Michael Fields v. Commonwealth of Kentucky

RENDERED: OCTOBER 28, 2021 TO BE PUBLISHED

Supreme Court of Kentucky 2019-SC-0663-DG

MICHAEL FIELDS APPELLANT

ON REVIEW FROM COURT OF APPEALS V. NO. 2017-CA-1980 SCOTT CIRCUIT COURT NO. 10-CR-00190

COMMONWEALTH OF KENTUCKY APPELLEE

OPINION OF THE COURT BY JUSTICE HUGHES

AFFIRMING

An investigation by the Office of the Attorney General cybercrimes unit led investigators to discover child pornography files on Michael Fields’s desktop computer and external hard drive. After a jury trial he was convicted of four counts of possession of matter portraying a sexual performance by a minor, Kentucky Revised Statute (KRS) 531.335, and sentenced to ten years in prison by the Scott Circuit Court. On appeal, the Court of Appeals found no error and affirmed. Fields contends that the trial court improperly disqualified his sole expert witness, erred by denying his motion for directed verdict, and impermissibly admitted various photos and reports as evidence. On discretionary review, this Court concludes that the trial court committed no reversible error and thus affirms the judgment.

FACTS AND PROCEDURAL HISTORY

Fields used Limewire, a now-defunct file-sharing program, to download and share music, videos and images. His goal was to acquire over 10,000 songs. In downloading files, Fields also amassed several thousand clips of adult pornography. According to Fields, if another Limewire user had music he liked, he would download every file in the other user’s library—Fields did not preview or search through the entire library prior to downloading. Instead, Fields used the “select all” command to highlight all the user’s files and hit the download button, downloading hundreds of files at a time. Fields intended to sort and catalogue the files later—retaining the files he wanted and deleting the others—but he was downloading so many files it became difficult to keep up. Fields steadfastly maintains that he had no idea child pornography was amongst the thousands of files he downloaded from Limewire. He was aware of the adult pornography, some of which he viewed with his wife.

In January 2010 Investigator Tom Bell of the cybercrimes branch of the Attorney General’s office investigated online computers that were advertising, via peer-to-peer networks, that they had files available for sharing that matched known signatures of child pornography. Bell identified an IP address advertising approximately 156 files with these known child pornography signatures.¹ The IP address, which belonged to Fields, was using the file-*3 sharing software Limewire. Bell executed a search warrant at Fields’s home in March 2010, seizing a laptop from the living room, a desktop computer from the bedroom, an external hard drive and numerous CDs and DVDs. An initial forensic examination of Fields’s computers and external hard drive tagged 126 images and 41 videos as suspected child pornography. On September 3, 2010 a Scott County grand jury indicted Fields on 105 counts of possession of matter portraying a sexual performance by a minor. Given how long the case had been pending, prior to the 2017 trial Bell conducted a supplemental examination of Fields’s computers and external hard drive and concluded that the devices contained 48 images and 7 videos of child pornography.² He explained that his supplemental review revealed that some of the images and videos did not meet the child pornography criteria, citing reasons such as the questionability of the subject’s age, the subject being clothed, or the absence sexual activity. The indictment was later amended on May 5, 2017 to ten counts, two counts related to videos and eight counts related to images.

Fields was originally represented by private counsel. In 2014 private counsel obtained an order from the Scott Circuit Court allowing a computer expert to conduct an independent forensic examination of Fields’s two *4 computers. Over a year passed, and private counsel withdrew, citing differences with Fields as to trial strategy and communication. The Department of Public Advocacy was subsequently appointed to represent Fields. One month before trial, the trial court granted defense counsel’s motion for funding to hire a computer expert for Fields. This expert was a different expert than the one hired by private counsel; it is unclear whether private counsel’s expert ever examined Fields’s computers.

At trial the Commonwealth’s sole witness was Investigator Bell. Bell explained how peer-to-peer file sharing programs like Limewire work, namely that users make files available to other users. Bell noted that the files forming the basis for the indictment had titles containing child pornography buzzwords, like “Lolita,” “kiddie,” “pthc,”³ “pedo,” and others. He also acknowledged that titles for non-pornography files sometimes included these terms. Bell testified that he conducted a forensic review of Fields’s computers,⁴ but found no evidence that Fields performed searches using child pornography terms. Instead, the data obtained from Fields’s computer was consistent with bulk downloading. Because the evidence did not show that Fields was specifically *5 seeking out child pornography on Limewire, the Commonwealth’s case hinged on whether Fields knew that his large collection of downloads contained child pornography. The testimony established that file titles are often misleading and inaccurate, so to “know” that he had child pornography, Fields would have had to preview or open the files on his desktop computer.⁵

The Commonwealth introduced Exhibits 1-10, which were either images or videos of suspected child pornography that corresponded with Counts 1-10 of the indictment. The Commonwealth introduced each image by having Bell read the file name before briefly displaying the image or video to the jury.

