United States v. Brandon Moran

NOT RECOMMENDED FOR FULL-TEXT PUBLICATION
File Name: 19a0237n.06
No. 18-5648
UNITED STATES COURT OF APPEALS
FOR THE SIXTH CIRCUIT
FILED
May 03, 2019
UNITED STATES OF AMERICA, ) DEBORAH S. HUNT, Clerk
)
Plaintiff-Appellee, )
) ON APPEAL FROM THE UNITED
v. ) STATES DISTRICT COURT FOR
) THE EASTERN DISTRICT OF
BRANDON MORAN, ) KENTUCKY
)
Defendant-Appellant. )
_________________________________/
Before: GUY, CLAY, and GRIFFIN, Circuit Judges.
RALPH B. GUY, JR., Circuit Judge. Brandon Moran was convicted by a jury of four
child pornography offenses—one count of distributing, one count of possessing, and two counts
of receiving child pornography—in violation of 18 U.S.C. § 2252(a)(2) and (4)(B). Seeking a new
trial on all counts, Moran contends that the district court erred by: (1) allowing an expert witness
to testify to matters outside the scope of the government’s pretrial disclosures; and (2) providing
an inadequate answer to a question posed by the jury during deliberations. Moran also challenges
the sufficiency of the evidence to support the distribution conviction, arguing that no reasonable
juror could conclude that he knew the files contained child pornography at the time they were
distributed. We affirm.
Case No. 18-5648 2
United States v. Brandon Moran
I.
On June 6, 2016, a computer operated by Kentucky’s Internet Crimes Against Children
Task Force was searching for available child pornography on a peer-to-peer network and
successfully downloaded four files containing child pornography from a single IP address near
Marysville, Kentucky. Alerted to the download, Kentucky State Police Detective Brian Cooper
confirmed that the files contained child pornography, requested subscriber information for the
associated IP address, and obtained a search warrant for the home where Brandon Moran resided
with other family members.1
When the warrant was executed on June 14, 2016, Detective Cooper interviewed Moran’s
sister and nephew who lived in the home; determined that the sister’s boyfriend, who was the
subscriber, had not lived there in weeks; and learned that Moran’s mother lived there but required
care for dementia. That left 25-year-old Brandon Moran, who led Detective Cooper to his room
in the basement and acknowledged that he had been using BitTorrent on the laptop computer that
was sitting on a table. The interview with Moran that followed was recorded and played for the
jury, although he did not testify at trial.
In that interview, Moran was advised of his right to remain silent before being questioned
further. Moran then confirmed that the bedroom and computer were his; stated that the wifi
connection and computer were password protected; and admitted that there was child pornography
on his computer. Referring to child pornography, Moran said: “I have clicked on it, I’m not going
to lie to you, sir.” Moran said he had looked at all kinds of porn, but denied watching “baby porn”
and claimed that he had used the search term “Lolita” to look for Japanese animated pornography.
1
The four files, which were the basis of the distribution count, consisted of: one video and one picture file that were
both named “new pthc opva 2014 real father fucks his 13 yo daughter in the basement”; and one video and picture file
that were both named “pedo Lolita pthc hussyfan two preteen lesbian to cam.” There was testimony that “pthc” refers
to “pre-teen hard core.”
Case No. 18-5648 3
United States v. Brandon Moran
When asked how torrents worked, Moran said he did not really know but then described having
downloaded and used several peer-to-peer programs—including, BitComet, BitTorrent, UTorrent,
Frostwire, and Limewire. Moran also explained that a torrent download sometimes included things
he did not want, such as child pornography and that he sometimes tried unsuccessfully to delete it.
Near the end of the interview, Detective Cooper asked, “let me get this straight . . . [y]ou’re telling
me that you know there is child pornography on that computer?” And Moran answered, “Yes sir
I do.”
The interview also included an extended exchange about file sharing, which is relevant to
the charge that Moran knowingly distributed the four files that were obtained by the state computer.
During that exchange, Moran said he did not understand how peer-to-peer file sharing worked
before going on to make further statements that suggested he understood well enough. For
example, at one point, Moran acknowledged that someone using the correct peer-to-peer software
would be able to get a picture from a share folder on his computer. And, although he denied having
shared child pornography directly, he ultimately agreed that it was possible he could have shared
it indirectly from a share folder because “that’s how Torrent works when you download stuff.”
