State v. Ritchie

GILLETTE, J. pro tempore

This case is a companion to State v. Barger, 349 Or 553, 247 P3d 309 (2011). Like the defendant in Barger, defendant was convicted of multiple (in defendant’s case, 20) counts of Encouraging Child Abuse in the Second Degree, ORS 163.686, based on the presence of sexually explicit digital images of children on the hard drives of his computers. Defendant appealed, arguing, among other things, that the state had failed to prove that he “possesse[d] or control[led]” any of the images within the meaning of the Encouraging Child Abuse statute,¹ and that it also had failed to prove venue with respect to some of the charges. The Court of Appeals rejected defendant’s argument with respect to the “possession] or control! ]” element of the charges, but agreed that the state had failed to prove venue with respect to 10 of the counts — Counts 11 through 20. The court therefore reversed defendant’s convictions on Counts 11 through 20 and otherwise affirmed. State v. Ritchie, 228 Or App 412, 423, 208 P3d 981 (2009). Defendant and the state both petitioned for review by this court and we allowed both petitions. On review, we hold that, in view of the disposition that we make today, we need not — and do not — decide whether the evidence presented by the state was sufficient to allow a rational trier of fact to conclude that the conduct at issue occurred in the county where defendant was tried. Rather, we hold that the evidence presented by the state was insufficient to allow a rational trier of fact to conclude that defendant “possesse[d] or control[led]” any of the images at issue (including those associated with the counts for which venue was an issue), within the meaning of the relevant section of ORS 163.686.²

In September 2004, while defendant was working as a music teacher in an elementary school in Clackamas County, officers from the Clackamas County Sheriffs Department went to the school to interview him about a report involving a former student. In the course of the interview, defendant consented to a forensic examination of both his laptop computer, which he had with him at the school, and his desktop computer, which he kept in his home. Defendant turned over his laptop to the officers on the spot and gave the officers permission to enter his home and take the desktop computer.* *³

A police computer specialist, White, examined the desktop computer and discovered 600 pornographic images, most of which were of children, in unallocated space⁴ on the computer’s hard drive. White repeated the procedure with the laptop and found about 500 pornographic images, again primarily of children, in unallocated space in that computer’s hard drive. Virtually all of the images that White discovered were accessible only by means of special data recovery software that forensics experts like White used, but that was not commonly used by ordinary computer users.

The state subsequently charged defendant in Clackamas County Circuit Court with 20 counts of Encouraging Child Sexual Abuse in the Second Degree by “possessing] and controlling] a photograph of sexually explicit conduct involving a child.” Counts 1 through 10 were based on 10 sexually explicit digital images of young boys that had been recovered from unallocated space on the desktop computer’s hard drive, and Counts 11 through 20 were based on 10 similar digital images that had been recovered from unallocated space on the laptop’s hard drive.

Defendant waived his right to a jury trial and the case was tried to the court. The state’s primary witness was White. White described his examination of defendant’s laptop and desktop computers and his discovery of the images that formed the basis of the charges in “unallocated space” in the computers’ hard drives. He explained that “unallocated” space “is basically clusters on the hard drive that may or may not have information written to them. If there’s information written there, it is * * * a file that was deleted.” White then described the process by which deleted files are retained in unallocated space — that, when a “file”^{5 6} is created, the operating system “allocates” the file to a certain location in the hard drive, that a master file table keeps track of that location, and that, when a file is deleted, the data in the file remains in the physical location that originally was allocated, but the master file table is altered to indicate that that location now is “unallocated,” i.e., available to be overwritten by new files. Finally, White explained that, although files in unallocated space generally are not available to a user through ordinary means, they can be recovered with special forensic software like the software that he had used.

