United States v. Brandon Moran

• Court: Court of Appeals for the Sixth Circuit
• Decided: May 3, 2019
• Docket: 18-5648
• Status: Unpublished

Opinion

NOT RECOMMENDED FOR FULL-TEXT PUBLICATION File Name: 19a0237n.06

No. 18-5648

UNITED STATES COURT OF APPEALS FOR THE SIXTH CIRCUIT

FILED May 03, 2019 UNITED STATES OF AMERICA, ) DEBORAH S. HUNT, Clerk ) Plaintiff-Appellee, ) ) ON APPEAL FROM THE UNITED v. ) STATES DISTRICT COURT FOR ) THE EASTERN DISTRICT OF BRANDON MORAN, ) KENTUCKY ) Defendant-Appellant. )

_________________________________/

Before: GUY, CLAY, and GRIFFIN, Circuit Judges.

RALPH B. GUY, JR., Circuit Judge. Brandon Moran was convicted by a jury of four

child pornography offenses—one count of distributing, one count of possessing, and two counts

of receiving child pornography—in violation of 18 U.S.C. § 2252(a)(2) and (4)(B). Seeking a new

trial on all counts, Moran contends that the district court erred by: (1) allowing an expert witness

to testify to matters outside the scope of the government’s pretrial disclosures; and (2) providing

an inadequate answer to a question posed by the jury during deliberations. Moran also challenges

the sufficiency of the evidence to support the distribution conviction, arguing that no reasonable

juror could conclude that he knew the files contained child pornography at the time they were

distributed. We affirm. Case No. 18-5648 2 United States v. Brandon Moran

I.

On June 6, 2016, a computer operated by Kentucky’s Internet Crimes Against Children

Task Force was searching for available child pornography on a peer-to-peer network and

successfully downloaded four files containing child pornography from a single IP address near

Marysville, Kentucky. Alerted to the download, Kentucky State Police Detective Brian Cooper

confirmed that the files contained child pornography, requested subscriber information for the

associated IP address, and obtained a search warrant for the home where Brandon Moran resided

with other family members.1

When the warrant was executed on June 14, 2016, Detective Cooper interviewed Moran’s

sister and nephew who lived in the home; determined that the sister’s boyfriend, who was the

subscriber, had not lived there in weeks; and learned that Moran’s mother lived there but required

care for dementia. That left 25-year-old Brandon Moran, who led Detective Cooper to his room

in the basement and acknowledged that he had been using BitTorrent on the laptop computer that

was sitting on a table. The interview with Moran that followed was recorded and played for the

jury, although he did not testify at trial.

In that interview, Moran was advised of his right to remain silent before being questioned

further. Moran then confirmed that the bedroom and computer were his; stated that the wifi

connection and computer were password protected; and admitted that there was child pornography

on his computer. Referring to child pornography, Moran said: “I have clicked on it, I’m not going

to lie to you, sir.” Moran said he had looked at all kinds of porn, but denied watching “baby porn”

and claimed that he had used the search term “Lolita” to look for Japanese animated pornography.

1 The four files, which were the basis of the distribution count, consisted of: one video and one picture file that were both named “new pthc opva 2014 real father fucks his 13 yo daughter in the basement”; and one video and picture file that were both named “pedo Lolita pthc hussyfan two preteen lesbian to cam.” There was testimony that “pthc” refers to “pre-teen hard core.” Case No. 18-5648 3 United States v. Brandon Moran

When asked how torrents worked, Moran said he did not really know but then described having

downloaded and used several peer-to-peer programs—including, BitComet, BitTorrent, UTorrent,

Frostwire, and Limewire. Moran also explained that a torrent download sometimes included things

he did not want, such as child pornography and that he sometimes tried unsuccessfully to delete it.

Near the end of the interview, Detective Cooper asked, “let me get this straight . . . [y]ou’re telling

me that you know there is child pornography on that computer?” And Moran answered, “Yes sir

I do.”

The interview also included an extended exchange about file sharing, which is relevant to

the charge that Moran knowingly distributed the four files that were obtained by the state computer.

