United States v. Moreland

Case: 09-60566 Document: 00511695314 Page: 1 Date Filed: 12/14/2011

IN THE UNITED STATES COURT OF APPEALS

FOR THE FIFTH CIRCUIT United States Court of Appeals

Fifth Circuit

FILED

December 14, 2011

No. 09-60566 Lyle W. Cayce

Clerk

UNITED STATES OF AMERICA,

Plaintiff-Appellee

v.

KEITH MORELAND

Defendant-Appellant

Appeal from the United States District Court

for the Northern District of Mississippi

Before JOLLY, DeMOSS, and DENNIS, Circuit Judges.

DENNIS, Circuit Judge:

The defendant-appellant, Keith Moreland (“Keith”), was convicted by a

jury of knowing possession of child pornography, 18 U.S.C. § 2252A(a)(5)(B)

(2006), sentenced to 51 months imprisonment and five years of supervision after

release, and ordered to register as a sex offender. At trial, the prosecutor

introduced 112 digital images of alleged child pornography that a Columbus,

Mississippi city police officer found in two home computers that Keith and his

wife, Deanna, owned and kept in their house in Columbus. Because Keith’s

father, George Moreland (“George”), was terminally ill and required assisted

living, he resided with Keith and Deanna off and on during 2007 and until his

death in January 2008. The police obtained possession of the Morelands’ two

Case: 09-60566 Document: 00511695314 Page: 2 Date Filed: 12/14/2011

No. 09-60566

computers on September 28, 2007. During several months prior to September 28,

2007, the two computers had been subject to joint custody, control, and use by

Keith, Deanna, and George. George, who slept in the living room, frequently

used the computers late at night when Keith and Deanna were asleep and

during the day while Keith was at work. George, Keith, and Deanna each had

access to and free use and control of Keith’s username, password, and Yahoo!

account on the computers. The police never interviewed or investigated George

about his use of the computers or pornography. George died in January 2008.

Subsequently, Keith was indicted in May 2008 with knowing possession of child

pornography. He was tried and convicted of that charge by a jury in 2009.

Keith appeals his conviction. He argues that the evidence was insufficient

to rationally support a jury in finding beyond a reasonable doubt that he, rather

than George or another person, knowingly possessed the 112 images found on

the two computers. After viewing all of the evidence in the light most favorable

to the guilty verdict, we conclude that no reasonable jury could find beyond a

reasonable doubt that Keith had (1) knowledge that the 112 images were in the

computers; or (2) possession of the images, that is, the power and ability to

access and exercise dominion or control over them. Thus, we are required to

reverse the district court’s judgment of conviction.

I. Background of Law and Computer Technology

The “exploitive use of children in the production of pornography has

become a serious national problem.” New York v. Ferber, 458 U.S. 747, 749

(1982). In Ferber, the Supreme Court held that child pornography is

distinguishable from other sexually explicit speech. Child pornography is not

2

Case: 09-60566 Document: 00511695314 Page: 3 Date Filed: 12/14/2011

No. 09-60566

protected by the First Amendment because the State has a “compelling” interest

in safeguarding the well-being of minors. Id. at 756-57. “The prevention of sexual

exploitation and abuse of children constitutes a government objective of

surpassing importance.” Id. at 757; see also Ashcroft v. Free Speech Coalition,

535 U.S. 234, 239 (2002). Therefore, while pornography may warrant First

Amendment protection and can be banned only if it is found to be obscene, see

Miller v. California, 413 U.S. 15 (1973), pornography that depicts minors can be

proscribed whether or not the images are obscene. Ashcroft, 535 U.S. at 240.

Moreover, the Court has held that the State’s interest in protecting children

from exploitation also justifies criminalizing the possession of pornography that

is produced using children. Osborne v. Ohio, 495 U.S. 103, 110-11 (1990); see also

Ashcroft, 535 U.S. at 250 (affirming Osborne while striking down a statutory

provision that outlawed possession of virtual child pornography because real

children were not exploited in its production). “The freedom of speech has its

limits; it does not embrace certain categories of speech, including defamation,

incitement, obscenity, and pornography produced with real children.” Ashcroft,

535 U.S. at 246.

The state’s power to criminalize child pornography and to prosecute

individuals for possession of child pornography is not unlimited. See Ferber, 458

U.S. at 764 (noting that “[t]here are . . . limits on the category of child

pornography which . . . is unprotected by the First Amendment”). “As with

obscenity laws, criminal responsibility [for child pornography] may not be

imposed without some element of scienter on the part of the defendant.” Id. at

765.

3

Case: 09-60566 Document: 00511695314 Page: 4 Date Filed: 12/14/2011

No. 09-60566

Keith was convicted of the knowing possession of child pornography in

violation of the federal Protection of Children Against Sexual Exploitation Act,

18 U.S.C. § 2252A(a)(5)(B) (2006). At the time that he was charged, the statutory

provision prohibited, in pertinent part, “knowingly possess[ing] . . . any . . .

material that contains an image of child pornography that has been . . .

transported . . . in . . . interstate or foreign commerce by any means, including

by computer.” Id. Child pornography is defined therein as “any visual depiction

. . . involv[ing] the use of a minor engaging in sexually explicit conduct; . . . or .

. . [any] visual depiction [that] has been created, adapted, or modified to appear

that an identifiable minor is engaging in sexually explicit conduct.” 18 U.S.C. §

2256(8). Thus, to secure Keith’s conviction, the government had to prove beyond

a reasonable doubt that Keith knowingly possessed digital visual images of real

children engaging in sexually explicit conduct. The term “knowingly” extends

both to the age of the performers and the sexually explicit nature of the material.

United States v. X-Citement Video, Inc., 513 U.S. 64, 78 (1994).

Although the Supreme Court upheld a prohibition against both possessing

and viewing child pornography, see Osborne, 495 U.S. 103, at the time of Keith’s

offense, the federal statute and the majority of state statutes criminalized

“knowing possession,” but not mere “viewing,” of child pornography.1 The term

1

In 2008, the federal statute was amended to also criminalize “knowingly access[ing

child pornography] with intent to view.” Protection of Children Against Sexual Exploitation

Act, 18 U.S.C. § 2252A(a)(5)(B) (2006). The majority of states do not criminalize viewing child

pornography. See, e.g., Fla. Stat. § 827.071(4)-(6) (2010); La. Rev. Stat. Ann. § 14:81.1 (2006);

Miss. Code Ann. § 97-5-33 (2003); Tex. Penal Code Ann. § 43.26 (West 2011). Some states

criminalize possession or control of child pornography. See, e.g., Colo. Rev. Stat. § 18-6-403

(2009). A small minority of states criminalize viewing child pornography. See Alaska Stat.

§ 11.61.123 (2009); Ark. Code Ann. § 5-27-602 (2010); N.J. Stat. Ann. § 2C:24-4 (2010); Ohio

Rev. Code Ann. § 2907.323 (West 2010); 18 Pa. Cons. Stat. § 6312(d) (2009). The federal

statute also criminalizes knowing receipt of child pornography, see 18 U.S.C. § 2252A(a)(2)

4

Case: 09-60566 Document: 00511695314 Page: 5 Date Filed: 12/14/2011

No. 09-60566

“knowingly possess” is not defined in the statute. “[I]n interpreting the term,

[federal courts] are guided by its ordinary, everyday meaning.” United States v.

Tucker, 305 F.3d 1193, 1204 (10th Cir. 2002); see also United States v.

Hildenbrand, 527 F.3d 466, 476 (5th Cir. 2008) (“Absent a statutory definition

or definitive clue, the meaning [of a statutory term] must be given its ordinary,

‘everyday meaning.’” (citation omitted)); United States v. Dobbs, 629 F.3d 1199

(10th Cir. 2011) (using ordinary meaning to analyze the term “receives” under

a related statute, 18 U.S.C. § 2252(a)(2)). Possession is defined as “the holding

or having something (material or immaterial) as one’s own, or in one’s control.”

Oxford English Dictionary (2d ed. 1989); see also United States v. Simpson, 94

F.3d 1373, 1380 (10th Cir. 1996) (defining “knowing possession” in the drug

context as encompassing situations in which an individual “knowingly hold[s]

the power and ability to exercise dominion or control” over the narcotics

(quotation omitted)); Webster’s New Collegiate Dictionary (11th ed. 2008)

(defining “possession” as “the act of having or taking into control”).

