(rentas-nmcca-providence-ineffective-assistance-military-defense-lawyer)

United States v. Rentas: When “Trash” Almost Sank a Plea—And the IAC Claim That Followed

On 30 April 2026, the Navy-Marine Corps Court of Criminal Appeals (NMCCA) issued a per curiam opinion affirming the convictions and sentence in United States v. Rentas, No. 202500082. Lance Corporal Joshua J. Rentas had pleaded guilty at a general court-martial at Camp Foster, Okinawa, to four specifications of possessing child pornography and one specification of distributing child pornography under Article 134, UCMJ. The military judge sentenced him to a dishonorable discharge, 36 months of confinement, total forfeitures, and reduction to E-1. On appeal, Rentas raised two Grostefon issues: improvident pleas based on alleged pressure from counsel during a mid-providence recess, and ineffective assistance of counsel for failing to retain a digital forensic expert. NMCCA rejected both. The opinion offers a textbook walk-through of how providence inquiries work, what an “inconsistency” actually means, and how Strickland prejudice plays out in the guilty-plea context. For service members and any military defense lawyer working a pretrial agreement, it is worth a careful read.

The Facts the Court Cared About

Rentas confessed to NCIS, consented to the search and seizure of his electronic devices, and submitted a “letter of apology” with his proposed plea agreement. Pursuant to that agreement, he pleaded guilty to possessing child pornography on two laptops, an iPhone, and an external hard drive, and to one distribution specification.

During the providence inquiry on Specification 2 (the external hard drive), Rentas told the military judge he had put the hard drive in “the trash can.” Trial counsel called for a recess. Eight minutes later the inquiry resumed. Rentas explained “trash” actually meant a desk drawer “full of a bunch of trash,” that he had transferred the data—including some of the child pornography files—from the hard drive onto a different laptop, and that he planned to eventually get rid of the hard drive. The military judge accepted the pleas and imposed the agreed-upon sentence.

After trial, Rentas filed a declaration alleging that during the recess his trial defense counsel and the trial counsel both told him to “stick to the script” or his plea deal would collapse and he would face “over 50 years of confinement.” NMCCA initially denied his motion to attach the declaration, then denied reconsideration, then on its own reconsidered again and granted the motion. Even with the declaration in the record, the appeal failed.

Issue One: The Providence Inquiry and the “Trash” Problem

The standard of review for accepting a guilty plea is abuse of discretion, with questions of law reviewed de novo. United States v. Inabinette, 66 M.J. 320, 322 (C.A.A.F. 2008). Under Article 45, UCMJ, and R.C.M. 910(h)(2), the military judge must reject a plea—or resolve the inconsistency—if the accused sets up matter inconsistent with the plea. The substantial basis test asks whether anything in the record raises a substantial question about the plea.

NMCCA held nothing in the record raised that question for Specification 2. The “trash” comment was not an inconsistency. Rentas explained the desk-drawer-full-of-trash meaning, admitted he transferred the files including the child pornography to another device, and never claimed he was not guilty or that he obtained the files inadvertently. The stipulation of fact had him admitting “exclusive dominion and control” of the hard drive. That is the opposite of an inconsistency. The court distinguished United States v. Hayes, 70 M.J. 454 (C.A.A.F. 2012), and United States v. Phillippe, 63 M.J. 307 (C.A.A.F. 2006): a military judge must dig deeper when the accused raises a possible defense, but mere mitigation or rationalization is not the same thing as a defense. See United States v. Shaw, 64 M.J. 460 (C.A.A.F. 2007).

The recess-pressure allegation got even shorter treatment. Rentas did not argue coercion. The court flatly stated that “it is reasonable for a defense counsel to inform a client of possible and foreseeable consequences if a military judge were to reject a guilty plea as improvident.” Telling a client what the maximum punishment looks like if the deal collapses is not improper pressure—it is candid lawyering. The court also pointed out that Rentas did not challenge providence as to Specifications 1, 3, 4, or 5, but asked that all five findings and the sentence be set aside. NMCCA was not biting.

For background on how the Care inquiry functions and how plea problems develop in the record, see our prior post: Guilty pleas under the UCMJ.

