State v. Beck

242 W.Va. 2

828 S.E.2d 821

STATE of West Virginia, Plaintiff below, Petitioner

v.Daniel BECK, Defendant below, Respondent

No. 18-0936

Supreme Court of Appeals of West Virginia.

Submitted: May 14, 2019

Filed: June 6, 2019

Rhonda L. Wade, Esq., Eric M. Gordon, Esq. Andrea C. Poling, Esq., Marshall County Prosecuting Attorney’s Office, Moundsville, West Virginia, Patrick Morrissey, Esq., Attorney General, Lindsay S. See, Esq., Solicitor General, Charleston, West Virginia, Counsel for the Petitioner

Kevin L. Neiswonger, Esq., Neiswonger & White, Moundsville, West Virginia, Counsel for Respondent

WALKER, Chief Justice:

In this case we consider a certified question concerning West Virginia Code § 61-8C-3 (2014) and child pornography found in the cache files of a defendant’s laptop computer. Respondent Daniel Beck (Beck) is charged with one count of violating § 61-8C-3. By order entered October 19, 2018, the circuit court certified the following question to this Court:

Is possession of a laptop computer containing cache files that relate to material visually portraying a minor and/or minors engaged in sexually explicit conduct, without evidence of when or where said cache files were created and/or accessed enough to establish the defendant knowingly and intentionally possessed the material contained on said cache files in violation within the meaning [sic] of West Virginia [C]ode §[ ]61-8C-3(a)?^{[1 ]}

The circuit court answered this question, "No."

As the State acknowledges, the thrust of that question is "whether the evidence in this case is sufficient to sustain a conviction for possession of material depicting minors engaged in sexually explicit conduct" under § 61-8C-3(a). We decline to respond to that question, though, because our answer would be an impermissible advisory opinion that depends on disputed questions of material fact—namely the state of mind of the defendant.²

Nevertheless, there is a legal issue in the question certified by the circuit court that can be addressed at this point in the proceedings against Beck. We have held that it is appropriate to reformulate a certified question when it

is not framed so that this Court is able to fully address the law which is involved in the question, then this Court retains the power to reformulate questions certified to it under both the Uniform Certification of Questions of Law Act found in W. Va.Code, 51-1A-1, et seq. and W. Va.Code, 58-5-2 [1967], the statute relating to certified questions from a circuit court of this State to this Court. Syllabus Point 3, Kincaid v. Mangum, 189 W.Va. 404, 432 S.E.2d 74 (1993).^{[3 ]}

Under the authority granted to this Court by West Virginia Code § 58-5-2 (2012), we reformulate the circuit court’s certified question as follows:

May a jury consider images of a minor engaged in sexually explicit conduct, contained in the temporary Internet cache files on a defendant’s computer, as evidence of a violation of West Virginia Code § 61-8C-3(a). Answer: Yes.

I. Case Background and Procedural Posture

On November 14, 2017, a grand jury returned a one-count indictment that charged Beck with violating West Virginia Code § 61-8C-3(a) and - 3(b) (2014). The indictment alleged that on or about February 23, 2017, Beck knowingly possessed fifteen images or files on his computer and that those images visually portrayed minor children engaged in sexually explicit conduct.⁴

On May 18, 2018, the parties filed a joint motion to certify a question to this Court addressing the issue of cache files. Prior to certifying the question, the circuit court held a hearing to hear testimony about cache files from a State witness, Matthew Adams (Adams). Adams is an investigator for the Ohio County Prosecuting Attorney’s Office, and, for purposes of the hearing, Beck stipulated that Adams is expert in cyber-investigation and recovery and acquisition of computer data. Adams testified about the characteristics of cache files and their contents. He explained that a computer user does not intentionally download information, including images, from the Internet to cache files. Instead, a computer’s web browser automatically downloads information to the computer’s cache files when the user views a website that displays images. The browser does this to enable a computer user to access that website more quickly in the future. In other words, the information contained in the cache files enables the user to return to a website without having to download the entire site again.

Adams explained that while a user has the ability to delete cache files from his computer, the user does not intentionally create the files, in contrast to images that he downloads and intentionally saves to his computer:

Circuit court: So a download of a file is different than a cache of a picture?

