On Appeal from the United States District Court for the Eastern District of Pennsylvania District Court No. 2-07-cr-00171-001. District Judge: The Honorable Timothy J. Savage.
The opinion of the court was delivered by: Smith, Circuit Judge
Before: SCIRICA, Chief Judge, BARRY, and SMITH, Circuit Judges
Roderick Vosburgh appeals his conviction for possession of child pornography in violation of 18 U.S.C. § 2252(a)(4)(B) and attempted possession of child pornography in violation of 18 U.S.C. § 2252(b)(2). We will affirm.
At the center of this case is an underground Internet message board known as Ranchi. Ranchi allows users to post links to images and videos of child pornography.*fn1 Ranchi is not simply an open forum in which some posts happen to be related to child pornography; child pornography is Ranchi's raison d'etre. It describes itself as a place to "share all kinds of material especially for all the kiddy lovers around the world. This material can range from non-nude cuties to hard core baby material." Ranchi allows its users access to a wide range of pornographic pictures and videos, including hard core videos of infants and other children engaging in sexual acts with each other and with adults. Ranchi explicitly warns that the pornographic materials posted to the board are illegal.
Ranchi does not itself host child pornography; instead, it directs users to where it can be found elsewhere on the Internet. For obvious reasons, chiefly among them a desire to evade law enforcement, Ranchi operates in the far recesses of cyberspace. It is accessible through the use of any one of three "gateway" websites that exist at any given time. Each gateway consists of a web page that contains nothing but a hyperlink to the actual Ranchi message board. The gateway sites change approximately every three months, but regardless of their location, they always point to the most recent location of the Ranchi board, which itself moves around the Internet on a weekly basis. It is highly unlikely that an innocent user of the Internet would stumble across Ranchi through an unfortunate Google search. Because Ranchi moves so frequently and has cumbersome URLs, it is most often, if not always, accessed by way of the gateway sites. Interested persons often learn of Ranchi, and where to find the gateways, through postings on other child pornography websites.
A user seeking to access a link to child pornography posted on Ranchi cannot do so with a simple click of the mouse. It requires several steps. URLs as posted by Ranchi users typically begin with the prefix "hxxp," rather than the customary "http," to make it less likely that the links will be detected by search engines. Therefore, a user interested in that link must copy it from the board, paste it into the address bar of a web browser, and then change "hxxp" to "http" so that the address will be recognized by the browser. Only then can the file be accessed and downloaded. Even after downloading, files cannot be viewed immediately. They first must be decrypted, in part through use of a password.
In July 2006, FBI Special Agent Wade Luders learned of Ranchi's existence from a suspect apprehended in an investigation of a different child pornography board. That suspect authorized Luders to use his Ranchi handle, "Bongzilla," to go undercover on the board. On October 25, 2006, Luders posted six links to what purported to be child pornography. One of those links directed users to a video lo c a t e d a t th e f ollo w in g a d d re s s hxxp://uploader.sytes.net/12/05/4yo_suck.rar.html. Along with this link, Luders posted the following description:
[H]ere is one of my favs -- 4yo hc with dad (toddler, some oral, some anal) -- supercute! Haven't seen her on the board before -- if anyone has anymore, PLEASE POST.
In the parlance of Ranchi, "yo" stood for "year old" and "hc" stood for "hard core."*fn2 Luders quickly realized that because he had mistakenly failed to encrypt the file, it was unlikely to attract attention. He then re-posted the "4yo_suck" link and posted instructions for decrypting the file. He also promised to post the necessary password, but never did.
The "4yo_suck" link (hereinafter the "Link") was, in short, a trap. It did not direct the user to actual child pornography. It was a dummy link which led only to Agent Luders's secure FBI computer. The "video" downloaded by way of the Link generated only gibberish on the recipient's computer screen. Meanwhile, Agent Luders's computer generated a log file containing the Internet Protocol addresses ("IP addresses")*fn3 of every user who attempted to access the Link, and the date and time of each attempt. Among those who attempted to access the Link was a user at the IP address 188.8.131.52. That individual attempted to download the Link three times in a two-minute period between 11:46 and 11:48 p.m. EST on October 25, 2006. Luders traced this IP address to Comcast Cable Communications. In response to a subpoena, Comcast informed the government that "the individual utilizing the IP address 184.108.40.206 on October 25, 2006 at [the relevant times] did so using an account subscribed to by Rod Vosburgh, residing at 37 State Rd., Apt. B4" in Media, Pennsylvania. Luders forwarded this information to FBI Special Agent David Desy in Philadelphia.
