Fone v. State

REPORTED

IN THE COURT OF SPECIAL APPEALS

OF MARYLAND

No. 962

September Term, 2016

______________________________________

JOHN R. FONE

v.

STATE OF MARYLAND

______________________________________

Eyler, Deborah S.,
Arthur,
Wilner, Alan M.
(Senior Judge, Specially Assigned),
JJ.
______________________________________

Opinion by Eyler, Deborah S., J.
______________________________________

Filed: June 6, 2017
 A jury in the Circuit Court for Montgomery County convicted John R. Fone, the

appellant, of ten counts of distribution of child pornography. The court sentenced him to

five years for each count, with the sentences to run concurrently, and suspended the

sentences in favor of a five-year term of supervised probation.

The appellant presents four questions for review, which we have condensed and

rephrased as three:

I. Did the circuit court err by denying his motion to suppress from
evidence pornographic images of children seized in a search of his laptop
computer in his townhouse?

II. Did the trial court err or abuse its discretion by permitting the State’s
expert witness to opine about certain activity on the appellant’s laptop
computer immediately before and after pornographic images of children
were shared?

III. Was the evidence legally sufficient to support the appellant’s
convictions?

For the following reasons, we shall affirm the judgments of the circuit court.

FACTS AND PROCEEDINGS

The Child Exploitation Unit (“CEU”) operates within the Special Victims

Investigations Division (“SVID”) of the Montgomery County Police Department

(“MCPD”). On January 2, 2015, the CEU received information from the National Center

for Missing and Exploited Children (“NCMEC”) that an image of child pornography had

been attached to an email on a gmail account with the address CaptainJRF@gmail.com,

accessed from an Internet Protocol (“IP”) address in Germantown. The NCMEC had

received that information from Google, which operates gmail.
 MCPD Detective Louvenna Pallas, who was working in the CEU, investigated the

information and on March 18, 2015, applied for and obtained a search warrant for the

appellant’s townhouse in Germantown. That same day, she and MCPD Detective Robert

Onorio went to the townhouse to execute that search warrant. They knocked on the door

and the appellant answered. They asked if they could come inside and speak to him, and

he consented.

The detectives sat down with the appellant at his dining room table and talked to

him for over an hour. With the appellant’s consent, Detective Pallas audio recorded their

conversation. The appellant told them he was married with two adult children, neither of

whom lived at home. His wife had been diagnosed with Alzheimer’s disease six years

earlier, and he was her primary caregiver. She was upstairs sleeping during the

interview.

Detectives Pallas and Onorio asked the appellant if he had a gmail account; he

replied that he did. He identified his email address as “CaptainJRF6969@gmail.com.”

They asked if he had any other email accounts, such as an account with an address of

CaptainJRF@gmail.com. He replied that he “might have had that.”1

The detectives inquired about the appellant’s internet usage. He acknowledged

having pornography on his computer but denied having any “inappropriate images of

children.” He primarily used a Gateway laptop computer (“laptop”), which he kept in the

1
The appellant later confirmed that he had used that email address. He also
identified two other email accounts he used: NudistJohn6969@yahoo.com and
CaptJRF6969@verizon.net.

-2-
basement of the townhouse. He said he spent a couple of hours each day in online

chatrooms and also spent time on Yahoo! Messenger, which is an instant messaging

program. He had an account with Flickr, an online photo storage site, under the name

“NudistJohn6969.”

Detective Onorio asked the appellant whether they could search his laptop and he

agreed. Detective Onorio accompanied the appellant to the basement of the townhouse to

retrieve the laptop. While the interview continued, Detective Onorio inspected the

contents of the laptop. He received permission from the appellant to run a computer

program to scan the laptop for child pornography. That program did not work, however,

so Detective Onorio carried out a manual search of the laptop. The appellant told the

detectives he engaged in “fantasy chats” on the laptop about sexual activity with children.

He denied ever having exchanged any child pornography images or videos. He said that

on one occasion the previous year a “guy” had sent him two images that he had looked at

for “about 10 seconds” and then deleted. One image depicted an infant and the other

image depicted “a child in pain.”

The appellant said he “d[id] it all” in caring for his wife. His sister had taken care

of his wife “once,” when he was out of town, but that time he had “left [his wife] at [his]

sister’s house.” His son lived in Seattle. A “good friend” who lived in Phoenix also had

taken care of his wife for him.

Detective Onorio located images of what the CEU calls “child erotica” on the

laptop. “Child erotica” are images of children in “sexually exploitative positions and

dress” that do not meet the definition of child pornography. He asked the appellant if it

-3-
was “fair to say [he had] a sexual attraction to children in a fan[tasy] component?” The

appellant replied, “Not to children, well yeah.” Detective Onorio inquired about the

appellant’s “age of attraction,” noting that his internet searches suggested he was

attracted to children from infancy through their teenage years. The appellant replied,

“Yeah.” He claimed there was no chance that he had child pornography on his laptop,

however.

As he continued his manual search of the laptop, Detective Onorio located an

image he believed to be child pornography. At that point, he stopped the interview and

advised the appellant that the detectives had a search warrant for his house. The

detectives seized the laptop and an external hard drive for it that was in the basement

where the laptop had been. They also seized a computer tower for a desktop computer

that was in the master bedroom. The appellant was not placed under arrest at that time.

