COURT OF APPEALS OF VIRGINIA UNPUBLISHED Present: Judges Malveaux, Athey and Senior Judge Petty Argued by videoconference

TARUN KUMAR VYAS MEMORANDUM OPINION* BY v. Record No. 2183-23-3 JUDGE WILLIAM G. PETTY APRIL 8, 2025 COMMONWEALTH OF VIRGINIA

FROM THE CIRCUIT COURT OF ROCKINGHAM COUNTY Andrew S. Baugher, Judge (David R. Martin; Law Office of David R. Martin, PLLC, on brief), for appellant. Appellant submitting on brief.

Justin B. Hill, Assistant Attorney General (Jason S. Miyares, Attorney General, on brief), for appellee.

Following a jury trial, the trial court convicted Tarun Kumar Vyas for possessing child pornography, 29 counts of possessing child pornography as a second or subsequent offense, distributing child pornography, and 6 counts of distributing child pornography as a second or subsequent offense. The trial court sentenced Vyas, in accordance with the jury’s verdict, to 35 years and 450 days of imprisonment. Vyas contends that the trial court erred in joining all the offenses for a single trial and denying his motions to suppress the evidence. He argues the trial court erred in admitting evidence that violated his Sixth Amendment right of confrontation. Vyas also challenges the sufficiency of the evidence to sustain his convictions. We find no trial court error and affirm the convictions.1

* This opinion is not designated for publication. See Code § 17.1-413(A).

As Vyas is represented by counsel, we take no action upon Vyas’s pro se motion to dismiss the Commonwealth’s brief for exceeding the page limitation, his pro se reply brief, or BACKGROUND On appeal, “we review the evidence in the ‘light most favorable’ to the Commonwealth.”

Clanton v. Commonwealth, 53 Va. App. 561, 564 (2009) (en banc) (quoting Commonwealth v. Hudson, 265 Va. 505, 514 (2003)). That principle requires us to “discard the evidence of the accused in conflict with that of the Commonwealth, and regard as true all the credible evidence favorable to the Commonwealth and all fair inferences that may be drawn therefrom.” Kelly v. Commonwealth, 41 Va. App. 250, 254 (2003) (en banc) (quoting Watkins v. Commonwealth, 26 Va. App. 335, 348 (1998)).

The Cybertip “Kik” is an online chat messaging platform that allows users to communicate either publicly or privately. Media Lab is the parent company for several online social media applications, including Kik. To combat the use of Kik for unlawful purposes and distributing child pornography, Media Lab uses a “hashmatching” system to determine if a video or image transmitted through the application is contraband; the suspected contraband files are matched electronically by a “hash value” to other images or videos that have already been identified as contraband. The hash value is unique to a file if it has not been altered. If the item is matched electronically to contraband, it is then flagged at Media Lab for “human review.” Following that review, if confirmed as child pornography, Media Lab submits a report to the National Center for Missing and Exploited Children (NCMEC) through an online portal. The report is automatically generated by Kik’s system and includes the subscriber’s account information and a record of events, such as logging in or sending a message.

his pro se motion to supplement the reply brief. See generally McGinnis v. Commonwealth, 296 Va. 489 (2018). -2- Mignon Davis, the legal response manager for Media Lab, identified a subscriber data document for a Kik account connected with an email of [email protected], a Samsung device, and IP addresses. On October 29, 2020, Media Lab transmitted that report to NCMEC involving the email address and device for the suspected distribution of child pornography in October 2020 using Kik.

NCMEC is a national clearinghouse for issues involving missing and exploited children.

The organization works to “find missing children, reduce child sexual exploitation, and prevent future victimization.” When NCMEC receives a cybertip—such as the October 2020 report from Media Lab—about suspected child pornography, it generates a report for the police passing along that information and including the suspicious images or videos for law enforcement. However, NCMEC does not open the suspicious files or manipulate the information in the cybertip before forwarding them to the police.

With the information contained in the cybertip from Media Lab, the NCMEC produced a report concerning the Kik account with the email address of [email protected] and the Samsung device. On October 29, 2020, the Virginia Internet Crimes Against Children task force received NCMEC’s report concerning the possible distribution of child pornography on Kik.

