COURT OF APPEALS OF VIRGINIA
Present: Judges Petty, Athey and Senior Judge Frank Argued by teleconference UNPUBLISHED
JAEYOUNG LEE MEMORANDUM OPINION* BY v. Record No. 0869-20-4 JUDGE ROBERT P. FRANK JULY 13, 2021 COMMONWEALTH OF VIRGINIA
FROM THE CIRCUIT COURT OF FAIRFAX COUNTY John M. Tran, Judge
Peter D. Greenspun (Liza Greenspun Yang; Greenspun Shapiro PC, on briefs), for appellant.
Timothy J. Huffstutter, Assistant Attorney General (Mark R. Herring, Attorney General; Robert H. Anderson, III, Senior Assistant Attorney General, on brief), for appellee.
Jaeyoung Lee, appellant, was convicted in a bench trial of one count of possessing child
pornography and ninety-nine counts of possessing child pornography as a second or subsequent
offense in violation of Code § 18.2-374.1:1. On appeal, he contends that the evidence was
insufficient to prove that he knowingly possessed, either actually or constructively, the visual
depictions of child pornography that the police found on three computer hard drive devices. For
the following reasons, we affirm appellant’s convictions.
BACKGROUND
On November 1, 2017, Detective Jon Long and other police officers executed a search
warrant at appellant’s residence at “Unit 435”in an apartment complex in Alexandria.1 Detective
* Pursuant to Code § 17.1-413, this opinion is not designated for publication. 1 The validity of the search warrant or the scope of the search is not before us. Long explained to appellant that he had a search warrant for his apartment. Long “gave him the
option of either staying or leaving.” Appellant walked with Long to Unit 435. Long testified
that appellant “stayed outside in the hallway” of the apartment “with his mom while the door
remained open” during the search.
The apartment contained one bedroom and one bathroom. The bedroom closet contained
men’s clothing but no clothing for women or children. The police found, in a walk-in closet off
the bedroom, a LaCie external hard drive for a computer on a shelf behind a pair of pants. Also
in the closet was a fingerprint card bearing appellant’s name.
The police found several backpacks of various colors in the apartment. Detective James
Lopez testified he found two black Western Digital My Password computer hard drives inside a
black and grey backpack.2 Detective Lopez first saw the backpack on a couch in the living
room. Within or beside the backpack was a bi-fold folder3 containing appellant’s application
with the U.S. Department of Justice Bureau of Alcohol, Tobacco, Firearms and Explosives to
build a firearm. The police recovered documents in the closet and living room area relating to
appellant, but no one else.
In November of 2017, Detective Nickolas Boffi, who was then a digital forensic
examiner for the Fairfax County police, received the hard drives that the police seized from
appellant’s apartment. Boffi examined the content of the hard drives. At trial, the
Commonwealth introduced diagrams demonstrating the file structure of the three hard drives.
2 These three hard drive devices are the subject of this appeal. 3 Lopez testified that he did not have personal knowledge of where the backpack originally was found, but that he saw a similar looking backpack hanging on the door to the utility room. Concerning Lopez’s testimony, the trial court said, “But I could not give any weight to Detective Lopez as to where those items were found . . . but I could not find from that – from Detective Lopez’s testimony as to where each of – each of the accordion folder or those personal items were actually located.” Nevertheless, the backpack was found in appellant’s living room. -2- The files on one of the Western Digital hard drives (WD-1) were structured into folders
with names such as “tara 8yr old slut,” “LS,” “preteen sluts,” “vicky,” and “candydoll.” There
was also a folder titled “preteen sluts child pornstar movies.” Boffi found child pornography
files within the designated folders. Boffi testified that anyone who plugged WD-1 into a
computer would see the file structure, which was “not hidden.” Additionally, anyone who
plugged in the hard drive to a computer would see “preteen sluts child pornstar movies” and
“candydoll” in the main folders. A person who clicked on the plus sign next to “preteen sluts
child pornstar movies” would access subfolders contained within that main folder that included
such titles indicative of child pornography as “tara 8yr old slut,” “vicky,” and “ls models.” All
of the child pornography images had been placed on the device on July 25, 2016. The source of
the child pornography was a device with a unique identification number with the last digits of
“9335-1000.”
