State v. Al-Khayyal

Ellington, Chief Judge. The State indicted Faiz Al-Khayyal on 49 counts of sexual exploitation of children in violation of OCGA § 16-12-100 (b) (8), based upon allegations that he possessed and controlled child pornography in the form of digital files on his laptop computer. The [719] Superior Court of Clayton County sustained Al-Khayyal’s plea in bar and granted his motion to dismiss the indictment for lack of venue, finding that, although Al-Khayyal possessed the computer in Clayton County, he had deleted the digital files before he entered the county and could no longer access the illegal images, and, therefore, that there was no evidence that he committed the offenses as alleged in the indictment. The State appeals this ruling, in part, as to Counts 30 through 49.1 For the reasons explained below, we reverse in part. The following facts are undisputed. In 2009, while Al-Khayyal, a professor at the Georgia Institute of Technology, was abroad teaching in China, he became the target of an investigation into child pornography. When he returned to the United States on August 5, 2009, bringing his laptop computer, immigration control officers detained him in the Atlanta airport (in Clayton County) and seized that computer. A forensic computer specialist for the Georgia Bureau of Investigation conducted a forensic examination of the computer, using specialized forensic software, and discovered 29 digital files that contained sexually explicit images of young girls. The files had been placed in the computer’s trash folder, which had then been emptied, so that the files were permanently deleted or “double-deleted” and inaccessible to the user.2 A subsequent examination of the computer yielded 20 additional files that had been “deleted” but remained saved in the trash folder.3 Those files were in a compressed “.rar” format, and the images contained in the files could be viewed only with an “uncompressing” or “unzipping” program that at that time was not loaded on the computer. A different unzipping program, [720] however, was loaded on the computer, and the computer’s history files showed that the software had been used, though not on the files at issue in this case. In addition, the computer specialist testified that the software required to access the .rar files is readily available to the public and can be used without special training. When the computer specialist used the required software to “rebuild” the .rar files in the trash folder, she found that the files also contained sexually explicit images of young girls. The State indicted Al-Khayyal on 49 counts of violating OCGA § 16-12-100 (b) (8).4 Each count alleges that Al-Khayyal, in the State of Georgia and County of Clayton, on or about August 5, 2009, did knowingly possess and control material, to wit: a digital file located on a Toshiba laptop and labeled[, giving the file name of one of the 49 digital files recovered from his computer], which depicts a minor engaged in sexually explicit conduct, to wit: [describing the conduct depicted in the specified file]. Counts 1 through 29 concern the double-deleted files; Counts 30 through 49 concern the single-deleted .rar files. Al-Khayyal filed a plea in bar and motion to dismiss the indictment, arguing that, regardless whether he possessed and controlled the files at one time, he did not do so in Clayton County and, therefore, that the prosecution was barred for lack of venue.5 After an evidentiary hearing, the trial court sustained the plea in bar and granted the motion to dismiss, finding that there was no evidence that Al-Khayyal was in knowing possession and control of the images in Clayton County. The State appeals this ruling only as to Counts 30 through 49, which concern the single-deleted .rar files.6 The State contends that, for purposes of Al-Khayyal’s plea in bar and motion, the evidence establishes that he possessed his computer in Clayton County at a [721] time when the subject .rar files were present on the computer’s hard drive. In addition, the State contends that the evidence establishes that, although the subject files were then assigned to Al-Khayyal’s computer’s trash folder, he could have accessed the files and viewed the contraband images after downloading software that was readily available to the public. Further, the State contends that the evidence supports an inference that Al-Khayyal knew that the files were present on his computer and that he could later access them. Because questions concerning Al-Khayyal’s knowledge and intent are for the jury to decide, the State contends that, under the circumstances presented, the trial court erred in sustaining Al-Khayyal’s plea in bar and granting his motion to dismiss the indictment. Al-Khayyal contends, on the other hand, that the trial court’s ruling was correct because, while he was in Clayton County, he lacked the ability to access the illegal images stored on his computer. He