Investigator Bell’s evidence on Fields’s file viewing was primarily circumstantial. He testified that Fields used Real Player, Windows Media Player, and other video and image viewing programs to open files with provocative names, some of which included child pornography buzzwords. But, on cross-examination, Bell admitted that none of the provocatively named files viewed with those programs were necessarily child pornography.⁶

In a final effort to prove that Fields knew he had child pornography, on the second day of trial, Bell provided the Commonwealth with a new exhibit extracting highly technical information from his previously provided report. As to the images that formed the basis for Counts 2, 4, 6 and 9, Bell testified that Fields’s computer history reflected that those files had been opened. In support of that assertion, Bell noted that Fields’s File Explorer history logged those four files with the prefix “file:///C:.” The File Explorer in Windows allows a user to view the information on their computer in a hierarchical structure of drives, folders and files. If the preview pane feature of File Explorer is enabled a user can quickly preview a file, such as a photo, without opening it by single clicking on the file’s name or icon.⁷ Bell testified that the three-forward-slash prefix meant that the files had been “opened.”

On cross-examination, Bell backtracked slightly, acknowledging that he could not prove that Fields “opened” the four files in the traditional sense – none of the files were opened in the video or image viewing programs, such as Windows Media Player and Photo Viewer, that the computer would use by default to open image or video files. Instead, Bell posited that the three-forward-slash prefix meant that Fields viewed the child pornography files with File Explorer’s preview pane. Fields attempted to refute this theory with information from Bell’s report showing that Fields’s computer history logged a three-forward-slash prefix for multiple items in relatively quick succession – *7 ten seconds, twenty seconds, etc. But Bell adamantly insisted that the three-forward-slash prefix proved that Fields personally interacted with the files, giving him knowledge of their contents.

In an effort to counter Bell’s testimony, Fields attempted to present his own computer forensics expert, Matthew Considine from Cyber Agents, Inc. While testifying about his qualifications, Considine admitted that he had not previously performed a forensic evaluation of a computer involving Limewire during his professional career. However, Considine testified that he had a four-year degree in digital forensics and had two class sessions about Limewire during his education. He also testified that he had personal experience using the program “as a child.” Based on Considine’s lack of professional experience involving Limewire, the trial court sustained the Commonwealth’s objection to him testifying as an expert and excluded his testimony. Fields subsequently presented Considine’s testimony by avowal, testimony which focused on Limewire and the discrepancy between file titles and their actual contents. Considine also discussed how users can search for files and that irrelevant results often appear while searching. Importantly, Fields’s counsel failed to ask Considine anything about Bell’s report, the three-forward-slash prefix’s meaning in Windows, or how the File Explorer in Windows functions.

Based on the above-described testimony, the jury convicted Fields of knowingly possessing the four child pornography files that Bell testified were logged with the three forward slashes and therefore “viewed” by Fields. After the verdict, Fields hired private counsel who represented him in post-trial *8 proceedings and at sentencing. The trial court sentenced Fields to two and one-half years on each count, to run consecutively, for a total sentence of ten years in prison.

ANALYSIS

Fields presents four arguments: the trial court (1) improperly denied a directed verdict; (2) erred in excluding Matthew Considine as an expert witness; (3) improperly admitted various exhibits, and (4) improperly admitted the ten images and videos that formed the basis of the ten-count indictment.

I. The trial court properly denied Fields’s motion for directed verdict.

Fields argues the trial court erred in denying his motion for directed verdict, asserting that his “knowing possession” of the child pornography files was wholly unsupported.8 Possession of matter portraying a sexual performance by a minor is defined by KRS 531.335(1):

On appeal to the Court of Appeals, the Commonwealth stated that it was 8

unclear from the record whether the directed verdict issue was properly preserved. While the Commonwealth does not make that argument to this Court, we note the Court of Appeals’ discussion regarding preservation: The record before us does not contain Fields’s initial motion for directed verdict. The video recording in the record cuts off at the close of the Commonwealth’s case. At that time, the court dismissed the jury and informed the parties that the court was taking a break “so you [Fields] can go ahead and make your motion.” The recording of the proceedings resumes with the defense calling its first witness, Donna Fields. However, at the close of all evidence, Fields stated to the trial court that he was renewing his motion for directed verdict and argues that no fact finder could determine the “knowingly” element required by KRS 531.335 based on the sheer number of files that Fields had downloaded. Therefore, we treat the issue as preserved for appeal. A motion for a directed verdict made at the close of the Commonwealth’s case is not sufficient to preserve error unless renewed at the close of all the evidence.

A person is guilty of possession or viewing of matter portraying a sexual performance by a minor when, having knowledge of its content, character, and that the sexual performance is by a minor, he or she:

(a) Knowingly has in his or her possession or control any matter which visually depicts an actual sexual performance by a minor person; or (b) Intentionally views any matter which visually depicts an actual sexual performance by a minor person.

Fields was indicted under subsection (a), which criminalizes the possession of such material, not the viewing of the material. “Sexual performance” means sexual conduct by a minor, which includes “[t]he exposure, in an obscene manner, of the unclothed . . . female genitals, pubic area or buttocks, or the female breast . . . .” KRS 531.300. The images that formed the basis for Counts 2, 4, 6 and 9 undoubtedly meet these statutory requirements.

A trial court’s ruling on a motion for directed verdict is reviewed under the following standard:

On a motion for directed verdict, the trial court must draw all fair and reasonable inferences from the evidence in favor of the Commonwealth. If the evidence is sufficient to induce a reasonable juror to believe beyond a reasonable doubt that the defendant is guilty, a directed verdict should not be given. For the purposes of ruling on the motion, the trial court must assume that the evidence for the Commonwealth is true, but reserving to the jury questions as to the credibility and weight to be given to such testimony. On appellate review, the test of a directed verdict is, if under the evidence as a whole, it would be clearly unreasonable for a jury to find guilt, only then the defendant is entitled to a directed verdict of acquittal.