Child pornography can be distributed digitally over the internet and

personal computers. As child pornographers have become more tech savvy, so

have law enforcement officers and prosecutors. With the assistance of forensic

software, a skilled investigator can recover data from a computer that the user

thought was deleted or never even knew existed. In order for investigators,

prosecutors, and courts to properly analyze such evidence in the context of a

criminal prosecution for the knowing possession of child pornography, they must

have a basic understanding of how individual computers and the internet

interrelate and work. The major parts of a computer that come into play in a

(2006). Keith was not charged with this offense.

5

Case: 09-60566 Document: 00511695314 Page: 6 Date Filed: 12/14/2011

No. 09-60566

typical case are its cache, its temporary internet files, and its unallocated slack

space.2

When a computer user views a webpage, the computer automatically

stores a copy of that webpage in a folder known as the cache. Ty E. Howard,

Don’t Cache Out Your Case: Child Pornography Possession Laws Based on

Images Located in Temporary Internet Files, 19 Berkeley Tech. L.J. 1227, 1229-

30 (2004). The copy is retained in a file called a temporary internet file. When

the user revisits that webpage, the computer can load the page more quickly by

retrieving the version stored in the cache. Id. at 1230. The computer

automatically deletes temporary internet files when the cache — which has

limited storage space — becomes full. Once full, the computer begins to delete

the files on a “first in, first out” basis. Note, Child Pornography, The Internet,

and the Challenge of Updating Statutory Terms, 122 Harv. L. Rev. 2206, 2212

(2009). Users also may manually delete files from the cache, or use commercial

software to remove the files. Id.

Deleted files are not wholly removed from the computer. A deleted file is

marked as unallocated file space, which allows that file to be overwritten by new

files. See Michele C.S. Lange & Kristin M. Nimsger, Electronic Evidence and

Discovery: What Every Lawyer Should Know Now 208-09, 235-36 (2d ed. 2009).

A computer’s deleted files make up what is known, in this case, as the disk slack

space. A knowledgeable forensic investigator may use forensic software to search

2

Files found in the disk slack space are sometimes called “orphan files,” as it is difficult

or impossible to trace their origin or date of download. See United States v. Kain, 589 F.3d 945,

948 (8th Cir. 2009) (“Orphan files are files that were on the computer somewhere saved but

were subsequently deleted, so the computer doesn’t know exactly where they came from.”

(internal quotation marks omitted)).

6

Case: 09-60566 Document: 00511695314 Page: 7 Date Filed: 12/14/2011

No. 09-60566

for, recall, and view the contents of the unallocated file space. This process is

known as “restoring” a deleted, but not yet overwritten, file. It requires

sophisticated expertise and special software to restore a deleted file. See, e.g., id.

at 78, 231, 235-36 & fig. 5.8; Howard, supra, at 1234 n.22 (citing Joan E.

Feldman, The Basics of Computer Forensics, 12 Practical Litig. 17, 19-20 (2001);

and Richard Hardy & Susan Kreston, “Computers are like Filing Cabinets . . .”:

Using Analogy to Explain Computer Forensics, 15 Nat’l Ctr. for Prosecution of

Child Abuse Update Newsl. No. 9 (Nat’l Dist. Attorneys Ass’n, Alexandria, Va.),

2002).

Investigators may also utilize index.dat files in prosecuting child

pornography cases. The index.dat file is a record of all visited websites, as well

as the date and time that the site was last visited. Howard, supra, at 1235 n.26.

II. Factual Background

A.

Keith Moreland lived in a house in Columbus, Mississippi with his wife

Deanna and their three children. In 2007, George Moreland, Keith’s father, who

was dying of cancer, stayed at Keith and Deanna’s house for several months, off

and on, sleeping on the living room couch. There were two computers in the

house: a desktop, located in the living room, and a laptop. Keith, Deanna, and

George each had free access to and consistently used both computers. According

to Deanna, George regularly used both computers, including late at night and

at other times when Keith and Deanna were absent or not in the living room.

On September 28, 2007, Deanna was using the desktop computer and

noticed a URL (an internet address) in the web browser’s history which

7

Case: 09-60566 Document: 00511695314 Page: 8 Date Filed: 12/14/2011

No. 09-60566

contained the words “Teen Topanga.” She testified that she clicked on it and

found what appeared to be a pornographic website, where she saw pictures of

“girls” who “appeared to be underage” and were “dressed, you know, very

provocative” but were not nude. Deanna then found the same URL in the web

browser history on the laptop computer as well.

Deanna was upset and called Keith, who was at work, to tell him what she

had found. Keith was a supervisor at a company called American Eurocopter,

where he regularly worked 10-to-12-hour days and was “responsible for the

planning and outlay of work programs throughout the day,” and had “about 14

to 16” employees working under him. According to Deanna, Keith “didn’t really

seem alarmed at all” and “said, well, you know, I haven’t looked at anything like

that. I don’t know how it got there. We’ll talk about it when I get home.” Keith

worked late that day, as he often did.

After speaking with Keith, Deanna called the sheriff’s department. She

testified that a friend of hers had suggested that she call the police. The deputy

who came to the house asked Deanna to turn the two computers over to the

police, and she did so. She also decided to pack a few things and take the

children to her parents’ house, because she expected to have a heated argument

with Keith when he came home from work, and did not like to argue in front of

the children. Deanna later testified that she was “concerned about what Keith’s

position would be with regards to his father.” When Keith returned home from

work, Deanna and the children had gone to her parents’ house. The following

morning, Keith went to compete in a bass fishing tournament with a friend.

While he was at the tournament, he received another phone call from Deanna,

at which point he walked back home.

8

Case: 09-60566 Document: 00511695314 Page: 9 Date Filed: 12/14/2011

No. 09-60566

In January 2008, Keith’s father, George, died. Subsequently, on May 27,

2008, Keith was charged with possessing child pornography in violation of 18

U.S.C. § 2252A(a)(5)(B) (2006).3

B.

The trial took place on January 6 and 7, 2009. At trial, the government

introduced and displayed to the jury slide photos of 112 digital images that had

been taken from the hard drives of the Moreland household’s two computers. The

jury was given only 3 to 5 seconds to view each of these images. At the time the

images were shown, the jury had not been given any instruction as to the legal

definition of child pornography. After the jurors were later instructed, they did

not again view the images or expressly determine which images were child

pornography.

3

At the time the defendant was charged, this statutory provision, in pertinent parts,

prohibited “knowingly possess[ing] . . . any . . . material that contains an image of child

pornography that has been . . . transported . . . in . . . interstate or foreign commerce, by any

means, including by computer.” 18 U.S.C. § 2252A(a)(5)(B) (2006). The government, though

it introduced evidence showing that the computers themselves were manufactured in a foreign

country, did not introduce any evidence at trial that the 112 digital images found on the

Morelands’ two home computers had been transported in interstate or foreign commerce. One

federal court of appeals has held that a defendant’s mere connection to the Internet does not

satisfy the requirement of proof that the files or images in question were actually transported

in foreign or interstate commerce. United States v. Flyer, 633 F.3d 911, 918 (9th Cir. 2011)

(citing United States v. Wright, 625 F.3d 583, 595 (9th Cir. 2010)). However, the defendant did

not raise the insufficiency of evidence on this essential element of the crime below or present

argument on it on appeal. The commerce clause nexus element in the statute is not

“jurisdictional” in the sense that a failure of proof would divest the federal courts of

adjudicatory power over the case. See United States v. Ternus, 598 F.3d 1251, 1254 (11th Cir.

2010); see also United States v. Sealed Appellant, 526 F.3d 241, 243 & n.4 (5th Cir. 2008)

(quoting United States v. Martin, 147 F.3d 529, 531-32 (7th Cir. 1998)); United States v.

Lasaga, 328 F.3d 61, 63-64 (2d Cir. 2003); United States v. Robinson, 119 F.3d 1205, 1212 n.4

(5th Cir. 1997). Therefore, we do not consider or decide this issue; nor is it necessary to our

disposition of this appeal.

9

Case: 09-60566 Document: 00511695314 Page: 10 Date Filed: 12/14/2011

No. 09-60566

The government relied upon Matthew Manley, a Columbus, Mississippi

police officer, to examine the Morelands’ two home computers and testify as to

his findings. He was not offered, qualified, or accepted as an expert in child

pornography or in forensic computer technology. He testified that he had

received 160 hours in computer training and was serving as a computer

investigator for the city police department. Manley said that he could only testify

as to the facts of what he found on the Morelands’ two computers. Because of the

lack of information in the computers, Manley said he could not testify as to

where the images had come from, when they were received or deleted, or who

was operating the computer at those times; also, he testified that he could not

express an opinion as to whether any particular image was child pornography.