White then went on to describe some of the characteristics of the images that he had discovered on the two hard drives, and how he was able to tell that certain of the images had been sent to defendant’s computer by another user while others may have come to the computer from ordinary Internet sites. At some point, the parties announced that they would stipulate that four of the images — those associated with Counts 1, 2, 3, and 4 — had been sent to defendant’s desktop computer in a “zipped folder”⁶ through an Internet chat room by another chat room user, “rasputinlives978,” and that, when the folder reached defendant’s desktop computer, the folder was unzipped in some manner, so that the images within were available for viewing. The parties were not willing to stipulate as to whether the unzipping was an intentional act by defendant or an automatic function of the chat room program. White could not determine whether anyone had ever used defendant’s desktop computer to view the images in that folder. (That was important because, as noted elsewhere, the state’s theory of the case was that defendant had possessed or controlled the digital images in Counts 1 through 4 by displaying them on a computer screen.)

White then testified to some additional matters that were relevant to the parties’ “chat room” stipulation. He testified that the folder at issue was sent to defendant’s desktop computer at 9:24 p.m. on July 7, 2002, and was deleted by midnight of the same day. He also testified that, to receive a zipped folder offered by another Internet chat room user, a computer user generally must affirmatively accept the folder or file. White also produced data collected from defendant’s desktop showing that, in September 2002, defendant’s laptop had received a file entitled “youngyoungboys.mpg” by instant messaging in an apparent swap for another file entitled “13suckbrother.jpg.” Finally, White produced fragments of online “chat” found in unallocated space on defendant’s desktop computer, which suggested that defendant had solicited and received child pornography from other chat room users. In one of those fragments, someone using one of defendant’s acknowledged screen names appeared to be responding favorably to material that a user had shared with him (“I’m taking off my clothes for this one”). In another fragment, a person using one of defendant’s screen names appeared to be inquiring about how to obtain videos (“u have videos?”) that had been mentioned.

The parties also announced that they had entered into a stipulation concerning the digital images taken from the desktop computer that corresponded to Counts 5 through 10 and the images taken from the laptop computer that corresponded to Counts 11 through 20. Specifically, they stipulated that all those digital images were the product of “web browsing,” i.e., searching the Internet. White also provided technological background evidence that was relevant to that stipulation. He explained how files accessed through web browsing might end up in unallocated space: that, when a computer user accesses a web page, the browser creates a copy of the page and stores it in a temporary Internet file cache; that the next time the user calls up the same web page, the browser pulls up the copy from the temporary Internet file cache, rather than accessing and downloading the same information from the web page; that files held in the temporary Internet file cache may be deleted from the cache in a number of ways, some of which occur automatically and some of which require intentional action by a computer user; and that files that are deleted from the temporary Internet file cache remain in unallocated space unless and until they are overwritten by a new file.

In his testimony, White acknowledged that there was no way of knowing, with respect to any of the files associated with Counts 5 through 20, whether the files had been deleted from the temporary Internet file cache intentionally or by some automatic process. He suggested, however, that the temporary Internet file cache appeared to have been emptied or cleaned more thoroughly and more often than would have occurred by purely automatic processes.

Because of the limitations of his forensic software, White was not able to provide further detail about when and from what website the images associated with Counts 11 through 20 (which had been found on defendant’s laptop) had been accessed. He was able, however, to provide a more detailed analysis of the six image files associated with Counts 5 through 10, which had been discovered in unallocated space on defendant’s desktop computer. White testified that, insofar as his forensic software enabled him to see at least some dates, file names, and path histories associated with those images, he could determine that all six of the images came from a “photo album” on a single website, that they initially had appeared on the desktop computer’s screen as a series of “thumbnail” images,⁷ that they had been accessed under one of defendant’s user names on December 8, 2002, and that the user had “clicked” on the thumbnail images to enlarge them, but had not printed, saved, or taken other actions concerning them.

After White completed his testimony, defendant moved for a judgment of acquittal on all counts, arguing that there was no evidence that he had knowingly “possessed or controlled” the images at issue within the meaning of ORS 163.686(l)(a)(A)(i). Defendant also moved for a judgment of acquittal on Counts 11 through 20, i.e., the counts associated with images found on defendant’s laptop, on the ground that the evidence would not support, beyond a reasonable doubt, a finding that those crimes had been committed in Clackamas County. The trial court denied defendant’s motions and, after hearing the remaining evidence, found defendant guilty on all 20 counts.

