State v. Ritchie

• Decision Date: 06 January 2011
• Docket Number: S057705).,(CC CR0401509; CA A129591; SC S057701 (Control)
• Citation: 248 P.3d 405,349 Or. 572
• Parties: STATE of Oregon, Petitioner on Review/Cross–Respondent on Review,v.Gregg Bryant RITCHIE, Respondent on Review/Cross–Petitioner on Review.
• Court: Oregon Supreme Court

349 Or. 572

248 P.3d 405

STATE of Oregon, Petitioner on Review/Cross–Respondent on Review,

v.Gregg Bryant RITCHIE, Respondent on Review/Cross–Petitioner on Review.

(CC CR0401509; CA A129591; SC S057701 (Control)

S057705).

Supreme Court of Oregon.

Argued and Submitted Sept. 14, 2010.Decided Jan. 6, 2011.

On review from the Court of Appeals.^*Ryan Kahn, Assistant Attorney General, Salem, argued the cause and filed the briefs for petitioner on review/cross-respondent on review. With him on the briefs were John R. Kroger, Attorney General, David B. Thompson, Interim Solicitor General, and Erika L. Hadlock, Senior Assistant Attorney General.Kendra M. Matthews, Ransom Blackman LLP, Portland, argued the cause and filed the briefs for respondent on review/cross-petitioner on review. With her on the briefs was Marc D. Blackman.Before DE MUNIZ, C.J., and DURHAM, BALMER, KISTLER, WALTERS, and LINDER, JJ., and GILLETTE, J. pro tempore.^**GILLETTE, J. pro tempore.

This case is a companion to State v. Barger, 349 Or. 553, 247 P.3d 309 (2011) (decided this date). Like the defendant in Barger, defendant was convicted of multiple (in defendant's case, 20) counts of Encouraging Child Abuse in the Second Degree, ORS 163.686, based on the presence of sexually explicit digital images of children on the hard drives of his computers. Defendant appealed, arguing, among other things, that the state had failed to prove that he “possesse[d] or control[led]” any of the images within the meaning of the Encouraging Child Abuse statute,¹ and that it also had failed to prove venue with respect to some of the charges. The Court of Appeals rejected defendant's argument with respect to the “possess [ion] or control[ ]” element of the charges, but agreed that the state had failed to prove venue with respect to 10 of the counts—Counts 11 through 20. The court therefore reversed defendant's convictions on Counts 11 through 20 and otherwise affirmed. State v. Ritchie, 228 Or.App. 412, 423, 208 P.3d 981 (2009). Defendant and the state both petitioned for review by this court and we allowed both petitions. On review, we hold that, in view of the disposition that we make today, we need not—and do not—decide whether the evidence presented by the state was sufficient to allow a rational trier of fact to conclude that the conduct at issue occurred in the county where defendant was tried. Rather, we hold that the evidence presented by the state was insufficient to allow a rational trier of fact to conclude that defendant “possesse[d] or control[led]” any of the images at issue (including those associated with the counts for which venue was an issue), within the meaning of the relevant section of ORS 163.686.²

In September 2004, while defendant was working as a music teacher in an elementary school in Clackamas County, officers from the Clackamas County Sheriff's Department went to the school to interview him about a report involving a former student. In the course of the interview, defendant consented to a forensic examination of both his laptop computer, which he had with him at the school, and his desktop computer, which he kept in his home. Defendant turned over his laptop to the officers on the spot and gave the officers permission to enter his home and take the desktop computer.³

A police computer specialist, White, examined the desktop computer and discovered 600 pornographic images, most of which were of children, in unallocated space ⁴ on the computer's hard drive. White repeated the procedure with the laptop and found about 500 pornographic images, again primarily of children, in unallocated space in that computer's hard drive. Virtually all of the images that White discovered were accessible only by means of special data recovery software that forensics experts like White used, but that was not commonly used by ordinary computer users.

The state subsequently charged defendant in Clackamas County Circuit Court with 20 counts of Encouraging Child Sexual Abuse in the Second Degree by “possess[ing] and control[ling] a photograph of sexually explicit conduct involving a child.” Counts 1 through 10 were based on 10 sexually explicit digital images of young boys that had been recovered from unallocated space on the desktop computer's hard drive, and Counts 11 through 20 were based on 10 similar digital images that had been recovered from unallocated space on the laptop's hard drive.

