The opinion of the court was delivered by: Ciparick, J.:
This opinion is uncorrected and subject to revision before publication in the New York Reports.
The question presented for our review is whether the evidence proffered at defendant's trial was legally sufficient to support his convictions for Promoting a Sexual Performance by a Child (Penal Law § 263.15) and Possessing a Sexual Performance by a Child (Penal Law § 263.16). We must consider, among other issues, the evidentiary significance of "cache files," or temporary internet files automatically created and stored on a defendant's hard drive, and the defendant's awareness of the presence of such files. We conclude that where the evidence fails to show that defendant had such awareness, the People have not met their burden of demonstrating defendant's knowing procurement or possession of those files. We further conclude that merely viewing Web images of child pornography does not, absent other proof, constitute either possession or procurement within the meaning of our Penal Law.
The following evidence was adduced at defendant's trial. On May 26, 2005, defendant James D. Kent, a professor of public administration at a Dutchess County college, received a new office computer through a campus-wide technology upgrade. The files stored on the hard drive of the old computer were transferred to the new computer. On April 5, 2007, a student employee of the college's information technology (IT) department went to defendant's office in response to his complaints that his computer was malfunctioning. While running a virus scan of the computer's hard drive, the employee discovered a work folder containing numerous ".jpg" or picture files, displayed as "thumbnails," of scantily clad, prepubescent girls in provocative poses. When the virus scan failed to correct the computer's unresponsiveness, the employee removed defendant's hard drive and took it back to the IT office, where supervisors learned of the images. College administrators informed defendant that these images had been found on his computer, but defendant denied any knowledge of them. Approximately two weeks later, the college submitted defendant's hard drive to the Town of Poughkeepsie Police Department with a "Consent to Search" form signed by a college administrator.
Barry Friedman, an investigator in the computer forensic lab of the New York State Police, conducted a forensic analysis of defendant's hard drive using EnCase Software (EnCase). Investigator Friedman explained that EnCase searches both allocated space, which contains data (including saved items or items sent to the "recycling bin") that is readily accessible to a user, and unallocated space, which contains material deleted from the allocated space and is inaccessible to a user. Defendant's computer contained Real Player, a downloadable media program used to play videos and music that maintains a "play" history. The computer also had two internet browsers: Internet Explorer and Mozilla Firefox. In addition to the default profile provided by Mozilla Firefox, a second profile under the name of "Jim" had been created.
The allocated space under the Jim profile on Mozilla Firefox contained a temporary internet file known as a Web "cache." A cache contains images or portions of a Web page that are automatically stored when that page is visited and displayed on the computer screen; if the user visits the Web page again at a later date, the images are recalled from the cache rather than being pulled from the Internet, allowing the page to load more quickly. The cache under the Jim profile contained a .jpg image of a child pornography Web site called "School Backyard" that depicted children engaged in sexual intercourse with adults.
According to the Encase software, the "School Backyard" page had been accessed on the morning of February 21, 2007. Within minutes of accessing "School Backyard," three other pages were accessed -- two images of a young girl sitting in the front seat of her car with her wrists bound and a Web page labeled "Pedoland" -- which were also stored in the Web cache. The cache contained several other Web pages labeled, among other things, "Best CP Sites Portal, the Best Lolita CP Sites," that provided links to child pornography Web sites. Additionally, the Real Player history included links to numerous videos with file names indicating that they contained child pornography that were accessed, some on multiple occasions, between 2005 and 2007. There was no evidence that defendant was aware either of the cache function of his computer or that any of these files were stored in the cache.
The allocated space on defendant's hard drive also contained a "My
Documents" folder with subfolders labeled "cdocs" and another labeled
"work," and an additional folder labeled "JK." The "cdocs" subfolder
contained approximately 13,000 saved
images of female children, whom Investigator Friedman
estimated to be 8 or 9 years old, dressed in lingerie or bathing suits
and many with their legs spread open. The "work" subfolder contained
an additional 17,000 saved images of female children, some organized
into further subfolders named for a particular child. The JK folder
held a file labeled "porndef.pb," which contained a document that
included the text of four messages dated between June 1999 and July
2000 and directed to the unidentified recipient "P.B."*fn1
The messages apparently relate to a potential research
project on the regulation of child pornography and include comments
such as "sooner or later someone at this college is going to wonder
why I keep looking at porno sites." A final message dated July 11,
"Well, this last batch pretty much tears it.
While, as somebody's father, I'm pretty appalled by this stuff, I also don't want to get arrested for having it. So let's do this-if this is a legitimate research project, let's write it up and tell the deans (and preferably also the cops) what we're doing and why. Otherwise, let's drop it in the most pronto possible fashion. "I don't even think I can mail the disk to you, or anyone else, without committing a separate crime. So I'll probably just go ahead and wipe them. You have the URL's if you want to pursue it. "See you sooner or later, no doubt. Kent."
From the unallocated space on the computer, EnCase retrieved a video containing child pornography that had previously been downloaded and saved to the allocated space under the file name "Arina." EnCase also discovered over 130 .jpg images depicting children engaged in oral sex and sexual intercourse with dogs, adults and other children, children being penetrated by objects, and the lewd exhibition of the exposed genitals of female children. Like the "Arina" video, each of these images had been downloaded and stored in the allocated space of defendant's computer at some point between May 26, 2005 (the date that data was transferred from defendant's old computer to his new computer) and April 5, 2007 (the date the IT employee removed the hard drive) before the user deleted them, sending them to unallocated space. There was no evidence that defendant ever paid for access to any of the child pornography found on his computer.