Detective Cooper seized the laptop, which was turned over to a computer forensics
examiner with the Kentucky State Police. The examiner, Mike Viergutz, who testified as an expert
witness, found approximately 200 files—including 106 videos and 91 images—which Moran
stipulated at trial contained or consisted of depictions of minors engaging in sexually explicit
conduct. (Gov’t Exh. 8.) About 20 of those files were recovered from the recycle bin. Viergutz
prepared a spreadsheet with detailed information about those files, including creation date,
directory path, file name, and a unique digital identifier called a “hash value.” (Gov’t Exh. 9.)
Although none of the four files retrieved by the state computer was found on Moran’s computer,
Case No. 18-5648 4
United States v. Brandon Moran
file paths remained indicating that those four files had once been in the “c:\downloads folder.”
Viergutz testified that the only recovered internet search history that was relevant to the charges
was a single parsed (i.e., partial) search on Bing for “pedo forum.”
Viergutz extracted a long list of torrent files that had been downloaded to Moran’s
computer with various peer-to-peer programs, which included some torrents with names that
suggested child pornography, two that referenced a known series of child pornography, and others
that had innocuous names or characters (“FrostWire” spreadsheet). (Gov’t Exh. 11.)2 Viergutz
also found two logs on Moran’s computer that were created by the BitComet software: one log
showed downloads made using BitComet (“BitComet MyHistory”) and the other showed files
shared through BitComet (“BitComet MyShares”). (Gov’t Exhs. 10a & 10b.) Those BitComet
logs were the subject of the jury’s question during deliberations.
Testimony about how peer-to-peer networks operate was admitted primarily through
Robert Couchman, the Kentucky State Police Detective who ran the state computers searching for
available child pornography. Briefly, he explained that peer-to-peer networks generally, and
BitTorrent specifically, use the internet to share content directly between computers that have the
same or compatible client software. To find available content, BitTorrent users typically go to an
index site where search terms are entered to find torrent files. The search results are hyperlinks,
which look like a file name, picture, or symbol, and, when clicked on, the torrent file is downloaded
by the user’s client software program. The file name often indicates what the content will be, but
2
The order denying Moran’s post-verdict motion for judgment of acquittal specifically identified the following torrent
file names found on Moran’s computer as indicative of child pornography: (1) “collection01 preteen pedo underagfe
pthc babyshivid Lolita maffiasex hussyfan st. Petersburg Is magazine”; (2) “Falko III (with sound)”; (3) “[pthc]
falkovideo – part 3 . . . 2014 opva preteen loli 10yo 8yo 9yo 11yo 12yo pedo mom family”; (4) “1st-Studio Siberian
Mouse Custom (ND_TA)”; (5) “_cp”; (6) “BabyJ-R@ck (55S) 5yo enjoys gentle fuck from very big dick (R@ygold
Style RCA pedo 9yo Child sex)”; (7) “baby bj”; (8) “Izzy 8yo 1b - Deep throating”; (9) “CBaby 7 - 3yo girl eat cum
(2m44s)”; (10) “awe pthc videos”; (11) Children-W”; (12) PTHC – (=^.^=) Fernanda (12yo) Cumshot In Face [child
kids pedo r@ygold hussyfan]”; (13) “!!!NEW!!!PTHC – (="."=) Fernanda (12yo) Cumshot In Face [child kids pedo
r@gold hussyfan]”; (14) “cP.”
Case No. 18-5648 5
United States v. Brandon Moran
it is possible, for example, that a file called “cat.jpg” actually is a picture of a dog. Also, the torrent
file itself does not contain the content; instead, it is the “package” and provides instructions for
creating a file to receive the content and includes the metadata for the locations where that content
can be retrieved on the network.
