Case: 17-13729 Date Filed: 09/05/2018 Page: 1 of 19
[DO NOT PUBLISH]
IN THE UNITED STATES COURT OF APPEALS
FOR THE ELEVENTH CIRCUIT
________________________
No. 17-13729
Non-Argument Calendar
________________________
D.C. Docket No. 6:16-cr-00170-PGB-DCI-1
UNITED STATES OF AMERICA,
Plaintiff-Appellee,
versus
DAVID R. RIVENBARK,
Defendant-Appellant.
________________________
Appeal from the United States District Court
for the Middle District of Florida
________________________
(September 5, 2018)
Before WILLIAM PRYOR, BRANCH and HULL, Circuit Judges.
PER CURIAM:
Case: 17-13729 Date Filed: 09/05/2018 Page: 2 of 19
After a jury trial, defendant David Rivenbark was convicted of:
(1) transporting and aiding and abetting in the transport of child pornography, in
violation of 18 U.S.C. §§ 2252A(a)(1), 2252A(b)(1), and 2 (Count 1); and
(2) knowingly possessing materials containing child pornography, in violation of
18 U.S.C. § 2252A(a)(5)(B) (Count 2). The charges stemmed from Rivenbark’s
posting in an internet chatroom a Dropbox hyperlink that contained child
pornography, which led to law enforcement’s tracking him down and conducting a
forensic search of his computer.
In his appeal, Rivenbark contends that: (1) the government did not present
sufficient evidence to support his convictions; and (2) the district court’s jury
instruction on possession constructively amended his indictment and created a
mandatory presumption that violated his due process rights. After careful review,
we affirm.
I. BACKGROUND
Because defendant Rivenbark challenges the sufficiency of the evidence
supporting his convictions, we start by outlining the trial evidence about the
investigation that led to his arrest and the forensic examination of his laptop
computer.
A. Detective Brad Gallant’s Investigation
2
Case: 17-13729 Date Filed: 09/05/2018 Page: 3 of 19
In August 2014, Detective Brad Gallant, with the York Regional Police in
Ontario, Canada, led part of an investigation targeting the distribution and
consumption of child pornography. As part of that investigation, Detective Gallant
staked out chatrooms on a website called Chatzy, where previous investigations
had uncovered the exchange of child pornography.
On August 19, 2014, Detective Gallant joined a particular chatroom named
“Send and Share,” with a description that read, “Do not trade, this room is only
meant for willing shares.” Detective Gallant observed the following exchange.
One user, “Jackson,” stated “if you truly want to see little girl porn hit me up” and
provided his username for another sharing application. A second user,
“Dick6Inch,” offered to provide 10 links and asked others to click on them.
A third user named “hrdgy2k00,” who was later identified as defendant Rivenbark,
then posted a hyperlink to a Dropbox account.
Dropbox is a company that hosts an off-site virtual storage application based
in California. After creating an account, users may place items in a Dropbox
folder and then access them remotely through the application or, as in this case, by
using a designated internet hyperlink. The hyperlink posted by hrdgy2k00 led to a
folder entitled “Share For” and contained over 100 videos of child pornography.
Hrdgy2k00 asked the others in the chatroom to post more hyperlinks
containing child pornography, stating: “anyone got more like that link? . . . that
3
Case: 17-13729 Date Filed: 09/05/2018 Page: 4 of 19
actaly [sic] work.” Dick6Inch retorted that all of his hyperlinks worked, and
hrdgy2k00 replied, “then post em pls.” Dick6Inch then posted a series of links and
introduced them as “Free Pedo Boys and Girls Fucking Links.” “Pedo” is short for
pedophile and denotes a sexual interest in children.
Detective Gallant screen captured the Chatzy conversation and the contents
of the Dropbox account posted by hrdgy2k00. After reviewing a cross-section of
the video content, Detective Gallant contacted Dropbox about who had created that
account. Detective Gallant was not able to tie hrdgy2k00 to the creation of the
Dropbox account.
