Matthew John Stickle v. Commonwealth of Virginia

COURT OF APPEALS OF VIRGINIA

Present: Judges Humphreys, Russell and Senior Judge Bumgardner
Argued at Norfolk, Virginia
PUBLISHED

MATTHEW JOHN STICKLE
OPINION BY
v. Record No. 0660-16-1 JUDGE ROBERT J. HUMPHREYS
DECEMBER 27, 2017
COMMONWEALTH OF VIRGINIA

FROM THE CIRCUIT COURT OF THE CITY OF WILLIAMSBURG AND
COUNTY OF JAMES CITY
Michael E. McGinty, Judge

Patricia Palmer Nagel for appellant.

John I. Jones, IV, Assistant Attorney General (Mark R. Herring,
Attorney General, on brief), for appellee.

Matthew John Stickle (“Stickle”) appeals his December 16, 2015 conviction in the

Circuit Court of the City of Williamsburg and County of James City (the “circuit court”) on three

counts of possession of child pornography, first and second or subsequent offenses, and

twenty-two counts of possession of child pornography with intent to distribute.

I. Background

“In accordance with established principles of appellate review, we state the facts in the

light most favorable to the Commonwealth, the prevailing party in the [circuit] court. We also

accord the Commonwealth the benefit of all inferences fairly deducible from the evidence.”

Muhammad v. Commonwealth, 269 Va. 451, 479, 619 S.E.2d 16, 31 (2005).

So viewed, the evidence shows that on September 3, 2013, Lieutenant Scott Little

(“Little”), a district coordinator of the Southern Virginia Internet Crimes Against Children Task

Force, took part in an undercover investigation into what is known as peer-to-peer (“P2P”)
distribution of child pornography over the internet. Little testified regarding his substantive role

in the investigation of Stickle and also testified without objection as an expert in the field of

digital forensics, in particular “as to the investigation of child exploitation offenses.”

Although the record reflects that much of Little’s testimony is somewhat technical, the

specifics are important to the legal analysis in this case and are essentially as follows:

What is generically referred to as “the internet” is a cooperatively managed global

network of smaller interconnected networks. Each internet site, whether such site is hosted on a

computer server or a single specific computer, is associated with a unique internet protocol

(“IP”) address. Likewise, each device accessing the internet, such as computers, tablets,

modems, routers, and smart phones, necessarily also is assigned a unique IP address to facilitate

two-way communication with other devices and locations on the internet.1 The most common

method of accessing internet sites is through a software application known as a “browser,” such

as Microsoft’s Internet Explorer or Apple’s Safari. Browsers can access that portion of the

internet known as the Worldwide Web or simply “the web,” which is the roughly fifteen percent

of the internet sites that have been assigned domain names and indexed by Google and other

search engines.2 Using a browser to access a site on the Worldwide Web requires that the link be

1
An IP address is a unique 128 bit number assigned by the Domain Name Server
(“DNS”) of an internet service provider to each specific customer. IP addresses of individual
devices within that customer’s premises are assigned and maintained by a DNS in a device called
a router that creates a subnetwork within the premises based upon the IP address assigned by the
internet service provider. Overall worldwide management of IP addresses and associated
domain names is the responsibility of the Internet Corporation for Assigned Names and Numbers
(ICANN).
2
The web is defined as a collection of links to the registered domain names of internet
locations or “web pages” created using HTML (Hypertext Markup Language) thereby enabling
them to be indexed by search engines and displayed in a browser. The remainder and vast
majority of internet sites, known as the “deep web,” consists of unindexed, non-HTML locations,
resources, and data that are encrypted, protected by a password, behind a paywall or otherwise
beyond the reach of search engines and includes such things as email addresses, private networks

-2-
routed through one or more DNS servers located throughout the world that maintain a current

database of IP addresses and their associated domain names and direct internet traffic to the

appropriate IP address.3

A less common, but nevertheless widely available and frequently used method of

reaching a specific IP address is through a direct link that is not relayed through a routing DNS.

