Michael Forrest Kovach v. Commonwealth of Virginia

• Court: Court of Appeals of Virginia
• Decided: December 6, 2016
• Docket: 2013152
• Status: Unpublished

Opinion

COURT OF APPEALS OF VIRGINIA

Present: Judges Beales, Alston and Senior Judge Haley UNPUBLISHED

Argued at Richmond, Virginia

MICHAEL FORREST KOVACH MEMORANDUM OPINION BY v. Record No. 2013-15-2 JUDGE ROSSIE D. ALSTON, JR. DECEMBER 6, 2016 COMMONWEALTH OF VIRGINIA

FROM THE CIRCUIT COURT OF WESTMORELAND COUNTY Harry T. Taliaferro, III, Judge

David B. Hargett (Hargett Law, PLC, on brief), for appellant.

Rosemary V. Bourne, Senior Assistant Attorney General (Mark R. Herring, Attorney General, on brief), for appellee.

Michael Forrest Kovach appeals his convictions of possession of child pornography in

violation of Code § 18.2-374.1:1(A), two counts of possession of child pornography as a second

or subsequent offense in violation of Code § 18.2-374.1:1(B), distribution of child pornography

in violation of Code § 18.2-374.1:1(C), and three counts of distribution of child pornography as a

second or subsequent offense in violation of Code § 18.2-374.1:1(C). Specifically, appellant

argues that the evidence was insufficient to support his convictions. We affirm in part and

reverse in part.

I. BACKGROUND

On November 19, 2013, Special Agent Mike Jedrey of the Virginia State Police began

investigating an IP address suspected of distributing child pornography. The IP address provided

him with a file list containing terms of child exploitation. From this list, Special Agent Jedrey

attempted to download some of the files to verify the content. He was able to download the files

 Pursuant to Code § 17.1-413, this opinion is not designated for publication. using a peer-to-peer sharing platform designed to facilitate file sharing between computers.

Special Agent Jedrey later traced the IP address to appellant because the address was registered

to appellant’s residence.

On March 5, 2014, Special Agent Jedrey, along with several other officers, executed a

search warrant of appellant’s home. Nine items were seized including a Dell Dimension 2400

Tower, an iPhone, two SD cards, three laptops, an external hard disc drive, and a large black

custom computer desk top tower.

On the same day, Special Agent Jedrey interviewed appellant. Appellant stated that only

he and his sons lived in the house and that he monitored the computers very carefully,

controlling what information his sons could access. He also indicated that he downloaded

peer-to-peer sharing software, Shareaza, on his computer and admitted to downloading adult

pornography. Appellant also stated that while he was downloading these files, he viewed child

pornography on a zip file1 that he downloaded using Shareaza.

At trial, Special Agent Jedrey testified about the files that came from the IP address

registered to appellant’s home which Special Agent Jedrey downloaded using peer-to-peer

sharing programs. As part of his investigation, Special Agent Jedrey testified that for several

months he would download files that he suspected of being child pornography. Some of these

images were found on a zip file on appellant’s desktop and a SD card.2 During that time the files

he downloaded ultimately allowed him to obtain a search warrant for appellant’s home.

Thomas Heflin, an expert in the field of digital forensic examination, testified about what

the investigators found on the items seized from appellant’s house. Child pornography was

1 A zip file is downloaded by a computer user and allows multiple pictures, videos, or any other type of file to be contained within a compressed file to provide space on a computer and make transmission more efficient. 2 A SD card is a memory card that stores files and can be inserted into a computer. - 2 - found on a laptop, the desktop computer, and a SD card. The child pornography was found in

the unallocated space3 on the desktop and in the thumb cache4 on the laptop. Heflin testified that

there were videos on the SD card depicting child pornography, which the Commonwealth played

at trial. Heflin also testified that when he examined the desktop the user name for the

peer-to-peer sharing program installed on the computer was “Mike.”

Lawrence Daniel, an expert in forensic examination, testified that he could not tell from

examining the SD card whether it had been accessed by other computers. Daniel also stated that

he did not find any link file from the SD card on the laptop or the desktop, which would have

appeared if a link had been opened on either device from the SD card. Further, Daniel testified

that the only pictures found on the desktop and laptop computer were in the unallocated space or

the thumb cache. Both the unallocated space and the thumb cache require special software to

gain access to them; there was no evidence of any such programs on either the laptop or the

desktop. Daniel testified that because the globally unique identifier (“GUID”) number, which

Special Agent Jedrey found while downloading suspicious files using the peer-to-peer sharing

program, matched appellant’s desktop, it followed that the child pornography came from

appellant’s computer.

