We are called upon to decide whether, absent a search warrant or probable cause, the contents of a laptop computer may be searched at an international border and, if so, what evidence is sufficient to convict its owner of receiving and possessing child pornography. We also address an error in the jury instructions on the mental state required for knowingly possessing child pornography.
Defendant Stuart Romm connected to the internet from a Las Vegas hotel room and visited websites containing images of child pornography. As Romm viewed the images online and enlarged them on his screen, his computer automatically saved copies of the images to his “internet cache.” 1 Based on 40 images deleted from his internet cache and two images deleted from another part of his hard drive, 2 Romm was convicted of knowingly receiving and knowingly possessing child pornography in violation of 18 U.S.C. §§ 2252A(a)(2), (a)(5)(B). Romm appeals both of these convictions, as well as his concurrent mandatory minimum sentences of ten and fifteen years.
First, Romm claims the evidence of his crime should have been suppressed as the fruits of an unlawful border search. Second, he challenges the sufficiency of the evidence supporting each of his convictions, arguing he cannot be found guilty of possessing or receiving child pornography, when he merely viewed child pornography without “downloading” 3 any of it to *994 his hard drive. Third, he claims the refusal of his proffered jury instruction on the statutory definition of a “visual depiction” deprived him of the right to present a defense. Fourth, he argues that the omission of an element from the jury instructions on “knowing possession” and the district court’s refusal to supplement the instructions in response to a note from the jury together constitute reversible plain error. Fifth, he challenges the enhancement of his sentences based on prior convictions for predicate offenses.
We have jurisdiction pursuant to 28 U.S.C. § 1291, and for the reasons stated herein, affirm Romm’s convictions, but vacate his sentences and remand to the district court for resentencing.
BACKGROUND
From January 23, 2004 to February 1, 2004, Romm attended a training seminar held by his new employer in Las Vegas, Nevada. When the training seminar ended on February 1, 2004, Romm flew from Las Vegas, Nevada to Kelowna, British Columbia on business.
At the British Columbia airport, Canada’s Border Services Agency discovered that Romm had a criminal history and stopped him for questioning. Romm admitted he had a criminal record 4 and was currently on probation. Agent Keith Brown then asked Romm to turn on his laptop and briefly examined it. When Brown saw several child pornography websites in Romm’s “internet history,” 5 Brown asked Romm if he had violated the terms of his probation by visiting these websites. Romm answered “Yes,” and also said, “That’s it. My life’s over.”
Meanwhile, Canada’s immigration service had decided not to admit Romm into the country. Romm withdrew his application for entry and was placed under detention until the next flight to Seattle. Agent Brown then informed U.S. Customs in Seattle that Romm had been denied entry and possibly had illegal images on his computer. On February 2, 2004, Romm returned to Seattle. At the Seattle-Tacoma airport, Romm was interviewed by Agents Macho and Swenson of Immigration and Customs Enforcement (“ICE”). 6 The agents told Romm they needed to search his laptop for illegal images, and could arrange for the examination to be completed that night. Romm agreed. He told the agents he had been in sole possession of the laptop for the previous six to eight weeks. He also told the agents he had “drifted” away from his “therapy,” and experienced “occasional lapses” during which he would view child pornography. But Romm repeatedly denied having any child pornography on his laptop.
ICE conducted a preliminary forensic analysis of the hard drive in Romm’s laptop. When the preliminary analysis revealed ten images of child pornography, Agent Macho confronted Romm with this information and asked Romm why he had lied about having images on his computer. Romm looked down, adopted a “confes *995 sional mode,” made little eye contact with his interrogators, and said that “he knew[the agents] were gonna find something on the computer.” He also stated the agents had every right to arrest him and would probably do so.
Romm then described to the agents how he used Google 7 to search for child pornography websites. When he found pictures he liked, Romm would keep them on his screen for five minutes and then delete them. Romm used the terms “save” and “download” to describe this operation. While staying in his hotel room in Las Vegas, Romm viewed child pornography and masturbated twice, while or shortly after viewing the child pornography; he claimed to have then deleted such images. In all, Romm used the internet for approximately six-and-a-half hours during his week-long stay in Las Vegas.
