State v. Ballantyne

543 P.3d 1152

STATE of Kansas, Appellee,

v.Randy Allen BALLANTYNE, Appellant.

No. 125,064

Court of Appeals of Kansas.

Opinion Filed February 2, 2024.

Syllabus by the Court

1.To convict a defendant of sexual exploitation of a child for possession of child pornography under K.S.A. 2018 Supp. 21- 5510(a)(2), the State must prove that a defendant had knowledge of the nature of the visual depiction—meaning, that defendant either knew the essential character or the identity of the visual depiction and that defendant had joint or exclusive control over the visual depiction with knowledge of or intent to have such control or that the defendant knowingly kept the visual depiction in a place where the defendant had some measure of access and right of control. See K.S.A. 2018 Supp. 21-5202(i).

2. Possession, as that term is used in K.S.A. 2018 Supp. 21-5510(a)(2), includes knowingly accessing and viewing child pornography when a defendant has joint or exclusive control over a visual depiction with knowledge of or intent to have such control or knowingly keeps the visual depiction in a place where the defendant has some measure of access and right of control over it on the internet. See K.S.A. 2018 Supp. 21-5111(v).

Appeal from Saline District Court; Jared B. Johnson, judge. Submitted without oral argument.

Michelle A. Davis, of Kansas Appellate Defender Office, for appellant.

Ryan J. Ott, assistant solicitor general, and Kris W. Kobach, attorney general, for appellee.

Before Isherwood, P.J., Green and Pickering, JJ.

Green, J.:

Randy Allen Ballantyne appeals his 26 convictions for sexual exploitation of a child under K.S.A. 2018 Supp. 21-5510(a)(2). The images forming the basis for his convictions were found on his computer. The State had to rely on circumstantial evidence of knowing possession of the files because the State could not directly establish that Ballantyne had downloaded the files to his computer or that he viewed them at all. On appeal, Ballantyne argues the following: (1) that insufficient evidence existed in support of his convictions; (2) that prosecutorial error in misstating the facts deprived him of his right to a fair trial; (3) that the district court erred in instructing the jury; and (4) that cumulative errors require that he be provided a new trial.

Images in unallocated space

Expert testimony established that files in the unallocated space of a computer cannot be accessed or seen without specialized software. No evidence established that Ballantyne knowingly accessed or used any specialized software necessary to retrieve the 25 images in the unallocated space of his computer. Additionally, no evidence established that Ballantyne knowingly accessed and viewed any of the 25 images. Finding insufficient evidence to support Ballantyne’s possession of the 25 images found in the unallocated space of his computer, we reverse the 25 convictions.

Video in recycle bin

Expert testimony established that computer users can access and control files placed by the user into the recycle bin of the computer. We find sufficient evidence to support that Ballantyne was knowingly aware of the presence of the pornographic video found in the recycle bin of his computer and that he knowingly exercised control and influence over the video. We reject Ballantyne’s arguments that prosecutorial error or error in the jury instructions deprived him of a fair trial. Thus, we affirm his conviction under count 26 for possession of child pornography found in the recycle bin of his computer.

We affirm in part and reverse in part.

Facts

The State charged Ballantyne with 25 counts of sexual exploitation of a child under K.S.A. 2018 Supp. 21-5510(a)(2), which prohibits "possessing any visual depiction of a child under 18 years of age shown or heard engaging in sexually explicit conduct with intent to arouse or satisfy the sexual desires or appeal to the prurient interest of the offender or any other person." The State alleged that the crimes occurred on or about March 5, 2019. The State later amended the charging document to add a 26th count of sexual exploitation of a child under K.S.A. 2018 Supp. 21-5510(a)(2), alleging that the crime occurred on or about December 11, 2018.

The case proceeded to a jury trial in December 2021.

The investigation leading to Ballantyne’s convictions began in March 2018. It was then that Microsoft Online, through its search engine BingImage, submitted a tip to the National Center for Missing and Exploited Children that child pornography had potentially been accessed. Microsoft monitors its traffic to identify potential users of child pornography material. The National Center referred the CyberTip report to local authorities.

