Jaeyoung Lee v. Commonwealth of Virginia

COURT OF APPEALS OF VIRGINIA

Present: Judges Petty, Athey and Senior Judge Frank Argued by teleconference UNPUBLISHED

JAEYOUNG LEE MEMORANDUM OPINION* BY v. Record No. 0869-20-4 JUDGE ROBERT P. FRANK JULY 13, 2021 COMMONWEALTH OF VIRGINIA

FROM THE CIRCUIT COURT OF FAIRFAX COUNTY John M. Tran, Judge

Peter D. Greenspun (Liza Greenspun Yang; Greenspun Shapiro PC, on briefs), for appellant.

Timothy J. Huffstutter, Assistant Attorney General (Mark R. Herring, Attorney General; Robert H. Anderson, III, Senior Assistant Attorney General, on brief), for appellee.

Jaeyoung Lee, appellant, was convicted in a bench trial of one count of possessing child

pornography and ninety-nine counts of possessing child pornography as a second or subsequent

offense in violation of Code § 18.2-374.1:1. On appeal, he contends that the evidence was

insufficient to prove that he knowingly possessed, either actually or constructively, the visual

depictions of child pornography that the police found on three computer hard drive devices. For

the following reasons, we affirm appellant’s convictions.

BACKGROUND

On November 1, 2017, Detective Jon Long and other police officers executed a search

warrant at appellant’s residence at “Unit 435”in an apartment complex in Alexandria.1 Detective

* Pursuant to Code § 17.1-413, this opinion is not designated for publication. 1 The validity of the search warrant or the scope of the search is not before us.

Long explained to appellant that he had a search warrant for his apartment. Long “gave him the option of either staying or leaving.” Appellant walked with Long to Unit 435. Long testified that appellant “stayed outside in the hallway” of the apartment “with his mom while the door remained open” during the search.

The apartment contained one bedroom and one bathroom. The bedroom closet contained men’s clothing but no clothing for women or children. The police found, in a walk-in closet off the bedroom, a LaCie external hard drive for a computer on a shelf behind a pair of pants. Also in the closet was a fingerprint card bearing appellant’s name.

The police found several backpacks of various colors in the apartment. Detective James Lopez testified he found two black Western Digital My Password computer hard drives inside a black and grey backpack.2 Detective Lopez first saw the backpack on a couch in the living room. Within or beside the backpack was a bi-fold folder3 containing appellant’s application with the U.S. Department of Justice Bureau of Alcohol, Tobacco, Firearms and Explosives to build a firearm. The police recovered documents in the closet and living room area relating to appellant, but no one else.

In November of 2017, Detective Nickolas Boffi, who was then a digital forensic examiner for the Fairfax County police, received the hard drives that the police seized from appellant’s apartment. Boffi examined the content of the hard drives. At trial, the Commonwealth introduced diagrams demonstrating the file structure of the three hard drives.

2 These three hard drive devices are the subject of this appeal. 3 Lopez testified that he did not have personal knowledge of where the backpack originally was found, but that he saw a similar looking backpack hanging on the door to the utility room. Concerning Lopez’s testimony, the trial court said, “But I could not give any weight to Detective Lopez as to where those items were found . . . but I could not find from that – from Detective Lopez’s testimony as to where each of – each of the accordion folder or those personal items were actually located.” Nevertheless, the backpack was found in appellant’s living room. -2-

The files on one of the Western Digital hard drives (WD-1) were structured into folders with names such as “tara 8yr old slut,” “LS,” “preteen sluts,” “vicky,” and “candydoll.” There was also a folder titled “preteen sluts child pornstar movies.” Boffi found child pornography files within the designated folders. Boffi testified that anyone who plugged WD-1 into a computer would see the file structure, which was “not hidden.” Additionally, anyone who plugged in the hard drive to a computer would see “preteen sluts child pornstar movies” and “candydoll” in the main folders. A person who clicked on the plus sign next to “preteen sluts child pornstar movies” would access subfolders contained within that main folder that included such titles indicative of child pornography as “tara 8yr old slut,” “vicky,” and “ls models.” All of the child pornography images had been placed on the device on July 25, 2016. The source of the child pornography was a device with a unique identification number with the last digits of “9335-1000.”