Using specialized but readily obtainable software designed for the purpose, a direct, encrypted

“peer-to-peer” or “P2P” link can be established between a user’s computer and a specific folder

or file on any linked computer—provided that the owner of the destination computer is using

similar P2P software and has allowed specific access to such folder or file location.

In short, P2P networks use locally installed software called a “client” which allows users

to share computer files of their choice directly with other similarly equipped users (a “peer”) and

without any intermediary routing. Files which a user intends to share are kept in a specific folder

designated as sharable by the software client. While there is nothing inherently illegal about the

use of peer-to-peer file sharing, P2P software is often used to share files in violation of copyright

and other intellectual property laws and to facilitate communications regarding various types of

and on-line banking sites. A small, encrypted subset of the deep web known as the “dark web”
consists of peer-to-peer networks such as Tor, Freenet or, as in this case, ARES, and requires
specific software, hardware configurations or authorization to access. See generally, Andy
Greenberg, Hacker Lexicon: What Is the Dark Web?, Wired Magazine, November 19, 2014.
3
By way of example, www.vacourts.gov is the domain name registered with ICANN for
the internet site hosting the on-line presence of the judicial department of the Commonwealth of
Virginia. Entering www.vacourts.gov into a web browser will cause it to contact a DNS, lookup
the IP address assigned to the domain name www.vacourts.gov which will return the associated
IP address 208.210.219.101 and then link to that IP address and display the web page located
there.

-3-
criminal activity.4 Because P2P locations in the dark web are invisible to indexing and search

engines such as Google, specialized software is required to access each separate P2P network.

Little was focusing his investigative attention on the ARES P2P network, which is often

used to exchange child pornography. Testifying as an expert, Little explained how peer-to-peer

networks are used in the context of the exchange of child pornography.

In a P2P network generally, users place any files they wish to share with others in a

specific “shared” folder. P2P clients like ARES globally search all shared folders in the P2P

network for any specified files. If found, the client then connects directly to all “peers,” i.e.

computers with shared folders that host the particular file being sought, and different pieces of

the file are then downloaded from multiple peers and reassembled into a new whole copy which

is then saved to the user’s shared folder.5

Specifically, with respect to the use of ARES, Little testified that file source IP addresses

are always collected by a P2P client, but in the stock version of ARES, they are not normally

displayed to the user. An ARES user enters the name of any file sought into the ARES client.

As with other P2P software, ARES then locates multiple IP addresses of computers hosting

copies of the requested file, verifies that all copies available are identical to each other, then

downloads separate pieces of the file from the many different copies found across the internet,

reassembles the pieces into a new copy and, after verifying that the newly assembled copy is

identical to the those from which it was assembled, saves the new file copy to the user’s

computer.

4
Under the “Sony standard” articulated by the Supreme Court in Sony Corp. of Am. v.
Universal City Studios, Inc., 464 U.S. 417 (1984), a device does not constitute contributory
copyright infringement so long as the device is capable of “substantial non-infringing uses.”
5
Apparently, this is done to preserve the anonymity of any single peer.
-4-
 Little used a specialized version of the ARES client designed specifically for law

enforcement (“ARES Round Up”). ARES Round Up, has been modified from its stock

configuration in two ways. First, ARES Round Up forces the client to download a shared file

from a single location instead of doing so piecemeal from multiple locations and then assembling

the pieces into a whole copy of the sought-after file. The second law enforcement modification

to the ARES client allows law enforcement users to view the actual IP address of the target

computer containing the file location of a P2P shared file.

Little input the names of specific child pornographic images encrypted and verified

through the Secure Hash Algorithm (“SHA”)6 and commonly exchanged by those interested in

child pornography into ARES Round Up and instructed the ARES Round UP client to search the

ARES network for matches. This process allows the verified SHA values to be used to search

for identical copies of known files. Little had enabled ARES Round Up to constantly search the

P2P network for matches with the SHA values of known child pornography image and video

files. One of these SHA values matched to a shared folder location on a computer indicating an

IP address within the task force’s geographic area.

