directing the trial court to correct errors in the minutes of the sentencing hearing that the
parties agree need to be corrected.
FACTS3
On January 4, 2010, defendant lived alone at his home, where he kept, inter alia,
the four computers discussed below. By way of stipulation, the parties agreed to the
chain of custody of those computers from the time of their seizure from defendant‟s
house to the time they were analyzed by the prosecution and defense experts.
1 The prosecution expert witness and the prosecutor explained that child pornography comprised images of children (persons under the age of 18) engaged in a sexual act or simulated sexual act or a naked child with the focus of the image on the child‟s genitals and child erotica comprises images of children in bikinis or underwear or otherwise nude, with their genitals not exposed, but the focus of the image on the child‟s covered genitals. The instruction given this jury provided that possession of either constituted a violation of Penal Code section 311.11, subdivision (a).
2 All further statutory references are to the Penal Code unless otherwise indicated.
3The prosecutor made the understatement of the decade when she said, at the beginning of her argument to the jury, “I know some of the testimony might have been confusing.” This confusion could have been avoided.
2
The prosecution expert testified that Internet Explorer automatically logs into
Internet history every web page the computer user goes to, and saves into temporary
Internet files the images on every web page the user views, including the graphics that
make up the banners on web pages. If a computer user is not savvy, he or she may be
unaware that the images from every web page viewed are saved.
On one of the computers removed from defendant‟s home on January 4, 2010, a
Compaq brand computer (Compaq), the prosecution expert found 12 thumbnail size4
computer generated images5 of children having sex with adults. The images had been
saved to a folder on the hard drive on October 19, 2009 and December 7, 2009, and,
subsequently, the folder had been deleted. The prosecution‟s expert could not determine
whether any of the 12 images had been viewed or how they had been deleted. The fact
that these images had the same creation,6 modification and last access date suggests that
they appeared on the screen while the computer user was viewing a website, but the
prosecution expert could not say that the computer user opened any images beyond
viewing them within Internet Explorer. The images had been saved to temporary Internet
files. The fact that the December 7 creation time was within four minutes of the last
access time suggested that they were consistent with advertisements on a web page. The
4 The expert described thumbnails as different images that are offered for the computer user to view when the user opens a web page.
5 This means they were images of computer-generated children, not images of real children.
6 This means when they were saved to the hard drive.
3
evidence relating to these images was not admitted to prove the charged offense, but as
evidence of defendant‟s intent or mental state as to it. Also on the Compaq were 188
thumbnail images of girls in bikinis or panties with their legs spread, with the focal point
of the images being their genitals or buttocks, nine of which were shown to the jury. The
images had been saved by the Compaq‟s operating system to temporary Internet space on
the hard drive by the computer user visiting the website on which the images appeared on
October 19 and December 7, 2009, and on January 3, 2010, then the images had been
deleted. The standard user name of “Compaq_administrator” was associated with these
images. A web page for that user name was for defendant. The images would have come
across the computer‟s monitor, but it could not be determined whether anyone had
actually viewed them. They were in temporary Internet space, in deleted folders,
meaning the images had to have been displayed on a web page and the computer user had
to have visited that web page. Also on the Compaq was a web banner graphic for a child
pornography image named, “Real Preteen” that had eventually been deleted. A banner
graphic is saved to the hard drive when the computer user goes to the website where the
graphic appears. It had been in a temporary Internet file, meaning the image had to have
been displayed on a web page and the computer user had to have visited that web page.
The same user name as previously mentioned was associated with this graphic as were
the above-mentioned dates. Also on the Compaq were three images of females under the
age of 18 years, two of whom were engaging in sex acts with adults and the other of
whom was naked, on a bed, with her legs apart. Those images had also been deleted.