contends that contraband that is in the form of electronic data “can only be thrown away in one way — [by] rendering it inaccessible on the computer” on which the data is stored. He contends that, before entering Clayton County, he had done “everything he could to discard the [illegal] images and terminate his possession” and that the steps he had taken before he returned to the United States did, in fact, render the subject files “totally inaccessible.” Based on this, he contends that the trial court correctly determined that, as a matter of law, he was not in knowing possession or control of the contraband in that venue. We apply a de novo standard of review to the trial court’s ruling on Al-Khayyal’s plea in bar and motion to dismiss the indictment for improper venue.7 Under Georgia law, a person who knowingly has direct physical control over a thing at a given time is in actual possession of it. A person who, though not in actual possession, knowingly has both the power and the intention at a given time to exercise dominion or control over a thing is [722] then in constructive possession of it. In any criminal prosecution for possession, therefore, the State must prove that the defendant was aware he possessed the contraband at issue. (Citation and punctuation omitted.) Barton v. State, 286 Ga. App. 49, 52 (1) (648 SE2d 660) (2007). “Both knowledge and possession maybe proved, like any other fact, by circumstantial evidence.” (Citation and punctuation omitted.) Hunt v. State, 303 Ga. App. 855, 858 (2) (695 SE2d 53) (2010). Further, “[a]s long as there is slight evidence of access, power, and intention to exercise control or dominion over an instrumentality, the question of fact regarding constructive possession remains within the domain of the trier of fact.” (Citation and punctuation omitted.) Id. The common thread in child pornography laws is the visual depiction of minors engaged in sexually explicit conduct.8 Although the iconic example of child pornography may be a photograph, where the illegal image is fixed in a tangible form, child pornography presents special issues in contemporary times because technology allows images to be ephemerally generated from data stored in a variety of media.9 Georgia law in the arena of child pornography has evolved to reflect the impact of technology. Some offenses are narrowly drawn to prohibit specified conduct involving a “visual medium”10 or “visual or printed matter”11 which depicts a minor or a portion of a minor’s body engaged in any sexually explicit conduct. The offense at issue in this case, on the other hand, is more broadly drawn to prohibit possession or control of “any material” which depicts such an image. OCGA § 16-12-100 (b) (8).12 Georgia’s appellate courts have upheld convictions under this subsection in cases based on the defendant’s possession of a videotape,13 a compact [723] disc,14 a DVD,15 or a USB flash drive16 that contained prohibited content. Thus, in these storage media cases, evidence that a defendant possessed data capable of generating images of a minor engaged in sexually explicit conduct authorized the jury to find that the defendant possessed prohibited “material” even though actually viewing the prohibited images would require the use of a machine or electronic device (a videocassette player, a computer equipped with particular software, etc.).17 In this case, it is undisputed that Al-Khayyal physically possessed a computer that served as the storage medium for data files capable of generating visual depictions of minors engaged in sexually explicit conduct. Despite his undisputed physical possession of the computer in Clayton County, Al-Khayyal contends that the State cannot prove that he possessed the contraband at issue in that venue because, while he was in the county, he lacked the ability to access the illegal images stored on his computer. He relies in part on evidence that the software required to view the prohibited visual depictions was not loaded on his computer at the same time. We find no support in Georgia law, however, for the proposition that possession of prohibited material under OCGA § 16-12-100 (b) (8) exists only in conjunction with the defendant’s present ability to view illegal visual depictions, especially given the evidence that the needed software was readily available to the public. See Veats v. State, 300 Ga. App. 600, 602 (1) (685 SE2d 416) (2009) (A defendant knowingly had constructive possession of a pornographic videotape even when he could not view the content because he did not have a videocassette player or electricity.).18 [724] Finally, we turn to Al-Khayyal’s argument that the evidence precludes the requisite finding that he possessed the contraband at issue knowingly, that is, that he was aware that the files containing the illegal images were stored in his computer’s memory. We note initially that there was no evidence presented at the hearing on