## Facts

- An FBI agent conducted an undercover investigation using LimeWire, a peer-to-peer file-sharing program that allows users to search for and download shared files from other users.
- The agent searched for “8yo,” identified a Tulsa-area user sharing many files with filenames suggesting child pornography, and downloaded and viewed dozens of files he believed were child pornography.
- The user’s IP address was traced to a Tulsa residence where Andre Ralph Haymond lived with his mother.
- A magistrate judge issued a warrant to search the residence and seize and examine a computer and related digital media for evidence of child pornography.
- Agents executed the warrant, seized the computer hard drive from Haymond’s bedroom, and conducted a forensic examination.
- During the search, Haymond consented to an interview and, according to the agent, admitted he had been accessing child pornography since 2006 using peer-to-peer programs, including LimeWire; he also admitted purposeful searches using child-pornography-related terms.
- The prosecution relied on seven images recovered from the hard drive’s unallocated space (deleted-file area), tied to a known series involving two boys; a medical expert opined the subjects were under 18, and an ICE agent recognized the subjects.

## Issues

1. Whether the search warrant for the residence and computer was supported by probable cause based on the agent’s LimeWire investigation and IP-address trace.
2. Whether the evidence was sufficient to prove knowing possession or attempted possession of child pornography when the charged images were recovered only from unallocated space.
3. Whether the government sufficiently proved that the persons depicted in the charged images were minors.

## Decision

- The Tenth Circuit affirmed the conviction.
- The court upheld denial of the motion to suppress, concluding the warrant was supported by probable cause.
- The court upheld denial of the Rule 29 motions, finding sufficient evidence for a rational jury to find knowing possession or attempted possession beyond a reasonable doubt.
- The court held the government presented sufficient proof that the images depicted minors through expert testimony, law-enforcement identification, and the images themselves.

## Legal Principles

- Probable cause to search for child pornography may be established when an agent downloads and views multiple files strongly indicative of child pornography from a peer-to-peer user whose IP address is traced to the target residence, creating a sufficient nexus between the offense and the place to be searched.
- Knowing possession or attempted possession can be proven through circumstantial evidence that images were previously stored on a defendant’s device and later deleted, including recovery from unallocated space, especially when combined with admissions of intentional searching and downloading.
- The fact that images are recovered from unallocated space does not, by itself, negate knowing possession; deletion may support an inference that the defendant previously possessed the images and exercised control over them.
- Proof that depicted persons are minors may rest on a combination of expert opinion on apparent age, law-enforcement testimony based on familiarity with known series, and the jury’s review of the images.

## Conclusion

The court affirmed Haymond’s conviction, holding that the peer-to-peer downloads and IP trace supplied probable cause for the search warrant and that the recovery of deleted images, together with Haymond’s admissions and testimony identifying the minors, allowed a rational jury to find knowing possession or attempted possession beyond a reasonable doubt.


United States v. Haymond, 672 F.3d 948 (10th Cir. 2012)