The Police Investigation In February 2021, Virginia State Police Special Agent Chad Morris was assigned to investigate NCMEC’s report concerning the distribution of suspected child pornography on Kik and within Rockingham County. The email address identified for the suspicious Kik account was [email protected]. Special Agent Morris noted that two IP addresses reportedly involved in the distributions were 73.99.78.141 and 173.15.193.234. Using the hash values in the NCMEC report, Special Agent Morris identified seven images of child pornography that were shared by the Kik account from October 5 through 9, 2020.

-3- Comcast records established that IP address 73.99.78.141 was assigned to 1340 Hunters Road Apartment C, where Vyas lived. The IP address 173.15.193.234 was assigned to the Microtel Motel where Vyas worked.

Special Agent Morris’s investigation revealed that beginning June 26, 2020, AT&T provided cellular service to Vyas with a phone number 540-746-3108 and an email address of [email protected]. The email accounts of [email protected] and [email protected] were listed as reciprocal recovery, or backup, emails for each other.

On February 16, 2021, Special Agent Morris went to Vyas’s place of employment to interview him. Vyas was working at the front desk of the motel when Special Agent Morris arrived.

In a conversation outside the motel in a police vehicle, Vyas said he had a Samsung Galaxy S9 cell phone and provided his phone number, 540-746-3108; he confirmed that his service provider for the phone was AT&T. Vyas also admitted that he lived at 1340 Hunters Road, Apartment C, and he had two email addresses—[email protected] and [email protected].

After speaking with Vyas, Special Agent Morris went back inside the motel. The manager of the motel identified a cell phone and a Chromebook device in the staff break room as belonging to Vyas. The manager said that she had observed surveillance camera footage of Vyas using a device to view pornography and the people involved appeared to be of a young age. Special Agent Morris seized the phone, a Samsung Galaxy S9 cell phone, and the Chromebook. Special Agent Morris placed the locked phone in “airplane mode” to remove it from the AT&T network and safeguard its data. The police arrested Vyas for distributing child pornography.

-4- The police obtained a search warrant for the content of Vyas’s phone on February 17, 2021.2 That same day, Special Agent Morris delivered the phone to Detective Randall Life for a forensic examination as the warrant authorized.

In his examination, Detective Life determined that the Samsung phone had been activated on May 6, 2019. The initial email during the setup of the device was [email protected].

Detective Life found 30 images and videos of child pornography on the phone, corresponding to Vyas’s 30 charges of possessing child pornography.

The contraband files were located on the SD memory card of the phone, which had been added to the phone for file storage. There were user created folders on the phone for “Twitter hotties,” “For Angie,” and “bad sisters,” among others. The “For Angie” file on the SD card containing child pornography was created on September 30, 2020. The child pornography was in the phone’s cache files, indicating that they had been opened or used. The thumbnails database file, which held a gallery of small, downloaded images, contained child pornography also.

A local Dropbox application on the phone held child pornography in a “For Angie” file.

The “For Angie” file was created on September 19, 2020, and was accessed through Dropbox on September 30, 2020. The username for the account was [email protected]. The last “ping” of communication between the [email protected] email and Dropbox was on February 17, 2021, when the phone was in the custody of the police.

The [email protected] and [email protected] emails were “listed on accounts throughout the phone.” Detective Life found both of the IP addresses noted in the NCMEC report in files on the phone linked to Vyas and documents in Dropbox concerning his immigration status.

The police also obtained a search warrant for the Chromebook. However, no evidence was obtained from the device. -5- The Kik application was first downloaded to the Samsung phone on August 31, 2020. The application was apparently removed from the phone, but was downloaded again on October 14, 2020. In addition, Samsung Story Service, a standard application on the phone, detected child pornography images accessed on September 30, 2020.

Vyas testified that he moved into the Hunters Road apartment in the summer of 2020. He claimed that in November or December 2020, he replaced his cell phone with a used Samsung Galaxy S9 phone with an SD card already in it. He said that from September 2020 to February 2021 he worked as a desk clerk at the Ramada Inn located directly beside Microtel. Vyas acknowledged that all three email addresses found on the phone belonged to him. He claimed he used the chat application WhatsApp but had not used Kik.

