United States v. Vosburgh

602 F.3d 512 | 3rd Cir. | 2010

602 F.3d 512 (2010)

UNITED STATES of America
v.
Roderick S. VOSBURGH, Appellant.

No. 08-4702.

United States Court of Appeals, Third Circuit.

Argued January 12, 2010. Filed: April 20, 2010.

Denise S. Wolf, (Argued), Office of United States Attorney, Philadelphia, PA, for Appellee.

Anna M. Durbin, Peter Goldberger, (Argued), Ardmore, PA, for Appellant.

Before: SCIRICA, Chief Judge, BARRY, and SMITH, Circuit Judges.

OPINION

SMITH, Circuit Judge.

Roderick Vosburgh appeals his conviction for possession of child pornography in violation of 18 U.S.C. § 2252(a)(4)(B) and attempted possession of child pornography in violation of 18 U.S.C. § 2252(b)(2). We will affirm.

I. Factual Background

A. Ranchi

At the center of this case is an underground Internet message board known as Ranchi. Ranchi allows users to post links to images and videos of child pornography.^[1] Ranchi is not simply an open forum in which some posts happen to be related to child pornography; child pornography is Ranchi's raison d'etre. It describes itself as a place to "share all kinds of material especially for all the kiddy lovers around the world. This material can range from non-nude cuties to hard core baby material." Ranchi allows its users access to a wide range of pornographic pictures and videos, including hard core videos of infants and other children engaging in sexual acts with each other and with adults. Ranchi explicitly warns that the pornographic materials posted to the board are illegal.

Ranchi does not itself host child pornography; instead, it directs users to where it can be found elsewhere on the Internet. For obvious reasons, chiefly among them a desire to evade law enforcement, Ranchi operates in the far recesses of cyberspace. It is accessible through the use of any one of three "gateway" websites that exist at any given time. Each gateway consists of a web page that contains nothing but a hyperlink to the actual Ranchi message board. The gateway sites change approximately every three months, but regardless of their location, they always point to the most recent location of the Ranchi board, which itself moves around the Internet on a weekly basis. It is highly unlikely that an innocent user of the Internet would stumble across Ranchi through an unfortunate Google search. Because Ranchi moves so frequently and has cumbersome URLs, it is most often, if not always, accessed by way of the gateway sites. Interested persons often learn of Ranchi, and where to find the gateways, through postings on other child pornography websites.

A user seeking to access a link to child pornography posted on Ranchi cannot do so with a simple click of the mouse. It requires several steps. URLs as posted by Ranchi users typically begin with the prefix "hxxp," rather than the customary "http," to make it less likely that the links will be detected by search engines. Therefore, a user interested in that link must copy it from the board, paste it into the address bar of a web browser, and then change "hxxp" to "http" so that the address will be recognized by the browser. Only then can the file be accessed and downloaded. Even after downloading, files cannot be viewed immediately. They first must be decrypted, in part through use of a password.

In July 2006, FBI Special Agent Wade Luders learned of Ranchi's existence from a suspect apprehended in an investigation of a different child pornography board. That suspect authorized Luders to use his Ranchi handle, "Bongzilla," to go undercover on the board. On October 25, 2006, Luders posted six links to what purported to be child pornography. One of those links directed users to a video located at the following address: hxxp://uploader.sytes.net/12/05/4yo_suck.rar.html. Along with this link, Luders posted the following description:

[H]ere is one of my favs—4yo hc with dad (toddler, some oral, some anal)— supercute! Haven't seen her on the board before—if anyone has anymore, PLEASE POST.

In the parlance of Ranchi, "yo" stood for "year old" and "hc" stood for "hard core."^[2] Luders quickly realized that because he had mistakenly failed to encrypt the file, it was unlikely to attract attention. He then re-posted the "4yo_suck" link and posted instructions for decrypting the file. He also promised to post the necessary password, but never did.

The "4yo_suck" link (hereinafter the "Link") was, in short, a trap. It did not direct the user to actual child pornography. It was a dummy link which led only to Agent Luders's secure FBI computer. The "video" downloaded by way of the Link generated only gibberish on the recipient's computer screen. Meanwhile, Agent Luders's computer generated a log file containing the Internet Protocol addresses ("IP addresses")^[3] of every user who attempted to access the Link, and the date and time of each attempt. Among those who attempted to access the Link was a user at the IP address 69.136.100.151. That individual attempted to download the Link three times in a two-minute period between 11:46 and 11:48 p.m. EST on October 25, 2006. Luders traced this IP address to Comcast Cable Communications. In response to a subpoena, Comcast informed the government that "the individual utilizing the IP address 69.136.100.151 on October 25, 2006 at [the relevant times] did so using an account subscribed to by Rod Vosburgh, residing at 37 State Rd., Apt. B4" in Media, Pennsylvania. Luders forwarded this information to FBI Special Agent David Desy in Philadelphia.

B. Affidavit and Search Warrant

Agent Desy took steps to confirm that Vosburgh lived at the address identified by Comcast, and that he lived there alone. A January 17, 2007, search of Pennsylvania Bureau of Motor Vehicle records confirmed that Vosburgh resided at 37 State Road, Apartment B4 in Media, and a Choicepoint query conducted the same day revealed the same information. On January 31, 2007, through query of the U.S. Postal Service, Agent Desy learned that Vosburgh was the only person receiving mail at the apartment in question. In addition, Agent Desy twice conducted surveillance of the apartments at 37 State Road, and both times observed a vehicle in the parking lot matching the description of the one owned by Vosburgh.

On February 23, 2007, Agent Desy applied for a warrant to search Vosburgh's apartment. The affidavit in support of that application described how computers and the Internet have facilitated the spread of child pornography. It explained what IP addresses are, and how "[l]aw enforcement entities, in conjunction with Internet Service Providers, have the ability to identify a user's IP address to a specific household or residence." It also described certain characteristics and habits of persons interested in child pornography. It noted that "[c]hild pornography collectors almost always maintain and possess their material in the privacy and security of their homes, or some other secure location such as their vehicle(s), where it is readily available," and that collectors tend to hoard their materials:

Because the collection reveals the otherwise private sexual desires and intent of the collector and represents his most cherished sexual fantasies, the collector rarely, if ever, disposes of the collection. The collection may be culled and refined over time, but the size of the collection tends to increase.

The affidavit also noted that even if a collector deletes illegal materials from his computer's hard drive, law enforcement can often retrieve those files using forensic tools. Next, the affidavit described the nature of Ranchi, with graphic descriptions of some of the illegal pornographic materials that agents had found posted to the site. It then summarized Agent Luders's posting of the Link, how his computer logged the IP addresses of users who attempted to access the Link, and why it was unlikely that anyone who attempted to download the video promised by the Link would have done so by accident.^[4] Finally, the affidavit laid out the facts specific to Vosburgh. It noted that an individual using the IP address 69.136.100.151 attempted to access the Link three times on the night of October 25, 2006. It recounted how Agent Desy traced that IP address back to Vosburgh's apartment, and the subsequent steps Agent Desy took to confirm that Vosburgh actually lived there. It also described in detail the property to be searched and the items to be searched and seized. Those items included "[a]ny and all items which may be used to visually depict child pornography, store information pertaining to the sexual interest in child pornography, or to distribute, possess, or receive child pornography, ... including ... computer hardware[.]"

Magistrate Judge Felipe Restrepo issued a search warrant on February 23, 2007, approximately four months after Vosburgh's apparent attempts to access the Link. That warrant was executed on February 27, 2007. Before they arrived at his apartment, officers learned that Vosburgh lawfully owned more than a dozen guns. Concerned for their safety, officers attempted to lure Vosburgh out of his apartment with a ruse. They knocked on his door, identified themselves as police, and told him that they wanted to talk to him because his car had been vandalized. Vosburgh did not answer the door, but from the apartment came a sound of "metal on metal" that sounded like the racking of a gun. Alarmed, officers remained outside of the apartment and attempted to persuade Vosburgh to open the door. They knocked at least three times, with the knocks getting louder each time. They also called Vosburgh's telephone several times and left messages asking him to come out of the apartment. Approximately 27 minutes after officers first knocked, Vosburgh opened the door. He told officers that he did not answer sooner because he had been in the bathroom.

Inside Vosburgh's apartment, police found pieces of smashed thumb drives, one of which was floating in the toilet. They also found a hammer and a pair of scissors outside of the bathroom door.^[5] They found a screwdriver next to a computer tower in the kitchen. The computer's panel had been forcibly removed and its internal hard drive was missing. Part of an internal drive was found in a trash bag in the kitchen, and the remains of that same hard drive were found on a bookshelf in the living room. The destroyed internal hard drive was compatible with the tower in the kitchen.

In an interview with Agent Desy, Vosburgh acknowledged that he lived alone in the apartment and that he owned a computer. He denied intentionally breaking or destroying the computer's internal hard drive; he claimed that he had discarded it two or three weeks earlier because it was corrupted. He told officers that he owned an external hard drive that contained adult pornography, and a thumb drive that contained work documents and more adult pornography. Officers collected the internal hard drive and the pieces of the thumb drive, but the FBI's computer forensics experts were unable to recover anything from either. They also took the external hard drive, which was intact and later examined by FBI forensics expert Justin Price.^[6]

C. Contents of the External Hard Drive

The external hard drive contained a folder with hundreds of pictures of what the government calls "child erotica."^[7] Many of these were pictures of a young Asian girl known as Loli-chan who has gained some notoriety by posting suggestive photos of herself on the Internet.^[8] It also contained a folder called "jap 111." This folder contained twenty pictures of adult women in .jpeg format^[9] and a file called thumbs.db which itself contained 68 `thumbnail' images. Two of those images were of child pornography. One depicted a naked prepubescent girl in the computer room of a house, with one leg propped up unnaturally to expose her genitalia. This image became Government Exhibit 14 at trial, and we will refer to it as such. The second depicted four naked young girls, sitting on a couch with their legs spread to expose their genitalia. This became Government Exhibit 15.