Within a folder titled “Sony” on WD-1, Boffi found photographs of appellant. The
photographs of appellant were saved to the “Sony” folder on WD-1 on October 26, 2016. The
same device used to transfer the child pornography to WD-1, with the final digits of 9335-1000,
also was the source of appellant’s personal photographs.
Boffi also examined the second Western Digital hard drive (WD-2). One folder that
would be apparent when someone connected WD-2 to a computer was labeled “New Folder,”
which contained subfolders of child pornography. One subfolder within “New Folder” was
labeled “vcb,” which, in turn, contained a further subfolder titled “Vietnamese Child Brothel.”
“Vietnamese Child Brothel” contained pictures of child pornography. WD-2 contained more
than 2,700 files, at least some of which were child pornography. Child pornography images
were placed on WD-2 on June 4 and 6, 2016, from the device with the final identifying digits of
-3- 9335-1000, i.e., the same device that was the origin of the child pornography and the personal
photographs of appellant on WD-1.
Upon examination, Boffi found that the LaCie hard drive contained three “partitions,” or
separate storage areas. Within “Partition 3,” Boffi found a folder titled “New Folder” containing
child pornography. Per Boffi’s testimony, one video of child pornography was placed on the
LaCie hard drive on March 24, 2011. The video was saved on the hard drive with the path
“\New Folder\preteen sluts child pornstar movies\tara 8 yr old slut\Tara – wants you to f***
her.” The source of the video was a device with a unique identification number ending in
“4274-1000.” Boffi testified that the titles of all folders in the file structure on the device,
including those relating to child pornography, would be visible when other files or documents
were added to the device.
“Partition 3” of the LaCie hard drive contained a “Graduation” folder that included
pictures of appellant that were placed on the device on August 18 and 19, 2011. One of the next
major folders in the file structure was entitled “Documents,” within which Boffi found various
letters from appellant to doctors, as well as a resume associated with appellant. Another folder
named “Career” included appellant’s resume, and the “Personal” folder contained other items
connected to him. Yet another folder labeled “Pictures” included pictures of appellant as well.
The remaining child pornography on the LaCie device for which appellant was
prosecuted was placed there on November 16, 2013. The November 16, 2013 transfer of child
pornography was within the main folder titled “New Folder” and under the subfolder “preteen
sluts child pornstar movies,” where the previously saved “tara 8 yr old slut\Tara – wants you to
f*** her” video had been placed. The pornographic videos and photographs added in 2013 were
organized within further subfolders under “New Folder” and subfolder “preteen sluts child
pornstar movies” with labels of “tara 8 yr old slut,” “liluplanet Lord of the rings,” “veronica,”
-4- “vicky,” and “vids privat niece.” Moreover, within the subfolder “tara 8 yr old slut,” were
separate categories containing pornography labeled “tara 5 yr old” and “new!.” The source of
the pornography saved on the LaCie hard drive on November 16, 2013, was the same device
from which the pornography saved on March 24, 2011, had originated.
On cross-examination, Boffi elaborated on certain parts of his earlier testimony. The
images on the WD-2 hard drive had been modified (or first put on a device) on February 18,
2015 and created (put on that specific hard drive) on June 4 and 6, 2016. The videos4 found on
WD-1 were placed on the hard drive on July 25, 2016. Appellant’s personal files including
appellant’s pictures had been placed on the WD-1 hard drive on October 26, 2016.
Similarly, child pornography files were stored on WD-2 on June 4, 2016. As for the
LaCie hard drive, all but one of the child pornography files had been stored to it on November
16, 2013, and the remaining one had been stored on March 24, 2011. Appellant’s graduation
pictures and other personal documents relating to him had been placed on the hard drive on
August 18, 2011, and August 19, 2011, i.e., between the dates that the pornography was stored in
March 2011 and November 2013.
Finally, Boffi testified that the various subfiles such as “Graduation,” “Career,” and
“Personal” would all have been created and named by the user. The user creating such a file
folder would see the file structure while doing so. A user downloading a new file to the device
would see the entire file structure, including the various references to child pornography.