Manley testified that he performed a forensic examination of the

computers using software called Forensic Toolkit (FTK). He used FTK to process

the data on the computers’ hard drives, and to look for and recover deleted files.

He recovered “tens of thousands of images,” and flagged only those that he

thought might possibly contain child pornography. The prosecutor then selected

the 112 images to present to the jury and place into evidence. Because a

computer does not save the source or date of a file when the file is deleted,

Manley was unable to recover information pertaining to where the images had

come from or when they entered the computer. He also testified that he was

unable to recover data showing when the images had been deleted. He testified

that “[t]he majority of the [images] that were found on both computers were

found in the disk slack space. They had been deleted and, you know, were not

able to be fully recovered as far as date, time stamps, and things like that to

know when they were deleted, but the images were able to be recovered.” He

10

Case: 09-60566 Document: 00511695314 Page: 11 Date Filed: 12/14/2011

No. 09-60566

later indicated that a few images had come from other places in the computers,

but he did not explain which ones those were or where he had found them.

Manley also testified that deleted files can continue to exist on a computer’s hard

drive and be recovered: “When [a person] . . . hit[s] the delete button . . . that file

just isn’t immediately scrubbed from [the] hard drive. The way Windows and

most operating systems work is, it just goes in there and delete the first string

of code, which is known as the header, which tells Windows, I now have that

space free in there. It doesn’t mean that it’s automatically deleted off of the

computer. It’s just available for that space.” Thus, Manley testified that he had

recovered most of the 112 digital images that the government introduced at trial

from the computers’ unallocated slack spaces, indicating that they had been

deleted but had not yet been overwritten, and therefore could be recovered.

Manley also testified in respect to the computers’ index.dat files, which

reflected the computers’ internet browsing history. Manley explained that an

index.dat file “basically makes a bread crumb trail of where you’ve been and

what sites you’ve been to and the last time you were there.” Approximately

twenty index.dat files on the laptop were considered to have evidentiary value;

together, the files contained “thousands of pages of listings.” He did not testify

about how far back in time the index.dat files went, what date ranges were

contained in the twenty index.dat files that were found to have evidentiary

value, or how many files were not entered into evidence. Manley initially stated

that, on print-outs of the index.dat files, he “highlighted in pink every web site

that was visited that was pornographic,” but later clarified that he limited his

pink highlighting to “web sites that are still up that were of teen in nature

pornography sites,” and furthermore noted that he highlighted websites that he

11

Case: 09-60566 Document: 00511695314 Page: 12 Date Filed: 12/14/2011

No. 09-60566

guessed might be pornographic based on the title, but could not verify that they

contained illegal child pornography.4 The government did not introduce into

evidence any images from these websites. Manley admitted on cross-examination

that some such websites advertise themselves suggestively as underage sexually

explicit websites by their names and other features, but, ultimately when they

are inspected, they turn out not to be unlawful child pornography websites but

legal adult pornography websites.

Manley found usage patterns showing that a user of the computers had

visited a website that might have contained child pornography shortly after or

shortly before visiting the Yahoo! website where the user checked email or

played dominoes. As Manley acknowledged, however, this evidence did not

indicate who actually visited those sites. Keith was not the only person who used

the computers prior to Manley’s inspection of them sometime in October 2007.

For several months prior to September 28, 2007, Keith’s father, George, lived in

the Morelands’ living room and used the family’s computers often and as he

pleased. On cross-examination, Manley testified that the data revealed that the

suspected pornographic websites were visited by someone using the computers

in 2007. Thus, as he admitted, Manley could not identify whether it was George,

Deanna, Keith, or another person who was using the computers when the usage

patterns occurred. Specifically, Manley acknowledged that anyone who knew

Keith’s password could log on to the computers and use Keith’s accounts on

4

The federal statutory definition of child pornography, as relevant here, requires a

depiction of “a minor engaging in sexually explicit conduct.” 18 U.S.C. § 2256(8). A minor is

“any person under the age of eighteen years.” 18 U.S.C. § 2256(1). “Teen pornography” is not

defined by law and may involve eighteen- or nineteen-year-old teenagers, which is adult

pornography that is not illegal unless it is obscene. See id.

12

Case: 09-60566 Document: 00511695314 Page: 13 Date Filed: 12/14/2011

No. 09-60566

them; and that if Keith logged on to one of the computers, put his password in

and got up and left it on, subsequently another person could come and use that

computer in Keith’s name and account.

Manley testified that the laptop computer had only one user account,

which “had the user name of Keith Moreland.” The desktop computer had three

user accounts, in the names of Keith, Deanna, and their son. George did not have

a separate user account on either computer. According to Deanna, Keith “was

always logged on” from both computers to his Yahoo! account on the internet.

Therefore, she testified, she did not need a password to access his account, and

that she used his Yahoo! email account to check and send email. Manley

confirmed that if someone remained logged on to their account, anyone using

that computer could access the account, and that he could not testify as to who

actually was using the computer at any given time. Deanna further explained

that because their household had cable wireless internet, rather than dial-up,

the computers were always logged into the internet, and that Keith was always

logged in to his Yahoo! account. She also testified that Keith “has the same

password for everything,” and that she knew the password.

Deanna testified that she had not looked at child pornography on the

computers and that she had never seen anyone in her home looking at any kind

of pornography. Keith also testified that he had not looked at child pornography

on the computers. According to Deanna and Keith’s uncontradicted testimony

at trial, George often used both computers in the Moreland household while he

was staying at their house. Deanna testified that it was “not uncommon” for

George to use the computers at night when the rest of the family went to bed.

According to Keith, “My father always logged in under my name. My name was

13

Case: 09-60566 Document: 00511695314 Page: 14 Date Filed: 12/14/2011

No. 09-60566

always up [on the computers], and that’s what he used. . . . [George] didn’t have

an account on my computer. He did everything in my name.” Deanna further

testified that George “was a character that I was very suspicious of,” explaining

that George “was definitely into pornography. He would readily admit it to

anybody that would listen. I always felt he had a guilty conscience, because he

would just put it out there, and it was a little awkward. So that was common

knowledge. Everybody that knew the man knew that.” She also testified that she

told the police that she suspected her father-in-law when she spoke with them

a second time, but that the police did not give her “much of an opportunity to say

anything.”

Eric Moreland, Keith’s brother and George’s son, corroborated Deanna’s

and Keith’s testimony about George. Eric lived with his wife, Kayla, next door

to George’s house in Gatman, Mississippi. He testified that he had known “for

a long time” that George “had an issue with viewing adult material.” Eric

testified that after George learned that Keith’s computers were being

investigated for child pornography, George “contacted me and asked me to bring

his computers to him at the residence he was staying and proceeded to ask me

to destroy it, to take the hard drive out of the machine and get rid of it.”

According to Eric, “I told [George] I wasn’t actually going to do that, but I would

take it apart and let him destroy it hisself. As far as I know, he destroyed it. I

have no idea where it’s at at this point. I just assumed that he got rid of it.”

Kayla, Eric’s wife, also testified that “right after all of this came up” – referring

to the police’s investigation of Keith’s and Deanna’s computers – George called

Eric and asked Eric to pick up George’s computer from George’s house and bring

it to George’s current residence. She stated that Eric brought George his

14

Case: 09-60566 Document: 00511695314 Page: 15 Date Filed: 12/14/2011

No. 09-60566

computer, and then George “had something done with it.” Eric and Kayla both

testified that after George died, they cleaned out George’s house and found a

large amount of pornographic material, including magazines and videotapes.

With regard to this testimony concerning George’s obsession with

pornography and his destruction of his own computer, the prosecution attempted

to discredit the testimony of Keith, Deanna, Eric, and Kayla on cross-

examination. The prosecution challenged the four witnesses for not informing

the police of George’s conduct. The law enforcement officers who testified at trial

acknowledged that Deanna had mentioned George to them in connection with

their investigation, but denied that she ever specifically informed them that

George had access to the computers. The record does not indicate that the police

ever interviewed George or investigated him in connection with his use of the

computers or with the 112 photographic images found on the two computers in

the Moreland household.

