In the
United States Court of Appeals For the Seventh Circuit
____________________
Nos. 24-1581 & 24-1582 UNITED STATES OF AMERICA, Plaintiff-Appellee,
v.
EDWARD C. BROWN, Defendant-Appellant.
____________________
Appeals from the United States District Court for the Central District of Illinois.
Nos. 2:15-cr-20008 & 2:23-cr-20033 — Colin S. Bruce, Judge.
____________________
ARGUED JANUARY 14, 2025 — DECIDED MAY 5, 2025
____________________
Before RIPPLE, BRENNAN, and KOLAR, Circuit Judges. KOLAR, Circuit Judge. Edward C. Brown was convicted of distribution and possession of child pornography. After his prison sentence elapsed, Brown entered supervised release. During an unannounced visit to Brown’s apartment, a probation officer discovered and seized an unreported cell phone. A forensic search revealed that the phone contained 75 thumbnail images of child pornography in an inaccessible 2 Nos. 24-1581 & 24-1582
cache folder. Brown was charged with possession of child pornography, and a jury convicted him.
On appeal, Brown challenges the sufficiency of the evidence . He highlights deficiencies in the forensic digital evidence , including that the 75 thumbnail images lacked metadata, and argues that there is insufficient basis for a jury to find that he knowingly possessed child pornography. We affirm Brown’s conviction.
I. Background
In 2015, Brown pleaded guilty to distribution and possession of child pornography in violation of 18 U.S.C. §2252A(a)(2)(A), (b)(1) and 18 U.S.C. §2252A(a)(5)(B), (b)(2). In June 2022, Brown transferred out of prison to a halfway house, and in December 2022, he began supervised release. As part of his terms of supervised release, Brown agreed to let probation make unannounced visits to his apartment. Probation also only allowed Brown to have one cell phone and required him to report that single device.
Probation officers visited Brown’s apartment unannounced on April 13, 2023. They observed a Consumer Cellular Link II cell phone that Brown had not reported. They seized the cell phone and sent it off for a forensic search.
The forensic data extraction revealed that the cell phone’s cache contained 75 thumbnail images of child pornography. The images were not accessible through the cell phone’s normal user interface. And the images contained no metadata indicating when they were created, accessed, or modified.
Brown was arrested, and a federal grand jury returned an indictment charging him with one count of possessing child
Nos. 24-1581 & 24-1582 3
pornography on or about April 13, 2023, in violation of 18 U.S.C. §2252A(a)(5)(B), (b)(2). Brown pleaded not guilty.
In the run-up to trial, the district court granted the government ’s motion to admit Brown’s prior child pornography convictions as propensity evidence under Federal Rule of Evidence 414 and to prove knowledge under Federal Rule of Evidence 404(b). It also held that Brown’s supervised release status was admissible as evidence.
At the three-day trial, the jury heard testimony from three government witnesses and two defense witnesses. The government ’s first witness, probation officer Michael Bice, testi- fied to his supervision of Brown and his discovery of the cell phone. Bice explained that he informed Brown that he could only use one cell phone, which must be registered with probation . Brown told Bice he used a Gabb-brand phone, an internet -restricted phone often “recommended for persons under supervision that have a sex offense conviction.” Bice also acknowledged that the one-phone restriction was set by probation and not contained in the court’s conditions of supervised release.
Bice recounted the April 2023 visit to Brown’s apartment, where he seized the Consumer Cellular Link II cell phone that Brown had not reported to probation. Bice noted that like the Gabb phone that Brown reported, the Cellular Link II cell phone could not connect to the internet. He also observed that the cell phone was powered on when he first saw it because it rang while it was in the evidence locker.
Next, the government called Jim Kerner, an Urbana, Illinois police detective assigned to the Department of Homeland Security. Kerner explained that he arrested Brown on 4 Nos. 24-1581 & 24-1582
May 17, 2023, and conducted a search of Brown’s apartment that failed to uncover anything of evidentiary value.
Kerner additionally testified that he interviewed Brown in custody, and the government played clips from the interview. In those videos, Brown recognized that although the unreported phone was not internet accessible, it could receive images , audio, and video through a Bluetooth connection. Brown said that he had paid someone to put music and music videos on the phone but denied ever asking anyone to place child pornography images on the phone. Brown stated that he was “not a dummy” and “pretty computer savvy.” He predicted that any child pornography found on the phone must be inaccessible to a regular user and stored in “shadow memory.”