Detective Onorio made copies of the hard drives from the devices seized at the

appellant’s townhouse and provided the copies to the MCPD Electronic Crimes Unit

(“ECU”). Detective William Heverly, with the ECU, analyzed the digital copies. From

the appellant’s laptop, he located ten images of child pornography and numerous internet

searches, websites visited, and chat sessions that were associated with child pornography.

The ten images had been sent by the appellant to an unknown third party on August 24,

2014.

On September 24, 2015, the appellant was arrested and charged with ten counts of

possession of child pornography and ten counts of distribution of child pornography. He

later filed a pre-trial motion to suppress the evidence seized from his townhouse.

-4-
 On April 8, 2016, the court held a suppression hearing. Among other things, the

appellant argued that the search warrant was issued based upon information that was stale

and therefore did not give rise to probable cause. The court denied the suppression

motion, rejecting the staleness argument and ruling, in the alternative, that even if

probable cause was lacking the detectives relied upon the warrant in good faith. The

appellant filed a motion for reconsideration, which was denied.

Before trial, the State entered a nolle prosequi on the possession counts.

A four day jury trial commenced on May 2, 2016. The State called Detective

Pallas, Detective Onorio, and Detective Heverly, who was accepted as an expert in digital

forensic analysis. The audio recording of the appellant’s March 18, 2015 interview with

the police was played for the jury, with minor redactions.

Detective Heverly testified that there were two user accounts associated with the

appellant’s laptop: one under the name “John” and one under the appellant’s wife’s name.

The appellant’s wife’s account was password protected and had been accessed just 7

times, with the last access in January 2013. The “John” account was not password

protected and had been accessed 2,937 times. The ten images of child pornography that

formed the basis for the charges had been accessed from the “John” account on the laptop

and sent to an unknown third party via Yahoo! Messenger on August 24, 2014, between

3:41 p.m. and 3:47 p.m.

Detective Heverly determined that fifteen minutes before that six-minute Yahoo!

Messenger session, a user of the “John” account had accessed the Flickr account the

appellant identified as his during the police interview and the

-5-
CaptainJRF6969@gmail.com gmail account, which the appellant also had identified as

his. Five minutes after the end of the Yahoo! Messenger session, a user of the “John”

account had accessed that same gmail account. A user of the “John” account also had

accessed a particular chatroom before and after the Yahoo! Messenger session. Detective

Heverly further testified that the external hard drive seized from the appellant’s

townhouse had been plugged into the laptop before and after the Yahoo! Messenger

session and images from it had been accessed.

In his case, the appellant presented his own digital forensic analysis expert, Patrick

Siewart, who testified that it was possible that a user other than the appellant had

uploaded and sent the ten child pornography images. He further testified that laptops are

portable, and therefore the images in question could have been sent when the appellant’s

laptop was outside of Montgomery County or outside of Maryland. He suggested that the

MCPD should have subpoenaed the IP address logs for the appellant’s internet service

provider (“ISP”) for August 24, 2014, to determine whether the laptop was connected to

the internet at the appellant’s townhouse on that date.

The appellant’s motion for judgment of acquittal at the close of all the evidence

was denied.

After conviction and sentencing, the appellant noted a timely appeal. We shall

include additional facts in our discussion of the issues.

DISCUSSION

I.

Denial of the Motion to Suppress

-6-
 In his pre-trial motion to suppress the evidence the police seized from his

townhouse, the appellant argued that the warrant was lacking in probable cause for

several reasons, including, as pertinent here, that the affidavit in support of the warrant

application “fail[ed] to state the date of the events relied upon to show probable cause . . .

[making it impossible] to determine the remoteness in time between the facts observed

and the issuance of the warrant, rendering the probable cause stale.” In other words, the

appellant maintained that because the warrant application did not disclose when the

image of child pornography was attached to the CaptainJRF@gmail.com account, that

event was not shown to be close enough in time to the date of the warrant application not

to be stale.2

At the suppression hearing, the warrant application was introduced into evidence

by joint stipulation. No testimony or other evidence was introduced.

The warrant application was sworn out by Detective Pallas on March 18, 2015,

and the warrant was issued and executed that same day. In the affidavit, Detective Pallas

detailed her experience, identified the location to be searched, listed the items to be

seized, and averred:

On 01-02-15, the [NCMEC] cyber tipline received a complaint from
Google that an image containing child pornography was attached to the
Google email address, captainjrf@gmail.com which may or may not have
been sent. (Cybertip #3384307)
The following is a description of the attached image:
1. Jpeg image titled: 39601_15

2
It appears that the image of child pornography that Google reported to the
NCMEC on January 2, 2015, is not one of the ten images of child pornography the
appellant later was charged with possessing and distributing on August 24, 2014.

-7-
 This image depicts an adult female performing fellatio on a
male toddler’s penis.
Your affiant through her training, knowledge, and experience
identified the above described image as being child pornography.
Google provided an IP address, date, and time of the suspected
uploaded image. A preservation letter was also sent to Google, Inc. to
preserve the account information pending warrant service.