During that exchange, Moran said he did not understand how peer-to-peer file sharing worked

before going on to make further statements that suggested he understood well enough. For

example, at one point, Moran acknowledged that someone using the correct peer-to-peer software

would be able to get a picture from a share folder on his computer. And, although he denied having

shared child pornography directly, he ultimately agreed that it was possible he could have shared

it indirectly from a share folder because “that’s how Torrent works when you download stuff.”

Detective Cooper seized the laptop, which was turned over to a computer forensics

examiner with the Kentucky State Police. The examiner, Mike Viergutz, who testified as an expert

witness, found approximately 200 files—including 106 videos and 91 images—which Moran

stipulated at trial contained or consisted of depictions of minors engaging in sexually explicit

conduct. (Gov’t Exh. 8.) About 20 of those files were recovered from the recycle bin. Viergutz

prepared a spreadsheet with detailed information about those files, including creation date,

directory path, file name, and a unique digital identifier called a “hash value.” (Gov’t Exh. 9.)

Although none of the four files retrieved by the state computer was found on Moran’s computer, Case No. 18-5648 4 United States v. Brandon Moran

file paths remained indicating that those four files had once been in the “c:\downloads folder.”

Viergutz testified that the only recovered internet search history that was relevant to the charges

was a single parsed (i.e., partial) search on Bing for “pedo forum.”

Viergutz extracted a long list of torrent files that had been downloaded to Moran’s

computer with various peer-to-peer programs, which included some torrents with names that

suggested child pornography, two that referenced a known series of child pornography, and others

that had innocuous names or characters (“FrostWire” spreadsheet). (Gov’t Exh. 11.)2 Viergutz

also found two logs on Moran’s computer that were created by the BitComet software: one log

showed downloads made using BitComet (“BitComet MyHistory”) and the other showed files

shared through BitComet (“BitComet MyShares”). (Gov’t Exhs. 10a & 10b.) Those BitComet

logs were the subject of the jury’s question during deliberations.

Testimony about how peer-to-peer networks operate was admitted primarily through

Robert Couchman, the Kentucky State Police Detective who ran the state computers searching for

available child pornography. Briefly, he explained that peer-to-peer networks generally, and

BitTorrent specifically, use the internet to share content directly between computers that have the

same or compatible client software. To find available content, BitTorrent users typically go to an

index site where search terms are entered to find torrent files. The search results are hyperlinks,

which look like a file name, picture, or symbol, and, when clicked on, the torrent file is downloaded

by the user’s client software program. The file name often indicates what the content will be, but

2 The order denying Moran’s post-verdict motion for judgment of acquittal specifically identified the following torrent file names found on Moran’s computer as indicative of child pornography: (1) “collection01 preteen pedo underagfe pthc babyshivid Lolita maffiasex hussyfan st. Petersburg Is magazine”; (2) “Falko III (with sound)”; (3) “[pthc] falkovideo – part 3 . . . 2014 opva preteen loli 10yo 8yo 9yo 11yo 12yo pedo mom family”; (4) “1st-Studio Siberian Mouse Custom (ND_TA)”; (5) “_cp”; (6) “BabyJ-R@ck (55S) 5yo enjoys gentle fuck from very big dick (R@ygold Style RCA pedo 9yo Child sex)”; (7) “baby bj”; (8) “Izzy 8yo 1b - Deep throating”; (9) “CBaby 7 - 3yo girl eat cum (2m44s)”; (10) “awe pthc videos”; (11) Children-W”; (12) PTHC – (=^.^=) Fernanda (12yo) Cumshot In Face [child kids pedo r@ygold hussyfan]”; (13) “!!!NEW!!!PTHC – (=^^.^^=) Fernanda (12yo) Cumshot In Face [child kids pedo r@gold hussyfan]”; (14) “cP.” Case No. 18-5648 5 United States v. Brandon Moran

it is possible, for example, that a file called “cat.jpg” actually is a picture of a dog. Also, the torrent

file itself does not contain the content; instead, it is the “package” and provides instructions for

creating a file to receive the content and includes the metadata for the locations where that content

can be retrieved on the network.