Once the user clicks on a torrent file, the user’s software, in this case BitComet, launches
automatically to open the torrent file (similar to how Adobe launches to open a .pdf file) and then
begins to retrieve the content in pieces from other computers if it is available for sharing. The
pieces can consist of whole files or parts of files. If the user who downloads a torrent has not
allowed sharing of files, the download speed is “choked” or slowed down greatly. BitComet
allows sharing of pieces before a whole file is received, and the version of BitComet on Moran’s
computer allowed the user to share by default or to turn off sharing. The state computers monitored
multiple networks for available content suggestive of child pornography, but the state computers
were specially configured to download only from a single IP address and to prevent any content
that was received from being shared.
With respect to the four files that the state computer requested and received from Moran’s
computer on June 6, Couchman testified in detail from a log of the communications between the
computers. In short, when the state computer initiated a “handshake” at 59:17, Moran’s computer
responded that it did not have any of the 92 pieces of those four files available for sharing.
BitComet on Moran’s computer responded that it had only one piece available (which was also
one complete file) at 59:47; and then it communicated that it had all four files as of 1:01:58.
Sixteen second later, at 1:02:14, the state computer received the first complete piece of those files
from Moran’s computer; and, at 1:12:21, the state computer finished receiving all four files from
Case No. 18-5648 6
United States v. Brandon Moran
Moran’s computer. The log also indicated that Moran’s computer was receiving those files as an
“unchoked” download.
Moran moved unsuccessfully for judgment of acquittal at the close of the government’s
proofs and again after the defense rested without presenting any witnesses or other evidence. The
jury found Moran guilty of distributing child pornography on June 6, 2016; receiving child
pornography on May 15 and June 12, 2016; and possessing additional files of child pornography
when his laptop computer was seized on June 14, 2016. The district court denied Moran’s post-
verdict motion for judgment of acquittal, and imposed a below-Guidelines sentence of 138 months
of imprisonment. This appeal followed.3
II.
Reviewing the denial of a motion for judgment of acquittal de novo, this court views the
evidence in the light most favorable to the government and asks whether “any rational trier of fact
could have found the essential elements of the crime beyond a reasonable doubt.” Jackson v.
Virginia, 443 U.S. 307, 319 (1979); see also United States v. Humphrey, 279 F.3d 372, 378 (6th
Cir. 2002). In evaluating the evidence, we “must draw all reasonable inferences from the record
in favor of the prosecution and must avoid the temptation to weigh the evidence anew or assess
the credibility of witnesses.” United States v. Fitzgerald, 906 F.3d 437, 449 (6th Cir. 2018).
Challenging only the conviction for distributing child pornography, Moran argues that the
evidence could not establish that he knew the files constituted or contained child pornography at
the time of distribution.
3
There appears to be no dispute that the receiving and possessing counts each involve distinct videos or images, which
is necessary to avoid a violation of the Double Jeopardy Clause. See United States v. Ehle, 640 F.3d 689, 696-98 (6th
Cir. 2011).
Case No. 18-5648 7
United States v. Brandon Moran
Moran accepts that distribution under 18 U.S.C. § 2252(a)(2) may be established by
showing “that the defendant maintained child pornography in a shared folder, knew that doing so
would allow others to download it, and another person actually downloaded it.” United States v.
Pirosko, 787 F.3d 358, 368 (6th Cir. 2015) (quoting United States v. Budziak, 697 F.3d 1105, 1109
(9th Cir. 2012) (following First, Eighth, and Tenth Circuits)). Although Pirosko addressed this
proposition in a different context, this statement represents a consensus among the circuits that
passive distribution of known child pornography made available for sharing on a peer-to-peer
network constitutes distribution. As the First Circuit explained: “When an individual consciously
makes files available for others to take and those files are in fact taken, distribution has occurred”
and “[t]he fact that the defendant did not actively elect to transmit those files is irrelevant.” United
States v. Chiaradio, 684 F.3d 265, 282 (1st Cir. 2012); see also United States v. Ryan, 885 F.3d
449, 453 (7th Cir. 2018); United States v. Richardson, 713 F.3d 232, 235-36 (5th Cir. 2013).4
Similarly, this court has repeatedly held that a two-level sentencing enhancement for
distribution of child pornography applies when files are knowingly made available through file-
sharing software. See United States v. Abbring, 788 F.3d 565, 567-68 (6th Cir. 2015) (citing cases
interpreting USSG § 2G2.2(b)(3)(F)). The point of using a file-sharing program, we said, “is to
share, sharing creates a transfer, and transferring equals distribution.” Id. at 567 (citing United
States v. Connor, 521 F. App’x 493, 499-500 (6th Cir. 2013)).
