455 F. 3d 990 - United States v. Romm

We are called upon to decide whether, absent a search warrant or probable cause, the contents of a laptop computer may be searched at an international border and, if so, what evidence is sufficient to convict its owner of receiving and possessing child pornography. We also address an error in the jury instructions on the mental state required for knowingly possessing child pornography.

Defendant Stuart Romm connected to the internet from a Las Vegas hotel room and visited websites containing images of child pornography. As Romm viewed the images online and enlarged them on his screen, his computer automatically saved copies of the images to his "internet cache."1 Based on 40 images deleted from his internet cache and two images deleted from another part of his hard drive,2 Romm was convicted of knowingly receiving and knowingly possessing child pornography in violation of 18 U.S.C. §§ 2252A(a)(2), (a)(5)(B). Romm appeals both of these convictions, as well as his concurrent mandatory minimum sentences of ten and fifteen years.

First, Romm claims the evidence of his crime should have been suppressed as the fruits of an unlawful border search. Second, he challenges the sufficiency of the evidence supporting each of his convictions, arguing he cannot be found guilty of possessing or receiving child pornography, when he merely viewed child pornography without "downloading"3 any of it to his hard drive. Third, he claims the refusal of his proffered jury instruction on the statutory definition of a "visual depiction" deprived him of the right to present a defense. Fourth, he argues that the omission of an element from the jury instructions on "knowing possession" and the district court's refusal to supplement the instructions in response to a note from the jury together constitute reversible plain error. Fifth, he challenges the enhancement of his sentences based on prior convictions for predicate offenses.

We have jurisdiction pursuant to 28 U.S.C. § 1291, and for the reasons stated herein, affirm Romm's convictions, but vacate his sentences and remand to the district court for resentencing.

From January 23, 2004 to February 1, 2004, Romm attended a training seminar held by his new employer in Las Vegas, Nevada. When the training seminar ended on February 1, 2004, Romm flew from Las Vegas, Nevada to Kelowna, British Columbia on business.

At the British Columbia airport, Canada's Border Services Agency discovered that Romm had a criminal history and stopped him for questioning. Romm admitted he had a criminal record4 and was currently on probation. Agent Keith Brown then asked Romm to turn on his laptop and briefly examined it. When Brown saw several child pornography websites in Romm's "internet history,"5 Brown asked Romm if he had violated the terms of his probation by visiting these websites. Romm answered "Yes," and also said, "That's it. My life's over."

Meanwhile, Canada's immigration service had decided not to admit Romm into the country. Romm withdrew his application for entry and was placed under detention until the next flight to Seattle. Agent Brown then informed U.S. Customs in Seattle that Romm had been denied entry and possibly had illegal images on his computer. On February 2, 2004, Romm returned to Seattle. At the Seattle-Tacoma airport, Romm was interviewed by Agents Macho and Swenson of Immigration and Customs Enforcement ("ICE").6 The agents told Romm they needed to search his laptop for illegal images, and could arrange for the examination to be completed that night. Romm agreed. He told the agents he had been in sole possession of the laptop for the previous six to eight weeks. He also told the agents he had "drifted" away from his "therapy," and experienced "occasional lapses" during which he would view child pornography. But Romm repeatedly denied having any child pornography on his laptop.

ICE conducted a preliminary forensic analysis of the hard drive in Romm's laptop. When the preliminary analysis revealed ten images of child pornography, Agent Macho confronted Romm with this information and asked Romm why he had lied about having images on his computer. Romm looked down, adopted a "confessional mode," made little eye contact with his interrogators, and said that "he knew[the agents] were gonna find something on the computer." He also stated the agents had every right to arrest him and would probably do so.

Romm then described to the agents how he used Google7 to search for child pornography websites. When he found pictures he liked, Romm would keep them on his screen for five minutes and then delete them. Romm used the terms "save" and "download" to describe this operation. While staying in his hotel room in Las Vegas, Romm viewed child pornography and masturbated twice, while or shortly after viewing the child pornography; he claimed to have then deleted such images. In all, Romm used the internet for approximately six-and-a-half hours during his week-long stay in Las Vegas.

