Fone v. State

Deborah S. Eyler, J. A jury in the Circuit Court for Montgomery County convicted John R. Fone, the appellant, of ten counts of distribution of child pornography. The court sentenced him to five years for each count, with the sentences to run concurrently, and suspended the sentences in favor of a five-year term of supervised probation. ⁹⁴ The appellant presents four questions for review, which we have condensed and rephrased as three: I. Did the circuit court err by denying his motion to suppress from evidence pornographic images of children seized in a search of his laptop computer in his townhouse?

II

Did the trial court err or abuse its discretion by permitting the State’s expert witness to opine about certain activity on the appellant’s laptop computer immediately before and after pornographic images of children were shared?

III

Was the evidence legally sufficient to support the appellant’s convictions? For the following reasons, we shall affirm the judgments of the circuit court. FACTS AND PROCEEDINGS The Child Exploitation Unit (“CEU”) operates within the Special Victims Investigations Division (“SVTD”) of the Montgomery County Police Department (“MCPD”). On January 2, 2015, the CEU received information from the National Center for Missing and Exploited Children (“NCMEC”) that an image of child pornography had been attached to an email on a gmail account with the address [email protected], accessed from an Internet Protocol (“IP”) address in German-town.

The NCMEC had received that information from Google, which operates gmail. MCPD Detective Louvenna Pallas, who was working in the CEU, investigated the information and on March 18, 2015, applied for and obtained a search warrant for the appellant’s townhouse in Germantown. That same day, she and MCPD Detective Robert Onorio went to the townhouse to execute that search warrant. They knocked on the door and the appellant answered.

They asked if they could come inside and speak to him, and he consented. The detectives sat down with the appellant at his dining room table and talked to him for over an hour. With the appellant’s consent, Detective Pallas audio recorded their conversation. The appellant told them he was married with two ⁹⁵ adult children, neither of whom lived at home.

His wife had been diagnosed with Alzheimer’s disease six years earlier, and he was her primary caregiver. She was upstairs sleeping during the interview. Detectives Pallas and Onorio asked the appellant if he had a gmail account; he replied that he did. He identified his email address as “[email protected].” They asked if he had any other email accounts, such as an account with an address of [email protected].

He replied that he “might have had that.” 1 The detectives inquired about the appellant’s internet usage. He acknowledged having pornography on his computer but denied having any “inappropriate images of children.” He primarily used a Gateway laptop computer (“laptop”), which he kept in the basement of the townhouse. He said he spent a couple of hours each day in online chatrooms and also spent time on Yahoo! Messenger, which is an instant messaging program.

He had an account with Flickr, an online photo storage site, under the name “NudistJohn6969.” Detective Onorio asked the appellant whether they could search his laptop and he agreed. Detective Onorio accompanied the appellant to the basement of the townhouse to retrieve the laptop. While the interview continued, Detective Onorio inspected the contents of the laptop. He received permission from the appellant to run a computer program to scan the laptop for child pornography.

That program did not work, however, so Detective Onorio carried out a manual search of the laptop. The appellant told the detectives he engaged in “fantasy chats” on the laptop about sexual activity with children. He denied ever having exchanged any child pornography images or videos. He said that on one occasion the previous year a “guy” had sent him two images that he had looked at for “about 10 seconds” and then deleted.

One ⁹⁶ image depicted an infant and the other image depicted “a child in pain.” The appellant said he “d[id] it all” in caring for his wife. His sister had taken care of his wife “once,” when he was out of town, but that time he had “left [his wife] at [his] sister’s house.” His son lived in Seattle. A “good friend” who lived in Phoenix also had taken care of his wife for him. Detective Onorio located images of what the CEU calls “child erotica” on the laptop. “Child erotica” are images of children in “sexually exploitative positions and dress” that do not meet the definition of child pornography.