But, Detective Gallant did determine that the internet protocol (“IP”) address
for hrdgy2k00 originated in Oviedo, Florida. 1 From Canada, Detective Gallant
forwarded his investigation materials to his liaison for the United States
Department of Homeland Security (“DHS”), who then forwarded the materials to a
DHS field office in Orlando, Florida.
B. DHS Investigation and Interview
The DHS field office in Florida submitted a subpoena request to the service
provider associated with the IP address identified by Detective Gallant and found
that the account was registered to David R. Rivenbark at 1008 Wainwright Drive,
Oviedo, Florida.
1
An IP address is a temporary address that a computer uses to communicate with the
internet.
4
Case: 17-13729 Date Filed: 09/05/2018 Page: 5 of 19
On November 26, 2014, three DHS agents conducted an interview with
Rivenbark at his home. The agents told Rivenbark that someone had posted
hyperlinks to child pornography in a chatroom on Chatzy and that they had traced
this activity to his address. According to the agents, Rivenbark calmly responded
that he was familiar with Chatzy and that he had seen child pornography on that
website before.
When the officers pressed further, Rivenbark admitted that he had used his
personal laptop to view child pornography online. Rivenbark denied that he ever
saved or downloaded any of this child pornography, but he also told the officers
that he routinely used a computer program to delete information from his computer
hard drives.
The DHS agents asked about the profile name hrdgy2k00, and Rivenbark
claimed that he had used it previously on a dating website but did not use it to post
hyperlinks on Chatzy. Rivenbark later confessed to being hrdgy2k00 from Chatzy
and to posting the Dropbox hyperlink that he knew led to a folder containing
videos of child pornography.
The agents asked him how long he had been looking at child porn.
Rivenbark responded that he began while in college in the mid-1990s and that he
was primarily interested in high-school-aged girls. Rivenbark admitted that he was
sexually aroused by the images and that he had masturbated to them. When asked
5
Case: 17-13729 Date Filed: 09/05/2018 Page: 6 of 19
if he had a problem, Rivenbark responded that he did not know why he had a
“compulsion” for “young girls.”
Rivenbark gave the DHS agents permission to check his laptop and other
devices. This initial search yielded no results, but the agents seized Rivenbark’s
laptop and two external hard drives for further investigation. Near the end of the
interview, the agents presented Rivenbark with a voluntary waiver containing his
Miranda rights, 2 and he signed it. Rivenbark was not arrested that day.
C. Forensic Scan of Rivenbark’s Computer
A DHS forensic analyst later examined Rivenbark’s laptop computer and
hard drives to check for child pornography.
At trial, the following facts were established about files on a computer.
While browsing images on the internet, a user has the opportunity to download and
save images at any time. Even if the user does not download or save images when
visiting a web page, the computer automatically generates temporary internet files
of the images and stores them in a cache. These cached files represent the images
available to the user while he or she browses a particular page. This process assists
the user by allowing that page to load faster if the user chooses to return to it.
Periodically—or when the user elects to do so—the temporary internet files
are deleted from the cache. Deleted files go into unallocated space on the hard
2
See Miranda v. Arizona, 384 U.S. 436, 86 S. Ct. 1602 (1966).
6
Case: 17-13729 Date Filed: 09/05/2018 Page: 7 of 19
drive and reside there until they are overwritten or replaced by new information.
Unallocated data is not accessible to the user without manipulation or the use of
recovery tools on the system, but signifies a file that was present on the computer’s
allocated space at one time.
From the unallocated space on Rivenbark’s laptop computer, the DHS
forensic analyst recovered nearly 400 images of child pornography deleted from
Rivenbark’s temporary internet files. Among the files recovered, some were
located in what the DHS analyst identified as the “pagefile,” or the virtual memory
file for the computer’s operating system. These files, whether image or video,
were portrayed as thumbnail images when saved in Rivenbark’s temporary internet
files.
The DHS forensic analyst also received video files recovered from the
Dropbox account that Rivenbark posted on Chatzy. When viewed on the operating
system, the videos from the Dropbox account were also portrayed as thumbnail
images. The DHS analyst compared these thumbnails side by side and concluded
that five of them were a visual match. Based on this information, the DHS analyst
opined that Rivenbark had viewed these five videos from the Dropbox account on
his laptop, which resulted in his computer’s memory storing a cached image on his
hard drive.
