Case: 17-14913 Date Filed: 11/21/2019 Page: 1 of 11
[DO NOT PUBLISH]
IN THE UNITED STATES COURT OF APPEALS
FOR THE ELEVENTH CIRCUIT
________________________
No. 17-14913
________________________
D.C. Docket No. 4:16-cr-10043-KMM-1
UNITED STATES OF AMERICA,
Plaintiff–Appellee,
versus
RUSSELL HUDSON CULLEN,
Defendant–Appellant.
________________________
Appeal from the United States District Court
for the Southern District of Florida
________________________
(November 21, 2019)
Case: 17-14913 Date Filed: 11/21/2019 Page: 2 of 11
Before MARTIN, TJOFLAT, and PARKER, * Circuit Judges.
PER CURIAM:
Appellant Russell Hudson Cullen appeals from a judgment of conviction in
the United States District Court for the Southern District of Florida. We assume
familiarity with the facts, procedural history, and issues on appeal.
BACKGROUND
The Department of Homeland Security (“DHS”) uses the Child Protection
System (“CPS”) investigative software to search the internet for computers that
contain child pornography. CPS uses keywords associated with child pornography,
searches the internet, and downloads files that it finds. It then keeps a large database
of known child pornography videos’ “hash values,” which are unique indicators
associated with each individual video. According to expert testimony at trial, CPS
identified hundreds of hash values corresponding to child pornography that had been
downloaded through Shareaza—a peer-to-peer sharing software—to multiple IP
addresses associated with Cullen. Some of these files had been downloaded
completely while others had been downloaded only partially. In January 2016,
Special Agent Elliott Graves requested an image of child pornography from Cullen’s
IP address and the associated computer automatically sent him the file. In March
*
Honorable Barrington D. Parker, United States Circuit Judge for the Second Circuit,
sitting by designation.
2
Case: 17-14913 Date Filed: 11/21/2019 Page: 3 of 11
2016, DHS obtained a warrant and searched Cullen’s residence. The agents
retrieved an Asus laptop computer and a LaCie external hard drive.
When the Cyber Crimes Center extracted the contents of the LaCie hard drive,
they found various documents bearing Cullen’s name as well as child
pornography—specifically a video of two young girls displaying their genitalia. The
video had been found in “unallocated space” in the hard drive, which means that it
had been previously deleted. Special Agent Daniel Kenney was able to play the
recovered video and, at trial, two screenshots from the video were introduced into
evidence. A forensic analyst determined that the Asus laptop had been reformatted
multiple times, relegating certain files to unallocated space on the laptop. From this
space, Lumbert retrieved four images depicting child pornography. Lumbert found
an additional 14 images in a “cache file” that had been created after a thumb drive
was inserted into the computer to upload files.
Cullen was charged with one count of accessing with intent to view, two
counts of possession, and one count of distribution of child pornography. Cullen
proceeded to and testified at trial. His defense was that he had been addicted to adult
pornography for many years but had never searched for child pornography on any
of his computers. He testified that he would download thousands of video files in
bulk, searching only for adult pornography, and then open them later to sift through
potential options. He admitted that he downloaded and viewed child pornography
3
Case: 17-14913 Date Filed: 11/21/2019 Page: 4 of 11
but explained that he had done so by accident. When that occurred, he would delete
the files, and in instances where the pornography was particularly shocking, he
would immediately reformat his computer to remove any trace of the files from his
computer. Cullen also testified that he had never allowed any type of sharing of
pornography from his computer and that he had “deselected” all files that could be
shared, thus ensuring that none of them were available for download by other
Shareaza users. He testified that he had no idea how agents were able to obtain child
pornography from his computer.
During trial, Agent Kenney identified the LaCie hard drive that was seized
from Cullen’s home, but he noted that the hard drive serial number he recalled
differed from the serial number noted on the Government’s exhibit list. He
nevertheless testified that he “absolutely” recognized it both by the serial number on
the hard drive itself and the external case that accompanied it. The court, over
Cullen’s objection, admitted the hard drive. In February 2017, the jury found Cullen
guilty on all counts.
Probation determined that Cullen’s base offense level was 22. It
recommended a multitude of enhancements, increasing the offense level to 37. In
particular, two levels were added for the knowing distribution of child pornography
and five levels were added because the offense involved 600 or more images of child
pornography. Because Cullen had no criminal history points, his offense level of 37
4
Case: 17-14913 Date Filed: 11/21/2019 Page: 5 of 11
corresponded to a guidelines range of 210 to 262 months. He also faced a mandatory
minimum sentence of five years and an authorized maximum sentence of 80 years.