On defendant’s appeal, the Court of Appeals affirmed in part and reversed in part. The court opined that, for purposes of ORS 163.686(l)(a)(A)(i), a person “controls” a visual recording when the person “discovers the presence of that recording on the Internet and causes that recording to appear on a specific computer monitor.” 228 Or App at 419. The court concluded that there was sufficient evidence in the record to demonstrate that defendant exercised control in that sense over the images associated with Counts 1 through 10, and affirmed the trial court’s findings of guilt with respect to those counts. Id. at 419-20. The court then addressed defendant’s venue argument, which related to the images discovered on defendant’s laptop computer (Counts 11-20). It concluded that the state was required to prove venue beyond a reasonable doubt and that the state’s evidence — that defendant’s home and work were located in Clackamas County, that he had broadband Internet access in his home, and that he generally was logged on to instant-messaging services when at home — was insufficient to support a finding, beyond a reasonable doubt, that defendant and his laptop were in Clackamas County when he downloaded, viewed, and deleted those images. Accordingly, the court reversed defendant’s convictions on Counts 11 through 20. Id. at 420-23.

As noted, both the state and defendant petitioned for review, and we allowed both petitions. As it turns out, however, we need not address the Court of Appeals holding respecting venue, and we express no opinion concerning it. We turn directly to questions about defendant’s “possession] or control! ]” of the images in question.

As noted, the Court of Appeals held that defendant “controlled” the visual recordings of child sexual abuse that were discovered on his desktop computer, within the meaning of ORS 163.686(l)(a)(A)(i), by “discovering] the presence of [such] recording[s] on the Internet and causing them] to appear on a specific computer monitor.” 228 Or App at 419.⁸ Defendant contends that, contrary to the Court of Appeals’ logic, one cannot “knowingly control” an Internet image in that manner, because the act of “discovering” the image and “causing [it] to appear” are simultaneous. Defendant argues that the Court of Appeals is applying the statutory concept of “possession] or control[ ]” to the mere viewing of child pornography on the Internet, and that the legislature did not intend, when it enacted ORS 163.686, to criminalize mere viewing of such images.

The state responds that a rational trier of fact could conclude from the evidence that defendant “possessed or controlled” each of the images associated with the 20 charges. The state argues that, when a person opens a web page and displays images on that page on his or her own computer screen, the person possesses or controls the images that appear on his screen in the course of such browsing in a variety of senses — he physically possesses them insofar as he can move the computer screen and control the way the images are displayed; he constructively possesses them insofar as he has the latent ability to save, forward, or otherwise manipulate them; and he actually controls them by bringing them to his computer screen in the first instance. The state argues, in a nearly identical vein that, when a person accepts a zipped folder sent to him or her through a chat room and, by inference, displays the images contained therein on his or her computer, he or she “possesses or controls” the images in the same three senses — by physically controlling the way they are displayed, by having a latent ability to manipulate them, and by accepting and, thus, actually controlling the transfer.⁹

In Barger, 349 Or 553, we addressed the same explanations for why a user “possesses or controls” any image accessed in the course of web browsing. In Barger, the defendant was charged with “knowingly possessing] or control[ling]” eight images of child sexual abuse that were discovered in his computer’s temporary Internet file cache. The evidence indicated that the images were the product of the defendant’s web browsing, but there was no evidence that he had printed, saved, forwarded, or in any other way done anything beyond accessing the images (and, by inference, looking at them). The case thus posed the following question: “Can a computer user be found to have knowingly ‘possessed] or control[led]’ digital images of child sexual abuse, within the meaning of ORS 163.686(l)(a)(A)(i), based solely on evidence showing that, at some time in the past, he intentionally accessed those digital images using his computer’s Internet browser and — by reasonable inference — looked at them?” 349 Or at 558.

