U.S. v. Romm

Citation455 F.3d 990
Decision Date24 July 2006
Docket NumberNo. 04-10648.,04-10648.
PartiesUNITED STATES of America, Plaintiff-Appellee, v. Stuart ROMM, Defendant-Appellant.
CourtUnited States Courts of Appeals. United States Court of Appeals (9th Circuit)

Jason F. Carr, Las Vegas, NV, for appellant Stuart Romm.

Nancy J. Koppe (briefed) and Daniel R. Schiess (argued), Las Vegas, NV, for appellee United States of America.

Appeal from the United States District Court for the District of Nevada Philip M. Pro, District Judge, Presiding. D.C. No. CR-04-00216-PMP(PAL).

Before: B. FLETCHER, THOMPSON, and BEA, Circuit Judges.

BEA, Circuit Judge:

We are called upon to decide whether, absent a search warrant or probable cause, the contents of a laptop computer may be searched at an international border and, if so, what evidence is sufficient to convict its owner of receiving and possessing child pornography. We also address an error in the jury instructions on the mental state required for knowingly possessing child pornography.

Defendant Stuart Romm connected to the internet from a Las Vegas hotel room and visited websites containing images of child pornography. As Romm viewed the images online and enlarged them on his screen, his computer automatically saved copies of the images to his "internet cache."1 Based on 40 images deleted from his internet cache and two images deleted from another part of his hard drive,2 Romm was convicted of knowingly receiving and knowingly possessing child pornography in violation of 18 U.S.C. §§ 2252A(a)(2), (a)(5)(B). Romm appeals both of these convictions, as well as his concurrent mandatory minimum sentences of ten and fifteen years.

First, Romm claims the evidence of his crime should have been suppressed as the fruits of an unlawful border search. Second, he challenges the sufficiency of the evidence supporting each of his convictions, arguing he cannot be found guilty of possessing or receiving child pornography, when he merely viewed child pornography without "downloading"3 any of it to his hard drive. Third, he claims the refusal of his proffered jury instruction on the statutory definition of a "visual depiction" deprived him of the right to present a defense. Fourth, he argues that the omission of an element from the jury instructions on "knowing possession" and the district court's refusal to supplement the instructions in response to a note from the jury together constitute reversible plain error. Fifth, he challenges the enhancement of his sentences based on prior convictions for predicate offenses.

We have jurisdiction pursuant to 28 U.S.C. § 1291, and for the reasons stated herein, affirm Romm's convictions, but vacate his sentences and remand to the district court for resentencing.

BACKGROUND

From January 23, 2004 to February 1, 2004, Romm attended a training seminar held by his new employer in Las Vegas, Nevada. When the training seminar ended on February 1, 2004, Romm flew from Las Vegas, Nevada to Kelowna, British Columbia on business.

At the British Columbia airport, Canada's Border Services Agency discovered that Romm had a criminal history and stopped him for questioning. Romm admitted he had a criminal record4 and was currently on probation. Agent Keith Brown then asked Romm to turn on his laptop and briefly examined it. When Brown saw several child pornography websites in Romm's "internet history,"5 Brown asked Romm if he had violated the terms of his probation by visiting these websites. Romm answered "Yes," and also said, "That's it. My life's over."

Meanwhile, Canada's immigration service had decided not to admit Romm into the country. Romm withdrew his application for entry and was placed under detention until the next flight to Seattle. Agent Brown then informed U.S. Customs in Seattle that Romm had been denied entry and possibly had illegal images on his computer. On February 2, 2004, Romm returned to Seattle. At the Seattle-Tacoma airport, Romm was interviewed by Agents Macho and Swenson of Immigration and Customs Enforcement ("ICE").6 The agents told Romm they needed to search his laptop for illegal images, and could arrange for the examination to be completed that night. Romm agreed. He told the agents he had been in sole possession of the laptop for the previous six to eight weeks. He also told the agents he had "drifted" away from his "therapy," and experienced "occasional lapses" during which he would view child pornography. But Romm repeatedly denied having any child pornography on his laptop.

ICE conducted a preliminary forensic analysis of the hard drive in Romm's laptop. When the preliminary analysis revealed ten images of child pornography, Agent Macho confronted Romm with this information and asked Romm why he had lied about having images on his computer. Romm looked down, adopted a "confessional mode," made little eye contact with his interrogators, and said that "he knew[the agents] were gonna find something on the computer." He also stated the agents had every right to arrest him and would probably do so.

Romm then described to the agents how he used Google7 to search for child pornography websites. When he found pictures he liked, Romm would keep them on his screen for five minutes and then delete them. Romm used the terms "save" and "download" to describe this operation. While staying in his hotel room in Las Vegas, Romm viewed child pornography and masturbated twice, while or shortly after viewing the child pornography; he claimed to have then deleted such images. In all, Romm used the internet for approximately six-and-a-half hours during his week-long stay in Las Vegas.

