United States v. Dillingham

320 F. Supp. 3d 809

• Court: District Court, E.D. Virginia
• Decided: May 29, 2018
• Docket: Case No. 1:17–cr–184–AJT
• Status: Published

Opinion

Anthony J. Trenga, United States District Judge

Pending is a post-trial motion to set aside Defendant Dillingham's convictions for the distribution and receipt of child pornography. [Doc. No. 66] ("the Motion"). As discussed below, there is no direct evidence that Dillingham actually knew that *811the charged material contained child pornography at the time of its distribution or receipt and the Motion, at its core, requires the Court to determine whether the substantial evidence concerning the Defendant's general propensity to search for and view child pornography, without any demonstrable connection to the charged images, is sufficient to support the jury's finding that the defendant knowingly distributed and knowingly received child pornography. For the reasons stated below, the Court concludes that the evidence is insufficient as a matter of law to prove either (1) that he knew when files were distributed from his computer in June 2016 that those files contained child pornography; or (2) that he knew when he caused files to download to his computer on July 29, 2016 that those files contained or would contain child pornography. The Court also concludes that a new trial is warranted if the Court's conclusion as to the sufficiency of the evidence is vacated or reversed. The jury's finding that he knowingly distributed or knowingly received child pornography was necessarily based on evidence of Defendant's propensity to search for and view child pornography, with no demonstrable connection to the charged conduct. In light of that evidence, as well as speculative expert testimony that exceeded the scope of the Government's pre-trial disclosures, and issues pertaining to the jury instructions concerning scienter, a new trial is warranted. Accordingly, Defendant's motion to set aside the verdict and enter a judgment of acquittal will be GRANTED and his request, in the alternative, for a new trial will be CONDITIONALLY GRANTED if the Court's judgment of acquittal is later vacated or reversed.

BACKGROUND

On August 17, 2017, a three count indictment was issued against the Defendant [Doc. No. 21], charging (1) distribution of child pornography in violation of 18 U.S.C. § 2252(a)(2) (Count 1); (2) receipt of child pornography in violation of 18 U.S.C. § 2252(a)(2) (Count 2); and (3) possession of child pornography in violation of 18 U.S.C. § 2252(a)(4)(b) (Count 3). The case was tried with a jury beginning on October 16, 2017. Immediately before the start of that trial, the Government moved to dismiss Count 3, charging possession of child pornography and that Count was dismissed. [Doc. No. 40]. The case proceeded to trial as to distribution (Counts 1) and receipt (Count 2); and on October 17, 2017, the jury convicted Dillingham on both counts.¹ Now before the Court is Dillingham's motion for a judgment of acquittal pursuant to Fed. R. Crim. P. 29 or for a new trial pursuant to Fed. R. Crim P. 33 [Doc. No. 66] (the "Motion").

LEGAL STANDARD

"[T]he relevant question [on a Rule 29 motion] is whether, after viewing the evidence in the light most favorable to the prosecution, any rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt." Jackson v. Virginia , 443 U.S. 307, 319, 99 S.Ct. 2781, 61 L.Ed.2d 560 (1979) (emphasis in original). It is the sole providence of the jury to "weigh[ ] the credibility of the evidence and resolve[ ] any conflicts in the evidence presented." United States v. Murphy , 35 F.3d 143, 148 (4th Cir. 1994). The Court, therefore, must "assume that the jury resolved all contradictions in the testimony in favor of the government."

*812United States v. Moye , 454 F.3d 390, 394 (4th Cir. 2006) (citation omitted). Additionally, the Government need not provide direct evidence for each element of the charged offenses; "circumstantial evidence... may be sufficient to support a guilty verdict even though it does not exclude every reasonable hypothesis consistent with innocence." United States v. Jackson , 863 F.2d 1168, 1173 (4th Cir. 1989). Federal Rule of Criminal Procedure 33 provides that "[u]pon the defendant's motion, the court may vacate any judgment and grant a new trial if the interest of justice so requires." But in considering whether to grant a new trial, "the district court should only overturn a jury verdict in the 'rare circumstance' when the verdict is against the great weight of the evidence." United States v. Garcia , 855 F.3d 615, 620 (4th Cir. 2017) (internal citation omitted). "[A]ny error sufficient to require a reversal on appeal is an adequate ground for granting a new trial." 3 Wright & Miller, Fed. Prac. & Proc. Crim. § 589.

ANALYSIS

Counts 1 (distribution) and 2 (receipt) both charge an offense under 18 U.S.C. § 2252(a)(2), which provides in relevant part:

Any person who...knowingly receives, or distributes, any visual depiction using any means or facility of interstate or foreign commerce...by any means including by computer, or knowing reproduces any visual depiction for distribution using any means or facility of interstate or foreign commerce...if

(A) the production of such visual depiction involves the use of a minor engaging in sexually explicit conduct; and

(B) such visual depiction is of such conduct;...

Shall be punished as provided in subsection (b) of this section.

The only real issue at trial was whether Dillingham had the required scienter.² In that regard, the distribution charge was based on two sets of images of child pornography that the FBI uploaded from Dillingham's computer in June 2016, presented at trial through Exhibits 108 and 109 (consisting of six images and thirty-five videos of child pornography, respectively). The receipt charge was based on the six images of child pornography contained in Exhibit 108 that the FBI found in the "Trash" of Dillingham's computer after it seized that computer at his home on August 4, 2016 pursuant to a search warrant. See also Ex. 601 (stipulating that the minors in Ex. 108 are actual, identified minors under the age of 12). Collectively, the Government referred to the charged child *813pornography as the "Known Images."³ In order to establish that Dillingham "knowingly" received or "knowingly" distributed this child pornography, the Government was obligated to present evidence sufficient for a juror to find that he actually knew that the downloaded files contained child pornography when those files were distributed or received, as alleged.⁴

As the Government explained to the jury in its opening statement, uTorrent "is a program used to access an online file sharing network called BitTorrent...[which s]ome people use...to download music or movies, but other people use...to download child pornography." 10/16/17 Tr 17:9-15. As explained by the Government's expert witness at trial, the BitTorrent network is a peer-to-peer file-sharing network whereby users can both access and make available to others "torrent" files. A torrent file is a file that contains instructions for a computer on how to locate on the BitTorrent network and put together the pieces of another file, such as a video, audio, or image file. Users can find torrent files for content they are interested in through torrent search sites, such as PirateBay or BitMon. A user then needs a BitTorrent "client," viz. , a piece of software (which appeared on Dillingham's computer under the name "uTorrent"). This client reads the "instructions" in the torrent file, finds from another user's BitTorrent clients the pieces of the file it contains the instructions for finding, assembles that file, and, depending on the settings, makes any files placed in or downloaded to the client's "shared" or "downloads" folder available for others to access using their own BitTorrent clients.