Notably, these two images did not exist as full-sized, independent picture files (such as .jpeg files) in the jap111 folder when the government seized the hard drive. Nor were full-sized .jpegs of those images recovered anywhere else on the external hard drive. Rather, they existed only as miniatures within the thumbs.db file in the jap111 folder. Because the nature of thumbs.db is critical to resolution of the issues raised in this appeal, it is necessary to recount the record evidence concerning this file.

On ordinary computers running Windows operating systems, picture files are often stored in folders. When a folder is opened, the user has several options for displaying the pictures contained therein. One option is the "thumbnail" view. When the user selects the thumbnail view, a miniature version of each picture in the folder is displayed. Each of those miniatures is called a "thumbnail." The user can click on the thumbnail to open it and view a full-sized version of the picture. When the user selects the thumbnail viewing option, the Windows operating system automatically creates a hidden system file called "thumbs.db" within that folder. The user need not instruct Windows to do so; it happens automatically as part of the process of viewing the contents of the folder in thumbnail view. Thumbs.db is not a collection of many image files; it is a single file, which can be thought of as a visual catalog of all the image files contained in the folder. It contains a miniature, degraded version of every image in the folder that has been converted into a thumbnail pursuant to the use of the thumbnail view.

The thumbs.db file is stored within the folder whose content it reflects, along with the picture files themselves. But the ordinary user cannot view the contents of thumbs.db. Indeed, the ordinary user does not even know that thumbs.db is there. At trial, the government's expert Justin Price confirmed that opening the thumbs.db file to view its contents requires special software, and that there was no evidence that Vosburgh possessed such software or was otherwise capable of viewing the contents of the thumbs.db file in the jap111 folder.

The significance of the presence of Exhibits 14 and 15 in the thumbs.db file on Vosburgh's external hard drive was one of the central factual issues at trial. The government contended that the existence of Exhibits 14 and 15 in the thumbs.db file was evidence that corresponding full-sized picture files once existed on Vosburgh's hard drive in the jap111 folder. According to the government, Vosburgh knowingly possessed such pictures but then deleted them at some point before the search of his apartment on February 27; this explained why the hard drive contained thumbs.db versions of Exhibits 14 and 15, but not full-sized .jpeg versions of those same images. We will refer to this theory throughout our opinion as the government's "prior possession" theory.

Vosburgh vigorously contested the prior possession theory. He contended at trial, and now contends on appeal, that he conclusively disproved the theory with an in-court demonstration by his expert, Dr. Rebecca Mercuri. He also offered several alternative explanations for the presence of Exhibits 14 and 15 in the jap111 thumbs.db file.

II. Procedural History

A. The Indictment

On June 5, 2007, a grand jury in the Eastern District of Pennsylvania returned a four-count superseding indictment against Vosburgh. Count I charged that Vosburgh "knowingly possessed one external hard drive that contained visual depictions" of child pornography, in violation of 18 U.S.C. § 2252(a)(4)(B), "on or about February 27, 2007." This charge related to his possession of the hard drive containing the images that became Exhibits 14 and 15. Count II charged Vosburgh with attempted possession of child pornography in violation of 18 U.S.C. § 2252(b)(2), in connection with Vosburgh's attempts to access the Link. Count III charged that Vosburgh knowingly altered or destroyed tangible objects with the intent to obstruct the investigation of a matter within the jurisdiction of the FBI, in violation of 18 U.S.C. § 1519. Count IV charged Vosburgh with violating 18 U.S.C. § 2232 by knowingly destroying property in order to prevent its lawful seizure by the government.

B. Pre-Trial Proceedings

Considerable motion practice preceded Vosburgh's trial. Three sets of motions are most relevant to this appeal. First, Vosburgh and the government filed motions in limine. The government sought to admit much of the child erotica found on the external hard drive; Vosburgh sought to exclude it. The government argued that those materials, while not illegal, were relevant because they suggested that Vosburgh had a sexual interest in children and tended to disprove that Vosburgh did not know that he possessed the pornographic pictures in Exhibits 14 and 15. It further argued that the images were admissible under Rule 404(b) because possession of those materials helped to show Vosburgh's intent to possess child pornography. Vosburgh argued that the District Court should exclude the child erotica as unduly prejudicial under Rule 403. Ultimately, the District Court admitted some but not all of this evidence. It allowed forty-six non-pornographic images of prepubescent girls in swimsuits and thirty of the Lolichan pictures.

Second, on June 19, 2007, Vosburgh filed a request for a bill of particulars. He demanded that the government specify, inter alia, the time and date that he allegedly "downloaded the two visual depictions" which formed the basis for Count I. The government opposed Vosburgh's request on the ground that Vosburgh already knew everything he was entitled to know:

[T]he defendant has been provided with substantial discovery, including reports of interviews of witnesses, four search warrant affidavits, grand jury testimony, police reports, documents, and reports of forensic examinations of the computer equipment. Moreover, defendant has had access to and reviewed the evidence (including images and documents on the external hard drive) that was seized from his residence. Additionally, because the case originated by complaint and warrant, defendant was informed, in detailed fashion, of the basis of the underlying charges as set forth in the affidavit. The defendant even took the opportunity to cross-examine the case agent at his probable cause hearing. And, finally, after the Superseding Indictment, government counsel identified for defense counsel the two images found on defendant's external hard drive that comprise the charges for the possession of child pornography.

Nevertheless, the government gave a few specific responses to the inquiries raised in Vosburgh's request. In light of those responses, the District Court denied Vosburgh's request for a bill of particulars as moot.

Third, Vosburgh moved to suppress the external hard drive and other evidence seized in his apartment, claiming that the warrant was not supported by probable cause. After a hearing, the District Court denied Vosburgh's motion to suppress the fruits of the search, concluding that the magistrate "had a substantial basis for finding probable cause that there would be child pornography related evidence in the apartment described in the warrant."^[10]

C. Trial

Trial began on October 31, 2007 and lasted for four days. The relevant testimony is summarized below.

1. Agents Luders and Desy

Agents Luders and Desy testified about the events that led to Vosburgh's arrest. Agent Luders testified to his three-and-a-half years of experience investigating child pornography crimes with the FBI. He described his investigations of Ranchi and similar websites, and the nature of the child pornography accessible through Ranchi. He described how he posted the Link, how his computer logged Vosburgh's IP address, and how he traced that IP address to Vosburgh. He also testified about the measures Ranchi has taken to conceal itself from all but the most dogged pursuers of child pornography, and why it was unlikely that anyone would have stumbled across the board accidentally. Finally, he testified to the steps users had to go through in order to access materials posted to the board, and why it was unlikely that anyone who had undertaken each of those steps would have done so inadvertently.

Agent Desy testified about the steps he took once he received the lead about Vosburgh from Agent Luders. He described how he confirmed where Vosburgh lived and the process by which he obtained the search warrant for Vosburgh's apartment.

2. Comcast

A witness from Comcast testified about IP addresses and the process by which Comcast responds to requests from law enforcement to match IP addresses to individual Comcast subscribers. He explained that Comcast's automated system assigns a unique IP number to each customer on a dynamic basis, and that the "lease period" for each IP address is approximately 6-8 days. At the expiration of that lease period, the assignment of an address to a particular computer may or may not be renewed. He further explained that Comcast can trace an IP address back to a particular customer's account, through IP assignment logs that go back 180 days. Finally, he testified that between October 20 and October 30 of 2006, IP address 69.136.100.151 was assigned to an account registered to Vosburgh at 37 State Road, Apartment B4 in Media.

3. Justin Price

Price, an information technology specialist for the FBI, was the government's expert witness. He conducted the forensic examination of Vosburgh's external hard drive. He testified in support of the prior possession theory. According to Price, the fact that the thumbs.db images of Exhibits 14 and 15 existed in the jap111 folder was proof that corresponding, full-sized originals must have also existed within that folder and on Vosburgh's hard drive. He testified that the thumbs.db file containing Exhibits 14 and 15 was created on February 21, 2007, and that those specific images were added to (or modified within) thumbs.db on February 22—meaning that "on February 22, basically the user went into the [jap111] folder ... clicked on view and showed these pictures in thumbnail view." While Price testified that the presence of an image in the thumbs.db was definitive proof that the original, full-sized version of that image existed in the folder at one time, he also admitted on cross-examination that the presence of a picture within a folder did not necessarily mean that the image was actually viewed by the user. It meant only that the picture was present in a folder that was viewed in the thumbnail view.

4. Thomas Clinton

Retired U.S. Postal Inspector Thomas Clinton testified about the naked female in Exhibit 14. He explained that for the last 18 years of his career, he led a task force of agents investigating the transmission, production, and distribution of child pornography throughout the country. He testified that he recognized the female in Exhibit 14 because he had been in her home in New Kensington, Pennsylvania in 2003, during the execution of a search warrant. According to Clinton, she was a young girl who was living with her adoptive father at that time. Clinton testified that after the search of the house, the father was arrested and the girl was taken into protective custody. Over Vosburgh's hearsay objection, Clinton also testified that he knew the girl's date of birth to be August 25, 1992. On cross-examination, Clinton confirmed that he was not present when the photograph that became Exhibit 14 was taken, but reiterated that he recognized the girl in the picture and that she was less than 11 years old when he met her in New Kensington.

