People v. Conner CA6 ( 2023 )

Filed 10/23/23 P. v. Conner CA6
NOT TO BE PUBLISHED IN OFFICIAL REPORTS
California Rules of Court, rule 8.1115(a), prohibits courts and parties from citing or relying on opinions not certified for
publication or ordered published, except as specified by rule 8.1115(b). This opinion has not been certified for publication
or ordered published for purposes of rule 8.1115.
IN THE COURT OF APPEAL OF THE STATE OF CALIFORNIA
SIXTH APPELLATE DISTRICT
THE PEOPLE, H049879
(Monterey County
Plaintiff and Respondent, Super. Ct. No. SS151256A)
v.
BRANDON CONNER,
Defendant and Appellant.
Defendant Brandon Conner was placed on two years’ felony probation after a jury
convicted him of one count of possessing child pornography. On appeal he contends that
insufficient evidence supports the conviction and that trial counsel was ineffective for not
objecting to testimonial hearsay. Finding no prejudicial error, we will affirm.
I. TRIAL COURT PROCEEDINGS
Defendant was originally charged in 2015 with distributing child pornography
(Pen. Code, § 311.2, subd. (c)) and possessing child pornography (Pen. Code, § 311.11,
subd. (a)). He was convicted of those charges after a jury trial. A different panel of this
court reversed the judgment in 2019 due to admission of testimonial hearsay that violated
defendant’s right to confrontation. (People v. Conner (Sep. 26, 2019, H045304) [nonpub.
opn.].) The district attorney amended the information on remand to charge a single count
of possessing child pornography (Pen. Code, § 311.11, subd. (a)). The jury in
defendant’s second trial found him guilty as charged. The following evidence was
presented at defendant’s second trial.
A. TESTIMONY OF STEVEN GUIDI
Retired Monterey County district attorney’s office investigator Steven Guidi
testified about investigating defendant. He used a program called E-Phex in March 2015
to scan the Gnutella and Gnutella2 peer-to-peer Internet networks for people sharing
“files of interest.” (Guidi did not define the phrase “files of interest” during his
testimony.) He explained that E-Phex “grabs a list of internet protocol addresses that are
suspected of sharing files of interest.” It uses an automated process to request a list of
files that are being shared by computers at those internet protocol (IP) addresses. The
program then attempts to download any files of interest from those computers.
Guidi testified about an E-Phex report spreadsheet that was admitted into evidence
at trial. The report is based on E-Phex scans of an IP address associated with defendant
over the course of five days, March 12 to 16, 2015. The report has a separate tab for each
day the program scanned the computer using that IP address. Each tab has columns
noting the name of each file being shared by the target computer; the SHA value1 for
each file being shared by the target computer; and the size of each file. All of the files
listed in the report were being shared from the same Global Unique Identifier or “GUID”2
running the LimeRunner software program. The computer containing software with that
particular GUID was sharing over 1,000 files each day. Some of the file names for those
files contained the notation “PTHC,” which Guidi testified was a commonly used child
pornography abbreviation meaning “[p]reteen hardcore.”
Guidi testified that in order to share a file on the Gnutella network, a user must
possess the entire file. A file cannot be shared if it has been deleted. Guidi was not
aware of LimeRunner ever automatically downloading a file, meaning that a user must
1
As described by Guidi, a file’s “fingerprint” is its “SHA” or “hash” value, an
alphanumeric representation based on the file’s contents rather than its file name.
2
Guidi explained that a GUID is a 32-character unique address assigned to each
program running on a network (such as Gnutella) “so that the program can interact with
the other programs and know who is talking.”
2
choose to initiate a download. He noted that LimeRunner can run in the background on a
computer if the user does not actively exit the program, and merely clicking the “ ‘X’ in
the upper right-hand corner” would not necessarily close the program.
E-Phex was able to download full or partial copies of six videos from the target
computer. The parties stipulated that each of those videos was “clearly and plainly child
pornography within the meaning of Penal Code section 311.11.” Based on those
downloads, law enforcement obtained and executed a search warrant at defendant’s house
in Greenfield.
Guidi testified that defendant was home when he executed the search warrant.
Defendant told Guidi that he and his wife had access to a desktop computer located in an
upstairs office area. Guidi testified that defendant gave him the password for the desktop
computer.