The above mentioned user name was associated with them, as were the above-mentioned
4
dates. They were in temporary Internet files, meaning the images had to have been
displayed on a web page and the computer user had to have visited that web page. On the
Compaq there were also 200 more images of girls in underwear and bikinis similar to
those described above, which were in unallocated clusters, meaning they had been
deleted, therefore, it could not be determined when they were created or deleted. Also on
the Compaq were Google Internet searches for web pages associated with child model
sites and child erotica-type content, with which the above-mentioned user name was
associated and “the user profile identified [defendant] as having the email address
associated with [this user name].” They were in unallocated space. The Compaq also
contained indicia of a peer-to-peer sharing network that had been used on the computer
and a movie file with a title consistent with child pornography content that had been
partially downloaded, suggesting that the computer user had either cancelled the
download, or deleted it after it had been completed. The text in the network program
included, inter alia, the words, “masturbation, orgasm, panties, . . . vagina, porn, kiddie,
incest, preteen [and] fuck.” The prosecution expert opined that the images found on the
Compaq‟s hard drive had been displayed on its monitor.
On a Hewlett Packard brand laptop (HP) computer taken from defendant‟s home
on December 4, 2010, were 64 thumbnail size images of child porn or child erotica—nine
of them, which depicted young or preteen girls in various states of undress, most wearing
bikinis or panties, which could be viewed by the computer user on the screen, were
shown to the jury. Because they were in unallocated space, meaning they had been
deleted, it could not be determined when they were created or deleted. The 64 images
5
had been saved to the hard drive before being deleted. The images could be consistent
with an advertising page or the opening page from a model‟s website showing the content
of that website. The prosecution‟s expert was not able to say that these images were
displayed on the HP‟s monitor, because they were in unallocated clusters, however, they
were consistent with the images he found on the Compaq‟s hard drive, which he opined
had been on its monitor, and with the images he found on the Apple brand computer‟s
(Apple) hard drive (discussed below), some of which had been enlarged by the computer
user. The HP laptop also contained web banner graphics of four very small images that
had been spliced together to make one large, long image of preteen girls in various states
of undress. A banner graphic is saved to a hard drive when a computer user goes to the
website that contains the graphic. In the opinion of the prosecution‟s expert, the girls in
all of the above-mentioned images were under the age of 18. The images could have
been saved by the computer user or automatically saved by the operating system, the
latter when the computer user went to the website on which the images were displayed.
Also on the HP laptop were deleted Google searches—the user name associated with
them was Clark, which is defendant‟s first name. The text that had been typed into the
laptop by the computer user for these searches was “Russian ballet model,” “hot preteen
models,” “nude preteen” and “nude preteen models.” In his opinion, the images he found
on the Compaq, the HP and the Apple (discussed below) were images that would be
found if a computer user entered these search terms. Google suggestions, which are
suggested search terms that appear when the computer user begins typing a search term
into the Google web page, are not saved to the Internet history but they are saved as a
6
temporary file in unallocated space.7 Therefore, the Internet history shows only the
search term actually typed by the computer user and not the Google suggestions. In the
prosecution expert‟s opinion, Google suggestions would not suggest a term like “nude
preteen model” and if a computer user typed “nude” into a search, a suggestion of
“preteen” would not be made. There were no Google suggestion for “nude preteen.”
When the prosecution‟s expert typed “preteen nude” into a Google search on this
computer, no suggestions related to child pornography or child erotica came up. He
testified that due to federal law, Google does not suggest search terms that lead to child
pornography. Although he could not say that the images on the HP laptop had been
displayed on its screen, they were consistent with the images that were on the Apple
computer, which were viewed and which will be described below.
On the Apple computer, also taken from defendant‟s home on January 4, 2010,
were 268 images, which had been deleted, and of which the nine shown to the jury were
representative. Because the 268 images were in unallocated clusters, meaning they had
been deleted, it could not be determined when they were created or deleted. The nine
images shown to the jury were of girls and boys, from infancy to early teen (all under
18), engaged in sexual acts or having their exposed genitals as the focus of the images.