This court ultimately answered that question in the negative. We concluded that the theories of possession and control that the state had offered, which are identical to the ones that the state asserts here, were either illogical in and of themselves or inconsistent with what, in our judgment, the legislature intended by the statutory phrase “possesses or controls.” Id. at 562-66. We particularly derived our conclusions about the intended meaning of the phrase “possesses or controls” from contextual evidence showing that the legislature did not intend to criminalize the mere viewing of child pornography.¹⁰ We also were persuaded by certain cases— notably State v. Casey, 346 Or 54, 203 P3d 202 (2009), State v. Daniels, 348 Or 513, 234 P3d 976 (2010), and State v. Weller, 263 Or 132, 501 P2d 794 (1972)-that discussed common-law notions of physical and constructive possession and the relevant statutory definition of the term “possess,” which incorporates those common-law notions. Because those cases indicate that a person’s constructive possession of a thing (i.e., his or her dominion or control over it) cannot be established merely by showing that the person has a practical ability to manipulate or direct the item, we concluded that something more than a latent ability to save, e-mail, or otherwise manipulate a digital image that appears on a computer user’s screen is required to “possess[ ] or control[ ]” the image within the meaning of ORS 163.686(l)(a)(A)(i). Barger, 349 Or at 562-66.

Barger appears to control our disposition of the present case. It rejects the state’s central idea — that, to the extent that a digitalized image is displayed on a computer screen and, presumably, is viewed by the computer’s user, the computer user “possesses or controls” the image.

That is not to say that the facts in the present case are identical in every way to the facts in Barger. For example, in Barger, there was no evidence that the defendant had taken any intentional action with respect to the images at issue after they appeared on his computer screen; the only inference that could be drawn from the evidence was that the defendant had at some point viewed the images. In the present case, however, there is evidence indicating that defendant enlarged the two images involved in Counts 8 and 9 after he initially accessed the website where they were displayed, and there also is evidence that might support an inference that defendant attempted to remove all traces of the images from his computer’s hard drive. Moreover, while the images in Barger all had been obtained through web browsing, it appears that certain of the images in the present case came to defendant’s computer from a different source. Those images — which are associated with Counts 1 through 4 — apparently were transferred to defendant’s desktop computer through an instant messaging service by another user of the messaging service.

But the state chose not to make a separate issue out of those factual differences. In the proceedings below and before this court, it has never suggested that Counts 1 through 4, or Counts 8 and 9, should be analyzed any differently than the other counts. With regard to all 20 counts, the state’s position has been no different than its position in Barger — that defendant “possessed] or control[led]” the image at issue as long as the image appeared on his computer screen, because he could change the location where the image was displayed, because he had the capacity to save, forward, and manipulate it, and because he controlled it, in the first instance, by taking affirmative steps to bring it to his screen.¹¹ We rejected those arguments in Barger and, applying Barger, we reject them here as well. We conclude, in short, that the evidence presented at trial, with respect to all 20 counts, was insufficient to support a finding of possession or control under any theory of possession or control that the state has urged in this proceeding.

The decision of the Court of Appeals is affirmed in part and reversed in part. The judgment of the circuit court is reversed, and the case is remanded to the circuit court with instructions to enter a judgment of acquittal.

1 The relevant part of ORS 163.686 provides:

“(1) A person commits the crime of encouraging child sexual abuse in the second degree if the person:

“(a)(A)(i) Knowingly possesses or controls any photograph, motion picture, videotape or other visual recording of sexually explicit conduct involving a child for the purpose of arousing or satisfying the sexual desires of the person or another person; [and]

“(B) Knows or is aware of and consciously disregards the fact that creation of the visual recording of sexually explicit conduct involved child abuse[.]”

2 Defendant also raises several constitutional challenges to his convictions: He argues that, on its face, ORS 163.686 violates Article I, section 8, of the Oregon Constitution and that the Ex Post Pacto Clauses of the Oregon and United States constitutions preclude prosecutions under ORS 163.686 when the digital images of child sexual abuse that are involved depict abuse that occurred before the effective date of the statute. In light of our disposition of this case, we need not address those issues.