The government also played a portion of the interview where upon prompting from Kerner, Brown agreed that he had an interest in “petite women” and “younger, petite girls.” Brown would not admit that he liked “young” individuals because he said he was concerned that “young” was not a “safe word” for him to use. In response to Kerner’s questioning, Brown insisted he had never touched any children and never produced child pornography. Yet, he eventually answered “yes” when Kerner asked Brown if the whole matter was about the fact that Brown liked to “look at a few pictures every now and then.”
The third and final government witness was Kurt Bendoraitis , an FBI special agent assigned to child exploitation cases. Bendoraitis testified to his experience in digital extraction and forensic analysis of electronic devices. Based on the extracted data, Bendoraitis concluded that Brown was the primary user of the unreported phone.
Nos. 24-1581 & 24-1582 5
Bendoraitis further testified that he found approximately 75 thumbnail images of “clear and obvious minors engaged in sex acts with adults or lascivious displays of their genitals” located in the same cache file location on the phone. 1 Each thumbnail meant the corresponding full image had been viewed on the phone at some point. Five of the thumbnails were briefly shown to the jury.
In addition to the cached thumbnails, Bendoraitis identi-
fied a separate database that contained artifacts of files once associated with the device. Those artifacts included titles of file images that were suggestive of child pornography, including words like “tiny,” “little,” and “teen,” although the actual images (including the thumbnails) were no longer accessible. The data indicated that one such file was viewed or transferred to the phone on November 27, 2022 at 6:34 a.m. Whoever interacted with that file then scrolled through a series of approximately ten images, pausing for as long as eight minutes on an image. Bendoraitis conceded that he could not link the file names to specific pictures and could not say with certainty that the files were child pornography.
The defense’s first witness was Robert Benesiewicz, a special agent with the Department of Homeland Security. Benesiewicz reiterated the deficiencies in the data, including the lack of evidence on when the 75 thumbnail images were created, accessed, or deleted. He agreed it was “very unusual” for there to be no data associated with the pictures.
1 The parties stipulated to the accuracy of the data extraction, that cell
phones are a means, facility, or instrumentality of interstate commerce, and that the thumbnail images were child pornography involving minors under the age of twelve.
6 Nos. 24-1581 & 24-1582
The second and final defense witness was Scott Bokal, who operated a digital forensics business. Bokal explained that he had been provided with the data extraction from the phone, and like Bendoraitis and Benesiewicz, did not find any metadata associated with the images or any evidence that Brown interacted with them.
Bokal observed that the data showed the phone was first turned on in March 2020, with one other date of activity on July 5, 2021, when a user account named “Me” was created. Bokal confirmed an earlier statement from Bendoraitis that several devices, including a Samsung TV and a Gabb phone, were paired with the phone via Bluetooth on that same day. The next activity was June 30, 2022, when the phone acquired a cellular network connection and shortly thereafter “normal cell phone usage” began.
Brown’s closing argument emphasized the missing metadata and relied on Bendoraitis and Bokal’s testimony as an alternative explanation for how the child pornography thumbnails ended up on the phone: someone else viewed the images in July 2021 when Brown was still incarcerated. The government pointed to Brown’s previous child pornography offenses, his recorded interview statements and his concealment of the phone from probation, calling on the jurors to use their “common sense.”
The jury convicted Brown. Brown filed a motion for acquittal under Federal Rule of Criminal Procedure 29 or, alternatively , a new trial under Federal Rule of Criminal Procedure 33. The district court denied the motion. It recognized a lack of direct evidence that Brown interacted with child pornography images, but found there was sufficient circumstantial evidence to support the jury’s verdict. Specifically, it
Nos. 24-1581 & 24-1582 7
highlighted Brown’s prior convictions, interview admissions, and his decision not to report the phone.
The district court sentenced Brown to 78 months’ imprisonment and a 15-year term of supervised release. At the same hearing, the district court also revoked Brown’s supervised release from his prior convictions, sentencing him to 6 months’ imprisonment consecutive to the 78 months, and a 10-year term of supervised release to run concurrently with the 15 years.