Fields v. Commonwealth, No. 2017-CA-001980-MR, 2019 WL 3851636, *1, *3 n.11 (Ky. App. August 16, 2019) (citing Kimbrough v. Commonwealth, 550 S.W.2d 525, 529 (Ky. 1977)).

Hunter v. Commonwealth, 587 S.W.3d 298, 310 (Ky. 2019) (quoting Commonwealth v. Benham, 816 S.W.2d 186, 187 (Ky. 1991)). Based on the testimony presented at trial, it was not clearly unreasonable for the jury to find Fields guilty.

In Crabtree v. Commonwealth, 455 S.W.3d 390, 394 (Ky. 2014), the defendant was convicted of sixty-seven counts of possession of matter portraying a sexual performance by a minor, KRS 531.335, for partially downloaded pornography videos and images found on his computer. This Court discussed the necessary evidence in cases involving KRS 531.335:

the essential elements are (1) knowingly having possession or control (2) of a visual depiction (3) of an actual sexual performance by a minor, and (4) having knowledge of its contents. The statute contains two separate mental states: the defendant must know the content of the images and videos (i.e., that they depict a sexual performance by a minor) and the defendant must knowingly possess the images or videos.

Id. at 396. We explained that “[t]he crime requires only the knowing possessing of child pornography, regardless of the purpose. The mens rea requirements of KRS 531.335 are satisfied by showing that the defendant knew the videos were child pornography and that he knowingly possessed them.” Id. at 402. Thus in the case before us the issue is whether sufficient proof was offered that Fields knew the four images for which he was convicted were child pornography and that he knowingly possessed them.

We first consider whether there was sufficient proof that Fields had knowledge of the content of the four photos. As noted, the Commonwealth’s proof was presented through Bell’s expert testimony. Bell explained how peer-*11 to-peer file-sharing programs, like Limewire, work, namely that users make files available to other users. Bell noted that the files that were the basis for Fields’s indictment had lewd titles, containing child pornography buzzwords like “Lolita,” “kiddie,” “pthc,” “pedo,” and others. However, Bell admitted that titles for non-child-pornography files sometimes include these terms.

Bell testified that he conducted a forensic review of Fields’s computer, but found no evidence that Fields performed searches using child pornography terms. Instead, the data obtained from Fields’s computer was consistent with bulk downloading. Under KRS 531.335, the Commonwealth’s case rested in part on whether Fields knew that his large collection of Limewire downloads contained child pornography. Because file titles are often misleading and inaccurate, to “know” that he had child pornography, Fields would have had to open or preview the files on his desktop computer.

Bell’s evidence on Fields’s file viewing was largely circumstantial. He primarily relied on the three-forward-slash theory to posit that Fields viewed the four files he was ultimately convicted of possessing. On the second day of trial Bell provided the Commonwealth with a new exhibit extracting highly technical information from his previously provided report. As to the images that formed the basis for Counts 2, 4, 6 and 9, Bell testified that Fields’s computer reflected that those files had been opened. While he backtracked slightly on cross-examination by noting that he could not prove that Fields “opened” the files in a traditional sense because they were not opened in photo *12 or video applications or programs, he still rested on the three-forward-slash theory to support his assertion that Fields viewed the files in some way.

Attempting to refute Bell’s theory about the files being viewed, Fields highlighted additional information from Bell’s report showing that many other presumably non-offending files were “opened” within just a minute of each other. Bell acknowledged that many files were opened in a short amount of time. This is consistent with Fields’s testimony that if any child pornography was on his computer, it was not “knowingly” because it was part of a bulk download of other material. Nevertheless, Bell insisted that the three-forward-slash prefix proved that Fields personally interacted with the child pornography files, giving him knowledge of their contents.

Fields testified at trial and maintained that the images and videos underlying the indictment were downloaded through Limewire unbeknownst to him. He testified that he used Limewire to obtain music and adult pornography. He stated that if he saw that another Limewire user had music that he liked, he would simply download every file that the user had available, including adult pornography. Fields denied having any knowledge that child pornography was also downloaded with the music and adult pornography. He stated that he “didn’t really pay attention” to file names and that he “didn’t see anything that alarmed” him. He asserts that he was unaware of the presence of child pornography on his computer. Despite initially arguing in a pretrial hearing that the images were merely “erotica” or did not depict individuals *13 under the age of eighteen, Fields no longer contests that the files underlying the indictment constitute child pornography.

Fields contrasts his case to Crabtree, arguing that he did not purposefully download files that he knew contained child pornography and the record reflects nothing else proving that he had knowledge of the contents of the files. He testified that he did not read the individual file titles because he downloaded items in bulk. We agree that, in this respect, Fields’s case is distinguishable from Crabtree. In Crabtree the Court determined that the defendant at least had constructive knowledge of the content of the child pornography videos because he had to have seen the file names while individually downloading files. 455 S.W.3d at 398. Expert testimony in that case established that a Limewire user would see provocative file names before individually downloading files, and once “download” was selected the software would ask whether the user wanted to download the named file and, to do so, he would have to select “yes.” Id. Crabtree knew how to download files on Limewire and he knowingly downloaded individual files he knew contained child pornography. Id. at 401.9

Notably, the Crabtree Court held that “direct proof of knowledge is not necessary. ‘Proof of actual knowledge can be by circumstantial evidence.’” Id. at 399 (quoting Love v. Commonwealth, 55 S.W.3d 816, 825 (Ky. 2001)). The *14 Court held that the trial court properly relied on circumstantial evidence in denying a directed verdict. Id. at 400-01. That evidence was Crabtree’s admission that he viewed one of the child pornography videos, along with the direct evidence of the file names, which were reliable indicators of the content of the other downloads Crabtree made from Limewire. Id. at 400.