Al-Khayyal’s plea in bar and motion to dismiss that the type of files at issue in this case, .rar files, could have been saved to his hard drive automatically and without his knowledge.19 Rather, the evidence authorizes an inference that the subject .rar files originally came to be saved to Al-Khayyal’s computer deliberately. Further, the evidence, including evidence that he actively manipulated the .rar files by deleting them, authorizes an inference that he was aware that the files were saved to his hard drive. Evidence that Al-Khayyal had double-deleted other files authorizes an inference that he knew that deleting a file moves it to the trash folder and that, without further action, a deleted file remains stored there. By extension, this evidence also authorizes an inference that he knew that the .rar files at issue in this case were in the trash folder and still accessible. Evidence that he had used other unzipping software authorizes an inference that he knew about the kind of software needed to access and manipulate compressed files. In addition, all of this evidence must be viewed in light of Al-Khayyal’s educational background and professional exper [725] tise.20 Taking these permissible inferences together, we conclude that the evidence does not establish as a matter of law that, while Al-Khayyal possessed his computer in Clayton County, he had no knowledge of the presence of the .rar files in his computer’s trash folder. Under the facts presented, the question of whether Al-Khayyal’s efforts to abandon the illegal files were successful remains a question of fact for the jury and cannot be determined as a matter of law at this pretrial stage. Bearing in mind that knowledge and possession may be proved by circumstantial evidence and that slight evidence of access, power, and intention to exercise control or dominion over contraband is sufficient to create a jury issue, the record does not support a finding that it will be impossible for the State to prove that Al-Khayyal committed the offenses in Clayton County, as alleged in the indictment.21 Consequently, as to Counts 30 through 49, the trial court erred in sustaining Al-Khayyal’s plea in bar and his motion to dismiss the indictment for lack of venue. State v. Johnson, 269 Ga. 370, 372 (2) (499 SE2d 56) (1998).22 [726] Decided June 19, 2013 Reconsideration denied July 9, 2013 Samuel S. Olens, Attorney General, Laura D. Pfister, Neis S. D. Peterson, for appellant. Alston & Bird, Michael L. Brown, Angela Adams, for appellee. Judgment reversed in part. Phipps, P. J., and Branch, J., concur. Footnotes [1] See OCGA § 5-7-1 (a) (1) (providing that the State may appeal from an order dismissing an indictment); see also OCGA § 5-7-1 (a)(3) (providing that the State may appeal from an order sustaining a plea or motion in bar, when the defendant has not been put in jeopardy). [2] See United States v. Seiver, 692 F3d 774, 776-778 (7th Cir. 2012) (When a user deletes a computer file, it goes into a “trash” folder. If the user then directs the computer to “empty” the trash folder, the contents of the folder, including deleted files, are removed from the user interface. In many cases, a computer forensic expert using specialized software may be able to recover double-deleted data, if recovery is undertaken before the file is overwritten with later-saved files either because there is no longer unused space in the computer’s hard drive or at the user’s direction. Most computer users, however, lack the specialized software that is needed to be able to recover a double-deleted file from the hard drive’s “slack space” and the technological knowledge to use such software. In such a case, a computer user who deletes a file and empties the trash folder containing it will no longer knowingly possess the file.). [3] See David T. Cox, “Litigating Child Pornography and Obscenity Cases in the Internet Age,” 4 J. Technology L. & Policy 1,100 (Summer 1999) (When computer files are deleted, “the [DOS or Windows] operating system does not actually discard any information, rather, it merely makes note to itself” that the memory space being used by the file is again available for use and may be overwritten. Until overwritten, deleted files can be retrieved with software designed for that purpose. Thus, “[a] deleted file is really not a deleted file, it is merely organized differently.”). [4] Pursuant to OCGA § 16-12-100 (b) (8), “[i]t is unlawful for any person knowingly to possess or control any material which depicts a minor or a portion of a minor’s body engaged in any sexually explicit conduct.” [5] See Ga. Const. of 1983, Art. VI, Sec. II, Par. VI (“[A]ll criminal cases shall be tried in the county where the crime was committed, except cases in the superior courts where the judge is satisfied that an impartial jury cannot be obtained in such county.”); OCGA § 17-2-2 (a) (In general, “[c]riminal actions shall be tried in the county where