United States v. Russell Hudson Cullen

Case: 17-14913 Date Filed: 11/21/2019 Page: 1 of 11

[DO NOT PUBLISH]

IN THE UNITED STATES COURT OF APPEALS

FOR THE ELEVENTH CIRCUIT ________________________

No. 17-14913 ________________________

D.C. Docket No. 4:16-cr-10043-KMM-1

UNITED STATES OF AMERICA,

Plaintiff–Appellee,

versus

RUSSELL HUDSON CULLEN,

Defendant–Appellant.

________________________

Appeal from the United States District Court for the Southern District of Florida ________________________

(November 21, 2019)

Case: 17-14913 Date Filed: 11/21/2019 Page: 2 of 11 Before MARTIN, TJOFLAT, and PARKER, * Circuit Judges. PER CURIAM:

Appellant Russell Hudson Cullen appeals from a judgment of conviction in the United States District Court for the Southern District of Florida. We assume familiarity with the facts, procedural history, and issues on appeal.

BACKGROUND

The Department of Homeland Security (“DHS”) uses the Child Protection System (“CPS”) investigative software to search the internet for computers that contain child pornography. CPS uses keywords associated with child pornography, searches the internet, and downloads files that it finds. It then keeps a large database of known child pornography videos’ “hash values,” which are unique indicators associated with each individual video. According to expert testimony at trial, CPS identified hundreds of hash values corresponding to child pornography that had been downloaded through Shareaza—a peer-to-peer sharing software—to multiple IP addresses associated with Cullen. Some of these files had been downloaded completely while others had been downloaded only partially. In January 2016, Special Agent Elliott Graves requested an image of child pornography from Cullen’s IP address and the associated computer automatically sent him the file. In March

* Honorable Barrington D. Parker, United States Circuit Judge for the Second Circuit, sitting by designation.

Case: 17-14913 Date Filed: 11/21/2019 Page: 3 of 11 2016, DHS obtained a warrant and searched Cullen’s residence. The agents retrieved an Asus laptop computer and a LaCie external hard drive.

When the Cyber Crimes Center extracted the contents of the LaCie hard drive, they found various documents bearing Cullen’s name as well as child pornography—specifically a video of two young girls displaying their genitalia. The video had been found in “unallocated space” in the hard drive, which means that it had been previously deleted. Special Agent Daniel Kenney was able to play the recovered video and, at trial, two screenshots from the video were introduced into evidence. A forensic analyst determined that the Asus laptop had been reformatted multiple times, relegating certain files to unallocated space on the laptop. From this space, Lumbert retrieved four images depicting child pornography. Lumbert found an additional 14 images in a “cache file” that had been created after a thumb drive was inserted into the computer to upload files.

Cullen was charged with one count of accessing with intent to view, two counts of possession, and one count of distribution of child pornography. Cullen proceeded to and testified at trial. His defense was that he had been addicted to adult pornography for many years but had never searched for child pornography on any of his computers. He testified that he would download thousands of video files in bulk, searching only for adult pornography, and then open them later to sift through potential options. He admitted that he downloaded and viewed child pornography

Case: 17-14913 Date Filed: 11/21/2019 Page: 4 of 11 but explained that he had done so by accident. When that occurred, he would delete the files, and in instances where the pornography was particularly shocking, he would immediately reformat his computer to remove any trace of the files from his computer. Cullen also testified that he had never allowed any type of sharing of pornography from his computer and that he had “deselected” all files that could be shared, thus ensuring that none of them were available for download by other Shareaza users. He testified that he had no idea how agents were able to obtain child pornography from his computer.

During trial, Agent Kenney identified the LaCie hard drive that was seized from Cullen’s home, but he noted that the hard drive serial number he recalled differed from the serial number noted on the Government’s exhibit list. He nevertheless testified that he “absolutely” recognized it both by the serial number on the hard drive itself and the external case that accompanied it. The court, over Cullen’s objection, admitted the hard drive. In February 2017, the jury found Cullen guilty on all counts.