Issue Two: Ineffective Assistance and the Digital Forensic Expert

Rentas’s second claim was that trial defense counsel was ineffective for failing to retain a digital forensic expert who could have explained “the process by which files can be transferred from one device to another without the knowledge or intent of the user.” The court reviewed the claim de novo under Strickland v. Washington, 466 U.S. 668 (1984), and the guilty-plea-specific prejudice standard from Lee v. United States, 582 U.S. 357 (2017): whether there is a reasonable probability that, but for counsel’s errors, the accused would not have pleaded guilty and would have insisted on going to trial.

The opinion did two things that matter for any future Strickland claim in the plea context. First, it presumed reasonable tactical judgment. Rentas had already confessed to NCIS and consented to the searches that produced the devices. Against that record, declining to retain a digital forensic expert was a reasonable strategic call—and there is “significant” evidence to overcome before that presumption breaks. Second, it applied Suarez and Furth. A bare post-trial assertion that the accused would not have pleaded guilty is not enough. The court must look at contemporaneous evidence—the confession, the consent search, the apology letter, the stipulation of fact, the agreed sentence cap—because every appellant has an incentive to retroactively reframe the deal. United States v. Suarez, 86 M.J. 65 (C.A.A.F. 2025); United States v. Furth, 81 M.J. 114 (C.A.A.F. 2021).

The court added a sharp factual finding tucked in a footnote: it did not credit Rentas’s claim that he was unaware files would download onto the hard drive. With that credibility call, the prejudice analysis was over.

What This Opinion Teaches

Several practical points emerge. A providence inquiry is not a verbatim test. The military judge must resolve actual inconsistencies, not chase every mitigating word. Rationalization, minimization, and clarification do not invalidate a plea unless they negate an element or set up a defense. See our discussion of this principle: Providence shines down or upon.

Recess conversations between an accused and defense counsel about the consequences of an improvident plea are normal and lawful. Allegations of “pressure” must show coercion that overrides voluntariness, not just candor about exposure if the deal collapses. A post-trial declaration alone, even if attached to the record, rarely moves the needle when the contemporaneous record—confession, consent, stipulation, apology letter, plea agreement—uniformly supports the plea.

Ineffective-assistance claims in the plea context turn on whether the accused would have rejected the deal and gone to trial. That is an objective inquiry, anchored to the actual evidence of guilt, not to the appellate brief’s hindsight. When the Government has a confession, consensual search results, and a stipulation, the Lee prejudice showing is steep.

Digital forensic experts can be powerful tools in CSAM and computer-evidence cases. See United States v. Douangdara and our prior post: How a guilty plea can go wrong. But timing matters. The right place to litigate digital forensics is before the guilty plea, not after. Once an accused confesses, consents to searches, signs a stipulation, and pleads guilty, the appellate burden to undo the plea on a forensics theory becomes very heavy.

The Strategic Lesson Before You Sign a Plea Agreement

If digital forensics could exonerate or mitigate—if there is a real argument about automatic syncing, cloud backups, malware downloads, shared devices, or unintended file transfers—those arguments belong in pretrial motions, suppression litigation, expert assistance requests under R.C.M. 703(d), and pretrial negotiations. They lose nearly all their power once the providence inquiry is over and the plea is accepted. Rentas is the latest reminder that the leverage in a CSAM case is built before arraignment, not after sentencing.

How Cave & Freeburg Can Help

At Cave & Freeburg, our military defense lawyers handle Article 134 child pornography cases, NCIS, OSI, CID, and CGIS investigations, and the full range of pretrial and appellate work in courts-martial across every service. We litigate motions to suppress under the Fourth and Fifth Amendments, secure expert assistance for digital forensics under R.C.M. 703(d), evaluate plea agreements with realistic exposure analysis, and—when the government’s case has real weaknesses—we contest at trial rather than settle. On appeal, we know how NMCCA, AFCCA, ACCA, the Coast Guard CCA, and CAAF handle providence challenges, Strickland claims under Suarez, Furth, and Lee, and post-trial declarations. If you face a child pornography investigation or charge under Article 134, UCMJ, or you have already been convicted and want a candid appellate assessment, contact Cave & Freeburg, LLP, today. Call (703) 298-9562 or (917) 701-8961 to speak confidentially with an experienced military defense counsel.

