People v. Kent

OPINION OF THE COURT

The question presented for our review is whether the evidence proffered at defendant’s trial was legally sufficient to support his convictions for promoting a sexual performance by a child (Penal Law § 263.15) and possessing a sexual performance by a child (Penal Law § 263.16). We must consider, among other issues, the evidentiary significance of “cache files,” or temporary Internet files automatically created and stored on a defendant’s hard drive, and the defendant’s awareness of the presence of such files. We conclude that where the evidence fails to show that defendant had such awareness, the People have not met their burden of demonstrating defendant’s knowing procurement or possession of those files. We further conclude that merely viewing Web images of child pornography does not, absent other proof, constitute either possession or procurement within the meaning of our Penal Law.

L

The following evidence was adduced at defendant’s trial. On May 26, 2005, defendant James D. Kent, a professor of public administration at a Dutchess County college, received a new office computer through a campus-wide technology upgrade. The files stored on the hard drive of the old computer were transferred to the new computer. On April 5, 2007, a student employee of the college’s information technology (IT) department went to defendant’s office in response to his complaints that his computer was malfunctioning. While running a virus scan of the computer’s hard drive, the employee discovered a work folder containing numerous “.jpg” or picture files, displayed as “thumbnails,” of scantily clad, prepubescent girls in provocative poses. When the virus scan failed to correct the computer’s unresponsiveness, the employee removed defendant’s hard drive and took it back to the IT office, where supervisors learned of the images. College administrators informed defendant that these images had been found on his computer, but defendant denied any knowledge of them. Approximately two *296weeks later, the college submitted defendant’s hard drive to the Town of Poughkeepsie Police Department with a “Consent to Search” form signed by a college administrator.

Barry Friedman, an investigator in the computer forensic lab of the New York State Police, conducted a forensic analysis of defendant’s hard drive using EnCase Software (EnCase). Investigator Friedman explained that EnCase searches both allocated space, which contains data (including saved items or items sent to the “recycle bin”) that is readily accessible to a user, and unallocated space, which contains material deleted from the allocated space and is inaccessible to a user. Defendant’s computer contained Real Player, a downloadable media program used to play videos and music that maintains a “play” history. The computer also had two Internet browsers: Internet Explorer and Mozilla Firefox. In addition to the default profile provided by Mozilla Firefox, a second profile under the name of “Jim” had been created.

The allocated space under the Jim profile on Mozilla Firefox contained a temporary Internet file known as a Web “cache.” A cache contains images or portions of a Web page that are automatically stored when that page is visited and displayed on the computer screen; if the user visits the Web page again at a later date, the images are recalled from the cache rather than being pulled from the Internet, allowing the page to load more quickly. The cache under the Jim profile contained a .jpg image of a child pornography Web site called “School Backyard” that depicted children engaged in sexual intercourse with adults.

According to the EnCase software, the “School Backyard” page had been accessed on the morning of February 21, 2007. Within minutes of accessing “School Backyard,” three other pages were accessed—two images of a young girl sitting in the front seat of her car with her wrists bound and a Web page labeled “Pedoland”—which were also stored in the Web cache. The cache contained several other Web pages labeled, among other things, “Best CP Sites Portal, the Best Lolita CP Sites,” that provided links to child pornography Web sites. Additionally, the Real Player history included links to numerous videos with file names indicating that they contained child pornography that were accessed, some on multiple occasions, between 2005 and 2007. There was no evidence that defendant was aware either of the cache function of his computer or that any of these files were stored in the cache.

*297The allocated space on defendant’s hard drive also contained a “My Documents” folder with subfolders labeled “cdocs” and another labeled “work,” and an additional folder labeled “JK.” The “cdocs” subfolder contained approximately 13,000 saved images of female children, whom Investigator Friedman estimated to be eight or nine years old, dressed in lingerie or bathing suits and many with their legs spread open. The “work” subfolder contained an additional 17,000 saved images of female children, some organized into further subfolders named for a particular child. The JK folder held a file labeled “porndef.pb,” which contained a document that included the text of four messages dated between June 1999 and July 2000 and directed to the unidentified recipient “P.B.”1 The messages apparently relate to a potential research project on the regulation of child pornography and include comments such as “sooner or later someone at this college is going to wonder why I keep looking at porno sites.” A final message dated July 11, 2001 states:

“Well, this last batch pretty much tears it. While, as somebody’s father, I’m pretty appalled by this stuff, I also don’t want to get arrested for having it. So let’s do this—if this is a legitimate research project, let’s write it up and tell the deans (and preferably also the cops) what we’re doing and why. Otherwise, let’s drop it in the most pronto possible fashion.

