State of West Virginia v. Daniel Beck

828 S.E.2d 821, 242 W. Va. 2

Opinions

WALKER, Chief Justice:

*823In this case we consider a certified question concerning West Virginia Code § 61-8C-3 (2014) and child pornography found in the cache files of a defendant's laptop computer. Respondent Daniel Beck (Beck) is charged with one count of violating § 61-8C-3. By order entered October 19, 2018, the circuit court certified the following question to this Court:

Is possession of a laptop computer containing cache files that relate to material visually portraying a minor and/or minors engaged in sexually explicit conduct, without evidence of when or where said cache files were created and/or accessed enough to establish the defendant knowingly and intentionally possessed the material contained on said cache files in violation within the meaning [sic] of West Virginia [C]ode §[ ]61-8C-3(a)?^{[1 ]}

The circuit court answered this question, "No."

As the State acknowledges, the thrust of that question is "whether the evidence in this case is sufficient to sustain a conviction for possession of material depicting minors engaged in sexually explicit conduct" under § 61-8C-3(a). We decline to respond to that question, though, because our answer would be an impermissible advisory opinion that depends on disputed questions of material fact-namely the state of mind of the defendant.²

Nevertheless, there is a legal issue in the question certified by the circuit court that can be addressed at this point in the proceedings against Beck. We have held that it is appropriate to reformulate a certified question when it

is not framed so that this Court is able to fully address the law which is involved in the question, then this Court retains the power to reformulate questions certified to it under both the Uniform Certification of Questions of Law Act found in W. Va.Code, 51-1A-1, et seq. and W. Va.Code, 58-5-2 [1967], the statute relating to certified questions from a circuit court of this State to this Court. Syllabus Point 3, Kincaid v. Mangum, 189 W.Va. 404, 432 S.E.2d 74 (1993).^{[3 ]}

Under the authority granted to this Court by West Virginia Code § 58-5-2 (2012), we reformulate the circuit court's certified question as follows:

May a jury consider images of a minor engaged in sexually explicit conduct, contained in the temporary Internet cache files on a defendant's computer, as evidence of a violation of West Virginia Code § 61-8C-3(a). Answer: Yes.

I. Case Background and Procedural Posture

On November 14, 2017, a grand jury returned a one-count indictment that charged Beck with violating West Virginia Code § 61-8C-3(a) and - 3(b) (2014). The indictment alleged that on or about February 23, 2017, Beck knowingly possessed fifteen images or files on his computer and that those images *824visually portrayed minor children engaged in sexually explicit conduct.⁴

On May 18, 2018, the parties filed a joint motion to certify a question to this Court addressing the issue of cache files. Prior to certifying the question, the circuit court held a hearing to hear testimony about cache files from a State witness, Matthew Adams (Adams). Adams is an investigator for the Ohio County Prosecuting Attorney's Office, and, for purposes of the hearing, Beck stipulated that Adams is expert in cyber-investigation and recovery and acquisition of computer data. Adams testified about the characteristics of cache files and their contents. He explained that a computer user does not intentionally download information, including images, from the Internet to cache files. Instead, a computer's web browser automatically downloads information to the computer's cache files when the user views a website that displays images. The browser does this to enable a computer user to access that website more quickly in the future. In other words, the information contained in the cache files enables the user to return to a website without having to download the entire site again.

Adams explained that while a user has the ability to delete cache files from his computer, the user does not intentionally create the files, in contrast to images that he downloads and intentionally saves to his computer:

Circuit court: So a download of a file is different than a cache of a picture?

Adams: Yes, sir. The way we're speaking about it today, yes, sir.

Circuit court: But a cache would indicate that that website or that particular picture was viewed or this computer connected with some computer that had that image and it shows that in this example his computer accessed that file?

Adams: Yes, sir. That's correct.

Circuit court: If he manually or with purpose saved it to the computer, you can tell that?

Adams: Yes, sir.

Circuit court: As a download file?

Adams: Yes, sir.

Circuit court: But if it's a cache, that's something that the computer does by default?

Adams: That's correct.

Adams also explained that he can use software called Forensic Tool Kit to extract images from cache files even when a computer is not connected to the Internet. But Forensic Took Kit is not available to the general public. And without it, Adams testified, a lay person cannot access an image directly from a cache file and would have to seek out that image on the Internet in order to see it again.

