United States v. Russell Hudson Cullen

• Court: Court of Appeals for the Eleventh Circuit
• Decided: November 21, 2019
• Docket: 17-14913
• Status: Unpublished

Opinion

Case: 17-14913 Date Filed: 11/21/2019 Page: 1 of 11

[DO NOT PUBLISH]

IN THE UNITED STATES COURT OF APPEALS

FOR THE ELEVENTH CIRCUIT ________________________

No. 17-14913 ________________________

D.C. Docket No. 4:16-cr-10043-KMM-1

UNITED STATES OF AMERICA,

Plaintiff–Appellee,

versus

RUSSELL HUDSON CULLEN,

Defendant–Appellant.

________________________

Appeal from the United States District Court for the Southern District of Florida ________________________

(November 21, 2019) Case: 17-14913 Date Filed: 11/21/2019 Page: 2 of 11

Before MARTIN, TJOFLAT, and PARKER, * Circuit Judges.

PER CURIAM:

Appellant Russell Hudson Cullen appeals from a judgment of conviction in

the United States District Court for the Southern District of Florida. We assume

familiarity with the facts, procedural history, and issues on appeal.

BACKGROUND

The Department of Homeland Security (“DHS”) uses the Child Protection

System (“CPS”) investigative software to search the internet for computers that

contain child pornography. CPS uses keywords associated with child pornography,

searches the internet, and downloads files that it finds. It then keeps a large database

of known child pornography videos’ “hash values,” which are unique indicators

associated with each individual video. According to expert testimony at trial, CPS

identified hundreds of hash values corresponding to child pornography that had been

downloaded through Shareaza—a peer-to-peer sharing software—to multiple IP

addresses associated with Cullen. Some of these files had been downloaded

completely while others had been downloaded only partially. In January 2016,

Special Agent Elliott Graves requested an image of child pornography from Cullen’s

IP address and the associated computer automatically sent him the file. In March

* Honorable Barrington D. Parker, United States Circuit Judge for the Second Circuit, sitting by designation. 2 Case: 17-14913 Date Filed: 11/21/2019 Page: 3 of 11

2016, DHS obtained a warrant and searched Cullen’s residence. The agents

retrieved an Asus laptop computer and a LaCie external hard drive.

When the Cyber Crimes Center extracted the contents of the LaCie hard drive,

they found various documents bearing Cullen’s name as well as child

pornography—specifically a video of two young girls displaying their genitalia. The

video had been found in “unallocated space” in the hard drive, which means that it

had been previously deleted. Special Agent Daniel Kenney was able to play the

recovered video and, at trial, two screenshots from the video were introduced into

evidence. A forensic analyst determined that the Asus laptop had been reformatted

multiple times, relegating certain files to unallocated space on the laptop. From this

space, Lumbert retrieved four images depicting child pornography. Lumbert found

an additional 14 images in a “cache file” that had been created after a thumb drive

was inserted into the computer to upload files.

Cullen was charged with one count of accessing with intent to view, two

counts of possession, and one count of distribution of child pornography. Cullen

proceeded to and testified at trial. His defense was that he had been addicted to adult

pornography for many years but had never searched for child pornography on any

of his computers. He testified that he would download thousands of video files in

bulk, searching only for adult pornography, and then open them later to sift through

potential options. He admitted that he downloaded and viewed child pornography

3 Case: 17-14913 Date Filed: 11/21/2019 Page: 4 of 11

but explained that he had done so by accident. When that occurred, he would delete

the files, and in instances where the pornography was particularly shocking, he

would immediately reformat his computer to remove any trace of the files from his

computer. Cullen also testified that he had never allowed any type of sharing of

pornography from his computer and that he had “deselected” all files that could be

shared, thus ensuring that none of them were available for download by other

Shareaza users. He testified that he had no idea how agents were able to obtain child

pornography from his computer.

During trial, Agent Kenney identified the LaCie hard drive that was seized

from Cullen’s home, but he noted that the hard drive serial number he recalled

differed from the serial number noted on the Government’s exhibit list. He

nevertheless testified that he “absolutely” recognized it both by the serial number on

the hard drive itself and the external case that accompanied it. The court, over

Cullen’s objection, admitted the hard drive. In February 2017, the jury found Cullen

guilty on all counts.