Fields maintains that he downloaded files from Limewire in bulk and that he never saw the individual file names. Unlike Crabtree, the Commonwealth did not present evidence that Fields had downloaded individual files. However, as Bell highlighted, the file names in the indictment were riddled with child pornography buzzwords. The file names also included language such as “young,” “sex,” “underage,” “porn,” and “intercourse,” which were indicative of their content even to those unfamiliar with child pornography buzzwords. These file names were viewable by Fields, even if among numerous other file names.

Additionally, Fields moved the four files at issue to the recycle bin. Bell testified that the four files were moved to the recycle bin approximately one month after initially downloaded. One of the files was placed on the external hard drive which the detectives found plugged into Fields’s desktop computer.¹⁰ This is further evidence tending to show Fields’s knowing possession of child pornography. Bell also presented reports that suggested that Fields recently viewed other files with lewd names and child pornography *15 buzzwords, although Bell could not specifically attest that those files actually contained child pornography. While this evidence is largely circumstantial, knowledge can be shown through circumstantial evidence. Crabtree, 455 S.W.3d at 399.

Most detrimental to Fields’s defense, and therefore the evidence that best supported the trial court’s denial of the motion for directed verdict, was Bell’s testimony that the pornographic images underlying Counts 2, 4, 6, and 9 of the indictment were opened and viewed. The Commonwealth presented numerous reports created by Bell, one of which was a report from the File Explorer history on Fields’s computer that showed that the four images related to Counts 2, 4, 6 and 9 contained the three-forward-slash prefix, which according to Bell meant the files were viewed. Significantly, Fields neither cross-examined Bell to undermine this testimony nor did he offer a witness with an alterative explanation for the three-forward-slash prefix on the files.

“Circumstantial evidence has its limits. The proof must do more than point the finger of suspicion. Moreover, ‘a conviction obtained by circumstantial evidence cannot be sustained if the evidence is as consistent with innocence as with guilt.’” Id. at 408 (internal quotations and citations omitted). The Commonwealth presented direct proof, through Bell’s testimony, of when the images were downloaded, when they were moved to the recycle bin or hard drive, and when the files were opened or otherwise accessed. We recognize Fields’s argument that some of Bell’s testimony is not unassailable, i.e., other explanations may exist, but Fields did not properly counter that *16 testimony during cross-examination, nor did he present a witness that could contradict the information and explanations Bell provided.

Additionally, when weighing Bell’s testimony and Fields’s defense, a juror could doubt Fields’s credibility in asserting that he never saw the file names, never saved the one image to an external hard drive, and never interacted with the four files. Further, a reasonable juror could infer that Fields saw the file names in the approximately one month’s time that they were on his computer prior to being moved to the recycle bin or specifically saved to the external hard drive.

The issue on directed verdict was whether sufficient evidence was presented for a reasonable juror to determine that Fields knowingly possessed child pornography. The trial court was required to view the evidence in the light most favorable to the Commonwealth. Because there was direct evidence that the four files had been viewed (in addition to circumstantial evidence described above), the jury had sufficient evidence to infer that Fields knew that the child pornography files were on his computer and that he knew what the files contained. The Commonwealth met its burden and Fields was not entitled to a directed verdict under our controlling standard. Benham, 816 S.W.2d at 187.

II. The trial court did not abuse its discretion in disqualifying Matthew Considine as an expert witness but Considine’s testimony would have had no impact on the verdict even if the jury heard it.

Fields argues that the trial court erroneously excluded the testimony of his expert witness, Matthew Considine, thereby improperly denying him the *17 opportunity to present a defense. Considine testified for approximately six minutes before the Commonwealth objected to his qualifications as an expert. At that time, the trial court excused the jury and allowed the parties to question Considine regarding his qualifications.

The questioning focused on Limewire. Considine had not used Limewire in his professional capacity but testified that he had experience using the program “as a child” in 2007 or 2008. He added that any other direct experience with Limewire was “not for cases, but for [his] own education.” Considine had no specific education courses on peer-to-peer networking but testified that he had one or two class sessions in college that dealt with Limewire. He also testified that he considered his co-worker, Trent Strutman, an expert regarding Limewire. He stated that Strutman was available on-thejob to answer any questions Considine had and that he had previously consulted with Strutman regarding peer-to-peer networks.

Considine testified that he had conducted an examination on a computer previously that had Limewire installed on it, but then contradicted that by saying that the only computer with Limewire that he had ever examined was “the computer in this case.” While Considine may have possessed relevant experience and qualifications in general forensic computer investigations, nothing suggested he qualified as an expert in Limewire or peer-to-peer sharing networks.

Based on Considine’s lack of professional experience with Limewire, the trial court concluded that he did not qualify as an expert but allowed his *18 testimony by avowal for the purposes of appeal. That testimony, discussed below, was confined to Limewire. The Court of Appeals affirmed the exclusion of Considine as an expert, agreeing that he lacked expertise with respect to the use of Limewire. Stated succinctly, the Court of Appeals concluded that Considine had only two years of professional experience, no certifications, no specialized training, and his direct experience with Limewire was primarily informal and during childhood.