Brown now appeals the denial of his motion for acquittal, although not the denial of his alternative motion for a new trial.
II. Analysis
Brown contends that the evidence was insufficient to support his conviction, focusing solely on whether he “knowingly possessed” child pornography images on his cell phone. 18 U.S.C. §2252A(a)(5)(B). We disagree with Brown. No single piece of evidence is a smoking gun, but the entire case presented to the jury was sufficient to support the verdict. Despite the flaws in the extracted data, the combination of the 75 thumbnail images and the November 2022 activity suggests that Brown used the Cellular Link phone to look at child pornography . That interpretation of the evidence grows stronger from other facts introduced at trial: Brown’s prior convictions, his apparent admission of continued interest in child pornography , his technological knowledge, and his failure to tell probation about the phone.
Our review here is deferential. “De novo review applies to the denial of a motion for judgment of acquittal; practically speaking, however, the standard of review is that for 8 Nos. 24-1581 & 24-1582
sufficiency of the evidence.” United States v. Peterson, 823 F.3d 1113, 1120 (7th Cir. 2016). “[W]e review the evidence presented at trial in the light most favorable to the government and draw all reasonable inferences in its favor.” United States v. Hidalgo-Sanchez, 29 F.4th 915, 924 (7th Cir. 2022) (quoting United States v. Anderson, 988 F.3d 420, 424 (7th Cir. 2021)). We do not reassess witness credibility nor reweigh the evidence. United States v. Farmer, 38 F.4th 591, 602 (7th Cir. 2022). Ultimately , we overturn a conviction “only where no rational jury could have found the defendant guilty beyond a reasonable doubt.” United States v. Conley, 875 F.3d 391, 397 (7th Cir. 2017).
A. Brown’s “Possession” of Images Before we evaluate the evidence, we must confront a threshold question: what, exactly, was Brown convicted of possessing? The 75 cached thumbnail images only existed because the original full-size images were also at one point on the phone, but at a basic technical level, the thumbnails are not the same files.
Under 18 U.S.C. §2252A(a)(5)(B), an individual commits a crime when he “knowingly possesses, or knowingly accesses with intent to view, any book, magazine, periodical, film, videotape , computer disk, or any other material that contains an image of child pornography....” The indictment charged simply that Brown “knowingly possessed” images of child pornography “[o]n or about April 13, 2023.” Portions of the government’s argument at trial, as well as its briefing on appeal , imply that Brown was prosecuted for knowing possession of the 75 thumbnail images.
Nos. 24-1581 & 24-1582 9
If that is the theory of the case, we have concerns. Recall that the images were found in the cache of a flip phone. Based on the testimony elicited at trial, neither Brown nor any other person interacting with the phone’s user interface would have been able to access the thumbnail images or see that the thumbnails were on the phone. Law enforcement only discovered the thumbnails with forensic extraction software. There is evidence that Brown was aware of the general principle that deleted images can remain in a cache folder—which he referred to as “shadow memory”—but no evidence that Brown was using the cache folder as a hiding place.
Without evidence that Brown could access the images, or knew he could obtain the means of access, we cannot say he was in “possession” of the images on April 13, 2023. That conclusion follows from our prior statements in this area. In United States v. Seiver, we said that if a defendant who possessed child pornography “deleted the incriminating files” such that the files were not accessible through a device’s user interface, he no longer knowingly possessed those files if he “could no longer access them because he lacked the software that he would have needed to be able to recover them from the hard drive’s slack space.” 692 F.3d 774, 778 (7th Cir. 2012). To be sure, this language is dicta: Seiver was not a challenge to the sufficiency of the evidence supporting a conviction for possession of child pornography. Instead, it held that because forensic evidence of child pornography tends to persist even after a user has deleted the images, a warrant to search a computer that was reasonably believed to contain child pornography seven months beforehand was supported by probable cause. Id. at 776–78. But we see no reason to question Sevier’s logic.