Little obtained a subpoena and served the internet service provider to obtain the physical

address associated with that IP address - the shared home of Stickle and his fiancée Margaret

Mallory (“Mallory”). Stickle had been living at this address since moving from New York to

live with Mallory in August of 2013. Little obtained a search warrant for this address and

executed it on December 27, 2013. Pursuant to the warrant, police seized two laptop computers.

Mallory identified one of the laptops as belonging to her, the other she identified as Stickle’s.

6
The Secure Hash Algorithm compares two files at the basic binary level and calculates a
unique checksum for the authenticity of digital data to ensure the integrity of a file. In effect, it
is a digital signature that indicates if a file has been modified from its original form.
-5-
Mallory initially told Little that she had no access to Stickle’s device, but later amended her

statement to admit she had used Stickle’s computer on a few occasions.

Police conducted a forensic analysis on the laptops. Inside a password-protected user

account titled “Matt” on Stickle’s laptop, police found both images and videos of child

pornography and the ARES client, as well as personal and family photos relating to Stickle. The

ARES client’s shared folder contained an “extensive” library of child and adult pornography.

Some files dated back to 2010, three years before the device was seized. Little was also able to

forensically retrieve the search history of the ARES client, indicating which types of files the

user had been looking to obtain. It included explicit sexual terms referencing children. The

in-client ARES chat function on Stickle’s computer had been set to indicate to others that the

user was a 14-year-old male. In addition, there were three child pornography videos featuring

Stickle himself in another folder labelled “X.” The X folder was located near other folders

which were personally relevant to Stickle, specifically one regarding a relative’s baptism. The

three video files located in the X folder portrayed Stickle performing sexual acts on a

prepubescent eight-to-ten-year-old male.

When interviewed by police, Stickle denied knowledge of any child pornography on his

computer and stated that he had had several roommates prior to moving to Virginia to live with

Mallory. One of these roommates testified at trial that he had used Stickle’s computer when they

lived together. He also testified that he had seen another roommate use Stickle’s computer. He

did not testify that he had used ARES or placed any files on Stickle’s computer or seen any other

roommate do so.

A grand jury indicted Stickle on twenty-two counts of possession with intent to distribute

child pornography, first and second or subsequent offenses, and three counts of manufacture of

child pornography, first and second or subsequent offenses. The Commonwealth dropped the

-6-
manufacture of child pornography charges when it was discovered that the videos had been

created in New York, Stickle’s residence before he moved to Virginia to live with Mallory.

Stickle was tried on the remaining twenty-two charges in June of 2014. This trial ended in a

mistrial. A grand jury subsequently indicted Stickle for three additional counts of possession of

child pornography, first and second or subsequent offenses based upon the videos found in the X

folder. The Commonwealth amended the twenty-two possession with intent to distribute child

pornography indictments to first offense. Stickle was tried again by a jury on all twenty-five

charges and found guilty on all counts.

II. Analysis

A. Application of the Fourth Amendment

Stickle sought suppression of the evidence on the grounds that Little’s use of ARES

Round Up to download child pornography from a computer in Stickle’s home violated his Fourth

Amendment rights. “Since the constitutionality of a search and seizure under the Fourth

Amendment involves questions of law and fact, we give deference to the factual findings of the

trial court but independently decide whether, under the applicable law, the manner in which the

challenged evidence was obtained satisfies constitutional requirements.” Jackson v.

Commonwealth, 267 Va. 666, 672, 594 S.E.2d 595, 598 (2004).

For the past fifty years, “the application of the Fourth Amendment depends on whether

the person invoking its protection can claim a ‘justifiable,’ a ‘reasonable,’ or a ‘legitimate

expectation of privacy’ that has been invaded by government action.” Smith v. Maryland, 442

U.S. 735, 740 (1979) (internal citations omitted). Justice Harlan’s concurrence in Katz v. United

States, 389 U.S. 347 (1967), proposed a two-part test for evaluating the expectation of privacy.

Formally adopted in Smith v. Maryland, the Katz test first asks “whether the individual, by his

conduct, has ‘exhibited an actual (subjective) expectation of privacy.” Smith, 442 U.S. at 740

-7-
(quoting Katz, 389 U.S. at 361). Second, it asks “whether the individual’s subjective expectation

of privacy is ‘one that society is prepared to recognize as ‘reasonable.’” Id.