At trial, the government called three witnesses to testify about the forensic analysis of the hard drive in Romm's laptop. First, Agent Camille Sugrue described the preliminary analysis that she conducted with software called "EnCase." With EnCase, it is possible to recover deleted files,8 as well as information showing when the files were created, accessed, or modified. In conducting the preliminary analysis, Sugrue found ten images of child pornography. All of the images she found had been deleted from Romm's hard drive.

Second, Detective Timothy Luckie testified to the results of the full forensic analysis of Romm's hard drive. Luckie confirmed that all of the child pornography on Romm's computer had been deleted. The vast majority of the images Luckie found had been deleted from Romm's internet cache. EnCase did not reveal when the files had been deleted. Luckie's analysis also showed that Romm had enlarged a few smaller "thumbnail"9 images in the internet cache.

Luckie next explained how files in the internet cache are deleted. First, on the default setting, the web browser automatically empties the internet cache when it reaches a given size. Second, the user can instruct the browser to empty the internet cache. Third, users who know where the internet cache is located can go into the cache and manually delete the files, rather than effect the deletions automatically through the web browser's default setting. EnCase did not reveal the settings on Romm's web browser, or how his internet cache had been emptied. Luckie opined "through experience and training," however, that Romm either had instructed his browser to empty the cache or had deleted the files manually. Luckie also noted Romm had erased his internet history at 2:25 p.m. on February 2, 2004, the same afternoon that Canada's Border Services Agency placed Romm on a flight back to Seattle.

Finally, Luckie testified that files in the internet cache are accessible, albeit "system-protected." A user who knows how to find the internet cache can view the images stored there. Once the user views the image, the user "can print, rename, [or] save [it] elsewhere, the same thing you can do with any other file." The government's third expert witness, Darryl Cosme, exhibited to the jury 42 images of child pornography recovered from Romm's hard drive. He told the jury the provenance of some images, when each image was saved to the cache, and whether that image was a thumbnail or a full-sized picture. Cosme identified several websites in the internet history as related to child pornography.

Romm's expert witness, Thomas Keller, testified how the internet cache is "system-protected." According to Keller, "system-protection" blocks any user from accessing the cache, except by means of "system-commands." If, however, the user executes a system-command notwithstanding the computer's warning, he can copy the cached image to another location on the hard drive or view the image by copying it into an open program. Keller also testified that people delete their internet history and internet cache for legitimate reasons. Finally, Keller testified he found no evidence Romm ever went into the internet cache, or accessed the files there.

Before trial, Romm moved to suppress the evidence obtained through the border search of his laptop and moved to force the government to elect between multiplicitous counts. The court orally denied both motions. After a four-day trial, the jury deliberated for six hours and found Romm guilty of both possessing and receiving child pornography. At sentencing, the court found Romm had committed a predicate offense under 18 U.S.C. § 2252A(b), and accordingly imposed concurrent mandatory minimum sentences of ten and fifteen years. Romm then filed a timely notice of appeal.

First, we address whether the forensic analysis of Romm's laptop falls under the border search exception to the warrant requirement. We review the legality of a border search de novo. United States v. Okafor, 285 F.3d 842, 845 (9th Cir.2002). Under the border search exception, the government may conduct routine searches of persons entering the United States without probable cause, reasonable suspicion, or a warrant. See United States v. Montoya de Hernandez, 473 U.S. 531, 538, 105 S.Ct. 3304, 87 L.Ed.2d 381 (1985). For Fourth Amendment purposes, an international airport terminal is the "functional equivalent" of a border. See Okafor, 285 F.3d at 845 (citing Almeida-Sanchez v. United States, 413 U.S. 266, 272-73, 93 S.Ct. 2535, 37 L.Ed.2d 596 (1973)). Thus, passengers deplaning from an international flight are subject to routine border searches.