Detective Pallas further attested that, using the IP address, she determined that the

computer associated with the image was located in Germantown and used a Verizon

internet account. She obtained Verizon subscriber information for that account, which

was registered to the appellant at an address in Germantown. A Department of

Assessments and Taxation search revealed that the address was a townhouse owned by

the appellant and his wife. A criminal history background check showed that the

appellant had been arrested and charged with public masturbation in Jacksonville,

Florida, in 1986.

Detective Pallas further averred in the warrant application that, based on her

training and experience, “[s]ubjects who view or collect child pornography value their

collections and often go to great lengths to organize and protect their collections

including concealing the images on computer media.” Moreover, “when subjects

possessing child pornography conceal or delete it to avoid detection . . . it is possible to

recover files and data from computer media in hidden areas or after it has been deleted.”

Before the suppression court, the appellant argued that the information contained

within the four corners of the warrant was stale, and therefore the warrant was not

-8-
supported by probable cause.3 The State responded that staleness was not an issue

because, unlike drug evidence that is likely to “dissipate” because the drugs will be

“used,” child pornography stored on a digital device is a “collector’s item.”

Alternatively, the State argued that even if the information in the warrant was stale, the

evidence seized should not be excluded because Detectives Pallas and Onorio had relied

upon the warrant in good faith.

In rejecting the staleness argument, the suppression court, quoting United States v.

Seiver, 692 F.3d 774, 777 (7th Cir. 2012), stated that it was persuaded that staleness “‘is

highly relevant to the legality of a search for a perishable or consumable object like

cocaine but rarely relevant when it is a computer file.’” The court emphasized that

computer files, even if deleted, can be recovered. The court also found that Detective

Pallas’s averments in the warrant affidavit, based upon her 14 years of experience as an

SVID detective, about “the habits and propensities of those who view or collect child

pornography,” further supported the view that it is likely that a computer image of child

pornography will be saved (or will be recoverable even if deleted).

The court reasoned that given all of the above, the “issue of when did this

possession occur . . . doesn’t matter much because it is still on the computer until

destroyed and that there are ways to get these images back or to recover these images

3
This was not the appellant’s primary argument. His primary argument, which he
does not raise on appeal, was that the warrant was not supported by probable cause
because the tip from Google was inadmissible hearsay, was uncorroborated, and was
unreliable. Defense counsel did not touch on the staleness argument until he was given
an opportunity for rebuttal.

-9-
even if they have been deleted twice by a person who has access to the computer.”

Moreover, the court pointed out, federal law requires ISPs, including Google, to report

suspected child pornography to the NCMEC “as soon as reasonably possible.” See 18

U.S.C. § 2258A(a)(1). Thus, it reasonably could “assume that the existence of the picture

[was] fairly recent in time,” relative to the date of the tip (January 2, 2015).

Alternatively, the court ruled that even if the warrant was lacking in probable

cause because it was based on stale information, Detectives Pallas and Onorio acted in

good faith in executing it, under United States v. Leon, 468 U.S. 897 (1984). The court

opined that there was “nothing so glaring about this search warrant that would suggest to

a well-trained officer that he [or she] could not rely on that warrant particularly since it

[was] linked to [the appellant]’s address and computer very well.” Moreover, the

“description of the contraband [was] clear and d[idn’t] leave anything subject to

interpretation” and the source of the tip was Google, which did “have some degree of

reliability.”

The appellant filed a motion for reconsideration addressing only the issue of

staleness, which the State opposed.4 On the first day of trial, the court heard argument on

that motion and denied it.

Before this Court, the appellant contends the suppression court erred by “ruling

that the evidence contained within the search warrant affidavit was not stale.” He relies

upon numerous federal cases on staleness of probable cause that hold that information

4
The appellant’s motion does not appear in the record, but the State’s opposition
to it does.

-10-
leading police to believe that child pornography is present on a computer can become

stale over time; that each case must be considered on its unique facts; and that a period of

more than a year is often too remote. The appellant argues that because the warrant

affidavit established only that one image of suspected child pornography was attached to

an email on an unknown date before January 2, 2015, and there were no facts showing

that Detective Pallas took any additional investigative steps to determine when that image

was uploaded, the court could not assess whether the length of time was too remote. He

maintains, moreover, that Detectives Pallas and Onorio could not “claim objective good

faith when they relied upon a search warrant that was so lacking in probable cause.”

The State responds that the warrant application in this case was not the type of

conclusory, bare-bones application that falls outside the broad protections of Leon, and

the suppression court correctly ruled that the detectives relied upon the warrant in good

faith. The State maintains that because the good faith ruling was correct, this Court need

not address the staleness issue; and if we do, the issuing judge had a substantial basis to

believe that probable cause supporting the warrant was not stale, and therefore child

pornography would be found at the appellant’s townhouse.

We shall address staleness and good faith.