Cullen argued that he did not knowingly distribute child pornography. He also
argued that only one video (which corresponded to 75 images) and 18 photographs—
93 images in total—were involved in his offense conduct, and thus only a two-level
and not a five-level enhancement was warranted. The District Court rejected both
arguments and sentenced Cullen to 240 months’ imprisonment, adopting the
recommendation of the Probation Office. In addition, the Court stated on the record
that it would have imposed the same sentence had only the two-level and not the
five-level enhancement properly applied.
DISCUSSION
Sufficiency of Evidence
The reversal of a conviction for insufficient evidence is warranted only if no
reasonable jury could find proof of guilt beyond a reasonable doubt. United States
v. Thomas,
8 F.3d 1552, 1556 (11th Cir. 1993).
Possession and Access
The evidence that Cullen possessed and accessed child pornography was
overwhelming. Child pornography was found in unallocated space on his computer
and hard drive and an investigation of Cullen’s computer indicated that a thumb
drive had been used to upload additional pornographic images onto his computer.
5
Case: 17-14913 Date Filed: 11/21/2019 Page: 6 of 11
Further, full and partial downloads of hundreds of child pornography videos and
images were linked to a series of IP addresses all associated with Cullen. We find
this evidence sufficient to support his convictions.
Distribution
In United States v. Carroll,
886 F.3d 1347 (11th Cir. 2018), which involved
peer-to-peer sharing software, a jury convicted the defendant of distributing child
pornography after he had downloaded hundreds of images and videos from a peer-
to-peer sharing platform called Ares.
Id. at 1349. Ares functions in the same way
as Shareaza, the peer-to-peer software in this case:
When downloaded, Ares sets up a shared folder on the computer where,
by default, it automatically places all subsequent downloads. Once a
file is placed in the shared folder, it is immediately available for further
dissemination. Unless an Ares user changes the default settings or
deliberately moves files out of the shared folder, downloaded files will
remain freely accessible to anyone else on the Ares network . . . .
Id. at 1350.
We reversed the conviction in Carroll based on insufficient evidence because
“[n]othing in the record demonstrate[d] that Carroll intended to share files or that he
was even aware that the contents of his Ares folder were automatically distributed
to the peer-to-peer network.”
Id. at 1353. We rejected the Government’s argument
that the defendant “was guilty of knowing distribution simply because he was using
a peer-to-peer file sharing program and ‘that is what it is.’”
Id. at 1353. We
explained that “the fact that files were automatically shared from [the defendant’s]
6
Case: 17-14913 Date Filed: 11/21/2019 Page: 7 of 11
Ares folder, without some evidence of his awareness of it, cannot carry the
government’s burden to prove knowing distribution beyond a reasonable doubt.”
Id.
at 1353–54. The basis of our reasoning was that “Ares, by default, installs a shared
folder, automatically places downloaded files into that folder, and distributes all
contents of the shared folder to anyone else on the Ares network without prompting
the user—even when the user is away from his computer.”
Id. at 1354. In response
to the Government’s argument that “it would be impossible for an individual to use
a peer-to-peer file sharing program and lack a full understanding of its operations,”
we noted that it was “unwise to adopt such a sweeping rule in this fact-sensitive
context, where the mechanics of each peer-to-peer program may bear on the issue of
knowledge in different ways.”
Id.
Generally, courts should be cautious in their approach to distribution charges
brought in the peer-to-peer software context. Peer-to-peer software runs on the
sharing of downloaded files. If users do not proactively disable all sharing upon
installing the software, their files will be shared indefinitely without their awareness
and even when they have stepped away from their computer. The software also
intentionally makes it difficult for the average user to manage which of their files
are being shared at any given moment, often obscuring instructions for disabling
sharing, as is the case with Shareaza. Given the nature of this software, courts should
7
Case: 17-14913 Date Filed: 11/21/2019 Page: 8 of 11
focus with particular care on whether distribution on peer-to-peer software was done
knowingly.
In this case, however, Carroll does not compel a reversal because Cullen
testified that he understood how Shareaza’s automatic sharing function operated.