Probation determined that Cullen’s base offense level was 22. It

recommended a multitude of enhancements, increasing the offense level to 37. In

particular, two levels were added for the knowing distribution of child pornography

and five levels were added because the offense involved 600 or more images of child

pornography. Because Cullen had no criminal history points, his offense level of 37

4 Case: 17-14913 Date Filed: 11/21/2019 Page: 5 of 11

corresponded to a guidelines range of 210 to 262 months. He also faced a mandatory

minimum sentence of five years and an authorized maximum sentence of 80 years.

Cullen argued that he did not knowingly distribute child pornography. He also

argued that only one video (which corresponded to 75 images) and 18 photographs—

93 images in total—were involved in his offense conduct, and thus only a two-level

and not a five-level enhancement was warranted. The District Court rejected both

arguments and sentenced Cullen to 240 months’ imprisonment, adopting the

recommendation of the Probation Office. In addition, the Court stated on the record

that it would have imposed the same sentence had only the two-level and not the

five-level enhancement properly applied.

DISCUSSION

Sufficiency of Evidence

The reversal of a conviction for insufficient evidence is warranted only if no

reasonable jury could find proof of guilt beyond a reasonable doubt. United States

v. Thomas, 8 F.3d 1552, 1556 (11th Cir. 1993).

Possession and Access

The evidence that Cullen possessed and accessed child pornography was

overwhelming. Child pornography was found in unallocated space on his computer

and hard drive and an investigation of Cullen’s computer indicated that a thumb

drive had been used to upload additional pornographic images onto his computer.

5 Case: 17-14913 Date Filed: 11/21/2019 Page: 6 of 11

Further, full and partial downloads of hundreds of child pornography videos and

images were linked to a series of IP addresses all associated with Cullen. We find

this evidence sufficient to support his convictions.

Distribution

In United States v. Carroll, 886 F.3d 1347 (11th Cir. 2018), which involved

peer-to-peer sharing software, a jury convicted the defendant of distributing child

pornography after he had downloaded hundreds of images and videos from a peer-

to-peer sharing platform called Ares. Id. at 1349. Ares functions in the same way

as Shareaza, the peer-to-peer software in this case:

When downloaded, Ares sets up a shared folder on the computer where, by default, it automatically places all subsequent downloads. Once a file is placed in the shared folder, it is immediately available for further dissemination. Unless an Ares user changes the default settings or deliberately moves files out of the shared folder, downloaded files will remain freely accessible to anyone else on the Ares network . . . .

Id. at 1350.

We reversed the conviction in Carroll based on insufficient evidence because

“[n]othing in the record demonstrate[d] that Carroll intended to share files or that he

was even aware that the contents of his Ares folder were automatically distributed

to the peer-to-peer network.” Id. at 1353. We rejected the Government’s argument

that the defendant “was guilty of knowing distribution simply because he was using

a peer-to-peer file sharing program and ‘that is what it is.’” Id. at 1353. We

explained that “the fact that files were automatically shared from [the defendant’s] 6 Case: 17-14913 Date Filed: 11/21/2019 Page: 7 of 11

Ares folder, without some evidence of his awareness of it, cannot carry the

government’s burden to prove knowing distribution beyond a reasonable doubt.” Id.

at 1353–54. The basis of our reasoning was that “Ares, by default, installs a shared

folder, automatically places downloaded files into that folder, and distributes all

contents of the shared folder to anyone else on the Ares network without prompting

the user—even when the user is away from his computer.” Id. at 1354. In response

to the Government’s argument that “it would be impossible for an individual to use

a peer-to-peer file sharing program and lack a full understanding of its operations,”

we noted that it was “unwise to adopt such a sweeping rule in this fact-sensitive

context, where the mechanics of each peer-to-peer program may bear on the issue of

knowledge in different ways.” Id.

Generally, courts should be cautious in their approach to distribution charges

brought in the peer-to-peer software context. Peer-to-peer software runs on the

sharing of downloaded files. If users do not proactively disable all sharing upon

installing the software, their files will be shared indefinitely without their awareness

and even when they have stepped away from their computer. The software also

intentionally makes it difficult for the average user to manage which of their files

are being shared at any given moment, often obscuring instructions for disabling

sharing, as is the case with Shareaza. Given the nature of this software, courts should

7 Case: 17-14913 Date Filed: 11/21/2019 Page: 8 of 11

focus with particular care on whether distribution on peer-to-peer software was done

knowingly.

In this case, however, Carroll does not compel a reversal because Cullen

testified that he understood how Shareaza’s automatic sharing function operated.