Law enforcement used osTriage, an “on-scene triage program,” to search that
computer as well as two laptops in the house. Files of interest were located on the
desktop computer. The triage search did not find any complete files containing child
pornography. But the search uncovered “LNK” shortcut files that had the same file
names as some of the files of interest recorded during the E-Phex browses. Guidi
explained that LNK files are referred to as “pointer files” because they point to where a
file is actually saved; they are “not the actual file itself” but rather “a way for you to get
there without having to go to the folders and work your way through all of those folders.”
There was also a “Preview-T” file with “PTHC” as part of the file name. Guidi
explained that when using a Gnutella network program like LimeRunner, incomplete
downloads are placed into an “incomplete” folder until the download is completed.
Incomplete files use the naming convention: “T, hyphen, the file size, and then the file
name.” If a user wishes to preview a file while it is being downloaded, LimeRunner “will
create a LNK file that is titled Preview, hyphen, T,” and then the file name. From the
presence of the Preview-T file, Guidi concluded a user had previewed that file as it was
3
being downloaded. Guidi could not conclude from the foregoing that someone
successfully downloaded any files, only that someone had attempted to do so. The triage
software did not locate LimeRunner on the computer.
Law enforcement used EnCase software to conduct a forensic examination of the
seized desktop computer. Guidi explained that when a file is saved on a computer, a
reference to the file’s location is saved on the hard drive’s file directory. When a file is
deleted, the computer deletes the file directory location for the file as well as its metadata
(information about a computer file that includes the file name, file size, date created, and
other data). But the file (or parts thereof) can remain on the computer in unallocated
space. The EnCase software searches both allocated and unallocated spaces on a hard
drive. EnCase can “carve” data on a hard drive, meaning “going into a computer and
looking for those files that have been deleted or portions thereof, being able to take part
of that data and put it in a format that’s viewable or readable, whether it be a photo,
video, or document.”
The EnCase search found two relevant categories of information. First, the search
found evidence that LimeRunner had previously been installed on the computer. The
software was installed in 2011 and last accessed in April 2015. The directory for saving
files downloaded from LimeRunner was “users, Conner family, documents, and then
Brandon.” And the GUID for LimeRunner matched the GUID of the software that was
sharing the files Guidi found in March 2015 using E-Phex. There was no evidence of a
search history for terms associated with child pornography. Second, the software was
able to carve 14 images from unallocated space on the desktop computer that were
associated with videos E-Phex had downloaded from the same GUID. The parties
stipulated that the 14 images were “image files with no metadata. The images are
screenshots clearly associated directly with [the E-Phex videos]. These images contain
child pornography within the meaning of Penal Code section 311.11.”
4
Guidi also testified about a search of defendant’s wife’s phone. Based on the
content of text messages and a photograph with metadata indicating it was taken in San
Francisco, the messages suggested that defendant’s wife visited San Francisco between
March 20 and March 22, 2015.
The final evidence of child pornography being shared by the desktop computer
came in the form of a report by the Child Rescue Coalition, which included a list of files
being broadcast by the desktop computer between March 21 and March 22, 2015. Guidi
testified that he compared the hash values of files from the Child Rescue Coalition report
against a list of known child pornography files maintained by the Monterey County
district attorney’s office. The hash values for three videos being shared by the GUID
associated with defendant’s desktop computer matched known child pornography files.
The parties similarly stipulated that those three videos were “clearly and plainly child
pornography within the meaning of Penal Code section 311.11.”
B. TESTIMONY OF WILLIAM WILTSE
William Wiltse testified that he is the president of the Child Rescue Coalition, a
nonprofit organization that produces technology to help law enforcement agencies
identify individuals on peer-to-peer networks who possess and share “images of child
abuse.” He testified that the organization maintains software called the Child Protection
System, which uses “crawlers and scanners” to act as a user on peer-to-peer networks,
send out keyword search requests, and then evaluate “in an automated fashion the
responses that come back from the computers that do respond.”
Wiltse explained the software looks for “indicators that an IP address may be in
possession of files that law enforcement has seen before and knows to be child abuse
material.” (The prosecutor stated “we’ll refer to that as files of interest throughout the
course ... of this testimony.”) The software does not attempt to download files, it merely
logs information about the shared files, including file name, hash value, and file size.
