Stickle v. Commonwealth

• Citation: 68 Va.App. 321,808 S.E.2d 530
• Decision Date: 27 December 2017
• Docket Number: Record No. 0660-16-1
• Parties: Matthew John STICKLE v. COMMONWEALTH of Virginia
• Court: Court of Appeals of Virginia

68 Va.App. 321

808 S.E.2d 530

Matthew John STICKLE

v.COMMONWEALTH of Virginia

Record No. 0660-16-1

Court of Appeals of Virginia, Norfolk.

DECEMBER 27, 2017

Patricia Palmer Nagel, for appellant.

John I. Jones, IV, Assistant Attorney General (Mark R. Herring, Attorney General, on brief), for appellee.

Present: Judges Humphreys, Russell and Senior Judge Bumgardner

OPINION BY JUDGE ROBERT J. HUMPHREYS

Matthew John Stickle ("Stickle") appeals his December 16, 2015 conviction in the Circuit Court of the City of Williamsburg and County of James City (the "circuit court") on three counts of possession of child pornography, first and second or subsequent offenses, and twenty-two counts of possession of child pornography with intent to distribute.

I. Background

"In accordance with established principles of appellate review, we state the facts in the light most favorable to the Commonwealth, the prevailing party in the [circuit] court. We also accord the Commonwealth the benefit of all inferences fairly deducible from the evidence." Muhammad v. Commonwealth, 269 Va. 451, 479, 619 S.E.2d 16, 31 (2005).

So viewed, the evidence shows that on September 3, 2013, Lieutenant Scott Little ("Little"), a district coordinator of the Southern Virginia Internet Crimes Against Children Task Force, took part in an undercover investigation into what is known as peer-to-peer ("P2P") distribution of child pornography over the internet. Little testified regarding his substantive role in the investigation of Stickle and also testified without objection as an expert in the field of digital forensics, in particular "as to the investigation of child exploitation offenses."

Although the record reflects that much of Little's testimony is somewhat technical, the specifics are important to the legal analysis in this case and are essentially as follows:

What is generically referred to as "the internet" is a cooperatively managed global network of smaller interconnected networks. Each internet site, whether such site is hosted on a computer server or a single specific computer, is associated with a unique internet protocol ("IP") address. Likewise, each device accessing the internet, such as computers, tablets, modems, routers, and smart phones, necessarily also is assigned a unique IP address to facilitate two-way communication with other devices and locations on the internet.¹ The most common method of accessing internet sites is through a software application known as a "browser," such as Microsoft's Internet Explorer or Apple's Safari. Browsers can access that portion of the internet known as the Worldwide Web or simply "the web," which is the roughly fifteen percent of the internet sites that have been assigned domain names and indexed by Google and other search engines.² Using a browser to access a site on the Worldwide Web requires that the link be routed through one or more DNS servers located throughout the world that maintain a current database of IP addresses and their associated domain names and direct internet traffic to the appropriate IP address.³

A less common, but nevertheless widely available and frequently used method of reaching a specific IP address is through a direct link that is not relayed through a routing DNS. Using specialized but readily obtainable software designed for the purpose, a direct, encrypted "peer-to-peer" or "P2P" link can be established between a user's computer and a specific folder or file on any linked computer—provided that the owner of the destination computer is using similar P2P software and has allowed specific access to such folder or file location.

In short, P2P networks use locally installed software called a "client" which allows users to share computer files of their choice directly with other similarly equipped users (a "peer") and without any intermediary routing. Files which a user intends to share are kept in a specific folder designated as sharable by the software client. While there is nothing inherently illegal about the use of peer-to-peer file sharing, P2P software is often used to share files in violation of copyright and other intellectual property laws and to facilitate communications regarding various types of criminal activity.⁴ Because P2P locations in the dark web are invisible to indexing and search engines such as Google, specialized software is required to access each separate P2P network.

Little was focusing his investigative attention on the ARES P2P network, which is often used to exchange child pornography. Testifying as an expert, Little explained how peer-to-peer networks are used in the context of the exchange of child pornography.