The images ranged in size from thumbnail to full-size large images, the latter meaning
7 The prosecution expert‟s testimony concerning whether Google suggestions are saved to the hard drive was very confusing. First, he appeared to assert that while they were not saved to the Internet history, they were saved into Internet temporary space. However, when asked about Internet temporary space, he began talking about deleted Internet history.
7
that they had been opened up, enlarged or modified by the user of the computer. Also on
the Apple laptop was a web page banner for the Lolita‟s Kingdom web page, deleted web
pages to Lolita-type sites and child model sites for child erotica and 505 images of child
erotica.
On an Acer brand mini-notebook computer, also taken from defendant‟s home on
January 4, 2010, were deleted web page entries showing web page names relating to child
models or tiny girl pictures.
In the expert‟s opinion, whether the Compaq, the HP or the Apple had a virus
would be irrelevant because no virus would cause a Google search for the term “nude
preteen” to be typed in as it was on the HP. Also, the images found on all three of these
computers were consistent with the types of Google searches that had been done on the
HP (the user name associated with those searches was Clark), and according to the
prosecution‟s expert, a virus would not put those images onto a computer. He had never
seen a virus put child pornography onto a hard drive, including the virus, Trojan.8 He
conceded that pop-ups, which are advertisements that appear on the computer screen,
could be caused by a Trojan virus.
He described a “redirect” as occurring when a computer user is on a website and is
trying to close the website, but another screen appears, directing the user to another
location. At times, a computer user clicks on a page he or she thinks he or she is going to
8 Defendant states that the prosecution expert testified that he found Trojan viruses on the Compaq, citing Reporter‟s Transcript page 130. However, at that page, when asked if he found them on that computer, he responded, “I said I didn‟t pay any attention to the viruses or Trojans, whether or not they were present.”
8
and is actually taken to another page that has different content. Typically, these pop-ups
or redirects can be viewed by the computer user and the user has to be on the Internet for
them to occur. In the expert‟s opinion, pop-ups or redirects are irrelevant to this case
because some user of the HP had to enter the terms “hot preteen models” and “nude
preteen.” He had never seen a website redirect to child pornography if the computer user
was not originally on a child porn site. The expert conceded that in some instances, when
a computer user is on an adult pornography site, there could be a link taking the user to a
site with younger people (individuals that look 18 or 19 years old, but could be 14 or 15
years old). However, he had never seen a link on an adult pornography website to a site
for infants or early teenagers. There was no evidence that the images he found on the
Compaq, the HP or the Apple were the result of a computer user going on an adult
pornography website and getting redirected to a child pornography site. The expert
opined that one of the ways the images on all three computers got there was by a
computer user doing Google searches for the terms that had been typed into searches on
the HP (the user name associated with these was Clark), and the searches could not have
taken place without the computer user typing in the search terms. He explained that
when the computer user enters a search on Google, the user gets website names, and if
the user clicks on one of those names, that website appears on the user‟s screen and the
thumbnail images on that website are part of what the user views on the website.
Nothing has to be clicked on the website for the thumbnail images to be seen. Of the
total 1.6 million images he saw on the three computers, well over one thousand were
suspected child pornography or child erotica.
9
The prosecution expert testified that during a Google search, a flash on the screen
comes up on some websites, and even if the pop-up blocker blocks it, whatever flashed
on the screen can still record to the hard drive. Several years ago, the expert‟s computer
began flashing while he was on the Internet and everything on the pages that flashed by
was saved to the hard drive.
Every child pornography or child erotica image found in this case was either in the
unallocated space on the hard drives or in the Internet temporary files, the latter of which
had been saved by the computer‟s operating system. For images in unallocated space, it
cannot be determined when they were created, when they were deleted or whether they
were deleted by the computer operator or the system. Typically, when a web page comes
up in response to a search, the computer user has to scroll down on the page to view all of
it, so that images on the bottom of the page may not be viewed by the user unless he or
she scrolls down. Typically, child pornography is not advertised on the web. It is most
commonly obtained in peer-to-peer programs.
