Fields v. Commonwealth

644 S.W.3d 480

Michael FIELDS, Appellant

v.COMMONWEALTH of Kentucky, Appellee

2019-SC-0663-DG

Supreme Court of Kentucky.

OCTOBER 28, 2021

COUNSEL FOR APPELLANT: Michael Jay O'Hara, David Bryan Sloan, Covington, Jessica Nadine Wimsatt, Lexington, O'Hara, Taylor, Sloan & Cassidy.

COUNSEL FOR APPELLEE: Daniel J. Cameron, Attorney General of Kentucky, Mark Daniel Barry, Assistant Attorney General.

OPINION OF THE COURT BY JUSTICE HUGHES

An investigation by the Office of the Attorney General cybercrimes unit led investigators to discover child pornography files on Michael Fields's desktop computer and external hard drive. After a jury trial he was convicted of four counts of possession of matter portraying a sexual performance by a minor, Kentucky Revised Statute (KRS) 531.335, and sentenced to ten years in prison by the Scott Circuit Court. On appeal, the Court of Appeals found no error and affirmed. Fields contends that the trial court improperly disqualified his sole expert witness, erred by denying his motion for directed verdict, and impermissibly admitted various photos and reports as evidence. On discretionary review, this Court concludes that the trial court committed no reversible error and thus affirms the judgment.

FACTS AND PROCEDURAL HISTORY

Fields used Limewire, a now-defunct file-sharing program, to download and share music, videos and images. His goal was to acquire over 10,000 songs. In downloading files, Fields also amassed several thousand clips of adult pornography. According to Fields, if another Limewire user had music he liked, he would download every file in the other user's library—Fields did not preview or search through the entire library prior to downloading. Instead, Fields used the "select all" command to highlight all the user's files and hit the download button, downloading hundreds of files at a time. Fields intended to sort and catalogue the files later—retaining the files he wanted and deleting the others—but he was downloading so many files it became difficult to keep up. Fields steadfastly maintains that he had no idea child pornography was amongst the thousands of files he downloaded from Limewire. He was aware of the adult pornography, some of which he viewed with his wife.

In January 2010 Investigator Tom Bell of the cybercrimes branch of the Attorney General's office investigated online computers that were advertising, via peer-to-peer networks, that they had files available for sharing that matched known signatures of child pornography. Bell identified an IP address advertising approximately 156 files with these known child pornography signatures.¹ The IP address, which belonged to Fields, was using the file-sharing software Limewire. Bell executed a search warrant at Fields's home in March 2010, seizing a laptop from the living room, a desktop computer from the bedroom, an external hard drive and numerous CDs and DVDs. An initial forensic examination of Fields's computers and external hard drive tagged 126 images and 41 videos as suspected child pornography. On September 3, 2010 a Scott County grand jury indicted Fields on 105 counts of possession of matter portraying a sexual performance by a minor. Given how long the case had been pending, prior to the 2017 trial Bell conducted a supplemental examination of Fields's computers and external hard drive and concluded that the devices contained 48 images and 7 videos of child pornography.² He explained that his supplemental review revealed that some of the images and videos did not meet the child pornography criteria, citing reasons such as the questionability of the subject's age, the subject being clothed, or the absence sexual activity. The indictment was later amended on May 5, 2017 to ten counts, two counts related to videos and eight counts related to images.

Fields was originally represented by private counsel. In 2014 private counsel obtained an order from the Scott Circuit Court allowing a computer expert to conduct an independent forensic examination of Fields's two computers. Over a year passed, and private counsel withdrew, citing differences with Fields as to trial strategy and communication. The Department of Public Advocacy was subsequently appointed to represent Fields. One month before trial, the trial court granted defense counsel's motion for funding to hire a computer expert for Fields. This expert was a different expert than the one hired by private counsel; it is unclear whether private counsel's expert ever examined Fields's computers.