B. Affidavit and Search Warrant
Agent Desy took steps to confirm that Vosburgh lived at the address identified by Comcast, and that he lived there alone. A January 17, 2007, search of Pennsylvania Bureau of Motor Vehicle records confirmed that Vosburgh resided at 37 State Road, Apartment B4 in Media, and a Choicepoint query conducted the same day revealed the same information. On January 31, 2007, through query of the U.S. Postal Service, Agent Desy learned that Vosburgh was the only person receiving mail at the apartment in question. In addition, Agent Desy twice conducted surveillance of the apartments at 37 State Road, and both times observed a vehicle in the parking lot matching the description of the one owned by Vosburgh.
On February 23, 2007, Agent Desy applied for a warrant to search Vosburgh's apartment. The affidavit in support of that application described how computers and the Internet have facilitated the spread of child pornography. It explained what IP addresses are, and how "[l]aw enforcement entities, in conjunction with Internet Service Providers, have the ability to identify a user's IP address to a specific household or residence." It also described certain characteristics and habits of persons interested in child pornography. It noted that "[c]hild pornography collectors almost always maintain and possess their material in the privacy and security of their homes, or some other secure location such as their vehicle(s), where it is readily available," and that collectors tend to hoard their materials:
Because the collection reveals the otherwise private sexual desires and intent of the collector and represents his most cherished sexual fantasies, the collector rarely, if ever, disposes of the collection. The collection may be culled and refined over time, but the size of the collection tends to increase.
The affidavit also noted that even if a collector deletes illegal materials from his computer's hard drive, law enforcement can often retrieve those files using forensic tools. Next, the affidavit described the nature of Ranchi, with graphic descriptions of some of the illegal pornographic materials that agents had found posted to the site. It then summarized Agent Luders's posting of the Link, how his computer logged the IP addresses of users who attempted to access the Link, and why it was unlikely that anyone who attempted to download the video promised by the Link would have done so by accident.*fn4 Finally, the affidavit laid out the facts specific to Vosburgh. It noted that an individual using the IP address 220.127.116.11 attempted to access the Link three times on the night of October 25, 2006. It recounted how Agent Desy traced that IP address back to Vosburgh's apartment, and the subsequent steps Agent Desy took to confirm that Vosburgh actually lived there. It also described in detail the property to be searched and the items to be searched and seized. Those items included "[a]ny and all items which may be used to visually depict child pornography, store information pertaining to the sexual interest in child pornography, or to distribute, possess, or receive child pornography, . . . including . . . computer hardware[.]"
Magistrate Judge Felipe Restrepo issued a search warrant on February 23, 2007, approximately four months after Vosburgh's apparent attempts to access the Link. That warrant was executed on February 27, 2007. Before they arrived at his apartment, officers learned that Vosburgh lawfully owned more than a dozen guns. Concerned for their safety, officers attempted to lure Vosburgh out of his apartment with a ruse. They knocked on his door, identified themselves as police, and told him that they wanted to talk to him because his car had been vandalized. Vosburgh did not answer the door, but from the apartment came a sound of "metal on metal" that sounded like the racking of a gun. Alarmed, officers remained outside of the apartment and attempted to persuade Vosburgh to open the door. They knocked at least three times, with the knocks getting louder each time. They also called Vosburgh's telephone several times and left messages asking him to come out of the apartment. Approximately 27 minutes after officers first knocked, Vosburgh opened the door. He told officers that he did not answer sooner because he had been in the bathroom.
