Filed 10/23/23 P. v. Conner CA6

NOT TO BE PUBLISHED IN OFFICIAL REPORTS

California Rules of Court, rule 8.1115(a), prohibits courts and parties from citing or relying on opinions not certified for publication or ordered published, except as specified by rule 8.1115(b). This opinion has not been certified for publication or ordered published for purposes of rule 8.1115.

IN THE COURT OF APPEAL OF THE STATE OF CALIFORNIA

SIXTH APPELLATE DISTRICT

THE PEOPLE, H049879

(Monterey County Plaintiff and Respondent, Super. Ct. No. SS151256A)

v.

BRANDON CONNER,

Defendant and Appellant.

Defendant Brandon Conner was placed on two years’ felony probation after a jury convicted him of one count of possessing child pornography. On appeal he contends that insufficient evidence supports the conviction and that trial counsel was ineffective for not objecting to testimonial hearsay. Finding no prejudicial error, we will affirm.

I. TRIAL COURT PROCEEDINGS

Defendant was originally charged in 2015 with distributing child pornography (Pen. Code, § 311.2, subd. (c)) and possessing child pornography (Pen. Code, § 311.11, subd. (a)). He was convicted of those charges after a jury trial. A different panel of this court reversed the judgment in 2019 due to admission of testimonial hearsay that violated defendant’s right to confrontation. (People v. Conner (Sep. 26, 2019, H045304) [nonpub. opn.].) The district attorney amended the information on remand to charge a single count of possessing child pornography (Pen. Code, § 311.11, subd. (a)). The jury in defendant’s second trial found him guilty as charged. The following evidence was presented at defendant’s second trial.

A. TESTIMONY OF STEVEN GUIDI

Retired Monterey County district attorney’s office investigator Steven Guidi testified about investigating defendant. He used a program called E-Phex in March 2015 to scan the Gnutella and Gnutella2 peer-to-peer Internet networks for people sharing “files of interest.” (Guidi did not define the phrase “files of interest” during his testimony.) He explained that E-Phex “grabs a list of internet protocol addresses that are suspected of sharing files of interest.” It uses an automated process to request a list of files that are being shared by computers at those internet protocol (IP) addresses. The program then attempts to download any files of interest from those computers. Guidi testified about an E-Phex report spreadsheet that was admitted into evidence at trial. The report is based on E-Phex scans of an IP address associated with defendant over the course of five days, March 12 to 16, 2015. The report has a separate tab for each day the program scanned the computer using that IP address. Each tab has columns noting the name of each file being shared by the target computer; the SHA value1 for each file being shared by the target computer; and the size of each file. All of the files listed in the report were being shared from the same Global Unique Identifier or “GUID”2 running the LimeRunner software program. The computer containing software with that particular GUID was sharing over 1,000 files each day. Some of the file names for those files contained the notation “PTHC,” which Guidi testified was a commonly used child pornography abbreviation meaning “[p]reteen hardcore.” Guidi testified that in order to share a file on the Gnutella network, a user must possess the entire file. A file cannot be shared if it has been deleted. Guidi was not aware of LimeRunner ever automatically downloading a file, meaning that a user must

1 As described by Guidi, a file’s “fingerprint” is its “SHA” or “hash” value, an alphanumeric representation based on the file’s contents rather than its file name. 2 Guidi explained that a GUID is a 32-character unique address assigned to each program running on a network (such as Gnutella) “so that the program can interact with the other programs and know who is talking.” 2 choose to initiate a download. He noted that LimeRunner can run in the background on a computer if the user does not actively exit the program, and merely clicking the “ ‘X’ in the upper right-hand corner” would not necessarily close the program. E-Phex was able to download full or partial copies of six videos from the target computer. The parties stipulated that each of those videos was “clearly and plainly child pornography within the meaning of Penal Code section 311.11.” Based on those downloads, law enforcement obtained and executed a search warrant at defendant’s house in Greenfield. Guidi testified that defendant was home when he executed the search warrant. Defendant told Guidi that he and his wife had access to a desktop computer located in an upstairs office area. Guidi testified that defendant gave him the password for the desktop computer. Law enforcement used osTriage, an “on-scene triage program,” to search that computer as well as two laptops in the house. Files of interest were located on the desktop computer. The triage search did not find any complete files containing child pornography. But the search uncovered “LNK” shortcut files that had the same file names as some of the files of interest recorded during the E-Phex browses. Guidi explained that LNK files are referred to as “pointer files” because they point to where a file is actually saved; they are “not the actual file itself” but rather “a way for you to get there without having to go to the folders and work your way through all of those folders.” There was also a “Preview-T” file with “PTHC” as part of the file name. Guidi explained that when using a Gnutella network program like LimeRunner, incomplete downloads are placed into an “incomplete” folder until the download is completed. Incomplete files use the naming convention: “T, hyphen, the file size, and then the file name.” If a user wishes to preview a file while it is being downloaded, LimeRunner “will create a LNK file that is titled Preview, hyphen, T,” and then the file name. From the presence of the Preview-T file, Guidi concluded a user had previewed that file as it was 3 being downloaded. Guidi could not conclude from the foregoing that someone successfully downloaded any files, only that someone had attempted to do so. The triage software did not locate LimeRunner on the computer. Law enforcement used EnCase software to conduct a forensic examination of the seized desktop computer. Guidi explained that when a file is saved on a computer, a reference to the file’s location is saved on the hard drive’s file directory. When a file is deleted, the computer deletes the file directory location for the file as well as its metadata (information about a computer file that includes the file name, file size, date created, and other data). But the file (or parts thereof) can remain on the computer in unallocated space. The EnCase software searches both allocated and unallocated spaces on a hard drive. EnCase can “carve” data on a hard drive, meaning “going into a computer and looking for those files that have been deleted or portions thereof, being able to take part of that data and put it in a format that’s viewable or readable, whether it be a photo, video, or document.” The EnCase search found two relevant categories of information. First, the search found evidence that LimeRunner had previously been installed on the computer. The software was installed in 2011 and last accessed in April 2015. The directory for saving files downloaded from LimeRunner was “users, Conner family, documents, and then Brandon.” And the GUID for LimeRunner matched the GUID of the software that was sharing the files Guidi found in March 2015 using E-Phex. There was no evidence of a search history for terms associated with child pornography. Second, the software was able to carve 14 images from unallocated space on the desktop computer that were associated with videos E-Phex had downloaded from the same GUID. The parties stipulated that the 14 images were “image files with no metadata. The images are screenshots clearly associated directly with [the E-Phex videos]. These images contain child pornography within the meaning of Penal Code section 311.11.”

4 Guidi also testified about a search of defendant’s wife’s phone. Based on the content of text messages and a photograph with metadata indicating it was taken in San Francisco, the messages suggested that defendant’s wife visited San Francisco between March 20 and March 22, 2015. The final evidence of child pornography being shared by the desktop computer came in the form of a report by the Child Rescue Coalition, which included a list of files being broadcast by the desktop computer between March 21 and March 22, 2015. Guidi testified that he compared the hash values of files from the Child Rescue Coalition report against a list of known child pornography files maintained by the Monterey County district attorney’s office. The hash values for three videos being shared by the GUID associated with defendant’s desktop computer matched known child pornography files. The parties similarly stipulated that those three videos were “clearly and plainly child pornography within the meaning of Penal Code section 311.11.”

B. TESTIMONY OF WILLIAM WILTSE

William Wiltse testified that he is the president of the Child Rescue Coalition, a nonprofit organization that produces technology to help law enforcement agencies identify individuals on peer-to-peer networks who possess and share “images of child abuse.” He testified that the organization maintains software called the Child Protection System, which uses “crawlers and scanners” to act as a user on peer-to-peer networks, send out keyword search requests, and then evaluate “in an automated fashion the responses that come back from the computers that do respond.” Wiltse explained the software looks for “indicators that an IP address may be in possession of files that law enforcement has seen before and knows to be child abuse material.” (The prosecutor stated “we’ll refer to that as files of interest throughout the course ... of this testimony.”) The software does not attempt to download files, it merely logs information about the shared files, including file name, hash value, and file size.

5 Wiltse authenticated the Child Rescue Coalition report that Guidi used to compare files shared by the GUID for defendant’s desktop computer with files maintained by the district attorney’s office. The information in the Child Rescue Coalition report is computer-generated using an automated process. On cross-examination defense counsel asked Wiltse, “of the 6,814 [files in the report], do you know how many files of interest, meaning possible child pornography, are -- that can constitute what number in the 6,814?” Wiltse answered that he did not know. Wiltse acknowledged that he did not have personal knowledge about whether any of the files in the organization’s report contained child pornography.

C. TESTIMONY OF MICHELE BUSH

Michele Bush testified for the defense as an expert digital forensics examiner. She performed a forensic examination of the desktop computer from defendant’s house. She confirmed that there was no child pornography in the computer’s allocated space when it was seized. She acknowledged on cross-examination that 17 of the 150 files within the “recent” folder on the desktop computer had file names containing one or more terms that were “indicative of child pornography.”

D. DEFENDANT’S TESTIMONY

Defendant testified that he lived with his wife at the house in Greenfield in 2015. He and his wife both used the desktop computer, and it was located in a room where guests would have access to it. The computer was password-protected, but the password was only necessary if a user locked or restarted the computer. He testified that he used the computer to download entertainment, pay bills, and to watch adult pornography. He acknowledged using peer-to-peer software to download media, but denied ever searching for child pornography. He denied installing LimeRunner, and speculated that his sister’s boyfriend might have done so. Defendant testified that the boyfriend visited the house periodically in 2015 for “some holidays and some weekends,” but he could not remember how frequently he visited. Defendant denied intentionally downloading or viewing any 6 child pornography. He acknowledged that certain files listed on the E-Phex report of files shared by the desktop computer were his personal files, including the results of a physical exam and a form regarding his honorable discharge from the military. Defendant testified that he waived his Miranda rights and spoke with Guidi on the day of the search. (Miranda v. Arizona (1966) 384 U.S. 436.) He acknowledged telling Guidi that he had previously come across two or three files on the desktop computer that appeared to contain child pornography. He told Guidi he had deleted the files immediately upon discovery. He also acknowledged telling Guidi that he assumed the source of those files was a different peer-to-peer file sharing program, uTorrent. He testified that he had no reason to doubt the authenticity of the evidence of the text message conversation between him and his wife during a weekend she traveled to San Francisco in March 2015; he did not deny that he was home during that period.

II. DISCUSSION

A. SUBSTANTIAL EVIDENCE SUPPORTS DEFENDANT’S CONVICTION

Defendant does not contest that child pornography existed on his desktop computer, nor that child pornography was downloaded from a computer with the same IP address and GUID as the desktop computer. Defendant makes the narrower argument that there is insufficient evidence to show that he, as opposed to someone else, knowingly possessed that child pornography. “In assessing the sufficiency of the evidence, we review the entire record in the light most favorable to the judgment to determine whether it discloses evidence that is reasonable, credible, and of solid value such that a reasonable trier of fact could find the defendant guilty beyond a reasonable doubt.” (People v. Bolin (1998) 18 Cal.4th 297, 331.) We do not reweigh evidence or second-guess credibility determinations. (People v. Ramirez (2022) 13 Cal.5th 997, 1118 (Ramirez).) We presume the existence of every fact the trier of fact could reasonably deduce from the evidence to support the judgment. (Ibid.) To overturn a conviction based on insufficient evidence, “it must clearly appear 7 that upon no hypothesis whatever is there sufficient substantial evidence to support it.” (People v. Redmond (1969) 71 Cal.2d 745, 755.) Substantial evidence in this record supports defendant’s knowing possession of child pornography. The LimeRunner program was set to save downloads to a folder with defendant’s name on it (file path “users, Conner family, documents, and then Brandon”). That folder also contained at least two files specifically associated with defendant: the results of a physical exam and his honorable military discharge paperwork. During his wife’s trip to San Francisco in late March 2015, defendant was the only resident with access to the computer. And during that period of defendant’s exclusive access to the desktop computer, the desktop computer shared files that defendant stipulated contained child pornography. Defendant admitted seeing child pornography on the desktop computer—the jury was not required to credit defendant’s contentions that his viewing was inadvertent or that he immediately deleted the files. Further, child pornography files were being shared by the desktop computer over the course of several days in March 2015, which supports an inference that defendant did not immediately delete child pornography he saw on the computer. The foregoing evidence, considered together, is sufficient to support the finding that defendant knowingly possessed child pornography. Defendant’s arguments to the contrary fall into two categories. In the first category he notes the testimony that LimeRunner can run in the background, and argues that the desktop computer sharing files while defendant’s wife was in San Francisco therefore “does not give rise to an inference that appellant downloaded the three videos while his wife was in San Francisco or that he knew about them.” He also points out that only a few of the thousands of files in the shared folder during the E-Phex browses were specifically linked to defendant. But these issues would require us to reweigh or reinterpret the evidence, which is not our role (Ramirez, supra, 13 Cal.5th at p. 1118), and we have already summarized substantial evidence relating to defendant’s conviction.

8 The second category of arguments focuses on the absence of evidence that might more strongly support a conviction. Defendant notes the shared folder was not password protected, the forensic search could not identify a specific user, and there was no evidence of any search history for child pornography. But the absence of different or additional evidence does not render insufficient the evidence that was presented to and considered by the jury. Defendant argues his case is similar to United States v. Lowe (6th Cir. 2015) 795 F.3d 519, in which the court reversed a child pornography possession conviction where three individuals had access to a laptop and the pornography was downloaded to “the computer’s ‘downloads’ folder.” (Lowe, at pp. 524–525.) By contrast here, the testimony about defendant’s wife’s trip to San Francisco during a period where the computer was sharing child pornography supports an inference that defendant was the person who possessed the child pornography during that period. From that, the jury could also reasonably conclude it was defendant who possessed the child pornography shared earlier in the same month. And rather than a generic “downloads” folder, the LimeRunner program was set to save downloads to a folder with defendant’s name on it (file path “users, Conner family, documents, and then Brandon”).

B. COUNSEL DID NOT PROVIDE INEFFECTIVE ASSISTANCE

Defendant contends his federal constitutional right to confront and cross-examine witnesses was violated by the trial court’s admission of testimonial hearsay about “files of interest.” (See Crawford v. Washington (2004) 541 U.S. 36 (Crawford).) He acknowledges he forfeited the issue by not objecting on that basis in the trial court, but argues we should exercise our inherent discretion to consider the forfeited claim; alternatively he contends his trial counsel was ineffective for failing to object. We analyze the issue for ineffective assistance. To establish ineffectiveness of trial counsel in violation of the right to counsel under the Sixth Amendment to the United States Constitution, a defendant must show 9 both a deficiency in counsel’s performance and prejudice from the deficiency. (People v. Ledesma (1987) 43 Cal.3d 171, 216–217 (Ledesma).) We note that an attorney does not perform deficiently by declining to make a meritless objection. (People v. Ochoa (1998) 19 Cal.4th 353, 463 (Ochoa).) And we will not second-guess the reasonable tactical decisions of trial counsel. (People v. Riel (2000) 22 Cal.4th 1153, 1185.) Even where deficient performance is shown, a defendant must further affirmatively show a reasonable probability that, but for trial counsel’s error, the result would have been different. (Ledesma, at pp. 217–218.) We discern two components to defendant’s appellate argument. The first objects to Guidi’s and Wiltse’s use of the phrase “files of interest” during their testimony. The second objects to the prosecutor’s use of that phrase during closing argument. The admissibility of out-of-court statements in a criminal case is reviewed in two steps. (People v. Sanchez (2016) 63 Cal.4th 665, 680.) “The first step is a traditional hearsay inquiry: Is the statement one made out of court; is it offered to prove the truth of the facts it asserts; and does it fall under a hearsay exception?” (Ibid.) Next, “[i]f a hearsay statement is being offered by the prosecution in a criminal case, and the Crawford limitations of unavailability, as well as cross-examination or forfeiture, are not satisfied,” we must then decide whether the statement is “testimonial hearsay” as defined by the United States Supreme Court. (Sanchez, at p. 680; see Crawford, supra, 541 U.S. at p. 52 [a testimonial statement is “ ‘made under circumstances which would lead an objective witness reasonably to believe that the statement would be available for use at a later trial’ ”].) We agree with the court in People v. Lund (2021) 64 Cal.App.5th 1119, 1132 (Lund), that the first step of the analysis is reviewed for abuse of discretion, while the second step is reviewed independently because it implicates the federal constitution. 1. Guidi’s and Wiltse’s Testimony Defendant argues that “[a]ny reference to ‘files of interest’ to prove that a file depicted child pornography was [testimonial] hearsay evidence.” The argument is based 10 on an exchange between Wiltse and the prosecutor. Wiltse testified that the Child Protection System software looks for “indicators that an IP address may be in possession of files that law enforcement has seen before and knows to be child abuse material.” The prosecutor stated, “we’ll refer to that as files of interest throughout the course ... of this testimony,” and also stated, “we won’t get -- get too specifically into that.” Guidi, who testified both before and after Wiltse’s testimony, used the phrase “files of interest” but never defined it. A statement is not hearsay if it is not used to prove the truth of the matter asserted, such as when the statement is used to explain its effect on a listener. (Evid. Code, § 1200.) Lund, supra, 64 Cal.App.5th 1119, addressed a nearly identical argument in a case also involving the Child Protection System software and testimony by Wiltse. Lund argued that Wiltse’s statements were testimonial hearsay because he relied on the software’s “database of hash values corresponding to previously identified child pornography.” (Id. at p. 1133.) The court noted that the prosecution in Lund’s trial had not relied on the database of hash values to establish that any of the files Lund possessed actually contained child pornography; that was established by having an officer personally view the files. (Id. at p. 1134.) As such, the court concluded that Wiltse’s testimony about the database of hash values was used not to prove the truth of the matter asserted but rather to “explain [law enforcement’s] course of conduct in investigating” Lund. (Ibid.) The court reasoned that “[e]ven if every entry in the CPS hash value database were wrong, such hypothetical errors would not undermine the prosecution’s proof of the elements of the charge against Lund” because the prosecution proved the files were pornography by showing them to the jury or by having an officer testify about personally viewing them. (Id. at p. 1135.) The Lund court’s reasoning applies with full force to Guidi’s and Wiltse’s testimony in this case. Neither Wiltse nor Guidi relied on the label “file of interest” to conclude that the file contained child pornography. Indeed, Wiltse acknowledged that he 11 had no personal knowledge about whether any file in the Child Protection System report contained child pornography. References to “files of interest” merely explained the actions of law enforcement in investigating an IP address that was sharing those files, which eventually led to the discovery of several images on the desktop computer that defendant stipulated contained child pornography. We see no deficiency in trial counsel not making what would have been a meritless hearsay objection. (Ochoa, supra, 19 Cal.4th at p. 463.) 2. The Prosecution’s Closing Argument Defendant argues the prosecutor “used the phrase ‘files of interest’ in his closing argument—for the truth of the matter asserted that the files on the spreadsheet contained child pornography.” The prosecutor referred to “files of interest” twice in closing argument, without defining the phrase. When describing the E-Phex report, the prosecutor argued “E-Phex is a mechanism that -- that pretends to be just a random peer-to-peer user. But they go out and they crawl through the Gnutella network trying to find users who are broadcasting suspected files, files of interest. And when they get those files, when they see that, they record them.” The prosecutor later addressed the possibility of mistake, arguing: “So this idea of ‘Well, the BitTorrent made me do it, the BitTorrent came on and brought with it -- like a Trojan Horse, brought with it all kinds of child porn,’ well, the problem with that is where are the BitTorrent files that are being added during that same time period? They’re not there. There’s like three or four files being added per -- per -- per browse. And it’s only the -- the files of interest, the PTHC files.” The prosecutor’s first statement described the investigative process; it was not offered as proof of any matter asserted. In the second statement, the prosecutor did not state that “the files of interest, the PTHC files” identified through the E-Phex process were child pornography. The point of the reference was that “the files of interest, the PTHC files” discovered during the E-Phex browses came from LimeRunner software 12 rather than BitTorrent software—the prosecutor did not urge the jury to consider those files to be child pornography. Based on a reasonable assessment that jurors would not connect the prosecutor’s reference to “files of interest” to Wiltse’s use of the phrase on an earlier day of trial, defense counsel could have made the tactical decision not to object to the fleeting reference so as not to highlight it for the jury. (People v. Sta Ana (2021) 73 Cal.App.5th 44, 58.)

III. DISPOSITION

The order granting probation is affirmed.

13 ____________________________________ Grover, J.

WE CONCUR:

____________________________ Greenwood, P. J.

____________________________ Lie, J.

H049879

People v. Conner