The first defense expert opined that of the 248 “suspect” images from the Compaq
and the HP, most, if not all, were from redirects and had not been clicked on and
downloaded to either computer. A thumbnail image is saved to a hard drive either by the
computer user going to the website where the thumbnail image is located, or that website
popped up, or the computer user was redirected to that website. Based on his training and
experience, a computer user cannot go to a legitimate website and have a pop-up or
redirect to child pornography. In order for a thumbnail image to be saved to a hard drive,
the computer user would have to have gone to the website where the thumbnail image
10
was located, or the website would have had to have popped-up or the computer user
would have had to have been redirected to the website.
The second defense expert testified differently than the first, saying that he has
seen legitimate sites redirect to child pornography sites. However, once the computer
user is redirected, the redirected-to-website would be seen on the computer screen. He
testified that some redirects (the computer user goes on the Internet and is redirected to a
predetermined website no matter what the user does and as the user tries to get away from
that website, the user is directed back to it) and some pop-ups (something unexpected
appears when the computer user is on the Internet) are outside the computer user‟s
control and the latter may be so fast that the computer user cannot intercept it or see it
happening. Pop-up providers and redirect websites are constantly changing so they can
operate freely. Concerning only the images on the Compaq that were dated January 3,
2010, he testified that most were created within a minute of a particular time and it was
the same as the modification time and access time, meaning that none had been clicked
on and viewed. Based on what he said was the small number of suspected child
pornography and child erotica images relative to the total number of images found (he
said there were 12,200 which had been modified on January 3, 2010), the small size of
the former images and the fact that they were created, modified and accessed at the same
time, he opined that they were pop-ups that appeared on some type of web page or ads or
thumbnails. Of the 27 that could be traced back to a folder, they were in temporary
Internet space, which was controlled by the browser, and it did not appear that they had
been saved by the computer user. It did not appear to him that any had been clicked on or
11
expanded, however, he could not say whether or not someone had actually viewed them.
None had been saved to any other folders in the Compaq. All the images on the Compaq
that he examined were thumbnail size pictures of child erotica, and they could be viewed
by the computer user while they were on the screen. There was no evidence that the
Compaq‟s user went to a website containing child pornography and saw the thumbnail
images. The images could have gotten onto the Compaq‟s hard drive by the website
loading as an ad, the pop-up blocker could have blocked it and the ad could have been
saved to the hard drive even though it did not appear on the screen. Concerning Google
suggestions, he said that it is possible that if the computer user typed into a search the
word “nude” Google would suggest terms that would lead the user to a child pornography
website. However, he typed in “little girl” and no such suggestion came up. He testified
that as to four out of the five or six Google suggestions that had been made, no images
from the websites referenced by those suggestions had been saved to temporary Internet
space when he typed a search into Google on a computer and did not click on and open
any of the suggestions. He then used other computers and was able, with some, to
duplicate this result, and not able to with others. He could not with a version of Windows
that was newer than the one defendant had. The same program defendant had could
duplicate the expert‟s results 8 out of 10 times, but no images from the websites were
saved. He typed “little” then “girls” into Google and it showed some images from its
image search capability which appeared below the suggestions, and those images were
saved to the hard drive, but none of them were pornographic. That same search produced
results on the screen that the computer user would have had to have scrolled down to in
12
order to see all of them. The Google suggestions that were saved appeared the same as
the terms actually typed into the Google search in Internet temporary space. One of the
five-to-seven viruses on the Compaq was a Trojan, and viruses can cause redirects, but he
had never seen a virus that dropped child porn onto a computer. He found “a few”
images of child erotica on the HP9 and none on the Apple. All the images he examined
on the Compaq and the HP were consistent with pop-ups and redirects. No child
pornography or child erotica images were found in any of the computer user operated
space on any of the computers.