Adams: Yes, sir. The way we’re speaking about it today, yes, sir.

Circuit court: But a cache would indicate that that website or that particular picture was viewed or this computer connected with some computer that had that image and it shows that in this example his computer accessed that file?

Adams: Yes, sir. That’s correct.

Circuit court: If he manually or with purpose saved it to the computer, you can tell that?

Adams: Yes, sir.

Circuit court: As a download file?

Adams: Yes, sir.

Circuit court: But if it’s a cache, that’s something that the computer does by default?

Adams: That’s correct.

Adams also explained that he can use software called Forensic Tool Kit to extract images from cache files even when a computer is not connected to the Internet. But Forensic Took Kit is not available to the general public. And without it, Adams testified, a lay person cannot access an image directly from a cache file and would have to seek out that image on the Internet in order to see it again.

Following the hearing, the circuit court granted the parties’ motion to certify a question to this Court. That question is as follows:

Is possession of a laptop computer containing cache files that relate to material visually portraying a minor and/or minors engaged in sexually explicit conduct, without evidence of when or where said cache files were created and/or accessed enough to establish the defendant knowingly and intentionally possessed the material contained on said cache files in violation within the meaning [sic] of West Virginia [C]ode §[ ]61-8C-3(a)?

The circuit court answered the question "No," then stayed the matter pending this Court’s answer to the certified question.⁵

II. Standard of Review

"The appellate standard of review of questions of law answered and certified by a circuit court is de novo [,]"⁶ meaning that "we give plenary consideration to the legal issues that must be resolved to answer the question" certified by the circuit court.⁷

III. Discussion

Beck is charged with violating subsection (a) of West Virginia Code § 61-8C-3. In pertinent part, that statute provides:

(a) Any person who, knowingly and willfully, sends or causes to be sent or distributes, exhibits, possesses, electronically accesses with intent to view or displays or transports any material visually portraying a minor engaged in any sexually explicit conduct is guilty of a felony.

We found a prior version of § 61-8C-3(a) to be unambiguous.⁸ We find the current version of the statute is similarly clear so we accept the statute’s plain meaning.⁹

Numerous state and federal cases have analyzed the implications of child pornography stored in temporary Internet cache files. These authorities instruct that child pornography contained in cache files may be used in at least two ways in a prosecution under § 61-8C-3(a), as contraband or as circumstantial evidence.

A. Method 1: Cached Images of Child Pornography as Contraband

First, child pornography stored in the cache files on a defendant’s computer may be the "material visually portraying a minor engaged in any sexually explicit conduct"—that is, the actual offense contraband. Under this approach, the images of child pornography stored in the cache files on the defendant’s computer are themselves the material banned by the statute.¹⁰ As one commentator has explained,

Under this approach, the computer is analogous to a file cabinet and the cache is a file drawer. The user has reached out to the Internet through use of a web browser and selected an image, after which the computer automatically "files" a copy of that image in its file drawer. Viewed this way, the possession of the image begins when the image is cached and ends when the file is deleted and overwritten by other data.^{[11 ]}

But, the presence of cached images of child pornography on a defendant’s computer—standing alone—cannot prove that the defendant actually possessed that contraband. As the State’s expert Adams testified, when a computer user visits a website, the computer’s browser automatically saves the images displayed on that page to the computer’s cache files. Thus, those images exist in the cache files although the user may not know that they are there.¹² Exactly for that reason, we cannot conclude that the mere presence of child pornography in cache files on a particular computer proves that the individual who controls that computer knowingly and willfully possesses child pornography in violation of § 61-8C-3(a).¹³

Under the contraband approach the State may still proceed on a theory that the defendant constructively, rather than actually, possessed the cached images.¹⁴ Our analysis of constructive possession in State v. Cummings is instructive.¹⁵ There, Cummings argued that the State had not proven at trial that he constructively possessed matches and pseudoephedrine (items commonly used to make methamphetamine) seized from a vehicle when the State’s only evidence of possession was Cummings’s status as the vehicle’s driver.¹⁶ We rejected the State’s theory that Cummings’s presence in the stopped vehicle was enough to prove constructive possession at trial¹⁷ and, instead, adopted the rule that "the State must prove beyond a reasonable doubt that ...