“I don’t even think I can mail the disk to you, or anyone else, without committing a separate crime. So I’ll probably just go ahead and wipe them. You have the URLs if you want to pursue it.

“See you sooner or later, no doubt. Kent.”

From the unallocated space on the computer, EnCase retrieved a video containing child pornography that had previously been downloaded and saved to the allocated space under the file name “Arina.” EnCase also discovered over 130 .jpg images depicting children engaged in oral sex and sexual intercourse with dogs, adults and other children, children being penetrated by objects, and the lewd exhibition of the exposed genitals of female children. Like the “Arina” video, each of these images had been downloaded and stored in the allocated space of defendant’s computer at some point between May 26, 2005 (the date that *298data was transferred from defendant’s old computer to his new computer) and April 5, 2007 (the date the IT employee removed the hard drive) before the user deleted them, sending them to unallocated space. There was no evidence that defendant ever paid for access to any of the child pornography found on his computer.

Defendant was indicted on two counts of promoting a sexual performance by a child (Penal Law § 263.15) and 141 counts of possessing a sexual performance by a child (Penal Law § 263.16). Counts 1 and 142 related, respectively, to defendant’s alleged procurement and possession of the “School Backyard” Web page; counts 2 and 143 related, respectively, to defendant’s alleged procurement and possession of the “Arina” video; counts 3 through 141 charged defendant with possession of the .jpg images recovered from the unallocated space of the hard drive. During defendant’s six-day nonjury trial, County Court denied defendant’s trial motions for dismissal of the indictment. At the close of the trial, County Court granted the People’s motion to conform the pleadings to the proof by amending count 2 of the indictment to reflect May 18, 2005 as the date of the alleged procurement of the “Arina” video. Thereafter, County Court found defendant guilty of both procurement counts (1 and 2) and 134 of the 141 possession counts, including counts 142 and 143.2 County Court subsequently denied defendant’s motion to set aside the verdict, finding that the evidence was legally sufficient to sustain his convictions (see CPL 330.30 [1]). Defendant was sentenced to concurrent indeterminate prison terms of 1 to 3 years.

The Appellate Division affirmed County Court’s judgment (see People v Kent, 79 AD3d 52, 73 [2d Dept 2010]). Addressing the evidentiary significance of the presence of Internet files stored in a cache, as well as the significance of defendant’s knowledge or lack of knowledge regarding the cache function of his computer, the court undertook a review of both federal and state approaches to these issues (see id. at 65-66). Noting that “[t]he consistent thread in these cases is the need to distinguish inadvertent or unintentional acquisition or possession of the offensive material from knowing or intentional procurement and possession,” the court stated its preliminary “agreement with the underlying premise that the mere existence of an image *299automatically stored in the cache, standing alone, is legally insufficient to prove either knowing procurement or knowing possession of child pornography” (id. at 66).

The court adopted the view, however, that “a Web page stored in the cache is evidence of past procurement of the images on that page. Specifically, the cached Web page from the ‘School Backyard’ site is evidence that the Web page was accessed and displayed on the defendant’s computer screen” (id. at 67). That defendant knowingly accessed the page was demonstrated by a totality of evidence including defendant’s pattern of Internet browsing for child pornography Web sites, his Real Player history, and his messages to “EB.” acknowledging his possession of child pornography (id. at 67-68). The court further held that the evidence was legally sufficient to prove defendant’s knowing possession of the images on the “School Backyard” page, finding that defendant “knowingly accessed the Web page and displayed it on his computer screen . . . establishing his dominion and control over the images” (id. at 68).

The court also found that the evidence was legally sufficient to support defendant’s 134 other convictions, because those counts were based on “images which, at one time, had been downloaded and saved in the allocated space of the hard drive and subsequently deleted” (id. at 68-69). With respect to count 2, for promotion of the “Arina” video, the court found that “the totality of the direct and circumstantial evidence of. . . defendant’s extensive use of his office computer to obtain and view child pornography was a sufficient basis from which the fact-finder could infer that [he] acquired the video, and thus, committed an act of procurement” (id. at 70).

A Judge of this Court granted defendant leave to appeal (17 NY3d 797 [2011]) and we now modify by reversing defendant’s convictions on counts 1 and 142 for promotion and possession of the “School Backyard” Web page and, as so modified, affirm.