This Court recently applied the Katz test to a case nearly identical to Stickle’s. In

Rideout v. Commonwealth, 62 Va. App. 779, 753 S.E.2d 595 (2014), the same law enforcement

task force that tracked Stickle used a modified version of a different P2P client (Shareaza) to

download child pornography from Rideout. He sought suppression of this pornographic

evidence on the theory that his failed attempt to prevent the P2P client from sharing his files

established a reasonable expectation of privacy. We held in Rideout that “by simply installing

file-sharing software onto his computer, appellant has ‘failed to demonstrate an expectation of

privacy that society is prepared to accept as reasonable.’” Id. at 789, 753 S.E.2d at 600 (internal

citation omitted).

Stickle argues the inverse of Rideout. Instead of claiming that he attempted to limit

sharing, Stickle stresses both the fact that file sharing is enabled by default in ARES and that he

was unaware the ARES client was on his computer or that the client was being used to download

child pornography. By denying knowledge of the software, Stickle attempts to circumvent the

“reasonable expectation of privacy” Katz test and tie Little’s “search” to the earlier, more

fundamental, property-based foundation of Fourth Amendment application resurrected by the

Supreme Court in the wake of United States v. Jones, 565 U.S. 400 (2012). Though Katz

originally broke with the previous property-based application of Fourth Amendment protection

by declaring that the Fourth Amendment protects “protects people, not places,” Katz, 389 U.S. at

351, the Supreme Court in Jones revived and reinforced the pre-Katz concept of a property

interest component to Fourth Amendment protection as a backstop to a privacy interest.

However, Stickle’s legal argument necessarily depends upon both a misunderstanding of the

-8-
technology involved in this case and complete disregard for our standard of review. Stickle

interweaves three specific Fourth Amendment arguments which we separate below for clarity.

Stickle first claims that Little, using ARES Round Up software, “entered the curtilage

and threshold of [his] home without a warrant to search for evidence of probable cause of a

crime.” Stickle cites Florida v. Jardines, 569 U.S. 1 (2013), where the Supreme Court reversed a

drug conviction because police had used a drug-sniffing dog on the defendant’s curtilage. The

Supreme Court held this was an unreasonable search, stating “[t]he Katz reasonable-expectations

test ‘has been added to, not substituted for,’ the traditional property-based understanding of the

Fourth Amendment, and so is unnecessary to consider when the government gains evidence by

physically intruding on constitutionally protected areas.” Jardines, 569 U.S. at 11 (citing Jones,

565 U.S. at 409). Stickle claims Little “actually crossed the threshold of the house to reach the

modem [sic] in order to find probable cause to obtain a search warrant.” Analogizing to

Jardines, Stickle argues

[j]ust as the officer’s use of a drug-sniffing dog constituted a
warrantless search of the curtilage of the home, Little’s use of the
cable lines to the house to search the inside of the home constitutes
a warrantless search of the curtilage of the home in this case. In
fact, Little would not have been able to search the modem and
router without use of the cable lines to the house to access these
items inside of the house. Therefore, Little’s actions constitute a
warrantless search of the curtilage of Stickle’s home.

The curtilage is a well-established common law concept describing the area immediately

surrounding one’s house, as defined by “its relationship to the residence and its use by its

occupants.” Foley v. Commonwealth, 63 Va. App. 186, 195, 755 S.E.2d 473, 478 (2014). The

term “curtilage,” as it is used in the legal context, “is historically understood to refer to an

extension of the home that is so intertwined with the home that the law must provide it the same

protection as the home itself.” Id. It does not include the interior of the home which is

specifically protected from warrantless intrusion by the text of the Fourth Amendment itself.
-9-
While the lines carrying internet service to Stickle’s home may indeed run through his curtilage,

we need not engage in an esoteric determination and analysis of the precise physical location

where the bits and bytes constituting digital images of child pornography were obtained because