The prosecutor attempted to discredit and show the partiality of Deanna,

Eric, and Kayla through his examination of Deanna — who appeared as both a

government and defense witness — and his cross-examination of the other

Moreland family members. Beyond this, however, the government did not

present any affirmative evidence that called into question those witnesses’

testimony, including their description of George’s affinity for pornography and

his actions to destroy his own computer’s hard drive after the police obtained

custody of Keith’s and Deanna’s home computers. Moreover, the prosecutor

introduced no evidence to dispute Keith’s and Deanna’s testimony that she and

George had used Keith’s password and accounts continually to operate the two

home computers. For instance, the government introduced no evidence to show

15

Case: 09-60566 Document: 00511695314 Page: 16 Date Filed: 12/14/2011

No. 09-60566

that George had his own separate Yahoo! account that he had used while staying

at Keith and Deanna’s house; or to show that the computers were ever used by

Deanna or George to access any Yahoo! account other than Keith’s. Thus, the

undisputed evidence of record establishes that at least three adults, Keith,

Deanna, and George, had access to the Morelands’ home computers and had

access to Keith’s Yahoo! account prior to September 28, 2007 when Deanna

turned the computers over to the police.

III. Analysis

A. Standard of Review

Keith argues that the evidence was constitutionally insufficient to carry

the government’s burden of proof beyond a reasonable doubt as to two essential

elements of the crime5: first, that the evidence was insufficient to support a

finding beyond a reasonable doubt that Keith, rather than George or another

person, possessed the images that are the basis of the conviction; and second,

that the evidence was insufficient to support a finding beyond a reasonable

doubt that whoever possessed the images had actual knowledge that they were

child pornography. Because Keith properly preserved his argument regarding

the insufficiency of the evidence as to his knowing possession of child

5

We do not address, inter alia, the defendant’s argument that Manley gave expert

testimony about how computers work without being tendered or qualified as an expert,

making his testimony on that subject inadmissible under Fed. R. Evid. 701(c). See United

States v. Garcia, 413 F.3d 201, 215 (2d Cir. 2005). Nor do we address the argument that the

prosecutor deprived the defendant of due process by commenting at trial on his exercising his

right to remain silent after his arrest. See United States v. Laury, 985 F.2d 1293, 1304 (5th

Cir. 1993). We also do not address Keith’s argument that the prosecution failed to prove that

the 112 digital images are actual child pornography and not depictions of youthful-looking

adults or virtual or artificial minor child images.

16

Case: 09-60566 Document: 00511695314 Page: 17 Date Filed: 12/14/2011

No. 09-60566

pornography by moving for a judgment of acquittal after the close of all the

evidence, this court’s review is de novo. See United States v. Williams, 602 F.3d

313, 314-15 (5th Cir.), cert. denied, 131 S. Ct. 597 (2010). We conclude that the

evidence was insufficient to support a finding beyond a reasonable doubt that

Keith knowingly possessed the images in the computers because the evidence

does not sufficiently demonstrate that a rational jury could find beyond a

reasonable doubt that Keith had knowledge that the images were in the

computers or that Keith had the requisite knowledge and ability to access them

and to exercise dominion or control over them.

B. Due Process Requirements

Keith argues that his conviction violated the Due Process Clause of the

Fourteenth Amendment, which forbids conviction “‘except upon proof beyond a

reasonable doubt of every fact necessary to constitute the crime with which [the

defendant] is charged.’” Jackson v. Virginia, 443 U.S. 307, 315 (1979) (quoting

In re Winship, 397 U.S. 358, 364 (1970)). This requirement “provides concrete

substance for the presumption of innocence — that bedrock ‘axiomatic and

elementary’ principle whose ‘enforcement lies at the foundation of the

administration of our criminal law.’” Winship, 397 U.S. at 363 (quoting Coffin

v. United States, 156 U.S. 432, 453 (1895)).

Despite the importance of this constitutional principle, judges must be

highly deferential to the jury’s verdict of conviction: courts “view[] the evidence

in the light most favorable to the prosecution.” Jackson, 443 U.S. at 319; see also

United States v. McNealy, 625 F.3d 858, 870 (5th Cir. 2010) (citing United States

17

Case: 09-60566 Document: 00511695314 Page: 18 Date Filed: 12/14/2011

No. 09-60566

v. Harris, 293 F.3d 863, 869 (5th Cir. 2002)).6 Here, “[i]n deciding whether the

evidence was sufficient, we review all evidence in the light most favorable to the

verdict to determine whether a rational trier of fact could have found that the

evidence established the essential elements of the offense beyond a reasonable

doubt.” United States v. Shum, 496 F.3d 390, 391 (5th Cir. 2007).

That said, in viewing the evidence in the light most favorable to the

prosecution, we “consider the countervailing evidence as well as the evidence

that supports the verdict in assessing sufficiency of the evidence.” United States

v. Brown, 186 F.3d 661, 664 (5th Cir. 1999) (internal quotation marks omitted).

We also will draw upon only “reasonable inferences from the evidence to support

the verdict.” United States v. Percel, 553 F.3d 903, 910 (5th Cir. 2008) (quoting

United States v. McDowell, 498 F.3d 308, 312 (5th Cir. 2007)) (internal quotation

marks omitted).“[A] verdict may not rest on mere suspicion, speculation, or

conjecture, or on an overly attenuated piling of inference on inference.” United

States v. Rojas Alvarez, 451 F.3d 320, 333 (5th Cir. 2006) (alteration in original)

(quoting United States v. Pettigrew, 77 F.3d 1500, 1521 (5th Cir. 1996)) (internal

quotation marks omitted); see also United States v. D’Amato, 39 F.3d 1249, 1256

(2d Cir. 1994) (“[A] conviction based on speculation and surmise alone cannot

6

As the Supreme Court recognized in Jackson v. Virginia, “[A] properly instructed jury

may occasionally convict even when it can be said that no rational trier of fact could find guilt

beyond a reasonable doubt . . . . In a federal trial, such an occurrence has traditionally been

deemed to require reversal of conviction.” 443 U.S. at 317. We remain highly deferential to

jury verdicts, but are obligated, as judges, to reverse a conviction where, having viewed all

evidence in the light most favorable to the prosecution, we must conclude that the record

cannot support a conclusion that the prosecution established guilt beyond reasonable doubt.

Id. at 318-19; United States v. Ragan, 24 F.3d 657, 659 (5th Cir. 1994) (“Although the strict

nature of this standard demonstrates our reluctance to interfere with jury verdicts, this case

is an example of why courts of appeal must not completely abdicate responsibility for

reviewing jury verdicts.”).

18

Case: 09-60566 Document: 00511695314 Page: 19 Date Filed: 12/14/2011

No. 09-60566

stand.”). Courts cannot “credit inferences within the realm of possibility when

those inferences are unreasonable,” United States v. Quattrone, 441 F.3d 153,

169 (2d Cir. 2006). In keeping with this standard, we have held that no

reasonable jury could convict a defendant where the government has done

nothing “more than pile inference upon inference” to prove guilt. McDowell, 498

F.3d at 314; United States v. Maseratti, 1 F.3d 330, 337 (5th Cir. 1993); see also

United States v. Sandlin, 589 F.3d 749, 757-58 (5th Cir. 2009) (reversing a

defendant’s sentencing enhancement because it found that the evidence for

enhancement was supported by “nothing beyond speculation”). The government

must do more to support a conviction. McDowell, 498 F.3d at 314. We also have

held that no reasonable jury could find a defendant guilty of an offense where

the “evidence gives equal or nearly equal circumstantial support to a theory of

guilt, as well as to a theory of innocence.” United States v. Ferguson, 211 F.3d

878, 882-83 (5th Cir. 2000); United States v. Jaramillo, 42 F.3d 920, 923 (5th

Cir. 1995). Convictions based on such evidence must be reversed. Ferguson, 211

F.3d at 882-83. This standard must be applied with explicit reference to the

substantive elements of the criminal offense as defined by law. Jackson, 443 U.S.

at 324 n.16.

C. Sufficiency of the Evidence

1. Joint Custody vs. Constructive Possession

In order to obtain a conviction under 18 U.S.C. § 2252A(a)(5)(B) (2006), the

government must prove beyond a reasonable doubt that Keith knowingly

possessed material that contained an image of child pornography that had been

transported in interstate or foreign commerce by any means, including by

computer. Keith contends that the evidence was insufficient to prove beyond a

19

Case: 09-60566 Document: 00511695314 Page: 20 Date Filed: 12/14/2011

No. 09-60566

reasonable doubt that he possessed any such image of child pornography or that

he did so knowingly.

