United States of America Plaintiff - Appellee v. Michael Huyck Defendant - Appellant
United States of America Plaintiff - Appellee v. Michael Huyck Defendant - Appellant
Following a jury trial, Michael Huyck was convicted of multiple child pornography-related crimes. On appeal, he raises four issues, claiming that (1) the district court 1 erred in denying his motion to suppress evidence seized pursuant to an allegedly stale search warrant, (2) the district court abused its discretion in admitting various exhibits, (3) the evidence did not support the jury's verdicts, and (4) the district court abused its discretion in denying his motion for a new trial. We affirm.
In November 2012, the FBI seized a computer server in Bellevue, Nebraska that hosted child pornography websites on the “Tor” network. The Tor network is designed to allow users to surf the Internet anonymously and access otherwise hidden websites, including illegal websites like “Pedoboard,” which was strictly devoted to child pornography. To access the Tor network, a user downloads special software that obscures a user's Internet Protocol (“IP”) address, thereby evading traditional law enforcement IP identification techniques.2 Once on the Tor network, users must have a unique, sixteen-character web address to access the Pedoboard website. Unlike traditional web addresses, a Tor web address does not indicate the services or content available on the site. Thus, a Pedoboard user must obtain the web address from other users or from Internet postings describing Pedoboard's content. The most common way to find Pedoboard's web address was to access the “Hidden Wiki”—a directory of Tor hidden services providing the name of the hidden service, a description of its content, and the Tor web address. To identify people accessing Pedoboard, the FBI installed Network Investigative Technique (“NIT”) software on the website, which revealed the true IP addresses of people accessing the site, the date and time the user accessed the content, and the user's computer operating system.
The FBI controlled and monitored Pedoboard from November 16, 2012 to December 2, 2012. On November 21, 2012, an IP address linked to Huyck's residence utilized the Tor network and browsed Pedoboard for at least nine minutes. The computer used Windows XP and a Google Chrome browser. Huyck and his sixteen-year-old daughter were the only people present at his residence that night. No child pornography was downloaded during the visit.
In early April 2013, law enforcement agents conducted physical surveillance of Huyck's residence. They noted that Huyck utilized an unsecured wireless network, though the signal strength was so weak that agents could not obtain the signal from the front yard of his residence. Agents prepared a search warrant for the residence, which was executed on April 9, 2013, more than four months after the November 2012 Pedoboard access date. Officers went to the basement of Huyck's residence and discovered a complex computer network. They also found a Hitachi 160GB hard drive, a G-Technology 2GB external storage drive, and a Molex 2GB thumb drive on his desk and among his personal belongings. Two computers were located underneath the desk, and neither used Windows XP or Google Chrome at the time of the search. However, one of the computers had been recently wiped clean of all data, and stickers on the computer towers indicated Windows 7 had been downgraded to Windows XP Pro. Huyck was the only adult living at the residence, and during the search, Huyck told officers that no one else had access to his computers and that he worked at Molex in an information technology position. Finally, Huyck admitted that he was familiar with and had used the Tor network, believing it to be anonymous.
A forensic analysis of the Hitachi hard drive revealed ninety-five thumbnail images of child pornography in the thumbs.db file, though the images were not viewable without special software. Nonetheless, the thumbnail images indicated that original, full-size images were present on the Hitachi hard drive in 2010 but had been deleted by the time of the search. A forensic analysis of the G-Technology external storage drive revealed a text file with instructions on how to configure a computer to access the Tor network using a Google Chrome browser. The forensic analysis also exposed a list of Tor hidden services—including a link to the Onion Pedo Video Archive (OPVA), a different Tor child pornography website—and an image of a young girl, appearing to be under eighteen years of age, taking a picture with her genitalia showing. A forensic analysis of the Molex thumb drive revealed a picture of Huyck; another reference to the OPVA hyperlink; and a text file stating, “[H]ttps:// opva2pilscvtwmh.onion/ Need to use download manager downthemall is good for some.” The hyperlink was the Tor web address for OPVA. “Downthemall” is a download manager that helps a user efficiently download contents of an Internet website, such as child pornography, though it is commonly used for legal purposes.