5. Dr. Rebecca Mercuri

Mercuri was Vosburgh's forensic computer expert, and her testimony formed the bulk of Vosburgh's defense. Mercuri had conducted her own forensic examination of the external hard drive. In her pre-trial expert report, she concluded that "there is absolutely no evidence that the [images in Exhibits 14 and 15] ... ever existed as individual .jpeg files at any time on [Vosburgh's] hard drive." At trial, she likewise fiercely disputed the prior possession theory. According to Mercuri, the fact that a thumbs.db file containing Exhibits 14 and 15 appeared in the jap 111 folder was not proof that full-sized .jpegs of Exhibits 14 and 15 once existed on the hard drive. To underscore that point, Mercuri conducted a live, in-court demonstration using two computers. Mercuri created a folder with four .jpegs depicting natural scenery: Pond, Blue Hill, Sunset, and Winter. She opened the folder and selected the thumbnail view, thus creating within that folder a thumbs.db file containing all four images. She then deleted Blue Hills and Winter from the folder, leaving only the Pond and Sunset .jpegs. Next, she copied the entire folder onto a second computer. When she opened that folder on the second computer, it contained only the Pond and Sunset .jpegs, but it also contained the thumbs.db file created on the first computer. Using special software to view the contents of thumbs.db on the second computer, she showed that this thumbs.db file contained four thumbnails, one corresponding to each of the .jpegs that originally existed in the folder. The point of her demonstration, Mercuri said, was to show that "you can have a thumbs.db file that contains thumbnails in it that you never had the original pictures of."

Consistent with her demonstration, Mercuri offered her own theory about how the thumbs.db file containing the pornographic images could have gotten onto Vosburgh's hard drive without the corresponding.jpegs for those pictures doing the same. According to Mercuri, Vosburgh could have gotten the thumbs.db images but not the corresponding originals if he had downloaded the jap111 folder after the thumbs.db file was created in that folder but also after the full-sized versions of Exhibits 14 and 15 had been deleted.

With respect to Count II, Mercuri offered several theories as to how Vosburgh's IP address could appear to have attempted to access the Link without Vosburgh himself knowingly doing so. Mercuri speculated that an unknown user could have "spoofed" Vosburgh's IP address, or that Vosburgh's computer could have been infected with malicious software that turned it into a "zombie."^[11] She admitted, however, that she had no evidence that such mischief had actually occurred.

6. Closing Argument

The government pressed the prior possession theory throughout its closing argument. For example, the prosecutor told the jury:

[Vosburgh] viewed [the pictures] on February 22nd. That is what the forensics showed. He viewed them on February 22nd. He went to his view options.... he chose view. In order to choose view, it has to be there and he viewed them. And when he viewed them, it automatically created a thumbnail. And he did this on February 22, 2007. And in order to do this, you have to have the original photos. You have to have the original photos in jap111 before they could be viewed in thumbnail.

In response, Vosburgh emphasized Mercuri's testimony that the existence of Exhibits 14 and 15 in the thumbs.db file did not prove that Vosburgh ever knowingly possessed the full-sized originals on his hard drive. He also reiterated his spoofing and zombie theories for why someone using his IP address appeared to have accessed the Link.

The jury found Vosburgh guilty on Counts I and II, and acquitted him on Count III.^[12] Vosburgh was sentenced to 15 months of imprisonment and three years of supervised release.

D. Post-Trial

Vosburgh filed a post-trial motion for judgment of acquittal, or in the alternative, for a new trial. He claimed that there was insufficient evidence to convict him on Counts I and II. He also claimed, for the first time, that a new trial should be held because there was a constructive amendment of his indictment and/or a variance between the indictment and the evidence at trial. The District Court denied Vosburgh's motion without opinion.

Vosburgh then filed a timely notice of appeal. We have jurisdiction under 28 U.S.C. § 1291 and 18 U.S.C. § 3742(a). Vosburgh raises four challenges to his conviction. First, he contends that the District Court erred by failing to suppress evidence found in his apartment, because there was no probable cause to search his apartment for evidence of child pornography crimes. Second, he argues that the government constructively amended Count I of the indictment by changing its theory of prosecution during closing argument. In the alternative, he argues that there was a prejudicial variance requiring a new trial. Third, he argues that there was insufficient evidence to convict him on Count I. Fourth, he argues that the District Court erred at trial by admitting evidence that he contends was unduly prejudicial and inadmissible hearsay.

III. Probable Cause

The Fourth Amendment to the United States Constitution protects the "right of the people to be secure" in their homes and effects. U.S. Const. amend. IV. To that end, it generally requires that search warrants be supported by probable cause. Id. Evidence seized pursuant to a search warrant that is not so supported may be suppressed. See, e.g., United States v. Zimmerman, 277 F.3d 426, 438 (3d Cir.2002). Vosburgh argues that the District Court should have granted his motion to suppress because officers lacked probable cause to search his apartment.

A. Standard of Review

The applicable standards for issuing and reviewing a search warrant were set forth in Illinois v. Gates, 462 U.S. 213, 103 S. Ct. 2317, 76 L. Ed. 2d 527 (1983):

The task of the issuing magistrate is simply to make a practical, commonsense decision whether, given all the circumstances set forth in the affidavit before him, ... there is a fair probability that contraband or evidence of a crime will be found in a particular place. And the duty of a reviewing court is simply to ensure that the magistrate had a "substantial basis for ... conclud[ing]" that probable cause existed.

Id. at 238-39, 103 S. Ct. 2317 (some alterations in original).

We exercise plenary review of the District Court's denial of a motion to suppress. Zimmerman, 277 F.3d at 432. "Thus, we apply the same standard the District Court was required to apply," i.e., "whether the magistrate who issued the warrant had a `substantial basis' for determining that probable cause existed." Id. We owe "great deference" to the magistrate's probable cause determination, Gates, 462 U.S. at 236, 103 S. Ct. 2317, but we will not simply "rubber stamp" it. Zimmerman, 277 F.3d at 432.

B. Analysis

Agent Desy's affidavit explained that on October 25, 2006, someone using a computer with an IP address of 69.136.100.151 attempted to download a video that purported to be hardcore child pornography. It further explained that on the day in question, the relevant IP address was assigned to a Comcast account registered to Vosburgh's apartment. It also asserted that child pornography collectors tend to hoard their materials and "rarely, if ever" dispose of them. We must decide whether these averments provided a "substantial basis" for the magistrate's conclusion that there was a "fair probability that contraband or evidence of a crime [would] be found" in Vosburgh's apartment at the time of the search. Gates, 462 U.S. at 238, 103 S. Ct. 2317. We answer that question in the affirmative.

This Court has not squarely addressed the issue, but several Courts of Appeals have held that evidence that the user of a computer employing a particular IP address possessed or transmitted child pornography can support a search warrant for the physical premises linked to that IP address. See, e.g., United States v. Perez, 484 F.3d 735 (5th Cir.2007).^[13] In Perez, a woman contacted law enforcement after she received an unsolicited email containing child pornography from a Yahoo! email address. Yahoo! identified the user who sent the offensive email, and from its records identified that user's IP address. The FBI determined that the IP address belonged to a Time Warner customer, and subpoenaed the identity and address of that customer from Time Warner. A search of that address uncovered child pornography. Id. at 738. On appeal, the defendant argued that the images should have been suppressed because the "mere association between an IP address and a physical address is insufficient to establish probable cause." Id. at 739. The Fifth Circuit disagreed, concluding that the IP address provided "a substantial basis to conclude that evidence of criminal activity" would be found at the defendant's home, even if it did not conclusively link the pornography to the residence. Id. at 740. The court noted that although it was technically possible that the offending emails "originated outside of the residence to which the IP address was assigned, it remained likely that the source of the transmissions was inside that residence." Id. (emphasis added).

We agree with the reasoning in Perez. As many courts have recognized, IP addresses are fairly "unique" identifiers.^[14]See, e.g., United States v. Forrester, 512 F.3d 500, 510 n. 5 (9th Cir.2008) (stating that "every computer or server connected to the Internet has a unique IP address"); Perrine, 518 F.3d at 1199 n. 2 (noting that an IP address "is unique to a specific computer"); Peterson v. Nat'l Telecomm. & Inform. Admin., 478 F.3d 626, 629 (4th Cir.2007) (explaining that "[e]ach computer connected to the Internet is assigned a unique numerical [IP] address"); White Buffalo Ventures, LLC v. Univ. of Texas at Austin, 420 F.3d 366, 370 n. 6 (5th Cir.2005) (describing an IP address as "a unique 32-bit numeric address" that essentially "identifies a single computer"). The unique nature of the IP address assigned to Vosburgh on October 25 made his attempts to access the Link fairly traceable to his Comcast account and the physical address to which that account was registered.