Inside Vosburgh's apartment, police found pieces of smashed thumb drives, one of which was floating in the toilet. They also found a hammer and a pair of scissors outside of the bathroom door.*fn5 They found a screwdriver next to a computer tower in the kitchen. The computer's panel had been forcibly removed and its internal hard drive was missing. Part of an internal drive was found in a trash bag in the kitchen, and the remains of that same hard drive were found on a bookshelf in the living room. The destroyed internal hard drive was compatible with the tower in the kitchen.
In an interview with Agent Desy, Vosburgh acknowledged that he lived alone in the apartment and that he owned a computer. He denied intentionally breaking or destroying the computer's internal hard drive; he claimed that he had discarded it two or three weeks earlier because it was corrupted. He told officers that he owned an external hard drive that contained adult pornography, and a thumb drive that contained work documents and more adult pornography. Officers collected the internal hard drive and the pieces of the thumb drive, but the FBI's computer forensics experts were unable to recover anything from either. They also took the external hard drive, which was intact and later examined by FBI forensics expert Justin Price.*fn6
C. Contents of the External Hard Drive
The external hard drive contained a folder with hundreds of pictures of what the government calls "child erotica."*fn7 Many of these were pictures of a young Asian girl known as Loli-chan who has gained some notoriety by posting suggestive photos of herself on the Internet.*fn8 It also contained a folder called "jap111." This folder contained twenty pictures of adult women in .jpeg format*fn9 and a file called thumbs.db which itself contained 68 'thumbnail' images. Two of those images were of child pornography. One depicted a naked prepubescent girl in the computer room of a house, with one leg propped up unnaturally to expose her genitalia. This image became Government Exhibit 14 at trial, and we will refer to it as such. The second depicted four naked young girls, sitting on a couch with their legs spread to expose their genitalia. This became Government Exhibit 15.
Notably, these two images did not exist as full-sized, independent picture files (such as .jpeg files) in the jap111 folder when the government seized the hard drive. Nor were full-sized .jpegs of those images recovered anywhere else on the external hard drive. Rather, they existed only as miniatures within the thumbs.db file in the jap111 folder. Because the nature of thumbs.db is critical to resolution of the issues raised in this appeal, it is necessary to recount the record evidence concerning this file.
On ordinary computers running Windows operating systems, picture files are often stored in folders. When a folder is opened, the user has several options for displaying the pictures contained therein. One option is the "thumbnail" view. When the user selects the thumbnail view, a miniature version of each picture in the folder is displayed. Each of those miniatures is called a "thumbnail." The user can click on the thumbnail to open it and view a full-sized version of the picture. When the user selects the thumbnail viewing option, the Windows operating system automatically creates a hidden system file called "thumbs.db" within that folder. The user need not instruct Windows to do so; it happens automatically as part of the process of viewing the contents of the folder in thumbnail view. Thumbs.db is not a collection of many image files; it is a single file, which can be thought of as a visual catalog of all the image files contained in the folder. It contains a miniature, degraded version of every image in the folder that has been converted into a thumbnail pursuant to the use of the thumbnail view.
The thumbs.db file is stored within the folder whose content it reflects, along with the picture files themselves. But the ordinary user cannot view the contents of thumbs.db. Indeed, the ordinary user does not even know that thumbs.db is there. At trial, the government's expert Justin Price confirmed that opening the thumbs.db file to view its contents requires special software, and that there was no evidence that Vosburgh possessed such software or was otherwise capable of viewing the contents of the thumbs.db file in the jap111 folder.
The significance of the presence of Exhibits 14 and 15 in the thumbs.db file on Vosburgh's external hard drive was one of the central factual issues at trial. The government contended that the existence of Exhibits 14 and 15 in the thumbs.db file was evidence that corresponding full-sized picture files once existed on Vosburgh's hard drive in the jap111 folder. According to the government, Vosburgh knowingly possessed such pictures but then deleted them at some point before the search of his apartment on February 27; this explained why the hard drive contained thumbs.db versions of Exhibits 14 and 15, but not full-sized .jpeg versions of those same images. We will refer to this theory throughout our opinion as the government's "prior possession" theory.