He asked the appellant if it was “fair to say [he had] a sexual attraction to children in a fan[tasy] component?” The appellant replied, “Not to children, well yeah.” Detective Onorio inquired about the appellant’s “age of attraction,” noting that his internet searches suggested he was attracted to children from infancy through their teenage years. The appellant replied, “Yeah.” He claimed there was no chance that he had child pornography on his laptop, however. As he continued his manual search of the laptop, Detective Onorio located an image he believed to be child pornography. At that point, he stopped the interview and advised the appellant that the detectives had a search warrant for his house.

The detectives seized the laptop and an external hard drive for it that was in the basement where the laptop had been. They also seized a computer tower for a desktop computer that was in the master bedroom. The appellant was not placed under arrest at that time. Detective Onorio made copies of the hard drives from the devices seized at the appellant’s townhouse and provided the copies to the MCPD Electronic Crimes Unit (“ECU”).

Detective William Heverly, with the ECU, analyzed the digital copies. From the appellant’s laptop, he located ten images of child pornography and numerous internet searches, websites visited, and chat sessions that were associated with child pornography. The ten images had been sent by the appellant to an unknown third party on August 24, 2014. ⁹⁷ On September 24, 2015, the appellant was arrested and charged with ten counts of possession of child pornography and ten counts of distribution of child pornography. He later filed a pre-trial motion to suppress the evidence seized from his townhouse.

On April 8, 2016, the court held a suppression hearing. Among other things, the appellant argued that the search warrant was issued based upon information that was stale and therefore did not give rise to probable cause. The court denied the suppression motion, rejecting the staleness argument and ruling, in the alternative, that even if probable cause was lacking the detectives relied upon the warrant in good faith. The appellant filed a motion for reconsideration, which was denied.

Before trial, the State entered a nolle prosequi on the possession counts. A four day jury trial commenced on May 2, 2016. The State called Detective Pallas, Detective Onorio, and Detective Hev-erly, who was accepted as an expert in digital forensic analysis. The audio recording of the appellant’s March 18, 2015 interview with the police was played for the jury, with minor redactions.

Detective Heverly testified that there were two user accounts associated with the appellant’s laptop: one under the name “John” and one under the appellant’s wife’s name. The appellant’s wife’s account was password protected and had been accessed just 7 times, with the last access in January 2013. The “John” account was not password protected and had been accessed 2,937 times. The ten images of child pornography that formed the basis for the charges had been accessed from the “John” account on the laptop and sent to an unknown third party via Yahoo!

Messenger on August 24, 2014, between 3:41 p.m. and 3:47 p.m. Detective Heverly determined that fifteen minutes before that six-minute Yahoo! Messenger session, a user of the “John” account had accessed the Flickr account the appellant identified as his during the police interview and the Captain ⁹⁸ [email protected] gmail account, which the appellant also had identified as his. Five minutes after the end of the Yahoo!

Messenger session, a user of the “John” account had accessed that same gmail account. A user of the “John” account also had accessed a particular chatroom before and after the Yahoo! Messenger session. Detective Heverly further testified that the external hard drive seized from the appellant’s townhouse had been plugged into the laptop before and after the Yahoo!

Messenger session and images from it had been accessed. In his case, the appellant presented his own digital forensic analysis expert, Patrick Siewart, who testified that it was possible that a user other than the appellant had uploaded and sent the ten child pornography images. He further testified that laptops are portable, and therefore the images in question could have been sent when the appellant’s laptop was outside of Montgomery County or outside of Maryland. He suggested that the MCPD should have subpoenaed the IP address logs for the appellant’s internet service provider (“ISP”) for August 24, 2014, to determine whether the laptop was connected to the internet at the appellant’s townhouse on that date.

The appellant’s motion for judgment of acquittal at the close of all the evidence was denied. After conviction and sentencing, the appellant noted a timely appeal. We shall include additional facts in our discussion of the issues. DISCUSSION I. Denial of the Motion to Suppress In his pre-trial motion to suppress the evidence the police seized from his townhouse, the appellant argued that the warrant was lacking in probable cause for several reasons, including, as pertinent here, that the affidavit in support of the warrant application “fail[ed] to state the date of the events relied upon to show probable cause ... [making it impossible] ⁹⁹ to determine the remoteness in time between the facts observed and the issuance of the warrant, rendering the probable cause stale.” In other words, the appellant maintained that because the warrant application did not disclose when the image of child pornography was attached to the [email protected] account, that event was not shown to be close enough in time to the date of the warrant application not to be stale, 2 At the suppression hearing, the warrant application was introduced into evidence by joint stipulation.