The Fourth Amendment protects against unreasonable searches of our property, including cell phones. In Riley, the Supreme Court properly required a search warrant for (CID, OSI, CGIS, and NCIS) intrusions into seized cellphones. The court has acknowledged that people have a privacy right against Government intrusion without a warrant based on probable cause. As we know, there is an awful lot of personal data that is kept on the cellphone, and that can be retrieved with forensic tools.

In Lattin, the issue was a fishing expedition through the Appellant’s cellphone. The trial transcript shows that the OSI agent believed she had the right to search everything in the cellphone because it had been seized after the execution of a commander’s search and seizure authorization. With that general warrant concept in her mind she scrolled through a lot of information on the Appellant’s phone that wasn’t related to the reason for the search in the beginning. The OSI agent did not believe there were any limits based on her training and experience. Both the AFCCA and CAAF have ruled that the search was unlawful but that it was excused because there would be no future deterrent effect to OSI committing further unlawful searches. The court partly relied on Mil. R. Evid. 311, which wrongly summarizes the law post-Herring that was reinforced in Davis.

Shortly after Lattin comes Shields, another cellphone search case. The case presents dueling experts where, as you would expect, the Government expert was arguably given more “credibility” than the defense expert. When DCFL or government computer forensic “experts,” tell you they used the best and most current methods, you should not always believe that. Shields is a case where the DCFL used bad methods that ended up creating a fishing expedition. The court seemed to agree that the method wasn’t the best, but–it was good enough for government work.

In each case, the investigators were looking for texts, images, or data for a specific date or short time period. Forensic experts–good ones–will tell you that using proper methods readily available in the Atom or Cellebrite applications can make it relatively easy to create a narrow or focused search for items within a specified time period. Then, once the data is extracted for that time period, additional search criteria can narrow the data to that which is relevant to the reasons for the search. This, of course, is a little more time-consuming than a general search which, in light of Shields and Lattin, they might get away with.

These are matters–the law of the Fourth Amendment and issues of particularity and scope and cellphone or computer forensics that your military defense counsel needs to know about.

A jokester might suggest that the MCIO theme song might be ‘Scrolling Down the River on a Sunny Afternoon.’

If you do have leisure time on the river, you might take Digital Rummaging with you to read along the way.

Attorney Cave of Cave & Freeburg, LLP, is co-counsel in a petition for certiorari to be filed in Lattin v. United States.

Give us a call if you want to talk about representation by Cave & Freeburg, LLP as your military defense counsel.

The very foundation of what we do depends on trust, and trust depends on the treatment of all Soldiers with dignity and respect by fellow Soldiers and leaders. Without this, our profession is placed in jeopardy, our readiness suffers, and our mission success is at risk. The sentiment conveyed above is enduring; it epitomizes core Army values. In an age where electronic communication is commonplace, it is critical to ensure that dignity and respect is maintained offline and online. A harmful communication sent from behind a screen does not trivialize the behavior; the consequences of carrying out acts which flout Army values are the same regardless of the domain—cyber or face-to-face—in which those acts occur. “It is relatively easy to hurt others when their suffering is not visible and when causal actions are physically and temporally remote from their effects.”2 This is a key reason why Army leaders need to understand how to manage online misconduct. To carry out their responsibilities, leaders need unambiguous and comprehensive regulatory tools at their disposal which they can apply consistently and confidently. On 25 July 2018, the Deputy Chief of Staff of the Army circulated an All Army Activities (ALARACT) message providing guidance on online conduct applicable to all members of the Army.

[All Army Activities Message, 058/2018, 251301Z Jul 18, U.S. Dep’t of Army, subject: ALARACT Professionalization of Online Conduct [hereinafter ALARACT 058/2018].]

Read more at the Army Lawyer.

No. 18-0339/AF. U.S. v. Scott A. Meakin. CCA 38968. On consideration of the petition for grant of review of the decision of the United States Air Force Court of Criminal Appeals, it is ordered that said petition is hereby granted on the following issue:

WHETHER APPELLANT’S CONVICTION FOR ENGAGING IN ANONYMOUS, PRIVATE, AND CONSENSUAL COMMUNICATIONS WITH AN UNKNOWN PARTNER(S) IN THE PRIVACY OF HIS HOME WAS LEGALLY SUFFICIENT.

Briefs will be filed under Rule 25.