the crime was committed, except as otherwise provided by law.”). [6] Although the State “does not concede that... Al-Khayyal lacked knowing possession or control over the files in Counts 1-29, [it] will not challenge that ruling of the trial court in this appeal.” Consequently, the trial court’s order stands affirmed in part, as to those counts, by operation of law. Grimes v. State, 297 Ga. App. 720, n. 1 (678 SE2d 167) (2009). [7] See State v. Johnson, 269 Ga. 370, 372 (2) (499 SE2d 56) (1998) (reviewing de novo a trial court’s determination that venue for a prosecution for using a false document in a matter within the jurisdiction of a state department did not lie in the county where the state office that received the false documents was located, but lay in the county in which the defendant executed the false documents, and reversing the trial court’s order granting the defendant’s motion to dismiss the indictment for improper venue); State v. Barber, 193 Ga. App. 397, 398-399 (388 SE2d 350) (1989) (reviewing de novo a trial court’s determination that venue for a Medicaid fraud prosecution did not lie in the county where the defendant submitted false reports, but lay in the county in which he falsified the reports, and affirming the dismissal of the indictment for improper venue). [8] See, e.g., Aman v. State, 261 Ga. 669, 670 (1) (b) (409 SE2d 645) (1991); 18 USC §§ 2252; 2252A; Utah Code Ann. § 76-5b-103 (1); Mo. Ann. Stat. § 573.010 (2); Colo. Rev. Stat. Ann. § 18-6-403 (2) (j). [9] See generally “Obscenity and pornography in digital environments - Federal statutory law,” Law of Computer Technology § 18:43 (database updated April 2013); David T. Cox, “Litigating Child Pornography and Obscenity Cases in the Internet Age,” 4 J. Technology L. & Policy 1 (Summer 1999). [10] OCGA § 16-12-100 (b) (1), (2), (5), (6). [11] OCGA § 16-12-100 (c). [12] See also OCGA § 16-12-100 (b) (7) (“It is unlawful for any person knowingly to bring or cause to be brought into this state any material which depicts a minor or a portion of a minor’s body engaged in any sexually explicit conduct.”). [13] See Aman v. State, 261 Ga. at 671 (Hunt, J., concurring); see also Veats v. State, 300 Ga. App. 600, 602-605 (1) (685 SE2d 416) (2009) (probation revocation based on possession of a pornographic videotape). [14] See Scarborough v. State, 317 Ga. App. 523, 524-525 (1) (731 SE2d 396) (2012); Dickerson v. State, 304 Ga. App. 762, 766 (2) (697 SE2d 874) (2010). [15] See Henderson v. State, 320 Ga. App. 553, 555 (1) (740 SE2d 280) (2013). [16] See Hunt v. State, 303 Ga. App. at 857-859 (2). [17] See State v. Brown, 250 Ga. App. 376 (551 SE2d 773) (2001), in which we noted that, although all of the listed items in the statutory definition of a “[v]isual medium,” that is, “any film, photograph, negative, slide, [or] magazine,” OCGA § 16-12-100 (a) (5), “are ‘tangible,’in that they can be physically handled, not all of the listed items can be viewed without the assistance of machinery. Negatives require processing; films require projectors^] [t]he images on videotapes ... can be seen only with the aid of a machine.” Id. at 379 (1). We construed the definition of visual media to include “digital code that produces pictures when interpreted by software” and may be distributed electronically. Id. at 378 (1). See also OCGA § 16-12-100.2 (b) (8) (Defining “visual depiction,” as used in the Computer or Electronic Pornography and Child Exploitation Prevention Act of 2007, as “any image and includes undeveloped film and video tape and data stored on computer disk or by electronic means which is capable of conversion into a visual image or which has been created, adapted, or modified to show an identifiable child engaged in sexually explicit conduct.”). [18] Cf. Wise v. State, 364 SW3d 900, 904 (Tex. Crim. App. 2012) (Discussing the “present-possession approach” used in some jurisdictions when evaluating the sufficiency of evidence [724] that a defendant knowingly possessed child pornography images found in a computer’s cache or free space. That approach requires evidence that a defendant had the knowledge and ability to access the files “in their present format.” In the context of files deleted by a user or by an automatic computer program, if an ordinary computer could not have accessed the deleted files, then the defendant could not presently have the required custody, control, or management of the images to be deemed to be in knowing possession of them.). [19] Cf. Barton v. State, 286 Ga. App. at 50-52 (1) (Where the defendant was charged with possessing child pornography based on temporary internet files that were saved in his computer’s “cache”; where the evidence showed that the cache is “a storage mechanism designed to speed up the loading of internet displays” and that all computers will automatically store pictures or other content that is viewed over the internet; and where there was no evidence