Second Department, October 12, 2010

APPEARANCES OF COUNSEL

Dershowitz, Eiger & Adelson, P.C., New York City (Nathan Z. Dershowitz and Victoria B. Eiger of counsel), for appellant.

William V. Grady, District Attorney, Poughkeepsie (Bridget Rahilly Steller of counsel), for respondent.

Angiolillo, J.

In a prosecution for promoting and possessing computer images of child pornography, what is the evidentiary significance of a temporary Internet file automatically created by the computer's Internet browser when a Web page is displayed on the computer screen? What is the evidentiary significance of the defendant's knowledge or lack of knowledge regarding the operation of this automatic saving mechanism? In this appeal, we determine these issues of first impression in New York, as well as other issues regarding the legal sufficiency of the evidence of promoting and possessing child pornography through the defendant's use of an office computer.{**79 AD3d at 56}

Factual and Procedural Background

The defendant James D. Kent, a professor of public administration at a Dutchess County College (hereinafter the college), was indicted for two counts of promoting a sexual performance by a child (Penal Law § 263.15) and 141 counts of possessing a sexual performance by a child (Penal Law § 263.16). After a nonjury trial, the County Court found the defendant not guilty of seven of the possession counts and guilty of the remaining 134 possession counts and two promotion counts.

The Evidence at Trial

On May 26, 2005 as part of a campus-wide upgrade, the defendant received a new office computer, and all files on the hard drive of the old computer were transferred to the hard drive of the new computer. Nearly two years later, the defendant complained about the new computer. On April 5, 2007, an employee of the college's information technology (hereinafter IT) department ran a virus scan and discovered a "work" folder with a large number of ".jpg," or picture, files of very young girls, some scantily dressed in sexually suggestive poses. The employee removed the hard [*2]drive. Subsequently, the college turned the hard drive over to the Town of Poughkeepsie Police Department along with a signed "Consent to Search" form.

Barry Friedman, an investigator with the New York State Police, used a forensic program called EnCase to analyze the data on the hard drive. Friedman found that the only active user account associated with the hard drive was the defendant's, and there was no evidence that any other user had logged onto the computer, other than IT personnel through an "administrator" account. The defendant's user name was JKR6 and his password was 96799; to log onto the computer, a person other than the defendant would have to know this user name and password.

The EnCase program analyzes the contents of both the allocated and unallocated space on the hard drive. Friedman testified that, when the computer user initially creates a file, it is added to the allocated space, which contains files readily accessible and retrievable by the user from the file and operating systems. The unallocated space contains data which cannot be seen or accessed by the user but is accessible by forensic software. When a user deletes a file, it becomes part of the unallocated space. On the defendant's computer, the default setting on the Windows operating system directs a deleted file initially{**79 AD3d at 57} to the "recycle bin," where the user may still retrieve it. To permanently delete the file, the user must delete it from the recycle bin, sending it to the unallocated space.

On May 26, 2005, all data which was transferred from the defendant's old computer to the new computer came from the allocated space of the old computer. Nothing from the unallocated space was transferred. Thus, any files which Friedman found in the unallocated space of the hard drive of the new computer had been deleted by the user sometime between May 26, 2005 and April 5, 2007, the date when the IT department took the drive.

Within the allocated space on the defendant's hard drive was a "my documents" folder, with subfolders named "cdocs" and "work," and another folder on the C drive named "JK." The cdocs and work folders and their subfolders existed on the defendant's old computer. Some of the images in the folders and subfolders had been transferred from the old computer to the new computer on May 26, 2005, and new images had been added between 2005 and 2007.

To access the Internet, the defendant's computer had two Web browsers, Internet Explorer and Mozilla Firefox, each of which had a default profile. In addition, an alternate profile named "Jim" had been created for Mozilla Firefox and used to access child pornography Web sites. Friedman testified that several steps were required to create the alternate profile, which was set up to remain hidden and not displayed at "start up." One purpose of creating an alternate profile is to conceal the user's favorite "bookmarks" or Web addresses that are usually visited.

Under the Jim profile in the allocated space was a temporary Internet file known as the Web "cache," an automatic storage mechanism designed to speed the loading of Internet displays. When a Web page is displayed on a computer screen, the browser automatically stores a copy of it in the cache. If the user later returns to the Web site, the browser displays the cached file instead of retrieving it from the Internet in order to display the Web page more quickly.