Vyas said that he reviewed the photographs on his phone on February 14, 2021, and that he saw no child pornography. He said he had never opened any files in the “For Angie” folder in any location. He denied uploading child pornography from the internet in October 2020. He also claimed that he had never seen the 30 images of child pornography that the police found on the phone in February 2021. Vyas admitted that he had a prior felony conviction.

Upon the jury’s guilty verdict, the trial court convicted Vyas of the 37 charged offenses.

Vyas appeals.

ANALYSIS I. Joinder The grand jury indicted Vyas for 30 charges of possessing child pornography in February 2021 and for 7 charges of reproducing child pornography in October 2020. Vyas objected to the Commonwealth’s motion to join all the offenses for one trial and contended that the possession offenses should be tried separately from the offenses involving reproduction of child

-6- pornography. The trial court granted the Commonwealth’s motion and held a single trial upon all the charges. Vyas challenges this ruling on appeal.

“Rule 3A:10(c) governs when courts may direct an accused to be tried at one time for all charges currently against him.” Brooks v. Commonwealth, 73 Va. App. 133, 141 (2021). “The question whether an accused, pursuant to Rule 3A:10(c), can be tried in a single trial for all offenses then pending against that defendant is a matter resting within a trial court’s sound discretion.” Id. (quoting Commonwealth v. Minor, 267 Va. 166, 172 (2004)). Thus, unless the trial court “abused its discretion in ordering a single trial for the multiple charges against” Vyas, we will not disturb the trial court’s decision on appeal. Id. at 141-42.

“The court may direct that an accused be tried at one time for all offenses then pending against him, if justice does not require separate trials and (i) the offenses meet the requirements of Rule 3A:6(b) or (ii) the accused and the Commonwealth’s attorney consent hereto.” Rule 3A:10(c). Under Rule 3A:6(b), “[t]wo or more offenses . . . may be charged in separate counts of an indictment or information if the offenses . . . constitute parts of a common scheme or plan.”

Because Vyas did not consent to be tried jointly for his offenses, “the Commonwealth was required to establish both of the other two conditions of Rule 3A:10(c), namely, that the offenses satisfied the requirements of Rule 3A:6(b), and that justice did not require separate trials.”

Brooks, 73 Va. App. at 142 (quoting Scott v. Commonwealth, 274 Va. 636, 644 (2007)).

A “‘[c]ommon scheme’ describes crimes that share features idiosyncratic in character, which permit an inference that each individual offense was committed by the same person or persons as part of a pattern of criminal activity involving certain identified crimes.” Id. at 142-43 (quoting Scott, 274 Va. at 645). “The possible range of idiosyncratic features that may prove a ‘common scheme’ is very broad.” Id. at 143. But “the Commonwealth’s evidence regarding idiosyncratic features must permit an inference of a pattern of criminal activity by the -7- same person; mere general similarities common to all offenses of the same type are insufficient.”

Id. In February 2021, the Virginia State Police received information about the possible distribution of child pornography by Vyas in October 2020 and opened its investigation. The allegation that Vyas distributed the images and videos in October 2020 was based on information gained in the investigation of the cybertip. The investigation led the police to Vyas, and they contacted him at his work in February 2021. At that visit, the police seized Vyas’s cell phone.

The police searched the phone under a search warrant. In the forensic examination, the police found numerous images and videos of child pornography. In addition, the content of the phone tended to confirm that Vyas possessed the contraband in September 2020—before the alleged distributions—and that he actively used his Kik account at that time. These facts and circumstances demonstrated that the possession and distribution offenses constituted a common scheme of criminal activity under Rule 3A:6.

“Justice often requires separate trials where highly prejudicial evidence of one of the crimes is not admissible in the trial of the other.” Id. at 145 (quoting Long v. Commonwealth, 20 Va. App. 223, 226 (1995)). But “the mere fact that a jury may consider evidence of a defendant’s guilt for multiple offenses does not automatically constitute unfair prejudice, otherwise no joinder of offenses would ever be permissible.” Id. at 146. “[I]n striking the balance between judicial economy and unfair prejudice, a circuit court must essentially determine the issues a defendant is contesting and conduct a relevance analysis of the evidence proffered by the Commonwealth in support of joinder of the offenses.” Id. The evidence of the child pornography distributions in October 2020 led to the police investigation concerning the possible presence of child pornography on Vyas’s phone. The investigation culminated in the seizure of Vyas’s phone and the recovery of contraband from it.

