Matthew John Stickle v. Commonwealth of Virginia

COURT OF APPEALS OF VIRGINIA Present: Judges Humphreys, Russell and Senior Judge Bumgardner Argued at Norfolk, Virginia PUBLISHED MATTHEW JOHN STICKLE OPINION BY v. Record No. 0660-16-1 JUDGE ROBERT J. HUMPHREYS DECEMBER 27, 2017 COMMONWEALTH OF VIRGINIA FROM THE CIRCUIT COURT OF THE CITY OF WILLIAMSBURG AND COUNTY OF JAMES CITY Michael E. McGinty, Judge Patricia Palmer Nagel for appellant. John I. Jones, IV, Assistant Attorney General (Mark R. Herring, Attorney General, on brief), for appellee. Matthew John Stickle (“Stickle”) appeals his December 16, 2015 conviction in the Circuit Court of the City of Williamsburg and County of James City (the “circuit court”) on three counts of possession of child pornography, first and second or subsequent offenses, and twenty-two counts of possession of child pornography with intent to distribute. I. Background “In accordance with established principles of appellate review, we state the facts in the light most favorable to the Commonwealth, the prevailing party in the [circuit] court. We also accord the Commonwealth the benefit of all inferences fairly deducible from the evidence.” Muhammad v. Commonwealth, 269 Va. 451, 479, 619 S.E.2d 16, 31 (2005). So viewed, the evidence shows that on September 3, 2013, Lieutenant Scott Little (“Little”), a district coordinator of the Southern Virginia Internet Crimes Against Children Task Force, took part in an undercover investigation into what is known as peer-to-peer (“P2P”) distribution of child pornography over the internet. Little testified regarding his substantive role in the investigation of Stickle and also testified without objection as an expert in the field of digital forensics, in particular “as to the investigation of child exploitation offenses.” Although the record reflects that much of Little’s testimony is somewhat technical, the specifics are important to the legal analysis in this case and are essentially as follows: What is generically referred to as “the internet” is a cooperatively managed global network of smaller interconnected networks. Each internet site, whether such site is hosted on a computer server or a single specific computer, is associated with a unique internet protocol (“IP”) address. Likewise, each device accessing the internet, such as computers, tablets, modems, routers, and smart phones, necessarily also is assigned a unique IP address to facilitate two-way communication with other devices and locations on the internet.1 The most common method of accessing internet sites is through a software application known as a “browser,” such as Microsoft’s Internet Explorer or Apple’s Safari. Browsers can access that portion of the internet known as the Worldwide Web or simply “the web,” which is the roughly fifteen percent of the internet sites that have been assigned domain names and indexed by Google and other search engines.2 Using a browser to access a site on the Worldwide Web requires that the link be 1 An IP address is a unique 128 bit number assigned by the Domain Name Server (“DNS”) of an internet service provider to each specific customer. IP addresses of individual devices within that customer’s premises are assigned and maintained by a DNS in a device called a router that creates a subnetwork within the premises based upon the IP address assigned by the internet service provider. Overall worldwide management of IP addresses and associated domain names is the responsibility of the Internet Corporation for Assigned Names and Numbers (ICANN). 2 The web is defined as a collection of links to the registered domain names of internet locations or “web pages” created using HTML (Hypertext Markup Language) thereby enabling them to be indexed by search engines and displayed in a browser. The remainder and vast majority of internet sites, known as the “deep web,” consists of unindexed, non-HTML locations, resources, and data that are encrypted, protected by a password, behind a paywall or otherwise beyond the reach of search engines and includes such things as email addresses, private networks -2-routed through one or more DNS servers located throughout the world that maintain a current database of IP addresses and their associated domain names and direct internet traffic to the appropriate IP address.3 A less common, but nevertheless widely available and frequently used method of reaching a specific IP address is through a direct link that is not relayed through a routing DNS. Using specialized but readily obtainable software designed for the purpose, a direct, encrypted “peer-to-peer” or “P2P” link can be established between a user’s computer and a specific folder or file on any linked