Results of the Forensic Analysis
At trial, the government called three witnesses to testify about the forensic analysis of the hard drive in Romm’s laptop. First, Agent Camille Sugrue described the preliminary analysis that she conducted with software called “EnCase.” With EnCase, it is possible to recover deleted files, 8 as well as information showing when the files were created, accessed, or modified. In conducting the preliminary analysis, Sugrue found ten images of child pornography. All of the images she found had been deleted from Romm’s hard drive.
Second, Detective Timothy Luckie testified to the results of the full forensic analysis of Romm’s hard drive. Luckie confirmed that all of the child pornography on Romm’s computer had been deleted. The vast majority of the images Luckie found had been deleted from Romm’s internet cache. EnCase did not reveal when the files had been deleted. Luckie’s analysis also showed that Romm had enlarged a few smaller “thumbnail” 9 images in the internet cache.
Luckie next explained how files in the internet cache are deleted. First, on the default setting, the web browser automatically empties the internet cache when it reaches a given size. Second, the user can instruct the browser to empty the internet cache. Third, users who know where the internet cache is located can go into the cache and manually delete the files, rather than effect the deletions automatically through the web browser’s default setting. EnCase did not reveal the settings on Romm’s web browser, or how his internet cache had been emptied. Luckie opined “through experience and training,” however, that Romm either had instructed his browser to empty the cache or had deleted the files manually. Luckie also noted Romm had erased his internet history at 2:25 p.m. on February 2, 2004, the same afternoon that Canada’s Border Services Agency placed Romm on a flight back to Seattle.
Finally, Luckie testified that files in the internet cache are accessible, albeit “system-protected.” A user who knows how to find the internet cache can view the images stored there. Once the user views the image, the user “can print, rename, [or] save [it] elsewhere, the same thing you can do with any other file.”
*996 The government’s third expert witness, Darryl Cosme, exhibited to the jury 42 images of child pornography recovered from Romm’s hard drive. He told the jury the provenance of some images, when each image was saved to the cache, and whether that image was a thumbnail or a full-sized picture. Cosme identified several websites in the internet history as related to child pornography.
Romm’s expert witness, Thomas Keller, testified how the internet cache is “system-protected.” According to Keller, “system-protection” blocks any user from accessing the cache, except by means of “system-commands.” If, however, the user executes a system-command notwithstanding the computer’s warning, he can copy the cached image to another location on the hard drive or view the image by copying it into an open program. Keller also testified that people delete their internet history and internet cache for legitimate reasons. Finally, Keller testified he found no evidence Romm ever went into the internet cache, or accessed the files there.
Before trial, Romm moved to suppress the evidence obtained through the border search of his laptop and moved to force the government to elect between multiplicitous counts. The court orally denied both motions. After a four-day trial, the jury deliberated for six hours and found Romm guilty of both possessing and receiving child pornography. At sentencing, the court found Romm had committed a predicate offense under 18 U.S.C. § 2252A(b), and accordingly imposed concurrent mandatory minimum sentences of ten and fifteen years. Romm then filed a timely notice of appeal.
ANALYSIS
I. BORDER SEARCH
First, we address whether the forensic analysis of Romm’s laptop falls under the border search exception to the warrant requirement. We review the legality of a border search de novo.
United States v. Okafor,
Romm argues he was not subject to a warrantless border search because he never
legally
crossed the U.S.-Canada border. We have held the government must be reasonably certain that the object of a border search has crossed the border to conduct a valid border search.
See United States v. Corral-Villavicencio,
Nor will we carve out an “official restraint”
10
exception to the border search doctrine, as Romm advocates. We assume for the sake of argument that a person who, like Romm, is detained abroad has no opportunity to obtain foreign contraband. Even so, the border search doctrine is not limited to those cases where the searching officers have reason to suspect the entrant may be carrying foreign contraband. Instead, “ ‘searches made at the border ... are reasonable simply by virtue of the fact that they occur at the border.’ ”
United States v. Flores-Montano,
Finally, and for the first time in his reply brief, Romm argues the search of his laptop was too intrusive on his First Amendment interests to qualify as a “routine” border search.
See generally Okafor,
II. SUFFICIENCY OF THE EVIDENCE
Next, Romm challenges the sufficiency of the evidence that he committed the acts of “possessing” and “receiving” child pornography. The sufficiency of the evidence is reviewed de novo.
