State v. Darnstaedt
| Decision Date | 19 February 2021 |
| Docket Number | No. 20180922-CA,20180922-CA |
| Citation | 483 P.3d 71 |
| Parties | STATE of Utah, Appellee, v. George DARNSTAEDT, Appellant. |
| Court | Utah Court of Appeals |
Emily Adams and Freyja Johnson, Salt Lake City, Attorneys for Appellant
Sean D. Reyes and Jeffrey D. Mann, Salt Lake City, Attorneys for Appellee
1
Opinion
¶1 A jury convicted George Darnstaedt of twelve counts of sexual exploitation of a minor for knowingly possessing child pornography discovered during a search of his home computer. He appeals those convictions, contending they were based on insufficient evidence and that his trial counsel was constitutionally ineffective for making a generic directed verdict motion rather than pointing to specific deficiencies in the evidence. Darnstaedt also argues his counsel was ineffective for not ensuring that the jury was properly instructed on various elements of the offense and for not objecting to alleged prosecutorial misconduct during closing arguments. We reject those arguments and affirm Darnstaedt's convictions.
¶2 On June 17, 2013, a Utah law enforcement officer accessed Ares, a peer-to-peer file sharing network, to look for users illegally sharing child pornography. One particular IP address offered to share ninety-two files with hash values associated with known images of child exploitation. The officer downloaded one file and confirmed that it was indeed child pornography.
¶3 Through an administrative subpoena issued to the internet service provider, the officer identified the residence using the IP address at the time of the connection. Further investigation revealed that Darnstaedt lived at that address with his wife and two young daughters. Police also determined that the wireless networks at the house were locked so that no one outside the house could have gained access to the internet using that IP address without a password. Based on this information, police obtained a warrant to search Darnstaedt's house for evidence of child pornography.
¶4 Police executed the search warrant on July 11, 2013. When an officer explained to Darnstaedt that the search was part of an investigation into child pornography being distributed from the residence, Darnstaedt appeared shocked and repeated "the word ‘distributed’ with a little exclamation on the end, meaning like a question." During the search, the officers seized a desktop computer from a bedroom that had been converted into a home office space.
¶5 A forensic examination of the computer revealed fifty-five items that appeared to depict "underage individuals in fully nude, nude, or explicit-type pictures." The investigator noted it was unsurprising that the forensic team found fewer illicit files on the computer than the IP address had offered to share through the peer-to-peer network because some users "consume the pornography and then delete it immediately afterward" rather than "hoard[ing]" it.
¶6 The State ultimately charged Darnstaedt with twelve counts of sexual exploitation of a minor under Utah Code section 76-5b-201(1)(a). Each count was based on a specific file found on the computer's hard drive. The files contained graphic photographs and videos displaying the genitalia of prepubescent females and prepubescent females being raped and sodomized by adult males.
¶7 At trial, the State presented evidence explaining where each of the twelve files was found on the hard drive. Eight of the files were in the "recycle bin," indicating that a user purposefully downloaded then deleted them. A forensic examiner explained that when a user downloads a file, the data that makes up that file is saved on the hard drive and the operating system logs its location in a master file table. If a user later deletes the file, the file appears in the recycle bin. But the data is not erased from the hard drive, and the operating system still tracks where the data is stored. As a result, the file remains accessible to the user as "an active file," and the user can easily recover it from the recycle bin.
¶8 Three of the files were located in "unallocated space," indicating that they "had to have existed as ... active file[s] at some point in time," after which a user had either deleted them and then removed them from the recycle bin or had used a shortcut key to bypass the recycle bin and permanently delete them directly to the unallocated space. To move a file to the unallocated space, a user would generally "drag and drop [the file] into the recycle bin and then go into the recycle bin and hit ‘empty [recycle] bin.’ " When the user empties the recycle bin, the file's data remains on the hard drive, but the operating system no longer tracks its location, and it allows that unallocated space to be used for storing new information. The old data remains in the unallocated space until it is overwritten. Until that happens, the data can be recovered with specialized forensic software. Although a file in unallocated space is "generally inaccessible" to the user, "[i]t was once an active file that the user was able to see" and "went through the process of deletion."
¶9 The last file of the twelve files that led to the charges was in the temporary internet cache of Darnstaedt's computer. A defense expert explained that temporary internet files are automatically saved to the computer's hard drive to speed up internet browsing when a user visits a website. While the "user simply sees the interface" of the web browser, the "computer's doing all the communication" from "behind the scenes." Although the temporary internet cache saves files automatically, they are "considered active files" accessible to the user, unlike files in unallocated space.