Based on this evidence, the Government charged Huyck with five offenses in two separate indictments, which were later consolidated for trial. In the first indictment, the Government charged Huyck with two crimes in connection with the Pedoboard activity: (1) receipt or attempted receipt of child pornography, in violation of 18 U.S.C. §§ 2252A(a)(2) and (b)(1) (“Pedoboard receipt count”); and (2) accessing with intent to view child pornography, in violation of 18 U.S.C. § 2252A(a)(5)(B) (“Pedoboard access count”). In the second indictment, the Government charged Huyck with three crimes related to evidence seized from his residence. In relation to the ninety-five images found on the Hitachi hard drive, the Government charged Huyck with (1) receipt or attempted receipt of child pornography, in violation of 18 U.S.C. §§ 2252A(a)(2) and (b)(1) (“Hitachi receipt count”); and (2) possession of child pornography, in violation of 18 U.S.C. § 2252A(a)(5)(B) (“Hitachi possession count”). The last count was for possession of child pornography contained on the G-Technology external storage drive.
Huyck moved to suppress evidence seized during the search of his residence, alleging that a four and one half-month delay between his browsing of Pedoboard and the warrant's issuance rendered the warrant fatally stale. The magistrate judge 3 recommended denying the motion to suppress, which the district court adopted. Huyck also moved to exclude Exhibits 16, 18, 23, 24, 27, 28, and 32, claiming unfair prejudice. Exhibits 23, 24, and 32 concerned the “downthemall” program,4 and Exhibits 16, 18, 27, and 28 involved instructions for accessing and anonymizing the Tor network and references and links to OPVA.5 The district court admitted all of the challenged evidence over Huyck's objections.
After the close of evidence, the district court granted Huyck's motion for a judgment of acquittal as to the G-Technology possession count after finding that the Government had not sufficiently demonstrated that the person depicted in the image was under eighteen years of age. The district court provided the jury with a special verdict form for the Pedoboard receipt and Hitachi receipt counts. The verdict form allowed the jury to convict Huyck of receipt of child pornography, attempted receipt of child pornography, or neither.
The jury began deliberations but asked the district court for supplemental instructions defining intent, knowledge, and access. The court provided minor clarifications but generally referred the jury back to its previous instructions. The jury then found Huyck guilty as to the Pedoboard receipt and access counts. It also returned an inconsistent response to the special verdict form on the Hitachi receipt count, finding Huyck guilty of receiving child pornography but not guilty of attempted receipt of child pornography. The jury concluded by finding Huyck guilty of the Hitachi possession count. The district court denied Huyck's motion for a judgment of acquittal except for the Hitachi receipt count, which it granted. It then denied Huyck's motion for a new trial because the remaining verdicts were supported by sufficient evidence. Finally, the court sentenced Huyck to 72 months' imprisonment on the Pedoboard receipt count, with concurrent 36-month sentences for the Pedoboard access and Hitachi possession counts. This appeal followed.
A. Motion to Suppress
Huyck first argues that the district court erred in denying his motion to suppress because the search warrant was based on stale information and was thus unsupported by probable cause. “We examine the factual findings underlying the district court's denial of the motion to suppress for clear error and review de novo the ultimate question of whether the Fourth Amendment has been violated.” United States v. Williams, 577 F.3d 878, 880 (8th Cir. 2009) (quotation omitted). “Probable cause means a fair probability that contraband or evidence of a crime will be found in a particular place, given the circumstances set forth in the affidavit.” United States v. Lemon, 590 F.3d 612, 614 (8th Cir. 2010) (quotations omitted). “A warrant becomes stale if the information supporting the warrant is not sufficiently close in time to the issuance of the warrant and the subsequent search conducted so that probable cause can be said to exist as of the time of the search.” United States v. Brewer, 588 F.3d 1165, 1173 (8th Cir. 2009) (quotation and citation omitted). “There is no bright-line test for determining when information in a warrant is stale.” Lemon, 590 F.3d at 614 (quotation omitted). Instead, we look to “the lapse of time since the warrant was issued, the nature of the criminal activity, and the kind of property subject to the search.” United States v. Estey, 595 F.3d 836, 840 (8th Cir. 2010) (quotation omitted).
Huyck contends that the affidavit did not establish probable cause because briefly browsing a child pornography website is not sufficiently likely to result in evidence of child pornography possession four-and-one-half months later. He acknowledges that the Eighth Circuit has upheld time lapses of similar or longer durations, see Lemon, 590 F.3d at 614 (upholding a search warrant issued eighteen months after discovering information related to child pornography), but he argues that there is a difference between someone who downloads child pornography and someone who browses through child pornography. Huyck, however, does not proffer any evidence demonstrating a difference in the habits of those browsing through child pornography and those downloading child pornography. See Estey, 595 F.3d at 840 (“Meanwhile, Estey does not offer evidence contrary to the FBI statements regarding the habits of child pornography collectors.”). More importantly, his argument misrepresents the facts of this case.