7
Case: 17-13729 Date Filed: 09/05/2018 Page: 8 of 19
The DHS forensic analyst also reviewed Rivenbark’s internet search history
and discovered numerous search variations of the terms PTHC (meaning “pre-teen
hard core”), “PTH C,” PTSC (meaning “pre-teen soft core”), pre-teen, toddler, and
daughter, along with various ages and sexually explicit phrases. Rivenbark also
accessed chatroom and file-sharing websites associated with child pornography on
numerous occasions and attempted over 50 times to access chatrooms that were
closed for the exchange of child pornography.
D. Procedural History and District Court’s Jury Instruction on Possession
At the close of the government’s case-in-chief at trial, defendant Rivenbark
moved for a judgment of acquittal, which the district court denied. He renewed his
motion at the close of all evidence, and the district court denied it again.
Over Rivenbark’s objection, the district court instructed the jury that
“[k]nowingly possessing child pornography images includes intentionally viewing
images sent to a defendant’s computer from an outside source whether or not the
viewer tries to save, edit or, otherwise, exert more control over the images,” but
that “inadvertent receipt of child pornography does not violate the statutes.”
(Emphasis added.)
The jury convicted Rivenbark on both counts. After trial, Rivenbark filed a
written motion for judgment of acquittal, challenging: (1) the sufficiency of the
8
Case: 17-13729 Date Filed: 09/05/2018 Page: 9 of 19
evidence supporting his convictions; and (2) the district court’s jury instruction on
possession. The district court denied this motion as well.
Applying the Sentencing Guidelines, the district court calculated an offense
level of 40 and a criminal history category of I, which yielded an advisory
guidelines range of 292 to 360 months’ imprisonment. Ultimately, the district
court sentenced Rivenbark to 240 months on Count 1 and 240 months on Count 2
to run concurrently. Rivenbark does not appeal any advisory guidelines
calculations or the reasonableness of his sentence. Rather, Rivenbark appeals his
convictions.
II. SUFFICIENCY OF THE EVIDENCE AS TO TRANSPORTATION
We review de novo the sufficiency of the evidence supporting a criminal
conviction, viewing all evidence in the light most favorable to the government and
drawing all reasonable inferences and credibility choices made in the government’s
favor. United States v. Pruitt, 638 F.3d 763, 765 (11th Cir. 2011).
The indictment charged Rivenbark in Count 1 with knowingly transporting
and aiding and abetting the transportation of child pornography, in violation of
18 U.S.C. §§ 2252A(a)(1) and 2.
Under § 2252A(a)(1), it is illegal to “knowingly transport[]” child
pornography “using any means or facility of interstate or foreign commerce or in
or affecting interstate or foreign commerce by any means, including by computer.”
9
Case: 17-13729 Date Filed: 09/05/2018 Page: 10 of 19
18 U.S.C. § 2252A(a)(1). Under 18 U.S.C. § 2, an individual who aids and abets a
crime may be punished as a principal to that crime. See United States v.
Hornaday, 392 F.3d 1306, 1313 (11th Cir. 2004) (explaining aiding and abetting as
a situation where “a defendant with the requisite intent to commit a crime gets
someone [or something] else to act in a way necessary to bring about the crime,
even if that other person [or entity] is innocent”). Aiding and abetting requires the
government to prove: (1) a third party committed the substantive offense; (2) the
defendant committed an act that contributed to and furthered the offense; and
(3) the defendant intended to aid in the commission of the offense. United States
v. Cruickshank, 837 F.3d 1182, 1189 (11th Cir. 2016); see 18 U.S.C. § 2.
A. Transportation of “Child Pornography”
On appeal, Rivenbark argues that the government failed to prove substantive
transportation of child pornography under § 2252A(a)(1) because the hyperlink
that Rivenbark posted on Chatzy was not itself child pornography. Put differently,
Rivenbark claims that the only thing he “transported” was a hyperlink, which was
not technically child pornography. Since that hyperlink does not meet the statutory
definition for child pornography, Rivenbark claims he did not commit a
substantive violation of § 2252A(a)(1).