4
An analogy adopted by some circuits compares the distribution of child pornography through peer-to-peer sharing
“to that of the owner of a self-service gas station: although the owner might not be present and does nothing when a
motorist purchases gas at the pump, the gas station owner distributes gasoline just as a computer user on a peer-to-
peer network distributes child pornography—by making the material available for other users on the network just as
the gasoline is available to passing motorists.” Richardson, 713 F.3d at 236 (relying on United States v. Shaffer, 472
F.3d 1219, 1223-24 (10th Cir. 2007)). Of course, a gas station owner is also in the business of selling gas. But the
description of passive distribution is illustrative nonetheless.
Case No. 18-5648 8
United States v. Brandon Moran
Moreover, in Abbring, the enhancement applied even though the file sharing occurred at
the same time the defendant was downloading the files. Id. at 567. It did not matter that the peer-
to-peer software in that case did not allow users to disable automatic sharing or that files could not
be moved out of the shared folder until the download had been completed. Id. at 566. This court
explained that all the guidelines require “is the knowing sharing of the files.” Id. at 567–68. As
the Seventh Circuit concluded in Ryan, “[t]here is no reason why this same definition should not
apply when interpreting ‘distribute’ in the criminal statute.” 885 F.3d at 453.
Without denying that knowing distribution was established, Moran argues that no
reasonable juror could conclude that he knew, or could have known, that those files consisted of
or contained child pornography at the time they were distributed. This court has long held that
§ 2252(a)(2) requires knowledge of “the nature of the materials received or distributed.” United
States v. Brown, 25 F.3d 307, 311 (6th Cir. 1994). However, “knowledge of the contents of
material ‘may be proven by circumstantial evidence.’” United States v. Hentzen, 638 F. App’x
427, 431 (6th Cir. 2015) (quoting United States v. Kussmaul, 987 F.2d 345, 350 n.4 (6th Cir.
1993)).
In Hentzen, this court found that circumstantial evidence was sufficient to establish that the
defendant knew the character of the material involved because there was evidence that he searched
for child pornography and viewed it once it was on his computer. Id. at 431-32. That was the case
despite the defendant’s innocent explanations because this court “‘may not reweigh the evidence,
reevaluate the credibility of witnesses, or substitute our judgment for that of the jury.” Id. at 431
(citation omitted); see also United States v. Haymond, 672 F.3d 948, 957 (10th Cir. 2012) (finding
sufficient circumstantial evidence of knowledge where the jury could conclude the defendant used
a peer-to-peer network to search for, click on, and download child pornography).
Case No. 18-5648 9
United States v. Brandon Moran
Here, there was evidence that Moran used peer-to-peer file sharing networks, understood
that any downloaded files in a shared folder could be retrieved by other users on the network, and
knew that child pornography was downloaded to his computer. It is true that the four files sent to
the state computer were not found on Moran’s computer when it was seized, which a jury could
infer meant that the content was not what he was looking for. Nor did the forensic examination
find internet searches for child pornography beyond a single recovered parsed search for “pedo
forum.” Although Moran suggested during his initial interview that he sometimes received content
that he did not want, he also admitted to having clicked on child pornography and admitted that
there was child pornography on his computer. In fact, the forensic examination found about 200
files of child pornography on Moran’s computer, and only about 20 of them had been moved to
the recycle bin. Further, plenty of the file names were consistent with Moran’s stipulation that
they contained or consisted of child pornography.
The jury was entitled to consider Moran’s admissions along with the testimony that
BitTorrent users typically go to an index site and enter search terms when looking for torrent files
to download. Moreover, once a link to a torrent file is found, the user must affirmatively click on
it to download the torrent file and activate BitComet to retrieve the files. Although the specific
torrent file associated with the four distributed files had a non-descriptive name and only some of
the other torrent file names were indicative of child pornography, the jury could infer that Moran
had searched for that content and clicked on it because he expected it to be what he was looking
for.
