Searching over 5,500,000 cases.

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

State v. Land

Court of Appeals of South Carolina

September 28, 2016

The State, Respondent,
David A. Land, Appellant.

          Heard June 9, 2016.

         Appeal From Lexington County Donald B. Hocker, Circuit Court Judge

          Clarence Rauch Wise, of Greenwood, for Appellant.

          Attorney General Alan McCrory Wilson and Assistant Attorney General William M. Blitch, Jr., both of Columbia, for Respondent.


          MCDONALD, J.:

         A Lexington County jury convicted David A. Land of three counts of sexual exploitation of a minor, second degree. Land appeals his convictions, arguing the circuit court erred in denying his motion for a directed verdict because the State failed to provide sufficient proof from which a reasonable jury could conclude that he knowingly distributed or exchanged pictures or videos of minors engaged in sexual acts as prohibited by section 16-15-405(A) of the South Carolina Code (2015). We affirm.


         South Carolina Law Enforcement Division (SLED) special investigators Britt Dove and Lucinda McKellar conduct online undercover operations targeting individuals distributing child pornography through peer-to-peer file sharing databases.[1] Using programs utilized by the Internet Crimes Against Children Task Force (the Programs), [2] Agents Dove and McKellar target individuals possessing child pornography available to be viewed on various file sharing networks, such as LimeWire, Phex, FrostWire, and others.[3] When searching for distributors of child pornography, the Programs search out specific SHA (secure hash algorithm) values-also called "hash values"-known to be associated with images of child pornography. Agent Dove described the process as follows:

[The Programs] would search for hash values. Now, everything on the internet can be given a hash value. That's going to be basically a mathematical formula that's done to everything -- it gives this independent number. Almost like DNA for a person, but it's for a file. The only way that changes is if something inside that file changes. So the [Program] would go through and it would look and see for that hash value, that DNA match basically. It would go through and anything it found that it was known that it was related to child pornography or contraband, it would log that this hash value was seen at this time, in this state, and eventually return a list that I could go and look at and use GEO location stuff to find out if it was in South Carolina, and was inside my jurisdiction to begin an investigation.
. . . .
[The hash value] was for the individual files. It would . . . continuously and automatically go through the different softwares and look for the individual files that match that hash number.

         Agent Dove further explained the process for downloading suspicious files and then viewing the files to verify whether or not they contained child pornography. In downloading these files, Dove obtains the internet protocol address (IP address), which is similar to a phone number, associated with the location of the particular file.[4] Dove testified that only one user can have one IP address assigned at a time, and the IP address provides the location of the computer being used to view or store the file. In addition to the IP address, Dove obtains the global unique identifying number (GUID) generated when the software-such as LimeWire in the instant case-is installed on the computer. The GUID identifies the software on a particular computer or device; it will not change even if the location of the computer or its IP address changes.

[T]he GUID . . . is the global unique identifier. When you download a software, in this case LimeWire . . . to your system, it gives it that thirty-two character alphanumeric number that's unique to that software on that computer at that time. It doesn't change if you move the computer around to different IP addresses. It stays the same. Much like the VIN on a car . . . . You can register a car in Tennessee or South Carolina, the VIN remains the same. And that way, the system knows who has what available. It can use it for management purposes, even if the IP address changes.

         On December 7, 2009, Dove conducted an online investigation and found a computer with likely child pornography available for distribution. Dove downloaded four files from the computer. The title of one of the downloaded images contained numerous words typically associated with child pornography. At this time, Dove obtained the IP address and the GUID for the computer running the LimeWire program from which he downloaded the four files. After obtaining the necessary subpoena authorization, Dove discovered that the internet service provider was Time Warner Cable in Lexington, South Carolina.

         Agent McKellar conducted a separate online investigation on December 4, 2009. During her investigation, McKellar located a computer that shared known child pornography, and she was able to download several of its files. McKellar testified that the information identifying the IP address, location, and GUID were the same for each of the files. In other words, "This [document or file] would have had to come from the same person, same computer, at the same location, using the same IP address as the previous three files." The computer had an IP address in Lexington and contained images saved with terminology typically associated with child pornography.

         On January 27, 2010, McKellar conducted another online investigation and located a computer housing child pornography available for peer downloading. Like the files downloaded on December 4, 2009, these new files were available from the user to anyone using the peer network. Using a single-source download, [5]McKellar was able to determine the documents had the same GUID as the computer distributing child pornography on December 4, 2009, although the IP address had since changed.

         After gathering the necessary information, Dove and McKellar realized that they had accessed computers using IP addresses not only in the same apartment complex, but that the apartments were "right above each other." When asked if she noticed any connection with the GUID in any other investigation, Agent McKellar responded, "Yes, . . . we had different IP addresses[.] [B]ut it was the exact same GUID associated with my investigation on December the 9th[, ] [Agent Dove's] investigation on . . . December the 7th, and my investigation on January 27th of 2010. It was the same GUID for each address." Additionally, the investigators determined that the same GUID from the computer sharing the child pornography was previously located in Fort Campbell, Kentucky.

         Dove and McKellar then went to the Lexington apartment complex and checked for wireless access points. They found five potential wireless access points, four secured and one unsecured. The unsecured access point was titled "Admin." Because the locations were sitting right on top of each other with the same GUID, Dove and McKellar were concerned that there might be an issue with a wireless access point being "basically piggybacked" (accessed or amplified by a nearby unauthorized user). At this time, the investigators decided to execute their separate search warrants simultaneously.

         Agent McKellar executed her search warrant on 101 Saluda Point at the apartment of a married couple, the Does.[6] Mr. Doe explained that the couple did have wireless internet access, but their wireless access point was not password-protected. Additionally, Mr. Doe told Agent McKellar that the name of their wireless access point was "Admin." Special Agent Colin Duncan conducted an on-site forensic review of the Does' home computer to determine "what kinds of programs, if LimeWire was on this computer and also if there [were] any . . . files that depict minors engaged in sexual activity." McKellar testified, "There [were] no file sharing programs on the computer at the residence and there [were] very few images. And none of those images were children engaged in sexual activity."[7]

         Agent Dove executed his search warrant on 101 Saluda Point, Apartment 1138, which was the residence of Christy Land, her daughter, and her son. Dove seized a laptop and two computer towers from the Land home. These items were submitted for forensic examination, but the examiner did not find any items related to Dove's investigation. The agents learned from Ms. Land, ...

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.