Little’s actions with respect to his use of P2P software in no way constituted a search of the

cables, curtilage, computer or any other location protected by Stickle’s Fourth Amendment

rights. To be clear, any “search” essentially involves prying into a private place. See, e.g.,

United States v. Jacobsen, 466 U.S. 109, 113 (1984) (“A ‘search’ occurs when an expectation of

privacy that society is prepared to consider reasonable is infringed.”). However, it is well-settled

that viewing items deliberately exposed to public view does not constitute a search and in any

event, consensual searches and seizures of items within the scope of the consent given do not

implicate the Fourth Amendment. See, e.g., Coolidge v. New Hampshire, 403 U.S. 443 (1971)

(generally discussing the application of the “plain view” doctrine); United States v. Williams, 41

F.3d 192, 196 (4th Cir. 1994) (holding that “[u]nder certain circumstances, the police may seize

the contents of a container found in a lawfully accessed place, without a warrant, if the contents

are in plain view”); United States v. Karo, 468 U.S. 705 (1984) (concluding that there was no

violation of the Fourth Amendment through a beeper placed in chemical container as it was

placed with consent of the then owner); United States v. Dunn, 480 U.S. 294, 307 (1987)

(establishing a four-factor test for determining the extent of the curtilage, including “the steps

taken by the resident to protect the area from observation by people passing by”).

Here, no warrantless search of any area or seizure of any item protected by the Fourth

Amendment occurred at all. When a user “searches” a P2P network, the software client is

matching the search parameters to the contents of each P2P linked computer’s shared folder that

others, such as Stickle, chose to make publicly available. In other words, Stickle was essentially

broadcasting the contents of his shared folder to the entire ARES network community in

- 10 -
response to outside user queries and inviting them to copy anything and everything in the folder

he chose to share. Stickle’s shared folder thus represents an “implicit invitation” of the type

discussed in Jardines—a cultural custom, like placing a door knocker on the front door, “treated

as an invitation or license to attempt an entry, justifying ingress to the home by solicitors,

hawkers and peddlers of all kinds.” Jardines, 569 U.S. at 8 (quoting Breard v. Alexandria, 341

U.S. 622, 626 (1951)).

Such customs are easily understood and “generally managed without incident by the

Nation’s Girl Scouts and trick-or-treaters.” Id. Jardines ultimately held that such invitations are

limited both in area and purpose, not present here, which ultimately rendered the search in

Jardines unconstitutional. See id. at 9. Here, however, the invitation provided to others directly

involved child pornography. To expand upon Justice Scalia’s analogy from Jardines, placing a

jack-o’-lantern on the porch and leaving the light on during the evening of October 31 signifies a

homeowner’s participation in the annual All Hallows Eve exception to parents’ usual admonition

to their children that they should not accept candy from strangers.

Similarly, viewing the record in the light most favorable to the Commonwealth, Stickle

demonstrated his consensual participation in the file sharing community by downloading and

installing the ARES client and then setting the contents of a folder as “shared” thereby exposing

to public access those files in that folder he wished to share with others. Little, in effect a digital

passerby, merely accepted the invitation offered by Stickle to help himself to copies of the

contents of Stickle’s shared folder. Therefore, we reject Stickle’s argument that Little’s actions

constituted a trespass to his curtilage in violation of the Fourth Amendment.

Stickle next argues that ARES Round Up violated his Fourth Amendment rights because

it is “sophisticated equipment” prohibited by Kyllo v. United States, 533 U.S. 27 (2001). In

Kyllo the Supreme Court overturned a drug conviction where police used a thermal imaging

- 11 -
device to detect heat from a marijuana growing operation within a house. Kyllo held that

“[w]here, as here, the Government uses a device that is not in general public use, to explore

details of the home that would previously have been unknowable without physical intrusion, the

surveillance is a ‘search’ and is presumptively unreasonable without a warrant.” Id. at 40.7

Unlike the device used in Kyllo, however, ARES Round Up is only slightly modified from the

base ARES client, allowing it to connect to only one computer to download a file rather than to

do so piecemeal from as many as are advertising the availability of the file, and also by allowing

it to display the connected IP address to the investigating officer. These modifications, while

clearly features of the software not readily available to the general public, are not of such

sophistication that they represent a level of technology not available to the general public as was

the case in Kyllo.