Friedman testified that images from a Web site are stored in the cache only if they have been displayed on the computer screen. It is impossible to determine the length of time that the images remained on the screen or whether the user inadvertently accessed the Web site. Friedman testified that it was difficult to gain access to an active child pornography Web site{**79 AD3d at 58} because the sites are quickly shut down and moved to other Web addresses to avoid detection; further, in his experience as an investigator, he had never inadvertently accessed an active site nor seen a window containing child pornography "pop up" on the screen.

On the defendant's hard drive, the preferences for both the default profile and the alternate Jim profile automatically placed any downloaded material in the "work" folder. This folder structure was transferred from the old to the new computer. Also transferred between computers was the Real Player program, which is used to play videos and music. Real Player maintains a history of videos that have been played and links to files where the data is located in order to replay the files. The presence of a link file indicates that the video was on the computer screen; the video could have been streamed from a Web site or downloaded and then viewed.

In the "cdocs" folder of the defendant's hard drive were approximately 13,000 saved images of female children, the majority of which Friedman estimated to be 8 or 9 years old. Most of the children were undressed or scantily dressed in lingerie or bathing suits, many with their legs spread open and "crotches exposed." In the "work" folder were an additional 17,000 saved images [*3]of young girls. The work folder had several subfolders, each named for, and containing, images of a particular child. For instance, one subfolder contained images of a young girl named Sierra, who was identified as a known child pornography victim by the National Center for Missing and Exploited Children (hereinafter NCMEC). In addition, saved in the JK folder was a 40-minute video of Sierra, depicting her in revealing clothing, being encouraged by adult voices to strip and do other sexually suggestive acts.

The cache file in the allocated space under the Jim profile for Mozilla Firefox contained two images of a young girl with her wrists bound which were accessed within seconds of each other at 10:36 a.m. on February 21, 2007. The cache also contained 11 Web pages with messages describing child pornography, most soliciting payment with an "enter" button to access the site; one of the cached Web pages was labeled "Best CP Sites Portal, the Best Lolita CP Sites," with links to child pornography Web sites. One of the Web pages, labeled "Pedoland," was accessed on February 21, 2007, at 10:37 a.m. On the Real Player history,{**79 AD3d at 59} Friedman found links to eight child pornography videos, which were accessed between December 15, 2005 and January 8, 2007. Specifically, he found three links to child pornography videos containing the name "Arina," the same name on a deleted video in the unallocated space of the hard drive which is the subject of counts 2 and 143 of the indictment.

Saved under the file name "porndef.pb" in the JK folder is a Microsoft Word document with a file creation date of May 26, 2005, and a last written date of July 11, 2000, indicating that it had been transferred from the defendant's old computer to the new computer. The file contains the text of four messages from "JK," "Jim," or "Kent" dated June 12, 1999 through July 11, 2000, apparently addressed to a person with the initials "P.B." It is unclear from the file whether these messages were ever sent to P.B. in correspondence or e-mails. The messages comment on a proposed "project," apparently to write a book about child pornography or proposed laws regulating pornography, and discuss whether certain images of young girls contained on disks in the defendant's possession would be considered pornographic. The message dated July 21, 1999, among other things, states that "sooner or later someone at this college is going to wonder why I keep looking at porno sites . . . Jim." The message dated June 15, 2000 includes these comments:

"I still don't think there's anything in this project . . . So here I am (and I suppose you are, too) with a bunch of disks full of photos, at least some of which are probably illegal. Do you want them or should I wipe them or should I send them to somebody else?"

The final message dated July 11, 2000, states:

"Well, this last batch pretty much tears it. While, as somebody's father, I'm pretty appalled by this stuff, I also don't want to get arrested for having it. So let's do this—if this is a legitimate research project, let's write it up and tell the deans (and preferably also the cops) what we're doing and why. Otherwise, let's drop it in the most pronto possible fashion.

"I don't even think I can mail the disk to you, or anyone else, without committing a separate crime. So I'll probably just go ahead and wipe them. You have the URL's if you want to pursue it.

"See you sooner or later, no doubt. Kent."{**79 AD3d at 60}

According to Friedman, the term "wipe" means that the data on the disk is not merely deleted but is overwritten with randomly generated characters to make it unrecoverable.