At the close of the Commonwealth’s case, appellant moved to strike the evidence on each

charge. Appellant argued that the evidence presented by the Commonwealth was insufficient to

support the child pornography possession and distribution charges against him. Appellant

3 Unallocated space is an area of the computer where files that users have viewed will be stored, even if they are deleted, until they are eventually overwritten. Files found in the unallocated space on a computer could not be accessed by a user without some specialized software or program. 4 A thumb cache is a Microsoft Windows database designed to store smaller versions of images that a computer user looks at in Windows Explorer. Thumb cache images on a computer cannot be accessed by a user without some specialized software or program. - 3 - argued that the Commonwealth could not prove that appellant knowingly possessed child

pornography because the only pictures found on the desktop and the laptop were in places the

appellant could not access, specifically the unallocated space and the thumb cache. Appellant

further argued that people who have SD cards do not necessarily know what is on them.

Appellant stated that there was no way to prove appellant ever accessed, acquired, or viewed

anything on the SD card containing child pornography.

In his motion to strike, appellant also argued that there was no way to prove that the

people in the videos were children. He further stated that there was no way for the trial court to

know which picture or video corresponded with each indictment. Ultimately, the trial court

denied appellant’s motion to strike.

The trial court found appellant guilty of possession of child pornography, two counts of

possession of child pornography as a second or subsequent offense, distribution of child

pornography, and three counts of distribution of child pornography as a second or subsequent

offense. While the trial court admitted that it was not trying to limit the possession charges to a

particular exhibit, it did state that the first possession conviction was based on evidence found in

the thumb cache on the desktop, the second possession conviction was based on evidence found

in a Shareaza “collection” zip file, and the third possession conviction was based on evidence

found in the unallocated space on the laptop. The first distribution conviction was based on one

photo that Special Agent Jedrey downloaded on November 21, 2013. The second distribution

conviction was based upon the evidence of all the other photographs Special Agent Jedrey

downloaded on November 21, 2013. The third distribution conviction was based on all the

images Special Agent Jedrey downloaded on December 9, 2013. The fourth distribution

conviction was based on all the images Special Agent Jedrey downloaded on November 19,

- 4 - 2013. The trial court sentenced appellant to a total of forty years in prison, with twenty-five

years suspended. This appeal followed.

II. ANALYSIS

In this case, appellant challenges the trial court’s decision to deny his motion to strike the

possession and distribution of child pornography charges against him. When reviewing the

sufficiency of evidence on appeal, “the evidence and all reasonable inferences fairly drawn

therefrom must be viewed in the light most favorable to the Commonwealth. The trial court’s

judgment should be affirmed unless it appears that it is plainly wrong or without evidence to

support it.” Spencer v. Commonwealth, 238 Va. 275, 283, 384 S.E.2d 775, 779 (1989) (citation

omitted). The appellate court examines a trial court’s fact findings “with the highest degree of

appellate deference.” Thomas v. Commonwealth, 48 Va. App. 605, 608, 633 S.E.2d 229, 231

(2006). “An appellate court does not ‘ask itself whether it believes that the evidence at the trial

established guilt beyond a reasonable doubt.’” Williams v. Commonwealth, 278 Va. 190, 193,

677 S.E.2d 280, 282 (2009) (quoting Jackson v. Virginia, 443 U.S. 307, 318-19 (1979)). The

only “relevant question is, after reviewing the evidence in the light most favorable to the

prosecution, whether any rational trier of fact could have found the essential elements of the

crime beyond a reasonable doubt.” Sullivan v. Commonwealth, 280 Va. 672, 676, 701 S.E.2d

61, 63 (2010) (citing Jackson, 443 U.S. at 319).

A. Possession of Child Pornography

Code § 18.2-374.1:1(A) states that “[a]ny person who knowingly possesses child

pornography is guilty of a Class 6 felony.” To convict appellant of possession of child

pornography, the Commonwealth had to prove appellant “was aware of the presence and

character of the [contraband] and that he intentionally and consciously possessed [it].” Merritt v.

Commonwealth, 55 Va. App. 719, 733, 689 S.E.2d 757, 764 (2010) (quoting Castaneda v. - 5 - Commonwealth, 7 Va. App. 574, 583, 376 S.E.2d 82, 87 (1989)); see also Terlecki v.

Commonwealth, 65 Va. App. 13, 24-25, 772 S.E.2d 777, 782-83 (2015) (holding that possession

of child pornography may be analyzed under principles of constructive possession).

“Possession can be proven ‘by showing either actual or constructive possession.’”