Within a folder titled “Sony” on WD-1, Boffi found photographs of appellant. The photographs of appellant were saved to the “Sony” folder on WD-1 on October 26, 2016. The same device used to transfer the child pornography to WD-1, with the final digits of 9335-1000, also was the source of appellant’s personal photographs.

Boffi also examined the second Western Digital hard drive (WD-2). One folder that would be apparent when someone connected WD-2 to a computer was labeled “New Folder,” which contained subfolders of child pornography. One subfolder within “New Folder” was labeled “vcb,” which, in turn, contained a further subfolder titled “Vietnamese Child Brothel.” “Vietnamese Child Brothel” contained pictures of child pornography. WD-2 contained more than 2,700 files, at least some of which were child pornography. Child pornography images were placed on WD-2 on June 4 and 6, 2016, from the device with the final identifying digits of

-3-9335-1000, i.e., the same device that was the origin of the child pornography and the personal photographs of appellant on WD-1.

Upon examination, Boffi found that the LaCie hard drive contained three “partitions,” or separate storage areas. Within “Partition 3,” Boffi found a folder titled “New Folder” containing child pornography. Per Boffi’s testimony, one video of child pornography was placed on the LaCie hard drive on March 24, 2011. The video was saved on the hard drive with the path “\New Folder\preteen sluts child pornstar movies\tara 8 yr old slut\Tara – wants you to f*** her.” The source of the video was a device with a unique identification number ending in “4274-1000.” Boffi testified that the titles of all folders in the file structure on the device, including those relating to child pornography, would be visible when other files or documents were added to the device.

“Partition 3” of the LaCie hard drive contained a “Graduation” folder that included pictures of appellant that were placed on the device on August 18 and 19, 2011. One of the next major folders in the file structure was entitled “Documents,” within which Boffi found various letters from appellant to doctors, as well as a resume associated with appellant. Another folder named “Career” included appellant’s resume, and the “Personal” folder contained other items connected to him. Yet another folder labeled “Pictures” included pictures of appellant as well.

The remaining child pornography on the LaCie device for which appellant was prosecuted was placed there on November 16, 2013. The November 16, 2013 transfer of child pornography was within the main folder titled “New Folder” and under the subfolder “preteen sluts child pornstar movies,” where the previously saved “tara 8 yr old slut\Tara – wants you to f*** her” video had been placed. The pornographic videos and photographs added in 2013 were organized within further subfolders under “New Folder” and subfolder “preteen sluts child pornstar movies” with labels of “tara 8 yr old slut,” “liluplanet Lord of the rings,” “veronica,”

-4-“vicky,” and “vids privat niece.” Moreover, within the subfolder “tara 8 yr old slut,” were separate categories containing pornography labeled “tara 5 yr old” and “new!.” The source of the pornography saved on the LaCie hard drive on November 16, 2013, was the same device from which the pornography saved on March 24, 2011, had originated.

On cross-examination, Boffi elaborated on certain parts of his earlier testimony. The images on the WD-2 hard drive had been modified (or first put on a device) on February 18, 2015 and created (put on that specific hard drive) on June 4 and 6, 2016. The videos4 found on WD-1 were placed on the hard drive on July 25, 2016. Appellant’s personal files including appellant’s pictures had been placed on the WD-1 hard drive on October 26, 2016.

Similarly, child pornography files were stored on WD-2 on June 4, 2016. As for the LaCie hard drive, all but one of the child pornography files had been stored to it on November 16, 2013, and the remaining one had been stored on March 24, 2011. Appellant’s graduation pictures and other personal documents relating to him had been placed on the hard drive on August 18, 2011, and August 19, 2011, i.e., between the dates that the pornography was stored in March 2011 and November 2013.