Attempted possession of child pornography is a federal crime. See 18 U.S.C. § 2252(b)(2). Therefore, the attempts to access the Link by someone using Vosburgh's IP address were undoubtedly criminal activity. Considering the "totality of the circumstances" outlined in Agent Desy's affidavit, Gates, 462 U.S. at 238, 103 S. Ct. 2317, we think it was fairly probable that "instrumentalities or evidence" of that criminal activity—such as computers and computer equipment—would be found in Vosburgh's apartment.^[15]See United States v. Urban, 404 F.3d 754, 774 (3d Cir.2005) (quoting United States v. Tehfe, 722 F.2d 1114, 1117-18 (3d Cir.1983)); see also Agnellino v. New Jersey, 493 F.2d 714, 727 (3d Cir.1974) (stating that the standard for probable cause "clearly is something less than `certainty' or `evidence of guilt beyond a reasonable doubt'"); Perez, 484 F.3d at 740 (recognizing that "[p]robable cause does not require proof beyond a reasonable doubt").

Vosburgh argues that even if the IP address established some connection to the physical location of his apartment, the four-month gap between the warrant application and the attempts to access the Link described in Agent Desy's affidavit rendered the information in the affidavit stale. The "[a]ge of the information supporting a warrant application is a factor in determining probable cause." United States v. Harvey, 2 F.3d 1318, 1322 (3d Cir.1993). "If too old, the information is stale, and probable cause may no longer exist." Zimmerman, 277 F.3d at 434. "Age alone," however, is not determinative. Id. To analyze a claim of staleness, we must do more than simply count the number of the days between the date of the alleged criminal activity and the date of the warrant. We must also consider "the nature of the crime and the type of evidence" involved. Id.

This is not the first time we have had occasion to consider staleness vel non in the context of child pornography. See, e.g., United States v. Shields, 458 F.3d 269, 279 n. 7 (3d Cir.2006); Harvey, 2 F.3d at 1322-23 (rejecting defendant's staleness claim). In Shields, FBI agents infiltrated two online groups explicitly dedicated to the exchange of child pornography. Eventually, both groups were shut down and the agents obtained records of group members' email addresses. Shields, 458 F.3d at 272. They traced one of those addresses back to Shields. Nine months after the groups were shut down, agents obtained a search warrant for Shields's home, where they found hundreds of images of child pornography. Id. at 273. On appeal, we rejected Shields's probable cause challenge. Shields did not argue staleness, but we raised the issue sua sponte and concluded that the information in the affidavit was not stale, despite the nine-month gap between the warrant application and any possible participation by Shields in the child pornography groups. Id. at 279 n. 7.

We reiterate that staleness is not a matter of mechanically counting days. Zimmerman, 277 F.3d at 434. Nevertheless, our conclusion in Shields that a nine-month gap did not render the information stale counsels in favor of the same result here, given the similar "nature of the crime[s]" involved, id., and the fact that the gap here was only four months. We therefore hold that the information in Agent Desy's affidavit was not stale. As the affidavit explained, and as we have long recognized, persons with an interest in child pornography tend to hoard their materials and retain them for a long time. See, e.g., Shields, 458 F.3d at 279 n. 7 (noting that "collectors of child pornography often store their material and rarely discard it"); Harvey, 2 F.3d at 1322-23 (rejecting staleness claim in part due to recognition that "pedophiles rarely, if ever, dispose of sexually explicit material"). Child pornography is illegal, and therefore difficult and risky to obtain. Presumably, once a child pornography collector gets his hands on such material he will not be quick to discard it. Zimmerman, 277 F.3d at 434. Vosburgh argues that this "hoarding" principle had no place in Agent Desy's affidavit (and should not inform this Court's staleness analysis) because the affidavit established no basis for concluding that Vosburgh was a child pornography collector. We disagree. The affidavit described repeated, deliberate attempts to access the Link—which, as the affidavit explained, was advertised as hard core child pornography and posted to an underground website explicitly and exclusively dedicated to such pornography—originating from an apartment in which Vosburgh lived by himself. Under these facts, we cannot say that it was unreasonable for officers to infer that the person responsible for those attempts already possessed some quantity of child pornography. See United States v. Wagers, 452 F.3d 534, 540 (6th Cir.2006) (noting that "evidence that a person has visited or subscribed to websites containing child pornography supports the conclusion that he has likely downloaded, kept, and otherwise possessed the material." (citing United States v. Martin, 426 F.3d 68, 77 (2d Cir.2005), and United States v. Froman, 355 F.3d 882, 890-91 (5th Cir.2004))).^[16]

We do not hold, of course, that information concerning child pornography crimes can never grow stale. We observe only that information concerning such crimes has a relatively long shelf life. It has not been, and should not be, quickly deemed stale. See, e.g., Shields, 458 F.3d at 279 n. 7. See also United States v. Paull, 551 F.3d 516, 522 (6th Cir.2009) (noting that "the same time limitations that have been applied to more fleeting crimes do not control the staleness inquiry for child pornography"). This is especially true where, as here, the crime in question is accomplished through the use of a computer. As the Ninth Circuit observed in one child pornography case, computers have "long memor[ies]." United States v. Gourde, 440 F.3d 1065, 1071 (9th Cir.2006) (en banc); see also United States v. Frechette, 583 F.3d 374, 379 (6th Cir.2009) ("Digital images of child pornography can be easily duplicated and ... even if they are sold or traded .... have an infinite life span."). Images stored on computers can be retained almost indefinitely, and forensic examiners can often uncover evidence of possession or attempted possession long after the crime has been completed. See, e.g., Gourde, 440 F.3d at 1071 (crediting statement in affidavit that FBI computer experts can resurrect files from a hard drive even after they have been deleted). The staleness inquiry requires us to consider the "type of evidence" at issue, Zimmerman, 277 F.3d at 434, and we think it obvious that the type of evidence agents sought from Vosburgh's apartment—computers and/or computer equipment—is not the type of evidence that rapidly dissipates or degrades. Nor is it the type of property that is usually quickly or continuously discarded. Cf. United States v. Ritter, 416 F.3d 256, 270-71 (3d Cir.2005) (Smith, J., concurring in the judgment) (discussing the relevance to staleness of the nature of the evidence and how quickly it might reasonably be expected to be discarded). Therefore, the passage of weeks or months here is less important than it might be in a case involving more fungible or ephemeral evidence, such as small quantities of drugs or stolen music. See id.

The magistrate's task was to make a practical, commonsense decision as to whether there was a fair probability that evidence of criminal activity—including possession or even attempted possession of child pornography—would be found in Vosburgh's apartment four months after he attempted to access the Link. On the facts before us, and in light of our precedents, we agree that the magistrate had a substantial basis for concluding that there was. Our decision fits comfortably within the body of case law concerning staleness in the context of child pornography. See, e.g., United States v. Morales-Aldahondo, 524 F.3d 115, 119 (1st Cir.2008) (rejecting defendant's argument that three-year gap between date of download and warrant application rendered information stale, in light of testimony from the "government's knowledgeable witness" that child pornography collectors "do not quickly dispose of their cache"); United States v. Irving, 452 F.3d 110, 125 (2d Cir.2006) (holding that twenty-two month old information in affidavit in support of warrant to search for child pornography was not stale); United States v. Lemon, 590 F.3d 612, 615-16 (8th Cir.2010) (upholding probable cause determination despite eighteen-month gap between the warrant application and the incident described in the affidavit that suggested possession of child pornography); United States v. Lacy, 119 F.3d 742, 745 (9th Cir.1997) (rejecting staleness claim in child pornography case involving ten-month gap); United States v. Terry, 522 F.3d 645, 650 n. 2 (6th Cir.2008) (upholding probable cause in child pornography case involving a five-month gap).

Vosburgh claims that Zimmerman, in which we held that a search warrant for pornography lacked probable cause, supports his argument that the information in Agent Desy's affidavit was stale. In Zimmerman, police obtained a warrant to search the defendant's home for adult and child pornography, and found several images of the latter.^[17] 277 F.3d at 429. The warrant application contained no information suggesting that Zimmerman possessed child pornography in his home, and only one piece of information suggesting that adult pornography would be found at the home: a report that six to ten months earlier, a video clip of adult pornography was shown to minors there. Id. We concluded that there was no probable cause to search for child pornography, because there was no information suggesting that there was ever child pornography in the home. Indeed, the government conceded as much. Id. at 432. We further held that there was no probable cause to search for adult pornography either, because the only piece of information suggesting that pornography could be found at the home—the report about the video clip that was shown to minors—was stale. Id. at 433-34.

We cannot agree that Zimmerman controls this case. Initially, we note that the four-month gap at issue here is shorter than the six-month gap at issue in Zimmerman. Recognizing that staleness is about more than simply counting days, however, we note another important distinguishing fact. In Zimmerman, we acknowledged that child pornography collectors hoard and protect their materials closely, but we also noted that there was no information whatsoever in the affidavit to suggest that Zimmerman was a child pornography collector. The affidavit only asserted that Zimmerman had viewed adult pornography in his home. Therefore, the hoarding presumption applicable to child pornography collectors was inapposite, and nowhere did the affidavit address "whether adult pornography is typically retained" in the same manner as child pornography. Id. at 435 (emphasis added). Largely for that reason, we held that the six-month delay rendered the affidavit's information stale. The case before us is different. As we have explained, there was ample information to suggest that Vosburgh could be a collector of child pornography. Therefore, unlike in Zimmerman, the probable cause analysis here must account for the accepted fact that child pornography collectors tend to hoard their materials for long periods of time.^[18] See Shields, 458 F.3d at 279 n. 7; Harvey, 2 F.3d at 1322-23.

In summary, we hold that the search warrant was supported by probable cause. The IP address connected to a criminal attempt to access child pornography was fairly traceable to Vosburgh's apartment, and the information in the warrant application describing that attempt was not stale. Accordingly, the District Court did not err by denying Vosburgh's motion to suppress.