computer—provided that the owner of the destination computer is using similar P2P software and has allowed specific access to such folder or file location. In short, P2P networks use locally installed software called a “client” which allows users to share computer files of their choice directly with other similarly equipped users (a “peer”) and without any intermediary routing. Files which a user intends to share are kept in a specific folder designated as sharable by the software client. While there is nothing inherently illegal about the use of peer-to-peer file sharing, P2P software is often used to share files in violation of copyright and other intellectual property laws and to facilitate communications regarding various types of and on-line banking sites. A small, encrypted subset of the deep web known as the “dark web” consists of peer-to-peer networks such as Tor, Freenet or, as in this case, ARES, and requires specific software, hardware configurations or authorization to access. See generally, Andy Greenberg, Hacker Lexicon: What Is the Dark Web?, Wired Magazine, November 19, 2014. 3 By way of example, www.vacourts.gov is the domain name registered with ICANN for the internet site hosting the on-line presence of the judicial department of the Commonwealth of Virginia. Entering www.vacourts.gov into a web browser will cause it to contact a DNS, lookup the IP address assigned to the domain name www.vacourts.gov which will return the associated IP address 208.210.219.101 and then link to that IP address and display the web page located there. -3-criminal activity.4 Because P2P locations in the dark web are invisible to indexing and search engines such as Google, specialized software is required to access each separate P2P network. Little was focusing his investigative attention on the ARES P2P network, which is often used to exchange child pornography. Testifying as an expert, Little explained how peer-to-peer networks are used in the context of the exchange of child pornography. In a P2P network generally, users place any files they wish to share with others in a specific “shared” folder. P2P clients like ARES globally search all shared folders in the P2P network for any specified files. If found, the client then connects directly to all “peers,” i.e. computers with shared folders that host the particular file being sought, and different pieces of the file are then downloaded from multiple peers and reassembled into a new whole copy which is then saved to the user’s shared folder.5 Specifically, with respect to the use of ARES, Little testified that file source IP addresses are always collected by a P2P client, but in the stock version of ARES, they are not normally displayed to the user. An ARES user enters the name of any file sought into the ARES client. As with other P2P software, ARES then locates multiple IP addresses of computers hosting copies of the requested file, verifies that all copies available are identical to each other, then downloads separate pieces of the file from the many different copies found across the internet, reassembles the pieces into a new copy and, after verifying that the newly assembled copy is identical to the those from which it was assembled, saves the new file copy to the user’s computer. 4 Under the “Sony standard” articulated by the Supreme Court in Sony Corp. of Am. v. Universal City Studios, Inc., 464 U.S. 417 (1984), a device does not constitute contributory copyright infringement so long as the device is capable of “substantial non-infringing uses.” 5 Apparently, this is done to preserve the anonymity of any single peer. -4- Little used a specialized version of the ARES client designed specifically for law enforcement (“ARES Round Up”). ARES Round Up, has been modified from its stock configuration in two ways. First, ARES Round Up forces the client to download a shared file from a single location instead of doing so piecemeal from multiple locations and then assembling the pieces into a whole copy of the sought-after file. The second law enforcement modification to the ARES client allows law enforcement users to view the actual IP address of the target computer containing the file location of a P2P shared file. Little input the names of specific child pornographic images encrypted and verified through the Secure Hash Algorithm (“SHA”)6 and commonly exchanged by those interested in child pornography into ARES Round Up and instructed the ARES Round UP client to search the ARES network for matches. This process allows the verified SHA values to be used to search for identical copies of known files. Little had enabled ARES Round Up to constantly search the P2P network for matches with the SHA values