No testimony or other evidence was introduced. The warrant application was sworn out by Detective Pallas on March 18, 2015, and the warrant was issued and executed that same day. In the affidavit, Detective Pallas detailed her experience, identified the location to be searched, listed the items to be seized, and averred: On 01-02-15, the [NCMEC] cyber tipline received a complaint from Google that an image containing child pornography was attached to the Google email address, [email protected] which may or may not have been sent. (Cybertip # 3384307) The following is a description of the attached image: 1.

Jpeg image titled: 39601_15 This image depicts an adult female performing fellatio on a male toddler’s penis. Your affiant through her training, knowledge, and experience identified the above described image as being child pornography. Google provided an IP address, date, and time of the suspected uploaded image. A preservation letter was also sent to Google, Inc. to preserve the account information pending warrant service. ¹⁰⁰ Detective Pallas further attested that, using the IP address, she determined that the computer associated with the image was located in Germantown and used a Verizon internet account.

She obtained Verizon subscriber information for that account, which was registered to the appellant at an address in Germantown. A Department of Assessments and Taxation search revealed that the address was a townhouse owned by the appellant and his wife. A criminal history background check showed that the appellant had been arrested and charged with public masturbation in Jacksonville, Florida, in 1986. Detective Pallas further averred in the warrant application that, based on her training and experience, “[s]ubjects who view or collect child pornography value their collections and often go to great lengths to organize and protect their collections including concealing the images on computer media.” Moreover, “when subjects possessing child pornography conceal or delete it to avoid detection ... it is possible to recover files and data from computer media in hidden areas or after it has been deleted.” Before the suppression court, the appellant argued that the information contained within the four corners of the warrant was stale, and therefore the warrant was not supported by probable cause. 3 The State responded that staleness was not an issue because, unlike drug evidence that is likely to “dissipate” because the drugs will be “used,” child pornography stored on a digital device is a “collector’s item.” Alternatively, the State argued that even if the information in the warrant was stale, the evidence seized should not be excluded because Detectives Pallas and Onorio had relied upon the warrant in good faith. ¹⁰¹ In rejecting the staleness argument, the suppression court, quoting United States v. Seiver, 692 F.3d 774, 777 (7th Cir. 2012), stated that it was persuaded that staleness “ ‘is highly relevant to the legality of a search for a perishable or consumable object like cocaine but rarely relevant when it is a computer file.’ ” The court emphasized that computer files, even if deleted, can be recovered.

The court also found that Detective Pallas’s averments in the warrant affidavit, based upon her 14 years of experience as an SVID detective, about “the habits and propensities of those who view or collect child pornography,” further supported the view that it is likely that a computer image of child pornography will be saved (or will be recoverable even if deleted). The court reasoned that given all of the above, the “issue of when did this possession occur ... doesn’t matter much because it is still on the computer until destroyed and that there are ways to get these images back or to recover these images even if they have been deleted twice by a person who has access to the computer.” Moreover, the court pointed out, federal law requires ISPs, including Google, to report suspected child pornography to the NCMEC “as soon as reasonably possible.” See 18 U.S.C. § 2258A(a)(l). Thus, it reasonably could “assume that the existence of the picture [was] fairly recent in time,” relative to the date of the tip (January 2, 2015). Alternatively, the court ruled that even if the warrant was lacking in probable cause because it was based on stale information, Detectives Pallas and Onorio acted in good faith in executing it, under United States v. Leon, 468 U.S. 897 , 104 S.Ct. 3405 , 82 L.Ed.2d 677 (1984).

