United States of America v. Wesley Guard

Albany, New York, criminal defense lawyer represented the Defendant charged with transportation of child pornography.





Kik is a messaging application available for download on most mobile

phones.5 It "allows users to chat with one another one-on-one or in a group

setting, [either in a] private or public group.” App'x at 315. It also allows users

to share images and videos.



NCMEC "is an entity organized as a private nonprofit but established by

Congress and statutorily obliged to operate the official national clearinghouse for

information about missing and exploited children.” United States v. Maher, 120

F.4th 297, 302 n.5 (2d Cir. 2024) (citations and quotation marks omitted); see also

34 U.S.C. §11293(b)(1)(B). As part of its statutory mandate, NCMEC "work[s]

with families, law enforcement agencies, electronic service providers, . . .

technology companies, . . . and others . . . to reduce the existence and distribution

of online images and videos of sexually exploited children.” 34 U.S.C.

§11293(b)(1)(K). It operates a "CyberTipline” that invites members of the public

and electronic service providers ("ESPs”) to report online child pornography.2



Kik uses a software program developed by Microsoft "to identify known



the same images of child pornography that may come across [its] servers through user

accounts.” App'x at 70; see also Hany Farid, Reining In Online Abuses, 19 Tech. &

Innovation 593, 596 (2018). The program, called PhotoDNA, relies on "hashing”

technology to identify known images of CSAM. App'x at 122. When an image is

uploaded to Kik, PhotoDNA automatically assigns it "a specific alphanumeric

number, known as a hash I.D.” or "hash value.” App'x at 318. The hash value

"serves to identify an individual digital file as a kind of 'digital fingerprint.'”

App'x at 70 n.1 (quoting United States v. Wellman, 663 F.3d 224, 226 n.2 (4th Cir.

2011)). PhotoDNA's "database is populated with hash values provided by

NCMEC of known images of child pornography.” App'x at 70. When an image

is assigned a hash value, that value is "matched against a repository provided by

NCMEC and if . . . that [hash value] is identified with something in NCMEC's

repository, that's how” Kik identifies it as CSAM.



When PhotoDNA "identif[ies] contraband” on Kik, a designated Kik

employee personally reviews the file. App'x at 347-48. If the designated

employee confirms the file to be suspected child pornography, "he makes a

report to NCMEC.” App'x at 348. The file is "taken off the public platform

immediately” but at that time, it "is still in the user account.” App'x at 349-50.

The contraband file is retained by Kik "on the private side of” the system for 90

days for purposes of preservation of evidence.



The file is also sent to NCMEC, along with "[s]ubscriber data information

. . . and activity logs” for the user whose account contained the file. App'x at

319.3 This reporting is mandatory; the law requires an ESP to report suspected

CSAM to NCMEC if the ESP has "actual knowledge” that such material resides

on its platform. See 18 U.S.C. §2258A(a)(1)(A)(i), (B). Once the PhotoDNA

program returns a match and the designated employee reviews the file, Kik has

such actual knowledge and must report to NCMEC. Failure to report a file

containing CSAM of which the ESP has actual knowledge can be punished by a

fine of up to $850,000 for the first failure and $1,000,000 for any subsequent

failure. See id. §2258A(e). The law does not, however, "require a provider to . . .

affirmatively search, screen, or scan” for CSAM. Id. §2258A(f)(3).



When NCMEC receives a report through the CyberTipline, it is statutorily

obligated to make that report "available to the appropriate law enforcement

agency for its review and potential investigation.” 34 U.S.C.



§11293(b)(1)(K)(i)(II); see also App'x at 301. The report generated by NCMEC

follows a standardized format; Section A details the information reported by the

ESP, and Sections B and C set forth additional information provided by NCMEC.

See, e.g., App'x at 90. Section D lists the contact information of the law

enforcement agency to whom the report was provided. See App'x at 90.

Section B provides information that is "automatically generated by

NCMEC Systems,” including the file name for any files designated as a "hash

match” and a categorization of those files. App'x at 95. "The 'Hash Match'

designation indicates that the uploaded file matches the hash value of an

uploaded file from a CyberTipline report that was previously viewed and

categorized by NCMEC.” App'x at 95. Possible categorizations include

"Apparent Child Pornography,” "Child Unclothed,” and "CP (Unconfirmed).”

App'x at 108. This section also provides a "Geo-Lookup” for the internet

protocol ("IP”) address of the user account associated with the suspected CSAM

files, and the IP address from which activity involving the files occurred,

identifying an internet provider and general geographic location for those IP

addresses. See App'x at 108. Section C 9



NCMEC staff” which may include "data gathered from queries on publicly-

available, open-source websites.” App'x at 109. Information in Section C is input

by "actual human beings . . . as opposed to computer-generated.” App'x at 292.



