COURT OF APPEALS DECISION NOTICE DATED AND FILED This opinion is subject to further editing. If published, the official version will appear in the bound volume of the Official Reports.

May 18, 2021 A party may file with the Supreme Court a Sheila T. Reiff petition to review an adverse decision by the Clerk of Court of Appeals Court of Appeals. See WIS. STAT. § 808.10 and RULE 809.62.

Appeal No. 2019AP2356-CR Cir. Ct. No. 2016CF472 STATE OF WISCONSIN IN COURT OF APPEALS DISTRICT III

STATE OF WISCONSIN, PLAINTIFF-RESPONDENT, V. PHILIP W. VAUGHN, DEFENDANT-APPELLANT.

APPEAL from a judgment of the circuit court for Barron County: MAUREEN D. BOYLE, Judge. Affirmed.

Before Stark, P.J., Hruz and Seidl, JJ.

Per curiam opinions may not be cited in any court of this state as precedent or authority, except for the limited purposes specified in WIS. STAT. RULE 809.23(3).

¶1 PER CURIAM. Philip Vaughn appeals a judgment, entered upon a jury’s verdicts, convicting him of two counts of possession of child pornography.

No. 2019AP2356-CR

Vaughn argues the evidence at his trial was insufficient to support his convictions.

We reject Vaughn’s arguments and affirm.1 BACKGROUND ¶2 The State charged Vaughn with two counts of possession of child pornography. The first charge arose after law enforcement downloaded multiple images of child pornography from a peer-to-peer file sharing network on July 3, 2015. Those images had been made available for sharing by a computer with an IP address registered to Mosaic Telecom, which identified Vaughn as the account subscriber.2 The second charge against Vaughn was based on images that were discovered during a search of a laptop and USB drive that were seized from his residence during the execution of a search warrant on August 18, 2015.

¶3 The case proceeded to a two-day jury trial, and the jury ultimately found Vaughn guilty of both counts. Vaughn received concurrent sentences totaling five years’ initial confinement and five years’ extended supervision. He now appeals, arguing the evidence at trial was insufficient to support his convictions.

In his notice of appeal, Vaughn also purported to appeal an order denying his postconviction motion for a new trial. In his appellate briefing, however, Vaughn clarified that he is appealing only his judgment of conviction and does not challenge the order denying postconviction relief. We therefore do not address the circuit court’s denial of Vaughn’s postconviction motion.

“An IP address is a ‘unique address that identifies a device on the Internet.’” State v. Baric, 2018 WI App 63, ¶4, 384 Wis. 2d 359, 919 N.W.2d 221 (citation omitted).

No. 2019AP2356-CR

DISCUSSION ¶4 Whether the evidence was sufficient to sustain a guilty verdict in a criminal prosecution is a question of law that we review independently. State v. Smith, 2012 WI 91, ¶24, 342 Wis. 2d 710, 817 N.W.2d 410. A defendant challenging the sufficiency of the evidence “bears a heavy burden,” as “[t]he test for sufficiency of the evidence to convict is highly deferential” to the jury’s verdict. State v. Klingelhoets, 2012 WI App 55, ¶10, 341 Wis. 2d 432, 814 N.W.2d 885. Under that test, we may not reverse a conviction unless the evidence, viewed most favorably to the State and the conviction, is so insufficient in probative value and force that it can be said as a matter of law that no trier of fact, acting reasonably, could have found guilt beyond a reasonable doubt. State v. Poellinger, 153 Wis. 2d 493, 501, 451 N.W.2d 752 (1990).

¶5 If any possibility exists that the jury could have drawn the appropriate inferences from the evidence adduced at trial to find the requisite guilt, we may not overturn a verdict, even if we believe the jury should not have found guilt based on the evidence before it. Id. at 507. The jury “is the sole arbiter of the credibility of witnesses and alone is charged with the duty of weighing the evidence.” State v. Webster, 196 Wis. 2d 308, 320, 538 N.W.2d 810 (Ct. App. 1995). When the evidence supports more than one inference, we must accept the inference drawn by the jury unless the evidence on which that inference was based is incredible as a matter of law. Poellinger, 153 Wis. 2d at 506-07.

¶6 To prove that Vaughn possessed child pornography, the State needed to prove that: (1) Vaughn knowingly possessed a recording—i.e., a reproduction of an image or a sound or the storage of data representing an image or a sound; (2) the recording showed a child engaged in sexually explicit conduct; (3) Vaughn

No. 2019AP2356-CR

knew or reasonably should have known that the recording contained depictions of sexually explicit conduct; and (4) Vaughn knew or reasonably should have known that the person shown in the recording engaged in sexually explicit conduct was under eighteen years old. See WIS. STAT. § 948.12(1m) (2019-20); WIS JI— CRIMINAL 2146A (2020).