Expert testimony is admissible if it meets the requirements of Kentucky Rule of Evidence (KRE) 702, which states

If scientific, technical, or other specialized knowledge will assist the trier of fact to understand the evidence or to determine a fact in issue, a witness qualified as an expert by knowledge, skill, experience, training, or education, may testify thereto in the form of an opinion or otherwise, if:

(1) The testimony is based upon sufficient facts or data; (2) The testimony is the product of reliable principles and methods; and (3) The witness has applied the principles and methods reliably to the facts of the case.

The standard by which a trial court should assess the reliability of expert testimony was set out in Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579 (1993). Under the Daubert standard, the trial court must make a preliminary determination “whether the expert is proposing to testify to (1) scientific knowledge that (2) will assist the trier of fact to understand or determine a fact in issue.” Id. at 592. The trial court thus serves as gatekeeper to prevent the admission of pseudoscientific, unreliable evidence. Garrett v. Commonwealth, 534 S.W.3d 217, 221 (Ky. 2017). The topics of *19 Considine’s proposed testimony were scientific in nature and had the potential of assisting the jury in understanding Limewire and peer-to-peer networks. However, Considine, despite his degree, did not qualify as an expert on these particular topics.

KRE 702 requires that a witness is “qualified as an expert by knowledge, skill, experience, training, or education.” Further, “[t]he decision to qualify a witness as an expert rests in the sound discretion of the trial court.” Kemper v. Gordon, 272 S.W.3d 146, 154 (Ky. 2008) (citing Owensboro Mercy Health Sys. v. Payne, 24 S.W.3d 675, 677 (Ky. App. 1999)). A trial court’s determination of whether a witness is qualified as an expert is reviewed for abuse of discretion. Smith v. Commonwealth, 454 S.W.3d 283, 285-86 (Ky. 2015) (citing Brown v. Commonwealth, 416 S.W.3d 302, 309 (Ky. 2013)). “The test for abuse of discretion is whether the trial judge's decision was arbitrary, unreasonable, unfair, or unsupported by sound legal principles.” Commonwealth v. English, 993 S.W.2d 941, 945 (Ky. 1999).

The gist of Fields’s defense was that he unknowingly downloaded some files containing child pornography in a bulk download through Limewire, a peer-to-peer network, and then unknowingly transferred those files to his computer. Considine had minimal experience with Limewire and no professional experience with the program prior to this trial. While he possessed some knowledge of Limewire and how the software allows users to share and download files, his knowledge was sparse and his proposed testimony incorrectly focused on conducting searches in Limewire, which was *20 essentially irrelevant given the Commonwealth’s theory and Fields’s defense. He also stated that the only computer with Limewire he ever examined was Fields’s computer. As noted, Considine’s training and education on Limewire was limited to two college class sessions on the software and he had not had formal training regarding Limewire or even peer-to-peer sharing generally. Overall, he lacked the requirements to be deemed an expert in Limewire under KRE 702. Given his lack of knowledge and experience, we cannot say the trial court abused its discretion in declining to qualify Considine as an expert witness on that topic.

Fields cites a series of federal products-liability cases which hold that expert testimony was improperly excluded where the proposed witness is an expert in the subject area but lacks specialized knowledge of the particular product at issue.¹¹ Fields analogizes those cases to the trial court’s finding that Considine lacked sufficient experience with Limewire, a particular computer software. He argues that the trial court should have instead focused its analysis on Considine’s general training and experience and specialized knowledge in computer forensics. However, Considine lacked any recognized qualifications in computer forensics generally. He had no certifications, although he was in the process of obtaining certification in Encase, the computer forensics software used by Bell. Further, he only had two years of *21 professional experience in computer forensics generally and had never offered an expert opinion at trial although he had “consulted” for trials.

Even if we were to agree with Fields that any “underqualification” on Considine’s part should have gone to the weight of his testimony rather than constituting grounds for excluding that testimony altogether, the result in this case would have been no different. Considine’s proposed testimony focused on Limewire, bulk downloads from the program, how Limewire searches were conducted, the discrepancy between file titles and their contents and other Limewire-centric issues. Simply put, this testimony would not have established anything that conflicted with the Commonwealth’s version of what had occurred. The real point of contention was whether Fields had viewed, interacted with the pornographic images and that was not a Limewire issue, but rather the significance of the three-forward-slash reflected in the computer’s history as to the four images for which he was convicted.

Defense counsel failed to elicit any experience Considine may have had with Windows computers or the File Explorer generally, which is the type of expertise that could have successfully countered Bell’s testimony regarding Fields viewing or opening the four files at issue. In order to counter Bell’s testimony regarding the File Explorer and Windows, Fields needed an expert in Windows, not Limewire because it was incumbent for his defense to offer proof that he did not view the files, even in the preview pane of File Explorer. Considine’s education in computer forensics and efforts to become certified in Encase likely meant that he possessed some knowledge regarding Bell’s reports *22 and testimony but this information was never presented to the trial court. This omission is likely due to the fact that the proposed defense testimony was focused on a different subject—the workings of Limewire as opposed to the truly relevant issue of whether Fields had viewed the four images.

