People v. Lund

• Decision Date: 01 June 2021
• Docket Number: A157205
• Court: California Court of Appeals Court of Appeals
• Parties: The PEOPLE, Plaintiff and Respondent, v. Eric Curtis LUND, Defendant and Appellant.

64 Cal.App.5th 1119

279 Cal.Rptr.3d 697

The PEOPLE, Plaintiff and Respondent,

v.Eric Curtis LUND, Defendant and Appellant.

A157205

Court of Appeal, First District, Division 4, California.

Filed June 1, 2021

Law Offices of Beles & Beles, Robert J. Beles, Oakland, Joseph L. Ryan, for Defendant and Appellant.

Xavier Becerra, Attorney General, Lance E. Winters, Chief Assistant Attorney General, Julie L. Garland, Assistant Attorney General, A. Natasha Cortina, Annie Featherman Fraser, Deputy Attorneys General, for Plaintiff and Respondent.

BROWN, J.

A jury convicted Eric Lund of one count of possession of more than 600 images of child pornography, at least 10 of which involved a prepubescent minor or a minor under 12 years old, in violation of Penal Code section 311.11, subdivision (c)(1). The trial court sentenced Lund to five years in prison.

Lund contends the trial court committed four errors. First, he argues the trial court should have excluded some of the data produced by a computer program because the data was case-specific, testimonial hearsay under People v. Sanchez (2016) 63 Cal.4th 665, 204 Cal.Rptr.3d 102, 374 P.3d 320 ( Sanchez ). Second, he argues the prosecution failed to establish that the computer program was reliable and generally accepted in the scientific community under People v. Kelly (1976) 17 Cal.3d 24, 130 Cal.Rptr. 144, 549 P.2d 1240 ( Kelly ) and Sargon Enterprises, Inc. v. University of Southern California (2012) 55 Cal.4th 747, 149 Cal.Rptr.3d 614, 288 P.3d 1237 ( Sargon ). Third, Lund urges that his conviction should be reversed because the prosecutor committed repeated, pervasive misconduct. Finally, he argues that the trial court abused its discretion under Evidence Code section 352 in allowing the prosecution to play for the jury a number of child pornography videos. We reject each of these arguments and therefore affirm the judgment.

I. BACKGROUND

A. Peer-to-peer networks

Peer-to-peer networks allow sharing of files, including child pornography, over the internet. To access each different peer-to-peer network, users must download and install software that uses the programming protocol specific for that network. eDonkey is one example of a peer-to-peer network commonly used to share and download child pornography. eMule is a program people commonly use to get onto the eDonkey network.

When a user installs peer-to-peer networking software, the software randomly generates a globally unique identifier (GUID), which is used to specifically identify the instance of the software being used. The software also designates a five-digit port number, which is necessary for the software to communicate with the network. When a user sends out a search query, the request goes to one or more other "peer" computers in the network, which in turn propagate the request to other peers, and so on. This process exponentially increases the number of computers effectively receiving the search request. Each peer receiving the query will respond to the original user with a list of files matching the query that the peer has available for download. Despite the exponential spread of a search query, a user's query will not typically reach all other peers on the peer-to-peer network and a user will not see every file from every computer on the network matching the query. When a computer connects to a peer-to-peer network, it will automatically start receiving queries from other users and returning a list of files that the computer has available. Peer-to-peer networks use hash values to identify each file being shared. A hash value is like a DNA signature for a digital file; it is statistically unique and never changes, so it provides a way to authenticate that two digital files are identical, even if the names are different.

B. CPS Software

In August 2014, Vacaville police detective Jeffrey Datzman was investigating child pornography cases over peer-to-peer networks. One of the tools Datzman used was privately-developed software called the Child Protection System (CPS). CPS is the web interface for viewing results from a suite of several software tools that each search for child pornography on a specific peer-to-peer network.¹ It is used around the world in 84 countries by over 10,000 users, all of whom are law enforcement personnel.