The defendant testified, denying that he had viewed any of the images that had
been shown to the jury. He denied searching for or viewing any sexually explicit images
of children or images of children engaging in sexual activity. He denied knowing that
any web pages he visited were automatically downloaded to his hard drive. He claimed
the Apple stopped working in early 2009. He admitted using the Compaq on January 3,
2010, and it worked correctly, but the Internet on it had given him problems. He denied
doing the searches on the HP under the user name Clark for nude preteen models. He did
not recall searching the Internet for images of little girls on January 3, 2010.
ISSUES AND DISCUSSION
1. Statute of Limitations
Defendant contends that the People failed to carry their burden of proof that the
child pornography and erotica were possessed within the 10 years statute of limitations
9 The People incorrectly state that he found none.
13
applicable to violations of section 311.11, subdivision (a). (§ 801.1, subd. (b).) This
burden is by a preponderance of the evidence. (People v. Castillo (2008) 168
Cal.App.4th 364, 369.) Prosecution is to commence within 10 years after commission of
the offense. (§ 801.1, subd. (b).) Prosecution is commenced when an information is
filed. (§ 804, subd. (a).) The information charging defendant with possession on or
about January 4, 2010 was filed June 2, 2011. Therefore the People had the burden of
proving by a preponderance of the evidence that defendant possessed the child
pornography and erotica after June 2, 2001. Defendant here asserts that the prosecution
failed to prove that defendant possessed the images in the unallocated spaces after June 2,
2001 because the prosecution expert testified that he was unable to say when those
images were created, i.e., placed on the hard drive by the website that contained them
being visited. However, the People‟s theory was that defendant possessed the child
pornography and erotica by “having them on his computer” and there was proof, by a
preponderance of the evidence, that they were on his computer on January 4, 2010.
Defendant argued to the jury only that he was not aware that they were there—that they
got there due to pop-ups, redirects, and/or that they had been placed far enough down on
websites he viewed that he failed to see them because he had not scrolled down that far.
Therefore, defendant possessed all the child pornography and erotica within the statute of
limitations period.
2. Insufficiency of the Evidence
Relying on United States v. Kuchinski (9th Cir. 2006) 469 F. 3d 853 (Kuchinski),
defendant asserts that there was insufficient evidence to prove that he knew of the
14
existence of the child pornography and erotica images that were in temporary Internet
space. In Kuchinski, the defendant “d[id] not argue that he is not responsible for the
possession of [images of child pornography]” “located in the computer‟s downloaded
files and . . . in its deleted files.” (Id. at p. 856.) “[W]e have declared that, „[i]n the
electronic context, a person can receive and possess child pornography without
downloading it, if he or she seeks it out and exercised dominion and control over it.‟
[Citations.] Thus, [defendant] properly concedes that he did knowingly receive and
possess the . . . images that he downloaded. But [defendant] was charged with [receipt
and possession of] . . . images, which appeared in his cache files [i.e., Deleted Temporary
Internet Files]. [¶] . . . [¶] According to the evidence before the district court, when a
person accesses a web page, his web browser will automatically download that page into
his Active Temporary Internet Files, so that when the site is revisited the information will
come up much more quickly than it would have if it had not been stored on the
computer‟s own hard drive. When the Active Temporary Internet Files get too full, they
spill excess saved information into the Deleted Temporary Internet Files. All of this goes
on without any action (or even knowledge) of the computer user. A sophisticated user
might know all of that, or might even access the files. But, [according to the government
expert,] „most sophisticated—or unsophisticated users don’t even know [that downloaded
web pages are] on their computer.‟ [¶] . . . „[T]he cache is a “system-protected” area,
which the operating system tries to prevent users from accessing by displaying a warning
that access involved an “unsafe” system command.‟ [Citation.] [A computer] user, who
knows what he is doing, can go forward and get access to the cache files anyway.