Thus, even if the trial court’s refusal to allow Considine to testify as an expert witness was error, it was harmless. Considine’s avowal testimony contained no information that would have successfully countered Bell’s testimony regarding the three-forward-slash prefix and File Explorer testimony used to establish that Fields viewed the four files. Despite having Bell’s reports and having heard his trial testimony, Fields’s counsel did not ask Considine anything about Bell’s report or the three-forward-slash prefix meaning in Windows or whether previewing a file in File Explorer could constitute viewing the file for purposes of KRS 531.335. Considine might have had the relevant knowledge to refute Bell’s theory, but neither Considine nor defense counsel were adequately prepared to discuss that aspect of Bell’s report.¹²

As a result of the trial court’s exclusion of Considine as an expert witness, Fields argues that his right to present a defense was impermissibly infringed. He insists the jury was not permitted to hear evidence central to his claim of innocence because Considine’s testimony was fundamental to counter *23 Bell’s testimony, a somewhat curious position since, as discussed, Considine’s testimony never addressed the Commonwealth’s proof that Fields had viewed the images at issue. This Court has held that the rules of evidence cannot be applied “so as to completely bar all avenues for presenting a viable defense,” but they can be used “so as to properly channel the avenues available for presenting a defense.” Mills v. Commonwealth, 996 S.W.2d 473, 489 (Ky. 1999) (overruled on other grounds by Padgett v. Commonwealth, 312 S.W.3d 336 (Ky. 2010)). The trial court did not deny Fields the opportunity to present a defense, it merely excluded the testimony of one particular witness after determining that he was not qualified to render an expert opinion on the topic he planned to address.

III. The trial court properly admitted Commonwealth’s Exhibits 11- 14 and 18 regarding Fields’s computer activity.

Next Fields argues that the trial court improperly admitted certain exhibits offered by the Commonwealth. During its case-in-chief, the Commonwealth introduced Exhibits 1 through 10, which were the files underlying each count of the indictment. Exhibits 11 through 14 were taken from the registry examined on Fields’s computer as follows:

Exhibit 11 – “Recent Docs – JPG”

Exhibit 12 – “Recent Docs – MPG”

Exhibit 13 – “Real Player Most Recent Clips”

Exhibit 14 – “Microsoft Media Player Recent File List”

These exhibits were part of Bell’s forensic analysis of Fields’s computer. Bell testified that they were lists of the most recent files opened in their native *24 programs, i.e., Media Player or Real Player. Bell did not find the specific files listed in the exhibits during his investigation, nor could he definitively state that they contained child pornography. However, he testified that these files were “concerning” because the titles contained similar buzzwords to known child pornography files. Bell had previously testified about some of the buzzwords and their meaning. Exhibit 18 was a list of the four files Bell testified had been viewed, which he indicated to the Commonwealth were pulled from his overall report. At trial, Fields objected to the introduction of Exhibits 11-14 because none of the file names in these Exhibits were part of the indictment. Additionally, Fields argued that the Commonwealth could not prove that any of the files listed in the exhibits actually contained child pornography. Over Fields’s objection, the trial court admitted the exhibits into evidence.

The Court of Appeals affirmed the admission, pointing to Fields’s insistence that he downloaded files from Limewire in bulk and therefore never saw the file names or viewed files that would have alerted him to the presence of child pornography on his computer. According to the Court of Appeals, Exhibits 11-14 refute that assertion. The Exhibits were not admitted to show that the files contained child pornography, but rather to show that, based on the file names, one would expect these files to contain child pornography. A reasonable juror could infer that Fields saw the file names prior to opening them in the associated program, thus discrediting his testimony that he had never seen and had never been alerted to file names indicative of child *25 pornography on his computer. Exhibit 18 was admitted to show four files referenced in the indictment had actually been downloaded, opened and viewed on Fields’s computer. Although Fields may have obtained the files in a bulk download, these four files were in fact opened and viewed individually. Accordingly, the Court of Appeals concluded that the trial court did not abuse its discretion in admitting the exhibits.

Evidentiary rulings are reviewed for an abuse of discretion. English, 993 S.W.2d at 945. KRE 403 states

Although relevant, evidence may be excluded if its probative value is substantially outweighed by the danger of undue prejudice, confusion of the issues, or misleading the jury, or by considerations of undue delay, or needless presentation of cumulative evidence.

All evidence is subject to the balancing test of KRE 403:

There are three basic inquiries that the trial court must undertake when determining admissibility of relevant evidence under Rule 403. First, the trial court must assess the probative worth of the proffered evidence; second, it must assess the risk of harmful consequences (i.e., undue prejudice) of the evidence if admitted; and last, it must evaluate whether the probative value is substantially outweighed by the harmful consequences.

Hall v. Commonwealth, 468 S.W.3d 814, 823 (Ky. 2015) (citations omitted).

Fields asserts that, absent support in the record that he, in fact, opened and viewed the files contained in Commonwealth’s Exhibits 11-14 and 18, those exhibits were completely irrelevant and served no purpose other than to inflame and unduly prejudice the jury. The Commonwealth argues that the exhibits were properly admitted because they were relevant to rebut Fields’s defense of unknowing possession of child pornography. We agree.

