Redkovsky v. State

• Decision Date: 27 February 2019
• Docket Number: No. 1478, Sept. Term, 2017,1478, Sept. Term, 2017
• Citation: 203 A.3d 23,240 Md.App. 252
• Parties: Vyacheslav REDKOVSKY v. STATE of Maryland
• Court: Court of Special Appeals of Maryland

240 Md.App. 252

203 A.3d 23

Vyacheslav REDKOVSKY

v.STATE of Maryland

No. 1478, Sept. Term, 2017

Court of Special Appeals of Maryland.

February 27, 2019

Submitted by: Claudia A. Cortese (Paul DeWolfe, Public Defender, on the brief), Baltimore, MD, for Appellant.

Submitted by: Sarah P. Pritzlaff (Brian E. Frosh, Atty. Gen., on the brief), Baltimore, MD, for Appellee.

Panel: Meredith, Berger, Kehoe, JJ.

Berger, J.

A jury in the Circuit Court for Washington County convicted appellant, Vyacheslav Redkovsky, of four counts of distribution of child pornography and four counts of possession of child pornography. As to two of the distribution charges, the trial court sentenced appellant to consecutive ten-year sentences, with all but six years of each sentence suspended, and merged the remaining counts for sentencing purposes. On appeal, appellant challenges the sufficiency of the evidence to sustain his convictions.

We conclude that the evidence was sufficient and affirm the judgments of the trial court.

BACKGROUND

Corporal Roger Schwarb of the Maryland State Police ("MSP") testified that in February of 2016, he was assigned to the MSP division of the Internet Crimes Against Children Task Force ("Task Force"). In connection with his duties on the Task Force, Corporal Schwarb investigated internet child pornography on BitTorrent, a peer-to-peer file-sharing protocol.¹ BitTorrent allows users to download material, while also sharing material from the users' files.

Corporal Schwarb explained the basic process for accessing a peer-to-peer network. First, a user must download a "client," which is a free, publicly-available computer program. uTorrent is a popular client, which allows users to access the BitTorrent network. Corporal Schwarb explained that the client searches for files on the network by using a "torrent," which is similar to a library "indexing card."² A torrent contains text identifying the files associated with that torrent, including the number of files associated with that torrent, the size of the files and their location. The torrent does not contain any files or images; it only contains data with file descriptions. Each torrent is assigned a "hash," which is a specific number, similar to an electronic "thumbprint."³ Once the user downloads a particular torrent, that torrent is saved in the user's client.

Corporal Schwarb explained that, for example, a user who is interested in Lassie movies could search for a torrent using the term "Lassie," and the user will receive a list of torrent files associated with that search term. The BitTorrent client then searches the peer-to-peer network to find the info hashes for files associated with that torrent. If there are "a hundred images of that torrent for Lassie, it will go out, you'll get those hundred images," and "[y]ou've essentially downloaded all the files associated with that torrent."

Corporal Schwarb's state computer used a software program specifically designed to allow law enforcement to operate undercover, searching BitTorrent for child pornography files located in Maryland.⁴ On February 13, 2016, Corporal Schwarb's state computer generated a summary log identifying search results for a specific torrent associated with known child pornography info hashes. Three files associated with that torrent downloaded to the state computer from the IP address "24.170.239.94." Corporal Schwarb explained that the software program allows law enforcement to obtain a "single source download," from only one IP address at a time.⁵ Corporal Schwarb viewed three of the downloaded files: [ (1) "000015.mpg;" (2) "000018.avi" and (3) "000019.avi"], and observed that those files depicted child pornography.

On March 12, 2016, Corporal Schwarb's state computer's activity log identified an additional file, "!(PTHC)Composite01-fatherandhis12yotwinsdaughters-13m19s.avi," which had again downloaded to his computer from the IP address 24.170.239.94 via the BitTorrent network. Corporal Schwarb reviewed the March 12, 2016 video file and observed that it depicted child pornography. Corporal Schwarb copied to a CD the three video files downloaded to his computer on February 13, 2016 and the one video file downloaded on March 12, 2016 from the IP address 24.170.239.94. The four video files contained on the CD were played for the jury and admitted as evidence. The parties stipulated that each of the four video files identified by Corporal Schwarb depicted someone under the age of 15 engaged in sexual conduct.

