Redkovsky v. State
Panel: Meredith, Berger, Kehoe, JJ. Berger, J. 25 254 A jury in the Circuit Court for Washington County convicted appellant, Vyacheslav Redkovsky, of four counts of distribution of child pornography and four counts of possession of child pornography. As to two of the distribution charges, the trial court sentenced appellant to consecutive ten-year sentences, with all but six years of each sentence suspended, and merged the remaining counts for sentencing purposes. On appeal, appellant challenges the sufficiency of the evidence to sustain his convictions. 255 We conclude that the evidence was sufficient and affirm the judgments of the trial court.
BACKGROUND Corporal Roger Schwarb of the Maryland State Police ("MSP") testified that in February of 2016, he was assigned to the MSP division of the Internet Crimes Against Children Task Force ("Task Force"). In connection with his duties on the Task Force, Corporal Schwarb investigated internet child pornography on BitTorrent, a peer-to-peer file-sharing protocol. 1 BitTorrent allows users to download material, while also sharing material from the users' files. Corporal Schwarb explained the basic process for accessing a peer-to-peer network. First, a user must download a "client," which is a free, publicly-available computer program. uTorrent is a popular client, which allows users to access the BitTorrent network.
Corporal Schwarb explained that the client searches for files on the network by using a "torrent," which is similar to a library "indexing card." 2 A torrent contains text identifying the files associated with that torrent, including the number of files associated with that torrent, the size of the files and their location. The torrent does not contain any files or images; it only contains data with file descriptions. Each torrent is assigned a "hash," which is a specific number, similar to an electronic "thumbprint." 3 Once the user downloads 256 a particular torrent, that torrent is saved in the user's client. Corporal Schwarb explained that, for example, a user who is interested in Lassie movies could search for a torrent using the term "Lassie," and the user will receive a list of torrent files associated with that search term.
The BitTorrent client then searches the peer-to-peer network to find 26 the info hashes for files associated with that torrent. If there are "a hundred images of that torrent for Lassie, it will go out, you'll get those hundred images," and "[y]ou've essentially downloaded all the files associated with that torrent." Corporal Schwarb's state computer used a software program specifically designed to allow law enforcement to operate undercover, searching BitTorrent for child pornography files located in Maryland. 4 On February 13, 2016, Corporal Schwarb's state computer generated a summary log identifying search results for a specific torrent associated with known child pornography info hashes. Three files associated with that torrent downloaded to the state computer from the IP address "24.170.239.94." Corporal Schwarb explained that the software program allows law enforcement to obtain a "single source download," from only one IP address at a time. 5 Corporal Schwarb viewed three of the downloaded files: [ (1) "000015.mpg;" (2) "000018.avi" and (3) "000019.avi"], and observed that those files depicted child pornography. On March 12, 2016, Corporal Schwarb's state computer's activity log identified an additional file, "!(PTHC)Composite01-fatherandhis12yotwinsdaughters-13m19s.avi," which had again 257 downloaded to his computer from the IP address 24.170.239.94 via the BitTorrent network.
Corporal Schwarb reviewed the March 12, 2016 video file and observed that it depicted child pornography. Corporal Schwarb copied to a CD the three video files downloaded to his computer on February 13, 2016 and the one video file downloaded on March 12, 2016 from the IP address 24.170.239.94. The four video files contained on the CD were played for the jury and admitted as evidence. The parties stipulated that each of the four video files identified by Corporal Schwarb depicted someone under the age of 15 engaged in sexual conduct.
Corporal Schwarb testified that he researched the IP address 24.170.239.94 on the public website, American Registry for Internet Numbers (ARIN), and learned that the IP address 24.170.239.94 was registered to Antietam Cable. Corporal Schwarb sent a subpoena to Antietam Cable for the subscriber information associated with the IP address 24.170.239.94. Antietam Cable responded that the subscriber to the account for that IP address was Slava Redkovsky located at 1034 Mount Aetna Road, Hagerstown, Maryland. 6 At 4:50 a.m. on April 6, 2016, Corporal Schwarb assisted members of the Task Force in the execution of a search warrant at 1034 Mount Aetna Road. Corporal Schwarb arrived at the residence and spoke with appellant in the driveway, as appellant prepared to leave for work.