Merritt, 55 Va. App. at 733, 689 S.E.2d at 764 (quoting Birdsong v. Commonwealth, 37

Va. App. 603, 607, 560 S.E.2d 468, 470 (2002)). “Proof of constructive possession necessarily

rests on circumstantial evidence; thus, ‘all necessary circumstances proved must be consistent

with guilt and inconsistent with innocence and exclude every reasonable hypothesis of

innocence.’” Id. (quoting Burchette v. Commonwealth, 15 Va. App. 432, 435, 425 S.E.2d 81, 83

(1992)). When proving constructive possession of contraband, as in this case, “the

Commonwealth must point to evidence of acts, statements, or conduct of the accused or other

facts or circumstances which tend to show that [appellant] was aware of both the presence and

character of the [contraband] and that it was subject to his dominion and control.” Powers v.

Commonwealth, 227 Va. 474, 476, 316 S.E.2d 739, 740 (1984) (citing Eckhart v.

Commonwealth, 222 Va. 447, 450, 281 S.E.2d 853, 855 (1981)).

In this case, appellant argues that the Commonwealth’s evidence was insufficient for the

trial court to convict him of the possession charges because there was no evidence that appellant

had knowledge of what was on his desktop or laptop, in the unallocated space or the thumb

cache. Appellant also argues that the Commonwealth did not provide evidence to support the

trial court’s finding that he had knowing possession or dominion and control over the SD card

found by the police.5

5 Appellant did not provide a substantial argument about the evidence found on the desktop in the Shareaza “collection” zip file which is what the trial court considered in convicting him of the second possession charge, instead appellant focused on the SD card. - 6 - In Kobman v. Commonwealth, 65 Va. App. 304, 307-08, 777 S.E.2d 565, 567 (2015),

this Court found that the mere presence of contraband in the unallocated space of a computer

does not establish knowing possession of the contraband because the material in the unallocated

space cannot be accessed or seen without forensic software. Likewise, in the present case,

investigators found images in the unallocated space of appellant’s desktop, but because no

forensic software was found on the computer allowing access to the material appellant could not

be found to possess the contraband. Therefore, the trial court erred in denying the motion to

strike because no evidence established that appellant had knowledge, dominion, or control of the

photographs found in the unallocated space.6

The trial court also erred by denying the motion to strike as it related to the possession

charges for images in the thumb cache. Based on Daniel’s expert testimony, special software is

required to access the thumb cache, similar to that necessary for accessing the unallocated space.

Pursuant to Kobman, when special software is required to access part of a computer, and that

special software is not present, the recovered evidence by itself does not establish criminal

liability. 65 Va. App. at 307-08, 777 S.E.2d at 567. In this case, there was no evidence that

appellant had the software on his laptop that was necessary to access the thumb cache.

For the remaining possession charge, based on the evidence found on the desktop in the

Shareaza “collection” zip file, the Commonwealth advances a theory of constructive possession

of the contraband. As previously stated, “the Commonwealth must point to evidence of acts,

statements, or conduct of the accused or other facts or circumstances which tend to show that the

[appellant] was aware of both the presence and character of the [contraband] and that it was

6 The Commonwealth concedes this point on brief, citing Kobman. While this Court is not obligated to follow concessions of law by the Commonwealth, this concession of law is an appropriate recognition of controlling principles in this matter. See Logan v. Commonwealth, 47 Va. App. 168, 172, 622 S.E.2d 771, 773 (2005) (en banc). - 7 - subject to his dominion and control.” Powers, 227 Va. at 474, 316 S.E.2d at 739. “Ownership or

occupancy of the premises on which the contraband was found is a circumstance probative for

possession.” Archer v. Commonwealth, 26 Va. App. 1, 12, 492 S.E.2d 826, 832 (1997). In the

present case, the police recovered images from the desktop in a Shareaza “collection” zip file.

Special Agent Jedrey testified that these images were accessible to users without any special

programs. In addition, appellant admitted to Special Agent Jedrey that he saw an image of child

pornography on a zip file. This evidence, coupled with the facts which bolster the finding that

appellant had control over the desktop, the images located in the zip file which were under the

user name “Mike,” and because the zip file had recently been opened on the desktop, lead to the

conclusion that appellant knew the images were on the desktop and were under his dominion and

control. Viewing the evidence in the light most favorable to the Commonwealth, the trial court’s

ruling on the motion to strike as it related to the evidence found on the desktop in the Shareaza

“collection” zip file was not plainly wrong or without evidence to support it.