IL

Recognizing that “[t]he public policy of the state demands the protection of children from exploitation through sexual performances” (L 1977, ch 910, § 1), the Legislature enacted article 263 of the Penal Law “to eradicate the social evil of child pornography” (People v Keyes, 75 NY2d 343, 348 [1990]). With limited exception (see People v Fraser, 96 NY2d 318 [2001]), we have not had occasion to determine the extent to which the current statutory scheme applies to child pornography distributed *300and consumed over the Internet, a forum unknown to legislative drafters 30 years ago and which now provides a readily accessible and expansive marketplace for illicit material. Indeed, the Internet now allows for “a diverse array of offenders who can access and circulate images easily and privately from home computers” (see Wolak, Finkelhor, Mitchell and Ybarra, Online “Predators” and Their Victims: Myths, Realities, and Implications for Prevention and Treatment, 63 Am Psychologist 111, 120 [Feb.-Mar. 2008]). The resulting danger to the safety and welfare of children cannot be overstated: in a study of persons prosecuted for Internet-related child pornography crimes, 80% had images showing the sexual penetration of a child and nearly 20% had images of children younger than age three (see Wolak, Finkelhor and Mitchell, Child-Pornography Possessors Arrested in Internet-Related Crimes: Findings from the National Juvenile Online Victimization Study, at 5 [2005]).

Penal Law § 263.15 provides that “[a] person is guilty of promoting a sexual performance by a child when, knowing the character and content thereof, he produces, directs or promotes any performance which includes sexual conduct by a child less than seventeen years of age.” To “promote” means, among other things, “to procure” (Penal Law § 263.00 [5]),3 itself defined as “obtain, acquire ... to get possession of by particular care or effort” (Keyes, 75 NY2d at 348 [internal quotation marks omitted]). Thus, “the term ‘procure’ . . . defines ‘promote’ for the purposes of Penal Law § 263.15 as simply the acquisition of child pornography, whether for personal consumption or for distribution to others” (id.). Penal Law § 263.16 provides that “[a] person is guilty of possessing a sexual performance by a child when, knowing the character and content thereof, he knowingly has in his possession or control any performance which includes sexual conduct by a child less than sixteen years of age.”

For purposes of both the promotion and possession statutes, “performance” is defined as “any play, motion picture, photograph or dance” (Penal Law § 263.00 [4]). We have held that digital computer images are photographs within the meaning of section 263.00 (4) (see Fraser, 96 NY2d at 327-328). “Sexual conduct,” as used in both statutes, “means actual or *301simulated sexual intercourse, oral sexual conduct, anal sexual conduct, sexual bestiality, masturbation, sado-masochistic abuse, or lewd exhibition of the genitals” (Penal Law § 263.00 [3]). Furthermore, both crimes require that the defendant acted knowingly (see Penal Law § 15.05 [2]). The exercise of ‘‘[d]ominion or control is necessarily knowing, and such ‘constructive possession’ may qualify as knowing possession” (People v Muhammad, 16 NY3d 184, 188 [2011]).

Defendant argues that merely “accessing and displaying” Web images of child pornography does not constitute procurement for purposes of Penal Law § 263.15. Defendant further contends that his possession convictions are invalid because Penal Law § 263.16 criminalizes the possession of tangible items only and that, absent proof that defendant was aware of his computer’s cache function, he could not have knowingly possessed any item stored in the cache. For the reasons that follow, we agree with defendant’s first proposition. We also agree that where a promotion or possession conviction is premised on cached images or files as contraband, the People must prove, at a minimum, that the defendant was aware of the presence of those items in the cache. We hold, however, that regardless of a defendant’s awareness of his computer’s cache function, the files stored in the cache may constitute evidence of images that were previously viewed; to possess those images, however, the defendant’s conduct must exceed mere viewing to encompass more affirmative acts of control such as printing, downloading or saving.

Federal courts have held that for digital images to constitute evidence of knowing possession of child pornography, such images must be connected to something tangible (e.g., the hard drive), as they are when stored in a cache, and that the defendant must be aware of that connection (see United States v Romm, 455 F3d 990, 1000 [9th Cir 2006] [“to possess the images in the cache, the defendant must, at a minimum, know that the unlawful images are stored on a disk or other tangible material in his possession”]; United States v Tucker, 305 F3d 1193, 1205 [10th Cir 2002] [“Since (the defendant) knew his browser cached the image files, each time he intentionally sought out and viewed child pornography with his Web browser he knowingly acquired and possessed the images”]). At least two state courts have adopted the federal approach (see Worden v State, 213 P3d 144, 147-149 [Alaska 2009]; Barton v State, 286 Ga App 49, 52-53, 648 SE2d 660, 663 [2007]).