IV. Constructive Amendment and Variance

Vosburgh's next claim is that the government impermissibly changed its theory of prosecution during closing argument. The result, he maintains, was either a constructive amendment of the superseding indictment or a prejudicial variance requiring a new trial.

A. Standard of Review

We exercise plenary review over properly preserved claims of constructive amendment or variance. United States v. Daraio, 445 F.3d 253, 259 (3d Cir.2006). Vosburgh, however, raised these claims for the first time in his post-trial motion. Therefore, we will review for plain error only.^[19]See United States v. Tiller, 302 F.3d 98, 105 (3d Cir.2002) (applying plain error review where the defendant failed to object at trial to the substance of the government's closing argument). See also United States v. Brandao, 539 F.3d 44, 57 (1st Cir.2008) (applying plain error review when constructive amendment was first raised in the district court in an unsuccessful post-trial motion, and describing that claim as an "unpreserved objection"); United States v. Hughes, 213 F.3d 323, 328 n. 7 (7th Cir.2000) (noting that even though defendant had raised a claim of constructive amendment in a post-trial motion for a new trial, because he did not raise the objection at trial the court would review only for plain error), vacated on other grounds, 531 U.S. 975, 121 S. Ct. 423, 148 L. Ed. 2d 432 (2000).

B. Analysis

The Fifth Amendment provides that "[n]o person shall be held to answer for a capital, or otherwise infamous crime, unless on a presentment or indictment of a Grand Jury[.]" U.S. Const. amend. V. Because of this constitutional guarantee, "a court cannot permit a defendant to be tried on charges that are not made in the indictment against him." Stirone v. United States, 361 U.S. 212, 217, 80 S. Ct. 270, 4 L. Ed. 2d 252 (1960). From this rule comes the general prohibition against constructive amendments. See United States v. Navarro, 145 F.3d 580, 585 (3d Cir.1998) (stating that a constructive amendment deprives a defendant of his Fifth Amendment right "to be tried only on charges presented in an indictment returned by a grand jury" (quoting United States v. Miller, 471 U.S. 130, 140, 105 S. Ct. 1811, 85 L. Ed. 2d 99 (1985))).

"An indictment is constructively amended when, in the absence of a formal amendment, the evidence and jury instructions at trial modify essential terms of the charged offense in such a way that there is a substantial likelihood that the jury may have convicted the defendant for an offense differing from the offense the indictment returned by the grand jury actually charged." Daraio, 445 F.3d at 259-60. An indictment can be constructively amended through "evidence, arguments, or the district court's jury instructions," if they "effectively amend the indictment by broadening the possible bases for conviction from that which appeared in the indictment." United States v. McKee, 506 F.3d 225, 229 (3d Cir.2007) (quoting United States v. Lee, 359 F.3d 194, 208 (3d Cir.2004)). When considering a claim of constructive amendment, the "key inquiry is whether the defendant was convicted of the same conduct for which he was indicted." Daraio, 445 F.3d at 260 (quoting United States v. Robles-Vertiz, 155 F.3d 725, 729 (5th Cir.1998)). If a defendant is convicted of the same offense that was charged in the indictment, there is no constructive amendment. United States v. Patterson, 348 F.3d 218, 227 (7th Cir. 2003).

Variances and constructive amendments are similar in that both involve "variations between the charges in an indictment and the evidence at trial." Daraio, 445 F.3d at 259. A variance occurs "where the charging terms of the indictment are not changed but when the evidence at the trial proves facts materially different from those alleged in the indictment." Id. Not all variances constitute reversible error. A variance "result[s] in a reversible error only if it is likely to have surprised or has otherwise prejudiced the defense." Id. at 262. To demonstrate prejudice from a variance, the defendant must show "that the variance prejudiced some substantial right." Id. A variance that sufficiently informs the defendant of the charges against him and allows him to prepare his defense without being misled or surprised at trial does not prejudice the defendant's substantial rights.^[20]Id. Constructive amendments, by contrast, are "per se reversible under harmless error review, [and] are presumptively prejudicial under plain error review." United States v. Syme, 276 F.3d 131, 136 (3d Cir.2002).

Vosburgh argues that the government changed its theory of prosecution as to which "visual depictions" of child pornography Vosburgh unlawfully possessed. Count I of the indictment charged that Vosburgh "knowingly possessed one external hard drive that contained visual depictions" of child pornography, in violation of 18 U.S.C. § 2252(a)(4)(B), "on or about February 27, 2007." (A.45.) Vosburgh's arguments rest on his interpretation of the statutory term "visual depiction." The relevant definition states that a "visual depiction includes undeveloped film and videotape, [or] data stored on computer disk or by electronic means which is capable of conversion into a visual image...." 18 U.S.C. § 2256(5).

Vosburgh argues that a "visual depiction" is defined, not as a particular image, but as the collection of bytes that is "capable of conversion" into that image. Id. (emphasis added). On that basis, he distinguishes the pornographic thumbnails in the thumbs.db file from the full-sized.jpegs of those same images that once existed in the jap111 folder. He claims that although the thumbs.db images and the full-sized .jpegs possessed on February 22, 2007 are the same pictures of naked children, those pictures are two different "visual depictions" because each is generated by the computer's conversion of a distinct collection of bytes of data.

According to Vosburgh, he was charged only with possession of the thumbnails in the thumbs.db file, not possession of the .jpegs whose earlier existence was evidenced by those thumbnails. As support for this claim, he cites the government's response to his pretrial request for a bill of particulars. There, the government stated that it had "identified for defense counsel the two images found on defendant's external hard drive that comprise the charges for the possession of child pornography." Seizing on this reference to the "two images found on defendant's external hard drive," Vosburgh argues that he went to trial on Count I believing that he was charged only of knowingly possessing the thumbnails in thumbs.db. He contends that after the trial evidence proved that he could not have knowingly possessed the thumbs.db versions of Exhibits 14 and 15, the government realized that it would not be able to convict him based on his possession of those thumbnails alone. Therefore, it changed course at closing argument: no longer was Vosburgh accused of possessing the thumbs.db images. Instead, he was accused of knowingly possessing, on or around February 22, the full-sized .jpeg versions of Exhibits 14 and 15, with his possession of the pornographic-but-hidden thumbs.db miniatures on February 27 merely serving as evidence of his knowing possession of those full-sized pictures approximately five days earlier. As a result, Vosburgh claims, the prosecution "invited conviction for something the indictment did not charge" and thereby constructively amended the indictment. In the alternative, he argues that this inconsistency created a prejudicial variance, since he was "misled [and] surprised at trial" about the exact images that he was on trial for possessing. Daraio, 445 F.3d at 262.^[21]

The government argues that there was neither a constructive amendment nor a prejudicial variance. It maintains that its theory of prosecution was consistent from start to finish, and specifically contends that Count I did not specify whether the "visual depictions" were the thumbnails in the thumbs.db file or the previously-existing, full-sized .jpegs. Rather, the government argues, Count I notified Vosburgh generally about the illegal "images" he was charged with possessing, and the specific date of that possession was proved through Price's testimony at trial.

We are confident that there was no constructive amendment of the indictment. The statute under which Vosburgh was charged, 18 U.S.C. § 2252(a)(4)(B), does not criminalize the knowing possession of "visual depictions" of child pornography. It criminalizes knowing possession of "books, magazines, periodicals, films, video tapes, or other matter which contain any visual depiction" of child pornography. Id. (emphasis added). Accordingly, in Count I of the indictment, Vosburgh is charged, not with possession of any one particular "visual depiction" of child pornography, but with possession of "one external hard drive" (what § 2252(a)(4)(B) calls "other matter") that contained visual depictions of child pornography, on or about February 27, 2007. Assuming without deciding that Vosburgh is correct that the thumbs.db images of child pornography and the corresponding full-sized pictures are different "visual depictions" within the meaning of the statute,^[22] the fact remains that both of those "visual depictions" were depictions of the same underlying images, located on the same external hard drive. The indictment, when read in tandem with the government's response to Vosburgh's request for a bill of particulars, unmistakably and correctly identified the relevant hard drive and images. At most, the government's response imprecisely identified the exact "visual depictions"—essentially, which copies of the pornographic pictures on the hard drive—were at issue. While the line between variances and constructive amendments is not easily drawn, Daraio, 445 F.3d at 261, we believe that this error would not have created a constructive amendment of the indictment, because it would not modify "the elements of the crime charged." United States v. Castro, 776 F.2d 1118, 1122 (3d Cir.1985) (quoting United States v. Somers, 496 F.2d 723, 744 (3d Cir.1974)).

It would be more accurate to say that any error present here created a variance. A variance occurs when the evidence at trial "proves facts materially different from those alleged in the indictment." McKee, 506 F.3d at 231 n. 7. If the thumbs.db and .jpeg images were in fact different "visual depictions" of pornography, then the evidence at trial arguably proved facts materially different from those alleged in the government's response to Vosburgh's request for a bill of particulars. The issue then is whether that variance "surprised or otherwise ... prejudiced the defense," Daraio, 445 F.3d at 262, so as to require reversal. In our view, it did not.