10 Nos. 24-1581 & 24-1582
Indeed, as Seiver observed, several of our sister circuits have reached the same conclusion. The Tenth Circuit has explained that the “ordinary, everyday meaning” definition of “possession” requires an individual to have “control” over a “material or immaterial” item. United States v. Tucker, 305 F.3d 1193, 1204 (10th Cir. 2002); see also United States v. Dobbs, 629 F.3d 1199, 1203 (10th Cir. 2011) (overturning conviction for receipt , not possession, of child pornography because the government presented no evidence that the defendant knew of or could access images in his computer’s cache). The Fifth Circuit similarly held that a defendant cannot be convicted for possessing digital images that were “not in plain view” on a computer’s interface and “accessible only to a knowledgeable person using special computer software, [when] there was no circumstantial indicium that established that [the defendant] knew of the images or had the ability to access them.” United States v. Moreland, 665 F.3d 137, 152 (5th Cir. 2011). And the Ninth Circuit has also agreed, overturning a conviction when “[n]o evidence indicated that on or about April 13, 2004, [the defendant] could recover or view any of the charged images in unallocated space or that he even knew of their presence there” and the government conceded “it presented no evidence that [the defendant] had the forensic software required to see or access the files.” United States v. Flyer, 633 F.3d 911, 920 (9th Cir. 2011).
We think the prevailing approach to possession is sound, but we emphasize that the existence of inaccessible child pornography images on a device can be strong evidence of previous possession of child pornography. See Seiver, 695 F.3d at 775 (“Even if he had deleted the child pornography, a successful recovery of the images from his hard drive by an FBI computer forensic expert would establish that he had possessed
Nos. 24-1581 & 24-1582 11
them at one time, well within the five-year statute of limitations .”); see also United States v. Huyck, 849 F.3d 432, 443 (8th Cir. 2017) (“[T]hough the ninety-five thumbnail images on the Hitachi hard drive were not viewable without special software , they nonetheless constituted evidence of prior possession of child pornography.”). In addition, we understand technology is constantly progressing, and we advise that nothing in this opinion should be taken to question the conviction of a defendant who used technical proficiency to hide images of child pornography. The inquiry into whether a defendant had possession over an image is fact-specific.
That brings us back to Brown. Although we cannot say that there is sufficient evidence that Brown knowingly possessed child pornography on April 13, 2023, Brown conceded that the thumbnails are derivative of identical full-size images , proving the Cellular Link phone contained accessible child pornography at some point.
Importantly, the government did not need to show that Brown knowingly possessed child pornography on the exact date of April 13, 2023. “Where the indictment alleges that an offense allegedly occurred ‘on or about’ a certain date, the defendant is deemed to be on notice that the charge is not limited to a specific date.” United States v. Leibowitz, 857 F.2d 373, 379 (7th Cir. 1988). The jury instructions here accurately reflected that the “government must prove that the crime happened reasonably close to the date. The government is not required to prove that the crime happened on the exact date.” Plus, the indictment and jury instructions did not refer specifically to the thumbnail images, instead charging Brown more generally with possession of “material, being photographs, containing images of child pornography....” Brown’s “defense 12 Nos. 24-1581 & 24-1582
counsel affirmatively approve[d]” the jury instructions in this case, so he “waives his right to challenge them on appeal.” United States v. Bell, 28 F.4th 757, 763 (7th Cir. 2022).
So, we are able to view the thumbnails as evidence of the charged offense. The thumbnails were a way for the government to talk about and establish Brown’s knowing possession of the original child pornography images, even though those images disappeared from the cell phone before April 13, 2023.
Having said that, we have delineated limits on the variance between the date charged in an indictment and the evidence presented, depending on the offense and whether the delay was prejudicial to the defendant. See United States v. Ross, 412 F.3d 771, 774 (7th Cir. 2005). For instance, with felonin -possession firearm charges, “a few weeks of variance is allowable ” but eight and nine month variances between the evidence and the date alleged in the indictment are generally impermissible. United States v. Musgraves, 831 F.3d 454, 466– 67 (7th Cir. 2016). In this case, while the maximum variance is an admittedly long nine and a half months (starting from Brown’s release and acquisition of the Cellular Link phone in June 2022), we see no prejudice because the probative value of the evidence had little to do with the timing of events within that window. Even if the jury believed it was convicting Brown for possessing the thumbnails on April 13, 2023, it could have only reached that conclusion if it also believed Brown possessed the original images at an earlier time. Brown knew what he was accused of, and his theory of defense accordingly relied on the proposition that the thumbnails were a vestige of activity from before he took possession of the phone. The trial was about the government’s burden to prove
Nos. 24-1581 & 24-1582 13
otherwise. Our job now is to assess whether the government did enough to meet that burden.