The court opined that there was “nothing so glaring about this search warrant that would suggest to a well-trained officer that he [or she] could not rely on that warrant particularly since it [was] linked to [the appellant's address and computer very well.” Moreover, the “description of the contraband [was] clear and d[idn’t] leave anything subject to interpretation” and the source of the tip was Google, which did “have some degree of reliability.” ¹⁰² The appellant filed a motion for reconsideration addressing only the issue of staleness, which the State opposed, 4 On the first day of trial, the court heard argument on that motion and denied it. Before this Court, the appellant contends the suppression court erred by “ruling that the evidence contained within the search warrant affidavit was not stale.” He relies upon numerous federal cases on staleness of probable cause that hold that information leading police to believe that child pornography is present on a computer can become stale over time; that each case must be considered on its unique facts; and that a period of more than a year is often too remote. The appellant argues that because the warrant affidavit established only that one image of suspected child pornography was attached to an email on an unknown date before January 2, 2015, and there were no facts showing that Detective Pallas took any additional investigative steps to determine when that image was uploaded, the court could not assess whether the length of time was too remote. He maintains, moreover, that Detectives Pallas and Onorio could not “claim objective good faith when they relied upon a search warrant that was so lacking in probable cause.” The State responds that the warrant application in this case was not the type of conclusory, bare-bones application that falls outside the broad protections of Leon , and the suppression court correctly ruled that the detectives relied upon the warrant in good faith.

The State maintains that because the good faith ruling was correct, this Court need not address the staleness issue; and if we do, the issuing judge had a substantial basis to believe that probable cause supporting the warrant was not stale, and therefore child pornography would be found at the appellant’s townhouse. We shall address staleness and good faith. ¹⁰³ -a- Our standard of review when considering a facial challenge to a search warrant is well-established: We determine first whether the issuing judge had a substantial basis to conclude that the warrant was supported by probable cause. State v. Amerman, 84 Md.App. 461, 463-64 , 581 A.2d 19, 20 (1990). We do so not by applying a de novo standard of review, but rather a deferential one.

The task of the issuing judge is to reach a practical and common-sense decision, given all of the circumstances set forth in the affidavit, as to whether there exists a fair probability that contraband or evidence of a crime will be found in a particular search. Illinois v. Gates, 462 U.S. 213, 238-39 , 103 S.Ct. 2317, 2332 , 76 L.Ed.2d 527, 548 (1983). The duty of a reviewing court is to ensure that the issuing judge had a “substantial basis for ... concluding] that probable cause existed.” Id. (Quotation and citations omitted); Birchead v. State, 317 Md. 691, 701 , 566 A.2d 488, 492-93 (1989); Potts v. State, 300 Md. 567, 572 , 479 A.2d 1335, 1338 (1984) (Quotation and citation omitted).

The U.S. Supreme Court explained in Gates that the purpose of this standard of review is to encourage the police to submit to the warrant process. Gates, 462 U.S. at 237 n.10, 103 S.Ct. at 2331 n.10, 76 L.Ed.2d at 547 n.10. Greenstreet v. State, 392 Md. 652, 667-68 , 898 A.2d 961 (2006). “One of the factors in the ‘probable cause puzzle’ concerns the staleness of the information contained in an affidavit supporting a search warrant application.” Behrel v. State, 151 Md.App. 64, 88 , 823 A.2d 696 (2003) (quoting West v. State, 137 Md.App. 314, 327-28 , 768 A.2d 150 (2001)). “There is no ‘bright-line’ rule for determining the ‘staleness’ of probable cause; rather, it depends upon the circumstances of each case, as related in the affidavit for the warrant.” Connelly v. State, 322 Md. 719, 733 , 589 A.2d 958 (1991). In making that assessment, the court considers whether “the ‘event[s] or circumstance[s] constituting probable cause, occurred at ... [a] time ... so remote from the date of the affidavit as to render it ¹⁰⁴ improbable that the alleged violation of law authorizing the search was extant at the time[.]’ ” Patterson v. State, 401 Md. 76, 92 , 930 A.2d 348 (2007) (quoting Peterson v. State, 281 Md. 309, 314 , 379 A.2d 164 (1977)).