Count 1 charges promotion and count 142 charges possession of child pornography with respect to a Web page with an image saved as a ".jpg" file in the cache under the Jim profile in the allocated space of the hard drive. The Web page, which was accessed and stored in the cache at 10:37 a.m. on February 21, 2007, was called "School Backyard" and depicted children engaging in sexual intercourse with adults. Payment was required to obtain further material from the School Backyard Web site. There was no evidence that the defendant had paid to enter the Web site, but the cached Web page itself contained child pornography. Although it is possible for the user to delete files stored in the cache, the School Backyard file had not been deleted, was in allocated space, and could be retrieved by the user. As noted above, within minutes of accessing the School Backyard Web [*4]page, three other Web pages were accessed and appeared in the Web cache: two images of a girl with her wrists bound and a Web page labeled "Pedoland."

Count 2 charges promotion and count 143 charges possession with respect to a video containing child pornography which, at one time, had been downloaded and saved in the allocated space of the hard drive under the file name "Arina." Friedman recovered the video from the unallocated space, indicating that it had been deleted from the hard drive but was retrievable using EnCase because the data had not been overwritten. The file "created" date was May 26, 2005, which reflects the date that the college IT department copied the data from the defendant's old computer to the new computer. The last "written" date, May 18, 2005, was consistent with the date that the video was acquired and saved to the hard drive of the old computer. Also, in certain circumstances, the written date will reflect that a previously saved file has been opened and saved, even if the content is not altered.

These counts charged possession of images recovered from the unallocated space of the hard drive. The images contained{**79 AD3d at 61} the lewd exhibition of exposed genitals of female children and included depictions of children penetrated by objects and engaged in sex acts with dogs or adults. Some of those images were of children identified by NCMEC as victims of child pornography. At one time these images had been saved in the allocated space of the hard drive, either on the old computer or the new computer. With respect to each image, Friedman was unable to determine whether it had been in the allocated space of the old computer and transferred to the new computer, or whether it had been initially created and saved on the new computer. In either case, at some point between May 26, 2005 and April 5, 2007, all of the images charged in counts 3 through 141 had been stored in the allocated space of the new computer and were accessible to the user, and at some point during the same time period, the user deleted all of the images, sending them to the unallocated space.

Six witnesses testified for the defense: four students and two faculty members from the college. They testified that the defendant's office door was usually open and they often dropped in without an appointment; when they visited, the computer was on and there was nothing inappropriate on the screen. There were also occasions when the defendant's door was closed, and the witnesses did not determine if the defendant was inside.

Five of the defense witnesses testified that the defendant allowed students to use his computer. Two of the student witnesses had not used his computer. The other two student witnesses had used his computer to print their school papers by either inserting a flash drive or accessing their e-mail accounts to obtain files they had sent to themselves as e-mail attachments; the defendant was in the office but did not monitor their activities on his computer. One of the students had also saved a school paper to the defendant's hard drive. The same student testified that the defendant's wife had posted a message on Facebook asking for witnesses to come forward if they knew of the defendant's casual practice of allowing access to his office and his computer.

Four of the defense witnesses testified that they had difficulties with viruses or unwanted pop-up windows on their own computers while using the college network. One of the students testified that she received pop-up advertisements containing adult pornography but had not received any child pornography;{**79 AD3d at 62} a faculty member had received a lewd e-mail but did not open an attachment to it. One faculty member and two students testified that they never received any unwanted pop-up windows containing pornography.

Analysis

Counts 1 and 2 charge the defendant with the class D felony of promoting a sexual performance of a child. A person is guilty of that crime when, "knowing the character and content thereof, he produces, directs or promotes any performance which includes sexual conduct by a child less than seventeen years of age" (Penal Law § 263.15). The statutory definition of "performance," which includes any "motion picture" or "photograph" (Penal Law § 263.00 [4]), is interpreted to encompass any "digital computer image" (People v Fraser, 96 NY2d 318, 327 [2001], cert denied 533 US 951 [2001]), consistent with the legislative intent "to 'employ broad measures to eradicate child pornography [*5]in all its forms' " (id. at 327, quoting People v Keyes, 75 NY2d 343, 348 [1990]). The term "promote" means "to procure, manufacture, issue, sell, give, provide, lend, mail, deliver, transfer, transmute, publish, distribute, circulate, disseminate, present, exhibit or advertise, or to offer or agree to do the same" (Penal Law § 263.00 [5] [emphasis added]).