Although the file names in Exhibits 11-14 were not the same file names as the files listed in Counts 2, 4, 6, and 9 of the indictment, the files had similar names which were indicative of child pornography, both through buzzwords and the plain meaning of the language in the titles. It is immaterial whether the files actually contained child pornography because the Commonwealth’s purpose in admitting the exhibits was to show that similar files were opened by someone using the computer, most likely Fields. Likewise, Exhibit 18 constituted proof that someone (Fields) viewed four of the ten files in the indictment, rendering the exhibit highly relevant to the charged crime. It was admissible because it was extracted from Bell’s forensics report generated after examining Fields’s desktop computer and it contained the file names of four files that formed the basis of the indictment. The Commonwealth, through Bell, introduced the names of all ten files in the indictment and displayed those images and videos in the court room. Hearing the four specific file names contained in Exhibit 18 once more could not have inflamed the jury any further than actually seeing the images and videos.

Fields also contends that the Court of Appeals’ reasoning is based on unsupported factual conclusions regarding his interaction with the subject files, but the Commonwealth presented evidence that Fields accessed four of the files, those listed in Exhibit 18. As for the lists in Exhibits 11-14 they were directly related to countering Fields’s assertions that he had never seen and never been alerted to file names indicative of child pornography on his computer, regardless of whether the files actually contained child pornography.

Contrary to Fields’s argument, it is immaterial whether he searched for the files listed in Exhibits 11-14 and 18, or whether he searched for child pornography on Limewire at all, because the Commonwealth offered proof that Fields opened, previewed, or in some way accessed the four files in the indictment for which he was ultimately convicted. Fields offered no proof to rebut the assertion that these files were opened, other than highlighting that the files were apparently “viewed” within seconds of many other innocuous files.

Fields now argues that Exhibit 18 states nothing about the files being opened or viewed, it only states when the files were “last visited.” Bell acknowledged that the “last visited” timestamp sometimes can be updated upon the running of various default programs, such as malware, virus scans, or any number of programs that run by default. But Exhibit 18 accompanied Bell’s testimony that the four files were in fact opened given the three-forward-slash prefix. Fields asserts that it was critical for the jury to view “last visited” data for all records in the database, but he was able to elicit “last visited” information from Bell during cross-examination and had Bell acknowledge that the four images in Exhibit 18 were opened within seconds of many other files that did not contain child pornography.

Exhibits 11-14 and 18 were admissible as evidence because they were relevant to rebut Fields’s defense of unknowing possession of child pornography. Exhibits 11-14 were relevant to show that files with pornography-suggestive names were opened on Fields’s computer, even if those *28 particular files could not be determined to contain child pornography. Exhibit 18 reflected the four files for which Fields was convicted. In sum, the trial court did not abuse its discretion in admitting these exhibits as evidence.

IV. The trial court properly admitted the images and videos that formed the basis for the indictment.

Fields’s final assertion of error is based on the trial court’s admission, over his objection, of the ten images and videos underlying each count in the indictment. On appeal to the Court of Appeals, the Commonwealth argued that the claim was not properly preserved for review. The Court of Appeals agreed and declined to review the claim on the merits. Acknowledging that preservation was a close call, the Court of Appeals determined that Fields’s objections to the images were based solely on whether the images rose to the level of child pornography under KRS 531.335, not whether the photos were admissible under KRE 403. Additionally, Fields did not request palpable error review pursuant to Rule of Criminal Procedure 10.26. Fields argues that the claim was properly preserved, and the Court of Appeals should have remanded to the trial court for specific findings of fact.

On April 7, 2017 the Commonwealth indicated that it would submit the ten images that it intended to display at trial for an in camera review by the trial court. Fields did not raise an objection at that time. The trial court conducted a review and determined that the images could be shown to the jury. At a pretrial hearing on May 8, 2017 the parties discussed the admissibility of the ten images and videos supporting each count in the indictment. However, there were two separate arguments regarding *29 admissibility. First, the Commonwealth moved to introduce, under KRE 404(b), other suspected images of child pornography found on Fields’s computer that were not charged in the indictment. Fields’s counsel argued that the introduction of the images would be prejudicial but agreed to discuss that issue at a separate time.

The second issue discussed at the hearing was Fields’s objection to the introduction of the ten images and videos based on whether they constituted “child pornography” under KRS 531.335. Fields’s counsel challenged whether the images and videos were admissible at all because he argued they constituted “erotica” and not child pornography. Fields also stated it was too difficult to determine if the individuals contained in the images and videos were under the age of 18 and asked that the images be excluded. The Commonwealth noted that the trial court had already conducted an in camera review of the ten items in the indictment. In response to the objection, the trial court simply stated “I can’t as a matter of law rule that it is not [child pornography.]”

We note that during this pretrial hearing all parties and the trial court expressed confusion as to exactly what motions the Commonwealth and Fields made and what the trial court was being asked to rule upon. The motions appeared to be whether the ten images depicted (1) sexual performances (2) by minors, as required by KRS 531.335. Ultimately, the Commonwealth showed the videos and images contained in the indictment to the jury and Fields did not raise an objection to the presentation of the images and videos at trial.

We agree that whether Fields’s argument was properly preserved for appeal is a close call, but regardless of preservation we find no error in the admission of the images and videos.