As Little testified, the modification to allow direct connection to a single user is not an

unknown advancement but rather a regression in technology to earlier file sharing protocols.

File sharing software between individuals has been in general public use since the advent of the

original file sharing service, Napster, in 1999—much to the vexation of the music and movie

industries.8

The second law enforcement modification simply displays the IP address of the source

shared folder—data that is already captured, though not displayed, by the standard ARES client.

7
As an aside, we observe that Kyllo also creates an endemic problem for the courts as we
try to apply 18th and 19th century legal and constitutional concepts to 21st century technology.
The very infrared imaging device described in Kyllo is now widely available and can be readily
purchased by the general public and thus, under its own analysis, would no longer render the
search in Kyllo unconstitutional.
8
See Menn, Joseph, All the Rave: The Rise and Fall of Shawn Fanning’s Napster.
Crown Business, (2003).
- 12 -
The nature of the minor modifications present in ARES Round Up do not, in our judgment,

suffice to render it a presumptively unconstitutional law enforcement tool.

Moreover, unlike in Kyllo, ARES Roundup was not used “to explore details of the home

that would previously have been unknowable without physical intrusion.” Rather, its

modifications simply displayed the IP address of a single computer containing a copy of a file

sought—information which was broadcast to everyone on the network by the ARES software on

Stickle’s computer.

Finally, Stickle argues that the warrant Little obtained subsequent to downloading the

child pornography from Stickle’s IP address “was issued based upon an unlawful and

generalized search.” Stickle claims that, because Little ran ARES Round Up continuously

searching widely for any file being offered on the network which matched certain SHA values,

his “search” violated the particularity requirement the Fourth Amendment places on warrants.

Stickle specifically asserts that “Little . . . conduct[ed] a search into the curtilage of the homes

and across the threshold of the homes of all of the citizens within a region, including Stickle’s

home, that Little decided to subject to law enforcement surveillance for criminal activity without

probable cause to do so without the knowledge or consent of the citizens.” (sic) This again is a

misrepresentation of the technology. Little did not “[search] the modem for the IP address.”

Little searched the ARES network, a voluntary file-sharing community, for very specific files

containing images of child pornography from users willingly sharing those specific files. As

discussed above, these users, including Stickle, essentially invited anyone, including Little, to

connect directly to a specific set of files on their computers for the purpose of making copies.

We therefore conclude that no general search in violation of the Fourth Amendment occurred.

- 13 -
 B. Joinder of Offenses

Stickle next argues that the circuit court erred by permitting him to be charged jointly for

possession of the three child pornography videos located in the unshared X folder and the

twenty-two child pornography still images found in the ARES shared folder. He asserts that the

charges have “no connection to show a common scheme or plan, same act or transaction, or that

the two sets of alleged charges are linked or connected in any way.”

“The circuit court’s decision to join offenses for trial is reviewed for abuse of

discretion.” Walker v. Commonwealth, 289 Va. 410, 415, 770 S.E.2d 197, 199 (2015) (citing

Scott v. Commonwealth, 274 Va. 636, 644, 651 S.E.2d 630, 634 (2007)). An accused may be

tried at one time for more than one offense “if justice does not require separate trials and (i) the

offenses meet the requirements of Rule 3A:6 (b) or (ii) the accused and the Commonwealth’s

attorney consent thereto.” Rule 3A:10(c). Rule 3A:6(b) permits joinder of multiple offenses in

an indictment “if the offenses are based on the same act or transaction, or on two or more acts or

transactions that are connected or constitute parts of a common scheme or plan.” Rule 3A:6(b).