Defendant was indicted on two counts of Promoting a Sexual Performance by a Child (Penal Law § 263.15) and 141 counts of Possessing a Sexual Performance by a Child (Penal Law § 263.16). Counts 1 and 142 related, respectively, to defendant's alleged procurement and possession of the "School Backyard" Web page; counts 2 and 143 related, respectively, to defendant's alleged procurement and possession of the "Arina" video; counts 3 through 141 charged defendant with possession of the .jpg images recovered from the unallocated space of the hard drive. During defendant's six-day non-jury trial, County Court denied defendant's trial motions for dismissal of the indictment. At the close of the trial, County Court granted the People's motion to conform the pleadings to the proof by amending count two of the indictment to reflect May 18, 2005 as the date of the alleged procurement of the "Arina" video. Thereafter, County Court found defendant guilty of both procurement counts (one and two) and 134 of the 141 possession counts, including counts 142 and 143.*fn2
County Court subsequently denied defendant's motion to set aside the verdict, finding that the evidence was legally sufficient to sustain his convictions (see CPL 330.30 ). Defendant was sentenced to concurrent indeterminate prison terms of one to three years.
The Appellate Division affirmed County Court's judgment (see People v Kent, 79 AD3d 52, 73 [2d Dept 2010]). Addressing the evidentiary significance of the presence of internet files stored in a cache, as well as the significance of defendant's knowledge or lack of knowledge regarding the cache function of his computer, the court undertook a review of both federal and state approaches to these issues (see id. at 65-66). Noting that "[t]he consistent thread in these cases is the need to distinguish inadvertent or unintentional acquisition or possession of the offensive material from knowing or intentional procurement and possession," the court stated its preliminary "agreement with the underlying premise that the mere existence of an image automatically stored in a cache, standing alone, is legally insufficient to prove either knowing procurement or knowing possession of child pornography" (id. at 66).
The court adopted the view, however, that "a Web page stored in the cache is evidence of past procurement of the images on that page. Specifically, the cached Web page from the 'School Backyard' site is evidence that the Web page was accessed and displayed on the defendant's computer screen" (id. at 67). That defendant knowingly accessed the page was demonstrated by a totality of evidence including defendant's pattern of Internet browsing for child pornography Web sites, his Real Player history, and his messages to "P.B." acknowledging his possession of child pornography (id. at 67-68). The court further held that the evidence was legally sufficient to prove defendant's knowing possession of the images on the "School Backyard" page, finding that defendant "knowingly accessed the Web page and displayed it on his computer screen . . . establishing his dominion and control over the images" (id. at 68).
The court also found that the evidence was legally sufficient to support defendant's 134 other convictions, because those counts were based on "images which, at one time, had been downloaded and saved in the allocated space of the hard drive and subsequently deleted" (id. at 69). With respect to count two, for promotion of the "Arina" video, the court found that "the totality of the direct and circumstantial evidence of [ ] defendant's extensive use of his office computer to obtain and view child pornography was a sufficient basis from which the factfinder could infer that [he] acquired the video, and thus, committed an act of procurement" (id. at 70).
A Judge of this Court granted defendant leave to appeal (17 NY3d 797 ) and we now modify by reversing defendant's convictions on counts 1 and 142 for promotion and possession of the "School Backyard" Web page and, as so modified, affirm.
Recognizing that "[t]he public policy of the state demands the protection of children from exploitation through sexual performances" (L 1977, ch 910, § 1), the Legislature enacted article 263 of the Penal Law "to eradicate the social evil of child pornography" (People v Keyes, 75 NY2d 343, 348 ). With limited exception (see People v Fraser, 96 NY2d 318 ), we have not had occasion to determine the extent to which the current statutory scheme applies to child pornography distributed and consumed over the Internet, a forum unknown to legislative drafters 30 years ago and which now provides a readily accessible and expansive marketplace for illicit material. Indeed, the Internet now "allows for a diverse array of offenders who can access and circulate images easily and privately from home computers" (see Wolak, Finkelhor, Mitchell and Ybarra, "Online 'Predators' and Their Victims," American Psychologist [Feb - March 2008]). The resulting danger to the safety and welfare of children cannot be overstated: in a study of persons prosecuted for Internet-related child pornography crimes, 80 percent had images showing the sexual penetration of a child and nearly 20 percent had images of children younger than age three (see Wolak, Finkelhor and Mitchell, "Child-Pornography Possessors Arrested in Internet-Related Crimes," 5 ).
Penal Law § 263.15 provides that "[a] person is guilty of promoting a sexual performance by a child when, knowing the character and content thereof, he produces, directs or promotes any performance which includes sexual conduct by a child less than seventeen years of age." To "promote" means, among other things, "to procure" (Penal Law § 263.00 ),*fn3 itself defined as "obtain, acquire . . . to get possession of by particular care or effort" (Keyes, 75 NY2d at 348 [internal quotation marks omitted]). Thus, "the term 'procure' . . . defines 'promote' for purposes of Penal Law § 263.15 as simply the acquisition of child pornography, whether for personal consumption or for distribution to others" (id.). Penal Law § 263.16 provides that "[a] person is guilty of possessing a sexual ...