Finally, Boffi testified that the various subfiles such as “Graduation,” “Career,” and “Personal” would all have been created and named by the user. The user creating such a file folder would see the file structure while doing so. A user downloading a new file to the device would see the entire file structure, including the various references to child pornography.

Testifying as an expert on the identification of child pornography, Detective John Spata stated that three file folders’ titles in the file structure “stood out to” him as consistent with child pornography. Detective Spata reviewed the images contained within one of those folders and

4 Preteen Sluts Child Pornstar Movies. -5-

concluded that it included child pornography. Detective Spata further testified that he found child pornography and appellant’s personal files within the file structures of all three hard drives.

The trial court made certain factual findings in a memorandum opinion, and in a post-trial opinion denying the motion to set aside the verdict, specifically that the apartment in which the hard drives were found belonged to appellant. The trial court observed, “I have what appears to be personal documents identifying it as a place where the Defendant feels comfortable enough to leave such important documents.”

The trial court further found:

I saw that under Exhibit 13 the owner of the photographs is the same owner as some of the pornographic images. It ends with 893351000, which is part of the pornographic.

So - - so the source of this data is the same source as some of the pornography that’s in this case, which is 893351000.

So the - - his personal data being placed and categorized in these hard drives left the Court no doubt, especially because of the size of the pornography that exists in these places, that he knew what was in those hard drives when he downloaded the images.

....

I could not find a reasonable explanation as to why somebody would have three hard drives this size filled with these images that are reflected in the evidence before the Court.

Some of the images, of course, are - - contain videos of a great length of time. And that is the reason why I found that even though this is a constructive possession case that it’s driven by circumstantial evidence.

The circumstantial evidence left no doubt as to the Defendant’s guilt in this case.

The trial judge explicitly found as fact that, irrespective of any challenge to Boffi’s testimony as inconsistent or incredible, “I found the dates of the creation and modification date reliable . . . .”

-6-

In its factual findings, the trial court determined that the LaCie hard drive had been found “out in the open and sitting on top of a shelf in an unlocked closet” while the other two hard drives “were associated with the backpack” that the police found in the apartment. Regarding any claimed deficiencies in the police investigation, the court found that “when it comes to computer related evidence there can be an indicium of trustworthiness that offsets the inaccuracies of human investigation.”

As for the “modified” and “created” dates of the files of child pornography, the trial court found that the normal expectation would be that

an image had to be first created before it could be modified and the date order would be the reverse of what was found. Here, the modified date references the last time the images was [sic] modified within another source and then when copied onto the external hard drive was [sic] “created” in the external hard drive, resulting in the “created” date being the later date.

The trial court further found that “there were two sources of the child pornography that made its way to the three hard drives” and that all but one of the transfers to the LaCie hard drive had taken place on November 16, 2013. Further, the images had come into one primary folder named “New Folder” that contained subfolders with such names as “Preteen Sluts Child Porn Star Movies.” The LaCie hard drive contained photos from appellant’s graduation and other photos from 2010 and 2011. Regarding appellant’s contention at trial that the times in which the transfers had been recorded could have been manipulated, the trial court found that they could be “manipulated to be different than where the transfer actually occurred, however, absent an explanation as to why time zones would be manipulated, it is the consistency of the information overall that lends . . . credence to the data.”

As for the two Western Digital hard drives, again the computer data indicated “a pattern of transfers that speaks to the regularity of the process.” Regarding WD-1, the trial court found

that “the same device that transferred the child pornography . . . was the source of personal -7-

photos taken of the Defendant and placed into the hard drive after the child pornography had been transferred into the external hard drive.” As for WD-2, the court found that the transfers had occurred within two separate time periods, in June 2016.

Finally, the circuit court noted that the folders “were all organized. There was no indication that files were randomly copied into the hard drive without placing them into folders.” Further, WD-1 “had the file names on top. With the exception of a handful of folders, most of the files [on that hard drive] also had names associated with pornography. . . .” And “the number of images and the lengths of the movies suggests that the person who assembled or stored the materials knew what was kept” in the folders. Moreover, “an image with suggestive titles would not be willingly transferred into and kept in an external hard drive or long exist in an external hard drive unless it was placed and stored there knowingly.” The trial court also pointed out that “dates and time stamps constitute circumstantial evidence of the actual transfer dates” and that “it is pure speculation to consider the possibility of an erroneous system clock or the intentional manipulation of the dates and time stamps produced by a computer’s operating system where the manipulation is lacking.”