Here, Huyck did not simply and accidentally navigate to Pedoboard for a few meaningless minutes. Instead, the evidence shows he accessed Pedoboard after taking a number of intermediate steps that indicated his knowledge that Pedoboard trafficked in child pornography. First, Pedoboard was not some random website that any Internet user could randomly stumble upon by chance. It was located on the Tor network, and Huyck had to download specific software to access the Tor network. Second, accessing Pedoboard required knowledge of Pedoboard's exact Tor web address. According to the warrant affidavit, that Tor web address was not common information; users could only obtain the Pedoboard web address directly from other users or from Internet postings detailing the child pornography content available. In United States v. DeFoggi, a case which dealt with a different child pornography website hidden on the Tor network, we held that “[a]ccessing PedoBook therefore required numerous affirmative steps by the user, making it extremely unlikely that a user would stumble upon it without knowing that its purpose was to advertise and distribute child pornography and understanding the content to be found there.” 839 F.3d 701, 707 (8th Cir. 2016). That logic applies here with equal force. And coupled with the fact that “child pornographers generally retain their pornography for extended periods,” United States v. Chrobak, 289 F.3d 1043, 1046 (8th Cir. 2002), this evidence is sufficient to demonstrate that probable cause existed at the time of the search. See United States v. Wagers, 452 F.3d 534, 540 (6th Cir. 2006) (“[E]vidence that a person has visited or subscribed to websites containing child pornography supports the conclusion that he has likely downloaded, kept, and otherwise possessed the material.”).
We also note that the warrant sought not just contraband—that is additional child pornography—but evidence related to Huyck's prior November 21, 2012 crimes of receiving child pornography and accessing with intent to view child pornography. The warrant affidavit noted that “[d]igital information can also be retained unintentionally ․ (e.g., temporary files or ISP client software, among others)” and described how “a computer user's Internet activities generally leave traces or ‘footprints' in the web cache and history files of the browser used.” Thus, law enforcement officials had probable cause to search Huyck's residence, as there was a fair probability that they would unearth evidence of the completed crime in Huyck's possession at the time of the search. See United States v. McArthur, 573 F.3d 608, 612 n.4 (8th Cir. 2009) (“When a user deletes a file, it is not erased completely from the computer.”); United States v. Lewis, 605 F.3d 395, 402 (6th Cir. 2010) (“[I]mages typically persist in some form on a computer hard drive even after the images have been deleted and ․ can often be recovered by forensic examiners.” (quotation omitted)). As a result, the district court properly denied Huyck's motion to suppress.
B. Evidentiary Issues
Huyck next challenges the admission of a number of exhibits, claiming that their probative value was substantially outweighed by the danger of unfair prejudice. See Fed. R. Evid. 403. However, “Rule 403 does not offer protection against evidence that is merely prejudicial in the sense of being detrimental to a party's case. The rule protects against evidence that is unfairly prejudicial.” United States v. McCourt, 468 F.3d 1088, 1092 (8th Cir. 2006) (quotation omitted). “Unfair prejudice means an undue tendency to suggest decision on an improper basis,” including “[e]vidence which is so inflammatory on its face as to divert the jury's attention from the material issues in the trial.” United States v. Betcher, 534 F.3d 820, 825 (8th Cir. 2008) (citations and quotation omitted). With this in mind, we review a trial court's evidentiary rulings for abuse of discretion and give “great deference” to the district court's balancing of the probative value and prejudicial impact of the evidence. United States v. Farrington, 499 F.3d 854, 859 (8th Cir. 2007) (quotation omitted).
1. The “downthemall” evidence
Exhibits 23, 24, and 32 pertain to the “downthemall” program, which allows users to efficiently download content from websites. Huyck claims that this evidence's probative value is substantially outweighed by its unfair prejudice. Huyck notes he was charged with browsing Pedoboard, not the mass downloading of child pornography. He contends that admitting evidence of “downthemall” violated Rule 403 because it unfairly implied that he downloaded mass images of child pornography and thus suggested an improper basis for convicting him. These arguments are unavailing, and we find the district court did not abuse its discretion in admitting the “downthemall” exhibits.