The district court emphasized that Moran’s computer finished downloading all of the
pieces of all four files before the state computer received anything from Moran’s computer.
However, it is not necessary to prove that Moran actually saw the files prior to the distribution in
Case No. 18-5648 10
United States v. Brandon Moran
order for a reasonable juror to conclude that Moran knew the nature of the material that was
downloaded and made available for sharing. For that reason, it does not matter how short the time
was between when Moran’s computer finished downloading all four files and when the state
computer received the first complete piece at 1:02:14 (16 seconds), or the first complete file at
1:02:35 (2 ½ minutes), or all of the four files at 1:12:21 (12 ½ minutes).
Viewed in the light most favorable to the government, the evidence was sufficient to lead
a reasonable juror to conclude beyond a reasonable doubt that Moran’s search for child
pornography produced a link to the torrent file in question, which Moran activated knowing that
he would receive child pornography in his shared download folder. The district court did not err
in denying Moran’s motions for judgment of acquittal.
III.
This court reviews a district court’s admission or exclusion of evidence for abuse of
discretion. See United States v. White, 492 F.3d 380, 398 (6th Cir. 2007). But even when there is
an abuse of discretion, we reverse only when the error affects the substantial rights of a party. Id.
(citing Fed. R. Evid. 103(a) and United States v. Whittington, 455 F.3d 736, 738 (6th Cir. 2006)).
Moran contends that the district court abused its discretion by allowing Viergutz to offer
certain opinion testimony as a computer forensics expert. Specifically, defense counsel objected
to Viergutz’s testimony that the seven files containing child pornography found in a folder called
“users\Sherry\Pictures” had been “purposely put there as opposed to being directly [put] in the
downloads folder by the default settings” of the peer-to-peer software. Moran argues, as he did at
trial, that this opinion should have been excluded because it was outside the scope of the
government’s pretrial disclosures required by Federal Rule of Criminal Procedure 16(a)(1)(G).
Case No. 18-5648 11
United States v. Brandon Moran
Upon request, the government must give the defendant “a written summary of any
testimony that the government intends to use under Rules 702, 703, or 705 of the Federal Rules of
Evidence during its case-in-chief at trial.” Fed. Rule Crim. P. 16(a)(1)(G). That summary “must
describe the witness’s opinions, the bases and reasons for those opinions, and the witness’s
qualifications.” Id.; see also United States v. Davis, 514 F.3d 596, 612 (6th Cir. 2008).
Here, the government’s disclosure identified Mike Viergutz as a computer forensics expert,
provided a copy of his CV, and indicated that Viergutz would testify to the content of the forensics
report that had also been disclosed. In relevant part, the government’s letter also stated:
Viergutz will testify that when examining the computer seized from the
Defendant’s home, he discovered images and videos of minors engaged in sexually
explicit conduct. Viergutz will explain where he found the images, how they came
to reside there, the file names (some of which are indicative of child pornography),
and whether the images were deleted. Viergutz will also explain that he located
files indicating the computer user received and saved child pornography files.
(Emphasis added.) The record reflects that Viergutz’s report was disclosed to the defense,
including the spreadsheet that provided details regarding the files that contained child
pornography. Viergutz was also made available to defense counsel prior to trial. The district court
overruled Moran’s objection, finding that the testimony about where those files were located and
how they got there was covered by the disclosure and was an obvious inference to be drawn from
the spreadsheet of the files found.
Viergutz’s report does not appear to be in the record, but we know that it included the list
of files containing child pornography with details including the file path locations that were
admitted at trial. Viergutz testified without objection that the version of BitComet on Moran’s
computer directed files to a “downloads” folder as a default. And Viergutz’s testimony that the
files were located in a folder other than the downloads folder fits with the government’s disclosure
that Viergutz would “explain where he found the images[ and] how they came to reside there.”
Case No. 18-5648 12
United States v. Brandon Moran
The district court did not abuse its discretion in finding that the basis for that testimony was
adequately disclosed. Moreover, although the prosecutor’s closing argument referenced
Viergutz’s testimony that a few of child pornography files were found outside of the “downloads”
folder, Moran has not shown that the admission of Viergutz’s opinion that those files had been
deliberately moved affected Moran’s substantial rights.