Romm argues he was not subject to a warrantless border search because he never legally crossed the U.S.-Canada border. We have held the government must be reasonably certain that the object of a border search has crossed the border to conduct a valid border search. See United States v. Corral-Villavicencio, 753 F.2d 785, 788-89 (9th Cir.1985); United States v. Tilton, 534 F.2d 1363, 1366-67 (9th Cir. 1976); United States v. Garcia, 415 F.2d 1141, 1144 (9th Cir.1969). In all these cases, however, the issue was whether the person searched had physically crossed the border. There is no authority for the proposition that a person who fails to obtain legal entry at his destination may freely reenter the United States; to the contrary, he or she may be searched just like any other person crossing the border. See United States v. 1903 Obscene Magazines, 907 F.2d 1338, 1341 (2d. Cir.1990) (seizure of a shipment of magazines rejected by Canada "clearly permissible" as a border search); People v. DeLoach, 58 Misc.2d 896, 297 N.Y.S.2d 220, 222-23 (1969) (travelers denied entry by Canada for refusal to pay a duty properly searched without a warrant); see also United States v. Adams, 1 F.3d 1566, 1577-78 (11th Cir. 1993); United States v. Stanley, 545 F.2d 661, 666 (9th Cir.1976).

Nor will we carve out an "official restraint"10 exception to the border search doctrine, as Romm advocates. We assume for the sake of argument that a person who, like Romm, is detained abroad has no opportunity to obtain foreign contraband. Even so, the border search doctrine is not limited to those cases where the searching officers have reason to suspect the entrant may be carrying foreign contraband. Instead, "`searches made at the border .. . are reasonable simply by virtue of the fact that they occur at the border.'" United States v. Flores-Montano, 541 U.S. 149, 152-53, 124 S.Ct. 1582, 158 L.Ed.2d 311 (2004) (quoting United States v. Ramsey, 431 U.S. 606, 616, 97 S.Ct. 1972, 52 L.Ed.2d 617 (1977)). Thus, the routine border search of Romm's laptop was reasonable, regardless whether Romm obtained foreign contraband in Canada or was under "official restraint."

Finally, and for the first time in his reply brief, Romm argues the search of his laptop was too intrusive on his First Amendment interests to qualify as a "routine" border search. See generally Okafor, 285 F.3d at 846 (noting the difference between routine and non-routine searches). We decline to consider this issue here because "arguments not raised by a party in its opening brief are deemed waived." See Smith v. Marsh, 194 F.3d 1045, 1052 (9th Cir.1999). Therefore, evaluating the border search of Romm's laptop solely as a routine search, we hold the district court correctly denied Romm's motion to suppress.11

Next, Romm challenges the sufficiency of the evidence that he committed the acts of "possessing" and "receiving" child pornography. The sufficiency of the evidence is reviewed de novo. See United States v. Shipsey, 363 F.3d 962, 971 n. 8 (9th Cir.2004). "There is sufficient evidence to support a conviction if, `viewing the evidence in the light most favorable to the prosecution, any rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt.'" Id. (quoting Jackson v. Virginia, 443 U.S. 307, 319, 99 S.Ct. 2781, 61 L.Ed.2d 560 (1979)). Romm concedes there was sufficient evidence for the jury to find he acted with the requisite mental state of "knowingly," but rather contends that the act he committed was merely the viewing of child pornography, not the possession or receipt of it. We disagree. In the electronic context, a person can receive and possess child pornography without downloading it, if he or she seeks it out and exercises dominion and control over it. See United States v. Tucker, 305 F.3d 1193, 1204 (10th Cir.2002), cert. denied, 537 U.S. 1223, 123 S.Ct. 1335, 154 L.Ed.2d 1082 (2003) ("Tucker II"). Here, we hold Romm exercised dominion and control over the images in his cache by enlarging them on his screen, and saving them there for five minutes before deleting them. While the images were displayed on Romm's screen and simultaneously stored to his laptop's hard drive, he had the ability to copy, print, or email the images to others. Thus, this evidence of control was sufficient for the jury to find that Romm possessed and received the images in his cache.