With respect to the crime of promoting, in the context of the case before us, the only applicable term is "procure." Although there is no statutory definition for "procure," the Court of Appeals has applied the common dictionary definition, " 'to get possession of: obtain, acquire . . . esp: to get possession of by particular care or effort' " (People v Keyes, 75 NY2d at 348, quoting Webster's Third New International Dictionary 1809 [unabridged 1986]). The Court further explained that

"the term 'procure' as used in Penal Law § 263.00 (5) defines 'promote' for the purposes of Penal Law § 263.15 as simply the acquisition of child pornography, whether for personal consumption or for distribution to others. . . .

"[C]onsistent with [the Legislature's] efforts to eradicate the social evil of child pornography, Penal Law § 263.15 is directed at the consumers of child pornography as well as at its manufacturers and distributors. The Legislature used the term 'procure'{**79 AD3d at 63} as that term is commonly understood—meaning to obtain or acquire" (People v Keyes, 75 NY2d at 348).

A defendant, thus, can be found guilty of the crime of promoting a sexual performance by a child by committing an act of procuring a computer digital image containing child pornography while "knowing the character and content" of the material procured (Penal Law § 263.15). As a matter of statutory construction, this mental state is presumed to apply to every element of the offense (see Penal Law § 15.15 [1]), and therefore, the act of procuring pornographic material must be knowing, not merely inadvertent or accidental.

By contrast, counts 3 through 143 of the indictment charged the defendant with the class E felony of possessing a sexual performance by a child. A person is guilty of that crime when, "knowing the character and content thereof, he knowingly has in his possession or control any performance which includes sexual conduct by a child less than sixteen years of age" (Penal Law § 263.16). Like the crime of promoting, the applicable mental state is "knowingly." Unlike the crime of promoting based upon a defendant's procurement of child pornography for personal consumption, procurement is not an element of the crime of knowing possession of child pornography. Thus, the People need not prove that the defendant was the individual who initially procured the material (see Kromer v Commonwealth, 45 Va App 812, 820, 613 SE2d 871, 875 [2005] [applying a statute prohibiting knowing possession of child pornography, the court stated that "(t)he issue of who originally procured the offensive images is of no concern to our analysis"]).

The defendant contends, however, that computer images are "intangible," and therefore, cannot be possessed in the traditional sense. For this argument, he relies on the statutory definition of "possess" applicable generally to Penal Law offenses, which is "to have physical possession or otherwise to exercise dominion or control over tangible property" (Penal Law § 10.00 [8]). This definition applies "[e]xcept where different meanings are expressly specified in subsequent provisions of [the Penal Law]" (Penal Law § 10.00). The provision at issue, Penal Law § 263.16, expressly prohibits the knowing "possession or control" of child pornography contained in a "photograph" (Penal Law § 263.00 [4]), a definition which has been interpreted by the Court of Appeals to encompass "digital computer images" (People v Fraser, 96 NY2d at 327; Penal Law{**79 AD3d at 64} § 263.00 [4]; § 263.16). Therefore, even if computer images are deemed "intangible" as the defendant contends, the more specific provision of Penal Law § 263.16 broadens the general definition of "possess" in Penal Law § 10.00 (8) to apply to computer images in addition to tangible property. Moreover, Penal Law § 263.16 expressly prohibits the knowing "control" of child pornography, a concept which is particularly apt in the context of digital computer images.

Where, as here, the evidence is both direct and circumstantial, we must determine whether, viewing the evidence in the light most favorable to the prosecution, any rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt (see Jackson v Virginia, 443 US 307, 319 [1979]; People v Contes, 60 NY2d 620, 621 [1983]; People v Barnes, 50 NY2d 375, 379-380 [1980]). A defendant's mental state can be proven by circumstantial evidence (see People v Von Werne, 41 NY2d 584, 590 [1977]; People v Campbell, 33 AD3d 716, 718 [2006]), and the factfinder, when faced with conflicting evidence, "may accept some and reject other items of evidence, . . . regardless of whether that evidence is circumstantial or direct" (People v Kennedy, 47 NY2d 196, 201 [1979]; see People v Carr-El, 99 NY2d 546, 547 [2002]).

The defendant contends that the evidence was legally insufficient to establish his knowing procurement and possession of the "School Backyard" Web page. With respect to count 1, promoting, the defendant contends that visiting a Web site or viewing a Web page does not constitute procurement of its contents, nor that an act of procurement is committed when a Web page is automatically saved in the cache without his knowledge or intentional act of downloading or saving it. He further contends that the People failed to prove that he had the required mental state because, even if he procured the Web page, there was no evidence that he knew it would contain child pornography before he opened it. With respect to count 142, possession, the defendant contends that he did not knowingly possess the images in the cache because the temporary Internet files are automatically created and the People failed to prove that he had knowledge of this function of his computer.