-a-

Our standard of review when considering a facial challenge to a search warrant is

well-established:

We determine first whether the issuing judge had a substantial basis to
conclude that the warrant was supported by probable cause. State v.
Amerman, 84 Md. App. 461, 463–64, 581 A.2d 19, 20 (1990). We do so not

-11-
 by applying a de novo standard of review, but rather a deferential one. The
task of the issuing judge is to reach a practical and common-sense decision,
given all of the circumstances set forth in the affidavit, as to whether there
exists a fair probability that contraband or evidence of a crime will be found
in a particular search. Illinois v. Gates, 462 U.S. 213, 238–39, 103 S.Ct.
2317, 2332, 76 L.Ed.2d 527, 548 (1983). The duty of a reviewing court is
to ensure that the issuing judge had a “substantial basis for . . . conclud[ing]
that probable cause existed.” Id. (Quotation and citations omitted);
Birchead v. State, 317 Md. 691, 701, 566 A.2d 488, 492–93 (1989); Potts v.
State, 300 Md. 567, 572, 479 A.2d 1335, 1338 (1984) (Quotation and
citation omitted). The U.S. Supreme Court explained in Gates that the
purpose of this standard of review is to encourage the police to submit to
the warrant process. Gates, 462 U.S. at 237 n.10, 103 S.Ct. at 2331 n.10, 76
L.Ed.2d at 547 n.10.

Greenstreet v. State, 392 Md. 652, 667–68 (2006).

“One of the factors in the ‘probable cause puzzle’ concerns the staleness of the

information contained in an affidavit supporting a search warrant application.” Behrel v.

State, 151 Md. App. 64, 88 (2003) (quoting West v. State, 137 Md. App. 314, 327–28

(2001)). “There is no ‘bright-line’ rule for determining the ‘staleness’ of probable cause;

rather, it depends upon the circumstances of each case, as related in the affidavit for the

warrant.” Connelly v. State, 322 Md. 719, 733 (1991). In making that assessment, the

court considers whether “the ‘event[s] or circumstance[s] constituting probable cause,

occurred at . . . [a] time . . . so remote from the date of the affidavit as to render it

improbable that the alleged violation of law authorizing the search was extant at the

time[.]’” Patterson v. State, 401 Md. 76, 92 (2007) (quoting Peterson v. State, 281 Md.

304, 314 (1977)). That assessment turns on the particular facts of the case:

The ultimate criterion in determining the degree of evaporation of probable
cause, however, is not case law but reason. The likelihood that the evidence
sought is still in place is a function not simply of watch and calendar but of
variables that do not punch a clock: the character of the crime (chance

-12-
 encounter in the night or regenerating conspiracy?), of the criminal
(nomadic or entrenched?), of the thing to be seized (perishable and easily
transferable or of enduring utility to its holder?), of the place to be
searched (mere criminal forum of convenience or secure operational base?),
etc. The observation of a half smoked marijuana cigarette in an ashtray at a
cocktail party may well be stale the day after the cleaning lady has been in;
the observation of the burial of a corpse in a cellar may well not be stale
three decades later. The hare and the tortoise do not disappear at the same
rate of speed.

Andresen v. State, 24 Md. App. 128, 172 (1975) (emphasis added).

Several federal courts addressing staleness of probable cause in the context of

child pornography stored on digital devices have reasoned that because digital images

have a “potentially infinite lifespan,” United States v. Elbe, 774 F.3d 885, 891 (6th Cir.

2014), cert. denied, 135 S.Ct. 1573 (2015), “‘the passage of time alone’ cannot

demonstrate staleness.” United States v. Burkhart, 602 F.3d 1202, 1206 (10th Cir. 2010)

(quoting United States v. Mathis, 357 F.3d 1200, 1207 (10th Cir. 2004)). In Seiver, 692

F. 3d at 775–76, for example, the Seventh Circuit held that a seven-month delay from the

date that child pornography images were downloaded from the internet to the defendant’s

computer to the date a search warrant for the defendant’s computer was applied for did

not render the information stale. The court opined:

“Staleness” is highly relevant to the legality of a search for a perishable or
consumable object, like cocaine, but rarely relevant when it is a computer
file. Computers and computer equipment are “not the type of evidence that
rapidly dissipates or degrades.” United States v. Vosburgh, 602 F.3d 512,
529 (3d Cir. 2010). Because of overwriting, it is possible that the deleted
file will no longer be recoverable from the computer’s hard drive. And it is
also possible that the computer will have been sold or physically destroyed.
And the longer the interval between the uploading of the material sought as
evidence and the search of the computer, the greater these possibilities. But
rarely will they be so probable as to destroy probable cause to believe that a
search of the computer will turn up the evidence sought; for probable cause

-13-
 is far short of certainty—it “requires only a probability or substantial
chance of criminal activity, not an actual showing of such activity,” Illinois
v. Gates, 462 U.S. 213, 244 n. 13, 103 S.Ct. 2317, 76 L.Ed.2d 527 (1983),
and not a probability that exceeds 50 percent (“more likely than not”),
either. Hanson v. Dane County, 608 F.3d 335, 338 (7th Cir. 2010).

Id. at 777 (emphasis in original).

The Seiver court recognized that

after a very long time, the likelihood that the defendant still has [a
particular] computer, and if he does that the file hasn’t been overwritten, or
if he’s sold it that the current owner can be identified, drops to a level at
which probable cause to search the suspect’s home for the computer can no
longer be established.