Among other things, Huyck was charged with receipt of child pornography and accessing with intent to view child pornography on the Pedoboard website. Exhibits 24 and 32 demonstrated how “downthemall” worked and how it was often used to download child pornography. Exhibit 23 was a text file found on Huyck's computer, which referred to “downthemall” immediately following a link to OPVA, another child pornography website hidden on the Tor network. Thus, the evidence was probative of the charged crimes because it indicated Huyck's personal knowledge of the Tor network and specifically how it could be utilized to access hidden child pornography websites. In context then, the exhibits were admissible as they tended to show that Huyck had an interest in child pornography and knew about child pornography on the purportedly anonymous Tor network. The district court did not abuse its discretion in admitting Exhibits 23, 24, and 32.
2. The OPVA evidence
Huyck also challenges the admission of Exhibits 16, 18, 27, and 28—the OPVA evidence—on similar grounds. He claims that this evidence is unfairly prejudicial because he was charged with conduct related to Pedoboard, not OPVA, and thus, the exhibits improperly suggest that he should be convicted for reasons unrelated to the crimes charged.
We reject Huyck's challenge to the admission of the OPVA evidence. While it is true that Huyck was charged with conduct relating only to Pedoboard, the OPVA evidence illustrates Huyck's awareness of the Tor network and his knowledge of how to access it and utilize it to find child pornography websites—all relevant to the Pedoboard receipt and access counts. We reiterate that “Rule 403 does not offer protection against evidence that is merely prejudicial in the sense of being detrimental to a party's case. The rule protects against evidence that is unfairly prejudicial.” McCourt, 468 F.3d at 1092 (quotation omitted). Because the OPVA evidence is directly relevant to Huyck's knowledge of the Tor network and his intent to use it to view child pornography, there is no undue tendency to suggest a decision on an improper basis. Thus, as with the “downthemall” evidence, we conclude that the district court did not abuse its discretion in admitting the OPVA evidence.
C. Sufficiency of the Evidence
Huyck also claims that the district court erred in denying his motion for a judgment of acquittal. He maintains the evidence was insufficient to support the jury's verdicts that he knowingly received, accessed with intent to view, and possessed child pornography. “We review the sufficiency of the evidence de novo, viewing evidence in the light most favorable to the government, resolving conflicts in the government's favor, and accepting all reasonable inferences that support the verdict.” United States v. Yarrington, 634 F.3d 440, 449 (8th Cir. 2011) (quotations omitted). “If there is an interpretation of the evidence that would allow a reasonable-minded jury to find the defendant guilty beyond a reasonable doubt, then we must uphold the verdict.” United States v. McCloud, 590 F.3d 560, 565-66 (8th Cir. 2009) (quotations omitted). Essentially, our review of the trial evidence is “highly deferential.” United States v. Muhlenbruch, 634 F.3d 987, 1000 (8th Cir. 2011). “If evidence consistent with guilt exists, we will not reverse simply because the facts and the circumstances may also be consistent with some innocent explanation. Even where the evidence rationally supports two conflicting hypotheses, the reviewing court will not disturb the conviction.” United States v. Griffith, 786 F.3d 1098, 1102 (8th Cir. 2015), cert. denied 137 S. Ct. 70 (2016) (citation and quotation omitted).
1. Pedoboard receipt and access counts
For activity related to Pedoboard on November 21, 2012, Huyck was convicted of violating 18 U.S.C. §§ 2252A(a)(2) and 2252A(a)(5)(B). Section 2252A(a)(2) makes it a crime to “knowingly receive[ ]” “any child pornography” that has been transported in interstate commerce “by any means, including by computer.” See also United States v. Manning, 738 F.3d 937, 945 (8th Cir. 2014). Section 2252A(a)(5)(B) makes it a crime to “knowingly possess[ ], or knowingly access[ ] with intent to view, any ․ computer disk, or any other material that contains an image of child pornography” that has been transported in interstate commerce or produced using materials that have been transported in interstate commerce “by any means, including by computer.” See also Yarrington, 634 F.3d at 450.
Huyck contends no reasonable jury could have convicted him on these counts because the evidence did not prove that he was the person who received and accessed the child pornography on Pedoboard. The Government could not find devices owned by Huyck that used Windows XP or Google Chrome—the software and program that the NIT indicated had accessed Pedoboard on November 21, 2012. As a result, Huyck argues that there is insufficient evidence to uphold his Pedoboard receipt and access convictions. Instead, he claims that the “far more rational inference” is that “a device running the Windows XP operating system and the [Google] Chrome web browser used Huyck's unsecured wireless network to access the Pedoboard website.”