At trial the Commonwealth's sole witness was Investigator Bell. Bell explained how peer-to-peer file sharing programs like Limewire work, namely that users make files available to other users. Bell noted that the files forming the basis for the indictment had titles containing child pornography buzzwords, like "Lolita," "kiddie," "pthc,"³ "pedo," and others. He also acknowledged that titles for non-pornography files sometimes included these terms. Bell testified that he conducted a forensic review of Fields's computers,⁴ but found no evidence that Fields performed searches using child pornography terms. Instead, the data obtained from Fields's computer was consistent with bulk downloading. Because the evidence did not show that Fields was specifically seeking out child pornography on Limewire, the Commonwealth's case hinged on whether Fields knew that his large collection of downloads contained child pornography. The testimony established that file titles are often misleading and inaccurate, so to "know" that he had child pornography, Fields would have had to preview or open the files on his desktop computer.⁵

The Commonwealth introduced Exhibits 1-10, which were either images or videos of suspected child pornography that corresponded with Counts 1-10 of the indictment. The Commonwealth introduced each image by having Bell read the file name before briefly displaying the image or video to the jury.

Investigator Bell's evidence on Fields's file viewing was primarily circumstantial. He testified that Fields used Real Player, Windows Media Player, and other video and image viewing programs to open files with provocative names, some of which included child pornography buzzwords. But, on cross-examination, Bell admitted that none of the provocatively named files viewed with those programs were necessarily child pornography.⁶

In a final effort to prove that Fields knew he had child pornography, on the second day of trial, Bell provided the Commonwealth with a new exhibit extracting highly technical information from his previously provided report. As to the images that formed the basis for Counts 2, 4, 6 and 9, Bell testified that Fields's computer history reflected that those files had been opened. In support of that assertion, Bell noted that Fields's File Explorer history logged those four files with the prefix "file:///C:." The File Explorer in Windows allows a user to view the information on their computer in a hierarchical structure of drives, folders and files. If the preview pane feature of File Explorer is enabled a user can quickly preview a file, such as a photo, without opening it by single clicking on the file's name or icon.⁷ Bell testified that the three-forward-slash prefix meant that the files had been "opened."

On cross-examination, Bell backtracked slightly, acknowledging that he could not prove that Fields "opened" the four files in the traditional sense – none of the files were opened in the video or image viewing programs, such as Windows Media Player and Photo Viewer, that the computer would use by default to open image or video files. Instead, Bell posited that the three-forward-slash prefix meant that Fields viewed the child pornography files with File Explorer's preview pane. Fields attempted to refute this theory with information from Bell's report showing that Fields's computer history logged a three-forward-slash prefix for multiple items in relatively quick succession – ten seconds, twenty seconds, etc. But Bell adamantly insisted that the three-forward-slash prefix proved that Fields personally interacted with the files, giving him knowledge of their contents.

In an effort to counter Bell's testimony, Fields attempted to present his own computer forensics expert, Matthew Considine from Cyber Agents, Inc. While testifying about his qualifications, Considine admitted that he had not previously performed a forensic evaluation of a computer involving Limewire during his professional career. However, Considine testified that he had a four-year degree in digital forensics and had two class sessions about Limewire during his education. He also testified that he had personal experience using the program "as a child." Based on Considine's lack of professional experience involving Limewire, the trial court sustained the Commonwealth's objection to him testifying as an expert and excluded his testimony. Fields subsequently presented Considine's testimony by avowal, testimony which focused on Limewire and the discrepancy between file titles and their actual contents. Considine also discussed how users can search for files and that irrelevant results often appear while searching. Importantly, Fields's counsel failed to ask Considine anything about Bell's report, the three-forward-slash prefix's meaning in Windows, or how the File Explorer in Windows functions.

Based on the above-described testimony, the jury convicted Fields of knowingly possessing the four child pornography files that Bell testified were logged with the three forward slashes and therefore "viewed" by Fields. After the verdict, Fields hired private counsel who represented him in post-trial proceedings and at sentencing. The trial court sentenced Fields to two and one-half years on each count, to run consecutively, for a total sentence of ten years in prison.

ANALYSIS

Fields presents four arguments: the trial court (1) improperly denied a directed verdict; (2) erred in excluding Matthew Considine as an...