The problem for Rivenbark is that he was also charged in Count 1 with
aiding and abetting the transportation of child pornography. Under that theory, the
10
Case: 17-13729 Date Filed: 09/05/2018 Page: 11 of 19
government did not need to prove that Rivenbark actually transported the child
pornography himself. Rather, to establish that Rivenbark aided and abetted
transportation, the government had to prove that Rivenbark took an affirmative
step to induce an unknowing third party—namely, Dropbox—to transport the
images or videos of child pornography over the internet. The record evidence
established these facts. 3
Dropbox provides off-site virtual storage over the internet. The contents of a
Dropbox account can be shared by hyperlink, which provides immediate access to
anyone who clicks on it. The Dropbox account in this case contained over 100
videos of child pornography within a folder entitled “Share For.” With knowledge
of the contents of this particular Dropbox account, Rivenbark posted a hyperlink to
this Dropbox account on a Chatzy chatroom designated for the exchange of child
pornography. By doing so, Rivenbark caused and facilitated Dropbox’s software
to be used for the transportation of child pornography over the internet.
Although we need not address it here, crediting Rivenbark’s technical
argument about the hyperlink versus actual pornography would permit individuals
sharing child porn to avoid prosecution simply by using third-party virtual storage
3
Rivenbark’s reliance on United States v. Navrestad, 66 M.J. 262 (C.A.A.F. 2008), is
misplaced. In Navrestad, the United States Court of Appeals for the Armed Forces concluded
that sending a hyperlink to a digital-storage site containing child pornography did not constitute
distribution of child pornography. 66 M.J. at 266–67. However, the Navrestad court also noted
that the government had not charged the defendant under an aiding-and-abetting theory or any
sort of attempt liability. Id.
11
Case: 17-13729 Date Filed: 09/05/2018 Page: 12 of 19
to remain one step removed from the illicit materials. It is the difference between
providing a location for pickup and handing over the materials directly. In any
event, Rivenbark provided access to and facilitated the transportation of child
pornography by placing the Dropbox hyperlink in that particular chatroom on
Chatzy. We conclude that there was sufficient evidence for the jury to find that
Rivenbark aided and abetted in the transportation of child pornography. See 18
U.S.C. § 2.
B. Intent to Aid and Abet Transportation
Rivenbark also argues that the government failed to prove he intended to aid
and abet the transportation of child pornography because the government did not
show that he specifically intended the other Chatzy users to transport child
pornography from one location to another. In the context of aiding and abetting,
the defendant’s intent “must go to the specific and entire crime charged.”
Rosemond v. United States, 572 U.S. 65, 76, 134 S. Ct. 1240, 1248 (2014).
So, Rivenbark is correct that the government was required to prove he intended
others to transport the pornography across the internet. However, the record
evidence here demonstrates that intent.
Rivenbark not only posted a Dropbox hyperlink to a massive collection of
child pornography but he also did so in an internet chatroom created for the
purpose of exchanging and sharing such materials. Rivenbark had full knowledge
12
Case: 17-13729 Date Filed: 09/05/2018 Page: 13 of 19
that the other users in this chatroom would not only view the videos that he shared
but also transfer and save them to their own devices and private collections. The
name and description of the chatroom suggested that users “Send and Share” their
collections of child pornography and that the chatroom was “only meant for
willing shares.” Similarly, the folder contained in the Dropbox hyperlink was
entitled “Share For.” From this evidence, the jury could reasonably find that
Rivenbark anticipated and intended the other users—which included Detective
Gallant with the York Regional Police in Ontario—to save and transport the posted
materials.
Further, the conversation in this chatroom made it very clear what the users,
and specifically what Rivenbark, sought to share. After posting the Dropbox
hyperlink using the profile name hrdgy2k00, Rivenbark asked the other users if
“anyone got more like that link?” (Emphasis added.) The import of this statement
is two-fold: (1) Rivenbark implicitly asked the other users to click and view his
hyperlink to determine “like” or similar content; and (2) he explicitly asked the
other users to post similar hyperlinks containing child pornography. Viewed in the
light most favorable to the government, the evidence supports the jury’s conclusion
that Rivenbark intended to aid and abet the transportation of child pornography.