The government's response to Vosburgh's request for a bill of particulars appears to conflate the terms "images" and "visual depictions," and in that sense may be "below the level of clarity to which prosecutors should aspire." Syme, 276 F.3d at 151. But any notion that Vosburgh was "surprised at trial" by the prior possession theory, Daraio, 445 F.3d at 262, is flatly contradicted by the record. Vosburgh did not raise his constructive amendment and variance arguments until his post-trial motion for a judgment of acquittal. If he really had been surprised by the government's change of course during closing argument, we think it likely that he would have said something at trial. He did not. In fact, there is little to no indication in the record that Vosburgh was surprised at trial, and much evidence that he was not.

First, in her pre-trial report, Vosburgh's expert Dr. Mercuri concluded that "there is absolutely no evidence that the only two files that [the] Prosecution claims are child pornography in this case [i.e., Exhibits 14 and 15] ... ever existed as individual .jpg files at any time on the Defendant's hard drive. Additional findings are as follows...." The reference to whether Vosburgh possessed ".jpg" files shows that the defense at least contemplated a theory of prosecution other than one based on possession of the thumbs.db file.

Second, the prosecutor raised the prior possession theory in her opening statement. She said:

"You will also hear evidence that [Exhibits 14 and 15] were found in part of the computer external hard drives that a user may not know it existed called the thumb[s].db directory. But what you will also hear is that in order to get there, the defendant had to view these— has to store them in a file folder called japs111, had to view them in a thumbnail view, and it automatically got there. So it shows that he had possession of these images."

Vosburgh's attorney did not object to this statement as any sort of surprise or ambush, further evidencing his lack of surprise. Moreover, this statement disproves Vosburgh's claim that the government raised the prior possession theory for the first time at closing.

Next, we note that the government's expert Justin Price testified extensively in support of the prior possession theory. For example, the following exchanges occurred between Price and the prosecutor during direct examination:

Q: So if you have a photo, like we do in this case, from the thumbs.db file, can you say with certainty that that original photo once existed on the hard drive?

A: Yes. There is no other way for that photograph to be inside the thumbs.db file without it being within [the jap 111] folder.

* * * * *

A: ... Again, this thumbs.db file was just specific to that one folder. So you can tell with reasonable certainty that those thumbnails that were recovered within this file were once in that directory at some point in time.

Q: So what happened, if you know, to the original image in the folder jap111 computer?

A: We don't know what happened to it, because it was not recovered.

* * * * *

Q: Now ... can you say when the image of the one nude girl [Exhibit 14].... entered the thumbs.db file?

A: Yes. According to the date and time attributes it was added or modified into that thumbs.db file on February 22nd of '07.

Q: So what does that mean? What happened on February 22, 2007?

A: On February 22nd, basically the user went into the folder, jap111, clicked on view, and showed these pictures in thumbnail view. And once that is generated, the thumbnails are generated, those pictures are added into this particular file.

* * * * * *

Q: Let's look at the next one. Image of four nude girls, Exhibit 15. Where was this image found?

A: This picture was found in the exact same thumbs.db files as in the previous exhibit.

Q: And when was it added to the thumbs.db file?

A: Again, on the same date and time, February 22nd of 2007.

Q: So, like that last image, can you say with certainty whether this image once existed in its original form on the external hard drive?

A: It must be there in order for the thumbnail picture to be generated from the computer system.

* * * * *

Q: So the thumbs.db was created February 21st.

A: 21st.

Q: And Exhibit 14 and 15, the images, the thumbnail images of the girls, when [were those] created?

A: They were last modified on the 22nd which is the date that it captures.

Q: So separate days?

A: That is correct.

Q: What does that mean?

A: Well, what it would show you is the files of Exhibit 14 and 15 had to be viewed either on or after the thumbs.db was created on the 21st.

Q: Now, you testified that to see one of these thumbnails in the thumbs.db you need special software?

A: To view the files within the thumbs. db, yes.

Q: Would you need that special software to view the originals?

A: No, you would not.

Each of these exchanges developed testimony in support of the prior possession theory. Vosburgh's lawyer ably cross-examined Price about his testimony, but never objected to it as evidence of a crime that was beyond the scope of the indictment. She likewise did not object when the government argued prior possession during closing argument.^[23]

Finally, and most tellingly, we note that Vosburgh's expert, Dr. Mercuri, came to trial prepared to refute the prior possession theory. She conducted a lengthy, in-court computer demonstration attempting to show that a person can possess a particular image in a thumbs.db file without ever having possessed a full-sized .jpeg of that same image on his hard drive. See Section II.C.5, supra. We think the fact that Vosburgh's expert came to trial prepared with a powerful demonstration contradicting the government's theory of prosecution shows that Vosburgh knew exactly what that theory was well before closing argument.

In sum, there is no indication in the trial record that Vosburgh could have been, or was, unfairly surprised when the government advanced the prior possession theory during closing argument. A variance is only grounds for reversal if it is prejudicial, and it is only prejudicial if it "prejudiced some substantial right." Daraio, 445 F.3d at 262. "A variance does not prejudice a defendant's substantial rights... if the indictment sufficiently informs the defendant of the charges against him so that he may prepare his defense and not be misled or surprised at trial[.]" Id. Here, even assuming that there was a variance between the indictment and the evidence, the record demonstrates that Vosburgh prepared a strong defense that belies any claim of prejudice or surprise at trial.^[24] His request for acquittal or a new trial on this basis will therefore be denied.

V. Sufficiency of the Evidence

Vosburgh's next argument is that there was insufficient evidence to convict him on Count I because the prior possession theory was definitively disproved by Dr. Mercuri's in-court demonstration. This argument lacks merit and does not require lengthy discussion. When evaluating a sufficiency of the evidence challenge, "we must view the evidence in the light most favorable to the government and must sustain the jury's verdict if a reasonable jury believing the government's evidence" could find guilt beyond a reasonable doubt. Syme, 276 F.3d at 156. We must also recognize that the jury is entitled to draw reasonable inferences from the trial evidence. United States v. Starnes, 583 F.3d 196, 212-13 (3d Cir. 2009).

Price testified that Vosburgh viewed the jap111 folder in thumbnail view on February 22nd, and that Exhibits 14 and 15 were among the pictures in the folder at that time. The jury could have reasonably inferred from this testimony that Vosburgh not only possessed, but knowingly possessed, those pictures. Vosburgh's expert Dr. Mercuri advanced several alternative theories that, if believed, also could have explained the presence of the pornographic images in the thumbs.db file. The most prominent of those was the theory that the images in Exhibits 14 and 15 migrated onto Vosburgh's computer as part of the hidden thumbs.db file in the jap111 folder, even though the full-sized.jpegs of those images never did. This was a classic battle of the experts. While a reasonable jury could have accepted Vosburgh's explanation of the evidence, there was certainly sufficient evidence to support the jury's choice to believe the government instead.

VI. Evidentiary Issues at Trial

A. Admission of Child Erotica

Vosburgh contends that the District Court erred by allowing the government to introduce thirty of the Loli-chan pictures found on his external hard drive. He argues that the probative value of those pictures was substantially outweighed by the danger of unfair prejudice, and therefore they should have been excluded under Rule 403 of the Federal Rules of Evidence. Vosburgh emphasizes that the Loli-chan images, while vulgar, were not illegal, and claims that they had no tendency to prove any of the elements of the charges against him. He argues that the admission of the pictures inflamed the jury against him based on his "bad taste" in "sexually-tinged humor."

Rule 403 permits the District Court to exclude relevant evidence if "its probative value is substantially outweighed by the danger of unfair prejudice[.]" Fed. R.Evid. 403. We review the District Court's Rule 403 ruling for an abuse of discretion. United States v. Jones, 566 F.3d 353, 362 (3d Cir.2009). "A district court has broad discretion to determine the admissibility of relevant evidence in response to an objection under Rule 403." United States v. Balter, 91 F.3d 427, 442 (3d Cir.1996). Rule 403 is a balancing test, and "[l]ike any balancing test, the Rule 403 standard is inexact, requiring sensitivity on the part of the trial court to the subtleties of the particular situation, and considerable deference on the part of the reviewing court to the hands-on judgment of the trial judge." United States v. Guerrero, 803 F.2d 783, 785 (3d Cir.1986). We will not disturb the District Court's ruling unless it was "arbitrary or irrational." United States v. Kellogg, 510 F.3d 188, 197 (3d Cir.2007) (quoting United States v. Universal Rehab. Servs. (PA), Inc., 205 F.3d 657, 665 (3d Cir.2000) (en banc)).

The ruling before us was not an abuse of discretion. The probative value of the Loli-chan pictures was not insignificant. Possession of those pictures suggested that Vosburgh harbored a sexual interest in children, and tended to disprove any argument that he unknowingly possessed Exhibits 14 and 15, or attempted to access the Link by accident. See United States v. Dornhofer, 859 F.2d 1195, 1199 (4th Cir.1988) (upholding admission of child erotica evidence against Rule 403 challenge because possession of such material made defendant's claim that he ordered child pornography by mistake less probable).

Meanwhile, the risk of unfair prejudice was low. The District Court specifically instructed the jury that Vosburgh was not on trial for possessing the Loli-chan pictures, and that those pictures were not illegal. This limiting instruction minimized any risk of unfair prejudice. See, e.g., United States v. Givan, 320 F.3d 452, 461-62 (3d Cir.2003) (noting that the court's instruction about the limited purpose for which the jury could consider evidence of defendant's prior convictions "minimiz[ed] any prejudicial effect" of that evidence); Guerrero, 803 F.2d at 787 (upholding admission of threat evidence against defendant's Rule 403 challenge because the trial court's instructions would have "limit[ed] any possible prejudice"). Under these circumstances, and in light of the "broad discretion" we afford trial courts under Rule 403, Balter, 91 F.3d at 442, the District Court did not abuse its discretion by permitting the government to introduce some of the Loli-chan pictures found on Vosburgh's hard drive.

