FIRST DIVISION ELLINGTON, C. J., PHIPPS, P. J., and BRANCH, J.
NOTICE: Motions for reconsideration must be physically received in our clerk’s office within ten days of the date of decision to be deemed timely filed. http://www.gaappeals.us/rules/
June 19, 2013
In the Court of Appeals of Georgia A13A0623. THE STATE v. AL-KHAYYAL.
ELLINGTON, Chief Judge.
The State indicted Faiz Al-Khayyal on 49 counts of sexual exploitation of
children in violation of OCGA § 16-12-100 (b) (8), based upon allegations that he
possessed and controlled child pornography in the form of digital files on his laptop
computer. The Superior Court of Clayton County sustained Al-Khayyal’s plea in bar
and granted his motion to dismiss the indictment for lack of venue, finding that,
although Al-Khayyal possessed the computer in Clayton County, he had deleted the
digital files before he entered the county and could no longer access the illegal
images, and, therefore, that there was no evidence that he committed the offenses as alleged in the indictment. The State appeals this ruling, in part, as to Counts 30
through 49.1 For the reasons explained below, we reverse in part.
The following facts are undisputed. In 2009, while Al-Khayyal, a professor at
the Georgia Institute of Technology, was abroad teaching in China, he became the
target of an investigation into child pornography. When he returned to the United
States on August 5, 2009, bringing his laptop computer, immigration control officers
detained him in the Atlanta airport (in Clayton County) and seized that computer. A
forensic computer specialist for the Georgia Bureau of Investigation conducted a
forensic examination of the computer, using specialized forensic software, and
discovered 29 digital files that contained sexually explicit images of young girls. The
files had been placed in the computer’s trash folder, which had then been emptied, so
that the files were permanently deleted or “double-deleted” and inaccessible to the
user.2 A subsequent examination of the computer yielded 20 additional files that had
1 See OCGA § 5-7-1 (a) (1) (providing that the State may appeal from an order dismissing an indictment); see also OCGA § 5-7-1 (a) (3) (providing that the State may appeal from an order sustaining a plea or motion in bar, when the defendant has not been put in jeopardy). 2 See United States v. Seiver, 692 F3d 774,776-778 (7th Cir. 2012) (When a user deletes a computer file, it goes into a “trash” folder. If the user then directs the computer to “empty” the trash folder, the contents of the folder, including deleted files, are removed from the user interface. In many cases, a computer forensic expert
2 been “deleted” but remained saved in the trash folder.3 Those files were in a
compressed “.rar” format, and the images contained in the files could be viewed only
with an “uncompressing” or “unzipping” program that at that time was not loaded on
the computer. A different unzipping program, however, was loaded on the computer,
and the computer’s history files showed that the software had been used, though not
on the files at issue in this case. In addition, the computer specialist testified that the
software required to access the .rar files is readily available to the public and can be
used without special training. When the computer specialist used the required
using specialized software may be able to recover double-deleted data, if recovery is undertaken before the file is overwritten with later-saved files either because there is no longer unused space in the computer’s hard drive or at the user’s direction. Most computer users, however, lack the specialized software that is needed to be able to recover a double-deleted file from the hard drive’s “slack space” and the technological knowledge to use such software. In such a case, a computer user who deletes a file and empties the trash folder containing it will no longer knowingly possess the file.). 3 See David T. Cox, “Litigating Child Pornography and Obscenity Cases in the Internet Age,” 4 J. Technology L. & Policy 1, 100 (Summer 1999) (When computer files are deleted, “the [DOS or Windows] operating system does not actually discard any information, rather, it merely makes note to itself” that the memory space being used by the file is again available for use and may be overwritten. Until overwritten, deleted files can be retrieved with software designed for that purpose. Thus, “[a] deleted file is really not a deleted file, it is merely organized differently.”).
3 software to “rebuild” the .rar files in the trash folder, she found that the files also
contained sexually explicit images of young girls.
The State indicted Al-Khayyal on 49 counts of violating OCGA § 16-12-100
(b) (8).4 Each count alleges that Al-Khayyal,
in the State of Georgia and County of Clayton, on or about August 5, 2009, did knowingly possess and control material, to wit: a digital file located on a Toshiba laptop and labeled[, giving the file name of one of the 49 digital files recovered from his computer], which depicts a minor engaged in sexually explicit conduct, to wit: [describing the conduct depicted in the specified file]. Counts 1 through 29 concern the double- deleted files; Counts 30 through 49 concern the single-deleted .rar files.