Probation determined that Cullen’s base offense level was 22. It recommended a multitude of enhancements, increasing the offense level to 37. In particular, two levels were added for the knowing distribution of child pornography and five levels were added because the offense involved 600 or more images of child pornography. Because Cullen had no criminal history points, his offense level of 37

Case: 17-14913 Date Filed: 11/21/2019 Page: 5 of 11 corresponded to a guidelines range of 210 to 262 months. He also faced a mandatory minimum sentence of five years and an authorized maximum sentence of 80 years. Cullen argued that he did not knowingly distribute child pornography. He also argued that only one video (which corresponded to 75 images) and 18 photographs— 93 images in total—were involved in his offense conduct, and thus only a two-level and not a five-level enhancement was warranted. The District Court rejected both arguments and sentenced Cullen to 240 months’ imprisonment, adopting the recommendation of the Probation Office. In addition, the Court stated on the record that it would have imposed the same sentence had only the two-level and not the five-level enhancement properly applied.

DISCUSSION

Sufficiency of Evidence

The reversal of a conviction for insufficient evidence is warranted only if no reasonable jury could find proof of guilt beyond a reasonable doubt. United States v. Thomas, 8 F.3d 1552, 1556 (11th Cir. 1993).

Possession and Access

The evidence that Cullen possessed and accessed child pornography was overwhelming. Child pornography was found in unallocated space on his computer and hard drive and an investigation of Cullen’s computer indicated that a thumb drive had been used to upload additional pornographic images onto his computer.

Case: 17-14913 Date Filed: 11/21/2019 Page: 6 of 11 Further, full and partial downloads of hundreds of child pornography videos and images were linked to a series of IP addresses all associated with Cullen. We find this evidence sufficient to support his convictions.

Distribution

In United States v. Carroll, 886 F.3d 1347 (11th Cir. 2018), which involved peer-to-peer sharing software, a jury convicted the defendant of distributing child pornography after he had downloaded hundreds of images and videos from a peer-to-peer sharing platform called Ares. Id. at 1349. Ares functions in the same way as Shareaza, the peer-to-peer software in this case:

When downloaded, Ares sets up a shared folder on the computer where, by default, it automatically places all subsequent downloads. Once a file is placed in the shared folder, it is immediately available for further dissemination. Unless an Ares user changes the default settings or deliberately moves files out of the shared folder, downloaded files will remain freely accessible to anyone else on the Ares network . . . .

Id. at 1350.

We reversed the conviction in Carroll based on insufficient evidence because “[n]othing in the record demonstrate[d] that Carroll intended to share files or that he was even aware that the contents of his Ares folder were automatically distributed to the peer-to-peer network.” Id. at 1353. We rejected the Government’s argument that the defendant “was guilty of knowing distribution simply because he was using a peer-to-peer file sharing program and ‘that is what it is.’” Id. at 1353. We explained that “the fact that files were automatically shared from [the defendant’s]

Case: 17-14913 Date Filed: 11/21/2019 Page: 7 of 11 Ares folder, without some evidence of his awareness of it, cannot carry the government’s burden to prove knowing distribution beyond a reasonable doubt.” Id. at 1353–54. The basis of our reasoning was that “Ares, by default, installs a shared folder, automatically places downloaded files into that folder, and distributes all contents of the shared folder to anyone else on the Ares network without prompting the user—even when the user is away from his computer.” Id. at 1354. In response to the Government’s argument that “it would be impossible for an individual to use a peer-to-peer file sharing program and lack a full understanding of its operations,” we noted that it was “unwise to adopt such a sweeping rule in this fact-sensitive context, where the mechanics of each peer-to-peer program may bear on the issue of knowledge in different ways.” Id.

Generally, courts should be cautious in their approach to distribution charges brought in the peer-to-peer software context. Peer-to-peer software runs on the sharing of downloaded files. If users do not proactively disable all sharing upon installing the software, their files will be shared indefinitely without their awareness and even when they have stepped away from their computer. The software also intentionally makes it difficult for the average user to manage which of their files are being shared at any given moment, often obscuring instructions for disabling sharing, as is the case with Shareaza. Given the nature of this software, courts should

Case: 17-14913 Date Filed: 11/21/2019 Page: 8 of 11 focus with particular care on whether distribution on peer-to-peer software was done knowingly.