With respect to the distribution charge, the Government introduced evidence that between June 16 and 24, 2016 FBI agents accessed and uploaded⁵ from Dillingham's computer the Known Images multiple times using a law enforcement version of the BitTorrent software. As to the receipt charge, the Government established that on July 29, 2016, the six images in Exhibit 108 were downloaded to Dillingham's computer into a sub-folder within the uTorrent downloads folder called "CVCD" and that shortly after midnight on August 4, 2016, *814they were transferred to the "Trash" folder on Dillingham's computer.

On the morning of August 4, 2016, the Government executed a search warrant and seized Dillingham's computer⁶ and recovered a significant volume of computer forensic evidence from the computer's hard drive, including the Known Images. Also during that search, Dillingham made certain statements concerning his familiarity with bit-torrent file sharing software, his past attempts to search for "teen" and "pre-teen" pornography, and his occasional inadvertent downloading of child pornography as part of his search for adult pornography.

The forensic data obtained from Dillingham's computer included "bulk" system logs, including the File System Events logs (Ex. 517), the Safari internet history (Ex. 518), the Chrome internet history (Ex. 519), and additional Chrome internet history recovered from the unallocated space on the computer's hard drive (Ex. 520). From this bulk data, the Government presented selected entries at trial showing (1) that the Known Images in Exhibit 108 were downloaded to Dillingham's computer and later moved to the Trash (Ex. 517A); (2) evidence of multiple past searches for torrent files using child pornography related terms that occurred between July 14 and July 27, 2016 and also dozens of similar undated searches (Ex. 518A); (3) evidence that Dillingham visited several profiles with child pornography related terms in their names on the image-sharing site "imgsrc"; and (4) a digital "footprint" of files in Dillingham's computer that had been "uploaded" to another user though the BitTorrent software installed on his computer, at least one which had a description suggestive of child pornography (Ex. 508).

None of the recovered forensic data evidenced where the Known Images came from or any search that "linked" to or otherwise evidenced the source of those Known Images or how they came to be on Dillingham's computer either in June or on July 29, 2016. Also, none of recovered forensic data evidenced that Dillingham had opened the CVDC folder or viewed any of the Known Images until August 4, 2016 when he moved the images, the CVCD folder containing the Known Images, and the CVCD torrent file into the Trash. Further, while there was evidence that other torrent files with child pornography terms in their filenames were downloaded at the same time as the Known Images in July (Ex. 517A), there is similarly no evidence showing where those files came from or "linking" them to the search activity shown in the exhibits (Ex. 518A).

The only direct evidence concerning the source of the Known Images came from Dillingham himself, who testified that he frequently went to the Pirate Bay website and hit a "magnet link," which downloaded automatically the "top 100" torrent files, whose content was not otherwise described. Sometime after the files had been downloaded, he would go through those files and delete those he was not interested in, including, according to him, those containing child pornography. There was no evidence that the "top 100" link was promoted or held out as, or otherwise associated with, child pornography. Nor was there any evidence that any of the content or file names associated with the "top 100" link could be seen before being downloaded.

In the pending Motion, the Defendant contends that while the evidence was sufficient to establish that at some point Dillingham *815knowingly possessed the Known Images, the Government for whatever reason chose not to prosecute that crime and the evidence is insufficient as a matter of law to allow a jury to find that Dillingham knowingly received or distributed the Known Images.

a. Count I: Distribution of Child Pornography ( 18 U.S.C. § 2252(a)(2) )

The Government relies on what is known as the "passive distribution theory" to establish the knowledge requirement for the distribution of child pornography, whereby instead of presenting evidence that the Defendant "actively" posted content to a website or otherwise distributed child pornography through the internet, the Defendant downloaded child pornography by way of the uTorrent software into a "shared" folder in the uTorrent program, knowing that those files would then be available for others to upload from his computer.⁷ Dillingham challenges the sufficiency of the evidence to prove that he knew that child pornography was contained in the those files when law enforcement uploaded those images from his computer in June, 2016 and also that he knew that he was making those downloaded files available to others through his use of the uTorrent software.

1. The sufficiency of the evidence that Dillingham knew he possessed the child pornography "distributed" in June 2016.

The alleged distribution took place between June 16 and 24, 2016, when Special Agent Scott Stein of the FBI, using a law-enforcement version of the BitTorrent software, uploaded from Dillingham's computer child pornographic images from two known series of child pornography. See Exs. 108 & 109. While the Government *816presented a significant volume of computer forensic evidence from the period after the charged distribution in June-from July 14, 2016 through early August 2016⁸ -it presented no forensic evidence concerning the presence, creation, or source of the Known Images on or before they were uploaded by Agent Stein in June 2016. The only direct evidence that the Known Images were even on Dillingham's computer in June 2016 is the fact that Agent Stein was able to upload them.

As for circumstantial evidence, the only activity in the forensic record that predates the offense conduct charged in the distribution count is a series of entries in Government Exhibit 520A, which are excerpts from the deleted internet history recovered from the unallocated space on Dillingham's computer. These entries indicate that on October 29, 2015-approximately eight months before the charged conduct-Dillingham viewed "profiles" with names suggesting child pornography on a website called imgsrc.ru. There is no evidence connecting these searches to the Known Images being downloaded or otherwise placed in the shared folder in June 2016. In that regard, the Government's expert testified that imgsrc is not a torrent website at all but rather a site where individuals create named "profiles" and upload images to those profiles for others to view. In short, there is no evidence that this activity is at all related to the charged conduct in the distribution count.

In contending that the evidence is sufficient to establish that Dillingham knew at the time that child pornography was contained in what the FBI uploaded from his computer in June 2016, the Government also relies on Dillingham's statements concerning his search habits and search experience. In that regard, Dillingham admitted to law enforcement during the execution of the search warrant that there were occasions when he searched for "teen" and "pre-teen" pornography. He also stated that it was his to habit over some unspecified time period to visit PirateBay-a torrent search website-and click a single link to download in bulk the "top 100" torrent files on the site at that time. As described by Dillingham, the amount of material contained in those files would be so large in digital volume that it would sometimes take days for all of it to download to his computer, following which he would go through it, moving anything he was not interested in to the Trash folder. Dillingham also admitted that on "two or three" occasions (which he also characterized as "rare") he discovered among these bulk downloads instances of child pornography, which he discarded to the Trash. 10/17/2017 Tr 46:5-7.⁹ There was no evidence concerning when these "bulk" downloads took place or when he discovered child pornography among those bulk downloads. There is also no evidence that the files distributed in June were part of a bulk download from which he had previously discovered child pornography *817or that there was any demonstrable connection between the downloading of the Known Images in June that were "distributed" and any of his searches. As discussed in more detail in connection with the receipt charge, any such inference of knowledge drawn from this evidence is necessarily based on an impermissible inference drawn from a general propensity or disposition to search for and view child pornography, i.e., that Dillingham is an individual who searches for and is generally interested in child pornography, and therefore can be imputed with knowledge of any file of child pornography found in his possession. For these reasons, the Government failed to produce evidence that when viewed most favorably to the Government established beyond a reasonable doubt that Dillingham knew at the time that he possessed the child pornography that was distributed in June, 2016 from his computer.