B. The Evidence Supports Brown’s Conviction We start by saying, once again, that the forensic evidence of the 75 cached thumbnails is far from conclusive. Standing alone, that data establishes only that Brown owned a phone that was used to view child pornography at an unknown point in time. Compare the facts here to United States v. Chaparro , where “[f]orensic analysis of the smartphone showed that a user performed searches for terms related to child pornography on the morning of November 24, 2014” and uncovered that “[t]he smartphone had saved to its memory thumbnail versions of child pornography images that a user viewed that morning.” 956 F.3d 462, 471 (7th Cir. 2020). There was powerful evidence that the defendant was the same user: officers seized the smartphone from him eight days later, and a text sent on November 24, 2014 identified the defendant as the sender. Id. at 471–72. The data-based case against Brown is different—and weaker. With no timestamp information for the creation of the 75 thumbnails, the government cannot prove Brown’s knowing possession of child pornography by reference to his close-in-time activity on the phone. 2 Still, the forensic data may not reveal when the 75 thumbnails (and therefore the original images) were created, but it
2 Brown argues a jury cannot infer a defendant’s knowledge solely
based on evidence that a device containing child pornography was in his exclusive possession. We have not spoken on that issue and we have no occasion to do so here. The government did not rely on an exclusive possession theory and asked the jury to infer Brown’s knowledge from the totality of the evidence.
14 Nos. 24-1581 & 24-1582
does tell us that in November 2022, the user of the phone interacted with about 10 images with file names indicative of child pornography.3 Although we cannot know the content of those files with certainty, our suspicion from the names is bolstered by the fact that the files were located on a device that was indisputably used to store other images of child pornography .
If the November 2022 files were likely child pornography —which would have been a reasonable way for the jury to view the evidence—the forensic data is much more incriminating . There is no evidence that anyone other than Brown was using the phone at the time. It would stretch the government ’s case too far to argue that the November 2022 files could be “knowing possession” of child pornography that sustains Brown’s conviction. But when it appears plausible that Brown viewed child pornography on the phone at least once, it becomes more probable that he was also responsible for the 75 images captured as thumbnails.
That leads, naturally, to Brown’s prior convictions. Federal Rule of Evidence 414 “constitutes an exception to the rule that evidence of prior bad acts is not admissible to show a defendant ’s propensity to commit the offense charged.” United States v. Loughry, 660 F.3d 965, 969 (7th Cir. 2011); see also United States v. Foley, 740 F.3d 1079, 1087 (7th Cir. 2014) (stating that Rule 414 applies to possession of child pornography).
Said differently, “it is not improper to draw the inference that the defendant committed this sexual offense because he has a propensity to do so.” Loughry, 660 F.3d at 969 (quoting United States v. Rogers, 587 F.3d 816, 822 (7th Cir. 2009)).
3 For example, “little-teen-accidental-flash.jpg.”
Nos. 24-1581 & 24-1582 15
Nevertheless, evidence admitted under Rule 414 is not a shortcut to defeat a sufficiency challenge. Just as a jury may not convict because “it is appalled by a prior crime the defendant committed rather than persuaded that he committed the crime charged,” Rogers, 587 F.3d at 822, our appellate review must be a safeguard against that possibility. We must consider exactly how a prior offense logically supports a defendant ’s guilt.
Here, Brown’s “criminal history is proof of his long-standing sexual interest in children, and a reasonable trier of fact could find that it establishes motive beyond any reasonable doubt.” United States v. Niggemann, 881 F.3d 976, 981 (7th Cir. 2018). It shows not only his desires but also that he prefers to act upon them through viewing child pornography. Cf. United States v. Sebolt, 460 F.3d 910, 917 (7th Cir. 2006) (“The motive to molest children does not completely overlap with the propensity to possess, transport, or advertise child pornography .”). It would usually be a shock to find out that any given person was charged with possessing child pornography. We cannot say the same for Brown.