See United States v. Shipsey,
Possession of Child Pornography
As we explain below, whether Romm “received” the images in his cache depends on whether he knowingly took possession of them. Thus, we begin by analyzing his conviction for knowingly possessing child pornography. It is a federal crime to “knowingly possess[ ] any book, magazine, periodical, film, videotape, computer disk, or any other material that contains an image of child pornography....” 18 U.S.C. § 2252A(a)(5)(B). “Child pornography” is defined as a “visual depiction,” id. § 2256(8), and the term “visual depiction” “includes undeveloped film and videotape, and data stored on computer disk or by electronic means which is capable of conversion into a visual image.” Id. § 2256(5) (emphasis added).
Romm’s first argument is that files in the internet cache are not “visual depictions” and, therefore, lie beyond the reach of 18 U.S.C. § 2252A. Specifically, Romm argues the files in the cache are not “data ... which is capable of conversion into a visual image,” because they must be copied to another location on the disk before they are fully accessible. As Romm’s 8274 expert witness, Thomas Keller, testified, the cache is a “system-protected” area, which the operating system tries to prevent users from accessing by displaying a warning that access involves an “unsafe” system-command. The user can, however, override the warning, and open and view the cached files, by executing a system-command. The following testimony by Keller is pertinent here:
Q — What would a user of Windows XP Pro have to do to view [the cached] image if off line?
A — If he’s off line, ..., you have to physically move that image to another file folder. You could either drag it to another one, copy it and paste it to an open window [or] to [ ] some kind of [ ] software that would allow you to see images or cut it and paste it to another folder.
Keller further explained the user could perform the above operation by right-clicking his mouse and choosing from among a limited set of system-commands. Thus, the user can access the files in the cache, and once he accesses them, the user can, according to the government’s expert, “print, rename, [or] save [the files] elsewhere, the same thing you can do with any other file.”
In essence, Romm’s argument is that the cached files do not become “visual depictions” until the user takes the additional step of converting them into ordinary files. The statute, however, speaks of data files that are capable of conversion into a viewable form, not data files that are immediately viewable without any further affirmative steps. See 18 U.S.C. § 2256(5). Here, Romm could convert the image files in his internet cache into a viewable form by right-clicking his mouse. *999 Also, when Romm had the images displayed on his screen that were contemporaneously stored to the cache, he could copy, print, or email them to another person, just as with ordinary files. Therefore, we hold there was sufficient evidence from which the jury could find that the images stored in Romm’s internet cache were “visual depictions.” 12
Second, Romm challenges the sufficiency of evidence of his control over the images in the internet cache. We begin with the text of 18 U.S.C. § 2252A. We interpret the term “knowing possession” according to its plain meaning, and presume Congress intended to apply traditional concepts of possession.
See United States v. Mohrbacher,
In
Mohrbacher,
Of our sister circuits, only the Tenth Circuit has addressed whether a defendant can be convicted of possessing child pornography accessed from the internet and contemporaneously stored to the internet cache.
See Tucker II,
However, Romm exercised control over the cached images while they were contemporaneously saved to his cache and displayed on his screen. At that moment, as the expert testimony here established, Romm could print the images, enlarge them, copy them, or email them to others. No doubt, images could be saved to the cache when a defendant accidentally views the images, as through the occurrence of a “pop-up,” 14 for instance. But that is not the case here.
By his own admission to ICE, Romm repeatedly sought out child pornography over the internet. When he found images he “liked,” he would “view them, save them to his computer, look at them for about five minutes [] and then delete them.” Either while viewing the images or shortly thereafter, Romm twice masturbated. He described his activities as the “saving” and “downloading” of the images. While the images were displayed on screen and simultaneously stored to his cache, Romm could print them, email them, or save them as copies elsewhere. Romm could destroy the copy of the images that his browser stored to his cache. And ac *1001 cording to detective Luekie, Romm did just that, either manually, or by instructing his browser to do so. Forensic evidence showed that Romm had enlarged several thumbnail images for better viewing. In short, given the indicia that Romm exercised control over the images in his cache, there was sufficient evidence for the jury to find that Romm committed the act of knowing possession.