Here is a link to the AFCCA opinion., from which this appeal flows. However, there is an earlier opinion here which is relevant to the granted issue.

Investigation by the Department of Homeland Security and the Air Force Office of Special Investigations (AFOSI) revealed Appellant engaged in online conversations, image sharing, and electronic mail (email) correspondence with a Canadian law enforcement officer in a chat room on a pornographic website. Further investigation revealed Appellant had engaged in similar online conversations with a number of others. The content of the conversations involved extremely graphic descriptions of sexual abuse and degradation of children. On many occasions, Appellant asked for photographs of the alleged abuse. Appellant admitted to engaging in various online chats.

He was charged with violating Article 133, along with CP allegations. AFCCA noted that:

There is no requirement that the conduct underlying an alleged violation of Article 133, UCMJ, be criminal on its own. United States v. Norvell, 26 M.J. 477, 481 (C.M.A. 1988). The underlying act may be constitutionally protected in civilian society but not necessarily so for military members, and therefore be criminal under Article 133, UCMJ. United States v. Forney, 67 M.J. 271, 275 (C.A.A.F. 2009). Purely private speech can serve as the basis for a charge under Article 133. United States v. Hartwig, 39 M.J. 125, 128 (C.M.A. 1994). Additionally, private conduct may constitute an offense under Article 133, UCMJ. United States v. Moore, 38 M.J. 490, 493 (C.M.A. 1994).

As this case demonstrates, the novelty of an assimilative charging decision under Article 134 often wears off during the course of an appeal,

Says ACCA in a footnote to United States v. Meredith, 7 August 2018.

Specification 1 of Charge II alleged appellant violated the Computer Fraud and Abuse Act (CFAA), 10 U.S.C. § 1030, by obtaining the sex videos from HN SS’s and KS’s computer. We agree with the parties that the evidence for the Article 134 offense assimilating the CFAA, specifically, 18 U.C.S. § 1030(a)(2), was legally and factually insufficient.

Most of the reasoning is found in footnote 5.

Interestingly,

In an unusual twist, the government asks us to send this case back to the convening authority for a sentence rehearing, arguing that the gravamen of the misconduct of which appellant was found guilty was the violation of the CFAA and pointing out HN EA and HN TH did not testify about the impact of the offenses during sentencing. We disagree.

On reassessment, the Court approved all of the sentence except the 45 days confinement (and total forfeitures) the Appellant had already served–another pyrrhic victory (although the Appellant might have a little back-pay coming).

The unsophisticated suspect consents to the taking a search of their cell phone or computers.

Or, the MCIO get a search authorization.

Then investigators basically go on a fishing expedition for evidence of the current allegations, and anything else they can find–justifying anything else found on the “plain view” doctrine.

Voila–more charges.

So, we are about to find out from CAAF whether there are limitations on a search authorization of a cell phone or computer.

No. 16-0727/AF. U.S. v. James W. Richards IV. CCA 38346. On consideration of the petition for grant of review of the decision of the United States Air Force Court of Criminal Appeals, it is ordered that said petition is hereby granted on the following issues: (Issue II) WHETHER THE 9 NOVEMBER 2011 SEARCH AUTHORIZATION WAS OVERBROAD IN FAILING TO LIMIT THE DATES OF THE COMMUNICATIONS BEING SEARCHED, AND IF SO, WHETHER THE ERROR WAS HARMLESS.

The opinion of the Air Force Court of Criminal Appeals (AFFCA) is here.

The actions of AFOSI were not perfect. Ideally, AFOSI should have: (1) more specifically listed in the search authorization application what aspects of Appellant’s electronic devices it wanted to search and what types of evidence it expected to find on these devices; (2) specified in the affidavit accompanying the search authorization that it was seeking evidence of videos and images, not just text-based communications, and why it believed this evidence was present; (3) better defined what types of evidence the forensics laboratory was expected to provide on the FDEs; (4) outlined a clear search methodology for searching the FDEs, starting in folders where evidence of the crime being investigated was most likely to be found; and (5) informed the military magistrate of AP’s recantations concerning the sexual relationship. “However, model investigative practice is not the Fourth Amendment standard. ” Nor for the OSI, but good enough for gubmint work.