Testifying as an expert on the identification of child pornography, Detective John Spata
stated that three file folders’ titles in the file structure “stood out to” him as consistent with child
pornography. Detective Spata reviewed the images contained within one of those folders and
4 Preteen Sluts Child Pornstar Movies. -5- concluded that it included child pornography. Detective Spata further testified that he found
child pornography and appellant’s personal files within the file structures of all three hard drives.
The trial court made certain factual findings in a memorandum opinion, and in a post-trial
opinion denying the motion to set aside the verdict, specifically that the apartment in which the
hard drives were found belonged to appellant. The trial court observed, “I have what appears to
be personal documents identifying it as a place where the Defendant feels comfortable enough to
leave such important documents.”
The trial court further found:
I saw that under Exhibit 13 the owner of the photographs is the same owner as some of the pornographic images. It ends with 893351000, which is part of the pornographic.
So - - so the source of this data is the same source as some of the pornography that’s in this case, which is 893351000.
So the - - his personal data being placed and categorized in these hard drives left the Court no doubt, especially because of the size of the pornography that exists in these places, that he knew what was in those hard drives when he downloaded the images.
....
I could not find a reasonable explanation as to why somebody would have three hard drives this size filled with these images that are reflected in the evidence before the Court.
Some of the images, of course, are - - contain videos of a great length of time. And that is the reason why I found that even though this is a constructive possession case that it’s driven by circumstantial evidence.
The circumstantial evidence left no doubt as to the Defendant’s guilt in this case.
The trial judge explicitly found as fact that, irrespective of any challenge to Boffi’s
testimony as inconsistent or incredible, “I found the dates of the creation and modification date
reliable . . . .”
-6- In its factual findings, the trial court determined that the LaCie hard drive had been found
“out in the open and sitting on top of a shelf in an unlocked closet” while the other two hard
drives “were associated with the backpack” that the police found in the apartment. Regarding
any claimed deficiencies in the police investigation, the court found that “when it comes to
computer related evidence there can be an indicium of trustworthiness that offsets the
inaccuracies of human investigation.”
As for the “modified” and “created” dates of the files of child pornography, the trial court
found that the normal expectation would be that
an image had to be first created before it could be modified and the date order would be the reverse of what was found. Here, the modified date references the last time the images was [sic] modified within another source and then when copied onto the external hard drive was [sic] “created” in the external hard drive, resulting in the “created” date being the later date.
The trial court further found that “there were two sources of the child pornography that
made its way to the three hard drives” and that all but one of the transfers to the LaCie hard drive
had taken place on November 16, 2013. Further, the images had come into one primary folder
named “New Folder” that contained subfolders with such names as “Preteen Sluts Child Porn
Star Movies.” The LaCie hard drive contained photos from appellant’s graduation and other
photos from 2010 and 2011. Regarding appellant’s contention at trial that the times in which the
transfers had been recorded could have been manipulated, the trial court found that they could be
“manipulated to be different than where the transfer actually occurred, however, absent an
explanation as to why time zones would be manipulated, it is the consistency of the information
overall that lends . . . credence to the data.”
As for the two Western Digital hard drives, again the computer data indicated “a pattern
of transfers that speaks to the regularity of the process.” Regarding WD-1, the trial court found
that “the same device that transferred the child pornography . . . was the source of personal -7- photos taken of the Defendant and placed into the hard drive after the child pornography had
been transferred into the external hard drive.” As for WD-2, the court found that the transfers
had occurred within two separate time periods, in June 2016.
Finally, the circuit court noted that the folders “were all organized. There was no
indication that files were randomly copied into the hard drive without placing them into folders.”
Further, WD-1 “had the file names on top. With the exception of a handful of folders, most of
the files [on that hard drive] also had names associated with pornography. . . .” And “the number
of images and the lengths of the movies suggests that the person who assembled or stored the
materials knew what was kept” in the folders. Moreover, “an image with suggestive titles would
not be willingly transferred into and kept in an external hard drive or long exist in an external
hard drive unless it was placed and stored there knowingly.” The trial court also pointed out that
“dates and time stamps constitute circumstantial evidence of the actual transfer dates” and that
“it is pure speculation to consider the possibility of an erroneous system clock or the intentional
manipulation of the dates and time stamps produced by a computer’s operating system where the
manipulation is lacking.”