Appellant provided his house keys to the Task Force and the Task Force searched the home. Corporal Schwarb observed that there appeared to be only one person living in the house. Corporal Schwarb determined 27 that appellant's WiFi network was secured, as it required a password to access the WiFi network. The Task 258 Force seized a black Toshiba laptop and three hard drives from a custom built, "tricked out" computer tower.
State Trooper First Class Chris Reid of the Task Force interviewed appellant at his residence immediately following the search. The audio-recording of the interview was played for the jury at trial. In the interview, appellant acknowledged to Trooper Reid that he had a password protected wireless internet cable service provided by Antietam Cable. Appellant stated that he had a custom desktop computer, which he built as "a hobby." He also had two laptops: a broken HP laptop, which he was in the process of fixing, and a working Toshiba laptop.
Appellant explained that he bought the laptops on eBay "super cheap," and that he had tried to "fix them up." According to appellant, he was the only person who had used the Toshiba laptop. Appellant described himself as having "maybe a little more than average" knowledge of computers. Appellant stated that he understood a peer-to-peer file-sharing program to be one where "you like upload it to a server or something, and then if it's on a server, somebody else can go on and download it." Appellant stated that he understood that peer-to-peer file sharing involved sharing files with other people. Appellant indicated that he had heard of BitTorrent, but did not think that he had ever used it.
Appellant acknowledged that he had used the uTorrent program on his Toshiba laptop and expected that uTorrent was probably still on that laptop. When asked by Trooper Reid if he ever looked up pornography, appellant responded: "Uh, I can't say that I haven't, but not on a file sharing program." Appellant stated that he typically "would just Google for [pornography]." Appellant indicated to Trooper Reid that he did not expect that the Task Force would find any pornography on his laptop. Trooper Reid asked appellant if the Task Force would find any child pornography on appellant's computer, and he responded, "Gee, I hope not." According to appellant, he "didn't have any of that stuff on [his] computer" and "[didn't] want anything to do with child porn." 259 Steven Gibson, a computer forensic analyst with the Department of Homeland Security Investigations, testified as an expert in computer forensics and data analysis. Gibson assisted in the execution of the search warrant at 1034 Mount Aetna Road by previewing devices to identify items of evidentiary value.
On or about April 13, 2016, Gibson conducted a forensic analysis on multiple devices seized from appellant's residence, including a Toshiba laptop computer. Gibson observed that the peer-to-peer filing-sharing program, uTorrent, was installed on the Toshiba laptop and remained in active use. The most recent recorded logon date for the Toshiba laptop was April 6, 2016. In the course of Gibson's forensic analysis of the Toshiba laptop, he did not find any file names or visual images that matched the March 12, 2016 video provided to him by Corporal Schwarb.
Gibson's findings were recorded in a forensic report, and the State introduced that report in evidence. One year later, on or about April 18, 2017, Gibson conducted a subsequent analysis of the Toshiba laptop using GriFi Analyze, a digital imaging software tool, which had not previously been available to him. Using the four video files provided by Corporal Schwarb, Gibson searched the Toshiba laptop using a "hashset" from the info hashes and the file names, but found no filenames on the Toshiba laptop matching 28 the filenames of the four video files identified by Corporal Schwarb. In May of 2017, Gibson conducted a visual search of the files on the Toshiba laptop's thumbcache, 7 which is a hidden folder where users can view thumbnail-size images of their videos.
Gibson identified three thumbcache images that matched images from the three video files downloaded on February 13, 2016 by Corporal Schwarb. Gibson took a "screen shot of it for comparison view so [one] can see the exact frame where the thumb cache image is matching to that exact frame of the 260 video." The three "screenshot" images were admitted in evidence at trial. In the course of his visual file search, Gibson also discovered a complete video file located in the "unallocated" space of the Toshiba laptop, which matched the fourth video downloaded by Corporal Schwarb on March 12, 2016. Gibson explained that the unallocated space is the area containing deleted files that have been emptied from the computer's "trash can." Gibson was unable to determine when the video on the Toshiba laptop was created or whether it had ever been viewed; he could only determine that someone had deleted it.