Romm contends that the rule of lenity must caution us against construing the terms “possession” and “receipt” in 18 U.S.C. § 2252A to encompass cached internet files. The rule of lenity, which is rooted in considerations of notice, requires courts to limit the reach of criminal statutes to the clear import of their text and construe any ambiguity against the government.
See, e.g., Ladner v. United States,
In a recent dissent, one of our colleagues has drawn on the rule of lenity to opine that images saved to the cache are neither “received” nor “possessed” within the meaning of 18 U.S.C. § 2252.
See Gourde,
In short, we hold there was sufficient evidence for the jury to conclude that the images in the cache were “visual depictions” because they could be accessed and viewed by Romm. Further, given Romm’s ability to control the images while they were displayed on screen, and the forensic and other evidence that he actually exercised this control over them, there was sufficient evidence to support the jury’s finding that Romm possessed three or more images of child pornography. Coupled with Romm’s conceded knowledge that the images were saved to his disk, the prosecution produced sufficient evidence to establish every element of knowingly possessing child pornography under 18 U.S.C. § 2252A.
Receiving Child Pornography
Since Romm knowingly possessed the files in the internet cache, it follows that he also knowingly received them. Federal law makes it a crime to “knowingly receiv[e] or distribuye] ... any child pornography that has been mailed, or shipped or transported in interstate or foreign commerce.... ” 18 U.S.C. § 2252A(a)(2). Generally, federal statutes criminalizing the receipt of contraband require a “knowing acceptance or taking of possession” of the prohibited item.
See United States v. Lipps,
III. JURY INSTRUCTIONS
A. Refusal of Romm’s Proffered Instruction on “Visual Depiction”
Next, Romm claims the district court deprived him of the right to present his theory of the case by refusing his proffered jury instruction on the statutory definition of “visual depiction.” If the defense theory has a basis in fact and law, the failure to give a proffered jury instruction on that theory is per se reversible error.
See United States v. Escobar de Bright, 742
F.2d 1196, 1201 (9th Cir.1984). However, “it is not reversible error to reject a defendant’s proposed instruction on his theory of the case if other instructions, in their entirety, adequately cover that defense theory.”
United States v. Mason,
During the jury instructions conference, Romm proposed that the court instruct the jury on the legal definition of “visual depiction” and require the jury to find whether Romm knowingly received “visual depictions” onto the hard drive of his laptop computer. This instruction was necessary, Romm argued, to cover the “storage” element of the offense. The court refused Romm’s proffered instruction because “storage is not an element” of the offense and because Romm had, in any event, conceded that the cached files were “visual depictions” by stipulating that the cached files were “child pornography.” We need not address Romm’s stipulation, however, because we hold that the instructions given adequately covered Romm’s theory of the case. The jury was instructed that “a person has received something if they [sic ] have knowingly come into possession of it.” The instructions defined “possession” as “knowing] of [an object’s] presence and ha[ving] the power and intention to control it.” The court’s definition of “receiving,” as knowingly taking possession, thus required the jury to find whether Romm had possession and control over the images in the cache. Romm’s “visual depictions” defense was premised on the notion that files in the cache are too inaccessible to be the object of “possession” or “receipt” under § 2252A. In essence, he challenged whether he had access to and control over the images in the cache. The instructions on receiving, by incorporating *1003 a finding of control, encompassed Romm’s theory of the case.
B. Instructions on the Mens Rea of Knowing Possession
Next, Romm claims the jury instructions on the elements of knowing possession are plainly erroneous under our decision in
Lacy,
Since Romm failed to object on either ground, we review for plain error.
See, e.g., United States v. Redo,
In
Lacy,
Here, the jury instructions on knowing possession of child pornography omitted the same element of knowledge we addressed in Lacy. The entire instructions on knowing possession read as follows:
Defendant Stuart Romm is charged in Count 2 of the Indictment with Knowing Possession of Child Pornography, in violation of Title 18, United States Code, Section 2252A(a)(5)(B). In order for Defendant Romm to be found guilty of that charge, the Government must prove each of the following elements beyond a reasonable doubt:
First, That Defendant Stuart Romm knowingly possessed a laptop computer *1004 with a hard drive that contained three or more images of child pornography;
Second, That the images of child pornography knowingly possessed by Defendant Stuart Romm, had been mailed, shipped, or transported in interstate or foreign commerce by any means, including by computer.
A person has possession of something if the person knows of its presence and has physical control of it, or knows of its presence and has the power and intention to control it.
(Third emphasis added.) Just as in Lacy, the instructions failed explicitly to require the jury to find whether Romm knew images of child pornography were present on his disk.
Furthermore, the jury sent out a note after six hours of deliberations expressing confusion over the Lacy standard. The note read:
We need clarification on the [Possession] Charge. Are we trying to determine if Mr. Romm knew that he possessed three or more images could [sic] be found on his hard drive. Or is simply viewing pictures considered knowing of its [sic ] presence and being in control of it.
The court, with the affirmative agreement of both counsel, 17 referred the jury back to the original, flawed instructions and told the jury that no further guidance could be given.
The government contends that the instructions are distinguishable from the instructions given in Lacy because of the second instruction’s reference to “images ... knowingly possessed by Romm.” But this phrase is in fact a peremptory instruction that Romm knowingly possessed the unlawful images; not that the jury should determine whether he knowingly possessed them. The jury was told that they only needed to find whether the images that Romm “knowingly possessed” had a nexus to interstate commerce. Rather than requiring a finding that Romm knowingly possessed the images, the instructions dictated this finding.
Given that we squarely addressed the same issue in
Lacy,
we conclude that the instructions were in error and that the error was “plain.”
18
We assume, without deciding, that the omission of the knowledge element affected Romm’s substantial rights. We also assume, without deciding, that the district court’s failure to supple
*1005
ment the flawed instructions was plainly an abuse of discretion.
See United States v. Southwell,
When stopped and interviewed by ICE, Romm was in a hurry to continue his travels and asserted that the laptop contained his company’s proprietary software. He also acknowledged Canadian authorities knew about his prior conviction. It was against this background that Romm acknowledged having “lapses” from his “therapy,” and viewing images of child pornography. He also acknowledged to Agent Swenson that he had “saved” and viewed the images, for up to five minutes, but claimed to have deleted them. Importantly, he said he had “saved” or “downloaded” the images to his computer in Las Vegas.
After Agent Macho confronted Romm with Swenson’s relation that ten images of child pornography had been found 19 and questioned Romm as to why he had lied to Macho, Romm did not look surprised, or state he was surprised; rather, he let his shoulders slump and looked down at the ground rather than maintain eye contact with Agent Macho, in a demeanor that Agent Macho described as “confessional.” Then, Romm stated that “he knew [they] were gonna find something on the computer.”
In addition to his statements, the forensic analysis of Romm’s computer showed that he had erased his internet history at 2:25 p.m. on February 2, 2004, the same afternoon he was placed on a flight back to Seattle. Romm’s internet cache was completely empty, and the government’s expert opined through his experience and training that Romm had manually deleted the files or instructed his browser to empty it. Therefore, the forensic evidence strongly corroborated Romm’s direct admission that he knew the images were on his disk.
In sum, because of the overwhelming evidence of Romm’s knowledge, we decline to exercise our discretion to correct the plain error in the jury instructions on knowing possession.
IV. ENHANCED MANDATORY MINIMUM SENTENCES
At sentencing, the government claimed Romm’s prior convictions under Florida law for promoting sexual performance by a child and child exploitation by means of a computer were predicate offenses under 18 U.S.C. § 2252A(b). The district court found the Florida statutes were overly broad, but also that Romm’s convictions qualified as predicate offenses under the modified categorical approach. The parties agreed at argument that the categorical approach applies but that the record currently does not support the sentence enhancement. In accordance with their agreement, we vacate Romm’s sentences and remand for resentencing on an open record, allowing the government to supplement the record necessary to apply the modified categorical approach.
*1006 CONCLUSION
In sum, we hold first that the ICE’s forensic analysis of Romm’s laptop was permissible without probable cause or a warrant under the border search doctrine. Second, we hold there was sufficient evidence for the jury to find the images in Romm’s internet cache were visual depictions, and that he both received and possessed these images. Third, we hold the district court’s refusal of Romm’s proffered instruction defining “visual depiction” was not error because the instructions defining possession adequately covered Romm’s theory of the case. Fourth, while we find the instructions on “knowing possession” were plainly in error under our decision in Lacy, we decline to reverse Romm’s conviction due to the overwhelming evidence of the required knowledge. Fifth, we vacate Romm’s sentences and remand for resentencing in accordance with the stipulation reached by the parties.