Possession may be either actual or constructive. United States v.

Mergerson, 4 F.3d 337, 348 (5th Cir. 1993); United States v. McKnight, 953 F.2d

898, 901 (5th Cir. 1992). “Actual possession means the defendant knowingly has

direct physical control over a thing at a given time.” United States v. Munoz, 150

F.3d 401, 416 (5th Cir. 1998). “Constructive possession is the ownership,

dominion or control over an illegal item itself or dominion or control over the

premises in which the item is found.” United States v. De Leon, 170 F.3d 494,

496 (5th Cir. 1999). Because there was no evidence that Keith had direct

physical control of any of the 112 digital images in the computers, the

prosecution tried this case as a “constructive possession” case.

The government may prove constructive possession by circumstantial

evidence. Id.; United States v. Jones, 133 F.3d 358, 362 (5th Cir. 1998).

Dominion, control, and knowledge, in most cases, may be inferred if a defendant

had exclusive possession of the place in which the contraband is found, but this

inference cannot be sustained if the defendant shared joint occupancy of the

place. United States v. Crain, 33 F.3d 480, 486 (5th Cir. 1994); Mergerson, 4 F.3d

at 349. “[W]here . . . a residence is jointly occupied, the mere fact that

contraband is discovered at the residence will not, without more, provide

evidence sufficient to support a conviction based upon constructive possession

against any of the occupants.” Mergerson, 4 F.3d at 349 (second alteration in

original) (internal quotation marks omitted); accord United States v. Mills, 29

F.3d 545, 549 (10th Cir. 1994); United States v. Ford, 993 F.2d 249, 252 (D.C.

Cir. 1993); United States v. Sullivan, 919 F.2d 1403, 1431 (10th Cir. 1990);

20

Case: 09-60566 Document: 00511695314 Page: 21 Date Filed: 12/14/2011

No. 09-60566

United States v. Reese, 775 F.2d 1066, 1073 (9th Cir. 1985). When the

government seeks to prove constructive possession of contraband found in a

jointly occupied location, it must present additional evidence of the defendant’s

knowing dominion or control of the contraband, besides the mere joint occupancy

of the premises, in order to prove the defendant’s constructive possession.

Mergerson, 4 F.3d at 349. A conviction based upon constructive possession will

be upheld only where the prosecution has proven that there is “something else

(e.g., some circumstantial indicium of possession) . . . besides mere joint

occupancy” that “support[s] at least a plausible inference that the defendant had

knowledge of and access to the . . . contraband.” Id.

Based on our review of the evidence in the light most favorable to the

guilty verdict, we conclude that there was not sufficient evidence for a rational

jury to find beyond a reasonable doubt that Keith knowingly and constructively

had possession of the 112 digital images found in the computers’ slack space.

Because the government attempted to prove that Keith had constructive

possession of the images, and the two computers had been in the joint custody

and use by Keith with George and Deanna, the government was required to

introduce evidence, in addition to the evidence of mere joint custody, to support

a reasonable inference both that Keith knew that the images were in the

computers and that Keith had the knowledge and ability to access the images

and to exercise dominion or control over them. The evidence—both direct and

circumstantial, together with the reasonable inferences to be drawn

therefrom—is sufficient if, when taken in the light most favorable to the

government, a reasonable jury could find the defendant guilty of all of the

essential elements of the crime beyond a reasonable doubt. In this case, however,

21

Case: 09-60566 Document: 00511695314 Page: 22 Date Filed: 12/14/2011

No. 09-60566

the government failed to come forward with sufficient proof to justify a rational

jury in finding a reasonable inference of Keith’s knowledge of, access to, or

dominion or control over the 112 digital images in the computer; thus, the

evidence is not sufficient to support a reasonable jury in finding that Keith had

constructive possession of the images or that he was guilty beyond a reasonable

doubt.

The government’s arguments to the contrary are not persuasive or

meritorious. First, the government argues that Officer Manley’s testimony

provided additional facts that, when considered with the prosecution’s other

evidence, formed the basis for a finding beyond a reasonable doubt that Keith

knowingly exercised dominion or control over the digital images in the

computers’ slack space. We disagree for several reasons.

Manley admitted that he could only testify to the data that he found in the

computers. He further acknowledged that he could not determine from the data

in the computers where the 112 images he found there had come from, when

they had entered the computers, or when they had been deleted and

redesignated as slack spaces on the computers’ hard drives. He also

acknowledged that he could not tell from the data in the computers who, i.e.,

whether Keith, George, Deanna, or another person, was using the computers

when the computers received the 112 images; or when the computers deleted the

images and redesignated them as unallocated slack spaces on the computers’

hard drives; or when the computers visited websites that he suspected of

containing child pornography.7 He did not produce, and the government did not

7

Indeed, Manley highlighted and flagged a portion of the index.dat files that showed

that someone other than Keith, who was using Keith’s user name, accessed Keith’s Yahoo!

accounts within minutes of going to a suspected teenage pornographic website at 5:43 p.m. on

22

Case: 09-60566 Document: 00511695314 Page: 23 Date Filed: 12/14/2011

No. 09-60566

introduce, any evidence from those websites to prove that they contained child

pornography. Thus, Manley was unable to determine whether any of the 112

images found in the computer came from any of the websites that the index.dat

files indicated the computers had visited. In sum, Manley did not provide any

testimony or evidence from which it could reasonably be inferred that Keith had

ever seen the 112 images; knew that they were in the computers; or that Keith

had the knowledge and ability to access those images or exercise dominion or

control over them. Manley further testified that he could not express an opinion

on whether any particular image found in the computers was child pornography.

We do not reach the issue of whether the images met the statutory definition of

child pornography, however, because the government failed to introduce

sufficient evidence to establish Keith’s culpability beyond a reasonable doubt

even if the 112 images were child pornography.

Second, the government argues that Keith’s statements and conduct after

Deanna called him at work on September 28, 2007 to tell him what she had

found on the computers provides circumstantial evidence besides the mere joint

custody of the computers that furnished the jury with a basis for reasonably

September 28, 2007, Coordinated Universal Time, which was 12:43 p.m. local time. Both

parties agree that Keith was at work at that date and time and could not have been the home

computer operator; instead, it appears most likely that the user of the home computer in that

instance was Deanna. Rather than serving as proof that Keith was the computer user who

accessed the suggestively named websites, this is evidence that persons other than Keith had

access to his Yahoo! accounts and could and did access his account within moments of

accessing a lewd website. Evidence from the index.dat files that someone accessed Keith’s

Yahoo! account around the time that someone accessed suggestively lewd websites does not

provide additional facts beyond mere joint custody, from which it could reasonably be inferred

that Keith had knowledge of the images or the ability to access them and exercise dominion

or control over them, because that evidence does not show that Keith, rather than George or

another member of the household, accessed those websites.

23

Case: 09-60566 Document: 00511695314 Page: 24 Date Filed: 12/14/2011

No. 09-60566

inferring that Keith knew about the 112 images in the computers and that he

had the knowledge and ability to access the images and exercise dominion or

control over them. The linchpin of the government’s argument is its bare

assertion or speculation that if Keith had been ignorant of the images in the

computers, he would have gone home immediately to inspect the computers and

to upbraid his seriously ill father and to throw him out of the house; rather than

replying, as he did, by saying he didn’t know the images were there because he

hadn’t looked at anything like that; and that he would look into the matter when

he got off work. We do not believe the government’s assertion or speculation is

reasonable or supports a plausible inference of Keith’s knowledge of, access to,

or dominion or control over the 112 images. The government does not point to

any facts or evidence in the record to support its assertion or speculation that a

person’s failure to react so drastically and harshly to his dying father under

these circumstances is grounds for a reasonable inference of his guilt of

knowingly possessing child pornography.

In our previous joint occupancy cases, this court has adopted a

“commonsense, fact-specific approach” to determining whether constructive

possession was established. Mergerson, 4 F.3d at 349 (quoting United States v.

Smith, 930 F.2d 1081, 1086 (5th Cir. 1991)) (internal quotation marks omitted).