Once the user clicks on a torrent file, the user’s software, in this case BitComet, launches

automatically to open the torrent file (similar to how Adobe launches to open a .pdf file) and then

begins to retrieve the content in pieces from other computers if it is available for sharing. The

pieces can consist of whole files or parts of files. If the user who downloads a torrent has not

allowed sharing of files, the download speed is “choked” or slowed down greatly. BitComet

allows sharing of pieces before a whole file is received, and the version of BitComet on Moran’s

computer allowed the user to share by default or to turn off sharing. The state computers monitored

multiple networks for available content suggestive of child pornography, but the state computers

were specially configured to download only from a single IP address and to prevent any content

that was received from being shared.

With respect to the four files that the state computer requested and received from Moran’s

computer on June 6, Couchman testified in detail from a log of the communications between the

computers. In short, when the state computer initiated a “handshake” at 59:17, Moran’s computer

responded that it did not have any of the 92 pieces of those four files available for sharing.

BitComet on Moran’s computer responded that it had only one piece available (which was also

one complete file) at 59:47; and then it communicated that it had all four files as of 1:01:58.

Sixteen second later, at 1:02:14, the state computer received the first complete piece of those files

from Moran’s computer; and, at 1:12:21, the state computer finished receiving all four files from Case No. 18-5648 6 United States v. Brandon Moran

Moran’s computer. The log also indicated that Moran’s computer was receiving those files as an

“unchoked” download.

Moran moved unsuccessfully for judgment of acquittal at the close of the government’s

proofs and again after the defense rested without presenting any witnesses or other evidence. The

jury found Moran guilty of distributing child pornography on June 6, 2016; receiving child

pornography on May 15 and June 12, 2016; and possessing additional files of child pornography

when his laptop computer was seized on June 14, 2016. The district court denied Moran’s post-

verdict motion for judgment of acquittal, and imposed a below-Guidelines sentence of 138 months

of imprisonment. This appeal followed.3

II.

Reviewing the denial of a motion for judgment of acquittal de novo, this court views the

evidence in the light most favorable to the government and asks whether “any rational trier of fact

could have found the essential elements of the crime beyond a reasonable doubt.” Jackson v.

Virginia, 443 U.S. 307, 319 (1979); see also United States v. Humphrey, 279 F.3d 372, 378 (6th

Cir. 2002). In evaluating the evidence, we “must draw all reasonable inferences from the record

in favor of the prosecution and must avoid the temptation to weigh the evidence anew or assess

the credibility of witnesses.” United States v. Fitzgerald, 906 F.3d 437, 449 (6th Cir. 2018).

Challenging only the conviction for distributing child pornography, Moran argues that the

evidence could not establish that he knew the files constituted or contained child pornography at

the time of distribution.

3 There appears to be no dispute that the receiving and possessing counts each involve distinct videos or images, which is necessary to avoid a violation of the Double Jeopardy Clause. See United States v. Ehle, 640 F.3d 689, 696-98 (6th Cir. 2011). Case No. 18-5648 7 United States v. Brandon Moran

Moran accepts that distribution under 18 U.S.C. § 2252(a)(2) may be established by

showing “that the defendant maintained child pornography in a shared folder, knew that doing so

would allow others to download it, and another person actually downloaded it.” United States v.

Pirosko, 787 F.3d 358, 368 (6th Cir. 2015) (quoting United States v. Budziak, 697 F.3d 1105, 1109

(9th Cir. 2012) (following First, Eighth, and Tenth Circuits)). Although Pirosko addressed this

proposition in a different context, this statement represents a consensus among the circuits that

passive distribution of known child pornography made available for sharing on a peer-to-peer

network constitutes distribution. As the First Circuit explained: “When an individual consciously

makes files available for others to take and those files are in fact taken, distribution has occurred”

and “[t]he fact that the defendant did not actively elect to transmit those files is irrelevant.” United

States v. Chiaradio, 684 F.3d 265, 282 (1st Cir. 2012); see also United States v. Ryan, 885 F.3d

449, 453 (7th Cir. 2018); United States v. Richardson, 713 F.3d 232, 235-36 (5th Cir. 2013).4

Similarly, this court has repeatedly held that a two-level sentencing enhancement for

distribution of child pornography applies when files are knowingly made available through file-

sharing software. See United States v. Abbring, 788 F.3d 565, 567-68 (6th Cir. 2015) (citing cases

interpreting USSG § 2G2.2(b)(3)(F)). The point of using a file-sharing program, we said, “is to

share, sharing creates a transfer, and transferring equals distribution.” Id. at 567 (citing United

States v. Connor, 521 F. App’x 493, 499-500 (6th Cir. 2013)).