With regard to the pictures found on the SD card, the trial court did not specifically base

any conviction on the evidence found there but it still acknowledged in its ruling that when it

assigned a particular exhibit to a charge “it was not trying to limit it to just those particular

exhibits.” The trial court also stated that “from the beginning, the case has been about essentially

the SD drive and the two computers.” The Commonwealth again offers a theory of constructive

possession of the contraband. The Commonwealth argues that several different “acts,

statements, [and certain] conduct” of appellant would lead a factfinder to conclude that appellant

possessed the child pornography recovered by the police on the SD card. See Powers, 227 Va. at

474, 316 S.E.2d at 739.

These facts included that the SD card was found in appellant’s hamper in his bedroom.

Next, appellant admitted that he controlled the electronic devices in his house and stated that he - 8 - was the “dragon” between his sons and the computers, monitoring their use of electronics.

Appellant admitted that sometimes suspect images and videos appeared when he was trying to

download adult pornography. Lastly, several of the videos that Special Agent Jedrey obtained

while he was using peer-to-peer sharing software were also found on the SD card. Viewing the

evidence in the light most favorable to the Commonwealth, the trial court’s ruling on the motion

to strike as it related to the possession charges from the SD card was not plainly wrong or

without evidence to support it.

In summary, we conclude that the trial court erred when it found that the child

pornography found in the unallocated space on the desktop and in the thumb cache on the laptop

established appellant’s guilt because special forensic software programs and training were

necessary to access these images. Thus, we reverse the two possession of child pornography

second or subsequent convictions based on the files found in the unallocated space and thumb

cache. We affirm the possession of child pornography conviction based on the evidence found in

the “collection” zip file downloaded using Shareaza.

B. Distribution of Child Pornography

Code § 18.2-374.1:1(C)(i) states that “[a]ny person who knowingly [ ] reproduces by any

means, including by computer, sells, gives away, distributes, electronically transmits, displays,

[or] purchases” child pornography shall be guilty of violating the statute. Appellant argues that

he should not have been convicted of distribution of child pornography because the evidence was

insufficient to prove that he intentionally shared child pornography or was the person responsible

for sharing it.

In Kelley v. Commonwealth, 289 Va. 463, 469, 771 S.E.2d 672, 674-75 (2015), the

Supreme Court of Virginia held that because the appellant chose to download peer-to-peer

sharing software onto his laptop, he voluntarily participated in peer-to-peer sharing of child - 9 - pornography. The Court also found that appellant knew how the peer-to-peer sharing software

worked and knew that the software was capable of sharing files with other users, regardless of

whether appellant intended to share the files or if they were just put into a shared folder as a

default option by the program. Id.

Similarly, in this case, appellant knowingly downloaded and used the peer-to-peer

sharing software on his desktop. Appellant admitted to downloading movies and adult

pornography using Shareaza, showing he knew how to use the software. Appellant also admitted

that he had accidentally downloaded child pornography in the past. It was reasonable for the

factfinder to conclude that appellant should have known that the software had the ability to share

files with other users. Appellant’s assertion that he did not know that the sharing feature was

operating is insignificant. Furthermore, the trial court did not find appellant’s statements to

Special Agent Jedrey, with respect to his awareness of or intention to share pornographic image

files, credible.

Moreover, a GUID number that Special Agent Jedrey captured while downloading

photographs onto his computer during his investigation was a number generated during the

installation of Shareaza on appellant’s desktop. Daniel testified that because this GUID number

matched appellant’s desktop, Special Agent Jedrey downloaded the child pornography from

appellant’s computer. Finally, several of the videos that Special Agent Jedrey obtained while he

was using peer-to-peer sharing software were also found on the SD card in appellant’s hamper.

Based on the facts and circumstances presented to the trial court, we hold that the trial

court was not plainly wrong in denying appellant’s motion to strike the charges of distribution of

child pornography. Accordingly, we affirm appellant’s conviction of distribution of child

pornography in violation of Code § 18.2-374.1:1(C), and his three distribution of child

pornography second or subsequent offenses in violation of Code § 18.2-374.1:1(C). - 10 - III. CONCLUSION

We hold that the trial court erred when it denied appellant’s motion to strike as to the

possession of child pornography convictions based on evidence from the unallocated space on

the desktop and in the thumb cache on the laptop. Thus, the possession of child pornography

convictions that rely on evidence obtained from the unallocated space or the thumb cache are

reversed. The possession of child pornography conviction that relies on evidence found on the

desktop in the “collection” zip file downloaded using Shareaza is affirmed. We further hold that

the trial court did not err when it denied appellant’s motion to strike as to the distribution of child

pornography convictions. Thus, appellant’s distribution of child pornography convictions are

affirmed.

Affirmed in part, and reversed in part.

- 11 -