of known child pornography image and video files. One of these SHA values matched to a shared folder location on a computer indicating an IP address within the task force’s geographic area. Little obtained a subpoena and served the internet service provider to obtain the physical address associated with that IP address - the shared home of Stickle and his fiancée Margaret Mallory (“Mallory”). Stickle had been living at this address since moving from New York to live with Mallory in August of 2013. Little obtained a search warrant for this address and executed it on December 27, 2013. Pursuant to the warrant, police seized two laptop computers. Mallory identified one of the laptops as belonging to her, the other she identified as Stickle’s. 6 The Secure Hash Algorithm compares two files at the basic binary level and calculates a unique checksum for the authenticity of digital data to ensure the integrity of a file. In effect, it is a digital signature that indicates if a file has been modified from its original form. -5- Mallory initially told Little that she had no access to Stickle’s device, but later amended her statement to admit she had used Stickle’s computer on a few occasions. Police conducted a forensic analysis on the laptops. Inside a password-protected user account titled “Matt” on Stickle’s laptop, police found both images and videos of child pornography and the ARES client, as well as personal and family photos relating to Stickle. The ARES client’s shared folder contained an “extensive” library of child and adult pornography. Some files dated back to 2010, three years before the device was seized. Little was also able to forensically retrieve the search history of the ARES client, indicating which types of files the user had been looking to obtain. It included explicit sexual terms referencing children. The in-client ARES chat function on Stickle’s computer had been set to indicate to others that the user was a 14-year-old male. In addition, there were three child pornography videos featuring Stickle himself in another folder labelled “X.” The X folder was located near other folders which were personally relevant to Stickle, specifically one regarding a relative’s baptism. The three video files located in the X folder portrayed Stickle performing sexual acts on a prepubescent eight-to-ten-year-old male. When interviewed by police, Stickle denied knowledge of any child pornography on his computer and stated that he had had several roommates prior to moving to Virginia to live with Mallory. One of these roommates testified at trial that he had used Stickle’s computer when they lived together. He also testified that he had seen another roommate use Stickle’s computer. He did not testify that he had used ARES or placed any files on Stickle’s computer or seen any other roommate do so. A grand jury indicted Stickle on twenty-two counts of possession with intent to distribute child pornography, first and second or subsequent offenses, and three counts of manufacture of child pornography, first and second or subsequent offenses. The Commonwealth dropped the -6-manufacture of child pornography charges when it was discovered that the videos had been created in New York, Stickle’s residence before he moved to Virginia to live with Mallory. Stickle was tried on the remaining twenty-two charges in June of 2014. This trial ended in a mistrial. A grand jury subsequently indicted Stickle for three additional counts of possession of child pornography, first and second or subsequent offenses based upon the videos found in the X folder. The Commonwealth amended the twenty-two possession with intent to distribute child pornography indictments to first offense. Stickle was tried again by a jury on all twenty-five charges and found guilty on all counts. II. Analysis A. Application of the Fourth Amendment Stickle sought suppression of the evidence on the grounds that Little’s use of ARES Round Up to download child pornography from a computer in Stickle’s home violated his Fourth Amendment rights. “Since the constitutionality of a search and seizure under the Fourth Amendment involves questions of law and fact, we give deference to the factual findings of the trial court but independently decide whether, under the applicable law, the manner in which the challenged evidence was obtained satisfies constitutional requirements.” Jackson v. Commonwealth, 267 Va. 666, 672, 594 S.E.2d 595, 598 (2004). For the past fifty years, “the application of the Fourth Amendment depends on whether the person invoking its protection can claim a ‘justifiable,’ a ‘reasonable,’ or a ‘legitimate expectation of privacy’ that has been invaded by government action.” Smith v. Maryland, 