4 An analogy adopted by some circuits compares the distribution of child pornography through peer-to-peer sharing “to that of the owner of a self-service gas station: although the owner might not be present and does nothing when a motorist purchases gas at the pump, the gas station owner distributes gasoline just as a computer user on a peer-to- peer network distributes child pornography—by making the material available for other users on the network just as the gasoline is available to passing motorists.” Richardson, 713 F.3d at 236 (relying on United States v. Shaffer, 472 F.3d 1219, 1223-24 (10th Cir. 2007)). Of course, a gas station owner is also in the business of selling gas. But the description of passive distribution is illustrative nonetheless. Case No. 18-5648 8 United States v. Brandon Moran

Moreover, in Abbring, the enhancement applied even though the file sharing occurred at

the same time the defendant was downloading the files. Id. at 567. It did not matter that the peer-

to-peer software in that case did not allow users to disable automatic sharing or that files could not

be moved out of the shared folder until the download had been completed. Id. at 566. This court

explained that all the guidelines require “is the knowing sharing of the files.” Id. at 567–68. As

the Seventh Circuit concluded in Ryan, “[t]here is no reason why this same definition should not

apply when interpreting ‘distribute’ in the criminal statute.” 885 F.3d at 453.

Without denying that knowing distribution was established, Moran argues that no

reasonable juror could conclude that he knew, or could have known, that those files consisted of

or contained child pornography at the time they were distributed. This court has long held that

§ 2252(a)(2) requires knowledge of “the nature of the materials received or distributed.” United

States v. Brown, 25 F.3d 307, 311 (6th Cir. 1994). However, “knowledge of the contents of

material ‘may be proven by circumstantial evidence.’” United States v. Hentzen, 638 F. App’x

427, 431 (6th Cir. 2015) (quoting United States v. Kussmaul, 987 F.2d 345, 350 n.4 (6th Cir.

1993)).

In Hentzen, this court found that circumstantial evidence was sufficient to establish that the

defendant knew the character of the material involved because there was evidence that he searched

for child pornography and viewed it once it was on his computer. Id. at 431-32. That was the case

despite the defendant’s innocent explanations because this court “‘may not reweigh the evidence,

reevaluate the credibility of witnesses, or substitute our judgment for that of the jury.” Id. at 431

(citation omitted); see also United States v. Haymond, 672 F.3d 948, 957 (10th Cir. 2012) (finding

sufficient circumstantial evidence of knowledge where the jury could conclude the defendant used

a peer-to-peer network to search for, click on, and download child pornography). Case No. 18-5648 9 United States v. Brandon Moran

Here, there was evidence that Moran used peer-to-peer file sharing networks, understood

that any downloaded files in a shared folder could be retrieved by other users on the network, and

knew that child pornography was downloaded to his computer. It is true that the four files sent to

the state computer were not found on Moran’s computer when it was seized, which a jury could

infer meant that the content was not what he was looking for. Nor did the forensic examination

find internet searches for child pornography beyond a single recovered parsed search for “pedo

forum.” Although Moran suggested during his initial interview that he sometimes received content

that he did not want, he also admitted to having clicked on child pornography and admitted that

there was child pornography on his computer. In fact, the forensic examination found about 200

files of child pornography on Moran’s computer, and only about 20 of them had been moved to

the recycle bin. Further, plenty of the file names were consistent with Moran’s stipulation that

they contained or consisted of child pornography.

The jury was entitled to consider Moran’s admissions along with the testimony that

BitTorrent users typically go to an index site and enter search terms when looking for torrent files

to download. Moreover, once a link to a torrent file is found, the user must affirmatively click on

it to download the torrent file and activate BitComet to retrieve the files. Although the specific

torrent file associated with the four distributed files had a non-descriptive name and only some of

the other torrent file names were indicative of child pornography, the jury could infer that Moran

had searched for that content and clicked on it because he expected it to be what he was looking

for.

