U.S. v. Winkler

• Citation: 639 F.3d 692
• Decision Date: 25 April 2011
• Docket Number: No. 09–50703.,09–50703.
• Parties: UNITED STATES of America, Plaintiff–Appellee,v.David WINKLER, Defendant–Appellant.
• Court: United States Courts of Appeals. United States Court of Appeals (5th Circuit)

639 F.3d 692

UNITED STATES of America, Plaintiff–Appellee,
v.
David WINKLER, Defendant–Appellant.

No. 09–50703.

United States Court of Appeals, Fifth Circuit.

April 25, 2011.

[639 F.3d 693]

Joseph H. Gay, Jr. and Angela Sandoval Raba (argued), Asst. U.S. Attys., San Antonio, TX, for U.S.Nancy Blair Barohn (argued), San Antonio, TX, for Winkler.Appeal from the United States District Court for the Western District of Texas.Before GARWOOD, ELROD and SOUTHWICK, Circuit Judges.JENNIFER WALKER ELROD, Circuit Judge:

David Winkler appeals from two counts of his four-count conviction for receipt and possession of child pornography, challenging the sufficiency of the evidence supporting his conviction. Primarily, he argues that his conviction for knowing receipt of child pornography cannot stand because it was based on images found only in the temporary storage of his computer hard drive. We now AFFIRM.

I.

Winkler's name came to the attention of law enforcement during two national investigations led by elements of Immigration and Customs Enforcement (ICE) during 2005 and 2006. The first, “Operation Emissary,” was initiated in 2005. That investigation led to the discovery of a child pornography website. In order to access that website, a potential user visited a welcome page that offered samples of child pornography, and unlimited memberships for $79.95 and $90.00 for twenty days and a month respectively. Once a purchase had been made, the user would receive an email from an unrelated address a day later containing a link to the illicit content. Following the link led to a sign-in screen which required a username and password, after which the website warned that its contents were illegal in all countries. Evidence at trial established that after entering

[639 F.3d 694]

the website through those initial screens, a user could access approximately 1,000 images of child pornography, including videos. Having executed a search warrant for the physical internet server hosting the website, ICE agents discovered that the e-mail account of “dcwink @ ktc. com” together with a zip code, city and street address, was transmitted to the website as part of a membership sign-up procedure. Agents then investigated payments made to the website. They found that a credit card belonging to David Winkler was used to make purchases of child pornography on two dates.

“Operation Flicker,” a second ICE investigation initiated in 2006, focused on a specific commercial child pornography service which contained within it links to hundreds of individual child pornography websites. The agent in charge of the investigation accessed the website to confirm that it contained child pornography, and also conducted undercover purchases of access to discover the contents of the various linked sites. In the course of his investigation, the agent determined that someone using a paypal account associated with David Winkler had purchased access to one of those linked sites.

David Winkler's name was then referred to local ICE agents in February 2007. By obtaining credit card records, those agents were able to determine that Winkler's credit card was used for transactions in the same dates and amounts that were discovered in the Operation Emissary and Operation Flicker leads. The credit card records verified those purchases and showed that they were never credited back to the account or disputed. ICE then executed search warrants for Winkler's home and office addresses. As a result of its investigation, ICE seized several computers and hard drives belonging to Winkler. Three of the seized hard drives are relevant to this case: the Quantum Fireball hard drive, the Seagate hard drive and the Maxtor hard drive.

Agent James Beard, a computer forensics agent, conducted a forensic investigation on each of those hard drives. He discovered images and videos of child pornography on all three. Specifically, Beard found 261 images of child pornography on the Quantum hard drive, 26 video files containing child pornography on the Maxtor hard drive, and 261 images and 18 videos containing child pornography on the Seagate hard drive. Many of the files found on the Quantum hard drive were located in the utilities CD–ROM toolkit extras folder, a folder normally dedicated to files related to the Apple CD–ROM toolkit application. As Beard testified, that was not a normal place for the computer to store files downloaded by the user, but rather a special directory reserved for files associated with a specific hardware utility. To save a file there, an individual would have to browse his hard drive's contents and specifically choose that obscure directory. On the Seagate hard drive, most of the child pornography files were contained in the program files directory, in a folder entitled “wait2.” That is also not a default location for user downloaded files. Moreover, Beard discovered a text file in the program files directory entitled “med study list.” Instead of containing a list of medical publications as the file name indicates, however, the file contained links to child pornography sites.