The trial court found that appellant’s contention that the dates and times the files were created or modified were unreliable was not a reasonable hypothesis of innocence. Further, the files were “easily accessible by clicks on the files . . . and the presence of defendant’s personal photos and papers showed that defendant had access to the stored files.” The trial court also noted that the hard drives “were found separated from any active computer. There is more intentionality with respect to what is kept and stored on such hard drives than in computers which are generally accessible.”

-8-

ANALYSIS

On appeal, appellant argues that the evidence is insufficient to show he knowingly possessed, either actually or constructively, the child pornography found on the three external hard drive devices. Specifically, he contends that there was insufficient evidence to prove the apartment where the hard drives were found was his, that he ever exercised dominion and control over the hard drives, that he knowingly possessed the images, or that any of the backpacks were his.5

“When reviewing the sufficiency of the evidence to support a conviction, the Court will affirm the judgment unless the judgment is plainly wrong or without evidence to support it.” Bolden v. Commonwealth, 275 Va. 144, 148 (2008). The relevant issue on appeal is, “upon review of the evidence in the light most favorable to the prosecution, ‘whether any rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt.’” Pijor v. Commonwealth, 294 Va. 502, 512 (2017) (quoting Dietz v. Commonwealth, 294 Va. 123, 132 (2017)). Thus, “[a]n appellate court does not ‘ask itself whether it believes that the evidence at the trial established guilt beyond a reasonable doubt.’” Commonwealth v. Moseley, 293 Va. 455, 462-63 (2017) (quoting Williams v. Commonwealth, 278 Va. 190, 193 (2009)). “In sum, ‘[i]f there is evidence to support the conviction, the reviewing court is not permitted to substitute its judgment, even if its view of the evidence might differ from the conclusions reached by the finder of fact at the trial.’” Commonwealth v. McNeal, 282 Va. 16, 20 (2011) (quoting Commonwealth v. Taylor, 256 Va. 514, 518 (1998)).

“The sole responsibility to determine the credibility of witnesses, the weight to be given their testimony, and the inferences to be drawn from proven facts lies with the fact finder.”

5 Appellant does not dispute that the 100 images and videos for which he was prosecuted constituted child pornography or that the police found them on the three hard drive devices in question. -9-

Ragland v. Commonwealth, 67 Va. App. 519, 529-30 (2017). “That responsibility lies with the fact finder because ‘[t]his [C]ourt[,] sitting as an appellate court, and knowing nothing of the evidence or of the witness, except as it appears on the paper, . . . [is] incompetent to decide on the credibility of the testimony.’” McNeal, 282 Va. at 22 (quoting Brown v. Commonwealth, 29 Va. (2 Leigh) 769, 777 (1839)). Furthermore, when considering witness testimony, the fact finder is not required to believe all aspects of a witness’s testimony; it may accept some parts as believable and reject other parts as implausible. See id. Inconsistent or contradictory statements by a witness do not render his or her testimony incredible, and the trier of fact is entitled to rely upon that witness’s testimony in convicting a defendant. See Swanson v. Commonwealth, 8 Va. App. 376, 378-79 (1989). Further, it is within the province of the trier of fact to draw inferences from the proven evidence, and its inferences are binding so long as they are reasonable and justified. See Commonwealth v. Hudson, 265 Va. 505, 514 (2003).