No. 16-0727/AF. U.S. v. James W. Richards IV. CCA 38346. On consideration of the petition for grant of review of the decision of the United States Air Force Court of Criminal Appeals, it is ordered that said petition is hereby granted on the following issues:

I. WHETHER THE PANEL OF AFCCA THAT HEARD APPELLANT’S CASE WAS IMPROPERLY CONSTITUTED.

II. WHETHER THE 9 NOVEMBER 2011 SEARCH AUTHORIZATION WAS OVERBROAD IN FAILING TO LIMIT THE DATES OF THE COMMUNICATIONS BEING SEARCHED, AND IF SO, WHETHER THE ERROR WAS HARMLESS.

The recent decision of the Army Court of Criminal Appeals in a government appeal tells you why it’s important to check the warrant.

In United States v. Gurzynski, the court had before it a government appeal of a military judge’s decision to suppress evidence of a computer media search.

The accused was charged with “attempted sexual abuse of a child, abusive sexual contact with a child and other offenses related” to the allegations against the appellant.” The CID got a warrant to search for the related evidence. However, in the process the examiners came across a picture they believed was CP. Rather than stop and seek an expansion of the warrant, they went ahead and conducted a full search. Essentially,

Noting that search warrants must be specific, the military judge found the same was not true for child pornography because nothing in the warrant or supporting affidavit mentioned anything “even closely approximating evidence of child pornography.” See United States v. Carey, 172 F.3d 1268 (10th Cir, 1999). In this respect, the DA Form 2922, relied upon by SA CP, impermissibly expanded on the scope of the warrant. The military judge also noted the nature of the charges, given their plain statutory meaning, did not remotely contemplate the possession, creation or distribution of child pornography.

The military judge rejected application of the plain view doctrine.

Government appeal denied.

A responsible law enforcer would take the information to get a search warrant or command search authorization. But that doesn’t always happen. What does happen is that the law enforcer or someone in command goes and looks for themselves. The question then becomes whether that is a search or is it a continuation of a private search. If a private searcher shows the law enforcer exactly what they saw and that alone, there may not be an unlawful search. But what happens if the law enforcer does more than strictly replicate what the private searcher did. So Orin Kerr has some information for us in the Washington Post.

[T]he 11th Circuit handed down a new computer search decision,United States v. Johnson, that both sharpens and deepens the circuit split on how the private search doctrine of the Fourth Amendment applies to computers. Johnson isn’t a likely candidate for Supreme Court review. But it does leave the private search doctrine in computer searches ripe for Supreme Court review in other cases working their way through the courts.

See his article here in a 2005 article.

Because the Fourth Amendment applies only to the government and its agents, the Fourth Amendment is not triggered when private parties not associated with the government conduct searches. When a private party conducts a search and finds evidence of crime, the private party often goes to the police and voluntarily shows the police what she has found. The Supreme Court uses what I have called the “private-search reconstruction” doctrine to regulate what the police are allowed to see without a warrant. The police can reconstruct the private party search, seeing what the private party saw, but they can’t exceed the search the private party conducted. On to the important legal question: When a private party searches a computer, sees a suspicious file and reports the finding to the police, what kind of government search of the computer counts as merely reconstructing the private search and what kind of search counts as exceeding the private search?

Read on for Orin Kerr’s thoughts in his article.

THE ABUSE OF DISCRETION STANDARD OF REVIEW IN MILITARY JUSTICE APPEALS, by COLONEL JEREMY STONE WEBER.

US v. Husmann, No. 13-2688 (3d Cir. Sept 3, 2014) (available here) .

We all of us have an a client who is charged with distribution of CP because they were using a P2P program such as Limewire, and where the automatic settings placed information in the “shared” folder. Because the information is in the shared folder it is accessible to others who search Limewire and come across it. Actually many clients have been caught through the FBI or some other enforcement agency trolling Limewire for such information.

The opinion in Husmann makes much of the “intentional” placing of CP in the shared folder. But does not address the way in which the program, by default places everything in the shared folder. Normally the use needs to affirmatively change the settings for downloads not to go in the shared folder. The opinion assumes the subject files were deliberately placed in the shared folder making them accessible to others.