5
Wiltse authenticated the Child Rescue Coalition report that Guidi used to compare
files shared by the GUID for defendant’s desktop computer with files maintained by the
district attorney’s office. The information in the Child Rescue Coalition report is
computer-generated using an automated process. On cross-examination defense counsel
asked Wiltse, “of the 6,814 [files in the report], do you know how many files of interest,
meaning possible child pornography, are -- that can constitute what number in the
6,814?” Wiltse answered that he did not know. Wiltse acknowledged that he did not
have personal knowledge about whether any of the files in the organization’s report
contained child pornography.
C. TESTIMONY OF MICHELE BUSH
Michele Bush testified for the defense as an expert digital forensics examiner. She
performed a forensic examination of the desktop computer from defendant’s house. She
confirmed that there was no child pornography in the computer’s allocated space when it
was seized. She acknowledged on cross-examination that 17 of the 150 files within the
“recent” folder on the desktop computer had file names containing one or more terms that
were “indicative of child pornography.”
D. DEFENDANT’S TESTIMONY
Defendant testified that he lived with his wife at the house in Greenfield in 2015.
He and his wife both used the desktop computer, and it was located in a room where
guests would have access to it. The computer was password-protected, but the password
was only necessary if a user locked or restarted the computer. He testified that he used
the computer to download entertainment, pay bills, and to watch adult pornography. He
acknowledged using peer-to-peer software to download media, but denied ever searching
for child pornography. He denied installing LimeRunner, and speculated that his sister’s
boyfriend might have done so. Defendant testified that the boyfriend visited the house
periodically in 2015 for “some holidays and some weekends,” but he could not remember
how frequently he visited. Defendant denied intentionally downloading or viewing any
6
child pornography. He acknowledged that certain files listed on the E-Phex report of
files shared by the desktop computer were his personal files, including the results of a
physical exam and a form regarding his honorable discharge from the military.
Defendant testified that he waived his Miranda rights and spoke with Guidi on the
day of the search. (Miranda v. Arizona (1966) 384 U.S. 436.) He acknowledged telling
Guidi that he had previously come across two or three files on the desktop computer that
appeared to contain child pornography. He told Guidi he had deleted the files
immediately upon discovery. He also acknowledged telling Guidi that he assumed the
source of those files was a different peer-to-peer file sharing program, uTorrent. He
testified that he had no reason to doubt the authenticity of the evidence of the text
message conversation between him and his wife during a weekend she traveled to San
Francisco in March 2015; he did not deny that he was home during that period.
II. DISCUSSION
A. SUBSTANTIAL EVIDENCE SUPPORTS DEFENDANT’S CONVICTION
Defendant does not contest that child pornography existed on his desktop
computer, nor that child pornography was downloaded from a computer with the same IP
address and GUID as the desktop computer. Defendant makes the narrower argument
that there is insufficient evidence to show that he, as opposed to someone else, knowingly
possessed that child pornography.
“In assessing the sufficiency of the evidence, we review the entire record in the
light most favorable to the judgment to determine whether it discloses evidence that is
reasonable, credible, and of solid value such that a reasonable trier of fact could find the
defendant guilty beyond a reasonable doubt.” (People v. Bolin (1998) 18 Cal.4th 297,
331.) We do not reweigh evidence or second-guess credibility determinations. (People
v. Ramirez (2022) 13 Cal.5th 997, 1118 (Ramirez).) We presume the existence of every
fact the trier of fact could reasonably deduce from the evidence to support the judgment.
(Ibid.) To overturn a conviction based on insufficient evidence, “it must clearly appear
7
that upon no hypothesis whatever is there sufficient substantial evidence to support it.”
(People v. Redmond (1969) 71 Cal.2d 745, 755.)
Substantial evidence in this record supports defendant’s knowing possession of
child pornography. The LimeRunner program was set to save downloads to a folder with
defendant’s name on it (file path “users, Conner family, documents, and then Brandon”).
That folder also contained at least two files specifically associated with defendant: the
results of a physical exam and his honorable military discharge paperwork. During his
wife’s trip to San Francisco in late March 2015, defendant was the only resident with
access to the computer. And during that period of defendant’s exclusive access to the
desktop computer, the desktop computer shared files that defendant stipulated contained
child pornography. Defendant admitted seeing child pornography on the desktop
computer—the jury was not required to credit defendant’s contentions that his viewing
was inadvertent or that he immediately deleted the files. Further, child pornography files
were being shared by the desktop computer over the course of several days in March
2015, which supports an inference that defendant did not immediately delete child
pornography he saw on the computer. The foregoing evidence, considered together, is
sufficient to support the finding that defendant knowingly possessed child pornography.