Specifically, the Government, in cross-examination, asked Cullen: “You talked

about—I know you have used file-sharing for a long time, and you’ve talked about

when you first used file-sharing devices all that time ago. You learned that when

you set it up you had to deselect folders? Do you remember that?” In response,

Cullen answered, “Absolutely, have to, have to.” Furthermore, without prompting,

Cullen stated: “But always, always, always make sure . . . [to] deselect every

[downloaded file] because if you leave even one up, there are people with software

[who] will be able to access all of your computer. This is what I was told.” Based

on Cullen’s statements evincing an understanding of Shareaza’s automatic sharing

features and the testimony from Graves that he successfully downloaded child

pornography from Cullen’s IP address, we find the evidence sufficient to support

Cullen’s conviction.

Admissibility of LaCie Hard Drive

We review for an abuse of discretion the District Court’s rulings on the

admissibility of evidence. United States v. Shabazz, 887 F.3d 1204, 1216 (11th Cir.

2018). “To satisfy the requirement of authenticating or identifying an item of

8 Case: 17-14913 Date Filed: 11/21/2019 Page: 9 of 11

evidence, the proponent must produce evidence sufficient to support a finding that

the item is what the proponent claims it is.” Fed. R. Evid. 901.

Cullen argues that the testifying witness, Kenney, could not identify the LaCie

hard drive seized during the execution of the search warrant. To be sure, Kenney

noticed that the serial number on the hard drive did not include the last four digits of

the serial number listed on the Government’s exhibit list. Notwithstanding the

confusion as to the serial number, the District Court did not abuse its discretion in

admitting the hard drive. Kenney was able to identify the hard drive by its external

casing and was able to identify most of the digits on the serial number. He also

testified that he was “absolutely” certain that the hard drive offered into evidence

was the same hard drive as was seized from Cullen’s home. Kenney’s identification,

taken together with the evidence that the hard drive contained child pornography

along with Cullen’s tax form, Cullen’s resume, and Cullen’s job application,

demonstrates that the Government produced “evidence sufficient to support a

finding that the item is what the proponent claims it is.” See Fed. R. Evid. 901.

Sentencing Enhancements

“We review a district court’s choice of sentence . . . for abuse of discretion,

determining if the sentence was procedurally in error or substantively unreasonable.

United States v. Trapp, 396 F. App’x 671, 672 (11th Cir. 2010). “When the

government seeks to apply an enhancement under the Sentencing Guidelines over a

9 Case: 17-14913 Date Filed: 11/21/2019 Page: 10 of 11

defendant’s factual objection, it has the burden of introducing ‘sufficient and

reliable’ evidence to prove the necessary facts by a preponderance of the evidence.”

United States v. Washington, 714 F.3d 1358, 1361 (11th Cir. 2013).

Knowing Distribution

The Guidelines authorize a two-level enhancement “if the defendant

knowingly engaged in distribution.” U.S.S.G. § 2G2.2(b)(3)(F). For the reasons

discussed above, the District Court did not abuse its discretion in imposing a two-

level enhancement, given that Cullen admitted to fully understanding Shareaza’s

automatic sharing features.

Number of Images Involved in the Offense

The Guidelines authorize a five-level enhancement if the offense involved

“600 or more images.” U.S.S.G. § 2G2.2(b)(7)(D). In determining the number of

images, “[e]ach video, video-clip, movie, or similar visual depiction shall be

considered to have 75 images.” Id. cmt. app. n. 6(B)(ii).

Cullen argues that his offense involved only the 18 images and one video

recovered from his laptop—a total of 93 images under the Guidelines. Cullen thus

argues that he should have only received a two-level enhancement because his

offense involved “fewer than 150” images. See U.S.S.G. § 2G2.2(b)(7)(A). The

District Court, however, considered 27 videos that were fully downloaded to IP

addresses associated with Cullen as reflected on the CPS database. These 27 videos

10 Case: 17-14913 Date Filed: 11/21/2019 Page: 11 of 11

corresponded to 2,025 images under the Guidelines, but they had never actually been

found on Cullen’s devices. Still, the Government has demonstrated, by a

preponderance of evidence, that these videos were involved in Cullen’s offense.

They were linked to his IP addresses, they matched the hash values for known child

pornography, and they had been fully downloaded into his computer. While they

were not found on the physical devices seized from his home, the District Court

reasonably inferred that Cullen had deleted them, especially given his testimony that

he routinely reformatted his computer. The District Court thus did not abuse its

discretion in imposing the five-level enhancement.

CONCLUSION

We have considered Cullen’s remaining arguments and find them to be

without merit. For the foregoing reasons, the judgment is AFFIRMED.