In a P2P network generally, users place any files they wish to share with others in a specific "shared" folder. P2P clients like ARES globally search all shared folders in the P2P network for any specified files. If found, the client then connects directly to all "peers," i.e. computers with shared folders that host the particular file being sought, and different pieces of the file are then downloaded from multiple peers and reassembled into a new whole copy which is then saved to the user's shared folder.⁵

Specifically, with respect to the use of ARES, Little testified that file source IP addresses are always collected by a P2P client, but in the stock version of ARES, they are not normally displayed to the user. An ARES user enters the name of any file sought into the ARES client. As with other P2P software, ARES then locates multiple IP addresses of computers hosting copies of the requested file, verifies that all copies available are identical to each other, then downloads separate pieces of the file from the many different copies found across the internet, reassembles the pieces into a new copy and, after verifying that the newly assembled copy is identical to the those from which it was assembled, saves the new file copy to the user's computer.

Little used a specialized version of the ARES client designed specifically for law enforcement ("ARES Round Up"). ARES Round Up, has been modified from its stock configuration in two ways. First, ARES Round Up forces the client to download a shared file from a single location instead of doing so piecemeal from multiple locations and then assembling the pieces into a whole copy of the sought-after file. The second law enforcement modification to the ARES client allows law enforcement users to view the actual IP address of the target computer containing the file location of a P2P shared file.

Little input the names of specific child pornographic images encrypted and verified through the Secure Hash Algorithm ("SHA")⁶ and commonly exchanged by those interested in child pornography into ARES Round Up and instructed the ARES Round UP client to search the ARES network for matches. This process allows the verified SHA values to be used to search for identical copies of known files. Little had enabled ARES Round Up to constantly search the P2P network for matches with the SHA values of known child pornography image and video files. One of these SHA values matched to a shared folder location on a computer indicating an IP address within the task force's geographic area.

Little obtained a subpoena and served the internet service provider to obtain the physical address associated with that IP address—the shared home of Stickle and his fiancée Margaret Mallory ("Mallory"). Stickle had been living at this address since moving from New York to live with Mallory in August of 2013. Little obtained a search warrant for this address and executed it on December 27, 2013. Pursuant to the warrant, police seized two laptop computers. Mallory identified one of the laptops as belonging to her, the other she identified as Stickle's. Mallory initially told Little that she had no access to Stickle's device, but later amended her statement to admit she had used Stickle's computer on a few occasions.

Police conducted a forensic analysis on the laptops. Inside a password-protected user account titled "Matt" on Stickle's laptop, police found both images and videos of child pornography and the ARES client, as well as personal and family photos relating to Stickle. The ARES client's shared folder contained an "extensive" library of child and adult pornography. Some files dated back to 2010, three years before the device was seized. Little was also able to forensically retrieve the search history of the ARES client, indicating which types of files the user had been looking to obtain. It included explicit sexual terms referencing children. The in-client ARES chat function on Stickle's computer had been set to indicate to others that the user was a 14-year-old male. In addition, there were three child pornography videos featuring Stickle himself in another folder labelled "X." The X folder was located near other folders which were personally relevant to Stickle, specifically one regarding a relative's baptism. The three video files located in the X folder portrayed Stickle performing sexual acts on a prepubescent eight-to-ten-year-old male.

When interviewed by police, Stickle denied knowledge of any child pornography on his computer and stated that he had had several roommates prior to moving to Virginia to live with Mallory. One of these roommates testified at trial that he had used Stickle's computer when they lived together. He also testified that he had seen another roommate use Stickle's computer. He did not testify that he had used ARES or placed any files on Stickle's computer or seen any other roommate do so.

A grand jury indicted Stickle on twenty-two counts of possession with intent to distribute child pornography, first and second or subsequent offenses, and three counts of manufacture of child pornography, first and second or subsequent offenses. The Commonwealth dropped the manufacture of child pornography charges when it was discovered that the videos had been created in New York, Stickle's residence before he moved to Virginia to...