We have found constructive possession in such cases only when there was some

evidence supporting at least a plausible inference that the defendant had

knowledge of and access to the weapon or contraband. Id. (citing McKnight, 953

F.2d at 902 (upholding conviction where the weapon was found in plain view);

and Smith, 930 F.2d at 1086 (same)). In the instant case, the digital images were

not in plain view, but were in the computers’ unallocated slack spaces, which are

24

Case: 09-60566 Document: 00511695314 Page: 25 Date Filed: 12/14/2011

No. 09-60566

accessible only to a knowledgeable person using special computer software, and

there was no circumstantial indicium that established that Keith knew of the

images or had the ability to access them.

Thus, we hold that the evidence supporting Keith's conviction of knowing

possession of child pornography is constitutionally insufficient.

2. Comparison With Exclusive Possession Cases

The proof deficiency here is underscored by a comparison with other

federal courts of appeals’ decisions holding that, even when the defendant has

exclusive possession of his computer, evidence of storage of child pornography

images in the hard drive of a defendant’s computer, without more, is insufficient

to sustain a conviction or sentence for knowing possession or receipt of child

pornography; and that in exclusive possession cases in which convictions have

been upheld, the government has presented additional evidence of the

defendant’s knowledge, access and control of the child pornographic images.

In United States v. Dobbs, 629 F.3d 1199 (10th Cir. 2011), the Tenth

Circuit concluded that Dobbs’ conviction for receipt and attempted receipt of

internet child pornography must be reversed because the evidence was

insufficient to support the jury’s finding of guilt. Id. at 1209. The prosecution

proved only that two child pornography images were found in the cache of Dobbs’

computer. Id. at 1202. The court found that this evidence was insufficient to

support Dobbs’ conviction because the prosecution failed to demonstrate that

Dobbs knew about his computer’s automatic caching function, had seen the

images, or had any ability to exercise control over them. Id. at 1205, 1207.

Therefore, the Tenth Circuit determined that while a jury could conclude from

25

Case: 09-60566 Document: 00511695314 Page: 26 Date Filed: 12/14/2011

No. 09-60566

that evidence that Dobbs — or at least his computer — received the images, no

reasonable jury could find that he knowingly received the images.

In Dobbs, the court specifically rejected the prosecution’s argument that

proof of Mr. Dobbs’ pattern of seeking out and downloading internet child

pornography was sufficient circumstantial evidence to support Dobbs’ conviction,

because the prosecution could not show that Dobbs conducted a search for child

pornography or visited child pornography websites “immediately prior to the

creation of those two images in the cache.” Id. at 1204. Therefore, proof of illegal

searches was still insufficient where those searches could not be linked to the

pornographic images for which the defendant had been indicted.

The Ninth Circuit also has demanded more than the mere presence of

child pornography images in a computer’s hard drive to prove knowing

possession, when those images are found in an area of the computer that non-

expert users do not know about or cannot access. In United States v. Kuchinski,

469 F.3d 853 (9th Cir. 2006), the defendant appealed his sentence because the

court had taken into account additional images recovered on his computer after

he pleaded guilty to receiving and possessing different child pornography

images. Id. at 857. The court vacated his sentence because the additional images

were found in the cache and the prosecution had offered no evidence to show that

Kuchinski was a “sophisticated” computer user, had ever tried to access the

cache, or “even knew of [its] existence.” Id. at 862. The court therefore found that

“[w]here a defendant lacks knowledge about the cache files, and concomitantly

lacks access to and control over those files, it is not proper to charge him with

possession and control of the child pornography images located in those files,

without some other indication of domination and control over the images. To do

26

Case: 09-60566 Document: 00511695314 Page: 27 Date Filed: 12/14/2011

No. 09-60566

so turns abysmal ignorance into knowledge and a less than valedunarian grasp

into dominion or control.” Id. at 863.

Cases in which we and other circuits have upheld convictions for

possession of digital images of child pornography are as telling as the cases in

which the convictions were overturned. Affirmation of convictions have been

based on substantially more evidence than a defendant’s mere ownership and

custody of the computer. In fact, the evidence introduced in those cases tended,

independently of ownership or custody of the computer, to prove the defendant’s

knowledge and possession of the unlawful images or material concealed in the

computer’s hard drive. When the images are stored in inaccessible areas of a

hard drive or could have been downloaded and retained by a computer’s

automatic processes without the computer owner’s knowledge — such as

temporary internet files or, as here, in the computer’s disk slack space — courts

have treated as determinative whether the defendant had sufficiently expert

computer knowledge to know about and access those files or whether there were

independent facts that showed the defendant’s knowledge and dominion of child

pornography images on the computer.

For example, in United States v. Winkler, 639 F.3d 692 (5th Cir. 2011), this

court upheld a defendant’s conviction for receipt and possession of child

pornography because the government had produced sufficient evidence that

“Winkler himself sought out, downloaded, viewed and had the ability to

manipulate the images at issue in this case.” Id. at 699. The prosecution

produced evidence that illicit videos on Winkler’s computer were “hidden . . .

behind password walls in his . . . user account” or in “unnatural locations in the

computer’s file hierarchy rather than the normal location for downloaded

27

Case: 09-60566 Document: 00511695314 Page: 28 Date Filed: 12/14/2011

No. 09-60566

material.” Id. It also provided evidence that Winkler paid for members-only

access to a child pornography site and transmitted videos from this site to his

computer. Id.

Similarly, in United States v. Tucker, 305 F.3d 1193 (10th Cir. 2002), the

Tenth Circuit upheld a defendant’s conviction for possession of child

pornography in part because the prosecution presented evidence that Tucker

admitted to the police that he viewed several thousand images of child

pornography and that he intentionally deleted his computer’s cache after

viewing the images. Id. at 1197, 1204. The government also showed that Tucker

paid a user fee to access newsgroups that gave him access to images of child

pornography, and that he possessed the technical ability to access and

manipulate the images stored in the cache. United States v. Tucker, 150 F. Supp.

2d 1263, 1265, 1269 (D.Utah 2001), aff’d, 305 F.3d 1193 (10th Cir. 2002).

In United States v. Sanchez, 59 M.J. 566, 570 (A.F. Ct. Crim. App. 2003),

aff’d in part, rev’d in part on other grounds, 60 M.J. 329 (C.A.A.F. 2004), the U.S.

Air Force Court of Criminal Appeals upheld a conviction for child pornography

possession based on files located in a computer cache and on other files that had

been deleted from the hard drive but were recoverable. In that case, the

prosecution had presented evidence that the defendant was a subscriber of

“numerous e-groups described as nude teen sites,” that the child pornography

images came through emails to an account to which only he had access, and that

the defendant was “relatively sophisticated” in computer matters, such that a

jury could find that he knew that the images were being downloaded. See id. at

570.

28

Case: 09-60566 Document: 00511695314 Page: 29 Date Filed: 12/14/2011

No. 09-60566

These cases show that courts have refused to find that a defendant

constructively possessed child pornography located on his computer simply

because the defendant exclusively possessed that computer, without additional

evidence of the defendant’s knowledge and dominion or control of the images.

Where a defendant shares custody and control of the computer with other

persons and the prosecution has not produced further evidence of knowledge of

and access to the images, we must conclude that the proof of constructive

possession is deficient for even stronger reasons.

IV. Conclusion

In deciding whether a jury verdict is rationally supported by the evidence,

we are bound to review all evidence and the inferences therefrom in the light

most favorable to the verdict. Shum, 496 F.3d at 391; United States v. Ragan, 24

F.3d 657, 659 (5th Cir. 1994). As we said in Crain, “[a]lthough the strict nature

of this standard demonstrates our reluctance to interfere with jury verdicts, this

case is an example of why courts of appeal must not completely abdicate

responsibility for reviewing jury verdicts.” 33 F.3d at 487 (alteration in original)

(quoting Ragan, 24 F.3d at 659) (internal quotation marks omitted). Because the

evidence presented at trial was insufficient to provide a basis for a rational jury

to find beyond a reasonable doubt that the defendant knowingly possessed child

pornography, we REVERSE the judgment of the district court.

29

Case: 09-60566 Document: 00511695314 Page: 30 Date Filed: 12/14/2011

No. 09-60566

E. GRADY JOLLY, Circuit Judge, dissenting:

The record does not reflect whether the jury box had more than twelve chairs,

but we do know—and we know for sure—that two more jurors are trying to crowd into

the box. I respectfully dissent from the majority opinion, which is little more than a

presentation of the defendant’s case and the substitution of the views of judges for the

views of jurors. The majority refuses to view the evidence, as it should, in the light

most favorable to the verdict, but instead marshals the evidence to support the

defendant’s position, which the jury rejected. Furthermore, the majority examines

each of the key evidentiary items only in isolation and effectively says that none of the

individual items of evidence, standing alone, supports Keith Moreland’s conviction,

while ignoring the totality of the incriminating evidence.