Shea Carpenter, who worked for the Sedgwick County Sheriff’s Office and was on the Internet Crimes Against Children task force, received the CyberTip report. Carpenter researched the IP address identified in the report and determined that Cox Communications was the internet service provider for that IP address. Cox Communications identified the subscriber associated with the IP address as Ballantyne’s mother in Salina. Carpenter contacted the Salina Police Department with the information.

Detective Aaron Carswell with the Salina Police Department investigated the tip. He began his investigation by visiting Ballantyne’s residence along with another officer. Ballantyne answered the door. Detective Carswell told Ballantyne that he had received a tip that child pornography had been downloaded to the Ballantyne IP address.

Ballantyne’s computer, an HP laptop, was in his bedroom. Ballantyne said he was the only person in the house to use the laptop. His mother did not use the internet in the home. Ballantyne denied having any inappropriate photos of children on his computer. Ballantyne said he had set up the laptop so that it could not download anything. Detective Carswell thought that sounded strange, and Ballantyne was not able to explain how he was able to set up the computer to not download data. Ballantyne also said there had been attempts to hack his computer and that it might have some viruses.

Detective Carswell procured a warrant to search the residence and removed Ballantyne’s laptop from his bedroom. Detective Carswell transferred the computer to Carpenter, who then transferred it to forensic examiner Detective Michael Randolph.

Detective Randolph then analyzed Ballantyne’s computer. Through his examination, Detective Randolph recovered 26 items that he believed depicted child sexual exploitation. Twenty-five items were in the unallocated space on the computer. One file was in the recycle bin which is considered allocated space.

Detective Randolph explained at trial the difference between allocated and unallocated space. For example, when a file is created, either by the user or by the computer itself, the file is saved in the allocated space on the computer’s hard drive. The place where the file is stored on the drive is allocated to the file. When files are deleted, the space that was previously assigned to the file is treated as unallocated space. The unallocated space still contains the data, or may contain the data, but since it is no longer assigned to a file, it is not considered part of the allocated space. If the computer needs space later, it may overwrite data in the unallocated space. Average computer users cannot access data in the unallocated space—doing so requires specialized software. Detective Randolph did not find evidence of any such software on Ballantyne’s computer.

When a user creates a file, for example a Microsoft Word document, the file remains in the allocated space until the user deletes it. The normal deletion process involves placing the file in the Windows recycle bin. Files in the recycle bin remain in allocated space. When the user empties the recycle bin, the file system considers the file deleted. Though the file system considers the file deleted, the data remains on the system in the unallocated space until such a time as that unallocated space is used for new files.

Computers may also create files automatically which are also stored in allocated space. When a person is browsing the internet, for example, the computer will save images that appear on a webpage. The purpose of this function is to speed up the web browsing experience. When a person scrolls through a webpage, it is quicker for the computer to read from the files stored in its own hard drive than to wait to receive those images through the internet. These temporary files are stored in allocated space. After a period of time, the system deletes these files automatically. For some computers, the temporary cache files are deleted when a person ends a web browsing session and closes the browser. When these files are deleted, they are no longer designated by the computer as existing in the allocated space. But the data remains in the unallocated space until written over.

Images saved automatically by computers are not necessarily seen by the computer user. An example provided at trial was performing a search for fishing lures. If a webpage has 200 pictures of fishing lures, but only a few are visible on the screen, the computer will store files of all 200 pictures on the webpage to a temporary file cache. In this way, Detective Randolph explained, a picture can be downloaded to a person’s computer without the person ever seeing the picture because it was not visible on the screen. Though the user controls which websites he or she visits, the user does not control which images from those websites are saved in the browser cache.

The 25 files Detective Randolph found in the unallocated space could not be recalled by Ballantyne without the assistance of specialized software not present on his computer. Detective Randolph could not determine whether Ballantyne or the computer had deleted the files from the allocated space. He also could not say what date the files were deleted, or whether t...