A conviction may be based on circumstantial evidence. See id. at 512. “Circumstantial evidence, if sufficiently convincing, is as competent and entitled to the same weight as direct testimony.” McCain v. Commonwealth, 261 Va. 483, 493 (2001). This Court does not “view[] [circumstantial evidence] in isolation.” Kelly v. Commonwealth, 41 Va. App. 250, 259 (2003) (en banc). Rather, the “combined force of many concurrent and related circumstances, each insufficient in itself, may lead a reasonable mind irresistibly to a conclusion.” Dowden v. Commonwealth, 260 Va. 459, 470 (2000) (quoting Stamper v. Commonwealth, 220 Va. 260, 273 (1979)).

When assessing whether the circumstantial evidence excludes a reasonable hypothesis of innocence, the Commonwealth “need only exclude reasonable hypotheses of innocence that flow from the evidence, not those that spring from the imagination of the defendant.” Simon v. Commonwealth, 58 Va. App. 194, 206 (2011) (quoting Hamilton v. Commonwealth, 16

- 10 -Va. App. 751, 755 (1993)). “The reasonable-hypothesis principle . . . is ‘simply another way of stating that the Commonwealth has the burden of proof beyond a reasonable doubt.’” Moseley, 293 Va. at 464 (quoting Hudson, 265 Va. at 513). “[T]he factfinder determines which reasonable inferences should be drawn from the evidence[] and whether to reject as unreasonable the hypotheses of innocence advanced by a defendant.” Id. “Whether an alternate hypothesis of innocence is reasonable is a question of fact and, therefore, is binding on appeal unless plainly wrong.” Holloway v. Commonwealth, 57 Va. App. 658 (2011) (en banc) (quoting Archer v. Commonwealth, 26 Va. App. 1, 12-13 (1997)).

Under Code § 18.2-374.1:1(A) and (B), “[a]ny person who knowingly possesses child pornography is guilty of a Class 6 felony,” and any second or subsequent such offense is a Class 5 felony. On brief, appellant correctly cites to authorities analogizing the constructive possession issue here with constructive possession cases involving drugs. See Kobman v. Commonwealth, 65 Va. App. 304, 307 (2015); Terlicki v. Commonwealth, 65 Va. App. 13, 24-25 (2015). The principles governing a sufficiency claim involving proof of the defendant’s constructive possession of contraband are equally well-settled. To convict a defendant for constructive possession, “the Commonwealth must point to evidence of acts, statements, or conduct of the accused or other facts or circumstances which tend to show that the defendant was aware of both the presence and character of the [contraband] and that it was subject to his dominion and control.” Terlecki, 65 Va. App. at 24 (quoting Drew v. Commonwealth, 230 Va. 471, 473 (1986)). “Ownership or occupancy of the premises on which the contraband was found is a circumstance probative of possession.” Id. (quoting Kromer v. Commonwealth, 45 Va. App. 812, 819 (2005)).

We first address appellant’s contention that the evidence was insufficient to prove that the police found the hard drive devices in appellant’s own apartment. We disagree. The trial

- 11 -court found that the apartment belonged to appellant. The trial court observed, “I have what appears to be personal documents identifying it [the apartment] as a place where the [appellant] feels comfortable enough to leave such important documents.” Inside the apartment the police found appellant’s application to build a firearm, his fingerprint card, photographs of appellant, correspondence by appellant, and appellant’s resume. There was no indication that anyone other than appellant lived at the apartment.

Further, Detective Long told appellant that the police had a warrant to search his apartment. Appellant then walked with Long to Unit 435. Although given the option to leave, appellant remained in the hallway outside the apartment with his mother during the hours that the search was underway. Appellant would have had no reason to linger outside during the search if the apartment was not his. The evidence thus supports the trial court’s finding of fact that the apartment belonged to appellant.

Nonetheless, the Commonwealth was required to prove that appellant knowingly possessed the child pornography on the devices found in his apartment and that the contraband was subject to his dominion and control. “While this appears to be a case consigned to the new and evolving area of computer technology, we examine this case under familiar principles of constructive possession of contraband.” Kromer, 45 Va. App. at 818. “We do not need to determine whether appellant was the person” who saved the child pornography to the three devices but, “rather, we determine whether appellant knew the images existed and, if so, did he exercise dominion and control over them” after they were placed on the devices. Id.