-8- Thus, the evidence of the distributions was interwoven and interconnected with the possession offenses. Upon this record, we find that the joinder decision did not cause unfair prejudice to Vyas. As justice did not require separate trials, the trial court did not abuse its discretion in overruling Vyas’s objection and conducting a single trial upon all the charges against him.

II. Seizure of Vyas’s Cell Phone Vyas contends that the trial court erred in denying his motion to suppress the warrantless “seizure of the electronic devices” by the police. More specifically, he argues that the police seized the cell phone “and other electronic devices” without reasonable articulable suspicion of criminal activity; he also maintains that the seizure was not lawful under application of the “plain view” doctrine.

In reviewing a trial court’s denial of a motion to suppress, “we determine whether the accused has met his [or her] burden to show that the trial court’s ruling, when the evidence is viewed in the light most favorable to the Commonwealth, was reversible error.” Roberts v. Commonwealth, 55 Va. App. 146, 150 (2009). This Court is “bound by the trial court’s findings of historical fact unless ‘plainly wrong’ or without evidence to support them.” Id. (quoting McGee v. Commonwealth, 25 Va. App. 193, 198 (1997) (en banc)). “[W]e give due weight to the inferences drawn from those facts by resident judges and local law enforcement officers.”

McGee, 25 Va. App. at 198. “However, we consider de novo whether those facts implicate the Fourth Amendment and, if so, whether the officers unlawfully infringed upon an area protected by the Fourth Amendment.” Hughes v. Commonwealth, 31 Va. App. 447, 454 (2000) (en banc).

“Ordinarily, evidence obtained as the result of an unlawful search [or seizure] is subject to suppression under the exclusionary rule.” Commonwealth v. Jones, 267 Va. 532, 535 (2004).

In determining whether evidence is derivative of the illegal act and, therefore, barred as “fruit of the poisonous tree,” the question is “whether ‘the evidence to which the instant objection is made -9- has been come at by exploitation of that illegality or instead by means sufficiently distinguishable to be purged of the primary taint.’” Wong Sun v. United States, 371 U.S. 471, 488 (1963) (quoting John M. Maguire, Evidence of Guilt 221 (1959)).

Regardless of whether the police lawfully seized Vyas’s phone on February 16, 2021, the police did not conduct a search of the phone and did not obtain evidence from it until after they obtained a search warrant for the device on February 17, 2021. The evidence Vyas sought to exclude—the data recovered in Detective Life’s forensic examination of the phone—was obtained by the police pursuant to a search warrant. Vyas did not argue in the trial court, and does not assert on appeal, that the search warrant was invalid as not grounded on probable cause or executed by the police unlawfully. Indeed, the affidavit supporting the search warrant contains no information gained as a result of the police seizure of the phone. Rather, the affidavit details the police investigation of Vyas’s Kik account, the cybertip from Media Lab through NCMEC, and the records obtained from Google and AT&T tending to support the conclusion that the phone contained child pornography.

Thus, even if we were to assume that the police unlawfully gained physical control of Vyas’s phone, the evidence supporting the child pornography charges against him was obtained in a search authorized by an unchallenged warrant. The exclusionary rule did not apply to the evidence found on Vyas’s phone during the search, and the trial court did not err in denying the motion to suppress.

III. Suppression of Records from Kik and NCMEC Vyas contends that the trial court erred in denying his motion to suppress records that the police obtained from Kik and NCMEC. The Fourth Amendment provides the “right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures.” U.S. Const. amend. IV. However, its “text endorses no absolutes. It instead - 10 - condemns only ‘unreasonable’ searches and seizures.” Kyer v. Commonwealth, 45 Va. App. 473, 480 (2005) (en banc). Additionally, this prohibition applies only to such searches and seizures conducted by the government or its agents. See Debroux v. Commonwealth, 32 Va. App. 364, 371 (noting that the defendant bears the burden of proving a search was conducted by a government actor or agent), adopted on reh’g en banc, 34 Va. App. 72 (2000).