that the defendant took any affirmative action to store the images on his computer, that he was aware that, when he viewed the images, the computer had automatically stored the images as files in the cache, or that he had the software and the knowledge required to retrieve or access the images, the State failed to carry its burden of showing that he knowingly possessed the pornography.); see also United States v. Kuchinski, 469 F3d 853, 863 (B) (3) (9th Cir. 2006) (“Where a defendant lacks knowledge about the cache files[, which were automatically downloaded when he accessed web pages], and concomitantly lacks access to and control over those files, it is not proper to charge him with possession and control of the child pornography images located in those files, without some other indication of dominion and control over the images. To do so turns abysmal ignorance into knowledge and a less than valetudinarian grasp into dominion and control.”); Katie Gant, “Crying over the Cache: Why Technology Has Compromised the Uniform Application of Child Pornography Laws,” 81 Fordham L. Rev. 319, 322 (noting the difficulty of proving knowing possession when child pornography images are found exclusively in the defendant’s internet cache) (October 2012). [20] Cf. Barton v. State, 286 Ga. App. at 52 (1) (noting the absence of any circumstantial evidence that would have allowed the jury to infer the defendant’s knowledge of particular cache files, such as evidence that the defendant was an experienced or sophisticated computer user who would have been aware of the automatic storage process of such files). [21] See Henderson v. State, 320 Ga. App. at 555 (1) (Evidence supported OCGA § 16-12-100 (b) (8) convictions where there was evidence that the defendant viewed movie files containing child pornography, saved some of the files to DVDs, and tried to delete the images from his computer.); Scarborough v. State, 317 Ga. App. at 524-525 (1) (Evidence supported OCGA § 16-12-100 (b) (8) convictions where there was evidence that the defendant saved files containing child pornography to a CD.); Haynes v. State, 317 Ga. App. 400, 401 (1) (731 SE2d 83) (2012) (Evidence supported OCGA § 16-12-100 (b) (8) convictions where there was evidence that files containing child pornography were saved to the defendant’s computer; the files had been intentionally downloaded to the computer using certain file-sharing programs; the defendant admitted using the file-sharing programs; and the files had been modified after being downloaded.); Dickerson v. State, 304 Ga. App. at 766 (2) (Evidence supported OCGA § 16-12-100 (b) (8) conviction where there was evidence that files containing child pornography were deliberately copied to a compact disc found in the defendant’s home and the defendant’s fingerprint was on the CD.); Hunt v. State, 303 Ga. App. at 857-858 (2) (Evidence supported OCGA § 16-12-100 (b) (8) convictions, including proof of venue in Clayton County, where there was evidence that the defendant, who lived in another state, saved files containing child pornography to a USB flash drive and, weeks later, had the flash drive with him when he stayed in a hotel in Clayton County and left the flash drive behind when he returned home.); see also United States v. Romm, 455 F3d 990, 1000-1001 (II) (9th Cir. 2006) (Evidence that the defendant viewed images of child pornography over the internet and then deleted the associated temporary files from the computer’s cache authorized the jury to find that he exercised control over the images in the cache and, therefore, that he committed the act of knowing possession of the images.); United States v. Bass, 411 F3d 1198, 1202 (II) (10th Cir. 2005) (Evidence that the defendant attempted to delete internet child pornography from the computer on which he viewed it authorized the jury to find that the defendant knew that the child pornography was automatically saved to the computer and, therefore, that he knowingly possessed the pornography.). [22] We note that the issue of where venue would lie in a case where the State cannot specify where illegal “material” in the form of stored data is located is not before us. See George Blum et al., 21 Am. Jur.2d Criminal Law § 476 (database updated May 2013) (Use of the internet to [726] commit crimes “has led to many issues involving venue.”); David Colarusso, “Heads in the Cloud, a Coming Storm the Interplay of Cloud Computing, Encryption, and the Fifth Amendment’s Protection Against Self-incrimination,” 17 Boston U. J. Science & Technology L. 69, 70 (Winter 2011) (“New technologies . . . present law enforcement with the prospect that information may be stored in unknowable locations behind unbreakable locks.”) (footnote omitted). In this case, the State alleges that Al-Khayyal possessed and controlled material in the form of digital files stored in a knowable location — on a computer that was physically in Clayton County.