Fields argues that the trial court should have issued specific findings under KRE 403 and Hall, 468 S.W.3d at 824, as to whether the probative value of the display of child pornography was outweighed by undue prejudice. Hall involved the excessive display of crime scene and autopsy photographs in a murder case. It did not involve a determination of an ultimate issue in the case, i.e., whether the images constituted an element of the crime. In this case, because of the offense charged, the jury had to determine whether the Commonwealth proved that Fields knowingly possessed the child pornography files and that he had knowledge of what those files contained. KRS 531.335(1) requires a finding that Fields possessed “matter portraying a sexual performance by a minor.” So, it follows that the Commonwealth had to prove that the images and videos portrayed a sexual performance by minors. Fields, at one point, disputed whether the images and videos displayed sexual performances and whether the individuals in the images and videos were minors. Therefore, the jury was tasked with answering those factual questions.¹³ The fact that this evidence, which may inflame the jury, would be introduced in this case “follows from the nature of the crime and does not *31 make the evidence inadmissible.” Little v. Commonwealth, 272 S.W.3d 180, 188 (Ky. 2008).

Relevant evidence “may be excluded if its probative value is substantially outweighed by the danger of undue prejudice . . . .” KRE 403. Probative photos are admissible “unless they are so inflammatory that their probative value is substantially outweighed by their prejudicial effect.” Adkins v. Commonwealth, 96 S.W.3d 779, 794 (Ky. 2003). The probative value of the images in this case cannot be denied. “The ‘probative value’ or ‘probative worth’ of evidence is a measure of how much the evidence tends to make the fact it is introduced to prove more or less probable.” Hall, 468 S.W.3d at 823. Here, the images constitute physical evidence of the crime itself, and while undoubtedly prejudicial, this was not “undue prejudice,” KRE 403, and the prejudice did not outweigh their probative value. Because the images were relevant and highly probative of the child pornography charges, they were properly admitted into evidence and presented to the jury at trial.

CONCLUSION

For the foregoing reasons, we affirm the Court of Appeals opinion upholding the judgment and sentence of the Scott Circuit Court.

All sitting. All concur. *32 COUNSEL FOR APPELLANT:

Michael Jay O’Hara David Bryan Sloan Jessica Nadine Wimsatt O’Hara, Taylor, Sloan & Cassidy

COUNSEL FOR APPELLEE:

Daniel J. Cameron Attorney General of Kentucky

Mark Daniel Barry Assistant Attorney General

Footnotes

[1] As explained in United States v. Dodd, 598 F.3d 449, 451-53 (8th Cir. 2010), even if a user admits to knowing receipt and possession of illegal materials, he may have no knowledge that his computer was equipped to distribute said materials. But the precise function of a file sharing program, like Limewire, is to share, in other words, to distribute. Id. The Commonwealth and Investigator Bell never suggested that Fields attempted or actually distributed child pornography, only that the files were made available through the underlying functions of a peer-to-peer file sharing program.

[2] The trial court record shows numerous continuations of the trial due to various reasons, including scheduling conflicts, medical issues of attorneys involved in the case, Fields’s medical issues, and Fields’s private counsel’s withdrawal from the case in 2016.

[3] Bell indicated that this acronym stands for “preteen hard core.”

[4] Fields had a laptop and a desktop computer. The files that formed the basis for the indictment were found on the desktop computer or an external hard drive that was connected to the desktop computer. Fields’s wife testified that the desktop computer was located in their bedroom. She knew Fields used Limewire to download adult pornography and testified that they watched it together. She estimated that over 100 adult pornography videos were downloaded to the desktop computer and external hard drive. However, she denied any knowledge of child pornography. Although two computers were examined, child pornography was discovered on only the desktop computer and for the sake of clarity we refer to a single computer throughout this opinion.

[5] Limewire had a preview function, but Bell admitted that he found no evidence that Fields used it to preview any of the files included in the indictment.

[6] Bell’s report explained that these recently viewed images and videos were not present at the time the computer and hard drive were seized, but the data indicated that the files had been present on the computer or hard drive at some earlier point in time. Bell also stated that the files were “mostly empty files, so there’s nothing you can view.” He did not provide an extensive explanation as to why Fields’s recently viewed files could not be viewed during his examination or why they were no longer present on the computer or hard drive, but stated that the file names were highly suggestive of child pornography despite being inaccessible. On cross-examination, Bell acknowledged that the files included in the lists of recently viewed files, Commonwealth’s Exhibits 11-14, were no longer on the computer and therefore were separate and apart from the 48 images and 7 videos that Bell found on Fields’s computer and hard drive during the forensic examination.

[7] Georgetown University, Working with the File Explorer in Windows 10, https://uis.georgetown.edu/file-explorer/. (Last visited Sept. 29, 2021).

[9] In addition, Crabtree admitted to police that he viewed one of the child pornography videos although, interestingly, he was acquitted of the charge related to that particular video. Id. at 398.

[10] Fields testified that he did not intentionally place any files on the external hard drive.

[11] See, e.g., CNA Ins. Co. v. Hyundai Merch. Marine, Co., 2011 WL 5181464, *1, *2 (W.D. Ky. Oct. 31, 2011); Holbrook v. Lykes Bros. S.S. Co., 80 F.3d 777, 782 (3d Cir. 1996).

[12] In his concurrence, Judge Acree noted that Fields’s counsel had more than enough time to secure an expert whose credentials were no longer in the developmental stage. The Department of Public Advocacy sought expert funds, but it was so close to trial that it likely lessened the possibility of obtaining an expert who was both fully qualified and prepared for trial.

[13] The jury instructions included the definitions of “sexual performance” and “sexual conduct by a minor” to aid the jury in determining whether the images and videos satisfied the requirements of KRS 531.335.