Al-Khayyal filed a plea and bar and motion to dismiss the indictment, arguing
that, regardless whether he possessed and controlled the files at one time, he did not
do so in Clayton County and, therefore, that the prosecution was barred for lack of
venue.5 After an evidentiary hearing, the trial court sustained the plea in bar and
4 Pursuant to OCGA § 16-12-100 (b) (8), “[i]t is unlawful for any person knowingly to possess or control any material which depicts a minor or a portion of a minor’s body engaged in any sexually explicit conduct.” 5 See Ga. Const. of 1983, Art. VI, Sec. II, Par. VI (“[A]ll criminal cases shall be tried in the county where the crime was committed, except cases in the superior courts where the judge is satisfied that an impartial jury cannot be obtained in such county.”); OCGA § 17-2-2 (a) (In general, “[c]riminal actions shall be tried in the
4 granted the motion to dismiss, finding that there was no evidence that Al-Khayyal
was in knowing possession and control of the images in Clayton County.
The State appeals this ruling only as to Counts 30 through 49, which concern
the single-deleted .rar files.6 The State contends that, for purposes of Al-Khayyal’s
plea in bar and motion, the evidence establishes that he possessed his computer in
Clayton County at a time when the subject .rar files were present on the computer’s
hard drive. In addition, the State contends that the evidence establishes that, although
the subject files were then assigned to Al-Khayyal’s computer’s trash folder, he could
have accessed the files and viewed the contraband images after downloading software
that was readily available to the public. Further, the State contends that the evidence
supports an inference that Al-Khayyal knew that the files were present on his
computer and that he could later access them. Because questions concerning Al-
Khayyal’s knowledge and intent are for the jury to decide, the State contends that,
county where the crime was committed, except as otherwise provided by law.”). 6 Although the State “does not concede that . . . Al-Khayyal lacked knowing possession or control over the files in Counts 1-29, [it] will not challenge that ruling of the trial court in this appeal.” Consequently, the trial court’s order stands affirmed in part, as to those counts, by operation of law. Grimes v. State, 297 Ga. App. 720, n. 1 (678 SE2d 167) (2009).
5 under the circumstances presented, the trial court erred in sustaining Al-Khayyal’s
plea in bar and granting his motion to dismiss the indictment.
Al-Khayyal contends, on the other hand, that the trial court’s ruling was correct
because, while he was in Clayton County, he lacked the ability to access the illegal
images stored on his computer. He contends that contraband that is in the form of
electronic data “can only be thrown away in one way – [by] rendering it inaccessible
on the computer” on which the data is stored. He contends that, before entering
Clayton County, he had done “everything he could to discard the [illegal] images and
terminate his possession” and that the steps he had taken before he returned to the
United States did, in fact, render the subject files “totally inaccessible.” Based on this,
he contends that the trial court correctly determined that, as a matter of law, he was
not in knowing possession or control of the contraband in that venue. We apply a de
novo standard of review to the trial court’s ruling on Al-Khayyal’s plea in bar and
motion to dismiss the indictment for improper venue.7
7 See State v. Johnson, 269 Ga. 370, 372 (2) (499 SE2d 56) (1998) (reviewing de novo a trial court’s determination that venue for a prosecution for using a false document in a matter within the jurisdiction of a state department did not lie in the county where the state office that received the false documents was located, but lay in the county in which the defendant executed the false documents, and reversing the trial court’s order granting the defendant’s motion to dismiss the indictment for improper venue); State v. Barber, 193 Ga. App. 397, 398-399 (388 SE2d 350) (1989)
6 “Under Georgia law, a person who knowingly has direct physical control over
a thing at a given time is in actual possession of it. A person who, though not in
actual possession, knowingly has both the power and the intention at a given time to
exercise dominion or control over a thing is then in constructive possession of it. In
any criminal prosecution for possession, therefore, the State must prove that the
defendant was aware he possessed the contraband at issue.” (Citation and punctuation
omitted.) Barton v. State, 286 Ga. App. 49, 52 (1) (648 SE2d 660) (2007). “Both
knowledge and possession may be proved, like any other fact, by circumstantial
evidence.” (Citation and punctuation omitted.) Hunt v. State, 303 Ga. App. 855, 858
(2) (695 SE2d 53) (2010). Further, “[a]s long as there is slight evidence of access,
power, and intention to exercise control or dominion over an instrumentality, the
question of fact regarding constructive possession remains within the domain of the
trier of fact.” (Citation and punctuation omitted.) Id.