The trial court found that appellant’s contention that the dates and times the files were
created or modified were unreliable was not a reasonable hypothesis of innocence. Further, the
files were “easily accessible by clicks on the files . . . and the presence of defendant’s personal
photos and papers showed that defendant had access to the stored files.” The trial court also
noted that the hard drives “were found separated from any active computer. There is more
intentionality with respect to what is kept and stored on such hard drives than in computers
which are generally accessible.”
-8- ANALYSIS
On appeal, appellant argues that the evidence is insufficient to show he knowingly
possessed, either actually or constructively, the child pornography found on the three external
hard drive devices. Specifically, he contends that there was insufficient evidence to prove the
apartment where the hard drives were found was his, that he ever exercised dominion and control
over the hard drives, that he knowingly possessed the images, or that any of the backpacks were
his.5
“When reviewing the sufficiency of the evidence to support a conviction, the Court will
affirm the judgment unless the judgment is plainly wrong or without evidence to support it.”
Bolden v. Commonwealth, 275 Va. 144, 148 (2008). The relevant issue on appeal is, “upon
review of the evidence in the light most favorable to the prosecution, ‘whether any rational trier
of fact could have found the essential elements of the crime beyond a reasonable doubt.’” Pijor
v. Commonwealth, 294 Va. 502, 512 (2017) (quoting Dietz v. Commonwealth, 294 Va. 123, 132
(2017)). Thus, “[a]n appellate court does not ‘ask itself whether it believes that the evidence at
the trial established guilt beyond a reasonable doubt.’” Commonwealth v. Moseley, 293 Va.
455, 462-63 (2017) (quoting Williams v. Commonwealth, 278 Va. 190, 193 (2009)). “In sum,
‘[i]f there is evidence to support the conviction, the reviewing court is not permitted to substitute
its judgment, even if its view of the evidence might differ from the conclusions reached by the
finder of fact at the trial.’” Commonwealth v. McNeal, 282 Va. 16, 20 (2011) (quoting
Commonwealth v. Taylor, 256 Va. 514, 518 (1998)).
“The sole responsibility to determine the credibility of witnesses, the weight to be given
their testimony, and the inferences to be drawn from proven facts lies with the fact finder.”
5 Appellant does not dispute that the 100 images and videos for which he was prosecuted constituted child pornography or that the police found them on the three hard drive devices in question. -9- Ragland v. Commonwealth, 67 Va. App. 519, 529-30 (2017). “That responsibility lies with the
fact finder because ‘[t]his [C]ourt[,] sitting as an appellate court, and knowing nothing of the
evidence or of the witness, except as it appears on the paper, . . . [is] incompetent to decide on
the credibility of the testimony.’” McNeal, 282 Va. at 22 (quoting Brown v. Commonwealth, 29
Va. (2 Leigh) 769, 777 (1839)). Furthermore, when considering witness testimony, the fact
finder is not required to believe all aspects of a witness’s testimony; it may accept some parts as
believable and reject other parts as implausible. See id. Inconsistent or contradictory statements
by a witness do not render his or her testimony incredible, and the trier of fact is entitled to rely
upon that witness’s testimony in convicting a defendant. See Swanson v. Commonwealth, 8
Va. App. 376, 378-79 (1989). Further, it is within the province of the trier of fact to draw
inferences from the proven evidence, and its inferences are binding so long as they are
reasonable and justified. See Commonwealth v. Hudson, 265 Va. 505, 514 (2003).
A conviction may be based on circumstantial evidence. See id. at 512. “Circumstantial
evidence, if sufficiently convincing, is as competent and entitled to the same weight as direct
testimony.” McCain v. Commonwealth, 261 Va. 483, 493 (2001). This Court does not “view[]
[circumstantial evidence] in isolation.” Kelly v. Commonwealth, 41 Va. App. 250, 259 (2003)
(en banc). Rather, the “combined force of many concurrent and related circumstances, each
insufficient in itself, may lead a reasonable mind irresistibly to a conclusion.” Dowden v.