Defendant’s arguments to the contrary fall into two categories. In the first
category he notes the testimony that LimeRunner can run in the background, and argues
that the desktop computer sharing files while defendant’s wife was in San Francisco
therefore “does not give rise to an inference that appellant downloaded the three videos
while his wife was in San Francisco or that he knew about them.” He also points out that
only a few of the thousands of files in the shared folder during the E-Phex browses were
specifically linked to defendant. But these issues would require us to reweigh or
reinterpret the evidence, which is not our role (Ramirez, supra, 13 Cal.5th at p. 1118),
and we have already summarized substantial evidence relating to defendant’s conviction.
8
The second category of arguments focuses on the absence of evidence that might
more strongly support a conviction. Defendant notes the shared folder was not password
protected, the forensic search could not identify a specific user, and there was no
evidence of any search history for child pornography. But the absence of different or
additional evidence does not render insufficient the evidence that was presented to and
considered by the jury.
Defendant argues his case is similar to United States v. Lowe (6th Cir. 2015)
795 F.3d 519, in which the court reversed a child pornography possession conviction
where three individuals had access to a laptop and the pornography was downloaded to
“the computer’s ‘downloads’ folder.” (Lowe, at pp. 524–525.) By contrast here, the
testimony about defendant’s wife’s trip to San Francisco during a period where the
computer was sharing child pornography supports an inference that defendant was the
person who possessed the child pornography during that period. From that, the jury
could also reasonably conclude it was defendant who possessed the child pornography
shared earlier in the same month. And rather than a generic “downloads” folder, the
LimeRunner program was set to save downloads to a folder with defendant’s name on it
(file path “users, Conner family, documents, and then Brandon”).
B. COUNSEL DID NOT PROVIDE INEFFECTIVE ASSISTANCE
Defendant contends his federal constitutional right to confront and cross-examine
witnesses was violated by the trial court’s admission of testimonial hearsay about “files
of interest.” (See Crawford v. Washington (2004) 541 U.S. 36 (Crawford).) He
acknowledges he forfeited the issue by not objecting on that basis in the trial court, but
argues we should exercise our inherent discretion to consider the forfeited claim;
alternatively he contends his trial counsel was ineffective for failing to object. We
analyze the issue for ineffective assistance.
To establish ineffectiveness of trial counsel in violation of the right to counsel
under the Sixth Amendment to the United States Constitution, a defendant must show
9
both a deficiency in counsel’s performance and prejudice from the deficiency. (People v.
Ledesma (1987) 43 Cal.3d 171, 216–217 (Ledesma).) We note that an attorney does not
perform deficiently by declining to make a meritless objection. (People v. Ochoa (1998)
19 Cal.4th 353, 463 (Ochoa).) And we will not second-guess the reasonable tactical
decisions of trial counsel. (People v. Riel (2000) 22 Cal.4th 1153, 1185.) Even where
deficient performance is shown, a defendant must further affirmatively show a reasonable
probability that, but for trial counsel’s error, the result would have been different.
(Ledesma, at pp. 217–218.)
We discern two components to defendant’s appellate argument. The first objects
to Guidi’s and Wiltse’s use of the phrase “files of interest” during their testimony. The
second objects to the prosecutor’s use of that phrase during closing argument. The
admissibility of out-of-court statements in a criminal case is reviewed in two steps.
(People v. Sanchez (2016) 63 Cal.4th 665, 680.) “The first step is a traditional hearsay
inquiry: Is the statement one made out of court; is it offered to prove the truth of the facts
it asserts; and does it fall under a hearsay exception?” (Ibid.) Next, “[i]f a hearsay
statement is being offered by the prosecution in a criminal case, and the Crawford
limitations of unavailability, as well as cross-examination or forfeiture, are not satisfied,”
we must then decide whether the statement is “testimonial hearsay” as defined by the
United States Supreme Court. (Sanchez, at p. 680; see Crawford, supra, 541 U.S. at p. 52
[a testimonial statement is “ ‘made under circumstances which would lead an objective
witness reasonably to believe that the statement would be available for use at a later
trial’ ”].) We agree with the court in People v. Lund (2021) 64 Cal.App.5th 1119, 1132
(Lund), that the first step of the analysis is reviewed for abuse of discretion, while the
second step is reviewed independently because it implicates the federal constitution.