Beyond Rule 414, the jury saw evidence—portions of Brown’s recorded interview with Kerner—that Brown’s predilection toward possessing child pornography persisted after his prior convictions and release from incarceration. Depending on how the listener interprets Brown’s responses to Kerner, Brown may have outright admitted that he continued to enjoy looking at child pornography. An alternative interpretation is that Brown was merely acknowledging his past offenses or got tripped up by Kerner’s questions. Either way, Brown was focused on whether it was “safe” for him to admit what he was attracted to. Brown also explained his familiarity 16 Nos. 24-1581 & 24-1582
with technology, including an awareness that the Bluetooth transfers that put music onto the phone could have been used to transfer child pornography onto the phone, and he speculated how the phone’s storage might have retained unviewable thumbnails from previously accessed child pornography. Under our obligation to construe Brown’s statements in the manner most favorable to the government, this evidence amplifies the other signals that Brown had both a motive and means of committing the charged offense.
Finally, and especially considering the forensic data and Brown’s sexual proclivities, it is difficult to devise an innocuous explanation for why Brown did not disclose the Cellular Link phone to probation. 4 The jury saw Brown’s statement that he thought he was okay to have multiple phones if only one was in service. Putting aside the evidence that the Cellular Link phone was in service, because it rang after it was seized, Bice testified that probation is clear with supervisees that the one phone rule applies regardless of service. Brown only told probation about his Gabb phone, so despite Brown’s contention that the Cellular Link phone was in open view in his apartment, a reasonable jury could infer that he was trying to hide it from probation. And why would Brown hide it? He used the Cellular Link phone to listen to music and watch music videos, but there is no evidence that he was unable to do that on the Gabb phone too. The inference is both obvious and incriminating.
4 Brown correctly says that the conditions of supervised release set by
the district court did not limit him to one phone, but he does not argue probation lacked authority to impose that restriction.
Nos. 24-1581 & 24-1582 17
In response to the many signs of guilt, Brown put forward a defense theory that the thumbnails were already on the Cellular Link phone when he acquired it. Yes, the forensic data showed Bluetooth activity on the Cellular Link phone on one occasion while Brown was incarcerated, and yes, as Brown’s closing noted, the Cellular Link phone was the type of noninternet capable device that a sex offender might use. In isolation , it is not impossible that Brown was unlucky enough to take possession of a phone that someone else once used to look at child pornography. 5 Yet when one remembers that Brown owned the phone surreptitiously and very likely used it to look at pornography that at the very least played to his admitted ongoing sexual interest in young individuals, that scenario becomes very unlikely. The government held the burden of proof, but Brown’s attempt at offering his own version of events was weak.
Taken as a whole, the evidence that Brown knowingly possessed child pornography was significant. The shortfalls in the forensic data were addressed by the circumstantial evidence of Brown’s proclivities and behavior. 6 See Chaparro, 956 F.3d at 469 (looking at the “circumstantial evidence that
5 During his interview with Kerner, Brown wondered out loud whether the person he paid to put music on the phone also put child pornography on it. Brown’s closing argument addressed this possibility only in passing and primarily relied on the previous-user theory. In any event, there is no evidence that such a mysterious transfer was responsible for the existence of the thumbnails.
6 The district court allowed the government to introduce Brown’s su-
pervised release as evidence; Brown does not challenge that decision on appeal. We note that although Brown’s release status provided context for his restricted phone usage and the search of his apartment, it is not itself evidence of guilt.
18 Nos. 24-1581 & 24-1582
[defendant] was the user” of a hard drive containing child pornography); see also United States v. Memar, 906 F.3d 652, 656 (7th Cir. 2018) (“[T]here is nothing wrong with circumstantial evidence of guilt.”). Thus, the jury had a sufficient basis to find Brown guilty beyond a reasonable doubt.
One last issue. Brown argued that if we reverse his conviction , we should also overturn the revocation of his supervised release because the district court relied on Brown’s conviction as the sole basis for revocation. See, e.g., United States v. Fleming , 9 F.3d 1253, 1255 (7th Cir. 1993) (“[W]hen the probationer has been convicted of the offense, there is sufficient evidence to meet the lower revocation standard.”). We uphold his conviction , so the argument is moot.
III. Conclusion
For these reasons, we AFFIRM the judgment of the district court.