III. SUFFICIENCY OF THE EVIDENCE AS TO POSSESSION
13
Case: 17-13729 Date Filed: 09/05/2018 Page: 14 of 19
The indictment charged Rivenbark in Count 2 with knowingly possessing
child pornography, in violation of 18 U.S.C. § 2252A(a)(5)(B). Under
§ 2252A(a)(5)(b), it is illegal to “knowingly possess[], or knowingly access[] with
intent to view, any . . . image of child pornography that has been . . . transported
using any means or facility of interstate or foreign commerce . . . by any means,
including by computer.” 18 U.S.C. § 2252A(a)(5)(B).
On appeal, Rivenbark argues that he did not “possess” the images of child
pornography located in his temporary internet files because these images were
saved on his computer by the automatic operation of his internet browser.
Rivenbark also argues that the government failed to prove that he knew the images
were located on his computer.
Rivenbark’s arguments are red herrings at best. Under this Court’s
precedent in United States v. Woods, 684 F.3d 1045 (11th Cir. 2012), “a person
who intentionally views, but does not download, child pornography necessarily
‘possesses’ child pornography within the meaning of § 2252A(a)(5)(B).” Id. at
1059 (emphasis added); see 18 U.S.C. § 2252A(a)(5)(B). While sufficiency of the
evidence was not at issue in Woods, its holding as to possession under
§ 2252A(a)(5)(B) nonetheless controls. Compare Pruitt, 638 F.3d at 767
(analyzing sufficiency of the evidence as to receipt and holding that a person
“knowingly receives” child pornography by “intentionally viewing” it), with
14
Case: 17-13729 Date Filed: 09/05/2018 Page: 15 of 19
Woods, 684 F.3d at 1059 (applying “viewing” principle from Pruitt to possession
of child pornography under § 2252A(a)(5)(B)).
There is no dispute that Rivenbark intentionally viewed child pornography.
The record evidence shows that Rivenbark sought out these images and videos in
numerous ways and over the course of many years. In the Chatzy chatroom, for
example, Rivenbark posted the Dropbox hyperlink containing over 100 videos of
child pornography and then asked the other users to “pls” post more hyperlinks to
child pornography.
Aside from his conduct on Chatzy, Rivenbark admitted to DHS agents that
he had begun looking at child pornography in the mid-1990s and that he was
primarily interested in high-school-aged girls. He also admitted that he was
sexually aroused by images of child pornography, that he masturbated to them, and
that he did not know why he had a “compulsion” for “young girls.” Rivenbark
acknowledged that he viewed child pornography on his laptop computer and that
he routinely used a computer program to delete information, including the child
pornography, from his hard drives. Based on this evidence, the jury could have
reasonably inferred that Rivenbark was sophisticated in technology and that his
long history of viewing child pornography made him develop this system of
viewing and then deleting images of child pornography to avoid detection.
15
Case: 17-13729 Date Filed: 09/05/2018 Page: 16 of 19
Moreover, DHS’s forensic analyst uncovered nearly 400 deleted images of
child pornography in the unallocated space on Rivenbark’s laptop. The analyst
also found that Rivenbark would regularly conduct internet searches on his laptop
computer using a broad range of sexually explicit terms associated with child
pornography. Among other things, Rivenbark sought over 50 times to access
chatrooms that were closed due to the exchange of child pornography.
Notably too, DHS’s forensic analyst also opined that, based on thumbnail
images recovered from the unallocated space on Rivenbark’s laptop, Rivenbark
viewed at least five videos of child pornography from the Dropbox account he
posted on Chatzy. While viewing these and other videos or images online,
Rivenbark had the ability to save, copy, print, screen capture, and email them to
other people. See Woods, 684 F.3d at 1059.
When viewed in the light most favorable to the government, and consistent
with this Court’s opinion in Woods, the record evidence supports the jury’s
conclusion that Rivenbark knowingly possessed child pornography. Accordingly,
the district court correctly denied Rivenbark’s motion for judgment of acquittal as
to both counts in the indictment.