Gibson explained that deleted files may be recovered from a computer so long as they have not been overwritten. DISCUSSION Appellant contends that the evidence against him was insufficient to support his convictions for distribution of child pornography because he did not "actively transfer or distribute the videos to the State's computer and did not knowingly make the videos available for download[.]" Appellant is not challenging the sufficiency of the evidence as to his convictions for possession of child pornography. The State argues that appellant's claim is not preserved because he failed to raise before the trial court the argument that he now advances on appeal. Alternatively, if the argument was preserved, the State contends that there was sufficient evidence to show that appellant knowingly distributed child pornography by making the video files available for other users of the file-sharing network to download.
Preservation The State contends that appellant's argument for acquittal was limited to "arguing that there was insufficient evidence that it was he who distributed the child pornography files to the State's computer." (Emphasis added). At the close of the State's case, the appellant moved for judgment of acquittal arguing: 261 Your Honor, at this time, I make a motion for judgment of acquittal, specifically with counts one through four - distribution. The legal definition says distribution is to transfer possession. I would argue that the State has not met [its] burden of showing that [appellant] transferred possession to the State.
And I'd ask the [c]ourt to grant the motion. The prosecutor responded: Your Honor, at this point, the State has shown that [appellant] has transferred possession. He transferred digital files to Corporal Schwarb. The showing that it was indeed [appellant] in this particular matter is the fact that the files in question linked back to [appellant's] IP address. 29 Furthermore, that didn't stop.
It also further went to the fact that not only did it link to his IP address, but a device that he readily identified as being his own. I - - indicated he was the only occupant, didn't frequently have visitors. It was his laptop. There were no other - there were no other - - there would be anticipated no other users of it.
Had either one of the videos saved - - still saved on his particular device as well - - or artifacts, in other words, thumb[ ]cache indicative of the other three files. Following counsel's arguments, the court ruled: "Your motion is denied, counsel." Pursuant to Maryland Rule 4-324 (a), a criminal defendant who moves for judgment of acquittal must "state with particularity all reasons why the motion should be granted[,]" and "is not entitled to appellate review of reasons stated for the first time on appeal." Starr v. State , 405 Md. 293 , 302, 951 A.2d 87 (2008) (citations omitted). Thus, "the issue of sufficiency of the evidence is not preserved when [the defendant]'s motion for judgment of acquittal is on a ground different than that set forth on appeal." Mulley v. State , 228 Md. App. 364 , 388-89, 137 A.3d 1091 (2016) (citations omitted). We have recognized, however, that a motion for judgment of acquittal may be sufficient to preserve an issue where the acquittal argument generally includes the issue raised on appeal.
See 262 Williams v. State , 173 Md. App. 161 , 168, 917 A.2d 1213 (2007) (finding that defendant's argument in support of acquittal that he was not in possession of a rental car that he was charged with failing to return, was sufficient to preserve his challenge that he lacked the required element of intent); Shand v. State , 103 Md. App. 465 , 488-89, 653 A.2d 1000 (1995) (defendant's argument that proof as to the elements of assault was lacking sufficiently preserved challenge for review); aff'd on other grounds , 341 Md. 661 , 672 A.2d 630 (1996). Appellant's argument in support of his motion for acquittal challenged the State's evidence relating to the element of transferring possession. The State argues that appellant's argument was confined to challenging the evidence as to his identity as the source of the child pornography sent to the State's computer. We disagree.
It was the prosecutor who addressed the sufficiency of the evidence linking appellant to the laptop and IP address. The State's argument on that point did not limit the scope of appellant's motion. We, therefore, conclude that appellant's argument challenging the element of transferring possession, though general, sufficiently encompassed the argument he raises on appeal: that the evidence was insufficient to establish that he transferred possession of child pornography files via the peer-to-peer file-sharing network. Appellant's argument in support of his motion for judgment of acquittal was sufficient to preserve his claim for appellate review.
Sufficiency of the Evidence We review a challenge to the sufficiency of the evidence to determine " 'whether, after viewing the evidence in the light most favorable to the prosecution, any rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt.' " Grimm v. State , 447 Md. 482 , 494-95, 135 A.3d 844 (2016) (quoting Cox v. State , 421 Md. 630 ,
This is a preview of Redkovsky v. State. About 50% of the opinion remains. Read the complete opinion in RecordCite.