As we explain below, whether Romm "received" the images in his cache depends on whether he knowingly took possession of them. Thus, we begin by analyzing his conviction for knowingly possessing child pornography. It is a federal crime to "knowingly possess[ ] any book, magazine, periodical, film, videotape, computer disk, or any other material that contains an image of child pornography. . . ." 18 U.S.C. § 2252A(a)(5)(B). "Child pornography" is defined as a "visual depiction," id. § 2256(8), and the term "visual depiction" "includes undeveloped film and videotape, and data stored on computer disk or by electronic means which is capable of conversion into a visual image." Id. § 2256(5) (emphasis added).

Romm's first argument is that files in the internet cache are not "visual depictions" and, therefore, lie beyond the reach of 18 U.S.C. § 2252A. Specifically, Romm argues the files in the cache are not "data ... which is capable of conversion into a visual image," because they must be copied to another location on the disk before they are fully accessible. As Romm's 8274 expert witness, Thomas Keller, testified, the cache is a "system-protected" area, which the operating system tries to prevent users from accessing by displaying a warning that access involves an "unsafe" system-command. The user can, however, override the warning, and open and view the cached files, by executing a system-command. The following testimony by Keller is pertinent here:

Q—What would a user of Windows XP Pro have to do to view [the cached] image if off line?

A—If he's off line, ..., you have to physically move that image to another file folder. You could either drag it to another one, copy it and paste it to an open window [or] to [ ] some kind of [ ] software that would allow you to see images or cut it and paste it to another folder.

Keller further explained the user could perform the above operation by right-clicking his mouse and choosing from among a limited set of system-commands. Thus, the user can access the files in the cache, and once he accesses them, the user can, according to the government's expert, "print, rename, [or] save [the files] elsewhere, the same thing you can do with any other file."

In essence, Romm's argument is that the cached files do not become "visual depictions" until the user takes the additional step of converting them into ordinary files. The statute, however, speaks of data files that are capable of conversion into a viewable form, not data files that are immediately viewable without any further affirmative steps. See 18 U.S.C. § 2256(5). Here, Romm could convert the image files in his internet cache into a viewable form by right-clicking his mouse. Also, when Romm had the images displayed on his screen that were contemporaneously stored to the cache, he could copy, print, or email them to another person, just as with ordinary files. Therefore, we hold there was sufficient evidence from which the jury could find that the images stored in Romm's internet cache were "visual depictions."12

Second, Romm challenges the sufficiency of evidence of his control over the images in the internet cache. We begin with the text of 18 U.S.C. § 2252A. We interpret the term "knowing possession" according to its plain meaning, and presume Congress intended to apply traditional concepts of possession. See United States v. Mohrbacher, 182 F.3d 1041, 1048-49 (9th Cir.1999); Tucker II, 305 F.3d at 1204. "Possession" is "[t]he fact of having or holding property in one's power; the exercise of dominion over property." BLACK'S LAW DICTIONARY 1183 (7th Ed.1999). Thus, to establish possession, "`[t]he government must prove a sufficient connection between the defendant and the contraband to support the inference that the defendant exercised dominion and control over [it].'" United States v. Carrasco, 257 F.3d 1045, 1049 (9th Cir.2001) (quoting United States v. Gutierrez, 995 F.2d 169, 171 (9th Cir.1993) (internal quotation marks and alterations omitted)).

In Mohrbacher, 182 F.3d at 1048-1051, we held that a defendant who downloaded child pornography could be prosecuted for receiving child pornography, but not for transporting it. Our reasoning in Mohrbacher also clearly implied that a defendant who downloads child pornography can be prosecuted for knowing possession of child pornography. See id. at 1048. Recently, in United States v. Gourde, 440 F.3d 1065, 1070-73 (9th Cir.2006) (en banc), we addressed the evidence necessary to uphold a search warrant for child pornography located on a defendant's computer. There, we found the search warrant valid based on the defendant's continued, paying membership in a child pornography website, and the likelihood that "[illegal] images were almost certainly retrievable from his computer if he had ever received or downloaded them." Id. at 1071. Even though the affidavit supporting the warrant did not attest that the defendant had downloaded any files, it nonetheless provided the requisite "`fair probability' Gourde had, in fact, received or downloaded images." Id. (citing Illinois v. Gates, 462 U.S. 213, 240, 103 S.Ct. 2317, 76 L.Ed.2d 527 (1983)). Neither Gourde nor Mohrbacher, however, answers the question before us today: whether a defendant may be convicted of possessing and receiving images of child pornography found in the internet cache.