In this case, however, Carroll does not compel a reversal because Cullen testified that he understood how Shareaza’s automatic sharing function operated. Specifically, the Government, in cross-examination, asked Cullen: “You talked about—I know you have used file-sharing for a long time, and you’ve talked about when you first used file-sharing devices all that time ago. You learned that when you set it up you had to deselect folders? Do you remember that?” In response, Cullen answered, “Absolutely, have to, have to.” Furthermore, without prompting, Cullen stated: “But always, always, always make sure . . . [to] deselect every [downloaded file] because if you leave even one up, there are people with software [who] will be able to access all of your computer. This is what I was told.” Based on Cullen’s statements evincing an understanding of Shareaza’s automatic sharing features and the testimony from Graves that he successfully downloaded child pornography from Cullen’s IP address, we find the evidence sufficient to support Cullen’s conviction.

Admissibility of LaCie Hard Drive

We review for an abuse of discretion the District Court’s rulings on the admissibility of evidence. United States v. Shabazz, 887 F.3d 1204, 1216 (11th Cir. 2018). “To satisfy the requirement of authenticating or identifying an item of

Case: 17-14913 Date Filed: 11/21/2019 Page: 9 of 11 evidence, the proponent must produce evidence sufficient to support a finding that the item is what the proponent claims it is.” Fed. R. Evid. 901.

Cullen argues that the testifying witness, Kenney, could not identify the LaCie hard drive seized during the execution of the search warrant. To be sure, Kenney noticed that the serial number on the hard drive did not include the last four digits of the serial number listed on the Government’s exhibit list. Notwithstanding the confusion as to the serial number, the District Court did not abuse its discretion in admitting the hard drive. Kenney was able to identify the hard drive by its external casing and was able to identify most of the digits on the serial number. He also testified that he was “absolutely” certain that the hard drive offered into evidence was the same hard drive as was seized from Cullen’s home. Kenney’s identification, taken together with the evidence that the hard drive contained child pornography along with Cullen’s tax form, Cullen’s resume, and Cullen’s job application, demonstrates that the Government produced “evidence sufficient to support a finding that the item is what the proponent claims it is.” See Fed. R. Evid. 901.

Sentencing Enhancements

“We review a district court’s choice of sentence . . . for abuse of discretion, determining if the sentence was procedurally in error or substantively unreasonable. United States v. Trapp, 396 F. App’x 671, 672 (11th Cir. 2010). “When the government seeks to apply an enhancement under the Sentencing Guidelines over a

Case: 17-14913 Date Filed: 11/21/2019 Page: 10 of 11 defendant’s factual objection, it has the burden of introducing ‘sufficient and reliable’ evidence to prove the necessary facts by a preponderance of the evidence.” United States v. Washington, 714 F.3d 1358, 1361 (11th Cir. 2013).

Knowing Distribution

The Guidelines authorize a two-level enhancement “if the defendant knowingly engaged in distribution.” U.S.S.G. § 2G2.2(b)(3)(F). For the reasons discussed above, the District Court did not abuse its discretion in imposing a two-level enhancement, given that Cullen admitted to fully understanding Shareaza’s automatic sharing features.

Number of Images Involved in the Offense

The Guidelines authorize a five-level enhancement if the offense involved “600 or more images.” U.S.S.G. § 2G2.2(b)(7)(D). In determining the number of images, “[e]ach video, video-clip, movie, or similar visual depiction shall be considered to have 75 images.” Id. cmt. app. n. 6(B)(ii).

Cullen argues that his offense involved only the 18 images and one video recovered from his laptop—a total of 93 images under the Guidelines. Cullen thus argues that he should have only received a two-level enhancement because his offense involved “fewer than 150” images. See U.S.S.G. § 2G2.2(b)(7)(A). The District Court, however, considered 27 videos that were fully downloaded to IP addresses associated with Cullen as reflected on the CPS database. These 27 videos

Case: 17-14913 Date Filed: 11/21/2019 Page: 11 of 11 corresponded to 2,025 images under the Guidelines, but they had never actually been found on Cullen’s devices. Still, the Government has demonstrated, by a preponderance of evidence, that these videos were involved in Cullen’s offense. They were linked to his IP addresses, they matched the hash values for known child pornography, and they had been fully downloaded into his computer. While they were not found on the physical devices seized from his home, the District Court reasonably inferred that Cullen had deleted them, especially given his testimony that he routinely reformatted his computer. The District Court thus did not abuse its discretion in imposing the five-level enhancement.

CONCLUSION

We have considered Cullen’s remaining arguments and find them to be without merit. For the foregoing reasons, the judgment is AFFIRMED.