Vosburgh vigorously contested the prior possession theory. He contended at trial, and now contends on appeal, that he conclusively disproved the theory with an in-court demonstration by his expert, Dr. Rebecca Mercuri. He also offered several alternative explanations for the presence of Exhibits 14 and 15 in the jap111 thumbs.db file.
On June 5, 2007, a grand jury in the Eastern District of Pennsylvania returned a four-count superseding indictment against Vosburgh. Count I charged that Vosburgh "knowingly possessed one external hard drive that contained visual depictions" of child pornography, in violation of 18 U.S.C. § 2252(a)(4)(B), "on or about February 27, 2007." This charge related to his possession of the hard drive containing the images that became Exhibits 14 and 15. Count II charged Vosburgh with attempted possession of child pornography in violation of 18 U.S.C. § 2252(b)(2), in connection with Vosburgh's attempts to access the Link. Count III charged that Vosburgh knowingly altered or destroyed tangible objects with the intent to obstruct the investigation of a matter within the jurisdiction of the FBI, in violation of 18 U.S.C. § 1519. Count IV charged Vosburgh with violating 18 U.S.C. § 2232 by knowingly destroying property in order to prevent its lawful seizure by the government.
Considerable motion practice preceded Vosburgh's trial. Three sets of motions are most relevant to this appeal. First, Vosburgh and the government filed motions in limine. The government sought to admit much of the child erotica found on the external hard drive; Vosburgh sought to exclude it. The government argued that those materials, while not illegal, were relevant because they suggested that Vosburgh had a sexual interest in children and tended to disprove that Vosburgh did not know that he possessed the pornographic pictures in Exhibits 14 and 15. It further argued that the images were admissible under Rule 404(b) because possession of those materials helped to show Vosburgh's intent to possess child pornography. Vosburgh argued that the District Court should exclude the child erotica as unduly prejudicial under Rule 403. Ultimately, the District Court admitted some but not all of this evidence. It allowed forty-six non-pornographic images of prepubescent girls in swimsuits and thirty of the Loli-chan pictures.
Second, on June 19, 2007, Vosburgh filed a request for a bill of particulars. He demanded that the government specify, inter alia, the time and date that he allegedly "downloaded the two visual depictions" which formed the basis for Count I. The government opposed Vosburgh's request on the ground that Vosburgh already knew everything he was entitled to know:
[T]he defendant has been provided with substantial discovery, including reports of interviews of witnesses, four search warrant affidavits, grand jury testimony, police reports, documents, and reports of forensic examinations of the computer equipment. Moreover, defendant has had access to and reviewed the evidence (including images and documents on the external hard drive) that was seized from his residence. Additionally, because the case originated by complaint and warrant, defendant was informed, in detailed fashion, of the basis of the underlying charges as set forth in the affidavit. The defendant even took the opportunity to cross-examine the case agent at his probable cause hearing. And, finally, after the Superseding Indictment, government counsel identified for defense counsel the two images found on defendant's external hard drive that comprise the charges for the possession of child pornography.
Nevertheless, the government gave a few specific responses to the inquiries raised in Vosburgh's request. In light of those responses, the District Court denied Vosburgh's request for a bill of particulars as moot.
Third, Vosburgh moved to suppress the external hard drive and other evidence seized in his apartment, claiming that the warrant was not supported by probable cause. After a hearing, the District Court denied Vosburgh's motion to suppress the fruits of the search, concluding that the magistrate "had a substantial basis for finding probable cause that there would be child pornography related evidence in the apartment described in the warrant."*fn10
Trial began on October 31, 2007 and lasted for four days. The relevant testimony is summarized below.
1. Agents Luders and Desy
Agents Luders and Desy testified about the events that led to Vosburgh's arrest. Agent Luders testified to his threeand-a-half years of experience investigating child pornography crimes with the FBI. He described his investigations of Ranchi and similar websites, and the nature of the child pornography accessible through Ranchi. He described how he posted the Link, how his computer logged Vosburgh's IP address, and how he traced that IP address to Vosburgh. He also testified about the measures Ranchi has taken to conceal itself from all but the most dogged pursuers of child pornography, and why it was unlikely that anyone would have stumbled across the board accidentally. Finally, he testified to the steps users had to go through in order to access materials posted to the board, and why it was unlikely that anyone who had undertaken each of those steps would have done so inadvertently.