To address these contentions, we must determine the evidentiary significance of files stored in the cache and the related issue of the evidentiary significance of the defendant's knowledge{**79 AD3d at 65} or lack of knowledge of this automatic function of the Web browser. These issues have been considered by several state and federal courts, usually in the context of prosecutions under statutes prohibiting the knowing possession of child pornography. An underlying premise in these cases is that a defendant cannot be found guilty of possessing (or in some cases receiving, controlling or procuring) child pornography merely upon evidence that a file or files have been automatically stored in the cache. More is required.

For example, interpreting the federal statute which prohibits knowing possession of child pornography, the Tenth Circuit has required direct or circumstantial evidence of the defendant's knowledge that the files were automatically stored in the cache absent evidence that steps were taken to download or save the images (see United States v Bass, 411 F3d 1198, 1202 [2005], cert denied 546 US 1125 [2006]; United States v Tucker, 305 F3d 1193, 1204 [2002], cert denied 537 US 1223 [2003]). The Ninth Circuit requires either knowledge of the functioning of the cache or evidence that the defendant exercised control over the cache files by, for example, saving and later deleting them (see United States v Romm, 455 F3d 990, 1000-1001 [2006], cert denied 549 US 1150 [2007]; compare United States v Kuchinski, 469 F3d 853, 863 [2006]). These issues appear to be still open in the Second Circuit (see United States v Martin, 426 F3d 68, 77 [2005], cert denied 547 US 1192 [2006]).

Some state courts have held that files saved in the cache provide evidence only of intentional viewing of the images, an act which does not fall within the definition of knowing possession under the particular statutes in those jurisdictions (see Worden v State, 213 P3d 144 [Alaska 2009]; Barton v State, 286 Ga App 49, 648 SE2d 660 [2007]). They treat the cached file as the contraband itself and hold that guilt of knowing possession cannot be established without additional proof that the defendant took affirmative action to save or download the images or knew of the automatic saving mechanism of the computer (see Worden v State, 213 P3d at 147-149; Barton v State, 286 Ga App at 53, 648 SE2d at 663).

Other state courts have upheld convictions based upon files in the cache when there is additional evidence such as a pattern of Internet browsing; the defendant's repeated return to child pornography Web sites gives rise to the inference of his knowledge of their content and his control over the images (see State v Mercer, 324 Wis 2d 506, 526-530, 728 NW2d 125,{**79 AD3d at 66} 135-138 [2010]; People v Josephitis, 394 Ill App 3d 293, 306, 914 NE2d 607, 616 [2009]; Gant v State, 278 SW3d 836, 839 [Tex 2009]; State v Jensen, 217 Ariz 345, 351-352, 173 P3d 1046, 1052-1053 [2008]). By accessing the Web sites, the defendant has the ability to manipulate, download, copy, print, save, or e-mail the images; it is not important whether he chooses to engage in these additional activities "because intentionally seeking out child pornography and purposefully making it appear on the computer screen—for however long the defendant elects to view the image—itself constitutes knowing control" (Commonwealth v Diodoro, 601 Pa 6, 18, 970 A2d 1100, 1107 [2009], cert denied 558 US —, 130 S Ct 200 [2009]; see State v [*7]Mercer, 324 Wis 2d at 526, 782 NW2d at 136; Tecklenburg v Appellate Div. of Super. Ct., 169 Cal App 4th 1402, 1419, 87 Cal Rptr 3d 460, 473 [2009]; Ward v State, 994 So 2d 293, 301-302 [Ala 2007]). Other courts have reasoned that the cached file itself is not the contraband possessed, but merely a copy of the images which were, at one time, displayed on the screen and previously possessed through the defendant's exercise of dominion and control over them (see State v Hurst, 181 Ohio App 3d 454, 470, 909 NE2d 653, 664-665 [2009]; People v Josephitis, 394 Ill App 3d at 306, 914 NE2d at 616). Under this approach, the defendant's lack of knowledge of the functioning of the cache " 'is [rendered] irrelevant because criminal liability arises not from the cached images themselves, but rather from the images that the user originally searched for, selected, and placed on his computer screen' " (State v Hurst, 181 Ohio App 3d at 470, 909 NE2d at 665, quoting Howard, Don't Cache Out Your Case: Prosecuting Child Pornography Possession Laws Based On Images Located In Temporary Internet Files, 19 Berkeley Tech LJ 1227, 1272, 1257 [Fall 2004]).