(reviewing de novo a trial court’s determination that venue for a Medicaid fraud prosecution did not lie in the county where the defendant submitted false reports, but lay in the county in which he falsified the reports, and affirming the dismissal of the indictment for improper venue).
7 The common thread in child pornography laws is the visual depiction of minors
engaged in sexually explicit conduct.8 Although the iconic example of child
pornography may be a photograph, where the illegal image is fixed in a tangible form,
child pornography presents special issues in contemporary times because technology
allows images to be ephemerally generated from data stored in a variety of media.9
Georgia law in the arena of child pornography has evolved to reflect the impact of
technology. Some offenses are narrowly drawn to prohibit specified conduct
involving a “visual medium”10 or “visual or printed matter”11 which depicts a minor
or a portion of a minor’s body engaged in any sexually explicit conduct. The offense
at issue in this case, on the other hand, is more broadly drawn to prohibit possession
or control of “any material” which depicts such an image. OCGA § 16-12-100 (b)
8 See, e.g., Aman v. State, 261 Ga. 669, 670 (1) (b) (409 SE2d 645) (1991); 18 USC §§ 2252; 2252A; Utah Code Ann. § 76-5b-103 (1); Mo. Ann. Stat. § 573.010 (2); Colo. Rev. Stat. Ann. § 18-6-403 (2) (j). 9 See generally “Obscenity and pornography in digital environments – Federal statutory law,” Law of Computer Technology § 18:43 (database updated April 2013); David T. Cox, “Litigating Child Pornography and Obscenity Cases in the Internet Age,” 4 J. Technology L. & Policy 1 (Summer 1999). 10 OCGA § 16-12-100 (b) (1), (2), (5), (6). 11 OCGA § 16-12-100 (c).
8 (8).12 Georgia’s appellate courts have upheld convictions under this subsection in
cases based on the defendant’s possession of a videotape,13 a compact disc,14 a
DVD,15 or a USB flash drive16 that contained prohibited content. Thus, in these
storage media cases, evidence that a defendant possessed data capable of generating
images of a minor engaged in sexually explicit conduct authorized the jury to find
that the defendant possessed prohibited “material” even though actually viewing the
prohibited images would require the use of a machine or electronic device (a
videocassette player, a computer equipped with particular software, etc.).17 In this
12 See also OCGA § 16-12-100 (b) (7) (“It is unlawful for any person knowingly to bring or cause to be brought into this state any material which depicts a minor or a portion of a minor’s body engaged in any sexually explicit conduct.”). 13 See Aman v. State, 261 Ga. at 671 (Hunt, J., concurring); see also Veats v. State, 300 Ga. App. 600, 602-605 (1) (685 SE2d 416) (2009) (probation revocation based on possession of a pornographic videotape). 14 See Scarborough v. State, 317 Ga. App. 523, 524-525 (1) (731 SE2d 396) (2012); Dickerson v. State, 304 Ga. App. 762, 766 (2) (697 SE2d 874) (2010). 15 See Henderson v. State, _ Ga. App. _, _ (1) (740 SE2d 280) (2013). 16 See Hunt v. State, 303 Ga. App. 855, 857-859 (2) (695 SE2d 53) (2010). 17 See State v. Brown, 250 Ga. App. 376 (551 SE2d 773) (2001), in which we noted that, although all of the listed items in the statutory definition of a “[v]isual medium,” that is, “any film, photograph, negative, slide, [or] magazine,” OCGA § 16- 12-100 (a) (5), “are ‘tangible,’ in that they can be physically handled, not all of the listed items can be viewed without the assistance of machinery. Negatives require
9 case, it is undisputed that Al-Khayyal physically possessed a computer that served as
the storage medium for data files capable of generating visual depictions of minors
engaged in sexually explicit conduct.
