NOT RECOMMENDED FOR PUBLICATION

File Name: 25a0245n.06

No. 24-3258

UNITED STATES COURT OF APPEALS FILED

FOR THE SIXTH CIRCUIT May 13, 2025

KELLY L. STEPHENS, Clerk

) UNITED STATES OF AMERICA,

)

Plaintiff-Appellee, ) ON APPEAL FROM THE UNITED

) STATES DISTRICT COURT FOR v. ) THE NORTHERN DISTRICT OF

) OHIO CHRISTOPHER L. FRATER, )

Defendant-Appellant. ) OPINION

)

) Before: STRANCH, BUSH, and NALBANDIAN, Circuit Judges.

JOHN K. BUSH, Circuit Judge. Christopher Frater appeals his conviction for knowingly receiving, distributing, and possessing child pornography, in violation of 18 U.S.C. § 2252(a)(2). He argues that the government failed to prove beyond a reasonable doubt that he, rather than his wife, received or distributed child pornography. We disagree and AFFIRM.

I.

In November 2017, Van Wert Police Detective Jeff Blackmore was operating an online law enforcement surveillance tool called Gridcop,1 when he received seven complete files of child pornography from an unknown IP address based in Lima, Ohio. After verifying that the files were in fact illicit images and videos depicting child pornography, Blackmore subpoenaed Charter Communications for information about the account associated with the IP address. The records listed Christopher Frater as the registered account holder.

1

GridCop is a tool designed for law enforcement that monitors peer-to-peer internet activity of users distributing child pornography. No. 24-3258, United States v. Frater

Law enforcement executed a search warrant on Frater’s residence in January 2018. Frater and two young foster children—one girl and one boy—were present during the search. Frater’s wife, Nicky, was not. Agents confiscated several items, including Frater’s Motorola Droid cell phone, several DVD-ROM discs, his desktop computer, the modem, router, an MP3 player, and a digital camera. A forensic analysis revealed child pornography was present on the desktop computer.

A grand jury indicted Frater in October 2018 on one count of receipt and distribution of child pornography, in violation of 18 U.S.C. § 2252(a)(2). He proceeded to trial in November 2023. Several witnesses testified for the government. Detective Blackmore, the lead detective on the case, testified to how GridCop helped him identify Frater as the perpetrator. He described the sexually explicit files that he received from Frater’s IP address and the way those files were downloaded and shared via a peer-to-peer software called LemonWire and a peer-to-peer network called Gnutella. Specifically, he explained how a user searching for child pornography must be familiar with common terms such as “PTHC” (pre-teen hard core), “Tropical Cuties,” “Paradise Birds,” and “daddypedo,” among others. And he confirmed that Frater’s IP address generated several keyword searches including these terms.

Task Force Officer Steven Mueller likewise appeared for the government. Mueller, a forensic examiner, analyzed the devices taken from Frater’s home during the search, and he confirmed that Frater’s HP desktop computer contained child pornography. He spoke about how he looked for stills, graphic files, and videos of child pornography, as well as a Global Unique Identifier (GUID), which is a type of serial number that links a specific computer to the peer-to- peer software program. Mueller was able to connect the computer’s activity with Frater because the main user account was titled “Chris,” and he identified multiple documents that belonged to

2 No. 24-3258, United States v. Frater Frater personally, including, for example, a college loan document. And while there was also a secondary guest account titled “Nicky,” belonging to Frater’s wife, Mueller stated that he only found child pornography on the User Chris account.

Mueller also spoke to the files that he found on Frater’s computer, describing where those files were located and why there was no doubt—from a forensic perspective—that child sex abuse material (CSAM) was located on Frater’s computer. He confirmed that the digital footprint of the CSAM originated from the User Chris account. The jury also heard about the web history extraction report that Mueller prepared of Frater’s cell phone. Mueller explained how Frater’s web history contained common child pornography search terms, including “Tropical Cuties,” “Family taboo,” and “Family strokes.” That said, no actual CSAM was found on Frater’s phone.

Christina Suther, a senior digital forensic examiner with the FBI, also testified. Like Mueller, Suther analyzed Frater’s computer and cell phone. She first spoke to the files that she found on the computer in the User Chris account. She explained that Windows records about fifty of the user’s “most recently used files.” And of those files, she found child pornography opened as recent as January 26, 2018—the same day as the execution of the search warrant—in the User Chris account. More still, Suther noted that the User Nicky account did not have a password, but User Chris’s account was password protected.