15
[Citation.] In the case at hand, there was no evidence that [defendant] was sophisticated,
that he tried to get access to the cache files, or that he even knew of the existence of the
cache files. [¶] There is no question that the child pornography images were found on
the computer‟s hard drive and that [defendant] possessed the computer itself. Also, there
is no doubt that he had accessed the web page that had those images somewhere upon it,
whether he actually saw the images or not. What is in question is whether it makes a
difference that, as far as this record shows, [defendant] had no knowledge of the images
that were simply in the cache files. It does. [¶] . . . In [United States v.] Romm, 455 F.
3d [990,] 995-98, [(9th Cir. 2006)] the evidence demonstrated that the defendant knew
about the cache files and had actually taken steps to access and delete them. On appeal,
he conceded knowledge, and contested dominion and control, but we rejected his
arguments. [Citation.] In so doing, we opined that „to possess the images in the cache,
the defendant must, at a minimum, know that the unlawful images are stored on a disk or
other tangible material in his possession.‟ [Citation.] We relied upon a case wherein the
Tenth Circuit Court of Appeals had declared that the defendant was properly found guilty
where he knew that child pornography images would be sent to his „browser cache file
and thus saved to his hard drive.‟ [Citation.] . . . [¶] . . . [¶] Where a defendant lacks
knowledge about the cache files, and concomitantly lacks access to and control over
those files, it is not proper to charge him with possession and control of the child
pornography images located in those files, without some other indication of dominion
and control over the images.” (Id. at pp. 856, 861-863, italics added, fns. omitted.)
16
Assuming for purposes of this argument only that Kuchinski is good law and binds
us, contrary to defendant‟s assertion, its holding does not mean that there was insufficient
evidence in this case that defendant knew of the existence of the images in the temporary
Internet files. First, as the Kuchinski court pointed out, there was no evidence in that case
that the defendant was even aware that the automatically downloaded web pages he had
viewed were in the cache files of his computer. Moreover, the prosecution expert in
Kuchinski testified that even most sophisticated computer users do not know that the web
pages they have accessed have been automatically downloaded to his or her hard drive.
There was no such evidence in this case, but there was sufficient evidence from which
this jury could reasonably infer that defendant knew the web pages he was visiting were
being automatically downloaded to his hard drive. That circumstantial evidence was that
defendant was a sophisticated computer owner and user, having owned four computers at
the time of the search of his home, in addition to 18 other media devices. Additionally,
defendant testified that he had done “lots and lots [of Internet searches,]” that he had
taken classes on instructional technology, during which he learned how to make and
present a PowerPoint presentation, how to put together information on a teacher website,
how to use a Smart Boards in the classroom10 and how to run a projector and that he used
a computer to do his lesson plans and play a game. He testified that he used computers
both at work and at home. He conceded that one might have the opinion that he was
pretty knowledgeable about computers. The prosecutor identified the central issue in this
10 Defendant taught boys and girls.
17
case for the jury during her argument as follows, “Did the defendant know that he
possessed those images?” The jury answered this question in the affirmative and there
was sufficient evidence to support their implied finding. Kuchinski does not stand for the
proposition that just because a web page is automatically downloaded to the hard drive by
the system, it cannot be proven that defendant was aware of this.
Defendant also points out that a decision out of the Third Appellate District
disagrees with the holding in Kuchinski. In Tecklenburg v. Appellate Division (2009) 169
Cal.App.4th 1402 (Tecklenburg), the appellate court noted that there was not universal
acceptance of the holding in Kuchinski. (Tecklenburg at pp. 1416-1417.) The
Tecklenburg court went on to observe that, “The operative language of section 311.11,
subdivision (a), provides it is a criminal offense for any person to „knowingly possess[]
or control[] any . . . computer-generated image that contains or incorporates in any
manner, any film . . . , the production of which involves the use of a person under the age
of 18 years, knowing that the matter depicts a person under the age of 18 years personally
engaging in or simulating sexual conduct.‟ (Italics added.)” (Id. at p. 1418.) The