As for the Maxtor hard drive, which contains all the child pornography specifically at issue in this appeal, Beard testified that he found two user accounts. The first was an account named “user”—which Winkler admits was intended for his use—and the second a “staff” account, used by Winkler's office staff. Both accounts were

[639 F.3d 695]

password protected, and the password for the “user” account was the same password Winkler used for his home computer. Beard testified that the “staff” account on the Maxtor hard drive did not contain any child pornography. In his forensic investigation of the “user” account, however, Beard found a total of 26 video files of child pornography.

Five of those video files were located in a temporary internet cache—where internet browser software automatically saved the content of visited websites for the purpose of reducing page-loading time if the user revisits the site—including the only two files alleged in Count One. Evidence elicited by the government showed that those two files had been downloaded from the “members only” section of a child pornography website. Beard further testified that a video file is copied to a temporary internet cache when the user takes an affirmative action such as clicking on the video in order to play it. Thus, Beard explained, a video file differs as a technological matter from a still photo displayed on a web site, which is downloaded automatically to an internet cache when the web page it is displayed on is loaded.

The other 21 illicit videos were stored in various subfolders within the “mydocuments” folder of the Maxtor hard drive. Two of the files listed in Count Five were saved to the “lpack19vi” folder. Beard also discovered a zip file of the same name saved on the Maxtor hard drive. By cracking the password protecting the zip file, he discovered that those two files listed in Count Five had been extracted into the lpack19vi folder from that zip file. The other two video files listed in Count Five were saved to the “lpack20vi” and “lpack21vi” folders respectively. Beard testified that those video files also appeared to have been extracted from zip files of the same name as the directory in which they were saved. Beard testified that all four zip files he discovered on the Maxtor hard drive were downloaded to the Maxtor hard drive in the password protected “user” accounts between 9:49 p.m. and 9:56 p.m. on December 21, 2004.

In the course of his forensic investigation, Beard also checked whether any type of viruses or malware had infected the Maxtor hard drive. He found none. He also found no indication of remote access to the Maxtor hard drive that could indicate that a trojan or other kind of virus or invasive software downloaded illicit files to the hard drive without Winkler's knowledge.

As a result of the ICE investigation, Winkler was charged with receiving and possessing child pornography under 18 U.S.C. 2252(a)(2) and 18 U.S.C. 2252A(a)(5)(B), and his case was tried to a jury in 2009. He was convicted, and sentenced to 72 months imprisonment on Count One, and 73 months imprisonment on Counts Three, Four and Five, all to run concurrently, followed by concurrent 15 year terms of supervised release on each count. No fine was imposed, but Winkler was ordered to pay a $100 special assessment as to each of the four counts of conviction. In this appeal, Winkler disputes only his convictions on Counts One and Five. Specifically, Count One alleges, under 18 U.S.C. 2252(a)(2), that Winkler “did knowingly receive” two video files depicting minor females engaging in sexual activity with adult males. Count Five alleges, under 18 U.S.C. 2252A(a)(B)(5), that Winkler “did knowingly possess” four video files depicting minor or prepubescent females engaging in sexual activity.

II.

Winkler makes two claims on appeal. First, he claims that because the images alleged in Count One were found only in

[639 F.3d 696]

his temporary internet cache, there was insufficient evidence to support his conviction for “knowingly receiving” those images under 18 U.S.C. 2252(a)(2). Second, he claims that the evidence at trial was insufficient to support his conviction, on Count Five, for possessing certain other images under 18 U.S.C. 2252A(a)(5)(B). In support of that argument, he offers various alternative explanations for the presence of the files on his hard drive, and also contends that the government failed to show that the images alleged in Count Five of his indictment traveled in interstate commerce.

A challenge to the sufficiency of evidence following a proper motion for acquittal is reviewed by this court de novo. United States v. Valle, 538 F.3d 341, 344 (5th Cir.2008). In reviewing challenges to the sufficiency of the evidence in a criminal case, the evidence is viewed in the light most favorable to the jury verdict. United States v....