Of our sister circuits, only the Tenth Circuit has addressed whether a defendant can be convicted of possessing child pornography accessed from the internet and contemporaneously stored to the internet cache. See Tucker II, 305 F.3d at 1204-05. In Tucker II, the defendant was convicted of possessing thousands of images of child pornography in his internet cache and deleted from his hard drive. Id. at 1198; see also United States v. Tucker, 150 F.Supp.2d 1263, 1265-66 (D.Utah 2001) ("Tucker I"), aff'd by Tucker II, 305 F.3d at 1204-05. In Tucker, the defendant also saved one image to his hard drive, and had either copied or attempted to copy a set of images to a floppy diskette. See Tucker I, 150 F.Supp.2d at 1265-66. The Tenth Circuit held that the images in Tucker's internet cache furnished sufficient evidence to support his conviction for possession of child pornography. See Tucker II, 305 F.3d at 1199, 1204-05. Specifically, the evidence at trial established the defendant's unfettered access to the internet cache, his intent to seek the images out, and his knowledge of his web browser's caching function. See id. Therefore, since Tucker "knew his browser cached the image files," the Tenth Circuit held that "each time Tucker intentionally sought out and viewed child pornography with his Web browser he knowingly acquired and possessed the images." Id. at 1205.13 We agree generally with Tucker's analysis. It is true that the images possessed by the defendant must be "contain[-ed]" on a "computer disk or other [tangible] material." 18 U.S.C. § 2252A(a)(5)(B); United States v. Lacy, 119 F.3d 742, 747-48 (9th Cir.1997). It is also true that "a defendant may be convicted [of possessing child pornography] only upon a showing that he knew that the [disks] contained an unlawful visual depiction." See id. Therefore, to possess the images in the cache, the defendant must, at a minimum, know that the unlawful images are stored on a disk or other tangible material in his possession.

However, Romm exercised control over the cached images while they were contemporaneously saved to his cache and displayed on his screen. At that moment, as the expert testimony here established, Romm could print the images, enlarge them, copy them, or email them to others. No doubt, images could be saved to the cache when a defendant accidentally views the images, as through the occurrence of a "pop-up,"14 for instance. But that is not the case here.

By his own admission to ICE, Romm repeatedly sought out child pornography over the internet. When he found images he "liked," he would "view them, save them to his computer, look at them for about five minutes [ ] and then delete them." Either while viewing the images or shortly thereafter, Romm twice masturbated. He described his activities as the "saving" and "downloading" of the images. While the images were displayed on screen and simultaneously stored to his cache, Romm could print them, email them, or save them as copies elsewhere. Romm could destroy the copy of the images that his browser stored to his cache. And according to detective Luckie, Romm did just that, either manually, or by instructing his browser to do so. Forensic evidence showed that Romm had enlarged several thumbnail images for better viewing. In short, given the indicia that Romm exercised control over the images in his cache, there was sufficient evidence for the jury to find that Romm committed the act of knowing possession.

Romm contends that the rule of lenity must caution us against construing the terms "possession" and "receipt" in 18 U.S.C. § 2252A to encompass cached internet files. The rule of lenity, which is rooted in considerations of notice, requires courts to limit the reach of criminal statutes to the clear import of their text and construe any ambiguity against the government. See, e.g., Ladner v. United States, 358 U.S. 169, 177, 79 S.Ct. 209, 3 L.Ed.2d 199 (1958); McBoyle v. United States, 283 U.S. 25, 27, 51 S.Ct. 340, 75 L.Ed. 816 (1931); United States v. Napier, 861 F.2d 547, 548 (9th Cir.1988). Here, however, the statute employs the well-known concepts of "possession" and "receipt," each of which depends on the evidence of control. Thus, this is not a case where the language of the criminal statute is ambiguous or, by its plain meaning, too narrow to embrace the government's theory of prosecution.