2. The sufficiency of the evidence concerning Dillingham's knowledge that the uTorrent software made his shared files available to others.

The Government relied on three sources of evidence to establish Dillingham's knowledge that uTorrent software made files in the "downloads" folder available to others: (1) the uTorrent user agreement (Ex. 111); (2) the Defendant's statements during an interview by Agent Stein on the morning agents executed a search warrant on the Defendant's house (Exs. 106A-D); and (3) messages provided to Dillingham as part of the uTorrent software's user interface and design (Ex. 508). The user agreement evidence is clearly insufficient to prove knowledge. The Government provided no direct evidence that Dillingham read the user agreement, much less the portion that discusses how the shared folder works. Additionally, on cross examination Agent Stein, the witness through whom the Government introduced the user agreement, acknowledged that the user agreement admitted as Exhibit 111 was not taken from the Defendant's computer and was not the user agreement in effect when the Defendant's computer was seized, but rather was the agreement in use on the date of the trial. 10/16/2017 Tr.86-87.

The statements from Dillingham relied on by the Government were made in response to questions by the FBI agents during the search of his home, excerpts of which are in evidence as Exhibits 106A-D.¹⁰ During that exchange, Dillingham stated that he does not usually "upload anything" and that he understood that files could be shared through the uTorrent software "if you allow that to happen." The Government contends that notwithstanding the exculpatory nature of this initial response, Dillingham, upon further questioning, admitted that he did, in fact, understand *818that his files could be shared; but it is not at all clear from those responses whether Dillingham in fact admitted he understood at the time he downloaded the file in June that his downloaded files could be uploaded by others in the network without affirmative actions on his part or was simply acknowledging that he understood what was being explained to him. Likewise, as to the uTorrent user interface, presented as Exhibit 508, it is not at all clear that someone looking at that screen would understand that files were being uploaded by someone within the uTorrent network as opposed to an "uploading" into the computer itself. In fact, the Government used an expert to explain what one saw when looking at that screen, including that the term "seeding" that appears with respect to the values in one column means "uploading" or sharing."

The question then is whether a juror could reasonably conclude from this evidence beyond a reasonable doubt that Dillingham understood in June of 2016, when Agent Stein uploaded the Known Images from Dillingham's computer, that the BitTorrent client he was using, called uTorrent, would, without further actions on his part, make available to others any files in his "downloads" folder. If so, that evidence would be sufficient to demonstrate that he was aware that the files in his shared folder were available to others to download, and therefore that he had the necessary scienter as to that element of the "passive distribution" theory, even though the Defendant denied understanding how BitTorrent worked in his trial testimony. 10/17/2017 Tr 47:1-5; See Budziak , 697 F.3d at 1109-10 (finding sufficient evidence of knowledge for passive distribution where "the government presented evidence indicating that [the defendant ] was familiar with LimeWire and how it functioned ....and that he knew enough about the program's functions to tell an FBI agent that he moved files out of the shared folder to other parts of his computer.") (emphasis added). Although a close question, the Court concludes, after viewing all the evidence most favorably to the Government, that the evidence is sufficient for the jury to find that Dillingham knew in June 2016, that files on his computer downloaded through uTorrent software were accessible to others within the uTorrent network and that he could therefore "distribute" those files to others once they were downloaded.

b. Count II: Receipt of Child Pornography ( 18 U.S.C. § 2252(a)(2) )

Dillingham was also charged with the receipt of the six of Known Images in the torrent file presented in Exhibit 108. The contested issue here is the sufficiency of the evidence to establish that Dillingham "knowingly" received those Known Images on July 29, 2016.

As outlined above, the Government presented evidence that the Known Images were downloaded into a sub-folder within the uTorrent downloads folder called "CVCD" on July 29, 2016, before being moved to the computer's Trash folder on August 4, 2016 at 12:54 a.m. It did not present any evidence, digital or otherwise, concerning (1) what website or other source the CVCD torrent file or sub-folder came from; (2) the circumstances under which the file was downloaded; (3) any search terms used to locate the CVCD torrent file on the internet; or (4) any file titles that would have been seen before the file was downloaded other than "cvcd.torrent." There was also no digital evidence that Dillingham knew that the CVCD torrent file downloaded on July 29, 2016 contained or would likely contain child pornography before he caused that file to download. There was no evidence that the CVCD torrent file was downloaded from *819the "top 100" link, and even if it were, there was no evidence that the "top 100" link was identified with, promoted, or otherwise held out as being associated with child pornography. In that regard, there was no search history that had a demonstrable connection to the Known Images, the "top 100" link, or the CVCD file and no evidence that Dillingham had previously downloaded or viewed the CVCD torrent file before and thereby knew that the torrent contained child pornography when it was downloaded on July 29, 2016.¹¹

The Government candidly conceded at trial and also at the hearing on the Motion that there was no direct evidence of knowledge concerning the receipt charge and relies entirely on circumstantial evidence to support the jury's finding that Dillingham knowingly received child pornography on July 29 when the Known Images downloaded onto his computer. That circumstantial evidence falls in the following categories: (1) the Defendant's statements to law enforcement on August 4, 2016 evidencing that he knew he had possessed child pornography; (2) internet search histories with search terms associated with child pornography; (3) computer search history of accessing "profiles" on the imgsrc website with names suggesting that the profiles contained images of child pornography; and (4) evidence that "cleaning" software had been installed on Dillingham's computer.