The CPS software suite automates the process of searching peer to peer networks. Previously, law enforcement officers would have to manually input keyword search terms to discover computers that were hosting suspected child pornography and then further investigate those GUIDs. By contrast, CPS sends out search terms continuously. CPS also compares the files listed in response to the keyword searches against CPS's database of hash values, which contains the hash values of files that law enforcement officers somewhere in the world have previously tagged as being child pornography. If there is a match between the hash values for the files listed in response to the search and the hash values in the CPS database, CPS logs the details of the event in a CPS database for police officers to follow up on later. CPS logs the filenames and hash numbers of the suspected child pornography files being offered; the GUIDs, IP addresses, port number, and, in most cases, software used to offer the files; and the dates and times CPS detected the GUID with the files. Police officers obtain records from internet service providers to determine the physical location of the computer associated with the GUIDs, IP addresses, and port numbers logged by CPS.

A match between the hash number of a particular file being offered and a hash number in CPS's database suggests the file is likely child pornography. However, because child pornography laws can differ from one jurisdiction to another, CPS users are trained to always view a file personally in order to determine conclusively whether the file constitutes child pornography under applicable law. To assist with this, CPS also helps law enforcement users create their own separate, local databases of hash values called a media library. Where the CPS database contains only hash values and not the child pornography files, law enforcement users’ media libraries contain both the hash values and the corresponding files. Users can use their media libraries when they cannot download a file from the offering computer directly to view it. In such cases, users can compare the hash value of the file being offered to the hash value of a file in the media library and then use the media library file to confirm that the file is child pornography under applicable law.

C. Investigation of target GUID

When Datzman signed on to CPS in August 2014, he noticed that there was one user, identified by a specific GUID, who possessed several suspected child pornography files. Datzman downloaded a few files from the target GUID and confirmed that the files were in fact child pornography under California law. This GUID moved between different IP addresses but kept returning to a few addresses. This was unique, because GUIDs that moved from one IP address to another usually did not return to any of the IP addresses. After analyzing the target GUID's behavior, Datzman noticed that the GUID only showed activity overnight on Wednesday, Thursday, Friday, and Saturday nights. Because law enforcement officers often work overnight shifts four nights a week from Wednesday evening through Sunday morning, Datzman suspected that the target GUID user was a security guard, law enforcement officer, or someone else working such a shift.

Datzman obtained the physical addresses for the IP addresses the target GUID was using. Because the target GUID was active in the middle of the night when the businesses were closed, Datzman did not consider the owners of any of the IP addresses to be suspects. The most frequently recurring IP address in Vacaville belonged to a business called the Yogurt Beach Shack, which was owned by two former law enforcement officers Datzman knew. Datzman confirmed that the Yogurt Beach Shack's wireless internet (wifi) router was "open," meaning it did not require a password, and could be accessed from outside the building. Datzman therefore conducted overnight surveillance at the Yogurt Beach Shack in early October 2014.

During the surveillance, Datzman connected to the Yogurt Beach Shack's router so that he could observe whether any devices connected to the router and see such devices’ "mac ID," which is a unique specific identifier for a device. On one night, at around 1:00 a.m., Datzman saw a device connect to the router, and he recorded the mac ID. Datzman then drove around the outside of the building to see who was nearby that could be using the device. Datzman noticed a California Highway Patrol (CHP) vehicle parked near the business. Lund was the sole occupant of the vehicle, seated in the driver's seat and looking down and to his right at a lighted object. Datzman then contacted Sergeant Jason Johnson in the Vacaville Police Department. Johnson agreed to contact Lund using a ruse to determine his name. The ruse succeeded and Lund told Johnson his name. After Johnson spoke to Lund, Lund drove away, and Datzman noticed that the mac ID of the device that was using the Yogurt Beach Shack router dropped off at the same time. No other devices connected to the router that night. Datzman later checked CPS to see if the target GUID had been detected at the time that Lund was seen at the Yogurt Beach Shack. CPS had no record of it at that IP address at that time, but it detected the GUID at a different router later that night.

Datzman contacted the CHP and learned from Lund's commanding officer that Lund was a sergeant assigned to the Fairfield CHP office, worked alone, and worked a schedule that matched the target GUID's pattern of activity. Lund lived in Chico, and stayed in a hotel in Vacaville during the days he was working.

Every CHP patrol vehicle has a computer with software installed that, when...