So, you have a client who downloads CP via a P2P program, doesn’t realize about the automatic settings upon execution of the P2P software, and there is NO evidence that someone queried and received CP from that client’s account? In Husmann the investigators went through the various logs to see if they could find any evidence of another computer connecting and downloading, but weren’t able to find such evidence.

Currently in the Third the person may not be convicted, see Husmannn. It’s a 2-1 decision with a strong dissent. It’s only the Third.

Can you use the rationale from Husmann to defeat a conviction for distribution. Keep in mind that he court was construing the definition of “distribution” under the federal statute. And if it’s not distribution is it an attempted distribution.

All in all an interesting read for the all to common CP case.

After giving further consideration to the language of the statute, its legislative history, the underlying rationale for the federal child pornography laws, and the brief of Solicitor General submitted on behalf of the United States, we hold that the statutory term “lascivious exhibition of the genitals or pubic area,” as used in 18 U.S.C. Sec. 2256(2)(E), does not contain any requirement that the child subject’s genitals or pubic area be fully or partially exposed or discernible through his or her opaque clothing. The statutory language is clear and contains no ambiguity. Therefore, the rule of lenity should not be applied to defeat the clear intent of Congress to prohibit the possession of child pornography to the maximum extent allowable under the Constitution.

Certainly the broadened definition of what can be CP opens up a wider array of images subject regulation. In response to First Amendment and other concerns raised by Knox, the court opined:

Knox’s prediction that our interpretation of an exhibition will result in prosecutors leafing through family albums and church bulletins containing innocent pictures of fully clothed children and pressing charges is unfounded. The limiting principle in the statute is the requirement of lasciviousness.17 A visual depiction of a child subject’s genitals or pubic area, whether the child is clothed or naked, must be lascivious in order to be proscribed. Whether a depiction is lascivious is essentially an inquiry into whether or not the material meets the standard of lasciviousness as guided by the Dost factors.

The ACCA notes that the Court of Appeals for the Armed Forces has implicitly adopted Knox.

[W]e determine whether an image contains a “lascivious exhibition” by review of the totality of the circumstances, including consideration of the so-called Dost [United States v. Dost, 636 F. Supp. 828, 832 (S.D. Cal. 1986)] factors. See United States v. Roderick, 62 M.J. 425, 429-30 (C.A.A.F. 2006) (adopting the approach of the Third Circuit in Knox but not specifically referencing their holding relative to nudity).

Slip op. at 6.

Defendant had no reasonable expectation of privacy in his computer from police accessing it via Limewire when he was hooked up to the Internet. He did not create an expectation of privacy from his efforts to hide files on his computer. Warshak has no application to this situation. United States v. Conner, 2013 U.S. App. LEXIS 7437, 2013 FED App. 0365N (6th Cir. April 11, 2013)[.]

The court references United States v. Warshak, 631 F.3d 266 (6th Cir. 2010).

Generally speaking, computer users have a reasonable expectation of privacy in data stored on a home computer. Guest v. Leis, 255 F.3d 325, 333 (6th Cir. 2001). Conner argues that under United States v. Warshak, 631 F.3d 266 (6th Cir. 2010) (en banc), third-partyaccess to information on one’s computer is consistent with a reasonable expectation of privacy in that information. In Warshak, we agreed that the government could not compel a commercial ISP to turn over the contents of a subscriber’s e-mails without a warrant because subscribers “enjoy[] a reasonable expectation of privacy in the contents of emails,” even though an ISP has the ability to view the contents of e-mail prior to delivery. 631 F.3d at 288. Here is a link to EFF’s amicus in Warshak.

h.t fourthamendment blog.

For those of us doing a lot of CP cases – LimeWire, one of several peer-to-peer file sharing programs, is increasingly found to be the method by which CP is received or transmitted. Typically the prosecution calls a forensic computer examiner as an expert witness (although I notice the Navy is trying to short-circuit this by calling the duty NCIS agent to testify about computers). Anyway, FEB notes the difficulty courts are having in deciding whether testimony about computers and/or software falls within [Mil. ]R. Evid. 701 (lay) or 702 (expert).

[T]he line between lay and expert testimony is very hard to discern. A closer question would have been raised in the case if an objection had been made at trial and review was under the less deferential abuse of discretion standard. The issue of lay versus expert testimony arises in other contexts, including on computer forensic testimony, as noted in these prior posts: Drawing The Line On Computer Forensic Expert And Lay Testimony (Part I); Drawing The Line On Computer Forensic Expert And Lay Testimony (Part II).