“Consequently, a private search, no matter how unreasonable, does not constitute a constitutional violation warranting the suppression of the evidence seized.” Mills v. Commonwealth, 14 Va. App. 459, 463 (1992). “If, however, a private individual ‘must be regarded as having acted as an instrument or agent of the state’ while conducting the search, the fourth amendment is applicable.” Id. (quoting Skinner v. Railway Executives’ Ass’n, 489 U.S. 602, 614 (1989)).

“Whether a person acted privately or as an agent of the state is a question of fact that must be decided on the circumstances of each case.” Id. “Resolution of the agency issue ‘necessarily turns on the degree of the Government’s participation in the private party’s activities.’” Id. (quoting Skinner, 489 U.S. at 614).

The record contains no indication that Kik, under the auspices of the private company Media Lab, acted as a governmental agent in producing the report containing information about Vyas’s use of the application. In fact, the report was produced following the company’s own internal system of “hashmatching” to monitor and prevent the unlawful use of its platform. The system checked shared content on the application against known images or videos already identified as contraband. No governmental entity was involved in the application of this system to produce the report ultimately submitted to NCMEC. Accordingly, the trial court did not err in refusing to suppress records produced by Kik and Media Lab.

Nor did the trial court err in denying Vyas’s motion to suppress the report that NCMEC provided to the Virginia police. Assuming for the sake of argument that NCMEC acted as an - 11 - agent of the government in producing the cybertip, see, e.g., United States v. Meals, 21 F.4th 903, 908 (5th Cir. 2021), we find no basis to conclude that NCMEC conducted a search at all.

NCMEC received the information about the potential illegal use of Kik from Media Lab and forwarded that same material to the police in a cybertip. In this way, NCMEC engaged in no additional search beyond that already conducted by Media Lab. A governmental agent’s search that does not exceed the scope of a private search does not implicate the Fourth Amendment.

See United States v. Jacobsen, 466 U.S. 109, 115 (1984). Accordingly, the trial court did not err in denying Vyas’s motion to suppress the report NCMEC provided to the police.

IV. Confrontation of the NCMEC Report3 Vyas contends that the trial court erred in admitting the NCMEC report into evidence in violation of his Sixth Amendment confrontation rights. He maintains that the report contained testimonial evidence he was entitled to cross-examine.

“Decisions regarding the admissibility of evidence ‘lie within the trial court’s sound discretion and will not be disturbed on appeal absent an abuse of discretion.’” Blankenship v. Commonwealth, 69 Va. App. 692, 697 (2019) (quoting Michels v. Commonwealth, 47 Va. App. 461, 465 (2006)). “[W]e review de novo [the constitutional question of] whether a particular category of proffered evidence is testimonial hearsay.” Pulley v. Commonwealth, 74 Va. App. 104, 122 (2021) (alterations in original) (quoting Logan v. Commonwealth, 72 Va. App. 309, 316 (2020) (en banc)). “In conducting our de novo review, however, we are ‘bound by the trial court’s findings of historical fact unless “plainly wrong” or without evidence to support them.’” Id. (quoting Cody v. Commonwealth, 68 Va. App. 638, 656 (2018)).

Vyas’s assignment of error on this issue relates only to the report of NCMEC, not to the information transmitted from Media Lab to NCMEC. To the extent that Vyas’s brief contends that admission of the Media Lab report violated his right to confrontation, we do not consider that allegation. See Rule 5A:20(c)(1) (“Only assignments of error listed in the brief will be noticed by this Court.”). - 12 - The Confrontation Clause guarantees that an accused “shall enjoy the right . . . to be confronted with the witnesses against him.” U.S. Const. amend. VI. “[T]he Confrontation Clause prohibits the introduction of ‘testimonial’ statements by a witness who does not testify at trial, unless the witness is ‘unavailable to testify, and the defendant . . . had a prior opportunity for cross-examination.’” Logan, 72 Va. App. at 316-17 (second alteration in original) (quoting Crawford v. Washington, 541 U.S. 36, 54 (2004)). The Supreme Court of the United States has held that many hearsay exceptions “cover[] statements that by their nature [are] not testimonial—for example, business records or statements in furtherance of a conspiracy.”