Following the hearing, the circuit court granted the parties' motion to certify a question to this Court. That question is as follows:

Is possession of a laptop computer containing cache files that relate to material visually portraying a minor and/or minors engaged in sexually explicit conduct, without evidence of when or where said cache files were created and/or accessed enough to establish the defendant knowingly and intentionally possessed the material contained on said cache files in violation within the meaning [sic] of West Virginia [C]ode §[ ]61-8C-3(a)?

The circuit court answered the question "No," then stayed the matter pending this Court's answer to the certified question.⁵

II. Standard of Review

"The appellate standard of review of questions of law answered and certified by a circuit court is de novo [,]"⁶ meaning that "we give plenary consideration to the legal issues *825that must be resolved to answer the question" certified by the circuit court.⁷

III. Discussion

Beck is charged with violating subsection (a) of West Virginia Code § 61-8C-3. In pertinent part, that statute provides:

(a) Any person who, knowingly and willfully, sends or causes to be sent or distributes, exhibits, possesses, electronically accesses with intent to view or displays or transports any material visually portraying a minor engaged in any sexually explicit conduct is guilty of a felony.

We found a prior version of § 61-8C-3(a) to be unambiguous.⁸ We find the current version of the statute is similarly clear so we accept the statute's plain meaning.⁹

Numerous state and federal cases have analyzed the implications of child pornography stored in temporary Internet cache files. These authorities instruct that child pornography contained in cache files may be used in at least two ways in a prosecution under § 61-8C-3(a), as contraband or as circumstantial evidence.

A. Method 1: Cached Images of Child Pornography as Contraband

First, child pornography stored in the cache files on a defendant's computer may be the "material visually portraying a minor engaged in any sexually explicit conduct"-that is, the actual offense contraband. Under this approach, the images of child pornography stored in the cache files on the defendant's computer are themselves the material banned by the statute.¹⁰ As one commentator has explained,

Under this approach, the computer is analogous to a file cabinet and the cache is a file drawer. The user has reached out to the Internet through use of a web browser and selected an image, after which the computer automatically "files" a copy of that image in its file drawer. Viewed this way, the possession of the image begins when the image is cached and ends when the file is deleted and overwritten by other data.^{[11 ]}

But, the presence of cached images of child pornography on a defendant's computer-standing alone-cannot prove that the defendant actually possessed that contraband. As the State's expert Adams testified, when a computer user visits a website, the computer's browser automatically saves the images displayed on that page to the computer's cache files. Thus, those images exist in the cache files although the user may not know that they are there.¹² Exactly for that reason, we cannot conclude that the mere presence of child pornography in cache files on a particular computer proves that the individual who controls that computer knowingly and willfully possesses child pornography in violation of § 61-8C-3(a).¹³

*826Under the contraband approach the State may still proceed on a theory that the defendant constructively, rather than actually, possessed the cached images.¹⁴ Our analysis of constructive possession in State v. Cummings is instructive.¹⁵ There, Cummings argued that the State had not proven at trial that he constructively possessed matches and pseudoephedrine (items commonly used to make methamphetamine) seized from a vehicle when the State's only evidence of possession was Cummings's status as the vehicle's driver.¹⁶ We rejected the State's theory that Cummings's presence in the stopped vehicle was enough to prove constructive possession at trial¹⁷ and, instead, adopted the rule that "the State must prove beyond a reasonable doubt that the defendant had knowledge of the presence of the [contraband] and that [it] was subject to the defendant's dominion and control."¹⁸ Applying that rule, we held that the State failed to prove that Cummings constructively possessed the methamphetamine ingredients because it had not offered any evidence that Cummings knew of or controlled those items.¹⁹

The circumstances in Cummings and those raised by the reformulated certified question are parallel.²⁰ In both scenarios, the question of constructive possession turns on the defendant's knowledge of the contraband and dominion and control over it. Given those similarities, we believe that the logic of Cummings also applies in this context. For that reason, we conclude that images of minors engaged in sexually explicit conduct found in temporary Internet cache files on a defendant's computer are contraband in a prosecution for a violation of West Virginia Code § 61-8C-3(a) (2014) on a theory of constructive possession, where the State's evidence proves beyond a reasonable doubt that the defendant knew of the cached images and exercised dominion and control over them.²¹

B. Method 2: Cached Images of Child Pornography as Circumstantial Evidence

The second way cache files may be used in a prosecution under § 61-8C-3(a) is as circumstantial evidence. When the State cannot prove that a defendant constructively possessed child pornography found in his computer's cache files, a jury may still consider the cached images as circumstantial evidence of a prior violation of the statute.