In Caldwell the defense didn’t object to a LimeWire employee’s testimony, so the standard of review was “plain error” which is the easiest of all standards for the prosecution to beat.

Of interest was the testimony of the LimeWire employee in issue. When asked if someone else using LimeWire can send you a file you didn’t request he answered no. That is superficially correct. The idea being that the file was a CP related file and the person searched for it, knew it was CP, and had it downloaded. However, the question presumes that the downloaded file was correctly named (in the visible part) or that there were not additional files added to the file downloaded. I’ll give you an example.

A certain actress with the initials CZJ is an attractive woman. People will search for and find some risque pictures of her on LimeWire (or Kazaa, BitTorrent, etc.). Most of the time they will get risque pictures and nothing else. However, every now and again the person is likely to get a series of pictures of CZJ where a CP image is tacked on the end of the series. You won’t know this until you view all the series on or off line. And remember, at this point the images are automatically downloaded to a default folder. (This is no different than CP distribution via VHS. When VHS was a popular video medium CP’ers would cut-and-paste a CP video five or ten minutes into a regular movie. That’s done with DVD now. That’s why law enforcement seize the home movies and DVDs. They are looking for embedded CP videos. The same can happen with a series of apparently legitimate images on the web.) You don’t know you are getting CP images because all you know is the displayed name of the file is CZJ nude. When there is CP attached there is usually an extended file name that is not visible/displayed unless you examine the properties of the image. That extended name has the typical CP search terms in the extended, but not visible/displayed, file name. That hidden extended name is done by CP’rs to help other CP’rs find the images. But in process the innocent searcher and retriever of some risque photos of CZJ can unknowingly end up with CP. But ask anyone to believe that if you will . . . (Caution: Please don’t try this at home yourself.)

Courtesy of my favorite forensic computer examiner, Eric Lakes at CyberAgents, Inc., he pointed me to a couple of items about LimeWire and forensic examination problems. For example, DCFL has itself found an issue with LimeWire.

Lewthwaite, Joseph, & Smith, Victoria, Limewire examinations, Digital Investigation 5 (2008) S96-S104. The authors are employed at the Defense Cyber Crime Institute and DCFL.

Here is the important part of the article which shows that a non-expert/lay-person (read duty NCIS agent) might misinterpret and therefore wrongly testify that a client has been searching for CP in LimeWire.

The issue comes up most frequently with clients who have been actively searching for adult P., and who think that’s all they are getting or likely to get.

Back to Caldwell. If you get a situation where a non-forensic computer examiner is going to testify about LimeWire and CP, consider filing a Houser motion to exclude the testimony.

The case addresses the often perplexing issue of prosecutorial overcharging in CP cases. In this case the prosecution charged the CP under Article 134(1)(2) and (3), UCMJ. The court does note that some overcharging is to be expected prior to trial and the prosecution then commits itself to proving up the various charges. However, this was a guilty plea case. While the MJ did address some factors under United States v. Quiroz, NMCCA decided she’d not gone far enough. There was no effect on the sentence.

In People v. Michael James Tecklenburg, (2009, 169 Cal. App. 4th 1402) the California Court of Appeals considered the relevance and applicability of involuntary “pop-ups” and temporary Internet files (TIF or “cache”) to the applicable statute. California’s Penal Code section 311.11(a) makes it illegal to “knowingly posses or control” depictions defined as child pornography according to state law (P.C. 314, subd. d). The court specifically considered the variables required to establish “control”.

In Tecklenburg, the court denied appeal based on the State’s discovery having established the cumulative applicability of the following variables: the user actively searched for child porn; the user visited child porn web sites; the user explored beyond the first page of said web sites; the user clicked on images on, at least, one web site; the images appeared and were accessed multiple times; the user enlarged thumbnail images; the images were “part of a series or collection”; the size and format did not match that of a pop-up; similar, and sometimes identical, images were found on both the user’s home and work computers.

While I don’t agree with the entirety of the court’s findings, said computer forensics expert Jeff Fischbach, nor am I comfortable that the court fully appreciates the non-standardized and ever-evolving nature of the Web, or the limitations of computer forensics, I do think that the decision itself serves as a good minimum benchmark, or litmus test, for both prosecution and defense in similar cases.