Crawford, 541 U.S. at 56.

Here, the evidence to which Vyas objects—the NCMEC report to the police—was not testimonial in nature. The report was not generated as a substitute for trial testimony, but to simply inform the police of information that had come to its attention. Without accompanying opinions or conclusions, NCMEC simply provided law enforcement with information it had received as a clearinghouse. See Sanders v. Commonwealth, 282 Va. 154, 166 (2011) (“In order to determine if a statement is testimonial, the statement must be evaluated as to whether the statement was ‘made under circumstances which would lead an objective witness to reasonably believe that the statement would be available for use at a later trial.’” (quoting Crawford, 541 U.S. at 52)). Accordingly, the NCMEC tip to the police was not testimonial in nature and the trial court did not abuse its discretion in admitting it over Vyas’s objection.

V. Sufficiency of the Evidence In his motion to strike at the conclusion of the Commonwealth’s case-in-chief, defense counsel stated that “the evidence is insufficient as to [sic] matter of law to convict the defendant

- 13 - on all the charges, and I would just submit that issue to the [c]ourt.”4 The trial court denied the motion, finding that the evidence presented was sufficient to create “a jury question on these charges.” After Vyas presented evidence and the Commonwealth called a witness in rebuttal, defense counsel renewed the motion to strike “[o]n the same ground[.]” The trial court denied the motion. Vyas did not make a motion to set aside the jury’s verdicts.

Challenging the sufficiency of the evidence to sustain his convictions, Vyas argues on appeal that his testimony supported a reasonable hypothesis of innocence that he did not know of the contraband images on his phone. He asserts that he “purchased the cell phone associated with the suspect images second hand, that not all of the emails linked to the cell phone and suspect images were associated with him, and that the cell phone was left unlocked at his work where others could access it and the accounts linked to it.” The arguments Vyas raises on appeal are not the same contentions he raised in his motion to strike or in his renewed motion to strike after he testified.

“No ruling of the trial court . . . will be considered as a basis for reversal unless an objection was stated with reasonable certainty at the time of the ruling, except for good cause shown or to enable this Court to attain the ends of justice.” Rule 5A:18.

In a jury trial, the defendant preserves his objections to the sufficiency of the evidence in a motion to strike at the conclusion of the Commonwealth’s case if he elects to not introduce evidence of his own, or in a motion to strike at the conclusion of all the evidence or a motion to set aside the verdict if he does elect to introduce evidence of his own.

Commonwealth v. Bass, 292 Va. 19, 33 (2016); see also Sabol v. Commonwealth, 37 Va. App. 9, 20 (2001) (same).

Vyas also asked the court to reconsider its ruling concerning his right to confront evidence, specifically documents that the Commonwealth had introduced into evidence. - 14 - “The purpose of th[e] contemporaneous objection requirement [in Rule 5A:18] is to allow the trial court a fair opportunity to resolve the issue at trial, thereby preventing unnecessary appeals and retrials.” Creamer v. Commonwealth, 64 Va. App. 185, 195 (2015). “Specificity and timeliness undergird the contemporaneous-objection rule, animate its highly practical purpose, and allow the rule to resonate with simplicity.” Bethea v. Commonwealth, 297 Va. 730, (2019). If a party fails to timely and specifically object, he waives his argument on appeal.

Arrington v. Commonwealth, 53 Va. App. 635, 641 (2009).

At trial, Vyas raised only a general motion to strike the evidence. He did not contend that the evidence was insufficient for the reasons he now advances on appeal. Vyas thus waived the sufficiency claims he raises for the first time in this Court. Vyas does not invoke the good cause or ends of justice exceptions to Rule 5A:18, and the Court will not apply the exceptions sua sponte. Edwards v. Commonwealth, 41 Va. App. 752, 761 (2003) (en banc). Accordingly, we do not consider the merit of this assignment of error.

CONCLUSION For the foregoing reasons, we affirm the trial court’s judgment.

Affirmed.

- 15 -