First, and throughout its opinion, the majority embraces the primary defense

argument—placing blame on Keith’s dead father, George, instead of Keith himself—a

credibility choice for the jury to make. Second, the majority molds the testimony of the

government’s computer analyst, Matthew Manley, to suit its purposes, arguing the

testimony’s weak points, while failing properly to accept its strong points, which were

accepted by the jury. Third, the majority insists that no reasonable individual could

have believed that Keith Moreland’s behavior, after his wife discovered pornography

on their computers, indicated his guilt—again, an inference for the jury to make.

I.

It is fundamental that “we view the evidence in the light most favorable to the

verdict and uphold the verdict if, but only if, a rational juror could have found each

element of the offense beyond a reasonable doubt.” See United States v. Brown, 186

F.3d 661, 664 (5th Cir. 1999). After formally acknowledging this standard of review,

the majority disregards it—and not only disregards it, but combs the record to make

30

Case: 09-60566 Document: 00511695314 Page: 31 Date Filed: 12/14/2011

No. 09-60566

every argument in favor of exoneration. When the proper legal standard is faithfully

applied, it is manifest that we must uphold the jury’s verdict of guilty.1

II.

A.

The majority overturns the conviction on the ground that “there was not

sufficient evidence for a rational jury to find beyond a reasonable doubt that Keith

knowingly and constructively had possession of the 112 digital images found in the

computers’ slack space. ” Majority Op. at 21.2 This conclusion and holding necessarily

require the majority to minimize the incriminating evidence in this case that the jury

heard.

To review: The hard drives on both of the computers, which Keith’s wife turned

over to authorities,3 contained child pornography; pornographic sites with teen themes

1

I also specifically note that this court has recently implied that the evidentiary

threshold in possession of child pornography cases such as this one may not be particularly

high. See United States v. Winkler, 639 F.3d 692, 696 n.2 (5th Cir. 2011).

2

I do not respond in depth to the majority’s implicit point that none of the images are

child pornography because that discussion is dicta. For the same reason, I decline to address

the majority’s implicit point that the government failed to prove that Moreland was aware that

he was viewing child pornography, as opposed to legal pornography.

I briefly respond, however, to one example: the majority implies that the three to five

seconds that jurors were given to examine each image was insufficient for the jury to

determine whether the images were child pornography. As the government explained at oral

argument, however, the jury would have been given additional access to the images during

their deliberations upon request. The jury made no such request, suggesting that the properly

instructed jurors were confident that the images they had earlier viewed were child

pornography.

3

By way of background, the two computers are a desktop and a laptop. The desktop

had three user names, including Keith’s; the only user name on the laptop was Keith’s. Both

computers were turned over to the authorities after Deanna discovered a pornographic site in

the browsing history of both computers. Subsequent investigation showed that Keith’s user

profiles on each computer were the only profiles on either computer that contained

pornographic files.

31

Case: 09-60566 Document: 00511695314 Page: 32 Date Filed: 12/14/2011

No. 09-60566

were regularly visited while these very same computers were logged in under Keith’s

name; these pornographic sites were on at least some occasions visited within seconds

or minutes of Keith’s Yahoo account being accessed; Keith made no meaningful

attempt to assuage his wife’s concerns immediately after she discovered one of the

pornographic sites on the family computers and left with their children to go to her

parents’ home; and Keith and the defense witnesses waited until the eve of trial, well

after George Moreland’s death, to blame George for the crime. In other words, there

was plenty of evidence to support this conviction if the jury—as indeed it

did—concluded that the “My dead Daddy did it” defense was deceitful and fictional

nonsense.

Before addressing the majority’s specific critiques of the evidence, I note that the

majority employs an improper analysis in assessing the evidence of guilt: it treats

evidentiary items individually and independent of the whole; the analysis should ask

whether all of the evidence, viewed as a whole, supports the conviction. See United

States v. Miller, 146 F.3d 274, 281 (5th Cir. 1998) (“No single piece of circumstantial

evidence need be conclusive when considered in isolation; the question, rather, is

whether the evidence, when considered as a whole, provides a substantial basis for the

jury to find that the defendant's possession was knowing.”). With that said, I now turn

to analyze the majority’s itemization of reasons, notwithstanding the incriminating

evidence of guilt the jury’s verdict, the jury’s resolution of credibility issues, and the

proper standard of review in favor of the jury’s verdict, that the appellate court should

substitute its judgment for that of the jury.

B.

The rationale underlying the majority opinion is that Keith’s father, George

Moreland, was more likely the individual who possessed the pornographic images at

issue. In support of “blaming Daddy”—a “theory” presented to, and rejected by, the

jury—the majority raises several argumentative points.

32

Case: 09-60566 Document: 00511695314 Page: 33 Date Filed: 12/14/2011

No. 09-60566

First, the majority notes that Keith, along with several of his family members

(all biased witnesses, a fact that the jury apparently understood)—specifically, his wife

Deanna, his brother Eric, and Eric’s wife Kayla—all supported Keith’s “blame Daddy”

defense by testifying that George was a great pornographic fan.4 The majority further

notes that Keith and Deanna testified that George frequently accessed the computers

in Keith’s home under Keith’s user account and accessed his Yahoo account to play

dominoes, among other things. The primary problem with the majority’s reasoning is

that the government demonstrated to the jury that no one—and I mean no one—had

intimated to law enforcement that George might have committed this offense until

trial.5 The jury clearly was made aware of this. Yet, the majority makes no explicit

4

Notably, although Deanna testified that “[e]verybody that knew the man” was aware

that George was a pornography customer, the defense was unable to muster a single

disinterested witness to testify regarding George’s thirst. The jury took note.

5

Deanna’s testimony in this respect is somewhat contradictory. She first testified that

she had told the investigators that George “was a character that I was very suspicious of.” She

also said that she had informed the investigators that George had access to the computers.

She further explained that she had said: “I would like to bring up my father-in-law. . . . [H]e

might be someone of interest.” On the other hand, Deanna also testified that she did not

remember the investigators “specifically asking” whether George had access to the computers.

She then equivocated further, saying “I don’t remember that coming up. It should have.”

Thus, her own testimony as to what she told the investigators about George is ambiguous at

best. The testimony of the investigators, however, paints a clearer picture.

James Burton, an investigator with the Federal Bureau of Investigation, testified that

in his conversations with Deanna, she had indicated that “George Moreland may have had an

inappropriate relationship with . . . Mr. Keith Moreland’s daughter, which would have been

[George’s] . . . granddaughter.” Burton also testified that he did not remember Deanna

mentioning that George had access to the computers. Tony Cooper, an investigator with the

Lowndes County Sheriff’s Department, confirmed that Deanna “never mentioned he [i.e.,

George] used the computers.” He further explained: “[I]n the very beginning, I asked who

had access to these computers. She never mentioned him.” Finally, Matthew Manley, the

computer analyst, testified that he did not remember Deanna mentioning George as a

potential suspect.

Keith testified that his attorneys “advised [him] . . . not to” identify his father as a

potential suspect, but almost immediately equivocated, explaining that “they didn’t necessarily

33

Case: 09-60566 Document: 00511695314 Page: 34 Date Filed: 12/14/2011

No. 09-60566

attempt to justify this inexplicable delay,6 but does concede, as it must, that the jury

rejected this all too convenient and untimely canard.

Similarly, the majority points to no testimony that specifically indicates that

George viewed pornography on the family computers. If viewed in the light most

favorable to the verdict, the testimony suggests, at most, that George used his own

computer to look at pornography.7 Relevant to this point is the majority’s implausible

tell me not to go to the authorities. I just brought the information to them, and, you know, I

thought I was acting like I was supposed to act.”

The record also reflects that the government did not interview the brother, Eric

Moreland, as part of its investigation. Eric explained, however, that he never made contact

with the police, even after George asked Eric to help him destroy George’s personal computer,

because “it really didn’t cross my mind to be important considering it was my father and he

was not the one on trial.” Similarly, although the government did not interview Eric’s wife

Kayla as part of its investigation, she admitted that she made no attempt to inform the

government that George was worthy of investigation.