Id. (emphasis in original). Seven months was far too short a period of time for that to

occur, however. See also United States v. Carroll, 750 F.3d 700, 704-05 (7th Cir. 2014)

(five-year gap between date victim alleged she was molested by defendant, at which time

he showed her images of child pornography and took digital images of her genitals, and

date of warrant application was not so remote as to render probable cause to search the

defendant’s home and seize cameras and other digital devices stale); Burkhart, 602 F.3d

at 1206-07 (information pertaining to an email between child pornography distributor and

the defendant two years and four months before issuance of a search warrant not stale);

United States v. Morales-Aldahondo, 524 F.3d 115, 119 (1st Cir. 2008) (lapse of three

years between the defendant’s purchase of digital child pornography images and warrant

application did not render search warrant stale); but see United States v. Greathouse, 297

F.Supp. 2d 1264, 1272-73 (D. Ore. 2003) (information that child pornography was

distributed from a computer f: drive 13 months before a search warrant was applied for

was stale, so search warrant was not supported by probable cause).

-14-
 In the case at bar, the March 18, 2015 warrant application showed that Google

made its disclosure to the NCMEC about ten weeks earlier, on January 2, 2015. NCMEC

then reported the information from Google to the MCPD, which engaged in the

investigation set forth in the affidavit. Google gave the information to NCMEC pursuant

to a federal statute mandating ISPs to notify the NCMEC of suspected child pornography

“as soon as reasonably possible.” We agree with the suppression court that, given that

statutory mandate, the judge to whom the warrant application was presented rationally

could infer that the image of suspected child pornography was attached to an email on a

day reasonably close in time to January 2, 2015, and certainly within a few years. In this

case, in which the lapse between the report from Google and the issuance of the search

warrant was only three months and the lapse between the emails of August 24 and the

warrant was only seven months, Detective Pallas’s averments about the habits of

possessors of child pornography and the ability of the police “to recover files and data

from computer media [even] after it has been deleted” gave rise to a substantial basis for

the issuing judge’s probable cause determination. See Behrel, 151 Md. App. at 90 (“In

analyzing the issue of staleness, ‘the expertise and experience of the officer are to be

taken into account in applying the Fourth Amendment probable cause test,’ even if ‘the

officer would not qualify as an expert witness on the subject.’” (quoting 2 LaFave, §

3.2(c), at 38–39, 38 n.70)).

-15-
 -b-

If we agreed with the appellant that the information in the warrant application was

stale, which we do not, we nevertheless would agree with the suppression court that the

good faith exception applied.

Evidence seized without a warrant or based upon a warrant not supported by

probable cause may be subject to exclusion. See, e.g., Agurs v. State, 415 Md. 62, 76

(2010). Unlike a warrantless search, however, “searches pursuant to a warrant will rarely

require any deep inquiry into reasonableness, for a warrant issued by a magistrate

normally suffices to establish that a law enforcement officer has acted in good faith in

conducting the search.” Leon, 468 U.S. at 922 (citations omitted). Thus, “[i]n the

absence of an allegation that the magistrate abandoned his detached and neutral role,

suppression is appropriate only if the officers were dishonest or reckless in preparing

their affidavit or could not have harbored an objectively reasonable belief in the

existence of probable cause.” Id. at 926 (emphasis added).

The Leon Court outlined four scenarios in which the good faith exception will not

apply:

(1) the magistrate was misled by information in an affidavit that the officer
knew was false or would have known was false except for the officer's
reckless regard for the truth;
(2) the magistrate wholly abandoned his detached and neutral judicial role;
(3) the warrant was based on an affidavit that was so lacking in probable
cause as to render official belief in its existence entirely unreasonable; and
(4) the warrant was so facially deficient, by failing to particularize the place
to be searched or the things to be seized, that the executing officers cannot
reasonabl[y] presume it to be valid.

Id. at 923. The appellant relies only upon the third scenario.

-16-
 Where, as here, the facts are not in dispute, we review the suppression court’s

ruling on “the applicability of the Leon good faith exception to the exclusionary rule . . .

de novo[.]” Patterson, 401 Md. at 104–05. In assessing whether the warrant application

was “so lacking in probable cause as to render official belief in its existence entirely

unreasonable,” Leon, 468 U.S. at 923, we apply an objective test to determine whether

“officers, exercising professional judgment, could have reasonably believed that the

averments of their affidavit related a present and continuing violation of law, not remote

from the date of their affidavit, and that the evidence sought would be likely found at [the

place identified in the affidavit].” Connelly, 322 Md. at 735. As this Court has

explained, that reasonable belief test will not be satisfied when the warrant application

contains “nothing beyond mere conclusions.” State v. Jenkins, 178 Md. App. 156, 203

(2008).

