THE CIRCUIT COURT OF THE CITY OF WILLIAMSBURG AND COUNTY OF
JAMES CITY Michael E. McGinty, Judge
Patricia Palmer Nagel for appellant.
I. Jones, IV, Assistant Attorney General (Mark R. Herring,
Attorney General, on brief), for appellee.
Present: Judges Humphreys, Russell and Senior Judge
Bumgardner Argued at Norfolk, Virginia.
J. HUMPHREYS JUDGE.
John Stickle ("Stickle") appeals his December 16,
2015 conviction in the Circuit Court of the City of
Williamsburg and County of James City (the "circuit
court") on three counts of possession of child
pornography, first and second or subsequent offenses, and
twenty-two counts of possession of child pornography with
intent to distribute.
accordance with established principles of appellate review,
we state the facts in the light most favorable to the
Commonwealth, the prevailing party in the [circuit] court. We
also accord the Commonwealth the benefit of all inferences
fairly deducible from the evidence." Muhammad v.
Commonwealth, 269 Va. 451, 479, 619 S.E.2d 16, 31
viewed, the evidence shows that on September 3, 2013,
Lieutenant Scott Little ("Little"), a district
coordinator of the Southern Virginia Internet Crimes Against
Children Task Force, took part in an undercover investigation
into what is known as peer-to-peer ("P2P")
distribution of child pornography over the internet. Little
testified regarding his substantive role in the investigation
of Stickle and also testified without objection as an expert
in the field of digital forensics, in particular "as to
the investigation of child exploitation offenses."
the record reflects that much of Little's testimony is
somewhat technical, the specifics are important to the legal
analysis in this case and are essentially as follows:
generically referred to as "the internet" is a
cooperatively managed global network of smaller
interconnected networks. Each internet site, whether such
site is hosted on a computer server or a single specific
computer, is associated with a unique internet protocol
("IP") address. Likewise, each device accessing the
internet, such as computers, tablets, modems, routers, and
smart phones, necessarily also is assigned a unique IP
address to facilitate two-way communication with other
devices and locations on the internet. The most common
method of accessing internet sites is through a software
application known as a "browser, " such as
Microsoft's Internet Explorer or Apple's Safari.
Browsers can access that portion of the internet known as the
Worldwide Web or simply "the web, " which is the
roughly fifteen percent of the internet sites that have been
assigned domain names and indexed by Google and other search
engines. Using a browser to access a site on the
Worldwide Web requires that the link be routed through one or
more DNS servers located throughout the world that maintain a
current database of IP addresses and their associated domain
names and direct internet traffic to the appropriate IP
common, but nevertheless widely available and frequently used
method of reaching a specific IP address is through a direct
link that is not relayed through a routing DNS. Using
specialized but readily obtainable software designed for the
purpose, a direct, encrypted "peer-to-peer" or
"P2P" link can be established between a user's
computer and a specific folder or file on any linked
computer-provided that the owner of the destination computer
is using similar P2P software and has allowed specific access
to such folder or file location.
short, P2P networks use locally installed software called a
"client" which allows users to share computer files
of their choice directly with other similarly equipped users
(a "peer") and without any intermediary routing.
Files which a user intends to share are kept in a specific
folder designated as sharable by the software client. While
there is nothing inherently illegal about the use of
peer-to-peer file sharing, P2P software is often used to
share files in violation of copyright and other intellectual
property laws and to facilitate communications regarding
various types of criminal activity. Because P2P locations in the
dark web are invisible to indexing and search engines such as
Google, specialized software is required to access each
separate P2P network.
was focusing his investigative attention on the ARES P2P
network, which is often used to exchange child pornography.
Testifying as an expert, Little explained how peer-to-peer
networks are used in the context of the exchange of child
P2P network generally, users place any files they wish to
share with others in a specific "shared" folder.
P2P clients like ARES globally search all shared folders in
the P2P network for any specified files. If found, the client
then connects directly to all "peers, " i.e.
computers with shared folders that host the particular file
being sought, and different pieces of the file are then
downloaded from multiple peers and reassembled into a new
whole copy which is then saved to the user's shared
with respect to the use of ARES, Little testified that file
source IP addresses are always collected by a P2P client, but
in the stock version of ARES, they are not normally displayed
to the user. An ARES user enters the name of any file sought
into the ARES client. As with other P2P software, ARES then
locates multiple IP addresses of computers hosting copies of
the requested file, verifies that all copies available are
identical to each other, then downloads separate pieces of
the file from the many different copies found across the
internet, reassembles the pieces into a new copy and, after
verifying that the newly assembled copy is identical to the
those from which it was assembled, saves the new file copy to
the user's computer.
used a specialized version of the ARES client designed
specifically for law enforcement ("ARES Round Up").
ARES Round Up, has been modified from its stock configuration
in two ways. First, ARES Round Up forces the client to
download a shared file from a single location instead of
doing so piecemeal from multiple locations and then
assembling the pieces into a whole copy of the sought-after
file. The second law enforcement modification to the ARES
client allows law enforcement users to view the actual IP
address of the target computer containing the file location
of a P2P shared file.
input the names of specific child pornographic images
encrypted and verified through the Secure Hash Algorithm
("SHA") and commonly exchanged by those interested
in child pornography into ARES Round Up and instructed the
ARES Round UP client to search the ARES network for matches.
This process allows the verified SHA values to be used to
search for identical copies of known files. Little had
enabled ARES Round Up to constantly search the P2P network
for matches with the SHA values of known child pornography
image and video files. One of these SHA values matched to a
shared folder location on a computer indicating an IP address
within the task force's geographic area.
obtained a subpoena and served the internet service provider
to obtain the physical address associated with that IP
address - the shared home of Stickle and his fiancée
Margaret Mallory ("Mallory"). Stickle had been
living at this address since moving from New York to live
with Mallory in August of 2013. Little obtained a search
warrant for this address and executed it on December 27,
2013. Pursuant to the warrant, police seized two laptop
computers. Mallory identified one of the laptops as belonging
to her, the other she identified as Stickle's. Mallory