*302The rule espoused by several other states and by the Appellate Division—that defendant’s awareness of the automatic cache function is immaterial because it is not the cached files that constitute the contraband but the images previously displayed—is conceptually distinct as it does not rely on the tangibility of the image (i.e., its permanent placement on the defendant’s hard drive and his ability to access it later) but on the fact that the image was, at one time, knowingly accessed and viewed (see Kent, 79 AD3d at 68; see also State v Hurst, 181 Ohio App 3d 454, 470, 909 NE2d 653, 664-665 [2009]; People v Josephitis, 394 111 App 3d 293, 301, 914 NE2d 607, 612-613 [2009]).4

Like the federal courts to address the issue, we agree that where no evidence shows defendant was aware of the presence of the cached files, such files cannot underlie a prosecution for promotion or possession. This is necessarily so because a defendant cannot knowingly acquire or possess that which he or she does not know exists (see United States v Kuchinski, 469 F3d 853, 863 [2006] [to prosecute a defendant who lacks knowledge about the cache for possession of files stored therein “turns abysmal ignorance into knowledge and a less than valetudinarian grasp into dominion and control”]).

However, cached images can serve as evidence of defendant’s prior viewing of images that were, at one time, resident on his computer screen. Such evidence, like a pattern of browsing for child pornography, is relevant to the mens rea of both crimes by showing that a defendant did not inadvertently access an illicit image or site or was not mistaken as to its content.

Nonetheless, that such images were simply viewed, and that defendant had the theoretical capacity to exercise control over them during the time they were resident on the screen, is not enough to constitute their procurement or possession. We *303do not agree that “purposefully making [child pornography] appear on the computer screen—for however long the defendant elects to view the image—itself constitutes knowing control” (Kent, 79 AD3d at 66, quoting Commonwealth v Diodoro, 601 Pa 6, 18, 970 A2d 1100, 1107 [2009]). Rather, some affirmative act is required (printing, saving, downloading, etc.) to show that defendant in fact exercised dominion and control over the images that were on his screen. To hold otherwise, would extend the reach of article 263 to conduct—viewing—that our Legislature has not deemed criminal.

The federal statute regulating conduct related to child pornography, 18 USC § 2252A, provides a useful contrast. Section 2252A was amended in 2008 to provide that any person who either “knowingly possesses, or knowingly accesses with intent to view, any book, magazine, periodical, film, videotape, computer disk, or any other material that contains an image of child pornography” is subject to a fine and imprisonment (see 18 USC § 2252A [a] [5] [B] [emphasis added], as amended by Pub L 110-358, § 203, 122 US Stat 4002, 4004). Neither provision of the Penal Law at issue here contains comparable language targeted toward the “pull technology” by which one accesses and views Internet images. The words that are employed—“procures” and “possesses”—would not, in ordinary speech, encompass the act of viewing (see State v Barger, 349 Or 553, 563, 247 P3d 309, 314 [2011] [“Looking for something on the Internet is like walking into a museum to look at pictures— the pictures are where the person expected them to be, and he can look at them, but that does not in any sense give him possession of them”]).

Here, the “School Backyard” Web page was automatically stored in the cache in allocated space that was accessible to defendant. The People did not demonstrate that defendant knew that the page, or any other, for that matter, had been cached. While the cached page provided evidence that defendant previously viewed the site, the People presented no evidence that defendant downloaded, saved, printed or otherwise manipulated or controlled the image while it was on his screen. That defendant accessed and displayed the site, without more, is not enough. Thus, the evidence was insufficient to show that defendant knowingly possessed the “School Backyard” Web page, either in the form of the cached file or as an image on his screen. It follows, therefore, that there was not sufficient evidence that defendant procured the “School Backyard” page; defendant did *304not “get possession of [the page] by particular care or effort” (Keyes, 75 NY2d at 348 [internal quotation marks omitted]) as by downloading it. Thus, defendant’s convictions under counts 1 and 142 should be reversed.

We agree with the Appellate Division, however, that defendant was properly convicted of promotion and possession of the “Arina” video, and possession of 132 images of child pornography recovered from the unallocated space on his computer. Investigator Friedman’s testimony established that at some point defendant downloaded and/or saved the video and the images, thereby committing them to the allocated space of his computer, prior to deleting them. Thus, viewing the evidence in the light most favorable to the People, a rational fact-finder could conclude that defendant acquired the video and exercised control over it and the images (see People v Contes, 60 NY2d 620, 621 [1983]). That defendant did so knowingly was conclusively established by, among other things, copious evidence of his persistent pattern of browsing for child pornography sites; his meticulous cataloguing of thumbnail images of young, provocatively dressed girls; his deletion of illegal images and retention of legal ones; and defendant’s messages to “P.B.” discussing the pornographic content of the images and sites defendant perused.

Defendant also contends that County Court erred in permitting the People to amend count 2 of the indictment and that counsel provided ineffective assistance. We have considered these arguments and find them to be without merit.

Accordingly, the order of the Appellate Division should be modified by dismissing counts 1 and 142 of the indictment and remitting to County Court for resentencing and, as so modified, affirmed.