6

In the closing argument at trial, Keith’s trial counsel attempted to explain this failure,

arguing that although these witnesses were aware that Keith was the subject of a criminal

investigation, they did not notify law enforcement of their suspicions regarding George because

they did not know the investigation of Keith was a serious matter.

The majority declines to adopt as its own any argument that ordinary adults were

unable to comprehend that a criminal investigation is a serious matter.

7

Deanna testified that George had access to the family computers at times when he

was alone, and that George was a fan of pornography. She specifically admitted, however, that

she “didn’t check up on what he did, but he was certainly into—heavily, heavily into

pornography.” She also admitted that she and Keith discussed whether Keith should log out

of the computers, thereby denying George access, but decided against it. Finally, she stated

that “I knew that he [i.e., George] had looked at pornography. I had never [before this

incident] seen anyone in our home looking at pornography of any kind.”

Eric testified that George had limited access to his own computer: “there was a lot of

folks on it all of the time and stuff, so it was not accessible for whenever he wanted to use it.”

He also appeared to testify, however, that George destroyed the very same computer after

learning that Keith was being investigated. Presumably, the point of this latter testimony was

to imply that George had used his computer to look at illegal pornography and later destroyed

the evidence. The jury may well have found that these two points were inherently

34

Case: 09-60566 Document: 00511695314 Page: 35 Date Filed: 12/14/2011

No. 09-60566

attempt to shape the evidence in favor of reversal: its observation that someone, likely

Deanna, contemporaneously accessed Keith’s account along with pornographic sites at

a time when Keith was at work on September 28, 2007. See Majority Op. at 22 n.7.

To the majority, this single incident undermines the evidentiary value of the many

other visits to pornographic sites that came on the heels of someone logging into

Keith’s account. The majority reasons that because it was not Keith logged into his

account and looking at pornography on this one occasion, then no rational person could

conclude that it was Keith on other occasions. Yet the jury did so conclude, perhaps

because Deanna’s discovery of pornography on a family computer, call to Keith to

inform him of that discovery, and flight from her home to avoid a confrontation is a

sequence of events that points to Keith, not George, having accessed that pornography.

The majority next turns to attack the testimony of Matthew Manley, a computer

investigator for the city of Columbus who had analyzed the two computers that Deanna

turned over to authorities. Indeed, the majority turns away momentarily from its

assumed role as juror, assumes the role of defense attorney, and cross examines

Manley in an effort to minimize his incriminating testimony before the jury.

Specifically, the majority notes that Manley admitted that an unsophisticated

computer user would not have been aware that the images were on the computer. To

be sure, Manley explained that the images were recovered from the “disk slack space,”

which, in his view, and in the light of his knowledge regarding the way computers

work, indicated that someone had likely viewed the images on the internet and

thereafter deleted the browsing history. Notably, Keith’s trial counsel did not

challenge Manley on this point. Of course, the jury was free to determine that

contradictory; on one hand, Eric says that George could not conveniently access the computer;

on the other hand, he says (implicitly) that George used the computer to look at child

pornography, and further says that George somehow destroyed his computer to which he only

had limited access.

35

Case: 09-60566 Document: 00511695314 Page: 36 Date Filed: 12/14/2011

No. 09-60566

someone, at some relevant time, knowingly assumed possession of these images.

Indeed, the majority concedes—as it must—that the presence of child pornography on

a computer’s hard drive is evidence of prior possession of that pornography. Majority

Op. at 6 n.2, citing United States v. Kain, 589 F.3d 945, 948 (8th Cir. 2009).

This evidence, when properly viewed in the light most favorable to the jury

verdict—and notwithstanding the majority’s efforts to weaken Manley’s

testimony—enabled the jury reasonably to infer that Keith had attempted to delete

from his computer the pornographic images that he had downloaded (i.e., the images

recovered from the slack space), and that he was simply unaware that the images were

retrievable. The point is this: the majority makes every attempt to minimize and

weaken Keith’s possession of the images on his own computer, by repeatedly

emphasizing that this evidence, standing alone, does not support the conviction. But

the jury heard much more evidence pointing to his guilt.

The majority also attempts to discredit Manley for failing to specify when the

illegal images were downloaded. Manley explained that because the images were

recovered from the slack space, he was able to recover only the images themselves, and

was not able to recover the time stamps. The jury understood this fact, and discredited

the inference that the majority would give to this testimony, concluding instead that

Keith was nevertheless the culprit. If we view this testimony in the light most

favorable to the jury verdict, we should give credence to Manley’s explanation.

Finally, the majority argues that Manley never testified that the pornographic

sites that he had discovered in Keith’s browsing history8 contained child pornography.

8

To review, Manley testified that pornographic sites, many with teen themes, were

visited while Keith's user profile was logged into the computer and, furthermore, that some

such visits occurred within seconds or minutes of Keith's Yahoo account being accessed. The

majority argues that Manley admitted that anyone who knew Keith’s log in password could

have accessed the relevant accounts; the majority further argues that Keith and Deanna

testified that George had access to Keith’s accounts. In other words, the majority refuses to

accept that the jury, after being presented with this evidence, discredited Keith and Deanna,

36

Case: 09-60566 Document: 00511695314 Page: 37 Date Filed: 12/14/2011

No. 09-60566

The majority’s point is that Manley’s testimony that the computer’s browsing history

included pornographic sites, including sites for teen pornography, does not, by itself,

prove that Keith possessed child pornography. Manley’s testimony permitted the jury

to draw a reasonable factual inference that the same person who was frequenting these

pornographic sites was the same person who had downloaded the illegal images. It

seems that the majority misses the point: this browsing history is, at the very least,

circumstantial evidence that someone who was using the same computers that

contained illegal child pornography had an ample appetite for pornography depicting

young women.

The majority next, and finally, focuses its aim on the evidence of Keith’s

purposeful avoidance of Deanna. To better explain this point, I briefly recount the

relevant facts.

As I have earlier said, Deanna was using the desktop computer when she

discovered a domain name in the browsing history that included the words “teen

topanga.” Deanna immediately confirmed that the laptop computer had been used to

access the same site. After making these discoveries, she called Keith, who dismissed

her concerns and remained at work. When Keith returned home that evening, he

found Deanna and the children gone.9 Despite this, he went to a fishing tournament

the next morning; only after receiving a call from Deanna did he return home from the

tournament.

and the jury alone observed the demeanor of these witnesses and their presentation of Keith’s

belated alibis.

9

Deanna explained at trial that she had left because she was anticipating a “heated

argument” with Keith and “didn’t want the children to be present . . . .” She later testified,

however—after the defense had more fully presented its theory that Deanna’s dead father-in-

law was the responsible party—that she had never believed that Keith was the individual

responsible for viewing the pornography: “I couldn’t believe it then, and I don’t—I certainly

don’t believe it now.”

37

Case: 09-60566 Document: 00511695314 Page: 38 Date Filed: 12/14/2011

No. 09-60566

The majority, assuming its role as juror, airily dismisses Keith’s behavior,

insisting that it fails to support an inference that Keith knowingly possessed child

pornography. Keith’s trial counsel argued just that, even contending that Keith’s

behavior reflected his innocence. Thus, the jury had two choices: it could believe that

Keith’s actions evidenced his innocence, or that his behavior evidenced his guilt. It

decided on the latter. The jury was free to accept the defense’s preferred argument, but

it did not, and we are bound to review the evidence in the light “most favorable to the

verdict[,]” Brown, 186 F.3d at 664, a rule the majority left at the starting gate of its

opinion.

III.

To sum up: The key reasons assigned in the majority opinion for reversal are:

first, George was likely the culprit in this case; second, Matthew Manley did not

determine when the images were deleted, did not determine whether the images came

from any of the pornographic sites he found in the browsing history, and did not testify

that those sites contained child pornography; and third, Keith’s decision to avoid his

wife Deanna after receiving an ominous phone call from her could not be interpreted

as an expression of his guilt.

The majority defers to the defendant’s belated alibi instead of deferring to the

jury verdict. The resulting irony is that the jury of Keith’s peers rejected his story as

made-up nonsense, while the legally sophisticated majority accepted the story as fully

plausible.

More serious than the resulting irony, however, is the majority’s disregard for

the proper standard for a review of the verdict of the jury and its autocratic reversal

of a legally sound conviction.

I respectfully dissent.

38