Under this "evidence of" method, the cache files are no longer analogous to a file cabinet in which a defendant stores the contraband images of child pornography. Instead, the computer itself is analogous to a "video camera *827that records all of the activity of the computer user."²² Viewed in this manner, images found in the cache file are similar to the video, itself, and can be a record of a computer user's previous activity. Thus, the cache files are circumstantial evidence of a violation of § 61-8C-3(a) at an earlier point in time, but they do "not represent the literal contraband" under this approach.²³ The Court of Appeals of Georgia succinctly explained this distinction in New v. State :

In the case sub judice, even if the State did not (and could not) present evidence that New was aware of the shadow copy images' existence and, thus, could not prove present possession of those files, there was more than sufficient circumstantial evidence for the jury to conclude that New knowingly possessed child pornography on his computer at a prior point.^{[24 ]}

In short, under the "evidence of" method, the presence of child pornography in the cache files on a defendant's computer is circumstantial evidence of a violation of § 61-8C-3(a).

IV. Conclusion

Based on the analysis presented above, we hold that images of minors engaged in sexually explicit conduct found in temporary Internet cache files on a defendant's computer are contraband in a prosecution for a violation of West Virginia Code § 61-8C-3(a) (2014) on a theory of constructive possession, where the State's evidence proves beyond a reasonable doubt that the defendant knew of the cached images and exercised dominion and control over them. If the State cannot prove beyond a reasonable doubt that the defendant knew of the cached images and exercised dominion and control over them, the cached images are still circumstantial evidence that the State may use to prove that the defendant violated West Virginia Code § 61-8C-3(a). Therefore, we answer the reformulated certified question in the affirmative.

Having answered the reformulated certified question, we remand this case to the Circuit Court of Marshall County for further proceedings consistent with this Opinion.

Certified Question Answered.

JUSTICE WORKMAN concurs and reserves the right to file a separate opinion.

1 Emphasis in original. Section 61-8C-3(a) provides: "Any person who, knowingly and willfully, sends or causes to be sent or distributes, exhibits, possesses, electronically accesses with intent to view or displays or transports any material visually portraying a minor engaged in any sexually explicit conduct is guilty of a felony."

2 See Syl. Pt. 2, in part, Harshbarger v. Gainer , 184 W. Va. 656, 403 S.E.2d 399 (1991) ("Courts are not constituted for the purpose of making advisory decrees or resolving academic disputes.") (quoting Mainella v. Bd. of Trustees , 126 W. Va. 183, 185-86, 27 S.E.2d 486, 487-88 (1943) ); Consol. Coal Co. v. Mineral Coal Co. , 147 W. Va. 130, 145, 126 S.E.2d 194, 203 (1962) ("These conflicting allegations of the complaint and the answer create a disputed question involving material facts which, of course, can not be considered or resolved upon this certificate; and any such conflict in the material facts must be heard and determined by the circuit court.").

3 Syl. Pt. 2, Pyles v. Mason Cty. Fair , 239 W. Va. 882, 806 S.E.2d 806 (2017).

4 Beck was also indicted on an additional, unrelated count, which was later dismissed.

5 The circuit court did not explain its answer in the October 2018 order. But, at the end of the hearing held in July 2018, the court stated that it concluded that possession of cache files does not constitute possession of child pornography under § 61-8C-3(a) because "[w]ithout forensic software, the user of the computer could not access the images in the cache files."