B. Admission of Testimony Concerning the Age of the Girl in Exhibit 14

Vosburgh's final claim is that the District Court erred by admitting hearsay testimony concerning the age of the girl depicted in Exhibit 14. Whether testimony is hearsay is a question of law over which we exercise plenary review. United States v. Lopez, 340 F.3d 169, 175 (3d Cir.2003). To the extent the District Court's ruling was based on a permissible interpretation of the Federal Rules of Evidence, however, we review only for an abuse of discretion. United States v. Saada, 212 F.3d 210, 220 (3d Cir.2000).

To convict Vosburgh on Count I, the government had to prove that at least one of the images on Vosburgh's hard drive depicted "minor[s] engaging in sexually explicit conduct." 18 U.S.C. § 2252(a)(4)(B). To that end, the government sought to prove that the naked female in Exhibit 14 was a minor.^[25] It did not do so by introducing her birth certificate or some similar record. Instead, it sought to do so through the testimony of retired Postal Inspector Clinton.

Clinton testified that he recognized the girl in Exhibit 14 because he had conducted a search of her house and arrested her adoptive father as part of his work on an anti-child pornography task force. He was asked whether he knew when the girl was born. Vosburgh's lawyer objected on hearsay grounds. From there, the Court took over questioning and the following exchange occurred:

Q [The Court]: Do you know the date of birth of that person?

A: Yes, I do, Your Honor.

Q: And how do you know it?

A: From records we obtained from the—during the search and from the adoption agency.

Q: From Vital Statistics?

A: Yes, sir.

Q: Very well.

Q [Prosecutor]: Do you know the date that girl was born?

A: Yes, I do.

Q: What is that?

A: August 25th of 1992.

Apparently, the District Court viewed Clinton's testimony as falling within the "vital statistics" hearsay exception of Rule 803(9), and for that reason permitted Clinton to testify about the girl's date of birth.^[26] Clinton went on to testify that the girl was ten and a half years old at the time he met her and initiated her removal from her adoptive father's home.

Vosburgh argues that Clinton's testimony about what the "records" said about the girl's date of birth was impermissible hearsay. He concedes that under Rule 803(9), records of vital statistics about the girl's age would not have been excluded by the hearsay rule, but points out that the government never introduced any birth or adoption records into the trial record. It offered only Clinton's testimony about what he learned from those records. Therefore, Vosburgh argues, Clinton's testimony contained a layer of hearsay unaccounted for by the Rules of Evidence, and was inadmissible. Vosburgh contends that this error was not harmless because without Clinton's testimony, the jury could not have assigned an age to the female in Exhibit 14. The government agrees that Clinton's testimony about the girl's date of birth was hearsay.^[27] Its response is twofold. First, it contends that the District Court's error was inconsequential, because Clinton's testimony about the girl's age would have been admissible under the residual hearsay exception of FRE 807. This argument is plainly wrong. The party invoking the Rule 807 exception must give pretrial notice of its intention to do so. See Fed.R.Evid. 807 (stating in part that "a statement may not be admitted under this exception unless the proponent of it makes [it] known to the adverse party sufficiently in advance of the trial ... to provide the adverse party with a fair opportunity to prepare to meet it[.]"). Here, the government did not invoke Rule 807 at trial, nor could it have, because it never provided the requisite pre-trial notice.

The government's alternative argument is that the District Court's error was harmless. The test for harmless error is whether it is "highly probable that the error did not contribute to the judgment." United States v. Dispoz-O-Plastics, Inc., 172 F.3d 275, 286 (3d Cir.1999) (quoting United States v. Zehrbach, 47 F.3d 1252, 1265 (3d Cir.1995)). This "[h]igh probability" requires that the court possess a "sure conviction that the error did not prejudice the defendant." Id. We hold that "sure conviction" in this case. Vosburgh was charged under a statute criminalizing the possession of an external hard drive containing "any" visual depiction of child pornography. See 18 U.S.C. § 2252(a)(4)(B). Even if there were a basis for doubting that the female in Exhibit 14 was a minor, there was and is no dispute about whether the naked females in Exhibit 15 were. The jury could have convicted Vosburgh solely for possession of a hard drive containing the image that became Exhibit 15, regardless of whether Exhibit 14 depicted a "minor" in a pornographic pose.

Furthermore, assuming arguendo that the jury convicted on the basis of Exhibit 14, it is not the case, as Vosburgh claims, that the jury only could have determined that the female depicted therein was a minor based on Clinton's testimony as to her date of birth. There was enough other evidence that the female in Exhibit 14 was a minor that we can hold a sure conviction that Vosburgh was not prejudiced by Clinton's hearsay testimony. First, the jury viewed Exhibit 14 for itself. See United States v. Katz, 178 F.3d 368, 373 (5th Cir.1999) (observing that in many cases, it will be "possible for the fact finder to decide the issue of age in a child pornography case without hearing any expert testimony"). Second, Clinton offered a great deal of other testimony that established nearly conclusively that the female in Exhibit 14 was a minor, and Vosburgh offered none to the contrary. Clinton described the female that he recognized in Exhibit 14 as a "young girl" several times. He testified that when he arrived at her house, she emerged from the house holding her adoptive father's hand, and that after he arrested the father he took the girl into protective custody. Both of those facts suggested that the female in question was a minor. In addition, Clinton testified that he encountered the female in Exhibit 14 through his leadership of a task force investigating the production and distribution of child pornography. In light of these facts, we are confident that any error in admitting Clinton's hearsay testimony about the precise date of birth of the female in Exhibit 14 did not prejudice Vosburgh. We think it is highly probable, indeed virtually certain, that even without that testimony the jury would have concluded that the female in Exhibit 14 was a minor.

VII. Conclusion

The judgment of conviction will be affirmed.

BARRY, Circuit Judge, Concurring.

It is not disputed that when it applied for the search warrant, the government had no idea, much less evidence, that Vosburgh had ever possessed child pornography. All it knew was that during a two-minute period of time on one day in Vosburgh's life, he attempted to access the Link, and was unsuccessful. That's it. Paltry as that was, I agree with my colleagues that it was nonetheless "fairly probable" that evidence of that attempt would be found in Vosburgh's apartment, that the information in the warrant application describing that attempt was not stale, and that Vosburgh's motion to suppress was properly denied.

I write, however, to note my disappointment that, given how little the government knew about Vosburgh, it somehow believed it appropriate to spend the first fifteen pages of the eighteen-page affidavit supporting the warrant application with what it conceded was "boilerplate"—boilerplate which anything but subtly suggested that Vosburgh, whose name was never mentioned, was someone the government had no reason to believe that he was—a "collector" of child pornography, a child pornographer, and perhaps even a pedophile. Moreover, the boilerplate went into considerable detail describing, for example, the "collection" of the "collector" as revealing his "private sexual desires and intent" and representing his "most cherished sexual fantasies involving children," and into graphic detail describing the numerous ways in which those fantasies can be turned into reality, including the sexual gratification a collector may derive from actual physical contact with children.

The only purpose of those many pages of boilerplate was, at least in my view, to assure that the warrant issued, which assuredly it did. Indeed, the affidavit apparently convinced my colleagues that, although there was not even an allegation that Vosburgh ever possessed child pornography, there was reason to believe he was nonetheless a "collector" or, at least, he "could be." (Op. at 530.)

I have nothing against boilerplate per se. But I am deeply concerned when information and innuendo as serious as that seen here is used so inappropriately. Surely the government wants to win, but it must never forget its obligation to win fairly.

NOTES

[1] We will state the facts relevant to Ranchi in the present tense, as they are presented that way in the record. It is unknown whether Ranchi is operative today.

[2] "Hard core" generally denotes depictions of children engaged in actual sexual activity.

[3] An IP address is a number assigned to each device that is connected to the Internet. Although most devices do not have their own, permanent ("static") addresses, in general an IP address for a device connected to the Internet is unique in the sense that no two devices have the same IP address at the same time.

[4] As explained above, any attempt to access the Link would have been preceded by the following steps: (1) knowing where to find and then accessing a gateway site; (2) clicking on the URL from that gateway to Ranchi; (3) finding a hyperlink on the Ranchi board; (4) copying and pasting that link into a new window on his web browser; (5) changing the letters "hxxp" in the URL as posted to "http"; and (6) downloading the file.

[5] One of the officers present that day testified that when he walked into the apartment and saw the hammer, it became "obvious" to him that the "metal on metal" sound that officers feared was the racking of a handgun was actually the sound of a hammer smashing the metal on the thumb drive. Vosburgh claimed that the metallic sound was the sound of him unloading his guns "so there would not be any trouble."

[6] The external hard drive was inadvertently left in Vosburgh's apartment on February 27. When Agent Desy learned that it remained in Vosburgh's apartment, he sought a "piggyback" search warrant to return to Vosburgh's apartment. His application incorporated by reference the affidavit used to obtain the February 27 warrant. After Magistrate Judge Thomas Rueter issued this warrant on March 1, agents returned to Vosburgh's apartment and seized the external hard drive.

[7] The government distinguishes child pornography from child erotica by defining the latter as material that depicts "young girls as sexual objects or in a sexually suggestive way," but is not "sufficiently lascivious to meet the legal definition of sexually explicit conduct" under 18 U.S.C. § 2256. See also United States v. Gourde, 440 F.3d 1065, 1068 (9th Cir.2006) (en banc) (citing FBI affidavit describing child erotica as "images that are not themselves child pornography but still fuel ... sexual fantasies involving children").