We disagree. The evidence presented at trial demonstrated that Huyck received and accessed with intent to view child pornography from Pedoboard. The NIT linked Huyck's IP address to the November 21, 2012 access to Pedoboard, and though his wireless network was unsecured, the signal was so weak that when surveilling his residence, law enforcement agents could not detect it from the front yard. Huyck was the only adult living at his residence. He concedes that no one besides his daughter was present at his house on November 21, 2012 and never suggests that his daughter was the person who accessed Pedoboard. Furthermore, as noted above, users cannot accidentally navigate to Pedoboard. Users have to download specific software to access the Tor network anonymously and know the exact, unique Tor web address for Pedoboard. Huyck admitted to law enforcement agents that he was familiar with the Tor network, believed it to be anonymous, and had used it. More notably, Huyck saved text files on his computer detailing instructions on how to access the Tor network along with links to OPVA, another hidden child pornography website on the Tor network, thereby demonstrating his knowledge and intent to use the Tor network to receive and access child pornography.
While the devices seized from Huyck did not have Windows XP or Google Chrome installed, Huyck's computer towers had stickers indicating Windows XP Pro may have been used on the computers. Additionally, a forensic analysis of the G-Technology external storage drive revealed a text file with instructions on how to configure a computer using a Google Chrome browser to access the Tor network. Most importantly, Huyck's computers had been wiped clean just prior to the search, thus rendering any data unrecoverable. These facts would allow a jury to reasonably infer that the computer used Windows XP and Google Chrome at one point. As we noted, “If evidence consistent with guilt exists, we will not reverse simply because the facts and the circumstances may also be consistent with some innocent explanation.” See Griffith, 786 F.3d at 1102. Accordingly, Huyck's sufficiency-of-the-evidence challenge as to the Pedoboard convictions fails.
2. Hitachi possession count
Huyck was also convicted of knowing possession of child pornography, see 18 U.S.C. § 2252A(a)(5)(B), based on ninety-five thumbnail images discovered on the Hitachi hard drive. Testimony demonstrated that the thumbnail images could only have existed if the full-size, viewable images had been on the hard drive at some time in 2010. Huyck claims, however, that the Government did not prove that he was the person who possessed the Hitachi hard drive when the original, full-size images were last viewable.
In United States v. Manning, 738 F.3d at 945-46, we rejected a similar argument. The defendant in Manning argued that though a disc containing child pornography was found during a search of his home, that fact was insufficient to prove he was the person who possessed the disc. Id. at 946. In affirming the conviction, we focused on the defendant's living arrangements and the abundance of circumstantial evidence indicating his knowledge and interest in child pornography. See id. Specifically, the defendant “lived alone in his home when the disc was recovered from the desk where the laptop was seized,” and the defendant's “extensive knowledge of, and interest in, child pornography [was] probative as circumstantial evidence regarding [his] knowing possession of the Memorex disc.” Id. That reasoning applies equally here.
First, though the ninety-five thumbnail images on the Hitachi hard drive were not viewable without special software, they nonetheless constituted evidence of prior possession of child pornography. See United States v. Reed, 641 F.3d 992, 994 n.2 (8th Cir. 2011) (“The presence of child pornography in ․ [inaccessible] orphan files on a computer's hard drive is evidence of prior possession of that pornography.” (quotation and italics omitted)). Additionally, Huyck told law enforcement agents during the search that he was the only adult living at his residence. While Huyck's daughter often stayed with him, she testified that she only used his computer to print school assignments and that she never saw anyone besides Huyck use the downstairs computer. Furthermore, the Hitachi hard drive, just like the disc in Manning, was recovered from Huyck's computer desk—along with his personal belongings, the G-Technology external storage drive, and the Molex thumb drive—and the “downthemall” and OPVA evidence detailing Huyck's “knowledge of, and interest in, child pornography, were probative as circumstantial evidence regarding [Huyck's] knowing possession of the [Hitachi hard drive].” See 738 F.3d at 946. Accordingly, we find that the evidence was sufficient to support the jury's verdict regarding knowing possession of child pornography contained on the Hitachi hard drive.
D. Motion for a New Trial
Huyck's final argument is that the district court abused its discretion in denying his motion for a new trial. He contends that the jury's questions regarding intent, knowledge, and access—as well as the inconsistent response to the special verdict form on the Hitachi receipt count—indicate the jury was confused. This confusion, he alleges, led to an unjust outcome and requires a new trial.
