mere presence of contraband in the unallocated space of a computer does not establish knowing possession of the contraband because the material in the unallocated space cannot be accessed or seen without forensic software. Likewise, in the present case, investigators found images in the unallocated space of appellant’s desktop, but because no forensic software was found on the computer allowing access to the material appellant could not be found to possess the contraband. Therefore, the trial court erred in denying the motion to strike because no evidence established that appellant had knowledge, dominion, or control of the photographs found in the unallocated space.6

The trial court also erred by denying the motion to strike as it related to the possession charges for images in the thumb cache. Based on Daniel’s expert testimony, special software is required to access the thumb cache, similar to that necessary for accessing the unallocated space. Pursuant to Kobman, when special software is required to access part of a computer, and that special software is not present, the recovered evidence by itself does not establish criminal liability. 65 Va. App. at 307-08, 777 S.E.2d at 567. In this case, there was no evidence that appellant had the software on his laptop that was necessary to access the thumb cache.

For the remaining possession charge, based on the evidence found on the desktop in the Shareaza “collection” zip file, the Commonwealth advances a theory of constructive possession of the contraband. As previously stated, “the Commonwealth must point to evidence of acts, statements, or conduct of the accused or other facts or circumstances which tend to show that the [appellant] was aware of both the presence and character of the [contraband] and that it was

6 The Commonwealth concedes this point on brief, citing Kobman. While this Court is not obligated to follow concessions of law by the Commonwealth, this concession of law is an appropriate recognition of controlling principles in this matter. See Logan v. Commonwealth, 47 Va. App. 168, 172, 622 S.E.2d 771, 773 (2005) (en banc). - 7 -

subject to his dominion and control.” Powers, 227 Va. at 474, 316 S.E.2d at 739. “Ownership or occupancy of the premises on which the contraband was found is a circumstance probative for possession.” Archer v. Commonwealth, 26 Va. App. 1, 12, 492 S.E.2d 826, 832 (1997). In the present case, the police recovered images from the desktop in a Shareaza “collection” zip file. Special Agent Jedrey testified that these images were accessible to users without any special programs. In addition, appellant admitted to Special Agent Jedrey that he saw an image of child pornography on a zip file. This evidence, coupled with the facts which bolster the finding that appellant had control over the desktop, the images located in the zip file which were under the user name “Mike,” and because the zip file had recently been opened on the desktop, lead to the conclusion that appellant knew the images were on the desktop and were under his dominion and control. Viewing the evidence in the light most favorable to the Commonwealth, the trial court’s ruling on the motion to strike as it related to the evidence found on the desktop in the Shareaza “collection” zip file was not plainly wrong or without evidence to support it.

With regard to the pictures found on the SD card, the trial court did not specifically base any conviction on the evidence found there but it still acknowledged in its ruling that when it assigned a particular exhibit to a charge “it was not trying to limit it to just those particular exhibits.” The trial court also stated that “from the beginning, the case has been about essentially the SD drive and the two computers.” The Commonwealth again offers a theory of constructive possession of the contraband. The Commonwealth argues that several different “acts, statements, [and certain] conduct” of appellant would lead a factfinder to conclude that appellant possessed the child pornography recovered by the police on the SD card. See Powers, 227 Va. at 474, 316 S.E.2d at 739.

These facts included that the SD card was found in appellant’s hamper in his bedroom.

Next, appellant admitted that he controlled the electronic devices in his house and stated that he - 8 -

was the “dragon” between his sons and the computers, monitoring their use of electronics. Appellant admitted that sometimes suspect images and videos appeared when he was trying to download adult pornography. Lastly, several of the videos that Special Agent Jedrey obtained while he was using peer-to-peer sharing software were also found on the SD card. Viewing the evidence in the light most favorable to the Commonwealth, the trial court’s ruling on the motion to strike as it related to the possession charges from the SD card was not plainly wrong or without evidence to support it.

In summary, we conclude that the trial court erred when it found that the child pornography found in the unallocated space on the desktop and in the thumb cache on the laptop established appellant’s guilt because special forensic software programs and training were necessary to access these images. Thus, we reverse the two possession of child pornography second or subsequent convictions based on the files found in the unallocated space and thumb cache. We affirm the possession of child pornography conviction based on the evidence found in the “collection” zip file downloaded using Shareaza.

B. Distribution of Child Pornography

Code § 18.2-374.1:1(C)(i) states that “[a]ny person who knowingly [ ] reproduces by any means, including by computer, sells, gives away, distributes, electronically transmits, displays, [or] purchases” child pornography shall be guilty of violating the statute. Appellant argues that he should not have been convicted of distribution of child pornography because the evidence was insufficient to prove that he intentionally shared child pornography or was the person responsible for sharing it.

In Kelley v. Commonwealth, 289 Va. 463, 469, 771 S.E.2d 672, 674-75 (2015), the Supreme Court of Virginia held that because the appellant chose to download peer-to-peer

sharing software onto his laptop, he voluntarily participated in peer-to-peer sharing of child - 9 -

pornography. The Court also found that appellant knew how the peer-to-peer sharing software worked and knew that the software was capable of sharing files with other users, regardless of whether appellant intended to share the files or if they were just put into a shared folder as a default option by the program. Id.

Similarly, in this case, appellant knowingly downloaded and used the peer-to-peer sharing software on his desktop. Appellant admitted to downloading movies and adult pornography using Shareaza, showing he knew how to use the software. Appellant also admitted that he had accidentally downloaded child pornography in the past. It was reasonable for the factfinder to conclude that appellant should have known that the software had the ability to share files with other users. Appellant’s assertion that he did not know that the sharing feature was operating is insignificant. Furthermore, the trial court did not find appellant’s statements to Special Agent Jedrey, with respect to his awareness of or intention to share pornographic image files, credible.

Moreover, a GUID number that Special Agent Jedrey captured while downloading photographs onto his computer during his investigation was a number generated during the installation of Shareaza on appellant’s desktop. Daniel testified that because this GUID number matched appellant’s desktop, Special Agent Jedrey downloaded the child pornography from appellant’s computer. Finally, several of the videos that Special Agent Jedrey obtained while he was using peer-to-peer sharing software were also found on the SD card in appellant’s hamper.

Based on the facts and circumstances presented to the trial court, we hold that the trial court was not plainly wrong in denying appellant’s motion to strike the charges of distribution of child pornography. Accordingly, we affirm appellant’s conviction of distribution of child pornography in violation of Code § 18.2-374.1:1(C), and his three distribution of child

pornography second or subsequent offenses in violation of Code § 18.2-374.1:1(C). - 10 -

III. CONCLUSION

We hold that the trial court erred when it denied appellant’s motion to strike as to the possession of child pornography convictions based on evidence from the unallocated space on the desktop and in the thumb cache on the laptop. Thus, the possession of child pornography convictions that rely on evidence obtained from the unallocated space or the thumb cache are reversed. The possession of child pornography conviction that relies on evidence found on the desktop in the “collection” zip file downloaded using Shareaza is affirmed. We further hold that the trial court did not err when it denied appellant’s motion to strike as to the distribution of child pornography convictions. Thus, appellant’s distribution of child pornography convictions are affirmed.

Affirmed in part, and reversed in part.

- 11 -