Suther also created a report that included a timeline of logins and logouts of each of the two accounts on Frater’s computer. The report showed, for example, that the last login time for the User Chris account was January 25, 2018, at 11:48 p.m., while the last logout time occurred at 12:58 a.m. on January 26, 2018. During that time, the user viewed child pornography. For the User Nicky account, the last login time was January 24, 2018, at 12:44 p.m., while the last logout occurred just three minutes later. Child pornography activity was not detected during that time

3 No. 24-3258, United States v. Frater frame. And Suther found no evidence of a remote session—where a user logs in to his or her desktop computer from a different device—or of a virtual private network, which she described as a tunnel-like internet connection accessible only to authorized users. But there was evidence of external media and flash drives associated with Frater’s computer and proof that child pornography files were viewed using the flash drive. More still, Suther explained that though Frater’s computer had viruses, they could not have been the source of the child pornography, dispelling any speculation that the CSAM found was not attributable to conscious conduct. And Suther, like Mueller, established that Google searches on Frater’s phone included visits to child pornography websites on multiple dates between December 2017 and January 2018.

Frater’s former foster daughter also testified. She explained that she sometimes used Frater’s phone to play games on. She testified that she saw videos of “kids and grown-ups having sex with their clothes off” on both Frater’s phone and computer. And on some occasions, when Frater did not know she was there, she would see him viewing child pornography on his computer.

Finally, Special Agent Brian Russ of the FBI testified. Agent Russ recounted for the jury the voluntary conversation that occurred between himself, Frater, and another agent on the day of the search warrant. They discussed Frater’s background and asked him whether he had any peer- to-peer programs on his computer. Frater told Agent Russ that he used LemonWire and LimeWire to download music and movies, but he maintained that he never viewed or downloaded child pornography using that software. But Frater did concede a few points. He first admitted that Nicky never used the LemonWire program. And second, he admitted to watching “sex videos” on his computer.

Agent Russ also reported that he obtained Frater’s work records and compared them to the network activity that Detective Blackmore provided him, which traced back to Frater’s IP address

4 No. 24-3258, United States v. Frater and GUID identifier for his LemonWire software. All but one instance of recorded child pornography activity (of which there were many), Russ remarked, occurred when Frater was not at work. To explain this isolated inconsistency, several government witnesses noted that it was possible for peer-to peer programs to run if Frater was not home. One witness further explained that Frater had a folder on his computer that stored incomplete downloads and had a setting enabled that allowed the peer-to-peer software to share downloaded files from that folder with other users.

After five days, the government rested its case. Frater did not call any witnesses or present any evidence. The jury unanimously found him guilty. And the district court sentenced him to a term of 120-months incarceration, followed by a 20-year term of supervised release. Frater timely appealed.

II.

Generally, we review de novo a defendant’s challenge to the sufficiency of the evidence. United States v. Collins, 799 F.3d 554, 589 (6th Cir. 2015). Under that standard, the defendant “bears a very heavy burden,” United States v. Chaney, 921 F.3d 572, 589 (6th Cir. 2019) (citation omitted), to show that no “rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt,” Jackson v. Virginia, 443 U.S. 307, 319 (1979). But if a defendant fails to make a motion for judgment of acquittal under Federal Rule of Criminal Procedure 29 at the district court, our review is “limited to determining whether there was a manifest miscarriage of justice.” United States v. Jordan, 544 F.3d 656, 670 (6th Cir. 2008) (citation omitted).

Frater claims that his conviction must be reversed because the evidence introduced at trial failed to prove beyond a reasonable doubt that he knowingly received or distributed the child pornography. But Frater made no Rule 29 motion at the close of the prosecution’s case-in-chief or at the close of all evidence. Nor did he present a motion to the district court within 14 days after

5 No. 24-3258, United States v. Frater the guilty verdict. See Fed. R. Crim. P. 29(c)(1). Therefore, our review is limited to whether there was a “manifest miscarriage of justice” such that the record is “devoid of evidence pointing to guilt.” United States v. Price, 134 F.3d 340, 350 (6th Cir. 1998) (citation omitted).

III.

Frater’s central argument is that the evidence was insufficient to establish that the pornography on his computer belonged to him as opposed to his wife. Frater asserts his case is “almost identical” to United States v. Lowe, in which we reversed a defendant’s conviction because the evidence did not sufficiently show that the defendant, rather than the defendant’s wife, knowingly received, distributed, and possessed child pornography. 795 F.3d 519 (6th Cir. 2015). He contends that the similarities warrant reversal.

In Lowe, the government produced tenuous circumstantial evidence connecting the defendant to the crime. Id. at 523. For one, the family computer did not have a password. Id. And the investigating agent “could not pinpoint when someone searched for or initiated downloads of child pornography.” Id. at 522. He also admitted that while forensics could show the date and time the illicit downloads were complete, the files could “take a very long time to download” depending on factors like the internet’s connection speed. Id. at 521 (citation omitted). The Lowe jury also did not hear any testimony connecting documented computer activity (like viewing specific business records) to activities known to be completed by either the defendant or his wife. Id. at 522.