In a recent dissent, one of our colleagues has drawn on the rule of lenity to opine that images saved to the cache are neither "received" nor "possessed" within the meaning of 18 U.S.C. § 2252. See Gourde, 440 F.3d at 1080-82 (Kleinfeld, J., dissenting). Assuming a lack of control over the images saved to the cache, our colleague has opined that a person who looks at child pornography over the internet no more "receives" it, than a visitor to the Louvre "receives" a visualization of the Mona Lisa. See id. at 1082. However, as the record here indicates, Romm had access to, and control over, the images that were displayed on his screen and saved to his cache. He could copy the images, print them or email them to others, and did, in fact, enlarge several of the images. This control clearly differentiates Romm's conduct from that of a visitor to the Louvre who gazes on the Mona Lisa, even if we put aside the stringent museum rules against photographing or copying without museum permission.

In short, we hold there was sufficient evidence for the jury to conclude that the images in the cache were "visual depictions" because they could be accessed and viewed by Romm. Further, given Romm's ability to control the images while they were displayed on screen, and the forensic and other evidence that he actually exercised this control over them, there was sufficient evidence to support the jury's finding that Romm possessed three or more images of child pornography. Coupled with Romm's conceded knowledge that the images were saved to his disk, the prosecution produced sufficient evidence to establish every element of knowingly possessing child pornography under 18 U.S.C. § 2252A.

Since Romm knowingly possessed the files in the internet cache, it follows that he also knowingly received them. Federal law makes it a crime to "knowingly receiv[e] or distribut[e] ... any child pornography that has been mailed, or shipped or transported in interstate or foreign commerce. . . ." 18 U.S.C. § 2252A(a)(2). Generally, federal statutes criminalizing the receipt of contraband require a "knowing acceptance or taking of possession" of the prohibited item. See United States v. Lipps, 659 F.2d 960, 962 (9th Cir.1981) (per curiam) (construing 18 U.S.C. § 922(h)); see also, e.g., United States v. Ladd, 877 F.2d 1083, 1087 (1st Cir.1989) (receiving counterfeit money); United States v. Strauss, 678 F.2d 886, 893-94 (11th Cir.1982) (receiving stolen property). Moreover, we have applied this principle to 18 U.S.C. § 2252's prohibitions on receiving and possessing child pornography. See Mohrbacher, 182 F.3d at 1048 ("An individual who ... takes possession or accepts delivery of the visual image; ... has therefore certainly received it."). Specifically, in Mohrbacher, we held that downloading child pornography constitutes both the act of possession and receipt. Id. Here, we have held that the files stored to the cache were possessed by Romm, and thus, that the caching of files, on the facts of this case, is analogous to downloading for the purpose of possession. By analogy, it follows under Mohrbacher that knowingly taking possession of the files in the cache also constitutes the "knowing receipt" of those files. Therefore, we hold that the evidence was sufficient to sustain Romm's conviction for receiving child pornography.15

A. Refusal of Romm's Proffered Instruction on "Visual Depiction"

Next, Romm claims the district court deprived him of the right to present his theory of the case by refusing his proffered jury instruction on the statutory definition of "visual depiction." If the defense theory has a basis in fact and law, the failure to give a proffered jury instruction on that theory is per se reversible error. See United States v. Escobar de Bright, 742 F.2d 1196, 1201 (9th Cir.1984). However, "it is not reversible error to reject a defendant's proposed instruction on his theory of the case if other instructions, in their entirety, adequately cover that defense theory." United States v. Mason, 902 F.2d 1434, 1438 (9th Cir.1990). We review de novo whether the jury instructions adequately cover the defense's theory of the case. See United States v. Duran, 59 F.3d 938, 941 (9th Cir.1995).