442 U.S. 735, 740 (1979) (internal citations omitted). Justice Harlan’s concurrence in Katz v. United States, 389 U.S. 347 (1967), proposed a two-part test for evaluating the expectation of privacy. Formally adopted in Smith v. Maryland, the Katz test first asks “whether the individual, by his conduct, has ‘exhibited an actual (subjective) expectation of privacy.” Smith, 442 U.S. at 740 -7-(quoting Katz, 389 U.S. at 361). Second, it asks “whether the individual’s subjective expectation of privacy is ‘one that society is prepared to recognize as ‘reasonable.’” Id. This Court recently applied the Katz test to a case nearly identical to Stickle’s. In Rideout v. Commonwealth, 62 Va. App. 779, 753 S.E.2d 595 (2014), the same law enforcement task force that tracked Stickle used a modified version of a different P2P client (Shareaza) to download child pornography from Rideout. He sought suppression of this pornographic evidence on the theory that his failed attempt to prevent the P2P client from sharing his files established a reasonable expectation of privacy. We held in Rideout that “by simply installing file-sharing software onto his computer, appellant has ‘failed to demonstrate an expectation of privacy that society is prepared to accept as reasonable.’” Id. at 789, 753 S.E.2d at 600 (internal citation omitted). Stickle argues the inverse of Rideout. Instead of claiming that he attempted to limit sharing, Stickle stresses both the fact that file sharing is enabled by default in ARES and that he was unaware the ARES client was on his computer or that the client was being used to download child pornography. By denying knowledge of the software, Stickle attempts to circumvent the “reasonable expectation of privacy” Katz test and tie Little’s “search” to the earlier, more fundamental, property-based foundation of Fourth Amendment application resurrected by the Supreme Court in the wake of United States v. Jones, 565 U.S. 400 (2012). Though Katz originally broke with the previous property-based application of Fourth Amendment protection by declaring that the Fourth Amendment protects “protects people, not places,” Katz, 389 U.S. at 351, the Supreme Court in Jones revived and reinforced the pre-Katz concept of a property interest component to Fourth Amendment protection as a backstop to a privacy interest. However, Stickle’s legal argument necessarily depends upon both a misunderstanding of the -8-technology involved in this case and complete disregard for our standard of review. Stickle interweaves three specific Fourth Amendment arguments which we separate below for clarity. Stickle first claims that Little, using ARES Round Up software, “entered the curtilage and threshold of [his] home without a warrant to search for evidence of probable cause of a crime.” Stickle cites Florida v. Jardines, 569 U.S. 1 (2013), where the Supreme Court reversed a drug conviction because police had used a drug-sniffing dog on the defendant’s curtilage. The Supreme Court held this was an unreasonable search, stating “[t]he Katz reasonable-expectations test ‘has been added to, not substituted for,’ the traditional property-based understanding of the Fourth Amendment, and so is unnecessary to consider when the government gains evidence by physically intruding on constitutionally protected areas.” Jardines, 569 U.S. at 11 (citing Jones, 565 U.S. at 409). Stickle claims Little “actually crossed the threshold of the house to reach the modem [sic] in order to find probable cause to obtain a search warrant.” Analogizing to Jardines, Stickle argues [j]ust as the officer’s use of a drug-sniffing dog constituted a warrantless search of the curtilage of the home, Little’s use of the cable lines to the house to search the inside of the home constitutes a warrantless search of the curtilage of the home in this case. In fact, Little would not have been able to search the modem and router without use of the cable lines to the house to access these items inside of the house. Therefore, Little’s actions constitute a warrantless search of the curtilage of Stickle’s home. The curtilage is a well-established common law concept describing the area immediately surrounding one’s house, as defined by “its relationship to the residence and its use by its occupants.” Foley v. Commonwealth, 63 Va. App. 186, 195, 755 S.E.2d 473, 478 (2014). The term “curtilage,” as it is used in the legal context, “is historically understood to refer to an extension of the home that is so intertwined with the home that the law must provide it the same protection as the home itself.” Id. It does not include the interior of the home which is specifically protected from warrantless intrusion by the text of the