Frater has not convinced us that Lowe requires reversal of the jury’s verdict here. Frater’s case differs from Lowe in a few notable ways. First, the Lowe defendant moved for judgment of acquittal—twice. Id. By contrast Frater did not, so our review is much more limited. See Price, 134 F.3d at 350. Second, the evidence in Frater’s case tells a different story. The government

6 No. 24-3258, United States v. Frater brought forth ample circumstantial evidence connecting Frater to the pornography by showing that most of the activity occurred while Frater was off work. The government also attributed “special significance,” Lowe, 795 F.3d at 523, to Frater’s browsing history and computer activity, showing the jury how Frater viewed a personal student loan document then opened child pornography files soon after. All said, the evidence presented here does not require the jury to “stack[] inferences” in the way Lowe found problematic. Id. at 523.

Frater responds that the government’s evidence is inconsistent because it was conceded that not all child pornography activity occurred while Frater was off work from his job as a corrections officer. He reasons that this inconsistency shows someone other than himself could have accessed his computer to download and view CSAM.

But this small inconsistency does not diminish a record otherwise replete with “evidence pointing to guilt.” Price, 134 F.3d at 350; United States v. Oufnac, 449 F. App’x 472, 476 (6th Cir. 2011) (“[T]he presence of multiple computer users does not preclude a finding that only one of the computer users knowingly possessed the child pornography computer images.”); id. (affirming conviction because “ample other evidence” tied the defendant to the computer despite other people having access to it); see also United States v. Pavulak, 700 F.3d 651, 669 (3d Cir. 2012) (affirming conviction because the computer had a single, password-protected Windows user account with evidence tying it to the defendant, and because the defendant claimed the computer, he was the laptop’s “likeliest user” and the “likeliest” to have accessed the child pornography images); United States v. Schene, 543 F.3d 627, 639–40 (10th Cir. 2008) (affirming conviction even though defendant’s wife also had access to the computer and child pornography was found on both user accounts based on the “collection of evidence” viewed “in toto”). Detective Blackmore confirmed that the confiscated computer bore the same IP address, had the same

7 No. 24-3258, United States v. Frater LemonWire software program downloaded, and contained the same GUID as the account that shared the child pornography files with Blackmore. Frater admitted that no one else in the house used LemonWire. The User Chris account was password protected and was the only account that contained child pornography. Indeed, one of the foster children even testified that she saw videos of “kids and grownups having sex with their clothes off” on Frater’s desktop computer and saw Frater viewing images that appeared to be child pornography. Considerable child pornography activity occurred while Frater was not at work. And the government’s witnesses confirmed that there was no evidence linking the viruses found on Frater’s computer to the illicit activity, nor any indication of remote access that would suggest a third party was responsible for the child pornography on it. Viewing the evidence as a whole, a rational jury could conclude that Frater knowingly received and distributed child pornography.

What is more, not only do we draw all reasonable inferences in favor of the jury’s verdict, United States v. Bowens, 938 F.3d 790, 794 (6th Cir. 2019), the government need not disprove every possible version of the facts to sustain a conviction, United States v. Lindo, 18 F.3d 353, 357 (6th Cir. 1994). The government explained that Frater’s download settings allowed the peer-to- peer programs to continue downloading even when a user was not present. And this would explain why it appeared someone else was viewing pornography even though Frater was at work. Frater’s alternative theory—that his wife was downloading the child pornography—even if plausible, does not satisfy his burden to show that the record is devoid of evidence of his guilt. See United States v. Sadler, 24 F.4th 515, 547 (6th Cir. 2022); see also United States v. Stevens, No. 22-5410, 2023 WL 3200322, at *4 (6th Cir. May 2, 2023).

Frater offers one final retort. He contends that the government improperly attempts to shift the burden of proof by relying on a lack of evidence that Nicky ever logged into the password-

8 No. 24-3258, United States v. Frater protected User Chris account for any reason. But Frater ignores the mountain of other circumstantial evidence that the jury did consider, including his familiarity with child pornography terms, his cell phone and computer browsing history, his work records, the precise timeline of pornography activity, the files found on the computer itself, and the observations of his foster- daughter. All of this affirmative evidence is sufficient to carry the government’s burden. We see nothing that suggests a “manifest miscarriage of justice” occurred here. Price, 134 F.3d at 350.

IV.

Because the evidence is sufficient to sustain Frater’s conviction, we AFFIRM.

9