(1) Defendant's statements: As to the Defendant's own statements, the Government relies on Ex. 106C, the transcript of an exchange between Dillingham and Agent Stein on the morning of the search of Defendant's house. In that exchange, Dillingham acknowledges that "there is child porn there," referring to his computer. Ex. 106C 68:6. Dillingham also says that his computer will contain a history of using search terms related to child pornography, including "pre-teen." See id. at 68:14-69:13. In his interview with Agent Stein, Dillingham also admitted that he recognized an image array containing the Known Images from Exhibit 108, that he found them in the shared folder in his uTorrent program, and that they were "probably" still on his computer. Ex. 106D. The Defendant also admitted to seeing child pornography involving minors, in his estimation, as young as six or eight in response to a search for "pre-teen porn." 10/16/2017 Tr 72:10-17. As discussed in connection with the distribution charge, he also admitted that on "two or three" occasions or "rare[ly]" he discovered child pornography within the "bulk" downloads from the Pirate Bay site.

(2) The forensic evidence concerning searches: The forensic evidence consisted primarily of four exhibits, Exhibits 517 through 520. Exhibit 517 is the file system event logs, or FSE logs, which, according to the Government's expert witness Joshua Storey, show when any file is created, renamed, moved, or deleted. Exhibit 518 consists of the internet history for the Safari web browser recovered from the computer; and Exhibit 519 is the internet history for the Google Chrome web browser. Finally, Exhibit 520 contains additional Google Chrome internet history that was recovered from the unallocated space on the MacMini's hard drive-that is, internet history that had been deleted. The *820government separated out from these "bulk" exhibits those entries suggestive of child pornography and presented them in Government-created compilations presented as Exhibits 517A, 518A, 519A, and 520A. While the hard drive itself was in evidence, the jury had no means to review the data in Exhibits 517 through 520 that was not included in the Government-created compilations.

(a) Exhibit 517A: Exhibit 517A is the only Exhibit that references in any way the Known Images. In that regard, it shows the creation of the CVCD subfolder within the uTorrent downloads folder on July 29, 2016, the Known Images being placed into that subfolder, and the computer's user moving that subfolder, those image files, and the CVCD torrent file into the Trash on August 4, 2016, all direct evidence of the downloading, and thereby the receipt, of the Known Images.¹² That evidence does not establish, however, that a user had to do anything to create that CVCD subfolder or move the images to it. See id. at 181:11-13. Rather, as Government's expert explained, it is impossible to determine from this Exhibit where a given torrent file was downloaded from, or what actions the user had to take to initiate that download. Id. at 22:20-23:1. For these reasons, Exhibit 517A only establishes when the Known Images were downloaded and when they were moved to the Trash folder.

(b) Exhibit 518A: Exhibit 518A, titled Safari internet history, contains selected entries from the Safari browsing history recovered from the computer. This browsing history includes entries showing that Dillingham had previously searched for child pornography on image sharing and torrent sites using search terms associated with child pornography. As explained by Storey by way of example, Ex. 518A shows, inter alia , that a user visited the torrent search site called BitMon on multiple occasions and entered common child porn search terms into BitMon such as "yng sister spyind innuendo," "daddy," "r@y," "Rolds," and "pedo." The user then sorted the results for "pedo" by date and clicked through fourteen pages of these search results and downloaded approximately half a dozen torrent files with file names containing terms associated with child pornography. Ex. 518A 3; 10/16/2017 Tr 145:23-156:3 & 147:8-12. However, none of these files, or any other files listed in Exhibit 518A, have filenames or other identifiers indicating that they are the Known Images, and there is no evidence to suggest that they are the same images with different filenames. Most problematic is that there is no evidence concerning when these BitMon searches took place.¹³

In addition to the undated Bitmon search histories, Exhibit 518A contains dated browsing histories from July 14, 2016 through August 4, 2016. This browsing history includes entries reflecting that a user navigated on multiple occasions to a website called imgsrc.ru, which is not a torrent website, but a photo sharing website where "users can go and they upload *821photos for others to view." 10/16/2017 Tr. 142:8-16. The site is constructed around the "profiles" created by persons who have uploaded photos that other users can access. To access photos posted on that site, a user would select a "profile." Exhibit 518A compiles digital entries that evidence that a user accessed numerous profiles with names suggestive of child pornography, such as "likethemyounger," "Lolita_fan," "lolitalover34," "pedobrando," "likesyounggirls1," and "preteengirlover." The latest imgsrc entries in Exhibit 518A before the charged receipt on July 29 occurred two days earlier, on July 27, 2016. However, there is no evidence of the actual photos accessed, that they included any of the Known Images or that they were in fact downloaded. Nor do these imgsrc entries evidence the kind of activity that might have led to the receipt of the CVCD torrent file containing the Known Images on July 29, because imgsrc is not a torrent website.

(c) Exhibit 519A: Similarly, the United States introduced Exhibit 519A, titled Google Chrome Internet History, which contains dated entries showing websites Dillingham visited on July 23, 2016 between 1:06 am and 2:28am. These websites included "youngpornvideos.com," "realyoungporn.com," and also "thepiratebay," the website from which Dillingham testified he downloaded the "top 100" torrent files that contained the Known Images. The July 23 Pirate Bay entries have the associated search term "yourdirtydaughter." The dated entries also indicate that the Chrome browser received search queries for "your dirty daughter," "erotic stories," and "cp," a common abbreviation for child pornography. There are also multiple additional undated entries indicating that Dillingham searched the Pirate Bay website using the search terms "your dirty daughter," "family affairs," and "cp." Again, there is no evidence of the actual content of any files returned in response to these searches, whether any of those files were downloaded, or any demonstrable link between any of these searches and the "top 100" file or link, or any other link, from which the Known Images were downloaded.

(d) Exhibit 520A: Exhibit 520A contains similar records of searches for child pornography from the browsing history recovered from the unallocated space on the hard drive. This exhibit also compiles records of downloads of over two dozen torrent files containing child pornography terms in their titles and several dozen imgsrc and other social media profiles with child pornography terms in their names. However, like the BitMon evidence discussed above, these entries contain no dates. The only dated entries in 520A show that on October 29, 2015, Dillingham visited an imgsrc profile called "lolitafan6," and that on July 23, 2016 he searched the Pirate Bay for "your dirty daughter" and visited other websites with child pornography terms in their URLs, none of which is demonstrably connected to the Known Images.