Fourth Amendment itself. -9- While the lines carrying internet service to Stickle’s home may indeed run through his curtilage, we need not engage in an esoteric determination and analysis of the precise physical location where the bits and bytes constituting digital images of child pornography were obtained because Little’s actions with respect to his use of P2P software in no way constituted a search of the cables, curtilage, computer or any other location protected by Stickle’s Fourth Amendment rights. To be clear, any “search” essentially involves prying into a private place. See, e.g., United States v. Jacobsen, 466 U.S. 109, 113 (1984) (“A ‘search’ occurs when an expectation of privacy that society is prepared to consider reasonable is infringed.”). However, it is well-settled that viewing items deliberately exposed to public view does not constitute a search and in any event, consensual searches and seizures of items within the scope of the consent given do not implicate the Fourth Amendment. See, e.g., Coolidge v. New Hampshire, 403 U.S. 443 (1971) (generally discussing the application of the “plain view” doctrine); United States v. Williams, 41 F.3d 192, 196 (4th Cir. 1994) (holding that “[u]nder certain circumstances, the police may seize the contents of a container found in a lawfully accessed place, without a warrant, if the contents are in plain view”); United States v. Karo, 468 U.S. 705 (1984) (concluding that there was no violation of the Fourth Amendment through a beeper placed in chemical container as it was placed with consent of the then owner); United States v. Dunn, 480 U.S. 294, 307 (1987) (establishing a four-factor test for determining the extent of the curtilage, including “the steps taken by the resident to protect the area from observation by people passing by”). Here, no warrantless search of any area or seizure of any item protected by the Fourth Amendment occurred at all. When a user “searches” a P2P network, the software client is matching the search parameters to the contents of each P2P linked computer’s shared folder that others, such as Stickle, chose to make publicly available. In other words, Stickle was essentially broadcasting the contents of his shared folder to the entire ARES network community in - 10 -response to outside user queries and inviting them to copy anything and everything in the folder he chose to share. Stickle’s shared folder thus represents an “implicit invitation” of the type discussed in Jardines—a cultural custom, like placing a door knocker on the front door, “treated as an invitation or license to attempt an entry, justifying ingress to the home by solicitors, hawkers and peddlers of all kinds.” Jardines, 569 U.S. at 8 (quoting Breard v. Alexandria, 341 U.S. 622, 626 (1951)). Such customs are easily understood and “generally managed without incident by the Nation’s Girl Scouts and trick-or-treaters.” Id. Jardines ultimately held that such invitations are limited both in area and purpose, not present here, which ultimately rendered the search in Jardines unconstitutional. See id. at 9. Here, however, the invitation provided to others directly involved child pornography. To expand upon Justice Scalia’s analogy from Jardines, placing a jack-o’-lantern on the porch and leaving the light on during the evening of October 31 signifies a homeowner’s participation in the annual All Hallows Eve exception to parents’ usual admonition to their children that they should not accept candy from strangers. Similarly, viewing the record in the light most favorable to the Commonwealth, Stickle demonstrated his consensual participation in the file sharing community by downloading and installing the ARES client and then setting the contents of a folder as “shared” thereby exposing to public access those files in that folder he wished to share with others. Little, in effect a digital passerby, merely accepted the invitation offered by Stickle to help himself to copies of the contents of Stickle’s shared folder. Therefore, we reject Stickle’s argument that Little’s actions constituted a trespass to his curtilage in violation of the Fourth Amendment. Stickle next argues that ARES Round Up violated his Fourth Amendment rights because it is “sophisticated equipment” prohibited by Kyllo v. United States, 533 U.S. 27 (2001). In Kyllo the Supreme Court overturned a drug conviction where police used a thermal imaging - 11 -device to detect heat from a marijuana growing operation within a house. Kyllo held that “[w]here, as here, the Government uses a device that is not in general public use, to explore details of the home that would previously have been unknowable without physical intrusion, the surveillance is a ‘search’ and is presumptively unreasonable without a warrant.” Id. at 40.7 Unlike the device used in Kyllo, however, ARES Round Up is only slightly modified from the base ARES client, allowing it to connect to only one computer to download a file rather than to do so piecemeal from as many as are advertising the availability of the file, and also by allowing it to display the connected IP address to the investigating officer. These modifications, while clearly features of the software not readily available to the general public, are not of such sophistication that they represent a level of technology not available to the general public as was the case in Kyllo. As Little testified, the modification to allow direct connection to a single user is not an unknown advancement but rather a regression in technology to earlier file sharing protocols. File sharing software between individuals has been in general public use since the advent of the original file sharing service, Napster, in 1999—much to the vexation of the music and movie industries.8 The second law enforcement modification simply displays the IP address of the source shared folder—data that is already captured, though not displayed, by the standard ARES client. 7 As an aside, we observe that Kyllo also creates an endemic problem for the courts as we try to apply 18th and 19th century legal and constitutional concepts to 21st century technology. The very infrared imaging device described in Kyllo is now widely available and can be readily purchased by the general public and thus, under its own analysis, would no longer render the search in Kyllo unconstitutional. 8 See Menn, Joseph, All the Rave: The Rise and Fall of Shawn Fanning’s Napster. Crown Business, (2003). - 12 - The nature of the minor modifications present in ARES Round Up do not, in our judgment, suffice to render it a presumptively unconstitutional law enforcement tool. Moreover, unlike in Kyllo, ARES Roundup was not used “to explore details of the home that would previously have been unknowable without physical intrusion.” Rather, its modifications simply displayed the IP address of a single computer containing a copy of a file sought—information which was broadcast to everyone on the network by the ARES software on Stickle’s computer. Finally, Stickle argues that the warrant Little obtained subsequent to downloading the child pornography from Stickle’s IP address “was issued based upon an unlawful and generalized search.” Stickle claims that, because Little ran ARES Round Up continuously searching widely for any file being offered on the network which matched certain SHA values, his “search” violated the particularity requirement the Fourth Amendment places on warrants. Stickle specifically asserts that “Little . . . conduct[ed] a search into the curtilage of the homes and across the threshold of the homes of all of the citizens within a region, including Stickle’s home, that Little decided to subject to law enforcement surveillance for criminal activity without probable cause to do so without the knowledge or consent of the citizens.” (sic) This again is a misrepresentation of the technology. Little did not “[search] the modem for the IP address.” Little searched the ARES network, a voluntary file-sharing community, for very specific files containing images of child pornography from users willingly sharing those specific files. As discussed above, these users, including Stickle, essentially invited anyone, including Little, to connect directly to a specific set of files on their computers for the purpose of making copies. We therefore conclude that no general search in violation of the Fourth Amendment occurred. - 13 - B. Joinder of Offenses Stickle next argues that the circuit court erred by permitting him to be charged jointly for possession of the three child pornography videos located in the unshared X folder and the twenty-two child pornography still images found in the ARES shared folder. He asserts that the charges have “no connection to show a common scheme or plan, same act or transaction, or that the two sets of alleged charges are linked or connected in any way.” “The circuit court’s decision to join offenses for trial is reviewed for abuse of discretion.” Walker v. Commonwealth, 289 Va. 410, 415, 770 S.E.2d 197, 199 (2015) (citing Scott v. Commonwealth, 274 Va. 636, 644, 651 S.E.2d 630, 634 (2007)). An accused may be tried at one time for more than one offense “if justice does not require separate trials and (i) the offenses meet the requirements of Rule 3A:6 (b) or (ii) the accused and the Commonwealth’s attorney consent thereto.” Rule 3A:10(c). Rule 3A:6(b) permits joinder of multiple offenses in an indictment “if the offenses are based on the same act or transaction, or on two or more acts or transactions that are connected or constitute parts of a common scheme or plan.” Rule 3A:6(b). Our Supreme Court has held that “the terms ‘common scheme’ and ‘common plan’ are not synonymous.” Scott, 274 Va. at 645, 651 S.E.2d at 635. However, neither are they mutually exclusive. Id. at 646, 651 S.E.2d at 635. Scott defined both terms for the first time. A common scheme is composed of “crimes that share features idiosyncratic in character, which permit an inference that each individual offense was committed by the same person or persons as part of a pattern of criminal activity involving certain identified crimes.” Id. at 645, 651 S.E.2d at 635 (citations omitted). A common plan consists of “crimes that are related to one another for the purpose of accomplishing a particular goal.” Id. at 646, 651 S.E.2d at 635 (citations omitted). Further, the Virginia Supreme Court has stated that “offenses may be considered parts of a common scheme or plan when they are ‘closely connected in time, place, and means of - 14 -commission.’” Walker, 289 Va. at 416, 770 S.E.2d at 199 (quoting Satcher v. Commonwealth, 244 Va. 220, 229, 421 S.E.2d 821, 827 (1992)). Stickle argues that, though the pornographic files were all seized on the same date, they were placed on the computer at different dates over a range of years and are thus separate crimes that are not part of a common scheme or plan. However, Stickle is being charged with possession of these pornographic videos and possession with intent to distribute the various pornographic images, both of which are, “by nature,” continuing offenses. Morris v. Commonwealth, 51 Va. App. 459, 467, 658 S.E.2d 708, 712 (2008). At the moment Stickle’s computer was seized he was in possession of each of the files reflected in the charges irrespective of the date they were originally placed there. To protect defendants from being prosecuted multiple times for arbitrary divisions of offenses, the law long ago adopted the rule that “‘a continuing offence . . . can be committed but once, for the purposes of indictment or prosecution.’” In re Nielsen, 131 U.S. 176, 186 (1889) (discussing multiple prosecutions for “unlawful cohabitation,” another continuous offense). Stickle argues that the twenty-two possession with intent to distribute charges should be separated from the three possession charges related to the X folder, but he provides no logical resting place for his argument. Among the questions Stickle’s argument implicitly raises but does not answer are: Is child pornography more easily divisible than cocaine? Should a drug dealer charged with possession of twenty-five grams of cocaine have twenty-five (or more if a smaller unit of measurement is chosen) separate trials? Should a thief be tried separately for every unit of currency or item stolen? The executive branch of government, in the form of the Commonwealth’s Attorney, exclusively controls the charging decision and has wide discretion in doing so, subject only to constitutional or statutory limitations. Stickle’s argument slides easily down a slippery slope which, if adopted, would serve no purpose beyond devastating judicial - 15 -efficiency. Consistent with both Rules 3A:10(c) and 3A:6(b), the offenses here are so interrelated as to constitute part of a common scheme or plan to collect and/or distribute child pornography. Therefore, we conclude that the circuit court did not abuse its discretion in allowing joinder of all the offenses for trial. Stickle alternatively argues that, even if joinder requirements were satisfied, the three videos are so prejudicial that justice requires separate trials. He claims the videos constitute impermissible character evidence and that the circumstances surrounding their creation are factually distinct from those regarding the pornographic images in the shared folder. In weighing the prejudice of evidence against its probative value “We generally defer to trial judges . . . because they, unlike us, participate first person in the evidentiary process and acquire competencies on the subject that we can rarely duplicate merely by reading briefs and transcripts.” Thomas v. Commonwealth, 44 Va. App. 741, 758, 607 S.E.2d 738, 746, adopted upon reh’g en banc, 45 Va. App. 811, 613 S.E.2d 870 (2005) (citing Dandridge v. Marshall, 267 Va. 591, 596, 594 S.E.2d 578, 581 (2004)). Stickle relies on Hackney v. Commonwealth, 28 Va. App. 288, 504 S.E.2d 385 (1998) (en banc), and Long v. Commonwealth, 20 Va. App. 223, 456 S.E.2d 138 (1995), both cases where severance was ultimately required where other crimes evidence was introduced to show possession of a firearm