[8] The government described Loli-chan as follows:

Loli-chan is the name given to a 13-year old girl who posts pictures of herself on imageboards and enjoys hearing from her older male fans. In these images, `Lolichan' is, for example, licking a lollipop; in a bathroom wearing a robe and making a kissing expression; in a swimsuit at a pool; at the shower, starting to undress from her swimsuit; in a Mini-Mouse outfit; in a school uniform sitting on the floor barefoot; and sitting clothed on a toilet. In many of these images, the girl is holding signs that read "I'm thirteen," "Google your own porn," "kock swurve is gay," [and various other vulgar, non-sensical phrases].

[9] "JPEG" stands for Joint Photographic Experts Group and refers to "a commonly used method for compressing and storing electronic photographic images. JPEG files are usually saved with the `.jpg' extension appended to the computer file name and indicate the file contains a photograph or graphical image." United States v. Andrus, 483 F.3d 711, 714 n. 2 (10th Cir.2007).

[10] The District Court's Conclusions of Law also referenced the good-faith exception to the exclusionary rule established in United States v. Leon, 468 U.S. 897, 104 S. Ct. 3405, 82 L. Ed. 2d 677 (1984). It noted the existence of the Leon exception, but stopped short of deciding whether it applied to the search of Vosburgh's apartment.

[11] Mercuri testified that "spoofing is a way of making it appear as though the IP address is from one user when in fact it is coming from another." She explained that "people are instructed if they are going to download illicit materials, ... not to use their own IP address, they have to use some other IP address." She further testified that a computer becomes a "zombie" when it is remotely and surreptitiously hijacked by another user and used to do things that the owner does not know that it is doing. Hackers may use computers that have been turned into zombies to send spam emails, or as a place to store files they do not want to store on their own computers. The malicious programs used to perform these activities can be planted on the computer through websites, through email, or even through an idle Internet connection.

[12] The District Court dismissed Count IV at the close of the government's case-in-chief because there was insufficient evidence for the jury to find that Vosburgh knew there was an outstanding search warrant at the time he allegedly destroyed his computer equipment. Neither Count III nor Count IV is implicated in this appeal.

[13] See also United States v. Stults, 575 F.3d 834, 843-44 (8th Cir.2009) (holding that probable cause supported warrant where officers used IP address to identify possessor of child pornography on a file-sharing network); United States v. Perrine, 518 F.3d 1196, 1205-06 (10th Cir.2008) (upholding probable cause where pornographic images were traced to defendant's residence using IP address); United States v. Wagers, 452 F.3d 534, 539 (6th Cir.2006) (upholding probable cause where suspect was identified as a member of child pornography websites through an IP address assigned to his residence); United States v. Hay, 231 F.3d 630, 635-36 (9th Cir. 2000) (finding a substantial basis for magistrate's probable cause determination where images of child pornography were traced to defendant using an IP address).

[14] We say "fairly" unique because there undoubtedly exists the possibility of mischief and mistake with IP addresses. For example, the trial evidence showed that proxy servers can be used to mask IP addresses, and that knowledgeable users can "spoof" the IP addresses of others. In this case, we are confident that Vosburgh's IP address was a fairly reliable identifier of his computer for probable cause purposes, in light of the total lack of record evidence that he was the victim of any mischief. In those cases where officers know or ought to know, for whatever reason, that an IP address does not accurately represent the identity of a user or the source of a transmission, the value of that IP address for probable cause purposes may be greatly diminished, if not reduced to zero.

[15] The search warrant authorized agents to search for and seize much more than computer equipment. It allowed them to seize all originals, copies, and negatives of any visual depictions of minors engaging in sexually explicit conduct; "[a]ny and all documents ... pertaining to" the possession of child pornography; and diaries, notebooks, records, and notes reflecting contact with minors. Vosburgh does not challenge the scope of the warrant.

[16] Cf. Shields, 458 F.3d at 278 (finding it fairly probable that the defendant would be found in possession of child pornography, because he had "voluntarily registered for two e-groups that were devoted principally to sharing and collecting child pornography," using an email address that strongly suggested an interest in such pornography).

[17] Officers undertook the search for adult pornography pursuant to allegations that Zimmerman was criminally liable under Pennsylvania law for sexually abusing children and corrupting a minor. Zimmerman, 277 F.3d at 431.

[18] There is another distinction between this case and Zimmerman which, although not directly relevant to staleness, demonstrates why the probable cause showing here was stronger than the showing in Zimmerman. In Zimmerman, we emphasized that there was no information suggesting that the defendant had ever possessed child pornography in his home. 277 F.3d at 432. Furthermore, there was no indication that even the single pornographic video clip referenced in the warrant application was ever located at the defendant's home. There was no indication that Zimmerman had ever downloaded the clip; it could just as easily have been "located in cyberspace." Id. at 435. In other words, nothing in the warrant application established any nexus between the pornography and the residence to be searched. Here, by contrast, the warrant application described Vosburgh's multiple attempts to download the Link, and explained why, based on Comcast's records, there was reason to believe those attempts originated from Vosburgh's apartment.

[19] For Vosburgh to succeed under this standard, he must establish error that was plain and affected his substantial rights. United States v. Vazquez-Lebron, 582 F.3d 443, 446 (3d Cir.2009). To show that an error affected his substantial rights, he must show that the error was "prejudicial," that is, that it "affected the outcome of the district court proceedings." Id. "If these requirements are met, we may, at our discretion, grant relief ... if the error seriously affects the fairness, integrity, or public reputation of judicial proceedings." Id. (internal citations and quotations omitted).

[20] Although variances and constructive amendments are similar errors, the rules against each serve different purposes and derive from different constitutional provisions. The rule against constructive amendments arises under the Fifth Amendment, and protects the "constitutionally guaranteed role of the grand jury." Daraio, 445 F.3d at 261. The rule against prejudicial variances exists to ensure "the fairness of the trial and the protection of the defendant's right to notice of the charges against her and her opportunity to be heard." Id. Thus, "the variance rule, to the extent that it is constitutionally required, is more of a due process rule than is the flat fifth amendment prohibition against being tried on an indictment which a grand jury never returned." Id. at 261-62.

[21] Vosburgh does not argue for reversal on the grounds that the superseding indictment materially misidentified the relevant date of possession.

[22] Vosburgh's interpretation of the statutory text is sensible, but it does not account for the use of the word "includes." See 18 U.S.C. § 2256(5) (a visual depiction "includes ... data stored on computer disk ... which is capable of conversion into a visual image") (emphasis added). It could be that the statutory language Vosburgh relies upon was not intended to be an exhaustive definition of "visual depiction," but only to make clear that, in addition to the ordinary meaning of "visual depiction," the statute also encompasses matter that might not, in the ordinary sense of the term, be thought of as a visual depiction of an image—such as data stored on a hard drive that could not be viewed without conversion into an image by a computer. Under this interpretation of the term, the thumbs.db pornographic images and the full-sized originals might be considered the same "visual depictions," since they are, for all intents and purposes, the same pictures. In that case, there would be no inconsistency between the indictment and the trial evidence. The government does not advance this argument; in fact, it does little to engage Vosburgh's statutory argument at all. Because it does not alter our disposition of the case, we will proceed on the assumption that Vosburgh's interpretation of the statutory term is correct.

[23] We note the absence of objection to show that Vosburgh was not surprised at trial, not to imply any ineffectiveness on the part of Vosburgh's counsel.

[24] Vosburgh claims that he was surprised at trial, but he never explains what he would have done differently had he been accurately apprised of the charges against him.

[25] A "minor" is any person less than 18 years old. 18 U.S.C. § 2256(1).

[26] Rule 803 provides that "[t]he following are not excluded by the hearsay rule, even though the declarant is available as a witness":____

(9) Records of Vital Statistics.

Records or data compilations, in any form, of births, fetal deaths, deaths, or marriages, if the report thereof was made to a public office pursuant to requirements of law.

[27] The issue may not be as simple as the parties portray it. Testimony that conveys a witness's personal knowledge about a matter is not hearsay. See, e.g., United States v. Simmons, 773 F.2d 1455, 1460-61 (4th Cir.1985) (concluding that testimony concerning the out-of-state location of a business was not hearsay because it reflected the witness's personal knowledge that the business in question had never had a manufacturing plant within the state); United States v. Steel, 759 F.2d 706, 712 (9th Cir.1985) (concluding that testimony concerning the ownership of a vehicle was not hearsay because the testimony stemmed from the witness's "personal knowledge"). It can be difficult to distinguish hearsay—testimony that recounts what was spoken by an out-of-court declarant or written on an out-of-court document—from personal knowledge, because "[m]ost knowledge has its roots in hearsay." Robinson v. Watts Detective Agency, 685 F.2d 729, 739 (1st Cir. 1982). See also Agfa-Gevaert, A.G. v. A.B. Dick Co., 879 F.2d 1518, 1523 (7th Cir.1989) ("[k]nowledge acquired through others may still be personal knowledge"). Arguably, Clinton's testimony about the female's date of birth was not hearsay, but an expression of a discrete historical fact about which Clinton had acquired personal knowledge through his review of "vital statistics." Because both parties take the position that the testimony was hearsay, our analysis assumes that it was. The difficult line-drawing that might have been required if the government had not conceded this point can be left for another day.