In Kobman, 65 Va. App. at 308, this Court found the evidence insufficient to prove that the defendant constructively possessed images of child pornography found in the “unallocated space” of computers seized from his home. We found that “[n]o evidence established [the defendant] had access to or used the required forensic software necessary to retrieve the deleted

- 12 -photographs” from the unallocated space. Id. “Further, no evidence showed other indicia of knowledge, dominion, or control of the forty-five photographs found in the unallocated space on the specific date of the indictments.” Id. We reached a different conclusion regarding nine images found in the recycle bin of appellant’s computer, however. “Expert testimony established that computer users can access and control files placed by the user into the recycle bin. [The defendant] made statements indicating what the police were looking for, as reflected in the search warrant, could be found ‘in the computer.’” Id. at 310. Considering the totality of the evidence, we found that evidence sufficient to prove that the defendant “was aware of the presence of the nine illicit photographs in the recycle bin and that he exercised dominion and control over the contraband.” Id.

The issue of constructive possession of contraband is “largely a factual one.” Raspberry v. Commonwealth, 71 Va. App. 19, 30 (2019) (quoting Ritter v. Commonwealth, 210 Va. 732, 743 (1970)). We find that, when the facts and circumstances of this case are considered as a whole, a reasonable finder of fact could conclude beyond a reasonable doubt that appellant constructively possessed the child pornography on the three devices found in his apartment.

Concerning the LaCie hard drive, Boffi testified that a video containing child pornography was saved to the device on March 24, 2011. The pornography was deliberately placed within Partition 3 of the device, under “My Folder” and subfolders “preteen sluts child pornstar movies” and “tara 8 yr old slut.” Six months later, personal photographs of appellant were placed within Partition 3 of the device in the folder entitled “Graduation.” Other photographs and personal documents of appellant were located in other folders in Partition 3. The evidence demonstrated that the file structure of the device, which included file names indicative of child pornography, was not hidden and would be visible to anyone accessing the device. In 2013, numerous items of child pornography were added to the LaCie device within

- 13 -the same path of the prior video and into the previously created “preteen sluts child pornstar movies” subfolder. The source for the 2013 child pornography was the same as the origin of the 2011 visual depiction.

The evidence concerning the two Western Digital hard drive devices was even more intertwined. On two occasions in June 2016, child pornography was placed on WD-2 under “New Folder” in subfolder “vcb” and further subfolder “Vietnamese Child Brothel.” About one month later, and from the same source as the pornography placed on WD-2, numerous videos of child pornography were added to “New Folder” of WD-1 under the title “preteen sluts child pornstar movies,” the same subfolder title found on the LaCie device. Significantly, personal photographs of appellant were placed on WD-1 on October 26, 2016, from the same source of the child pornography previously saved on both WD-1 and WD-2. As with the LaCie hard drive, a person accessing the two Western Digital hard drives for an innocent purpose, such as saving his personal photos or documents, would necessarily see the titles of folders that already resided there and indicated that they contained child pornography.

As the trial court stated, the folders of child pornography were “organized,” and there was no indication that “files were randomly copied into the hard drive without placing them into folders.” We agree with the trial court’s assessment that “the number of images and the lengths of the movies suggest that the person who assembled and stored the material into the hard drives knew what was kept.” See United States v. Yarrington, 634 F.3d 440, 450 (8th Cir. 2011) (evidence sufficient to sustain conviction for possessing child pornography on a hard drive, which contained 168 images of child pornography organized into five separate folders, that also included the defendant’s personal photos).

- 14 -

We find no evidence in the record to support appellant’s claim that the digital information was incorrect and that the files could have been manipulated. We thus do not disturb the trial court’s finding of fact that appellant’s hypothesis of innocence in this regard was not reasonable.

CONCLUSION

In sum, the direct and circumstantial evidence supports the factfinder’s conclusions that appellant knew of the child pornography on the hard drive devices, that it was subject to his dominion and control, and that he constructively possessed it. Accordingly, we do not disturb appellant’s convictions.

Affirmed.

- 15 -