[248 P.3d 407 , 349 Or. 577]

Defendant waived his right to a jury trial and the case was tried to the court. The state's primary witness was White. White described his examination of defendant's laptop and desktop computers and his discovery of the images that formed the basis of the charges in “unallocated space” in the computers' hard drives. He explained that “unallocated” space “is basically clusters on the hard drive that may or may not have information written to them. If there's information written there, it is * * * a file that was deleted.” White then described the process by which deleted files are retained in unallocated space—that, when a “file” ⁵ is created, the operating system “allocates” the file to a certain location in the hard drive, that a master file table keeps track of that location, and that, when a file is deleted, the data in the file remains in the physical location that originally was allocated, but the master file table is altered to indicate that that location now is “unallocated,” i.e., available to be overwritten by new files. Finally, White explained that, although files in unallocated space generally are not available to a user through ordinary means, they can be recovered with special forensic software like the software that he had used.

White then went on to describe some of the characteristics of the images that he had discovered on the two hard drives, and how he was able to tell that certain of the images had been sent to defendant's computer by another user while others may have come to the computer from ordinary Internet sites. At some point, the parties announced that they would stipulate that four of the images—those associated with Counts 1, 2, 3, and 4—had been sent to defendant's desktop computer in a “zipped folder” ⁶ through an Internet chat room by another chat room user, “rasputinlives978,” and that, when the folder reached defendant's desktop computer, the folder was unzipped in some manner, so that the images within were available for viewing. The parties were not willing to stipulate as to whether the unzipping was an intentional act by defendant or an automatic function of the chat room program. White could not determine whether anyone had ever used defendant's desktop computer to view the images in that folder. (That was important because, as noted elsewhere, the state's theory of the case was that defendant had possessed or controlled the digital images in Counts 1 through 4 by displaying them on a computer screen.)

White then testified to some additional matters that were relevant to the parties' “chat room” stipulation. He testified that the folder at issue was sent to defendant's desktop computer at 9:24 p.m. on July 7, 2002, and was deleted by midnight of the same day. He also testified that, to receive a zipped folder offered by another Internet chat room user, a computer user generally must affirmatively accept the folder or file. White also produced data collected from defendant's desktop showing that, in September 2002, defendant's laptop had received a file entitled “youngyoungboys.mpg” by instant messaging in an apparent swap for another file entitled “13suckbrother.jpg.” Finally, White produced fragments of online “chat” found in unallocated space on defendant's desktop computer, which suggested that defendant had solicited and received child pornography from other chat room users. In one of those fragments, someone using one of defendant's acknowledged screen names appeared to be responding favorably to material that a user had shared with him (“I'm taking off my clothes for this one”). In another fragment, a person using one of defendant's screen names appeared to be inquiring about how to obtain videos (“u have videos?”) that had been mentioned.

The parties also announced that they had entered into a stipulation concerning the digital images taken from the desktop computer that corresponded to Counts 5 through 10 and the images taken from the laptop computer that corresponded to Counts 11 through 20. Specifically, they stipulated that all those digital images were the product of “web browsing,” i.e., searching the Internet. White also provided technological background evidence that was relevant to that stipulation. He explained how files accessed through web browsing might end up in unallocated space: that, when a computer user accesses a web page, the browser creates a copy of the page and stores it in a temporary Internet file cache; that the next time the user calls up the same web page, the browser pulls up the copy from the temporary Internet file cache, rather than accessing and downloading the same information from the web page; that files held in the temporary Internet file cache may be deleted from the cache in a number of ways, some of which occur automatically and some of which require intentional action by a computer user; and that files that are deleted from the temporary Internet file cache remain in unallocated space unless and until they are overwritten by a new file.

In his testimony, White acknowledged that there was no way of knowing, with respect to any of the files associated with Counts 5 through 20, whether the files had been deleted from the temporary Internet file cache intentionally or by some automatic process. He suggested, however, that the temporary Internet file cache appeared to have been emptied or cleaned more thoroughly and more often than would have occurred by purely automatic processes.

Because of the limitations of his forensic software,...