Accordingly, Romm’s convictions are AFFIRMED. His sentences are VACATED, and the case is REMANDED.
Notes
. The "internet cache” or “internet tempor rary folder” is a "set of files kept by a web browser to avoid having to download the same material repeatedly. Most web browsers keep copies of all the web pages that you view, up to a certain limit, so that the same images can be redisplayed quickly when you go back to them.” DOUGLAS DOWNING, ET AL., DICTIONARY OF COMPUTER AND INTERNET TERMS, 149 (Barron's 8th Ed.2003). According to expert testimony at trial, the cache is a set of files on the user's hard drive.
. Specifically, two images of child pornography had been deleted from Romm's "recycle bin.” The "recycle bin” is an area of the hard drive where Windows stores files that the user deletes. While the user does not necessarily have to delete a file manually for it go into the recycle bin, removal of files from the recycle bin generally requires manual steps to be taken by the user. Since Romm was indicted of possessing three or more images of child pornography, however, the two images in his recycle bin are insufficient to support his conviction. Therefore, we will not consider them here.
. The term "downloading” generally refers to the act of manually storing a copy of an image on the hard drive for later retrieval. The internet cache, by contrast, is an area to which the internet browser automatically stores data to speed up future visits to the same websites.
See United States v. Parish,
*994
.In an unrelated Florida state court prosecution, Romm pleaded nolo contendere to two counts of promoting sexual performance by a child and one count of child exploitation by means of a computer.
. As one expert testified at trial, the internet history is a "documented history of your travels on the Internet. You could actually go back through your Internet history and see where you've been on the Internet.”
. Agents Macho and Swenson administered a Miranda warning, the validity of which Romm does not challenge on appeal.
. Google is a search engine used to find information on the Internet.
. A file is "a block of information stored on disk, tape, or similar media. A file may contain a program, document, or a collection of data (such as a mailing list).” DOWNING, supra at 188.
. The term "thumbnail,” which derives from an artist’s thumbnail sketch, refers to "a small image of a graphics file displayed in order to help you identify it.” DOWNING, supra at 495.
. Under our cases construing 8 U.S.C. § 1326, the act of “being found” in the United States requires the alien to be present in the United States while free from "official restraint.”
See,
e.g.,
United States v. Pacheco-Medina,
. The Supreme Court's recent decision in
Flores-Montano,
. This holding is supported by
United States v. Smith,
. In
United States v. Bass,
. As an expert testified at trial, a "pop-up” is an unsolicited advertisement that will appear in a window that "pops up” unwanted in the user's web browser.
. We express no opinion on the possible multiplicity of the charges brought against Romm. Romm made a pretrial motion for the prosecution to elect between multiplicitous counts, but does not appeal its denial. Therefore, we need not reach this issue here.
. In
X-Citement Video,
the Supreme Court held 18 U.S.C. § 2252 requires the government to prove the defendant's knowledge that the performer depicted is a minor because this is “the crucial element separating legal innocence from wrongful conduct.”
Id.,
. The government argues that Romm's affirmative agreement to this response waives any right to challenge the jury instructions under the doctrine of "invited error." While the Seventh Circuit has applied waiver in similar circumstances,
see United States v. Askew,
. We note that the Ninth Circuit Model Jury Instructions incorporate Lacy’s requirement that the defendant know the images are on his disk. See Model Criminal Jury Instruction 8.154 (2003) (instructing die jury to determine, "[fjirst, that the defendant knowingly possessed [books] [magazines] [periodicals] [films] [video tapes] [matters] which the defendant knew contained [a] visual depiction[s] of [a] minor[s] engaged in sexually explicit conduct.”) (emphasis added). While these instructions are for possession of child pornography under 18 U.S.C. § 2252 rather than 18 U.S.C. § 2252A, both versions of the statute are materially the same.
. This evidence came in without an objection to its being hearsay.