The consistent thread in these cases is the need to distinguish inadvertent or unintentional acquisition or possession of the offensive material from knowing or intentional procurement and possession, depending upon the language of the particular statute under review. We are in agreement with the underlying premise that the mere existence of an image automatically stored in the cache, standing alone, is legally insufficient to prove either knowing procurement or knowing possession of child pornography. As one court put it, reliance on this evidence in isolation "is problematic" because a file in the cache{**79 AD3d at 67}

"may not always be the result of the computer user seeking out or downloading the image. The relevant inquiry thus becomes whether the defendant knowingly possessed the images, in that he exerted some control over them, . . . or whether the presence of the images on his computer was merely inadvertent. This inquiry is a question of fact" (State v Clark, 158 NH 13, 20, 959 A2d 229, 235 [2008]).

Here, turning first to the crime of promoting under Penal Law § 263.15, Investigator Friedman's testimony is consistent with the view that a Web page stored in the cache is evidence of past procurement of the images on that page. Specifically, the cached Web page from the "School Backyard" site is evidence that the Web page was accessed and displayed on the defendant's computer screen. Whether the defendant knowingly or inadvertently accessed that Web page, and whether he knew that the Web page would contain child pornography when he accessed the site, are issues of fact which require an examination of the totality of the direct and circumstantial evidence. Viewing the evidence in the light most favorable to the prosecution, we find that it was legally sufficient to support the defendant's conviction of count 1.

The evidence taken from the defendant's hard drive in the cache under the alternate "Jim" profile established a pattern of Internet browsing for child pornography Web sites. Eleven such sites were in the Web cache, four of which, including the "School Backyard" site, were accessed within minutes of each other on February 21, 2007. In addition to evidence in the cache, the Real Player history contained links to eight child pornography videos, indicating they were accessed and viewed. The defendant's interest in this material is further manifest in the 30,000 images of scantily attired young girls meticulously categorized and saved in subfolders of his work folder in the allocated space of the hard drive, as well as the scores of illegal images in the unallocated space, which are the subjects of the remaining counts of the indictment. The illegal images had at one time been saved and available in the allocated space, then deleted, sending them to the unallocated space, indicating the defendant's consciousness of guilt and knowledge of the difference between legal and illegal images. The defendant's knowledge is further established by his messages to "P.B." in 1999 and 2000, conceding that he was in possession of illegal child pornography and offering to{**79 AD3d at 68} "wipe" the disks. The evidence in totality was legally sufficient to establish that the defendant, "knowing the character and content" of the material, knowingly procured the "School Backyard" Web page for his personal consumption (Penal Law § 263.15; see People v Keyes, 75 NY2d at 348).

Turning to the possession charge under count 142 based upon the same Web page, we further conclude that the evidence was legally sufficient to prove the defendant's knowing possession of the images on that page. The defendant knowingly accessed the Web page and displayed it on his computer screen for his personal consumption, establishing his dominion and control over the images. Whether the defendant understood that his Web browser automatically saved a copy of the image is irrelevant because the cached file itself is not the contraband but is evidence of previous possession of the images. Further, the fact that he did not copy, download, save, or print the images for additional [*8]future consumption does not vitiate the proof of his dominion and control over the images for the period of time they were resident on his computer screen. Accordingly, we conclude that the evidence was legally sufficient to support the defendant's conviction under count 142.

In fulfilling our responsibility to conduct an independent review of the weight of the evidence (see CPL 470.15 [5]; People v Danielson, 9 NY3d 342 [2007]), we accord great deference to the factfinder's opportunity to view the witnesses, hear the testimony, and observe demeanor (see People v Mateo, 2 NY3d 383, 410 [2004], cert denied 542 US 946 [2004]; People v Bleakley, 69 NY2d 490, 495 [1987]). In light of the extensive evidence that the defendant had knowingly used his office computer for the acquisition of child pornography, the defense evidence that he allowed his students to use the computer for their school work did not give rise to a reasonable inference that a person other than the defendant had accessed and viewed the "School Backyard" Web page, or that the defendant himself had inadvertently or unknowingly accessed it. Accordingly, we are satisfied that the verdict of guilt as to counts 1 and 142 was not against the weight of the evidence (see People v Romero, 7 NY3d 633, 644-645 [2006]).