3 As the case comes to this court, there is no issue concerning either the validity of defendant’s consent or the lawfulness of the subsequent examination of the two computers by the police.

4 The meaning of the term "unallocated space” is described below, 349 Or at 577.

5 White’s testimony was in terms of “files,” and we therefore report it that way. But the testimony was, in a sense, abstract: The state’s theory of the case was (and has continued throughout to be) that defendant “possessed or controlled” the 20 digital images in question by displaying them, on his computer screen, not by having one or more “files” of the images in his computers. A case in which the state asserted that defendant illegally possessed or controlled forbidden digital images by having files of them on his computer that he could potentially access would raise different interpretive problems under ORS 163.686 than those that we address today.

6 A “zipped” file or folder is one that contains data that has been compressed using a mathematical algorithm. The “zipping” process renders the material in the file unreadable until the file is “unzipped” by the recipient. The value of a zipped file or folder is that it can be transmitted from one computer to another more quickly.

7 “Thumbnail” images are small images that usually are presented in groups. Larger versions of the thumbnails may be obtained by clicking on the thumbnail images.

8 The full text of ORS 161.686(l)(a)(A)(i) is set out above, 349 Or at 575 n 1.

9 Before this court, the state observes generally that the crime of Encouraging Child Sexual Abuse under ORS 163.686(l)(a)(A)(i) also can be proved by showing that the defendant understands that files containing sexually explicit images continue to be stored in temporary Internet files or in unallocated space in his or her computer. The state at the same time expressly states that it is not pursuing that “storage” theory on review in this case — in spite of the fact that the trial court alluded to that theory when it denied defendant’s motion for a judgment of acquittal. We assume that the state is not pursuing that theory here because there is no evidence in the record to support it: The images that are associated with all of the charges were discovered in unallocated space on defendant’s computers and there was no evidence presented that suggested that defendant knew or had reason to believe that the digital images might be retained there (although there was evidence that defendant knew or suspected that the digital images might be retained in the temporary Internet file cache).

10 The dissent contends that Barger is incorrect insofar as it treats the act of accessing and “viewing” digitalized images drawn from the web as similar to an act of viewing art in a museum. The dissent argues, in that regard, that images displayed on a computer screen are portable (because a person who has called up an image from a website can move the image from one place to another by moving his or her computer) and controllable (as, for example, when a person replays a specific part of an online video, or skips over uninteresting parts) in a way that art in a museum is not. That argument is unpersuasive for two reasons: First, it depends on the proposition that a mere unexercised ability to move or otherwise physically manipulate something is sufficient to establish possession or control — a proposition that we rejected in Barger. 349 Or at 565. Second, it ignores the fact that our holding in Barger was premised on the absence of any evidence that the defendant there had done anything other than call the images up to his computer screen. If there had heen evidence that defendant had, for example, gone hack and looked at particular scenes in a video, etc., or that he had passed around his computer screen while an image of child pornography was displayed on the screen, we would have faced a different interpretive task.

The dissent also finds significance in the facts that images accessed through web browsing involve an actual transfer of data from a website to a person’s computer and the automatic saving in a temporary Internet file of a copy of the data on the person’s computer. The dissent suggests that that fact makes an analogy to ordinary viewing (as of pictures in a museum) inapt, because the image in fact exists, in digital form, in the user’s computer. But what the dissent fails to acknowledge is that, from the user’s point of view, the experience of viewing images on the web is not different from viewing images in a museum: The ordinary computer user speaks of visiting or “going to” websites, and has no sense that web images are “in” the user’s own computer until the user affirmatively saves them. The computer user’s vision of what is happening when he or she is web browsing is relevant, of course, because the statute criminalizes “knowing possession and control” of child pornography.

11 In fact, it appears that the state’s primary concern in the trial court was with convincing the court that it was possible to infer from other evidence that defendant had actually opened and viewed the images associated with Counts 1 through 4, which had been sent to defendant in a zipped folder through an Internet chat room. The state had to persuade the trial court that such an inference was permissible in order to prevail on those counts under the theory of possession and control that it was advancing.