6 Syl. Pt. 1, Gallapoo v. Wal-Mart Stores, Inc. , 197 W. Va. 172, 475 S.E.2d 172 (1996).

7 Michael v. Appalachian Heating, LLC , 226 W. Va. 394, 398, 701 S.E.2d 116, 120 (2010).

8 State v. Shingleton , 237 W. Va. 669, 686, 790 S.E.2d 505, 522 (2016).

9 See Syl. Pt. 2, State v. Elder, 152 W. Va. 571, 165 S.E.2d 108 (1968) ("Where the language of a statute is clear and without ambiguity the plain meaning is to be accepted without resorting to the rules of interpretation.").

10 As detailed below, this "present possession" approach is distinguishable from the approach that views the cached images as "merely evidence of child pornography." See, e.g ., State v. Linson , 896 N.W.2d 656, 659 (S.D. 2017) ("This Court has not previously considered whether cached images are themselves the contraband that a defendant possesses or whether they are merely evidence of possession of child pornography.") (emphasis added).

11 Ty E. Howard, Don't Cache Out Your Case: Prosecuting Child Pornography Possession Laws Based on Images Located in Temporary Internet Files , 19 Berkeley Tech . L.J. 1227, 1254-55 (2004) (hereinafter, Howard ).

12 See United States v. Dobbs , 629 F.3d 1199, 1201 (10th Cir. 2011) (recounting expert testimony that "[t]he cache is populated with these images regardless of whether they are displayed on the computer's monitor. In other words, a user does not necessarily have to see an image for it to be captured by the computer's automatic-caching function.").

13 Id . at 1205 (reversing conviction for knowing receipt of child pornography; concluding "that the presence of the child pornography files in the cache of Mr. Dobbs's computer does not alone demonstrate-circumstantially or otherwise-his knowing receipt of those files.") (emphasis added).

14 Compare Syl. Pt. 4, State v. Dudick , 158 W. Va. 629, 213 S.E.2d 458 (1975) ("The offense of possession of a controlled substance also includes constructive possession, but the State must prove beyond a reasonable doubt that the defendant had knowledge of the controlled substance and that it was subject to defendant's dominion and control.").

15 220 W. Va. 433, 647 S.E.2d 869 (2007).

16 Id . at 439, 647 S.E.2d at 875.

17 Id . at 440, 647 S.E.2d at 876.

18 Id . at Syl. Pt. 4 (emphasis added) (quoting Dudick , Syl. Pt. 4).

19 Id . at 440-41, 647 S.E.2d at 876-77.

20 See United States v. Kain , 589 F.3d 945, 950 (8th Cir. 2009) ("The presence of child pornography in temporary internet and orphan files on a computer's hard drive ... is not conclusive evidence of knowing possession and control of the images, just as mere presence in a car from which the police recover contraband does not, without more, establish actual or construction [sic] possession of the contraband by a passenger.").

21 See United States v. Kuchinski , 469 F.3d 853, 863 (9th Cir. 2006) (holding that "[w]here a defendant lacks knowledge about the cache files, and concomitantly lacks access to and control over those files, it is not proper to charge him with possession and control of the child pornography images located in those files , without some other indication of dominion and control over the images" and vacating sentencing order) (emphasis added); United States v. Romm , 455 F.3d 990, 1005, 1006 (9th Cir. 2006) (affirming conviction of possession of child pornography found in cache files where evidence showed that the defendant knew of cache files and took steps to access and delete them); United States. v. Tucker , 305 F.3d 1193, 1204, 1205 (10th Cir. 2002) (affirming conviction of possession of child pornography found in cache files where defendant knew the browser cached images and testimony before the district court established that images in the cache files could be accessed, emailed, uploaded to the internet, or printed).

22 New v. State , 327 Ga.App. 87, 755 S.E.2d 568, 576 n.26 (2014) (quoting Howard , 19 Berkeley Tech. L.J. at 1255 ).

23 Id . at 576.

24 Id . (emphasis in original). See also Marsh v. People , 389 P.3d 100, 107-08 (Colo. 2017) (stating that "[i]t is for the fact-finder to determine the weight to give cache images in light of all the other evidence in any given case"); Linson , 896 N.W.2d at 660 (agreeing "with those courts holding that the mere presence of child pornography in a computer's cache is not sufficient to establish that a defendant knowingly possessed it; the cached images are not themselves the contraband. Instead, cached images or files are evidence of possession.").