The remaining 134 counts of which the defendant was convicted were based on images which, at one time, had been{**79 AD3d at 69} downloaded and saved in the allocated space of the hard drive and subsequently deleted. These counts included one count each of promotion and possession with respect to a video with the file name "Arina." Besides the Arina video, another 132 distinct images were the subject of the remaining possession counts. With respect to all 134 counts, the images and video were discovered in the unallocated space of the hard drive, establishing that, at some point between May 26, 2005 and April 5, 2007, they had been accessible to the defendant in the allocated space and at some point during the same time period he deleted them, causing them to move to the unallocated space.

Under New York law, in cases where legal sufficiency was not challenged, evidence of downloaded and saved computer images has served as the basis for a conviction of attempted promotion pursuant to Penal Law §§ 110.00 and 263.15 (see People v Johnson, 11 NY3d 416 [2008], affg 47 AD3d 140 [2007]) and possession pursuant to Penal Law § 263.16 (see People v Fraser, 96 NY2d 318 [2001]). Several federal and state courts have determined that knowing possession is established with evidence of downloaded and saved files and that deletion of such files provides additional evidence of dominion and control, supporting a finding of past possession of the saved files (see United States v Romm, 455 F3d at 1000; United States v Tucker, 305 F3d at 1204-1205; State v Clark, 158 NH at 19-20, 959 A2d at 234-235; Kromer v Commonwealth, 45 Va App at 815, 821, 613 SE2d at 872-273, 875-876; State v Mobley, 129 Wash App 378, 384-386, 118 P3d 413, 416-417 [2005]).

Here, the defendant contends that his deletion of the files indicates that he did not intend to possess them, and thus, undermines a finding of knowing possession. Contrary to this contention, when considered in context of the totality of the evidence, his deletion of the files gives rise to an inference of consciousness of guilt. The defendant did not delete some 30,000 images of scantily attired young girls which were, allegedly, not pornographic, but did delete the Arina video and the additional 132 pornographic images of which he was convicted, thus giving rise to the reasonable inference that he was attempting to avoid detection of this unlawful material. This evidence also tends to establish the defendant's knowledge of the functioning of his computer in support of the inference that he exercised dominion and control over these images. Accordingly, viewing the evidence in the light most favorable to the People, it was legally{**79 AD3d at 70} sufficient to establish the defendant's knowing possession of the material which is the subject of the remaining possession counts.

Further, with respect to count 2, promotion, the evidence sufficiently established that the defendant not only knowingly possessed the Arina video, but that he knowingly procured it for his personal consumption (see Penal Law § 263.15; People v Keyes, 75 NY2d at 348). The defendant contends that there is no evidence of the source of the video, whether it came from the Internet, a flash drive, an e-mail attachment, or another source. This contention, however, is irrelevant, as the People have no obligation to prove the source of the material. Rather, the totality of the direct and circumstantial evidence of the defendant's extensive use of his office computer to obtain and view child pornography was a sufficient basis from which the factfinder could infer that the defendant acquired the video, and thus, committed an act of procurement.

Finally, we have conducted an independent review of the weight of the evidence (see CPL 470.15 [5]; People v Danielson, 9 NY3d 342 [2007]), and are satisfied that the verdict of guilt of [*9]promoting under count 2 and of the remaining possession counts was not against the weight of the evidence (see People v Romero, 7 NY3d at 644-645).

At the close of the People's case, the County Court granted the prosecutor's application to amend count 2 of the indictment to change the date of the crime from on or about May 26, 2005 to on or about May 18, 2005, based upon Investigator Friedman's testimony regarding the Arina video. Friedman testified that the file "created" date of May 26, 2005, actually reflects the date that the files from the allocated space of the hard drive of the old computer, including the Arina video, were transferred to the allocated space of the new hard drive. The "written" date was May 18, 2005, which Friedman testified was consistent with the date when the file was acquired. He also testified, however, that he could not be certain how long the Arina video had been on the old computer and that, under certain circumstances, the last written date may reflect that a file, previously acquired or created, has been opened and saved.