¶7 Vaughn argues the State failed to prove the first of these elements— namely, that he knowingly possessed the images in question. To find that Vaughn knowingly possessed the images, the jury needed to find either: (1) that he knowingly had actual physical control over the images; or (2) that the images were in an area over which he had control and he intended to exercise control over them. See WIS JI—CRIMINAL 2146A (2020). The jury did not need to find that Vaughn owned the images or that he had exclusive control over them. See id. ¶8 The evidence presented at Vaughn’s trial was more than sufficient to support a finding that he knowingly possessed child pornography on both July 3, 2015, and August 18, 2015. First, the jury heard the testimony of Jesse Crowe, a special agent with the Wisconsin Department of Justice (DOJ) who specializes in investigating internet crimes against children.

¶9 Crowe explained that during the course of his investigations, he uses software that reaches out to IP addresses that have been identified as being “willing to share child exploitation material” to learn what files they have available to share over peer-to-peer networks, such as LimeWire. If a target computer is on and LimeWire is running, that computer will return a list of files that it has available to share. If that list includes files containing suspected child

No. 2019AP2356-CR

pornography, Crowe uses special software to perform a single-source download of those files from the target computer’s shared folder.3 Crowe clarified that an IP address is unique to a particular computer used to access the internet at a given time. He also explained that a user searching for files in LimeWire at a particular time may view and download files only from computers that are powered on and have LimeWire actively running at that time.

¶10 Crowe testified that on July 3, 2015, he used the procedure described above to connect with an IP address that was suspected of sharing child pornography. Vaughn was identified as the account subscriber for that IP address.

Crowe used software to obtain a list of ten files—most of which had names consistent with images of child pornography—that were available for sharing on LimeWire from Vaughn’s IP address. Crowe then used special software to perform a single-source download of eight of the ten listed files. Crowe determined that at least three of those files—which had file names containing the terms “pedo 8yo girl suck 8yo boy,” “PTHC Frifam Pedoland,” and “1301 onion”—were images of child pornography.

¶11 The jury also heard testimony that on August 18, 2015, law enforcement executed a search warrant at Vaughn’s residence, seeking evidence of child pornography stored on electronic devices. DOJ special agent Jonathan Meyer testified that he interviewed Vaughn during the search, and a recording of that interview was played for the jury. When asked during the interview about the images that had been shared from his IP address on July 3, 2015, Vaughn first

Crowe explained that a standard LimeWire download accesses files and parts of files from multiple sources.

No. 2019AP2356-CR

claimed that he was not home on that date because he was camping with his family. Vaughn later admitted, however, that he had not joined his family on the camping trip, and he instead claimed that he was on the road as a commercial trucker on July 3. When Vaughn’s driving logs disproved that claim, he told police that he was home alone on July 3 playing a video game. He denied having any knowledge of child pornography files in his shared LimeWire folder and claimed that he kept only music files in that folder.

¶12 Law enforcement seized various items during the search of Vaughn’s residence, including a silver HP laptop. In his interview with Meyer, Vaughn admitted that he had obtained the laptop from a rent-to-own store on June 30, 2015, that he had installed LimeWire on it, and that he was its sole user.

Digital forensics examiner Christine Byars testified that she examined the laptop’s hard drive and determined that its Windows operating system had been reinstalled on July 11, 2015. Byars discovered fragments of child pornography images in the hard drive’s unallocated space, which she explained indicated that the files had been deleted. Byars testified that files in a hard drive’s unallocated space can be accessed using special software, but they are not accessible to a regular user without such software. One of the deleted images that Byars discovered on Vaughn’s hard drive matched an image that Crowe had downloaded through LimeWire from Vaughn’s IP address on July 3, 2015.

¶13 Byars also recovered fragments of text keyword searches from Vaughn’s laptop hard drive that included terms commonly used by people seeking child pornography. For example, Byars located instances in which someone associated with the user profile “Philip” searched the peer-to-peer website Ares with the term “3YO” on multiple occasions after the Windows reinstall on July 11, 2015.

No. 2019AP2356-CR

¶14 Byars also testified that she found no evidence that the fragments of child pornography images she discovered on Vaughn’s hard drive were present before June 30, 2015—the date Vaughn purchased the laptop. Vaughn’s digital forensics expert similarly testified that although he found artifacts of files that had existed on the hard drive before June 30, 2015, there was no evidence of any artifacts of child pornography that existed before that date.

¶15 Byars also testified regarding her examination of a USB drive that was found in Vaughn’s wife’s purse during the search of his residence. Byars recovered an image of a prepubescent girl with exposed genitalia from the USB drive, as well as a movie file that depicted a young child fellating an adult man.

Byars testified those files appeared to have been transferred to the USB drive in October 2012. Byars further testified that the files had been deleted from the USB drive at some point but were still recoverable because they had not yet been overwritten with new data. During his interview with law enforcement, Vaughn initially denied knowing what a USB drive was. He later acknowledged, however, that he had bought a USB drive five years earlier when he was in school and had later given it to his wife to use when she returned to school.

¶16 Byars also examined Vaughn’s cell phone and discovered numerous searches of ImageSource, a Russian website known to law enforcement as a source for child pornography. Those searches occurred between August 8 and August 16, 2015, and returned results with titles such as “14Y in underwears,” “chubby blonde 16Y showering,” “Asian nude kids 13YO,” and “My 14-year-old teenage daughter.” When interviewed by law enforcement, Vaughn denied knowing what ImageSource was and said that he only accessed adult pornography online. However, when police asked Vaughn what search terms he typically used when seeking out that adult pornography, he was unable to provide a response.