Specifically, the Government, in cross-examination, asked Cullen: “You talked
about—I know you have used file-sharing for a long time, and you’ve talked about
when you first used file-sharing devices all that time ago. You learned that when
you set it up you had to deselect folders? Do you remember that?” In response,
Cullen answered, “Absolutely, have to, have to.” Furthermore, without prompting,
Cullen stated: “But always, always, always make sure . . . [to] deselect every
[downloaded file] because if you leave even one up, there are people with software
[who] will be able to access all of your computer. This is what I was told.” Based
on Cullen’s statements evincing an understanding of Shareaza’s automatic sharing
features and the testimony from Graves that he successfully downloaded child
pornography from Cullen’s IP address, we find the evidence sufficient to support
Cullen’s conviction.
Admissibility of LaCie Hard Drive
We review for an abuse of discretion the District Court’s rulings on the
admissibility of evidence. United States v. Shabazz,
887 F.3d 1204, 1216 (11th Cir.
2018). “To satisfy the requirement of authenticating or identifying an item of
8
Case: 17-14913 Date Filed: 11/21/2019 Page: 9 of 11
evidence, the proponent must produce evidence sufficient to support a finding that
the item is what the proponent claims it is.” Fed. R. Evid. 901.
Cullen argues that the testifying witness, Kenney, could not identify the LaCie
hard drive seized during the execution of the search warrant. To be sure, Kenney
noticed that the serial number on the hard drive did not include the last four digits of
the serial number listed on the Government’s exhibit list. Notwithstanding the
confusion as to the serial number, the District Court did not abuse its discretion in
admitting the hard drive. Kenney was able to identify the hard drive by its external
casing and was able to identify most of the digits on the serial number. He also
testified that he was “absolutely” certain that the hard drive offered into evidence
was the same hard drive as was seized from Cullen’s home. Kenney’s identification,
taken together with the evidence that the hard drive contained child pornography
along with Cullen’s tax form, Cullen’s resume, and Cullen’s job application,
demonstrates that the Government produced “evidence sufficient to support a
finding that the item is what the proponent claims it is.” See Fed. R. Evid. 901.
Sentencing Enhancements
“We review a district court’s choice of sentence . . . for abuse of discretion,
determining if the sentence was procedurally in error or substantively unreasonable.
United States v. Trapp, 396 F. App’x 671, 672 (11th Cir. 2010). “When the
government seeks to apply an enhancement under the Sentencing Guidelines over a
9
Case: 17-14913 Date Filed: 11/21/2019 Page: 10 of 11
defendant’s factual objection, it has the burden of introducing ‘sufficient and
reliable’ evidence to prove the necessary facts by a preponderance of the evidence.”
United States v. Washington,
714 F.3d 1358, 1361 (11th Cir. 2013).
Knowing Distribution
The Guidelines authorize a two-level enhancement “if the defendant
knowingly engaged in distribution.” U.S.S.G. § 2G2.2(b)(3)(F). For the reasons
discussed above, the District Court did not abuse its discretion in imposing a two-
level enhancement, given that Cullen admitted to fully understanding Shareaza’s
automatic sharing features.
Number of Images Involved in the Offense
The Guidelines authorize a five-level enhancement if the offense involved
“600 or more images.” U.S.S.G. § 2G2.2(b)(7)(D). In determining the number of
images, “[e]ach video, video-clip, movie, or similar visual depiction shall be
considered to have 75 images.” Id. cmt. app. n. 6(B)(ii).
Cullen argues that his offense involved only the 18 images and one video
recovered from his laptop—a total of 93 images under the Guidelines. Cullen thus
argues that he should have only received a two-level enhancement because his
offense involved “fewer than 150” images. See U.S.S.G. § 2G2.2(b)(7)(A). The
District Court, however, considered 27 videos that were fully downloaded to IP
addresses associated with Cullen as reflected on the CPS database. These 27 videos
10
Case: 17-14913 Date Filed: 11/21/2019 Page: 11 of 11
corresponded to 2,025 images under the Guidelines, but they had never actually been
found on Cullen’s devices. Still, the Government has demonstrated, by a
preponderance of evidence, that these videos were involved in Cullen’s offense.
They were linked to his IP addresses, they matched the hash values for known child
pornography, and they had been fully downloaded into his computer. While they
were not found on the physical devices seized from his home, the District Court
reasonably inferred that Cullen had deleted them, especially given his testimony that
he routinely reformatted his computer. The District Court thus did not abuse its
discretion in imposing the five-level enhancement.
CONCLUSION
We have considered Cullen’s remaining arguments and find them to be
without merit. For the foregoing reasons, the judgment is AFFIRMED.
11