/tip to fourthamendment.com blog for reporting this case.

In light of this court’s decisions in United States v. Davenport, 519 F.3d 940 (9th Cir. 2008) and United States v. Giberson, 527 F.3d 882 (9th Cir. 2008), Brobst’s convictions for both receipt and possession of child pornography violated the Double Jeopardy Clause of the Fifth Amendment to the Constitution. See Davenport, 519 F.3d at 947. “Where we conclude that a defendant has suffered a double jeopardy violation because he was erroneously convicted for the same offense under two separate counts . . . ‘the only remedy consistent with the congressional intent is for the [d]istrict [c]ourt, where the sentencing responsibility resides, to exercise its discretion to vacate one of the underlying convictions.'” United States v. Schales, 546 F.3d 965, 980 (9th Cir. 2008)(quoting United States v. Ball, 470 U.S. 856, 864, 105 S. Ct. 1668, 84 L. Ed. 2d 740 (1985)). Accordingly, we vacate the judgment and remand with instructions that the district court vacate one of Brobst’s convictions for either receipt or possession of child pornography, allowing for it to be reinstated without prejudice if his other conviction should be overturned on direct or collateral review.

United States v. Brobst, 558 F.3d 982, *39-40 (9th Cir. 2009).

We hold, as a matter of due process, appellant was not on fair notice that his conduct, arising from simply negligent possession of child pornography, violated Article 133, UCMJ, under the facts and circumstances of this case. Accordingly, we set aside and dismiss Charge II and its Specification alleging a violation of Article 133, UCMJ, and reassess appellant’s sentence.

[T]he governmentcharged appellant with violating Article 134, UCMJ, by knowingly possessing child pornography in violation of 18 U.S.C. § 2252A.4 On the date the convening authority referred appellant’s charges and specifications to trial, the government dismissed and replaced the Article 134, UCMJ, violation with a charge alleging appellant violated Article 133, UCMJ, by “wrongfully and dishonorably possess[ing]” a diskette containing eight images of child pornography, “negligently fail[ing] to note that there was child pornography” on the diskette, “negligently fail[ing] to eliminate” child pornography from the diskette, and “negligently leaving . . . child pornography on the [d]iskette in his place of residence in such a manner that other persons could easily access” the images.

Before an officer can be convicted of an offense under Article 133, UCMJ, due process requires “‘fair notice’ that an act is forbidden and subject to criminalsanction.” United States v. Vaughan, 58 M.J. 29, 31 (C.A.A.F. 2003) (citing United States v. Bivins, 49 M.J. 328, 330 (C.A.A.F. 1998)); see United States v. Anderson, 60 M.J. 548, 554 (A.F. Ct. Crim. App. 2004).

It seems that the appellant told the judge that he was given a disc with a zip file of adult porn by a colleague. He never opened the file. Until the results of a forensic search by law enforcement he did not know that there were eight CP images in the zip file. According to the prosecution and the judge, he had a duty to open the file and check to see there was nothing illegal on it, and if he found something illegal he should have gotten rid of it and — not stated in the case — turned in his friend who gave him the disc. Having failed to do that, he could be convicted of conduct unbecoming through a negligent dereliction theory. The other charge that related to mishandling classified information was allowed to stand.

This is another case of a pyhrric victory. He was sentenced to the maximum at trial of 12 months. IAW with a PTA the excess of six months was disapproved. It looks like the case was tried in 2005, and now the opinion in 2009. His sentence was reduced from six months to five months on reassessment. This seems odd, because while the mishandling of classified information is obviously serious, isn’t it more likely his sentence was more harsh because of child pornography?

One assumes the court was aware of CAAF’s action in United States v. Forney, __ M.J. ___, No. 05-0647/NA (C.A.A.F. March 26, 2009). See CAAFLog’s analysis of Forney.

Here is a APRI monograph which explains emails and how to maybe identify who has been sending them. This type of information is as equally useful to the defense counsel as to the prosecutor. The reverse of course works for prosecutors. Make Sun Tzu proud; study the ways of your enemy.

Understanding E-mail.

So don’t ignore the prosecution’s websites, blogs, etc.