Commonwealth, 260 Va. 459, 470 (2000) (quoting Stamper v. Commonwealth, 220 Va. 260, 273
(1979)).
When assessing whether the circumstantial evidence excludes a reasonable hypothesis of
innocence, the Commonwealth “need only exclude reasonable hypotheses of innocence that flow
from the evidence, not those that spring from the imagination of the defendant.” Simon v.
Commonwealth, 58 Va. App. 194, 206 (2011) (quoting Hamilton v. Commonwealth, 16
- 10 - Va. App. 751, 755 (1993)). “The reasonable-hypothesis principle . . . is ‘simply another way of
stating that the Commonwealth has the burden of proof beyond a reasonable doubt.’” Moseley,
293 Va. at 464 (quoting Hudson, 265 Va. at 513). “[T]he factfinder determines which
reasonable inferences should be drawn from the evidence[] and whether to reject as unreasonable
the hypotheses of innocence advanced by a defendant.” Id. “Whether an alternate hypothesis of
innocence is reasonable is a question of fact and, therefore, is binding on appeal unless plainly
wrong.” Holloway v. Commonwealth, 57 Va. App. 658 (2011) (en banc) (quoting Archer v.
Commonwealth, 26 Va. App. 1, 12-13 (1997)).
Under Code § 18.2-374.1:1(A) and (B), “[a]ny person who knowingly possesses child
pornography is guilty of a Class 6 felony,” and any second or subsequent such offense is a Class
5 felony. On brief, appellant correctly cites to authorities analogizing the constructive
possession issue here with constructive possession cases involving drugs. See Kobman v.
Commonwealth, 65 Va. App. 304, 307 (2015); Terlicki v. Commonwealth, 65 Va. App. 13,
24-25 (2015). The principles governing a sufficiency claim involving proof of the defendant’s
constructive possession of contraband are equally well-settled. To convict a defendant for
constructive possession, “the Commonwealth must point to evidence of acts, statements, or
conduct of the accused or other facts or circumstances which tend to show that the defendant was
aware of both the presence and character of the [contraband] and that it was subject to his
dominion and control.” Terlecki, 65 Va. App. at 24 (quoting Drew v. Commonwealth, 230 Va.
471, 473 (1986)). “Ownership or occupancy of the premises on which the contraband was found
is a circumstance probative of possession.” Id. (quoting Kromer v. Commonwealth, 45 Va. App.
812, 819 (2005)).
We first address appellant’s contention that the evidence was insufficient to prove that
the police found the hard drive devices in appellant’s own apartment. We disagree. The trial
- 11 - court found that the apartment belonged to appellant. The trial court observed, “I have what
appears to be personal documents identifying it [the apartment] as a place where the [appellant]
feels comfortable enough to leave such important documents.” Inside the apartment the police
found appellant’s application to build a firearm, his fingerprint card, photographs of appellant,
correspondence by appellant, and appellant’s resume. There was no indication that anyone other
than appellant lived at the apartment.
Further, Detective Long told appellant that the police had a warrant to search his
apartment. Appellant then walked with Long to Unit 435. Although given the option to leave,
appellant remained in the hallway outside the apartment with his mother during the hours that the
search was underway. Appellant would have had no reason to linger outside during the search if
the apartment was not his. The evidence thus supports the trial court’s finding of fact that the
apartment belonged to appellant.
Nonetheless, the Commonwealth was required to prove that appellant knowingly
possessed the child pornography on the devices found in his apartment and that the contraband
was subject to his dominion and control. “While this appears to be a case consigned to the new
and evolving area of computer technology, we examine this case under familiar principles of
constructive possession of contraband.” Kromer, 45 Va. App. at 818. “We do not need to
determine whether appellant was the person” who saved the child pornography to the three
devices but, “rather, we determine whether appellant knew the images existed and, if so, did he
exercise dominion and control over them” after they were placed on the devices. Id.