Results of the Forensic Analysis

At trial, the government called three witnesses to testify about the forensic analysis of the hard drive in Romm's laptop. First, Agent Camille Sugrue described the preliminary analysis that she conducted with software called "EnCase." With EnCase, it is possible to recover deleted files,8 as well as information showing when the files were created, accessed, or modified. In conducting the preliminary analysis, Sugrue found ten images of child pornography. All of the images she found had been deleted from Romm's hard drive.

Second, Detective Timothy Luckie testified to the results of the full forensic analysis of Romm's hard drive. Luckie confirmed that all of the child pornography on Romm's computer had been deleted. The vast majority of the images Luckie found had been deleted from Romm's internet cache. EnCase did not reveal when the files had been deleted. Luckie's analysis also showed that Romm had enlarged a few smaller "thumbnail"9 images in the internet cache.

Luckie next explained how files in the internet cache are deleted. First, on the default setting, the web browser automatically empties the internet cache when it reaches a given size. Second, the user can instruct the browser to empty the internet cache. Third, users who know where the internet cache is located can go into the cache and manually delete the files, rather than effect the deletions automatically through the web browser's default setting. EnCase did not reveal the settings on Romm's web browser, or how his internet cache had been emptied. Luckie opined "through experience and training," however, that Romm either had instructed his browser to empty the cache or had deleted the files manually. Luckie also noted Romm had erased his internet history at 2:25 p.m. on February 2, 2004, the same afternoon that Canada's Border Services Agency placed Romm on a flight back to Seattle.

Finally, Luckie testified that files in the internet cache are accessible, albeit "system-protected." A user who knows how to find the internet cache can view the images stored there. Once the user views the image, the user "can print, rename, [or] save [it] elsewhere, the same thing you can do with any other file."

The government's third expert witness, Darryl Cosme, exhibited to the jury 42 images of child pornography recovered from Romm's hard drive. He told the jury the provenance of some images, when each image was saved to the cache, and whether that image was a thumbnail or a full-sized picture. Cosme identified several websites in the internet history as related to child pornography.

Romm's expert witness, Thomas Keller, testified how the internet cache is "system-protected." According to Keller, "system-protection" blocks any user from accessing the cache, except by means of "system-commands." If, however, the user executes a system-command notwithstanding the computer's warning, he can copy the cached image to another location on the hard drive or view the image by copying it into an open program. Keller also testified that people delete their internet history and internet cache for legitimate reasons. Finally, Keller testified he found no evidence Romm ever went into the internet cache, or accessed the files there.

Before trial, Romm moved to suppress the evidence obtained through the border search of his laptop and moved to force the government to elect between multiplicitous counts. The court orally denied both motions. After a four-day trial, the jury deliberated for six hours and found Romm guilty of both possessing and receiving child pornography. At sentencing, the court found Romm had committed a predicate offense under 18 U.S.C. § 2252A(b), and accordingly imposed concurrent mandatory minimum sentences of ten and fifteen years. Romm then filed a timely notice of appeal.

ANALYSIS
I. BORDER SEARCH

First, we address whether the forensic analysis of Romm's laptop falls under the border search exception to the warrant requirement. We review the legality of a border search de novo. United States v. Okafor, 285 F.3d 842, 845 (9th Cir.2002). Under the border search exception, the government may conduct routine searches of persons entering the United States without probable cause, reasonable suspicion, or a warrant. See United...

To continue reading

Request your trial
231 cases
  • In re Sony Gaming Networks & Customer Data Sec. Breach Litig., MDL No.11md2258 AJB (MDD)
    • United States
    • U.S. District Court — Southern District of California
    • January 21, 2014
    ...because Sony's motion to dismiss did not present this contention the argument is not properly before the Court. See United States v. Romm, 455 F.3d 990, 997 (9th Cir. 2006). 30. Neither party addressed the Court's tentative ruling at oral argument, which stated that the implied warranty cla......
  • U.S. v. Guzman-Padilla
    • United States
    • United States Courts of Appeals. United States Court of Appeals (9th Circuit)
    • July 23, 2009
    ...I. SEARCHES AND SEIZURES AT THE BORDER A. General Principles The legality of a border search is reviewed de novo. United States v. Romm, 455 F.3d 990, 996 (9th Cir.2006). The border search doctrine is a partial exception to the Fourth Amendment's limitations on searches and seizures. United......
  • United States v. Saboonchi
    • United States
    • U.S. District Court — District of Maryland
    • April 7, 2014
    ...in United States v. Romm, the Ninth Circuit upheld a forensic search of a laptop computer at the border without probable cause, 455 F.3d 990, 1006 (9th Cir.2006), but the only issue raised on that appeal was whether the search in question was a border search; the defendant had waived any ar......
  • U.S. v. Falso
    • United States
    • United States Courts of Appeals. United States Court of Appeals (2nd Circuit)
    • September 25, 2008
    ...on by the district court to give weight to the prior conviction in its probable cause calculus. 1. See, e.g., United States v. Romm, 455 F.3d 990, 998-1001 (9th Cir.2006) (upholding conviction for receipt and possession of child pornography recovered from defendant's computer cache where de......
  • Request a trial to view additional results

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT