State v. Diaz

[Cite as State v. Diaz, 2013-Ohio-1449.]

Court of Appeals of Ohio
EIGHTH APPELLATE DISTRICT
COUNTY OF CUYAHOGA

JOURNAL ENTRY AND OPINION
No. 98808

STATE OF OHIO
PLAINTIFF-APPELLEE

vs.

CARLOS DIAZ
DEFENDANT-APPELLANT

JUDGMENT:
AFFIRMED

Criminal Appeal from the
Cuyahoga County Court of Common Pleas
Case No. CR-532195

BEFORE: S. Gallagher, P.J., Rocco, J., and McCormack, J.

RELEASED AND JOURNALIZED: April 11, 2013
ATTORNEY FOR APPELLANT

Michael J. Manuszak
2905 Paxton Road
Shaker Heights, OH 44120

ATTORNEYS FOR APPELLEE

Timothy J. McGinty
Cuyahoga County Prosecutor

By: Denise J. Salerno
Assistant Prosecuting Attorney
The Justice Center, 8th Floor
1200 Ontario Street
Cleveland, OH 44113
SEAN C. GALLAGHER, P.J.:

{¶1} Defendant-appellant, Carlos Diaz (“defendant”), was convicted, after a bench

trial, of 32 counts 1 of pandering sexually oriented matter involving a minor with

forfeiture specifications and one count of possessing criminal tools, also with a forfeiture

specification. In this appeal, he contends that his convictions were based upon

insufficient evidence. For the reasons that follow, we affirm.

{¶2} Defendant presents two assignments of error, which we address together

because they involve the same analysis of law and fact.

Assignment of Error No. 1

The trial court erred in denying Appellant’s Rule 29 Motion for Acquittal
where there was insufficient evidence to identify the Appellant as the
perpetrator of the crimes herein.

Assignment of Error No. 2

The trial court erred in finding Appellant guilty under O.R.C.
§2903.322(A)(1) & (2) in trading, online downloading and online
distribution and disseminating of videos and photographs of child
pornography, particularly by way of downloading child pornographic video
through file sharing networks.

{¶3} In both assignments of error, defendant argues that the state’s evidence was

insufficient to support his convictions. Defendant believes there was insufficient

evidence as to his identity as the perpetrator of the crimes. He also contends that the

1
Eight counts involved violations of R.C. 2907.322(A)(2), and the remaining counts
involved violations of R.C. 2907.322(A)(1). All counts are felonies of the second degree.
state did not establish that he knew there was peer-to-peer software on his computer

equipment or that his computer was used to advertise or disseminate the prohibited

material.

{¶4} When an appellate court reviews a claim of insufficient evidence, “‘the

relevant inquiry is whether, after viewing the evidence in a light most favorable to the

prosecution, any rational trier of fact could have found the essential elements of the crime

proven beyond a reasonable doubt.’” State v. Leonard, 104 Ohio St.3d 54,

2004-Ohio-6235, 818 N.E.2d 229, ¶ 77, quoting State v. Jenks, 61 Ohio St.3d 259, 574

N.E.2d 492 (1991), paragraph two of the syllabus. A motion for acquittal under Crim.R.

29(A) is governed by the same standard used for determining whether a verdict is

supported by sufficient evidence. State v. Tenace, 109 Ohio St.3d 255, 2006-Ohio-2417,

847 N.E.2d 386, ¶ 37.

{¶5} The applicable standard requires a determination as to whether there was any

evidence that, if believed, would support convictions against defendant for violations of

R.C. 2907.322(A)(1) and (2), which provide:

(A) No person, with knowledge of the character of the material or
performance involved, shall do any of the following:

(1) Create, record, photograph, film, develop, reproduce, or publish any
material that shows a minor participating or engaging in sexual activity,
masturbation, or bestiality;

(2) Advertise for sale or dissemination, sell, distribute, transport,
disseminate, exhibit, or display any material that shows a minor
participating or engaging in sexual activity, masturbation, or bestiality[.]
 {¶6} Rick McGinnis (“McGinnis”) is an investigator assigned to Ohio’s Internet

Crimes Against Children Task Force (“ICAC”). He participated in the investigation that

led to defendant’s arrest in this case, and he utilized law enforcement software known as

Peer Spectre.

{¶7} Peer Spectre is a search program that operates on the Gnutella network,

which is a public peer-to-peer network where people share their computer files back and

forth. The Gnutella network enables people to log onto the Internet to search, find,

retrieve, and download shared files from other computers, including child pornography.

The search will reveal an IP address and SHA1 values,2 and from this information, the

user can download the desired file from the computer(s) that offered to share it. Peer

Spectre conducts an automated search that identifies file sharing of known or suspected

child pornography associated with a specific IP address.

{¶8} Each time that Peer Spectre is used by a law enforcement agency anywhere in

the world, the results are compiled in a centralized server. The information that is logged

into the central database includes the IP address, the port that it came from, and the date

and time of the search. Law enforcement agencies are then enabled to query the

information that Peer Spectre recorded into the central server.

2
SHA1 stands for Secure Hash Algorithm 1, which consists of 32 digits and functions as a
file’s digital signature or unique identifier, which cannot be altered. McGinnis testified that SHA1
values are accurate in identifying a file to the 160th degree, which is “better than DNA.” There is a
certainty exceeding 99.99 percent that two or more files with the same SHA1 value are identical
copies of the same file regardless of the file name. If any part of a file is altered in any way, the
SHA1 is changed.
 {¶9} McGinnis identified state’s exhibit No. 1 as being an IP activity report, which

references a specific IP address, SHA1 values, and contains dates ranging from April 28,

2009 to May 6, 2009. From that, he was able to identify movies and images of child

pornography being associated with that IP address. McGinnis created state’s exhibit No.

13, which is a disk with copies of the child pornography files that he had identified from

state’s exhibit No. 1.

{¶10} After a few of the videos were played in open court, the defense stipulated

that state’s exhibit No. 13 showed “a minor participating or engaging in sexual activity,

masturbation or bestiality” for purposes of Counts 1 through 31 of the indictment.

However, the defense did not stipulate that the videos and images belonged to defendant

or that he had recorded them.

{¶11} McGinnis learned, from records subpoenaed from Time Warner, that

defendant’s son, Randy, was the subscriber for the relevant IP address. Randy’s address

was an apartment in Brook Park, Ohio. Police conducted surveillance of that residence

and obtained a search warrant. McGinnis participated in executing the search warrant on

September 10, 2009, at 9:19 a.m. During the search, the following items were seized: an

Enermax black computer, a Buffalo hard drive, and a Hitachi hard drive.

{¶12} McGinnis testified that the files identified by Peer Spectre are located in a

person’s computer in a “shared file” after being downloaded from the Gnutella network.

{¶13} Luis Vargas testified that defendant is related to Vargas’s stepfather. Vargas

calls defendant his uncle. Vargas had spent the night at defendant’s residence on five or
six occasions in 2009 with his cousin Julio. Vargas and Julio were about 12 and 15 years

old, respectively. Defendant lived at the apartment in Brook Park that was the subject of

the search warrant in this case. Vargas said defendant lived alone in this one-bedroom

apartment. Defendant had a computer in his bedroom and would show the boys adult

pornography. Defendant would not allow the boys to use his computer. Although

defendant told Vargas he “didn’t have the internet,” Vargas testified that he saw

defendant accessing YouTube and Google. Vargas never saw anyone besides defendant

using the computer.

{¶14} Investigator Rice is an investigator with the Cuyahoga County Prosecutor’s

office and is assigned to the ICAC task force. He is trained as a computer forensic

examiner, and the defense stipulated to his expertise in computer forensic analysis. He

participated in the investigation in this case and was present at the search of the residence

in September 2009. Investigator Rice testified that child pornography was found on

several computer drives that were seized during the search. He was able to determine the

file names, the date they were created on the computer hard drive, and when each was last

accessed from that computer. For example, one file on the Western Digital hard drive

was created on May 11, 2009, at 1:48 p.m. and was last accessed on August 13, 2009, at

7:30 p.m. The defense stipulated to the contents of the videos as involving children

engaging in sexual activity for purposes of Counts 9 through 32.

{¶15} Investigator Rice also found file-sharing programs on the equipment seized

from the residence. When LimeWire is installed, it creates a folder that is called
“shared.” This is the file that is used when a person is online to connect with, and share

content, with other peers. “Carlos port” was the file path associated with it on the hard

drive. Investigator Rice also found FrostWire, another file-sharing program, on an HP

Pavilion desktop computer.

{¶16} During cross-examination, Investigator Rice indicated that it is possible for

viruses to be placed in people’s files where data can be disguised and sent without the

recipient’s knowledge of its content unless they opened it. In this case, the child

pornography files were downloaded, accessed again at later times, and none of them had

been deleted.

{¶17} Investigator Rice confirmed that persons with proper training and skill can

hack into computers and place things on other people’s computers without their

knowledge. Investigator Rice has seen computers that have been remotely accessed,

which leaves artifacts that evidence the remote access. He used the Forensic Tool Kit

created by AccessData to determine whether defendant’s equipment had been remotely

accessed. Investigator Rice did not find any artifacts or evidence that defendant’s

equipment had been remotely accessed by anyone.

{¶18} In this case, there was no evidence that someone else was using defendant’s

wireless connection without his knowledge because the actual files were found on his

equipment.

{¶19} Detective Jamie Bonnette assisted in the execution of the search warrant.

He interviewed defendant, who denied any knowledge of child pornography on the
computers. There was a woman present in the home who did not speak or understand

English. Defendant initially said she lived with him but later said she did not. Det.

Bonnette felt it was possible that she did live there. Defendant also indicated a man

named Emanuel Rivera lived in the apartment previously but had moved to Puerto Rico.

Defendant said his son, Randy, had not lived in the apartment for a year.

{¶20} Defendant said he had two computers: a laptop and a PC. He told Det.

Bonnette that he was the only person who used the computers. Defendant denied using

FrostWire or LimeWire and said he did not use them because they caused viruses. Det.

Bonnette felt that defendant was being evasive.

{¶21} The court denied defendant’s motion for acquittal and rendered its verdict

finding defendant guilty on all counts. The court noted that defendant’s primary defense

was that he was not the person who imported or placed the child pornography on the

computers. The court found that the state had proved that he was the person who

downloaded the child pornography beyond a reasonable doubt. The court referred to

some evidence in support of this finding, including that defendant had told police he lived

alone. The court also cited Vargas’s testimony, which indicated the defendant did not

allow him to use the computer and Vargas only saw defendant using the computer.

While there was some evidence that other people had lived in the apartment, the court

expressed “no substantial belief that they had any access to the computer.”

{¶22} The evidence establishes that the child pornography files were downloaded

and re-accessed at a later time. That fact, coupled with the evidence that defendant was
the only person who used the computers, provided evidence as to defendant’s knowledge

of the child pornography contents of the files.

{¶23} While defendant suggests that a computer virus could have caused the child

pornography to be placed on his computer without his knowledge, there is no evidence to

support this theory. The computers were searched for evidence of remote access, and

none was found.

{¶24} There was sufficient evidence to support appellant’s convictions, and his

assignments of error are overruled.

{¶25} Judgment affirmed.

It is ordered that appellee recover from appellant costs herein taxed.

The court finds there were reasonable grounds for this appeal.

It is ordered that a special mandate issue out of this court directing the common

pleas court to carry this judgment into execution. The defendant’s convictions having

been affirmed, any bail pending appeal is terminated. Case remanded to the trial court

for execution of sentence.

A certified copy of this entry shall constitute the mandate pursuant to Rule 27 of

the Rules of Appellate Procedure.

SEAN C. GALLAGHER, PRESIDING JUDGE

KENNETH A. ROCCO, J., and
TIM McCORMACK, J., CONCUR