In the case at bar, the warrant application was not conclusory or bare bones. It

gave the date and the substance of the Google tip to the NCMEC; the nature of the

pornographic image uploaded; the investigation into the IP address associated with the

upload; the means to establish that the appellant lived at that address; the types of devices

that might be used to store child pornography; expert information about the habits of

collectors of child pornography; and expert information about forensic techniques to

recover deleted computer files. Although the date the image was attached to the email

was not included, the date Google informed the NCMEC about the image, which was just

over three months before the warrant application, supported a reasonable belief that

someone at the appellant’s townhouse had engaged in a violation of the law (possession

-17-
of child pornography) within months of the warrant application and, in light of the other

averments, that evidence of that possession could be found on a device located at that

address, even if it had since been deleted.

II.

State’s Expert’s Testimony

As circumstantial proof of the appellant’s criminal agency, the State presented

evidence, through Detective Heverly, that 1) the appellant’s gmail account and his Flickr

account were accessed from his laptop within 15 minutes before the six minute Yahoo!

Messenger session in which the ten images of child pornography were distributed by

means of that laptop; 2) his gmail account also was accessed from that laptop within five

minutes after that session; 3) pornographic images of adult males were accessed by the

appellant’s laptop from his external hard drive soon before and after the critical Yahoo!

Messenger session; and 4) the “Silver Daddy” chatroom was accessed from the

appellant’s laptop soon before and after the Yahoo! Messenger session. The last two

categories of evidence were relevant because the appellant told the police in his interview

that he was bisexual, had had two long-term sexual relations with men over the past

several decades, and viewed adult gay pornography and participated in gay sexual

chatrooms such as “Silver Daddy.”

The appellant contends the State violated Rule 4-263(d), governing mandatory

discovery disclosures by the State in a criminal case, by not disclosing the specific

information about the gmail and Flickr account access, and consequently the court erred

-18-
by not excluding Detective Heverly’s testimony in that regard. (The appellant does not

raise any issue about the evidence on the external hard drive.)

The State responds that this issue is not preserved for review and, in any event, the

court did not err or abuse its discretion by permitting Detective Heverly to testify about

the account activity on the laptop soon before and after the incriminating Yahoo!

Messenger session.

On March 30, 2016, the State sent a letter to defense counsel stating that it

intended to call Detective Heverly as an expert witness in “digital forensic examination”;

that he would testify that his examination of the laptop revealed that the “contraband

charged in counts 1-10 was distributed via Yahoo! Messenger on August 24, 2014”; and

that he would “further testify that his examination revealed that both prior-to and after the

distribution of the contraband charged in counts 1-10, the user [of the laptop] accessed

images files and video files of pornography, specifically pornography depicting adult

men engaged in various sexual activities with each other.”

Before trial, the State provided the defense a summary of the Internet Evidence

Finding report (“IEF”) that Detective Heverly prepared after he examined the copies of

the hard drives for the appellant’s laptop and other devices. The State could not provide

the full IEF report to the defense because it contained prohibited images that could not be

shared. The full IEF report included the information about the gmail and Flickr accounts

used immediately before and after the Yahoo! Messenger session. The State made open

file discovery available, so the defense had access to the full IEF report. And, as part of

open file discovery, the State made the copies of the hard drives that were searched by

-19-
Detective Heverly and were the subject of his IEF report available for inspection by the

defense expert. Indeed, the defense expert inspected them, twice, performing his own

forensic examination and preparing his own IEF report.

At the outset of the proceedings on May 5, 2016, which was the third day of trial

and the day Detective Heverly was expected to testify, the prosecutor advised the court

that he planned to use a demonstrative exhibit titled “Timeline analysis for August 24,

2014” (“Exhibit 11”) that showed laptop user access of the Flickr account and the gmail

account in the periods shortly before and after the Yahoo! Messenger session. The

prosecutor explained that Detective Heverly’s testimony about user access before and

after the Yahoo! Messenger session would be “circumstantial evidence of who was using

the laptop at the time of the distribution [of child pornography].” The prosecutor

maintained that the information in Exhibit 11 had been disclosed to defense counsel in

the March 30, 2016 expert disclosure.

Defense counsel responded that the prosecutor had not disclosed that the State

intended to present evidence that a user of the laptop accessed the Flickr account or the

gmail account, only that a user of the laptop had viewed pornography involving adult gay

men. The prosecutor disagreed, taking the position that the expert disclosure was

sufficient and, in any event, because the defense expert had been given full access to the

copy of the hard drive for the laptop, the defense could not claim unfair surprise about

any information on the laptop.

The court denied the motion in limine, ruling that Detective Heverly could testify

about the user access as shown on Exhibit 11. Defense counsel “note[d] [his] objection

-20-
to the expert testifying as to the usage of the computer shortly prior to and subsequent

thereto because that was not something that was provided [in discovery].” He did not

seek a continuing objection.

Detective Heverly was called as the second witness that day. He was accepted as

an expert in digital forensic analysis by stipulation. After he testified generally about his

analysis of the laptop hard drive, the Yahoo! Messenger program, and the ten images of

child pornography sent via Yahoo! Messenger over six minutes on August 24, 2014, the

prosecutor approached the stand and showed him Exhibit 11 to refresh his recollection

about the start time (3:41 p.m.) and end time (3:47 p.m.) of that Yahoo! Messenger

session. Defense counsel did not object to any of this line of inquiry.

Later in Detective Heverly’s direct examination, the prosecutor asked: “And how

do you go about trying to identify the person who is sitting at the computer? The user.”