IV. JURY INSTRUCTIONS
A. Constructive Amendment
16
Case: 17-13729 Date Filed: 09/05/2018 Page: 17 of 19
Rivenbark next argues that the district court’s jury instruction on possession
constructively amended his indictment by adding that possession included
“intentionally viewing images.” Specifically, Rivenbark contends that the district
court’s jury instruction merged “possession” with “access with intent to view”
under § 2252A(a)(5)(B) and thus constructively amended his indictment.
“A constructive amendment to the indictment occurs where the jury
instructions so modify the elements of the offense charged that the defendant may
have been convicted on a ground not alleged by the grand jury’s indictment.”
United States v. Sanders, 668 F.3d 1298, 1309 (11th Cir. 2012); see United States
v. Gutierrez, 745 F.3d 463, 473 (11th Cir. 2014); United States v. Keller, 916 F.2d
628, 634 (11th Cir. 1990). This Court reviews whether jury instructions
constructively amended the indictment de novo. Gutierrez, 745 F.3d at 473.
Section 2252A(a)(5)(B) criminalizes both “possession” of and “access[ing]
with intent to view” child pornography. See 18 U.S.C. § 2252A(a)(5)(B). Count 2
of Rivenbark’s indictment specifically charged that Rivenbark “did knowingly
possess” images containing child pornography in violation of § 2252A(a)(5)(B).
(Emphasis added.) The indictment did not charge that he accessed them with the
intent to view.
The statute does not define “possession,” and this Court’s Pattern Jury
Instructions simply list and identify different types of legal possession, including
17
Case: 17-13729 Date Filed: 09/05/2018 Page: 18 of 19
actual, constructive, sole, and joint. See id.; Eleventh Circuit Pattern Jury
Instructions (Criminal Cases) S6 (2016). However, this Court in Woods concluded
that possession “necessarily” includes intentionally viewing child pornography,
even if it is never downloaded. 684 F.3d at 1059 (“[A] person who intentionally
views, but does not download, child pornography necessarily ‘possesses’ child
pornography within the meaning of § 2252A(a)(5)(B).”).
Consistent with Woods, the district court’s jury instruction made clear that,
in this digital age, possession can include the completed act of “intentionally
viewing images,” which is different than having access and intent to view images
but not actually viewing them. See 684 F.3d at 1059. The key distinction is that,
to establish possession in this case, the government had to prove that Rivenbark
actually viewed the child pornography. See Woods, 684 F.3d at 1059. By
contrast, under the “access with intent to view” prong, the government had no such
burden. The district court’s instruction on “possession” of child pornography was
consistent with the law of our Circuit, reflected the substance of the indictment,
and did not amount to a constructive amendment.
B. Mandatory Presumption
Lastly, Rivenbark argues that this same jury instruction on possession
created a mandatory presumption in favor of the government as to the element of
possession under § 2252A(a)(5)(B).
18
Case: 17-13729 Date Filed: 09/05/2018 Page: 19 of 19
“A jury instruction which creates a burden shifting presumption or a
conclusive presumption deprives a defendant of his right to the due process of the
law.” United States v. Dean, 517 F.3d 1224, 1231 (11th Cir. 2008) (citing
Sandstrom v. Montana, 442 U.S. 510, 524, 99 S. Ct. 2450, 2459 (1979)). We
review the correctness of a jury instruction and its propensity to mislead the jury
de novo. Palmer v. Bd. of Regents of the Univ. Sys., 208 F.3d 969, 973 (11th Cir.
2000).
In this case, the district court’s jury instruction that possession included
“intentionally viewing images” did not create a mandatory presumption as to
possession. As discussed above, the district court’s instruction was consistent with
the law of this Circuit, and the government was still required to prove beyond a
reasonable doubt that Rivenbark intentionally viewed the images of child
pornography. See Woods, 684 F.3d at 1059. Just because Rivenbark admits that
he is a long-time viewer of child pornography does not mean that his due process
rights were violated when the government used that fact against him at trial.
V. CONCLUSION
For all of these reasons, we affirm Rivenbark’s convictions.
AFFIRMED.
19