Our Supreme Court has held that “the terms ‘common scheme’ and ‘common plan’ are

not synonymous.” Scott, 274 Va. at 645, 651 S.E.2d at 635. However, neither are they mutually

exclusive. Id. at 646, 651 S.E.2d at 635. Scott defined both terms for the first time. A common

scheme is composed of “crimes that share features idiosyncratic in character, which permit an

inference that each individual offense was committed by the same person or persons as part of a

pattern of criminal activity involving certain identified crimes.” Id. at 645, 651 S.E.2d at 635

(citations omitted). A common plan consists of “crimes that are related to one another for the

purpose of accomplishing a particular goal.” Id. at 646, 651 S.E.2d at 635 (citations omitted).

Further, the Virginia Supreme Court has stated that “offenses may be considered parts of a

common scheme or plan when they are ‘closely connected in time, place, and means of

- 14 -
commission.’” Walker, 289 Va. at 416, 770 S.E.2d at 199 (quoting Satcher v. Commonwealth,

244 Va. 220, 229, 421 S.E.2d 821, 827 (1992)).

Stickle argues that, though the pornographic files were all seized on the same date, they

were placed on the computer at different dates over a range of years and are thus separate crimes

that are not part of a common scheme or plan. However, Stickle is being charged with

possession of these pornographic videos and possession with intent to distribute the various

pornographic images, both of which are, “by nature,” continuing offenses. Morris v.

Commonwealth, 51 Va. App. 459, 467, 658 S.E.2d 708, 712 (2008). At the moment Stickle’s

computer was seized he was in possession of each of the files reflected in the charges

irrespective of the date they were originally placed there.

To protect defendants from being prosecuted multiple times for arbitrary divisions of

offenses, the law long ago adopted the rule that “‘a continuing offence . . . can be committed but

once, for the purposes of indictment or prosecution.’” In re Nielsen, 131 U.S. 176, 186 (1889)

(discussing multiple prosecutions for “unlawful cohabitation,” another continuous offense).

Stickle argues that the twenty-two possession with intent to distribute charges should be

separated from the three possession charges related to the X folder, but he provides no logical

resting place for his argument. Among the questions Stickle’s argument implicitly raises but

does not answer are: Is child pornography more easily divisible than cocaine? Should a drug

dealer charged with possession of twenty-five grams of cocaine have twenty-five (or more if a

smaller unit of measurement is chosen) separate trials? Should a thief be tried separately for

every unit of currency or item stolen? The executive branch of government, in the form of the

Commonwealth’s Attorney, exclusively controls the charging decision and has wide discretion in

doing so, subject only to constitutional or statutory limitations. Stickle’s argument slides easily

down a slippery slope which, if adopted, would serve no purpose beyond devastating judicial

- 15 -
efficiency. Consistent with both Rules 3A:10(c) and 3A:6(b), the offenses here are so

interrelated as to constitute part of a common scheme or plan to collect and/or distribute child

pornography. Therefore, we conclude that the circuit court did not abuse its discretion in

allowing joinder of all the offenses for trial.

Stickle alternatively argues that, even if joinder requirements were satisfied, the three

videos are so prejudicial that justice requires separate trials. He claims the videos constitute

impermissible character evidence and that the circumstances surrounding their creation are

factually distinct from those regarding the pornographic images in the shared folder. In

weighing the prejudice of evidence against its probative value “We generally defer to trial judges

. . . because they, unlike us, participate first person in the evidentiary process and acquire

competencies on the subject that we can rarely duplicate merely by reading briefs and

transcripts.” Thomas v. Commonwealth, 44 Va. App. 741, 758, 607 S.E.2d 738, 746, adopted

upon reh’g en banc, 45 Va. App. 811, 613 S.E.2d 870 (2005) (citing Dandridge v. Marshall, 267

Va. 591, 596, 594 S.E.2d 578, 581 (2004)).