The district court emphasized that Moran’s computer finished downloading all of the

pieces of all four files before the state computer received anything from Moran’s computer.

However, it is not necessary to prove that Moran actually saw the files prior to the distribution in Case No. 18-5648 10 United States v. Brandon Moran

order for a reasonable juror to conclude that Moran knew the nature of the material that was

downloaded and made available for sharing. For that reason, it does not matter how short the time

was between when Moran’s computer finished downloading all four files and when the state

computer received the first complete piece at 1:02:14 (16 seconds), or the first complete file at

1:02:35 (2 ½ minutes), or all of the four files at 1:12:21 (12 ½ minutes).

Viewed in the light most favorable to the government, the evidence was sufficient to lead

a reasonable juror to conclude beyond a reasonable doubt that Moran’s search for child

pornography produced a link to the torrent file in question, which Moran activated knowing that

he would receive child pornography in his shared download folder. The district court did not err

in denying Moran’s motions for judgment of acquittal.

III.

This court reviews a district court’s admission or exclusion of evidence for abuse of

discretion. See United States v. White, 492 F.3d 380, 398 (6th Cir. 2007). But even when there is

an abuse of discretion, we reverse only when the error affects the substantial rights of a party. Id.

(citing Fed. R. Evid. 103(a) and United States v. Whittington, 455 F.3d 736, 738 (6th Cir. 2006)).

Moran contends that the district court abused its discretion by allowing Viergutz to offer

certain opinion testimony as a computer forensics expert. Specifically, defense counsel objected

to Viergutz’s testimony that the seven files containing child pornography found in a folder called

“users\Sherry\Pictures” had been “purposely put there as opposed to being directly [put] in the

downloads folder by the default settings” of the peer-to-peer software. Moran argues, as he did at

trial, that this opinion should have been excluded because it was outside the scope of the

government’s pretrial disclosures required by Federal Rule of Criminal Procedure 16(a)(1)(G). Case No. 18-5648 11 United States v. Brandon Moran

Upon request, the government must give the defendant “a written summary of any

testimony that the government intends to use under Rules 702, 703, or 705 of the Federal Rules of

Evidence during its case-in-chief at trial.” Fed. Rule Crim. P. 16(a)(1)(G). That summary “must

describe the witness’s opinions, the bases and reasons for those opinions, and the witness’s

qualifications.” Id.; see also United States v. Davis, 514 F.3d 596, 612 (6th Cir. 2008).

Here, the government’s disclosure identified Mike Viergutz as a computer forensics expert,

provided a copy of his CV, and indicated that Viergutz would testify to the content of the forensics

report that had also been disclosed. In relevant part, the government’s letter also stated:

Viergutz will testify that when examining the computer seized from the Defendant’s home, he discovered images and videos of minors engaged in sexually explicit conduct. Viergutz will explain where he found the images, how they came to reside there, the file names (some of which are indicative of child pornography), and whether the images were deleted. Viergutz will also explain that he located files indicating the computer user received and saved child pornography files.

(Emphasis added.) The record reflects that Viergutz’s report was disclosed to the defense,

including the spreadsheet that provided details regarding the files that contained child

pornography. Viergutz was also made available to defense counsel prior to trial. The district court

overruled Moran’s objection, finding that the testimony about where those files were located and

how they got there was covered by the disclosure and was an obvious inference to be drawn from

the spreadsheet of the files found.

Viergutz’s report does not appear to be in the record, but we know that it included the list

of files containing child pornography with details including the file path locations that were

admitted at trial. Viergutz testified without objection that the version of BitComet on Moran’s

computer directed files to a “downloads” folder as a default. And Viergutz’s testimony that the

files were located in a folder other than the downloads folder fits with the government’s disclosure

that Viergutz would “explain where he found the images[ and] how they came to reside there.” Case No. 18-5648 12 United States v. Brandon Moran

The district court did not abuse its discretion in finding that the basis for that testimony was

adequately disclosed. Moreover, although the prosecutor’s closing argument referenced

Viergutz’s testimony that a few of child pornography files were found outside of the “downloads”

folder, Moran has not shown that the admission of Viergutz’s opinion that those files had been

deliberately moved affected Moran’s substantial rights.