Despite his undisputed physical possession of the computer in Clayton County,
Al-Khayyal contends that the State cannot prove that he possessed the contraband at
issue in that venue because, while he was in the county, he lacked the ability to access
the illegal images stored on his computer. He relies in part on evidence that the
software required to view the prohibited visual depictions was not loaded on his
computer at the same time. We find no support in Georgia law, however, for the
proposition that possession of prohibited material under OCGA § 16-12-100 (b) (8)
exists only in conjunction with the defendant’s present ability to view illegal visual
depictions, especially given the evidence that the needed software was readily
processing; films require projectors[;] [t]he images on videotapes . . . can be seen only with the aid of a machine.” Id. at 379 (1). We construed the definition of visual media to include “digital code that produces pictures when interpreted by software” and may be distributed electronically. Id. at 378 (1). See also OCGA § 16-12-100.2 (b) (8) (Defining “visual depiction,” as used in the Computer or Electronic Pornography and Child Exploitation Prevention Act of 2007, as “any image and includes undeveloped film and video tape and data stored on computer disk or by electronic means which is capable of conversion into a visual image or which has been created, adapted, or modified to show an identifiable child engaged in sexually explicit conduct.”).
10 available to the public. See Veats v. State, 300 Ga. App. 600, 602 (1) (685 SE2d 416)
(2009) (A defendant knowingly had constructive possession of a pornographic
videotape even when he could not view the content because he did not have a
videocassette player or electricity.).18
Finally, we turn to Al-Khayyal’s argument that the evidence precludes the
requisite finding that he possessed the contraband at issue knowingly, that is, that he
was aware that the files containing the illegal images were stored in his computer’s
memory. We note initially that there was no evidence presented at the hearing on Al-
Khayyal’s plea in bar and motion to dismiss that the type of files at issue in this case,
.rar files, could have been saved to his hard drive automatically and without his
knowledge.19 Rather, the evidence authorizes an inference that the subject .rar files
18 Cf. Wise v. State, 364 SW3d 900, 904 (Tex. Crim. App. 2012) (Discussing the “present-possession approach” used in some jurisdictions when evaluating the sufficiency of evidence that a defendant knowingly possessed child pornography images found in a computer’s cache or free space. That approach requires evidence that a defendant had the knowledge and ability to access the files “in their present format.” In the context of files deleted by a user or by an automatic computer program, if an ordinary computer could not have accessed the deleted files, then the defendant could not presently have the required custody, control, or management of the images to be deemed to be in knowing possession of them.). 19 Cf. Barton v. State, 286 Ga. App. at 50-52 (1) (Where the defendant was charged with possessing child pornography based on temporary internet files that were saved in his computer’s “cache;” where the evidence showed that the cache is
11 originally came to be saved to Al-Khayyal’s computer deliberately. Further, the
evidence, including evidence that he actively manipulated the .rar files by deleting
them, authorizes an inference that he was aware that the files were saved to his hard
drive. Evidence that Al-Khayyal had double-deleted other files authorizes an
inference that he knew that deleting a file moves it to the trash folder and that,
without further action, a deleted file remains stored there. By extension, this evidence
also authorizes an inference that he knew that the .rar files at issue in this case were
in the trash folder and still accessible. Evidence that he had used other unzipping
“a storage mechanism designed to speed up the loading of internet displays” and that all computers will automatically store pictures or other content that is viewed over the internet; and where there was no evidence that the defendant took any affirmative action to store the images on his computer, that he was aware that, when he viewed the images, the computer had automatically stored the images as files in the cache, or that he had the software and the knowledge required to retrieve or access the images, the State failed to carry its burden of showing that he knowingly possessed the pornography.); see also United States v. Kuchinski, 469 F3d 853, 863 (B) (3) (9th Cir. 2006) (“Where a defendant lacks knowledge about the cache files[, which were automatically downloaded when he accessed web pages], and concomitantly lacks access to and control over those files, it is not proper to charge him with possession and control of the child pornography images located in those files, without some other indication of dominion and control over the images. To do so turns abysmal ignorance into knowledge and a less than valetudinarian grasp into dominion and control.”); Katie Gant, “Crying over the Cache: Why Technology Has Compromised the Uniform Application of Child Pornography Laws,” 81 Fordham L. Rev. 319, 322 (noting the difficulty of proving knowing possession when child pornography images are found exclusively in the defendant’s internet cache) (October 2012).