1. Guidi’s and Wiltse’s Testimony
Defendant argues that “[a]ny reference to ‘files of interest’ to prove that a file
depicted child pornography was [testimonial] hearsay evidence.” The argument is based
10
on an exchange between Wiltse and the prosecutor. Wiltse testified that the Child
Protection System software looks for “indicators that an IP address may be in possession
of files that law enforcement has seen before and knows to be child abuse material.” The
prosecutor stated, “we’ll refer to that as files of interest throughout the course ... of this
testimony,” and also stated, “we won’t get -- get too specifically into that.” Guidi, who
testified both before and after Wiltse’s testimony, used the phrase “files of interest” but
never defined it.
A statement is not hearsay if it is not used to prove the truth of the matter asserted,
such as when the statement is used to explain its effect on a listener. (Evid. Code,
§ 1200.) Lund, supra, 64 Cal.App.5th 1119, addressed a nearly identical argument in a
case also involving the Child Protection System software and testimony by Wiltse. Lund
argued that Wiltse’s statements were testimonial hearsay because he relied on the
software’s “database of hash values corresponding to previously identified child
pornography.” (Id. at p. 1133.) The court noted that the prosecution in Lund’s trial had
not relied on the database of hash values to establish that any of the files Lund possessed
actually contained child pornography; that was established by having an officer
personally view the files. (Id. at p. 1134.) As such, the court concluded that Wiltse’s
testimony about the database of hash values was used not to prove the truth of the matter
asserted but rather to “explain [law enforcement’s] course of conduct in investigating”
Lund. (Ibid.) The court reasoned that “[e]ven if every entry in the CPS hash value
database were wrong, such hypothetical errors would not undermine the prosecution’s
proof of the elements of the charge against Lund” because the prosecution proved the
files were pornography by showing them to the jury or by having an officer testify about
personally viewing them. (Id. at p. 1135.)
The Lund court’s reasoning applies with full force to Guidi’s and Wiltse’s
testimony in this case. Neither Wiltse nor Guidi relied on the label “file of interest” to
conclude that the file contained child pornography. Indeed, Wiltse acknowledged that he
11
had no personal knowledge about whether any file in the Child Protection System report
contained child pornography. References to “files of interest” merely explained the
actions of law enforcement in investigating an IP address that was sharing those files,
which eventually led to the discovery of several images on the desktop computer that
defendant stipulated contained child pornography. We see no deficiency in trial counsel
not making what would have been a meritless hearsay objection. (Ochoa, supra,19 Cal.4th at p. 463.)
2. The Prosecution’s Closing Argument
Defendant argues the prosecutor “used the phrase ‘files of interest’ in his closing
argument—for the truth of the matter asserted that the files on the spreadsheet contained
child pornography.”
The prosecutor referred to “files of interest” twice in closing argument, without
defining the phrase. When describing the E-Phex report, the prosecutor argued “E-Phex
is a mechanism that -- that pretends to be just a random peer-to-peer user. But they go
out and they crawl through the Gnutella network trying to find users who are
broadcasting suspected files, files of interest. And when they get those files, when they
see that, they record them.” The prosecutor later addressed the possibility of mistake,
arguing: “So this idea of ‘Well, the BitTorrent made me do it, the BitTorrent came on
and brought with it -- like a Trojan Horse, brought with it all kinds of child porn,’ well,
the problem with that is where are the BitTorrent files that are being added during that
same time period? They’re not there. There’s like three or four files being added per --
per -- per browse. And it’s only the -- the files of interest, the PTHC files.”
The prosecutor’s first statement described the investigative process; it was not
offered as proof of any matter asserted. In the second statement, the prosecutor did not
state that “the files of interest, the PTHC files” identified through the E-Phex process
were child pornography. The point of the reference was that “the files of interest, the
PTHC files” discovered during the E-Phex browses came from LimeRunner software
12
rather than BitTorrent software—the prosecutor did not urge the jury to consider those
files to be child pornography. Based on a reasonable assessment that jurors would not
connect the prosecutor’s reference to “files of interest” to Wiltse’s use of the phrase on an
earlier day of trial, defense counsel could have made the tactical decision not to object to
the fleeting reference so as not to highlight it for the jury. (People v. Sta Ana (2021)
73 Cal.App.5th 44, 58.)
III. DISPOSITION
The order granting probation is affirmed.
13
____________________________________
Grover, J.
WE CONCUR:
____________________________
Greenwood, P. J.
____________________________
Lie, J.
H049879
People v. Conner