IV.

Finally, Moran argues that reversible error occurred because the district court failed to

adequately respond to the jury’s question. When, as here, an objection was made, we review the

district court’s response to the jury’s question for an abuse of discretion. United States v. Fisher,

648 F.3d 442, 446-47 (6th Cir. 2011). This court “may reverse a judgment only if the instructions,

viewed as a whole, were confusing, misleading and prejudicial.” United States v. Clark, 988 F.2d

1459, 1468 (6th Cir. 1993).

If the jury is confused about an important legal issue not covered in the jury instructions,

“a district court abuses its discretion by not clarifying the issue.” Fisher, 648 F.3d at 447 (citing

United States v. Nunez, 889 F.2d 1564, 1567-69 (6th Cir. 1989)). However, the judge “should

refrain from straying beyond the purpose of jury instructions by answering jury questions that seek

collateral or inappropriate advice.” Id. (citing United States v. Combs, 33 F.3d 667, 670 (6th Cir.

1994)). And “the court must be careful not to invade the jury’s province as fact-finder.” Nunez,

889 F.2d at 1569.

During deliberations, the jury sent the following written request: “We would like to see

the BitComet search history with key words that the state showed @ the end of her rebut[al]. That

is if it is entered into evidence. Juror 607.” It was clear to everyone—then and now—that the jury

was referring to the BitComet logs admitted as Exhibits 10a and 10b. Because neither of those Case No. 18-5648 13 United States v. Brandon Moran

logs represented a search history, defense counsel proposed that the jury be told that there was no

BitComet search history. The government argued that the court’s response should not highlight

or comment on the absence of evidence, particularly because it was clear what evidence the jury

was asking to see. Rejecting defense counsel’s proposed language, the district judge sent the jury

the following handwritten response:

What was shown by the prosecutor during her rebuttal closing was a printout of Gov’t Exh 10a & 10b, which you have on a disc in evidence. Exh 10a is the BitComet “my history” spreadsheet and Exh 10b is the BitComet “my shares” spreadsheet.

(The jury’s question did not involve a legal issue requiring clarification, and the district court’s

answer was an eminently appropriate attempt to respond to the jury’s request without commenting

on the evidence. The response also emphasized what the exhibits actually were—as opposed to

what they were not. 5

Moran argues on appeal that the additional clarification he requested was necessary

because the existence of a BitComet search history had been suggested, albeit unintentionally, by

the prosecutor during closing arguments. The record does not support this contention. First, the

passage Moran quotes actually referred to the FrostWire spreadsheet of torrent files found on

Moran’s computer (Exhibit 9). And, the prosecutor’s argument in that regard was that the jury

could infer from the names of some of the torrent file that were downloaded to Moran’s computer

that Moran had searched for child pornography on the various peer-to-peer networks.

Second, the prosecutor also separately described the two exhibits in question as “evidence

that Detective Viergutz was also able to glean directly from BitComet.” Specifically, she argued

that one showed “the titles of the files that were in his MyShares folder” and that the “history of

5 Defense counsel requested that the court respond: “There is not a BitComet search history. On rebuttal, the United States showed a copy of Exhibits 10A and 10B, BitComet MyShares and MyHistory.” Case No. 18-5648 14 United States v. Brandon Moran

BitComet” showed the file paths, file size, and the titles of “the files that he had on his computer,

that he got from BitTorrent, that he downloaded via BitComet, and that he was making available

for sharing with others.” Defense counsel argued in closing that the government could not prove

what Moran had searched for when he downloaded the torrent associated with the four files that

the state computer received; that the torrent itself did not have a name indicative of child

pornography; and that the file names would not have been visible when Moran decided to

download them. So, in rebuttal, the prosecutor pointed to “the names of the torrent files” in the

“records BitComet was keeping on the defendant’s computer.”

The jury was urged to look at the BitComet logs showing Moran’s downloads and shared

files to evaluate his assertions of accidental, inadvertent, or unintentional downloads of child

pornography. The district judge did not abuse his discretion in answering the jury’s question about

the evidence in the way he did, and the instructions as a whole were not confusing, misleading, or

prejudicial.

* * *

AFFIRMED.