Corporal Schwarb testified that he researched the IP address 24.170.239.94 on the public website, American Registry for Internet Numbers (ARIN), and learned that the IP address 24.170.239.94 was registered to Antietam Cable. Corporal Schwarb sent a subpoena to Antietam Cable for the subscriber information associated with the IP address 24.170.239.94. Antietam Cable responded that the subscriber to the account for that IP address was Slava Redkovsky located at 1034 Mount Aetna Road, Hagerstown, Maryland.⁶

At 4:50 a.m. on April 6, 2016, Corporal Schwarb assisted members of the Task Force in the execution of a search warrant at 1034 Mount Aetna Road. Corporal Schwarb arrived at the residence and spoke with appellant in the driveway, as appellant prepared to leave for work. Appellant provided his house keys to the Task Force and the Task Force searched the home. Corporal Schwarb observed that there appeared to be only one person living in the house. Corporal Schwarb determined that appellant's WiFi network was secured, as it required a password to access the WiFi network. The Task Force seized a black Toshiba laptop and three hard drives from a custom built, "tricked out" computer tower.

State Trooper First Class Chris Reid of the Task Force interviewed appellant at his residence immediately following the search. The audio-recording of the interview was played for the jury at trial. In the interview, appellant acknowledged to Trooper Reid that he had a password protected wireless internet cable service provided by Antietam Cable. Appellant stated that he had a custom desktop computer, which he built as "a hobby." He also had two laptops: a broken HP laptop, which he was in the process of fixing, and a working Toshiba laptop. Appellant explained that he bought the laptops on eBay "super cheap," and that he had tried to "fix them up." According to appellant, he was the only person who had used the Toshiba laptop.

Appellant described himself as having "maybe a little more than average" knowledge of computers. Appellant stated that he understood a peer-to-peer file-sharing program to be one where "you like upload it to a server or something, and then if it's on a server, somebody else can go on and download it." Appellant stated that he understood that peer-to-peer file sharing involved sharing files with other people. Appellant indicated that he had heard of BitTorrent, but did not think that he had ever used it. Appellant acknowledged that he had used the uTorrent program on his Toshiba laptop and expected that uTorrent was probably still on that laptop.

When asked by Trooper Reid if he ever looked up pornography, appellant responded: "Uh, I can't say that I haven't, but not on a file sharing program." Appellant stated that he typically "would just Google for [pornography]." Appellant indicated to Trooper Reid that he did not expect that the Task Force would find any pornography on his laptop. Trooper Reid asked appellant if the Task Force would find any child pornography on appellant's computer, and he responded, "Gee, I hope not." According to appellant, he "didn't have any of that stuff on [his] computer" and "[didn't] want anything to do with child porn."

Steven Gibson, a computer forensic analyst with the Department of Homeland Security Investigations, testified as an expert in computer forensics and data analysis. Gibson assisted in the execution of the search warrant at 1034 Mount Aetna Road by previewing devices to identify items of evidentiary value. On or about April 13, 2016, Gibson conducted a forensic analysis on multiple devices seized from appellant's residence, including a Toshiba laptop computer. Gibson observed that the peer-to-peer filing-sharing program, uTorrent, was installed on the Toshiba laptop and remained in active use. The most recent recorded logon date for the Toshiba laptop was April 6, 2016. In the course of Gibson's forensic analysis of the Toshiba laptop, he did not find any file names or visual images that matched the March 12, 2016 video provided to him by Corporal Schwarb. Gibson's findings were recorded in a forensic report, and the State introduced that report in evidence.

One year later, on or about April 18, 2017, Gibson conducted a subsequent analysis of the Toshiba laptop using GriFi Analyze, a digital imaging software tool, which had not previously been available to him. Using the four video files provided by Corporal Schwarb, Gibson searched the Toshiba laptop using a "hashset" from the info hashes and the file names, but found no filenames on the Toshiba laptop matching the filenames of the four video files identified by Corporal Schwarb.

In May of 2017, Gibson conducted a visual search of the files on the Toshiba laptop's thumbcache,⁷ which is a hidden folder where users can view thumbnail-size images of their videos. Gibson identified three thumbcache images that matched images from the three video files downloaded on February 13, 2016 by Corporal Schwarb. Gibson took a "screen shot of it for comparison view so [one] can see the exact frame where the thumb cache image is matching to that exact frame of the video." The three "screenshot" images were admitted in evidence at trial.

In the course of his visual file search, Gibson also discovered a complete video file located in the "unallocated" space of the Toshiba laptop, which matched the fourth video downloaded by Corporal Schwarb on March 12, 2016. Gibson explained that the unallocated space is the area...