Detective Heverly responded that he tries to “find data and artifacts that will kind of help

us determine who that person was.” He gave as an example a user who works on his

resume, then engages in “illegal activity,” and then goes back to working on his resume.

He explained, “So we[] look for activity before and after.” He was asked if he had

“attempt[ed] to ascertain anything that was going on on [the laptop] that the user was

accessing at the time, 3:41 [p.m.] to 3:47 [p.m.] on August 24th of 2014?” He responded

that he had “specifically searched for activity right around that date to see what was

going on.” He did not find any other user activity during the Yahoo! Messenger session,

but he did find user activity just before and after that session. He then testified about the

gmail and Flickr accounts access as reflected on Exhibit 11. These questions all were

-21-
asked, and Detective Heverly’s answers all were given, without any objection or motion

to strike.

When Detective Heverly was asked whether he was able to determine that a user

had accessed the external hard drive seized from the appellant’s basement around the

time of the Yahoo! Messenger session, defense counsel objected and a bench conference

was held. The prosecutor explained that Detective Heverly was going to testify that

images were accessed from an external hard drive plugged into the laptop immediately

before and again immediately after the 6 minute Yahoo! Messenger session. Defense

counsel argued that the March 30, 2016 expert disclosure letter did not reveal that the

State’s expert would testify that the external hard drive had been accessed at those times.

The court disagreed and overruled the objection.

The prosecutor then resumed questioning Detective Heverly about the access of

the external hard drive. The questioning spans more than two pages of the transcript.

Defense counsel did not lodge any further objections.

The prosecutor subsequently sought to introduce Exhibit 11 into evidence. The

court denied that request, ruling that it was a demonstrative exhibit that had not been

disclosed to defense counsel in a timely manner.

We agree with the State that the issue the appellant raises on appeal—whether the

trial court erred by allowing Detective Heverly to testify about the laptop user accessing

his gmail and Flickr accounts close in time to the Yahoo! Messenger session in which the

child pornography images were distributed—is not preserved for review. “It is well-

established that a party opposing the admission of evidence ‘shall object’ at the time the

-22-
evidence is offered or as soon thereafter as the grounds for objection become apparent.

Wimbish v. State 201 Md. App. 239, 260–61 (2011) (quoting Md. Rule 4-323(a))

(additional citations omitted). If not, the objection is waived and the issue is not

preserved for review. Id. at 261. Also, “to preserve an objection, a party must either

‘object each time a question concerning the [matter is] posed or . . . request a continuing

objection to the entire line of questioning.’” Id. (quoting Brown v. State, 90 Md. App.

220, 225 (1992)). “Th[is] requirement of a contemporaneous objection at trial applies

even when the party contesting the evidence has made his or her objection known in a

motion in limine[.]” Id.

Here, the appellant did not object to any of the long line of questions that elicited

the evidence he complains about on appeal. His only objection was to the admission of

Detective Heverly’s testimony about the images of pornography on the external hard

drive, which is not the evidence being challenged on appeal. Moreover, we disagree with

the appellant’s argument in his reply belief that there was sufficient temporal proximity

between the trial court’s denial of the motion in limine and the direct examination of

Detective Heverly that the failure to make a contemporaneous objection should be

excused. Detective Heverly’s testimony was preceded by the cross-examination and

redirect examination of Detective Onorio. See, e.g., Hickman v. State, 76 Md. App. 111,

117-18 (1988) (“temporal closeness” exception to the contemporaneous objection rule

applies only when the court rules (or reiterates a prior ruling) immediately prior to the

objectionable testimony being elicited or evidence being offered). Also, at the close of

-23-
the motion in limine, the appellant could have requested a continuing objection but did

not.

In any event, we would not find merit in this issue even if it were preserved for

review. Rule 4-263(d) governs mandatory discovery disclosures by the State. At

subsection (d)(8), “Reports or Statements of Experts,” it requires the State to disclose, in

pertinent part, “[a]s to each expert consulted by the State’s Attorney . . . the expert’s

name and address, the subject matter of the consultation, the substance of the expert’s

findings and opinions, and a summary of the grounds for each opinion.” Also, the State

is required to provide the defense “the opportunity to inspect and copy all written reports

or statements made in connection with the action by the expert, including the results of

any physical or mental examination, scientific test, experiment, or comparison.” Id.

The March 30, 2016 disclosure by the State was non-specific, but referred to video

images and files accessed by the laptop user before and after the Yahoo! Messenger

session in which the images of child pornography were distributed. The details were

contained in the full IEF report prepared by Detective Heverly.

As noted, the State could not give that report to the defense as it contained

prohibited images, so the State gave the defense a summary and the opportunity for the

defense to have its own expert review the full IEF report in person. The dispute during

the motion in limine argument was over whether the State in fact did so. Defense counsel

asserted that the State did not; the prosecutor asserted that the State did. The court found

that the State had provided the report, and we cannot say that that finding was clearly

erroneous. Moreover, there was no dispute that the defense expert in fact examined the

-24-
hard drive copy for the laptop more than once and that the State offered to have Detective

Heverly review it with him. On this record, the court did not err or abuse its discretion in

denying the motion in limine.