Stickle relies on Hackney v. Commonwealth, 28 Va. App. 288, 504 S.E.2d 385 (1998)

(en banc), and Long v. Commonwealth, 20 Va. App. 223, 456 S.E.2d 138 (1995), both cases

where severance was ultimately required where other crimes evidence was introduced to show

possession of a firearm by a convicted felon. The precedent set by these cases is stark but

narrow, they are limited to this unfortunately common scenario: “a trial court must sever a

charge of possession of a firearm by a convicted felon from other charges that do not require

proof of a prior conviction.” Hackney, 28 Va. App. at 295, 504 S.E.2d at 389. This is a sensible

rule, as evidence of prior convictions is both highly prejudicial and entirely unrelated to the

joined offenses. Evidence in criminal cases is usually prejudicial, otherwise it would not

normally be relevant. To render otherwise relevant evidence inadmissible, the probative value of

- 16 -
the evidence must be substantially outweighed by its prejudicial effect. Va. R. Evid. 2:403.

Here, in the context of the charges and the evidence presented, the effect of the pornographic

videos is no more prejudicial than an analogous situation where a defendant is on trial for

possession of both cocaine and heroin and the evidence is that the cocaine was in his right pocket

and the heroin in his left. Moreover, despite Stickle’s protestations to the contrary, the evidence

of the videos in which he is featured is directly related to the other charges and highly probative

of both his knowledge that child pornography was on his computer and that he intended for child

pornography to be distributed. “Evidence of other crimes or convictions may be admitted for the

purpose of, among other things, . . . proving a relevant issue or element of the offense charged,

such as motive, intent, common scheme or plan, knowledge or identity.” Hackney, 28 Va. App.

at 293, 504 S.E.2d at 388 (internal citations omitted). Thus, we find no error in the circuit

court’s conclusion that justice did not require severance of the charges involving the videos from

the remaining charges.

C. Sufficiency of the Evidence

Stickle finally argues that the Commonwealth had no actual evidence that he knew the child

pornography in the ARES folder was on the laptop and that the Commonwealth is “bootstrapping”

knowledge of the three videos which Stickle created into knowledge of the twenty-two other pieces

of pornography, despite the fact that they are located on different parts of the computer.

“When considering the sufficiency of the evidence to sustain a conviction, we examine the

evidence in the light most favorable to the Commonwealth, the prevailing party at trial, granting it

all reasonable inferences fairly deducible therefrom.” Jordan v. Commonwealth, 286 Va. 153, 156,

747 S.E.2d 799, 800 (2013) (citing Dowden v. Commonwealth, 260 Va. 459, 461, 536 S.E.2d 437,

438 (2000)). “We will not set aside the trial court’s judgment unless it is ‘plainly wrong or without

- 17 -
evidence to support it.’” Kelley v. Commonwealth, 289 Va. 463, 468, 771 S.E.2d 672, 674 (2015)

(citing Code § 8.01-680).

The evidence taken in the light most favorable to the Commonwealth did show that

Stickle had roommates at various times who occasionally used his computer. It also showed that

his fiancée Mallory had used his computer at least once. However, none of these roommates

remained as such during the entire span of time videos were placed on Stickle’s computer.

Additionally, Little only began detecting child pornography present at Mallory’s IP address after

Stickle moved in with her. All images were within a password-protected user account which

also contained the three videos of Stickle himself performing sexual acts with a child. An

oft-quoted maxim of our jurisprudence is that “[t]he Commonwealth need only exclude

reasonable hypotheses of innocence that flow from the evidence, not those that spring from the

imagination of the defendant.” Hamilton v. Commonwealth, 16 Va. App. 751, 755, 433 S.E.2d

27, 29 (1993). Stickle’s contention is entirely unsupported speculation clearly rejected by the

jury rather than reasonable inferences flowing from the evidence, and it was unnecessary for the

Commonwealth to exclude them. The jury was entitled to reject Stickle’s assertion that for many

years an interstate cabal of roommates and fiancées used his computer without his knowledge to

store child pornography, and we hold that the evidence was legally sufficient for the jury to

instead conclude beyond a reasonable doubt that the child pornography was knowingly possessed

and possessed with the intent to distribute by a man with such an interest in child pornography

that he created his own videos.

- 18 -
 III. Conclusion

Upon review of the record, we find no error in the trial court’s decisions to admit the

evidence and to join the charges. We also find that the evidence was sufficient to convict Stickle

on all charges. The judgment of the trial court is therefore affirmed.

Affirmed.

- 19 -