II. The Searches of Guard's Accounts



On September 18, 2020, Kik used the CyberTipline to report seven files

containing apparent CSAM to NCMEC. See App'x at 89-98 (CyberTipline Report

79722638). According to the Report, on September 16, 2020, an individual using

the Kik username "ski18taco” had sent these seven files to other Kik accounts in

private chat messages. See App'x at 91-94. The Report provided the IP address

associated with the account assigned username "ski18taco” and indicated that

the IP address was located in Queensbury, New York. See App'x at 95. It also

designated five of the seven files as "hash matches,” three of which were

identified as "CP (Unconfirmed)” and two of which were identified as "Apparent



Child Pornography.” App'x at 95.4



Based on the location associated with the IP address, NCMEC forwarded

the report to the New York State Police, specifically, the Internet Crimes Against

Children ("ICAC”) taskforce located in Albany, New York. On October 31, 2020,

State Police Investigator Brandon Hudson served an administrative summons on

Charter Communications, an internet service provider, seeking subscriber

information associated with the IP address identified in the September 2020

Report. Charter reported that the IP address had been assigned to Guard's

account from March 17, 2019, through October 28, 2020. See App'x at 741-42.

Charter also provided a service address in Queensbury, New York. See App'x at

741. Another law enforcement agent later obtained lease agreements confirming

that Guard had resided at the Queensbury address provided by Charter "from

January 15, 2019[,] to November 30, 2020.” App'x at 79.



On January 21, 2021, Kik filed a second CyberTipline Report relevant to

Guard, attaching 18 files containing apparent CSAM. See App'x at 99-111

(CyberTipline Report 84703878). Kik reported that an individual using the Kik

username "ski118taco”5 had shared these files with other Kik accounts, by

private or group message, between December 27, 2020, and December 31, 2020.

See App'x at 101-08. The messages were sent from an IP address located in



Queensbury, New York, though not the same IP address identified in the

September 2020 Report. See App'x at 76-77.



NCMEC forwarded the January 2021 Report to the Albany ICAC taskforce.

The Report identified six of the files as hash matches, four of which were

categorized by NCMEC as "Apparent Child Pornography,” one as "CP

(Unconfirmed),” and one as "Child Unclothed.” App'x at 108.



On February 26, 2021, Investigator Ryan Maestro served an administrative

summons on Charter Communications seeking subscriber information for the IP

address in the January 2021 Report. See App'x at 76-77. Charter responded that

the subscriber was Wesley Guard, and the IP address at issue had been assigned

to his "account from October 29, 2020[,] until March 2, 2021.” App'x at 77.

Charter also provided a physical address in Queensbury, New York. See App'x

at 77. Maestro also ran a criminal history check on Guard; when he discovered a

2011 conviction for Sexual Misconduct, Maestro checked the New York Sex

Offender Registry and confirmed that Guard was listed as living at the address

provided by Charter. See App'x at 78.



Special Agent James Hamilton of the United States Immigration and

Customs Enforcement Office of Homeland Security Investigations ("HSI”)12

worked with the Albany ICAC taskforce, "reviewed the files that Kik reported to

NCMEC,” App'x at 72, and determined that four of the files identified in the

September 2020 Report and seven of the files identified in the January 2021

Report "depict[ed] child pornography as defined by 18 U.S.C. §2256,” App'x at

72, 75.



On April 27, 2021, a federal judge issued a search warrant for Guard's

residence "for evidence of the possession, distribution, and receipt of child

pornography.” App'x at 80-81. The warrant was executed on April 29, 2021.

"Just prior to the execution of the search at Guard's residence,” Hamilton,

Maestro, and State Police Investigator Thomas Gibney approached Guard at his

place of employment and brought him to a State Police facility. App'x at 80.

"At the station, [Hamilton] read [Guard] a Miranda warning from an

Immigration and Customs Enforcement form, which [Guard] initialed as it was

being read to him.”6 App'x at 80-81. Guard "then signed a written waiver of his

Miranda rights, which also was signed as witnessed by” Hamilton and Maestro.

App'x at 81. Guard was then interviewed by the officers. During the interview,

Guard stated that he had used Kik in the past, having had two or three accounts

over time, but that he had stopped using it "[t]hree, four months ago.” App'x at

750. Guard recalled that he had used the usernames "ski18taco” and

"ski118taco,” and also identified a third username, "the18taco,” of which law

enforcement was previously unaware. See App'x at 766. Guard admitted that he

had seen child pornography in the chat rooms, see App'x at 754, and that he had

been "looking at child pornography” for a while, but "not long,” App'x at 758.

Guard also agreed that he had "uploaded child pornography into a group using”

his Kik accounts, App'x at 756 — specifically, that he had shared child

pornography images among various Kik groups, see App'x at 759.



On June 14, 2021, Hamilton secured a warrant to obtain "subscriber

information, text message content, picture message content, video message

content, and any and all images generated in the Kik accounts, including

metadata,” regarding the three Kik usernames acknowledged by Guard in his

interview. App'x at 85. Kik produced records, including hundreds of "pages of

user log activity . . . in response to that warrant.” App'x at 321.

The defendant is sentenced on Counts 4,5,6 of the Indictment to the custody of the Bureau of Prisons to be imprisoned for a term of 151 months, counts to run concurrently; The Court will recommend to the BOP that the defendant receive Sex Offender and Mental Health treatment while incarcerated; 15 years Supervised Release to follow, to run concurrently, with standard and special conditions - The Court adopts the special conditions and makes them a part of this record; Special conditions including Sex Offender Specific conditions (CIMP Exhibit 1 included); Mental Health treatment, Psychosexual evaluation, No marijuana/CBD/THC, and limit to one internet capable device; No Fine; No Restitution; $300.00 Special Assessment; Forfeiture previously Dismissed.



Affirmed