(3) "Cleaning" Software. Government Exhibit 521 is a screenshot of the computer's "applications" folder, showing four "cleaning" programs: CCleaner, CleanMyDrive, Disk Cleaner, and CleanMyMac, which appear to have been installed multiple times. See also 10/16/2017 Tr 192:21-193:8. Storey testified that the CleanMyMac application had been set to automatically open when the user logged onto the computer. Id. at 193:10-12. At trial, the Government pointed to this software generally to explain why the Government did not present any evidence that the Defendant had viewed any of the Known Images. See 1/17/2017 Tr 109:2-25. Storey testified only generally concerning the "cleaning" software and provided little detail *822concerning how these applications worked and what, specifically, they "cleaned" from the computer.¹⁴ There was no testimony concerning the capabilities or functioning of the CleanMy Mac software, the only cleaning software said to automatically open upon log in. Similarly, while Storey testified that the CCleaner app "is specifically used to delete files and clean folders on the operating system," 10/16/2017 Tr 192:21-23, he did not elaborate on how files could be deleted or what it meant to "clean" a folder; and there was no testimony that it, or any of the other software other than CleanMyMac, was functioning or operating at any time. In fact, there was no evidence that Storey tested or investigated the functionality of any of this software or its effects on data or files, or that he had formed opinions to any particular degree of certainty. Rather, he expressed opinions based on nothing more than the names of the applications and the absence of data. See id. at 193:19-23 (when asked specifically whether he had found "any evidence to indicate that data had been deleted from this computer?", Storey testified that he "found a lack of data or a severe absence of data that would indicate to me that files had been removed from the system."); 10/17/2017 Tr 20:9-11(testifying on cross-examination that "where I would expect to find [those] entries [evidencing that the Known Images were opened], there were no entries...."). In sum, his testimony regarding this "cleaning" software was highly speculative, particularly since whatever its purpose or functionality, this cleaning software appears to have had no effect on a vast amount of forensic data that was recovered, including the browsing history recovered from the unallocated space going back as far as October 2015 and as late as August 4, 2016.

The issue before the Court is whether the evidence at trial, when viewed most favorably to the Government, is sufficient for a juror to reasonably find that Dillingham knowingly received child pornography when the CVCD file downloaded onto his computer on July 29, 2016. On the one hand, there is substantial evidence of a defendant with a deep-seated interest in child pornography, including a history of internet searches for it. On the other hand, there is no evidence that connects any of that history to what he did on July 29, 2016 to cause the Known Images to download onto his computer. Nor is there other evidence from which to draw the reasonable inference that he knew that child pornography would likely be included in whatever files downloaded on July 29, 2016. Indeed, there was no evidence at all in the Government's case in chief showing what he actually did to cause the CVCD torrent file to download. The only direct evidence concerning Dillingham's actus reus is his own testimony concerning his downloading "the top 100" torrent files from the Pirate Bay site. But there is no evidence connecting any of the forensic evidence to that link or Dillingham's prior knowledge concerning the contents of that particular link.

Given his admitted experiences in finding child pornography among his bulk downloads, Dillingham no doubt understood there was some risk that child pornography could be among what was downloaded and his conduct could be characterized by some level of negligence. But the offense of receipt requires that a defendant "knowingly receives" child pornography. See *823X-Citement , 513 U.S. at 76-78, 115 S.Ct. 464. The evidence here did not establish that Dillingham actually knew that he would be receiving child pornography when he caused the CVCD torrent to download on July 29, 2016. In other words, a jury could not reasonably find from the evidence that Dillingham was aware of facts that made it "practically certain" that the "top 100" link would contain child pornography when he clicked that link. See Model Penal Code, § 2:02(2)(b) (by definition, "[a] person acts knowingly with respect to a material element of an offense when:...(ii) if the element involves a result of his conduct, he is aware that it is practically certain that his conduct will cause such a result."), cited with approval in United States v. Merchant , 731 Fed.Appx. 204, 206-07 (4th Cir. 2018) ; See also United States v. Silva , 794 F.3d 173, 183 (1st Cir. 2015) (concluding that a defendant knowingly receives child pornography when he knows "the facts that ma[d]e his conduct fit the definition of the offense" at the time of receipt) (quoting Elonis v. United States , --- U.S. ----, 135 S.Ct. 2001, 2009, 192 L.Ed.2d 1 (2015) ).

Courts have often affirmed convictions for receipt of child pornography without direct evidence of knowledge, often on the basis of search histories containing many of the same terms found in the search histories in evidence in this case. But those cases typically involve some connection, absent here, between those search histories and the source of the received child pornography, such as a defendant's admissions or evidence that linked a particular search to the particular downloaded image charged. See, e.g., United States v. Miltier , 882 F.3d 81, 87 (4th Cir. 2018) ("There was also evidence the computer was used to search for child pornography, including the illicit files themselves...."); Silva , 794 F.3d at 183 (finding the evidence sufficient to prove that the defendant knowingly received child pornography through a website where the defendant had previously ordered 75 items on 22 separate occasions from that website and the website's content "clearly communicated to its website audience that each of the films [defendant] ordered would feature the [minor] boys nude."); United States v. McNealy , 625 F.3d 858, 870 (5th Cir. 2010) ("The Government presented exhibits of the images themselves and evidence of how McNealy obtained the images....").

In assessing the sufficiency of the evidence to support an inference of knowledge, the Court has considered whether the child pornography related searches in evidence are sufficiently proximate in time to the downloading of the Known Images as to allow a permissible inference that one was connected to the other. There are no such searches that would suggest such a link. The closest forensic evidence, temporally, to the downloading of the Known Images is the imgsrc activity in the Safari browsing history in Exhibit 518A showing that Dillingham viewed an imgsrc profile called "preteengirlover" on July 27, 2016. As with all of the imgsrc profiles, there is no evidence concerning what images Dillingham may have seen when viewing that profile. In any event, that viewing is not associated with any downloading of images and it is not so close in time as to suggest that his downloading the content of the link that contained the Known Images was part of any particular, identifiable search suggestive of child pornography. While there is forensic evidence in the FSE log in Exhibit 517A that other files with child pornography terms in their filenames downloaded at the same time as the Known Images, that evidence is not probative of Dillingham's mens rea with respect to those files or the Known Images, as none of the other forensic evidence shows where those files came from, or that Dillingham *824had any knowledge of their contents when they were downloaded. The other entries in Exhibit 517A largely consist of other child pornography files being moved to the Trash folder, rather than indicating that at that time Dillingham was searching for and downloading a series of child pornography related torrent files. In sum, there is no documented child pornography related search so close in time to the downloading of the Known Images as to allow any reasonable inference that it was part and parcel of the process that led to the downloading of the Known Images.

Based on the evidence presented, viewed most favorably to the Government, there is no reasonable or permissible inference that would allow the jury to conclude that Dillingham knowingly downloaded the Known Images. Rather, any such inference is necessarily drawn from evidence of a propensity to search for and view child pornography.