by a convicted felon. The precedent set by these cases is stark but narrow, they are limited to this unfortunately common scenario: “a trial court must sever a charge of possession of a firearm by a convicted felon from other charges that do not require proof of a prior conviction.” Hackney, 28 Va. App. at 295, 504 S.E.2d at 389. This is a sensible rule, as evidence of prior convictions is both highly prejudicial and entirely unrelated to the joined offenses. Evidence in criminal cases is usually prejudicial, otherwise it would not normally be relevant. To render otherwise relevant evidence inadmissible, the probative value of - 16 -the evidence must be substantially outweighed by its prejudicial effect. Va. R. Evid. 2:403. Here, in the context of the charges and the evidence presented, the effect of the pornographic videos is no more prejudicial than an analogous situation where a defendant is on trial for possession of both cocaine and heroin and the evidence is that the cocaine was in his right pocket and the heroin in his left. Moreover, despite Stickle’s protestations to the contrary, the evidence of the videos in which he is featured is directly related to the other charges and highly probative of both his knowledge that child pornography was on his computer and that he intended for child pornography to be distributed. “Evidence of other crimes or convictions may be admitted for the purpose of, among other things, . . . proving a relevant issue or element of the offense charged, such as motive, intent, common scheme or plan, knowledge or identity.” Hackney, 28 Va. App. at 293, 504 S.E.2d at 388 (internal citations omitted). Thus, we find no error in the circuit court’s conclusion that justice did not require severance of the charges involving the videos from the remaining charges. C. Sufficiency of the Evidence Stickle finally argues that the Commonwealth had no actual evidence that he knew the child pornography in the ARES folder was on the laptop and that the Commonwealth is “bootstrapping” knowledge of the three videos which Stickle created into knowledge of the twenty-two other pieces of pornography, despite the fact that they are located on different parts of the computer. “When considering the sufficiency of the evidence to sustain a conviction, we examine the evidence in the light most favorable to the Commonwealth, the prevailing party at trial, granting it all reasonable inferences fairly deducible therefrom.” Jordan v. Commonwealth, 286 Va. 153, 156, 747 S.E.2d 799, 800 (2013) (citing Dowden v. Commonwealth, 260 Va. 459, 461, 536 S.E.2d 437, 438 (2000)). “We will not set aside the trial court’s judgment unless it is ‘plainly wrong or without - 17 -evidence to support it.’” Kelley v. Commonwealth, 289 Va. 463, 468, 771 S.E.2d 672, 674 (2015) (citing Code § 8.01-680). The evidence taken in the light most favorable to the Commonwealth did show that Stickle had roommates at various times who occasionally used his computer. It also showed that his fiancée Mallory had used his computer at least once. However, none of these roommates remained as such during the entire span of time videos were placed on Stickle’s computer. Additionally, Little only began detecting child pornography present at Mallory’s IP address after Stickle moved in with her. All images were within a password-protected user account which also contained the three videos of Stickle himself performing sexual acts with a child. An oft-quoted maxim of our jurisprudence is that “[t]he Commonwealth need only exclude reasonable hypotheses of innocence that flow from the evidence, not those that spring from the imagination of the defendant.” Hamilton v. Commonwealth, 16 Va. App. 751, 755, 433 S.E.2d 27, 29 (1993). Stickle’s contention is entirely unsupported speculation clearly rejected by the jury rather than reasonable inferences flowing from the evidence, and it was unnecessary for the Commonwealth to exclude them. The jury was entitled to reject Stickle’s assertion that for many years an interstate cabal of roommates and fiancées used his computer without his knowledge to store child pornography, and we hold that the evidence was legally sufficient for the jury to instead conclude beyond a reasonable doubt that the child pornography was knowingly possessed and possessed with the intent to distribute by a man with such an interest in child pornography that he created his own videos. - 18 - III. Conclusion Upon review of the record, we find no error in the trial court’s decisions to admit the evidence and to join the charges. We also find that the evidence was sufficient to convict Stickle on all charges. The judgment of the trial court is therefore affirmed. Affirmed. - 19 -