“Upon the defendant's motion, the court may vacate any judgment and grant a new trial if the interest of justice so requires.” Fed. R. Crim. P. 33(a). “The decision to grant a Rule 33 motion is within the sound discretion of the District Court, and we will reverse only for an abuse of that discretion.” United States v. Amaya, 731 F.3d 761, 764 (8th Cir. 2013) (quotation omitted). The district court is permitted to “weigh the evidence, disbelieve witnesses, and grant a new trial even where there is substantial evidence to sustain the verdict,” United States v. Campos, 306 F.3d 577, 579 (8th Cir. 2002) (quotation omitted), though “this broad discretion should be exercised sparingly and with caution,” United States v. Schropp, 829 F.3d 998, 1005 (8th Cir. 2016) (quotation omitted). “Corresponding to the district court's broad discretion is the limited scope of our review: we will reverse the district court's ruling on the motion for new trial only if we find that ruling to be a clear and manifest abuse of discretion.” Amaya, 731 F.3d at 764 (quotation and citation omitted). “We will find a district court abused its discretion if it fails to consider a factor that should have been given significant weight, considers and gives significant weight to an improper or irrelevant factor, or commits a clear error of judgment in considering and weighing only proper factors.” Id. (quotation and citation omitted).
Here, the district court did not abuse its discretion in denying the motion for a new trial. Though Huyck claims the jury instructions confused the jury, he does not identify an improper or erroneous instruction. Indeed, he cannot, as the instructions accurately define the relevant terms and “taken as a whole ․ adequately advise the jury of the essential elements of the offenses charged and the burden of proof required of the government.” United States v. Rice, 449 F.3d 887, 895 (8th Cir. 2006) (quotation omitted).
Instead, his argument centers on the inconsistent response to the verdict form for the Hitachi receipt count. However, we have previously held that the presence of an inconsistent verdict is insufficient justification for a new trial. United States v. McDonald, 826 F.3d 1066, 1073 (8th Cir. 2016). “A jury may acquit a defendant as to one or more charges, for any number of reasons, including an inclination to be merciful, and yet come to the reasonable conclusion that the defendant was guilty of other related charges.” Id. at 1073-74 (quotation omitted). Because “[w]e are reluctant to delve into the minds of jurors to determine the reasons for apparently inconsistent verdicts,” for doing so would be based on “pure speculation,” “we only ask whether the government presented sufficient evidence to support the conviction.” United States v. Opare-Addo, 486 F.3d 414, 416-17 (8th Cir. 2007) (quotation and citation omitted). As noted previously, the Government presented sufficient evidence to support the Pedoboard receipt and access convictions and the Hitachi possession conviction. The district court recited these same facts when it denied Huyck's motion for a new trial. Moreover, the district court acquitted Huyck as to the Hitachi receipt count in an abundance of caution. Accordingly, we cannot say the district court “fail[ed] to consider a factor that should have been given significant weight, consider[ed] and [gave] significant weight to an improper or irrelevant factor, or commit[ted] a clear error of judgment in considering and weighing only proper factors.” Amaya, 731 F.3d at 764 (quotation and citation omitted). Therefore, the district court did not abuse its discretion in denying Huyck's motion for a new trial.
For the foregoing reasons, we affirm the judgment of the district court.
1. The Honorable Joseph F. Bataillon, United States District Judge for the District of Nebraska.
2. Normally, an Internet Service Provider (“ISP”) assigns an IP address to an individual computer using its Internet service and associates the IP address with the physical address of the user. If law enforcement officials know a user's IP address, they can subpoena the user's ISP to provide the physical address.
3. The Honorable Thomas D. Thalken, United States Magistrate Judge for the District of Nebraska.
4. Exhibit 23 was a text file created in 2012 and located on Huyck's Molex thumb drive. It stated, “[H]ttps://opva2pilscvtwmh.onion/ Need to use download manager downthemall is good for some.” Exhibit 24 was a demonstrative exhibit showing how “downthemall” worked. Exhibit 32 was a two-page document showing a search of PedoBoard for “downthemall,” and the document reflected comments where users discuss the utility of “downthemall” for child pornography purposes.
5. Exhibit 16 was a text file located on the G-Technology hard drive containing instructions on how to configure a computer to access the Tor network and the link to the OPVA web address. Exhibit 18 listed Huyck's Firefox browser bookmarks, which also included the link to OPVA. Exhibit 27 was a screenshot of the homepage of the OPVA bookmark in Exhibit 18. Exhibit 28 contained the Tor web address for the Hidden Wiki and OPVA.
GRUENDER, Circuit Judge.