¶10 Temporary files in an internet cache as well as data in unallocated space can be erased using specialized software, such as CCleaner. Although legitimate users can use CCleaner "for general computer maintenance" and "to free up space" to improve computer performance, forensic examiners often see such data-erasing programs in child pornography cases.
¶11 Investigators found that CCleaner had been installed on Darnstaedt's computer, along with Ares, the peer-to-peer network used for downloading and sharing files. To download files from other computers on the Ares network, a user would have to deliberately search for files and choose to download them to a designated folder. They would not download directly to the recycle bin.
¶12 Investigators also recovered the registry of files on Darnstaedt's computer that were recently viewed or opened. The list included "a considerable amount of files" that contained "key words that are consistent with files of child pornography." The case agent testified that people seeking child pornography use those key words—such as the acronym "PTHC" for "preteen hard core"—"as search terms when searching for files like this through the peer-to-peer network." For a file to appear on the registry list, a user would have to open the file after it was downloaded to the computer. Alongside the file names related to child pornography, the registry listed recently opened files such as "George's iPhone pics" and "George Darnstaedt vacation November 2011."
¶13 The State presented evidence that the computer was used almost exclusively by Darnstaedt. Darnstaedt's wife2 testified that she "very rarely" used the computer and had entirely "stopped going into the [home] office" sometime before the police executed the search warrant. In contrast, Darnstaedt spent most of his time "in his office at his desk at the computer." During the two months before the search, including the time when the IP address associated with the house offered to share child pornography, Darnstaedt was unemployed and at home alone while his wife worked most of the day away from home and commuted nearly an hour each way. When his wife was home, Darnstaedt spent at least three to four hours a day at the computer on weekdays and even more time over the weekends.
¶14 Three user profiles had been created on the computer. Darnstaedt's wife testified that he originally set up a separate user profile for himself under his nickname "Jersey" and one for her under her nickname "Froggy," but that he regularly used her Froggy profile. The computer contained a third user profile named "Camie," which was associated with the file saved in the temporary internet cache, but there was no direct evidence explaining why this profile had been created or who used it. No one named Camie lived in the household.3
¶15 Investigators found that someone had logged into the Froggy profile over 3,000 times and that it was the only profile on the computer connected to the Ares peer-to-peer file sharing network. The only occupants of the house were Darnstaedt, his wife, and their two young children, ages five and three years old. Darnstaedt's wife testified that she had never heard of Ares and had no idea how to use it. She further testified that she had never downloaded child pornography and had no "interest in seeing pictures or videos of children being raped."
¶16 Darnstaedt was the only other adult in the home. Although they did have an occasional housekeeper, teenage babysitter, or visiting family member or friend, the wife did not recall "anyone going into the office to use the computer" and testified that she never gave any of the passwords for the computer to any friends or visitors. She could not remember a time when any visitor would have had access to the computer or been alone for extended periods of time in the office.
¶17 The jury convicted Darnstaedt of all twelve counts of sexual exploitation of a minor. He now appeals.
¶18 Darnstaedt first challenges the sufficiency of the evidence to support his convictions. When reviewing a preserved sufficiency of the evidence claim, we ask "simply whether the jury's verdict is reasonable in light of all of...
To continue reading
Request your trial
-
State v. Holsomback
...whether the defendant was deprived of the effective assistance of counsel as a matter of law." State v. Darnstaedt , 2021 UT App 19, ¶ 19, 483 P.3d 71 (cleaned up). And "the plain error standard of review requires an appellant to show the existence of a harmful error that should have been o......
-
State v. Nunez
...because we identify no error throughout our analysis, we do not reach this argument. See State v. Darnstaedt , 2021 UT App 19, ¶ 19 n.4, 483 P.3d 71.5 Nunez also contends that the court erred in admitting any part of Kiara's CJC interview. But we agree with the State that any error was actu......
-
State v. Eddington
...challenge that must be raised in the trial court and preserved for appeal. See State v. Darnstaedt, 2021 UT App 19, ¶ 21, 483 P.3d 71 ("To preserve an issue for appeal, a defendant lodge a timely and specific objection in the district court." (quotation simplified)), cert. denied, 496 P.3d ......
-
State v. Naranjo
...It is simply whether the inference adopted by the jury was sustainable."); accord State v. Darnstaedt, 2021 UT App 19, ¶ 35 n.6, 483 P.3d 71, denied, 496 P.3d 716 (Utah 2021). ¶45 In sum, we conclude that "some evidence" existed for the jury to find beyond a reasonable doubt that Naranjo fa......