No. 2019AP2356-CR

¶17 The evidence summarized above was more than sufficient for the jury to find that Vaughn knowingly possessed child pornography. As to the July 3, 2015 charge, the jury could reasonably infer that Vaughn was home on July 3, that he knowingly had LimeWire open and running on his laptop computer on that date, and that he knowingly made images of child pornography available for sharing with others through LimeWire. Based on those inferences, the jury could readily find that Vaughn knowingly possessed child pornography on July 3.

¶18 As for the August 18, 2015 charge, the image fragments that Byars recovered from Vaughn’s laptop and USB drive supported an inference that he had stored or accessed child pornography on those devices. Notably, one of the deleted images found on Vaughn’s laptop was the same as one that was shared from his IP address and accessed by law enforcement on July 3. Moreover, evidence showing that Vaughn repeatedly used search terms aimed at finding child pornography supported an inference that he did not access or store the images on his laptop and USB drive accidentally. In other words, Vaughn’s internet searches supported an inference that his possession of the images was knowing and intentional. In addition, Vaughn’s contradictory and evasive responses when questioned by law enforcement—along with his deletion of the files from the USB drive and reinstallation of Windows on his laptop on July 11, 2015—strongly supported an inference that Vaughn was conscious of his own guilt.

¶19 Vaughn argues the State failed to show that he knowingly possessed the images in question because “there was undisputed testimony that the images found on the devices seized from Vaughn’s residence were located in unallocated space that was not user accessible.” He asserts a person cannot knowingly possess “something that he cannot access without special tools, or in this case, special

No. 2019AP2356-CR

software.” He contends the State presented no evidence that he had such special software.

¶20 Vaughn’s argument misses the mark. The State did not need to prove that it located accessible images of child pornography on Vaughn’s devices to prove that he knowingly possessed those images. Instead, the State needed to prove that Vaughn had actual physical control of the images, or that the images were in an area over which he had control and that he intended to exercise control over them. WIS JI—CRIMINAL 2146A (2020). The State did so by presenting evidence that: (1) Vaughn actively sought out child pornography on the internet; (2) images of child pornography were shared from Vaughn’s IP address on July 3, 2015; and (3) fragments of deleted images of child pornography— including one of the previously shared images—were found on Vaughn’s laptop and USB drive on August 18, 2015. Based on that evidence, a jury could reasonably infer that the images were, at the times alleged, in an area over which Vaughn had control and that he intended to exercise control over them.

¶21 We agree with the State that our prior decision in State v. Mercer, 2010 WI App 47, 324 Wis. 2d 506, 782 N.W.2d 125, is instructive as to what constitutes knowing possession of child pornography. The issue in Mercer was “whether individuals who purposely view digital images of child pornography on the Internet, even though the images are not found in the person’s computer hard drive, nonetheless knowingly possess those images.” Id., ¶1. We answered that question in the affirmative, concluding that an individual knowingly possesses child pornography when he or she “affirmatively pulls up images of child pornography on the Internet and views those images knowing that they contain child pornography.” Id., ¶31. We explained that it does not matter whether the proof of possession “is hard drive evidence or something else, such as the No. 2019AP2356-CR

monitoring software here, … because both capture a ‘videotape’ of the same behavior.” Id. Applying that holding to the facts in Mercer, we concluded the defendant’s pattern of repeatedly searching for and viewing child pornography on his computer, along with evidence that he had deleted child pornography files from his hard drive, was sufficient to support a finding that he had knowingly possessed child pornography. Id., ¶33.

¶22 Similarly, in this case, the jury could reasonably find that Vaughn knowingly possessed child pornography based on evidence that: he repeatedly searched internet sites known for supplying child pornography using search terms designed to deliver that material; a computer at his IP address shared child pornography files on LimeWire at a time when Vaughn admitted being home alone; and fragments of deleted child pornography images were found on Vaughn’s laptop—a device he admitted that no one else used—and USB drive.

As noted above, the jury could also consider Vaughn’s evasive and contradictory responses to law enforcement, his deletion of the images from the USB drive, and his reinstallation of Windows on his laptop as evidence that Vaughn was conscious of his own guilt. Under Mercer, this evidence was more than sufficient for the jury to find that Vaughn knowingly possessed child pornography.

¶23 To the extent Vaughn argues the jury could have drawn other inferences based on the evidence at trial that would have been consistent with a finding that he did not knowingly possess child pornography, his argument is unavailing. Again, when the evidence supports more than one inference, we must accept the inference drawn by the jury unless the evidence on which that inference was based is incredible as a matter of law. Poellinger, 153 Wis. 2d at 506-07.

The evidence discussed above is not incredible as a matter of law and provided a

No. 2019AP2356-CR

sufficient basis for the jury’s findings that Vaughn knowingly possessed child pornography on the relevant dates. We therefore affirm Vaughn’s convictions.

By the Court.—Judgment affirmed.

This opinion will not be published. See WIS. STAT. RULE 809.23(1)(b)5. (2019-20).