In Kobman, 65 Va. App. at 308, this Court found the evidence insufficient to prove that
the defendant constructively possessed images of child pornography found in the “unallocated
space” of computers seized from his home. We found that “[n]o evidence established [the
defendant] had access to or used the required forensic software necessary to retrieve the deleted
- 12 - photographs” from the unallocated space. Id. “Further, no evidence showed other indicia of
knowledge, dominion, or control of the forty-five photographs found in the unallocated space on
the specific date of the indictments.” Id. We reached a different conclusion regarding nine
images found in the recycle bin of appellant’s computer, however. “Expert testimony
established that computer users can access and control files placed by the user into the recycle
bin. [The defendant] made statements indicating what the police were looking for, as reflected in
the search warrant, could be found ‘in the computer.’” Id. at 310. Considering the totality of the
evidence, we found that evidence sufficient to prove that the defendant “was aware of the
presence of the nine illicit photographs in the recycle bin and that he exercised dominion and
control over the contraband.” Id.
The issue of constructive possession of contraband is “largely a factual one.” Raspberry
v. Commonwealth, 71 Va. App. 19, 30 (2019) (quoting Ritter v. Commonwealth, 210 Va. 732,
743 (1970)). We find that, when the facts and circumstances of this case are considered as a
whole, a reasonable finder of fact could conclude beyond a reasonable doubt that appellant
constructively possessed the child pornography on the three devices found in his apartment.
Concerning the LaCie hard drive, Boffi testified that a video containing child
pornography was saved to the device on March 24, 2011. The pornography was deliberately
placed within Partition 3 of the device, under “My Folder” and subfolders “preteen sluts child
pornstar movies” and “tara 8 yr old slut.” Six months later, personal photographs of appellant
were placed within Partition 3 of the device in the folder entitled “Graduation.” Other
photographs and personal documents of appellant were located in other folders in Partition 3.
The evidence demonstrated that the file structure of the device, which included file names
indicative of child pornography, was not hidden and would be visible to anyone accessing the
device. In 2013, numerous items of child pornography were added to the LaCie device within
- 13 - the same path of the prior video and into the previously created “preteen sluts child pornstar
movies” subfolder. The source for the 2013 child pornography was the same as the origin of the
2011 visual depiction.
The evidence concerning the two Western Digital hard drive devices was even more
intertwined. On two occasions in June 2016, child pornography was placed on WD-2 under
“New Folder” in subfolder “vcb” and further subfolder “Vietnamese Child Brothel.” About one
month later, and from the same source as the pornography placed on WD-2, numerous videos of
child pornography were added to “New Folder” of WD-1 under the title “preteen sluts child
pornstar movies,” the same subfolder title found on the LaCie device. Significantly, personal
photographs of appellant were placed on WD-1 on October 26, 2016, from the same source of
the child pornography previously saved on both WD-1 and WD-2. As with the LaCie hard drive,
a person accessing the two Western Digital hard drives for an innocent purpose, such as saving
his personal photos or documents, would necessarily see the titles of folders that already resided
there and indicated that they contained child pornography.
As the trial court stated, the folders of child pornography were “organized,” and there
was no indication that “files were randomly copied into the hard drive without placing them into
folders.” We agree with the trial court’s assessment that “the number of images and the lengths
of the movies suggest that the person who assembled and stored the material into the hard drives
knew what was kept.” See United States v. Yarrington, 634 F.3d 440, 450 (8th Cir. 2011)
(evidence sufficient to sustain conviction for possessing child pornography on a hard drive,
which contained 168 images of child pornography organized into five separate folders, that also
included the defendant’s personal photos).
- 14 - We find no evidence in the record to support appellant’s claim that the digital information
was incorrect and that the files could have been manipulated. We thus do not disturb the trial
court’s finding of fact that appellant’s hypothesis of innocence in this regard was not reasonable.
CONCLUSION
In sum, the direct and circumstantial evidence supports the factfinder’s conclusions that
appellant knew of the child pornography on the hard drive devices, that it was subject to his
dominion and control, and that he constructively possessed it. Accordingly, we do not disturb
appellant’s convictions.
Affirmed.
- 15 -