Courts have recognized that the offense of receiving child pornography, with its mandatory minimum sentence, effectively imposes a different, and more demanding, level of proof than that needed for the offense of possession. See, e.g. , United States v. Myers , 355 F.3d 1040, 1042 (7th Cir. 2004) (noting that an individual who incidentally receives, but knowingly retains, child pornography has sufficient mens rea for possession of child pornography but not receipt). That higher burden of proof may, in some cases, be more difficult to carry; and the horrible victimization of children associated with these crimes make it judicially tempting to allow a demonstration of propensities to sustain that burden, as the Federal Rules of Evidence have expressly done with respect to other sex related crimes. See Fed. R. Evid. 413 - 415. Such a course, however, would offend that bedrock principle of our criminal justice system that a finding of guilt should not be based merely on a person's "bad character" or his propensity to commit a crime. It is a principle that in its application often challenges human experience.

Federal Rule of Evidence 404(b)(1) and (2) essentially codifies the balance struck with respect to "other acts" evidence. Rule 404(b) provides that "[e]vidence of a crime, wrong, or other act is not admissible to prove a person's character in order to show that on a particular occasion the person acted in accordance with the character...[although it may] be admissible for another purpose, such as proving motive, opportunity, intent, preparation, plan, knowledge, identity, absence of mistake, or lack of accident." It is precisely because of the powerful influence of "other acts" evidence on the guilt determining process that the recognized use of such evidence must tie directly into an element or defense of the crime charged. But the recognized exceptions can easily be allowed to swallow the general prohibition against inferring "that on a particular occasion the person acted in accordance with the [person's] character." Fed. R. Evid. 404 (b)(1) ; See United States v. Gomez , 763 F.3d 845, 855 (7th Cir. 2014) (en banc) ("But if subsection (b)(2) of the rule allows the admission of other bad acts whenever they can be connected to the defendant's knowledge...then the bar against propensity evidence would be virtually meaningless."). For that reason, in determining whether an inference of knowledge or lack of mistake is permissible, and thus "reasonable" for the purposes of a Rule 29 motion, the question is whether the "permissible, ultimate purpose (say, proof of the defendant's knowledge or intent) cleanse[s] an impermissible subsidiary purpose (propensity)?" Gomez , 763 F.3d at 855 ; See also United States v. Ramos-Atondo , 732 F.3d 1113, 1123 (9th Cir. 2013)

*825(where the Government seeks to use 404(b) evidence to prove knowledge, "the government must prove a logical connection between the knowledge gained as a result of the commission of the prior act and the knowledge at issue in the charged act.") (internal quotation marks and citations omitted).

In order to protect against the misuse of propensity evidence, courts have "emphasized the importance of identifying the non-propensity theory that makes the other-act evidence relevant and specifically asking how the evidence tends to make a particular fact of consequence more or less probable." Gomez , 763 F.3d at 856 (emphasis added). It is therefore necessary to "delineate precisely the legitimate ends to which the evidence could be applied." United States v. Ciesiolka , 614 F.3d 347, 355 (7th Cir. 2010) (cited with approval in Gomez, 763 F.3d at 865 ). A court must "consider the chain of logic by which the jury is being asked to glean the defendant's knowledge, intent, etc., from proof of his prior misdeeds." United States v. Lee , 724 F.3d 968, 976-77 (7th Cir. 2013) ; See also United States v. Rodriguez , 880 F.3d 1151, 1167-68 (9th Cir. 2018). Here, the Government presented evidence concerning Dillingham's various digital "misdeeds" in order to prove his "knowledge" and "lack of mistake." In other words, the Government introduced Dillingham's child pornography related searches, with no demonstrable connection to what Dillingham did or downloaded on July 29, to prove that Dillingham knew that he downloaded the Known Images on July 29 and knew what they depicted. In Gomez , the Seventh Circuit, in an en banc opinion, summarized the necessary showing for this type of use of other acts evidence:

[I]t's not enough for the proponent of the other-act evidence simply to point to a purpose in the 'permitted' list and assert that the other-act evidence is relevant to it. Rule 404(b) is not just concerned with the ultimate conclusion, but with the chain of reasoning that supports the non-propensity purpose for admitting the evidence. In other words, the rule allows the use of other-act evidence only when its admission is supported by some propensity-free chain of reasoning.

Gomez , 763 F.3d at 856.

There is no "propensity-free chain of reasoning" that supports the use of the other-acts evidence to prove that Dillingham knew he was downloading child pornography on July 29, 2016. The source of the Known Images is unknowable from the digital record. Accepting that they came through the "top 100" link on the Pirate Bay website, as Dillingham seems to have testified, there is no forensic history connected to that link or any evidence that Dillingham knew that this link would cause child pornography to download onto his computer.

Here, the jury was allowed to find that the Defendant knowingly distributed and received child pornography based on nothing more than evidence that he had a general disposition or propensity to search for and view child pornography. Under the specific facts and circumstances of this case, that evidence is not sufficiently probative of any permitted use under Rule 404(b)(2) and should have been excluded; it had no connection to the crimes charged other than to show the defendant's predisposition and "bad character" and "that on a particular occasion the [defendant] acted in accordance with [his] character." Fed. R. Civ. P. 404(b).

Based on all the evidence, even when viewed most favorably to the government, the evidence is insufficient to allow a jury to conclude beyond a reasonable doubt that the defendant knowingly received or distributed the Known Images.

*826c. The Court conditionally grants a new trial.

In the event the Court's judgment of acquittal is reversed on appeal, the Court conditionally grants a new trial.

First, for the reasons stated above, a significant volume of the admitted forensic evidence should have been excluded. Although it appeared to the Court as that forensic evidence was being offered that it might sufficiently connect through other evidence to a permitted use, it is now clear to the Court when viewing that evidence with benefit of a full evidentiary record that much, if not all, of that forensic evidence was in fact used only for its value as evidence of Dillingham's propensity to search for child pornography. Indeed, this is precisely how the Government argued that evidence, and the entire case, to the jury. For example, the Government repeatedly told the jury, in various articulations, that "[t]his is a case about a man who wanted child pornography, who searched for child pornography, and who downloaded child pornography." 10/17/2017 Tr. 93:8-10; see also, e.g. , id. at 107:10-12 ("This is a case about the defendant searching for terms that included 'CP, Ray Gold, daddy incest, my dirty daughter.' "). As for carrying its burden to prove the crime of receipt, the Government argued that "[t]he forensics show that he did in fact search for child pornography, that he did in fact download child pornography. In legal terms that means he received child pornography." Id. at 97:15-17. In the absence of any evidence that Dillingham knew that the CVCD torrent file downloaded on July 29, 2016 contained child pornography, the Government essentially equated "knowingly receiving" with "knowingly searching" and pointed explicitly to his searches having no connection to the CVCD torrent file as evidence of "knowing receipt." See, e.g. , id. at 107:13-108:23 ("Let's look at what knowing looks like for a second; [and after pointing to and going through in detail the undated BitMon search unrelated to the "top 100 link" or the Known Images] That's what 'knowing' looks like. 14 pages of search results is knowing."); see also id. at 107:1-6 ("Defense counsel makes a valiant attempt to argue that this defendant didn't knowingly search for child pornography, didn't knowingly distribute child pornography. They made an attempt to argue that this defendant simply searches for adult porn and other things. Clicks magnet links and downloads hundreds of files all at the same time."). Summing up, the Government told the jury:

Let's talk about receipt. In today's internet-based world receipt basically just means download. This defendant received and attempted to receive child pornography over and over and over and over. He admitted this during his interview when he stated that he searched regularly for teen porn. He admitted that he searched for preteen pornography....The forensics show that he did in fact search for child pornography, that he did in fact download child pornography. In legal terms that means he received child pornography. You saw the file systems events log, the FSE log, showing this downloading. Specifically showing the downloading of the dot-CVCD torrent with those six images contained in it. And you saw the images themselves recovered from his computer. This is not a complicated case.

Id. at 97:2-22.¹⁶

Second, and particularly in light of the dismissal of the possession charge, the *827jury was not adequately instructed as to the difference between the receipt and possession or the scienter requirement. The jury was instructed that the Government must prove beyond a reasonable doubt that the Defendant "knowingly distributed or attempted to distribute" and "knowingly received" child pornography and that "the defendant knew both that the production of the visual depiction involved the use of a minor engaging in sexually explicit conduct, and that it portrayed a minor engaged in that conduct." See Instructions 23 and 26 [Doc. No. 43-3]. It was also instructed on the meaning of "knowing."¹⁷ While these instructions are an accurate statement of the law with respect to those elements, they do not adequately explain for the purposes of this case that a defendant must have actual knowledge of the content of the images (as determined from all the circumstances) at the time of receipt , as distinguished from the offense of possession, wherein a defendant can be found guilty if he merely knowingly retained the images. See Myers , 355 F.3d at 1042. Given all the forensic evidence and the Government's explanation to the jury as far as the significance of that evidence, a juror could easily have thought that proof of Defendant's possession alone, together with his search histories, was sufficient for conviction without a finding that he actually knew the contents of the images at the time of receipt or distribution.

Third, the testimony concerning the "cleaning" software should have been excluded. The Government's Notice of Intent to Offer Expert Testi[m]o[n]y, [Doc. No. 32] did not disclose its intent to offer such testimony and the opinions offered were not sufficiently supported so as to comply with either Fed. R. Evid. 703 or Daubert v. Merrell Dow Pharm., Inc. , 509 U.S. 579, 113 S.Ct. 2786, 125 L.Ed.2d 469 (1993). That problem was again compounded by the Government's closing argument when it told the jury that "the parts of a computer that log what images and videos have been viewed by a user were clean" and that they were "wiped" by the cleaning software. See 10/17/2017 Tr 109:6-8. However, even accepting Storey's testimony *828that he would have expected to find more data than he did and that he suspected that files were "deleted" or "cleaned," a jury could do nothing but totally speculate as to whether any "cleaning" software eliminated any forensic information that pertained to whether Dillingham knew that he would download the Known Images either in June or July.

For all the above reasons, the interests of justice require a new trial, should the judgment of acquittal be reversed or vacated on appeal.

CONCLUSION

For the foregoing reasons, the Motion will be GRANTED and a judgment of acquittal will be entered as to Count I for distribution of child pornography and Count II for receipt of child pornography. The Court will also conditionally grant Dillingham's motion for a new trial as to both counts, should the judgment of acquittal be reversed on appeal.

An appropriate order will follow.

1 Immediately following the verdict, the Court, upon the Government's motion, revoked Dillingham's pre-trial release on bond and ordered him detained pursuant to the mandatory detention provisions of 18 U.S.C. 3143(a).

2 As reflected in the statute, in order convict Dillingham of distribution of child pornography, the government was obligated to present evidence from which a jury could determine beyond a reasonable doubt each of the following elements: (1) the Defendant knowingly distributed a visual depiction; (2) the production of which involved using a minor engaged in sexually explicit conduct; (3) the visual depiction is of a minor engaged in sexually explicit conduct; (4) the Defendant knew that the visual depiction involved the use of a minor engaging in sexually explicit conduct; and (5) the distribution involved any means or facility of interstate or foreign commerce. In order to convict Dillingham of receipt of child pornography, the Government was likewise obligated to prove the following elements beyond a reasonable doubt: (1) the Defendant knowingly received a visual depiction; (2) the production of which involved using a minor engaged in sexually explicit conduct; (3) the visual depiction is of a minor engaged in sexually explicit conduct; (4) that the Defendant knew that the visual depiction involved the use of a minor engaging in sexually explicit conduct; and (5) that the receipt involved any means or facility of interstate or foreign commerce.

3 The Government explained at trial that the terms "known image" or "known series" are used to refer to "a file that law enforcement has previously encountered and reviewed and believed to be related to the sexual exploitation of children." [Doc. No. 62] ("10/16/2017 Tr") 28:3-5.

4 Unlike other statutes, Section 2252 does not define "knowingly." See, e.g. , False Claims Act, 31 U.S.C. § 3729(b)(1) (defining "knowing" and "knowingly" under the False Claims Act). In New York v. Ferber , 458 U.S. 747, 765, 102 S.Ct. 3348, 73 L.Ed.2d 1113 (1982), the U.S. Supreme Court concluded that in the absence of an explicit mens rea requirement, a mental state of at least "recklessness' was constitutionally required for conviction under child pornography laws. See also Osborne v. Ohio , 495 U.S. 103, 115, 110 S.Ct. 1691, 109 L.Ed.2d 98 (1990) (holding that a state statute outlawing reckless receipt of child pornography "plainly satisfies the requirement laid down in Ferber ...."). That decision, however, has no application to a statute, such as 18 U.S.C. § 2252, which states an explicit state of mind necessary for conviction. See United States v. X-Citement Video, Inc. , 513 U.S. 64, 68, 115 S.Ct. 464, 130 L.Ed.2d 372 (1994) (holding that "knowingly" in § 2252 applies to each element of the offense); See also United States v. Gendron , 18 F.3d 955, 959 (1st Cir. 1994) (Breyer, J.) (observing that the Congressional sponsor of Section 2252 intended "knowingly" to mean "actual knowledge")

5 For the sake of simplicity, the Court in this Memorandum Opinion uses the terms "upload" and "download" from the perspective of a user of Dillingham's computer; e.g., when the FBI "downloaded" the Known Images to its own system, the images were "uploaded" from Dillingham's computer. See discussion of knowledge infra pp. 822-23.