III.

Sufficiency of the Evidence

Finally, the appellant contends the evidence was legally insufficient to sustain his

convictions for distribution of child pornography for two reasons. First, the State failed

to establish that he was the person using the laptop when the 10 images were sent via the

Yahoo! Messenger program. Second, the State failed to prove territorial jurisdiction, i.e.,

that the criminal conduct occurred in Maryland.

The State responds that it presented ample circumstantial evidence from which

jurors reasonably could infer that the appellant was the user of the laptop when the

images of child pornography were accessed and transmitted and that he was at his home

in Maryland at the time of the charged conduct. We agree with the State.

As this Court has explained:

“The standard for appellate review of evidentiary sufficiency is whether,
after viewing the evidence in the light most favorable to the prosecution,
any rational trier of fact could have found the essential elements of the
crime beyond a reasonable doubt.” State v. Smith, 374 Md. 527, 533, 823
A.2d 664 (2003) (citations omitted). “Weighing the credibility of witnesses
and resolving any conflicts in the evidence are tasks proper for the fact
finder.” State v. Stanley, 351 Md. 733, 750, 720 A.2d 323 (1998). In
addition, we give “‘due regard to the [fact finder’s] finding of facts, its
resolution of conflicting evidence, and, significantly, its opportunity to
observe and assess the credibility of witnesses.’” Moye v. State, 369 Md. 2,
12, 796 A.2d 821 (2002) (quoting McDonald v. State, 347 Md. 452, 474,
701 A.2d 675 (1997) (quoting State v. Albrecht, 336 Md. 475, 478, 649
A.2d 336 (1994))).

-25-
Larocca v. State, 164 Md. App. 460, 471-72 (2005) (en banc).

The appellant relies upon several federal cases holding that evidence was legally

insufficient to prove criminal agency vis-à-vis charges of possession of child

pornography when someone other than the defendant had access to the digital device and

was not excluded as the user. See United States v. Lowe, 795 F.3d 519, 523-24 (6th Cir.

2015) (evidence insufficient to prove criminal agency when the defendant, his wife, and

his “adoptive son” had access to the laptop and were not excluded as possible users);

United States v. Moreland, 665 F.3d 137, 151-52 (5th Cir. 2011) (evidence insufficient to

prove criminal agency when child pornography was found on a computer in the home

shared by the defendant, his wife, and his father, and there was evidence that the

defendant’s father frequently used the computer late at night while the defendant and his

wife slept).

In the case at bar, in contrast, the evidence viewed in the light most favorable to

the State did not reveal any actual or even potential alternative users. The appellant lived

in a townhouse with his wife, who was suffering from Alzheimer’s disease. The

appellant’s wife had been diagnosed around 2009, more than four years before the

Yahoo! Messenger session. The appellant admitted to the police that the laptop in his

basement belonged to him and that he spent several hours every day using it there. In his

police interview, the appellant did not claim that anyone else had used his laptop or even

that anyone else frequented his townhouse, either to visit or help care for his wife. He

openly informed the police about his bisexuality and that his current partner, of eight

-26-
years, lived in Atlanta and never came to his house to visit. 5 He acknowledged having

several gmail accounts (and provided the addresses); having a Flickr account (and

provided his user name); visiting the Silver Daddy chatroom (and provided his user

name); and using Yahoo! Messenger.

The appellant further admitted that he was sexually attracted to children; that he

engaged in fantasy chats about sexual activity with children; and that he frequently

viewed pornography, including images of adult men engaging in sex acts, on his laptop.

The evidence pertinent to April 24, 2014, the date of the distribution, showed that

a user of the appellant’s laptop accessed a gmail account belonging to the appellant and a

Flickr account belonging to the appellant about 15 minutes before the 10 images were

sent via Yahoo! Messenger. Within two minutes of the end of that session, a user of the

appellant’s laptop again accessed those same two accounts. A user of the appellant’s

laptop also accessed an external hard drive kept in the appellant’s basement before and

after the Yahoo! Messenger session, accessing images depicting adult males engaged in

sexual acts. This plainly was evidence from which reasonable jurors could infer that the

appellant was the person using the laptop before, during, and after the Yahoo! Messenger

session.

The evidence also was legally sufficient to prove that the criminal conduct took

place in Maryland. Detective Heverly testified that he had detected “artifacts” on the

laptop showing that it had been connected to the internet in the appellant’s townhouse ten

5
The appellant’s family members knew he was bisexual and knew his partner, but
he had promised his wife he would not bring his partner to their home.

-27-
days before the subject images were distributed. As noted, the appellant told police that

he used his laptop in his basement and that he had had to “give up all”

his activities after his wife became ill, sometime around 2009. There also was evidence

that the laptop was connected to an external hard drive on August 24, 2014, both before

and after the Yahoo! Messenger session. This was evidence from which a reasonable

juror could infer that the laptop was located in the appellant’s home in Maryland, where

he stored his laptop and the external hard drive, at the time of the Yahoo! Messenger

session.

JUDGMENTS AFFIRMED. COSTS
TO BE PAID BY THE APPELLANT.

-28-