United States of America v. Wesley Guard

Syracuse, New York, criminal defense lawyer represented the Defendant charged with transportatoin of child pornography in violation of 18 USC 2252A(a)(1).



Kik is a messaging application available for download on most mobile

phones.



Kik uses a software program developed by Microsoft "to identify known

images of child pornography that may come across [its] servers through user

accounts.” App'x at 70; see also Hany Farid, Reining In Online Abuses, 19 Tech. &

Innovation 593, 596 (2018). The program, called PhotoDNA, relies on "hashing”

technology to identify known images of CSAM. App'x at 122. When an image is

uploaded to Kik, PhotoDNA automatically assigns it "a specific alphanumeric

number, known as a hash I.D.” or "hash value.” App'x at 318. The hash value

"serves to identify an individual digital file as a kind of 'digital fingerprint.'”

App'x at 70 n.1 (quoting United States v. Wellman, 663 F.3d 224, 226 n.2 (4th Cir.

2011)). PhotoDNA's "database is populated with hash values provided by

NCMEC of known images of child pornography.” App'x at 70. When an image

is assigned a hash value, that value is "matched against a repository provided by

NCMEC and if . . . that [hash value] is identified with something in NCMEC's

repository, that's how” Kik identifies it as CSAM.



When PhotoDNA "identif[ies] contraband” on Kik, a designated Kik

employee personally reviews the file. App'x at 347-48. If the designated

employee confirms the file to be suspected child pornography, "he makes a

report to NCMEC.” App'x at 348. The file is "taken off the public platform7

immediately” but at that time, it "is still in the user account.” App'x at 349-50.

The contraband file is retained by Kik "on the private side of” the system for 90

days for purposes of preservation of evidence. App'x at 350.



The file is also sent to NCMEC, along with "[s]ubscriber data information

. . . and activity logs” for the user whose account contained the file. App'x at

319.3 This reporting is mandatory; the law requires an ESP to report suspected

CSAM to NCMEC if the ESP has "actual knowledge” that such material resides

on its platform. See 18 U.S.C. §2258A(a)(1)(A)(i), (B). Once the PhotoDNA

program returns a match and the designated employee reviews the file, Kik has

such actual knowledge and must report to NCMEC. Failure to report a file

containing CSAM of which the ESP has actual knowledge can be punished by a

fine of up to $850,000 for the first failure and $1,000,000 for any subsequent

failure. See id. §2258A(e). The law does not, however, "require a provider to . . .

affirmatively search, screen, or scan” for CSAM. Id. §2258A(f)(3).



When NCMEC receives a report through the CyberTipline, it is statutorily

obligated to make that report "available to the appropriate law enforcement

3 Kik is "registered” with NCMEC, meaning that it may file CyberTipline reports

through a secure, encrypted channel. App'x at 285.8

agency for its review and potential investigation.” 34 U.S.C.



§11293(b)(1)(K)(i)(II); see also App'x at 301. The report generated by NCMEC

follows a standardized format; Section A details the information reported by the

ESP, and Sections B and C set forth additional information provided by NCMEC.

See, e.g., App'x at 90. Section D lists the contact information of the law

enforcement agency to whom the report was provided. See App'x at 90.

Section B provides information that is "automatically generated by

NCMEC Systems,” including the file name for any files designated as a "hash

match” and a categorization of those files. App'x at 95. "The 'Hash Match'

designation indicates that the uploaded file matches the hash value of an

uploaded file from a CyberTipline report that was previously viewed and

categorized by NCMEC.” App'x at 95. Possible categorizations include

"Apparent Child Pornography,” "Child Unclothed,” and "CP (Unconfirmed).”

App'x at 108. This section also provides a "Geo-Lookup” for the internet

protocol ("IP”) address of the user account associated with the suspected CSAM

files, and the IP address from which activity involving the files occurred,

identifying an internet provider and general geographic location for those IP

addresses. See App'x at 108. Section C provides "information collected by9

NCMEC staff” which may include "data gathered from queries on publicly-

available, open-source websites.” App'x at 109. Information in Section C is input

by "actual human beings . . . as opposed to computer-generated.” App'x at 292.

The defendant is sentenced on Counts 4,5,6 of the Indictment to the custody of the Bureau of Prisons to be imprisoned for a term of 151 months, counts to run concurrently; The Court will recommend to the BOP that the defendant receive Sex Offender and Mental Health treatment while incarcerated; 15 years Supervised Release to follow, to run concurrently, with standard and special conditions - The Court adopts the special conditions and makes them a part of this record; Special conditions including Sex Offender Specific conditions (CIMP Exhibit 1 included); Mental Health treatment, Psychosexual evaluation, No marijuana/CBD/THC, and limit to one internet capable device; No Fine; No Restitution; $300.00 Special Assessment; Forfeiture previously Dismissed;

18:2252A(a)(2)(A): Receipt of Child Pornography w/Forfeiture Allegation

(5) The defendant is sentenced on