The defendant contends that the County Court erred in granting the People's application because it impermissibly changed the prosecution theory, causing him prejudice. Contrary to this contention, the trial court properly permitted the amendment. The trial court may{**79 AD3d at 71}

"order the amendment of an indictment with respect to defects, errors or variances from the proof relating to matters of form, time, place, names of persons and the like, when such an amendment does not change the theory or theories of the prosecution as reflected in the evidence before the grand jury . . . or otherwise tend to prejudice the defendant on the merits" (CPL 200.70 [1]; see People v Simmons, 212 AD2d 643, 644 [1995]).

Here, the People's theory was that the defendant procured the Arina video by saving it to the hard drive of his office computer. The amendment conformed the indictment to the testimony that the Arina video had originally been present on the defendant's old hard drive and was transferred to the new one, but it did not materially change the prosecution theory, which continued to be that the defendant used his office computer to procure the video. The original indictment alleged that the procurement occurred "on or about" May 26, 2005, and the trial evidence confirmed that the exact date of procurement was impossible to determine, but was more likely to be on or about May 18, 2005. Where, as here, the date of the procurement was not a material element of the crime, the minor amendment did not constitute a material variance from the theory of the indictment (see People v O'Connor, 240 AD2d 764, 765 [1997]). Accordingly, the defendant had fair notice of the prosecution theory, and the amendment did not have an adverse impact on the defendant's strategy or ability to defend against the charges (see People v Straniero, 17 AD3d 161, 161-162 [2005]; People v Simmons, 212 AD2d at 644).

The defendant's trial counsel did not move to suppress the evidence collected from the hard drive of the defendant's office computer. The college consented to the search, but the police did not obtain the defendant's consent. The defendant contends that the search violated his constitutional rights because he had a reasonable expectation of privacy in the files stored in his office computer, and therefore, his trial counsel was ineffective in failing to move to suppress that evidence.

To prevail upon this claim, the defendant must demonstrate that his counsel had no strategic or other legitimate explanation for his failure to make the motion; absent such a showing, it is presumed that counsel acted in a competent{**79 AD3d at 72} manner and exercised professional judgment (see People v Taylor, 1 NY3d 174, 177 [2003]; People v Rivera, 71 NY2d 705, 709 [1988]). Further, a single failing in an otherwise competent performance may qualify as ineffective assistance only when the error is sufficiently egregious and prejudicial as to compromise a defendant's right to a fair trial; there can be no denial of effective assistance of counsel arising from the failure to make a motion or argument that has little or no chance of success (see People v Caban, 5 NY3d 143, 152 [2005]; People v Stultz, 2 NY3d 277, 287 [2004]; People v Adelman, 36 AD3d 926, 928 [2007]).

On the record before us, the defendant has failed to demonstrate that a suppression motion had any chance of success, and thus, he cannot demonstrate the absence of a legitimate explanation for his trial counsel's failure to make the motion. A defendant seeking to suppress evidence must initially establish his standing by demonstrating a legitimate expectation of privacy in the premises or object searched; the defendant's subjective expectation must be one that society recognizes as reasonable (see People v Ramirez-Portoreal, 88 NY2d 99, 108 [1996]). An employee's [*10]expectation of privacy in material stored in an office computer depends upon the employer's policy regarding computer use and any other relevant office practices, procedures, and regulations (see e.g. United States v Angevine, 281 F3d 1130, 1134-1135 [2002], cert denied 537 US 845 [2002]; Muick v Glenayre Elecs., 280 F3d 741, 742 [2002]; Leventhal v Knapek, 266 F3d 64, 73-74 [2001]; United States v Simons, 206 F3d 392, 398 [2000]).

Here, the record establishes that the computer was the property of the college, but contains no further evidence regarding the terms of the college's computer policy or user agreement with the defendant, if any. The defendant cannot show on this record that he had a reasonable expectation of privacy in his personal files stored on the office computer. Absent additional facts, we cannot conclude that counsel's actions lacked any legitimate explanation (see People v Denny, 95 NY2d 921, 923 [2000]; People v Love, 57 NY2d 998, 1000 [1982]). To the extent that the defendant's ineffective assistance of counsel claim is premised upon matter dehors the record, we are unable to review such a claim on direct appeal (see People v Park, 60 AD3d 972, 973 [2009]; People v Holland, 44 AD3d 874 [2007]).{**79 AD3d at 73}

The defendant's remaining contentions are unpreserved for appellate review, and in any event, are without merit.

Accordingly, the judgment is affirmed.

Prudenti, P.J., Balkin and Chambers, JJ., concur.

Ordered that the judgment is affirmed.