6 On his direct examination, Dillingham testified that he was the only person who had access to the computer in question. [Doc. No. 63] ("10/17/2017 Tr") 41:17.

7 Several circuits have accepted such a theory to impose liability for knowing distribution under § 2252(a)(2). These circuits have consistently held that (1) distribution does not have to be "active" and a defendant can distribute without affirmatively publishing or distributing the material; and (2) to prevail on a passive distribution theory, the Government must show that the Defendant knew that his passive behavior would make child pornography available to others.⁷See United States v. Budziak , 697 F.3d 1105, 1109 (9th Cir. 2012) ("[T]he evidence is sufficient to support a conviction for distribution under 18 U.S.C. § 2252(a)(2) when it shows that the defendant maintained child pornography in a shared folder, knew that doing so would allow others to download it , and another person actually downloaded it.") (emphasis added); United States v. Chiaradio , 684 F.3d 265, 282 (1st Cir. 2012) ("When an individual consciously makes files available for others to take and those files are in fact taken, distribution has occurred.") (emphasis added); United States v. Collins , 642 F.3d 654, 656-57 (8th Cir. 2011) (upholding conviction where the defendant "acknowledges that using a file-sharing program is some evidence of knowing distribution," and that "the jury could properly infer that he downloaded and installed the [file-sharing] program on two computers."); United States v. Shaffer , 472 F.3d 1219, 1224 (10th Cir. 2007) (Gorsuch, J.) ("Indeed, [the defendant] admitted that he had downloaded child pornography from other users' Kazaa shared folders and understood that file sharing was the very purpose of Kazaa."). The Fourth Circuit has only addressed "passive" distribution with respect to the first point, that "distribution" does not require an affirmative act. See United States v. Stitz , 877 F.3d 533, 538 (4th Cir. 2017). The Court did not have occasion to address the scienter question in that case, because the defendant repeatedly admitted at trial the he knew that his child pornography files were being shared. Courts have also concluded that even where a defendant does not understand the file-sharing software sufficiently to disable its automatic sharing function, he still possesses sufficient scienter under § 2252 where he nonetheless understands that by his actions he is making child pornography available to others over the internet. United States v. McVey , 476 F.Supp.2d 560, 563 n.4 (E.D. Va. 2007).

8 Exhibit 520A includes entries dated as early as October 2015, however, there are no entries in any exhibit between October 2015 and July 2016 and, as explained below, there is no evidence connecting these October 2015 entries to the files Agent Stein accessed in June 2016.

9 The Government attempted to impeach this testimony by referring to a remark by Dillingham to Agent Stein where he stated that it came through "a lot," however that statement was not within the excerpts the Government offered into evidence in its case in chief and the Government did not move it into evidence for the purposes of impeachment. Id. at 53:15-23. Accordingly, the only admissible evidence in the record indicates that Dillingham would receive child pornography as part of his bulk downloading only "two or three times."

10 During the FBI search of his home, the following exchange took place:

Q: That's the folder, uTorrent that they can also-people can upload from you because it's a-uTorrent's a file-sharing-

A: Yeah, yeah.

Q:-service, right?

[Q]: As you're downloading, people can upload form you, correct?

A: Well, yeah, if you allow that to happen. I usually download, I don't upload anything.

Q: No, I'm not saying you, like, proactively upload, but people-like, it's a file-sharing network, uTorrent, so, like, when you're downloading the files that you find on uTorrent, you're actually getting them from other users.

A: Yeah, yeah, yeah, yeah.

Q: Right?

A: You're right.

Q: Then they can get the files that you have as well, correct?

A: Yeah.

Ex. 106A 44:4-45:1 (emphasis added).

11 There was no evidence that the CVCD torrent file was the source of the Known Images on Dillingham's computer in June 2016 and therefore that Dillingham could associate the otherwise non-descript file name "CVCD" with child pornography. The fact that the same torrent was on the computer in June and July does not imply that they came from the same torrent file with the same filename; torrent files for the same image sets can have different filenames. See infra n.12.

12 Exhibit 517A also references a torrent file called "www.bitmon.com-Nude_-.torrent," which Storey identified as identical in content to the CVCD torrent file. However, like all the entries in Exhibit 517A, these entries only show the fact that the file existed on the system at that time, not where the file came from or what, if any, action Dillingham took to download that file.

13 Exhibit 518A contains two sources of Safari internet history: the browsing history and the favicon history. The browsing history is the history a user would be most familiar with and could easily access-or delete. Unlike the browsing history, the favicon history did not contain date and time information for the entries. The undated BitMon searches appeared in the favicon history portion of Exhibit 518A.

14 In its pre-trial disclosure of Storey's expert testimony to be presented at trial, the Government did not mention any testimony pertaining this "cleaning" software. See Notice of Intent to Use Expert Testimony [Doc. No. 32].

16 The Government also overstated in this summation the evidence concerning how often Dillingham discovered that child pornography had been downloaded through his bulk downloads. Specifically, the Government argued that Dillingham "admitted that he saw child pornography of children as young as eight in response to using the search term 'preteen' and that that came through quite a lot." See 10/17/2017 Tr 97:10-12. But the admitted evidence showed only that when defendant was asked to admit that he had received child pornography in his bulk downloads "a lot," defendant testified, without impeachment, that there had been only two or three occasions when that happened, which he also characterized as "rare." See id. at 46:5-7 & 53:12-54:3.

17 Instruction No. 26 stated:

An act is done knowingly when it is done voluntarily and intentionally and not because of accident, mistake, or some other innocent reason.

In this case, the term, "knowingly," refers to an awareness of the sexually explicit nature of the material, and to the knowledge that the visual depictions were in fact of actual minors engaged in that sexually explicit conduct.

The Government must show that the defendant had knowledge of the general nature of the contents of the material. The defendant need not have specific knowledge as to the identity or actual age of the underage performer, but the defendant must have knowledge or an awareness that the material contained a visual depiction of a minor engaging in sexually explicit conduct. Such knowledge may be shown by direct or circumstantial evidence or both. Eyewitness testimony of the defendant's viewing of the material is not necessary to prove his awareness of its contents. The circumstances may warrant an inference that he was aware of what the material depicts. Furthermore, the defendant's belief as to the legality or illegality of the material is irrelevant.