Agent Desy testified about the steps he took once he received the lead about Vosburgh from Agent Luders. He described how he confirmed where Vosburgh lived and the process by which he obtained the search warrant for Vosburgh's apartment.
A witness from Comcast testified about IP addresses and the process by which Comcast responds to requests from law enforcement to match IP addresses to individual Comcast subscribers. He explained that Comcast's automated system assigns a unique IP number to each customer on a dynamic basis, and that the "lease period" for each IP address is approximately 6-8 days. At the expiration of that lease period, the assignment of an address to a particular computer may or may not be renewed. He further explained that Comcast can trace an IP address back to a particular customer's account, through IP assignment logs that go back 180 days. Finally, he testified that between October 20 and October 30 of 2006, IP address 18.104.22.168 was assigned to an account registered to Vosburgh at 37 State Road, Apartment B4 in Media.
Price, an information technology specialist for the FBI, was the government's expert witness. He conducted the forensic examination of Vosburgh's external hard drive. He testified in support of the prior possession theory. According to Price, the fact that the thumbs.db images of Exhibits 14 and 15 existed in the jap111 folder was proof that corresponding, full-sized originals must have also existed within that folder and on Vosburgh's hard drive. He testified that the thumbs.db file containing Exhibits 14 and 15 was created on February 21, 2007, and that those specific images were added to (or modified within) thumbs.db on February 22 -- meaning that "on February 22, basically the user went into the [jap111] folder . . . clicked on view and showed these pictures in thumbnail view." While Price testified that the presence of an image in the thumbs.db was definitive proof that the original, full-sized version of that image existed in the folder at one time, he also admitted on cross-examination that the presence of a picture within a folder did not necessarily mean that the image was actually viewedby the user. It meant only that the picture was present in a folder that was viewed in the thumbnail view.
Retired U.S. Postal Inspector Thomas Clinton testified about the naked female in Exhibit 14. He explained that for the last 18 years of his career, he led a task force of agents investigating the transmission, production, and distribution of child pornography throughout the country. He testified that he recognized the female in Exhibit 14 because he had been in her home in New Kensington, Pennsylvania in 2003, during the execution of a search warrant. According to Clinton, she was a young girl who was living with her adoptive father at that time. Clinton testified that after the search of the house, the father was arrested and the girl was taken into protective custody. Over Vosburgh's hearsay objection, Clinton also testified that he knew the girl's date of birth to be August 25, 1992. On cross-examination, Clinton confirmed that he was not present when the photograph that became Exhibit 14 was taken, but reiterated that he recognized the girl in the picture and that she was less than 11 years old when he met her in New Kensington.
Mercuri was Vosburgh's forensic computer expert, and her testimony formed the bulk of Vosburgh's defense. Mercuri had conducted her own forensic examination of the external hard drive. In her pre-trial expert report, she concluded that "there is absolutely no evidence that the [images in Exhibits 14 and 15] . . . ever existed as individual .jpeg files at any time on [Vosburgh's] hard drive." At trial, she likewise fiercely disputed the prior possession theory. According to Mercuri, the fact that a thumbs.db file containing Exhibits 14 and 15 appeared in the jap111 folder was not proof that full-sized .jpegs of Exhibits 14 and 15 once existed on the hard drive. To underscore that point, Mercuri conducted a live, in-court demonstration using two computers. Mercuri created a folder with four .jpegs depicting natural scenery: Pond, Blue Hill, Sunset, and Winter. She opened the folder and selected the thumbnail view, thus creating within that folder a thumbs.db file containing all four images. She then deleted Blue Hills and Winter from the folder, leaving only the Pond and Sunset .jpegs. Next, she copied the entire folder onto a second computer. When she opened that folder on the second computer, it contained only the Pond and Sunset .jpegs, but it also contained the thumbs.db file created on the first computer. Using special software to view the contents of ...