12 software authorizes an inference that he knew about the kind of software needed to
access and manipulate compressed files. In addition, all of this evidence must be
viewed in light of Al-Khayyal’s educational background and professional expertise.20
Taking these permissible inferences together, we conclude that the evidence does not
establish as a matter of law that, while Al-Khayyal possessed his computer in Clayton
County, he had no knowledge of the presence of the .rar files in his computer’s trash
folder. Under the facts presented, the question of whether Al-Khayyal’s efforts to
abandon the illegal files were successful remains a question of fact for the jury and
cannot be determined as a matter of law at this pretrial stage. Bearing in mind that
knowledge and possession may be proved by circumstantial evidence and that slight
evidence of access, power, and intention to exercise control or dominion over
contraband is sufficient to create a jury issue, the record does not support a finding
that it will be impossible for the State to prove that Al-Khayyal committed the
20 Cf. Barton v. State, 286 Ga. App. at 52 (1) (noting the absence of any circumstantial evidence that would have allowed the jury to infer the defendant’s knowledge of particular cache files, such as evidence that the defendant was an experienced or sophisticated computer user who would have been aware of the automatic storage process of such files).
13 offenses in Clayton County, as alleged in the indictment.21 Consequently, as to Counts
30 through 49, the trial court erred in sustaining Al-Khayyal’s plea in bar and his
21 See Henderson v. State, _ Ga. App. at _ (1) (Evidence supported OCGA § 16-12-100 (b) (8) convictions where there was evidence that the defendant viewed movie files containing child pornography, saved some of the files to DVDs, and tried to delete the images from his computer.); Scarborough v. State, 317 Ga. App. at 524-525 (1) (Evidence supported OCGA § 16-12-100 (b) (8) convictions where there was evidence that the defendant saved files containing child pornography to a CD.); Haynes v. State, 317 Ga. App. 400, 401 (1) (731 SE2d 83) (2012) (Evidence supported OCGA § 16-12-100 (b) (8) convictions where there was evidence that files containing child pornography were saved to the defendant’s computer; the files had been intentionally downloaded to the computer using certain file-sharing programs; the defendant admitted using the file-sharing programs; and the files had been modified after being downloaded.); Dickerson v. State, 304 Ga. App. at 766 (2) (Evidence supported OCGA § 16-12-100 (b) (8) conviction where there was evidence that files containing child pornography were deliberately copied to a compact disc found in the defendant’s home and the defendant’s finger print was on the CD.); Hunt v. State, 303 Ga. App. at 857-858 (2) (Evidence supported OCGA § 16-12-100 (b) (8) convictions, including proof of venue in Clayton County, where there was evidence that the defendant, who lived in another state, saved files containing child pornography to a USB flash drive and, weeks later, had the flash drive with him when he stayed in a hotel in Clayton County and left the flash drive behind when he returned home.); see also United States v. Romm, 455 F3d 990, 1000-1001 (II) (9th Cir. 2006) (Evidence that the defendant viewed images of child pornography over the internet and then deleted the associated temporary files from the computer’s cache authorized the jury to find that he exercised control over the images in the cache and, therefore, that he committed the act of knowing possession of the images.); United States v. Bass, 411 F3d 1198, 1202 (II) (10th Cir. 2005) (Evidence that the defendant attempted to delete internet child pornography from the computer on which he viewed it authorized the jury to find that the defendant knew that the child pornography was automatically saved to the computer and, therefore, that he knowingly possessed the pornography.).
14 motion to dismiss the indictment for lack of venue. State v. Johnson, 269 Ga. 370,
372 (2) (499 SE2d 56) (1998).22
Judgment reversed in part. Phipps, P. J., and Branch, J., concur.
22 We note that the issue of where venue would lie in a case where the State cannot specify where illegal “material” in the form of stored data is located is not before us. See George Blum, et al., 21 Am. Jur. 2d Criminal Law § 476 (database updated May 2013) (Use of the internet to commit crimes “has led to many issues involving venue.”); David Colarusso, “Heads in the Cloud, a Coming Storm the Interplay of Cloud Computing, Encryption, and the Fifth Amendment’s Protection Against Self-incrimination,” 17 Boston U. J. Science & Technology L. 69, 70 (Winter 2011) (“New technologies . . . present law enforcement with the prospect that information may be stored in unknowable locations behind unbreakable locks.”) (footnote omitted). In this case, the State alleges that Al-Khayyal possessed and controlled material in the form of digital files stored in a knowable location – on a computer that was physically in Clayton County.