That assessment turns on the particular facts of the case: The ultimate criterion in determining the degree of evaporation of probable cause, however, is not case law but reason. The likelihood that the evidence sought is still in place is a function not simply of watch and calendar but of variables that do not punch a clock: the character of the crime (chance encounter in the night or regenerating conspiracy?), of the criminal (nomadic or entrenched?), of the thing to be seized (perishable and easily transferable or of enduring utility to its holder?), of the place to be searched (mere criminal forum of convenience or secure operational base?), etc. The observation of a half smoked marijuana cigarette in an ashtray at a cocktail party may well be stale the day after the cleaning lady has been in; the observation of the burial of a corpse in a cellar may well not be stale three decades later. The hare and the tortoise do not disappear at the same rate of speed. Andresen v. State, 24 Md.App. 128, 172 , 331 A.2d 78 (1975) (emphasis added).

Several federal courts addressing staleness of probable cause in the context of child pornography stored on digital devices have reasoned that because digital images have a “potentially infinite lifespan,” United States v. Elbe, 774 F.3d 885, 891 (6th Cir. 2014), cert. denied, — U.S.-, 135 S.Ct. 1573 , 191 L.Ed.2d 656 (2015), “ ‘the passage of time alone’ cannot demonstrate staleness.” United States v. Burkhart, 602 F.3d 1202, 1206 (10th Cir. 2010) (quoting United States v. Mathis, 357 F.3d 1200, 1207 (10th Cir. 2004)). In Seiver, 692 F.3d at 775-76 , for example, the Seventh Circuit held that a seven-month delay from the date that child pornography images were downloaded from the internet to the defendant’s computer to the date a search warrant for the defendant’s computer was applied for did not render the information stale. The court opined: ¹⁰⁵ “Staleness” is highly relevant to the legality of a search for a perishable or consumable object, like cocaine, but rarely relevant when it is a computer file. Computers and computer equipment are “not the type of evidence that rapidly dissipates or degrades.” United States v. Vosburgh, 602 F.3d 512, 529 (3d Cir. 2010).

Because of overwriting, it is possible that the deleted file will no longer be recoverable from the computer’s hard drive. And it is also possible that the computer will have been sold or physically destroyed. And the longer the interval between the uploading of the material sought as evidence and the search of the computer, the greater these possibilities. But rarely will they be so probable as to destroy probable cause to believe that a search of the computer will turn up the evidence sought; for probable cause is far short of certainty—it “requires only a probability or substantial chance of criminal activity, not an actual showing of such activity,” Illinois v. Gates, 462 U.S. 213 , 244 n. 13, 103 S.Ct. 2317 , 76 L.Ed.2d 527 (1983), and not a probability that exceeds 50 percent (“more likely than not”), either.

Hanson v. Dane County, 608 F.3d 335, 338 (7th Cir. 2010). Id. at 777 (emphasis in original). The Seiver court recognized that after a very long time, the likelihood that the defendant still has [a particular] computer, and if he does that the file hasn’t been overwritten, or if he’s sold it that the current owner can be identified, drops to a level at which probable cause to search the suspect’s home for the computer can no longer be established. Id.

(emphasis in original). Seven months was far too short a period of time for that to occur, however. See also United States v. Carroll, 750 F.3d 700, 704-05 (7th Cir. 2014) (five-year gap between date victim alleged she was molested by defendant, at which time he showed her images of child pornography and took digital images of her genitals, and date of warrant application was not so remote as to render probable cause to search the defendant’s home and seize cameras ¹⁰⁶ and other digital devices stale); Burkhart, 602 F.3d at 1206-07 (information pertaining to an email between child pornography distributor and the defendant two years and four months before issuance of a search warrant not stale); United States v. Morales-Aldahondo, 524 F.3d 115, 119 (1st Cir. 2008) (lapse of three years between the defendant’s purchase of digital child pornography images and warrant application did not render search warrant stale); but see United States v. Great-house, 297 F.Supp.2d 1264, 1272-73 (D. Ore. 2003) (information that child pornography was distributed from a computer f: drive 13 months before a search warrant was applied for was stale, so search warrant was not supported by probable cause). In the case at bar, the March 18, 2016 warrant application