IV.
Finally, Moran argues that reversible error occurred because the district court failed to
adequately respond to the jury’s question. When, as here, an objection was made, we review the
district court’s response to the jury’s question for an abuse of discretion. United States v. Fisher,
648 F.3d 442, 446-47 (6th Cir. 2011). This court “may reverse a judgment only if the instructions,
viewed as a whole, were confusing, misleading and prejudicial.” United States v. Clark, 988 F.2d
1459, 1468 (6th Cir. 1993).
If the jury is confused about an important legal issue not covered in the jury instructions,
“a district court abuses its discretion by not clarifying the issue.” Fisher, 648 F.3d at 447 (citing
United States v. Nunez, 889 F.2d 1564, 1567-69 (6th Cir. 1989)). However, the judge “should
refrain from straying beyond the purpose of jury instructions by answering jury questions that seek
collateral or inappropriate advice.” Id. (citing United States v. Combs, 33 F.3d 667, 670 (6th Cir.
1994)). And “the court must be careful not to invade the jury’s province as fact-finder.” Nunez,
889 F.2d at 1569.
During deliberations, the jury sent the following written request: “We would like to see
the BitComet search history with key words that the state showed @ the end of her rebut[al]. That
is if it is entered into evidence. Juror 607.” It was clear to everyone—then and now—that the jury
was referring to the BitComet logs admitted as Exhibits 10a and 10b. Because neither of those
Case No. 18-5648 13
United States v. Brandon Moran
logs represented a search history, defense counsel proposed that the jury be told that there was no
BitComet search history. The government argued that the court’s response should not highlight
or comment on the absence of evidence, particularly because it was clear what evidence the jury
was asking to see. Rejecting defense counsel’s proposed language, the district judge sent the jury
the following handwritten response:
What was shown by the prosecutor during her rebuttal closing was a printout of
Gov’t Exh 10a & 10b, which you have on a disc in evidence. Exh 10a is the
BitComet “my history” spreadsheet and Exh 10b is the BitComet “my shares”
spreadsheet.
(The jury’s question did not involve a legal issue requiring clarification, and the district court’s
answer was an eminently appropriate attempt to respond to the jury’s request without commenting
on the evidence. The response also emphasized what the exhibits actually were—as opposed to
what they were not. 5
Moran argues on appeal that the additional clarification he requested was necessary
because the existence of a BitComet search history had been suggested, albeit unintentionally, by
the prosecutor during closing arguments. The record does not support this contention. First, the
passage Moran quotes actually referred to the FrostWire spreadsheet of torrent files found on
Moran’s computer (Exhibit 9). And, the prosecutor’s argument in that regard was that the jury
could infer from the names of some of the torrent file that were downloaded to Moran’s computer
that Moran had searched for child pornography on the various peer-to-peer networks.
Second, the prosecutor also separately described the two exhibits in question as “evidence
that Detective Viergutz was also able to glean directly from BitComet.” Specifically, she argued
that one showed “the titles of the files that were in his MyShares folder” and that the “history of
5
Defense counsel requested that the court respond: “There is not a BitComet search history. On rebuttal, the United
States showed a copy of Exhibits 10A and 10B, BitComet MyShares and MyHistory.”
Case No. 18-5648 14
United States v. Brandon Moran
BitComet” showed the file paths, file size, and the titles of “the files that he had on his computer,
that he got from BitTorrent, that he downloaded via BitComet, and that he was making available
for sharing with others.” Defense counsel argued in closing that the government could not prove
what Moran had searched for when he downloaded the torrent associated with the four files that
the state computer received; that the torrent itself did not have a name indicative of child
pornography; and that the file names would not have been visible when Moran decided to
download them. So, in rebuttal, the prosecutor pointed to “the names of the torrent files” in the
“records BitComet was keeping on the defendant’s computer.”
The jury was urged to look at the BitComet logs showing Moran’s downloads and shared
files to evaluate his assertions of accidental, inadvertent, or unintentional downloads of child
pornography. The district judge did not abuse his discretion in answering the jury’s question about
the evidence in the way he did, and the instructions as a whole were not confusing, misleading, or
prejudicial.
* * *
AFFIRMED.