During the jury instructions conference, Romm proposed that the court instruct the jury on the legal definition of "visual depiction" and require the jury to find whether Romm knowingly received "visual depictions" onto the hard drive of his laptop computer. This instruction was necessary, Romm argued, to cover the "storage" element of the offense. The court refused Romm's proffered instruction because "storage is not an element" of the offense and because Romm had, in any event, conceded that the cached files were "visual depictions" by stipulating that the cached files were "child pornography." We need not address Romm's stipulation, however, because we hold that the instructions given adequately covered Romm's theory of the case. The jury was instructed that "a person has received something if they [sic] have knowingly come into possession of it." The instructions defined "possession" as "know[ing] of [an object's] presence and ha[ving] the power and intention to control it." The court's definition of "receiving," as knowingly taking possession, thus required the jury to find whether Romm had possession and control over the images in the cache. Romm's "visual depictions" defense was premised on the notion that files in the cache are too inaccessible to be the object of "possession" or "receipt" under § 2252A. In essence, he challenged whether he had access to and control over the images in the cache. The instructions on receiving, by incorporating a finding of control, encompassed Romm's theory of the case.

B. Instructions on the Mens Rea of Knowing Possession

Next, Romm claims the jury instructions on the elements of knowing possession are plainly erroneous under our decision in Lacy, 119 F.3d at 747-50. He also challenges the district court's refusal to supplement those instructions in response to a note from the jury expressing confusion over whether Romm had to know the images were located on his disk.

Since Romm failed to object on either ground, we review for plain error. See, e.g., United States v. Recio, 371 F.3d 1093, 1099-1102 (9th Cir.2004). Under this standard, we have discretion to reverse only if there is (1) error, (2) that is "plain"—i.e., obvious—under current law, and (3) that "affect[s] [Romm's] substantial rights." See United States v. Olano, 507 U.S. 725, 732-34, 113 S.Ct. 1770, 123 L.Ed.2d 508 (1993). If these three elements of plain error are established, we will exercise our discretion to reverse only if (4) leaving the error uncorrected would "`seriously affect[ ] the fairness, integrity or public reputation of judicial proceedings.'" Id. at 736, 113 S.Ct. 1770 (quoting United States v. Atkinson, 297 U.S. 157, 160, 56 S.Ct. 391, 80 L.Ed. 555 (1936)).

In Lacy, 119 F.3d at 747-50, the defendant appealed his conviction on one count of knowingly possessing "3 or more matters" that contained visual depictions of child pornography. The defendant there had downloaded several pictures of child pornography. He claimed, however, not to know the images were present on his disk because he had tried to delete the files, yet failed to do so. Id. at 745. The jury was instructed to find whether "[1] ... Lacy knowingly possessed `the matters charged' and [2] ... those `matters contained a visual depiction of a minor engaging in sexually explicit conduct.'" Id. at 747 (quoting jury instructions); see also id. at 748 n. 9 (full text of jury instructions). But the instructions failed to "require a finding that Lacy knew the matters contained the visual depictions." Id. at 747 (emphasis in original). Applying United States v. X-Citement Video, Inc., 513 U.S. 64, 72-73, 115 S.Ct. 464, 130 L.Ed.2d 372 (1994),16 we held that the instructions, by failing to require a finding that Lacy knew the files were on his disks, omitted an element of the offense. See Lacy, 119 F.3d at 747 ("[A] defendant may be convicted under § 2252(a)(4)(B) only upon a showing that he knew that the matter in question contained an unlawful visual depiction."). Without addressing whether this error was "plain" or prejudicial, we affirmed at step four of Olano because of the overwhelming evidence of Lacy's knowledge. See Lacy, 119 F.3d at 749-50.

Here, the jury instructions on knowing possession of child pornography omitted the same element of knowledge we addressed in Lacy. The entire instructions on knowing possession read as follows:

Defendant Stuart Romm is charged in Count 2 of the Indictment with Knowing Possession of Child Pornography, in violation of Title 18, United States Code, Section 2252A(a)(5)(B). In order for Defendant Romm to be found guilty of that charge, the Government must prove each of the following elements beyond a reasonable doubt:

First, That Defendant Stuart Romm knowingly possessed a laptop computer with a hard drive that contained three or more images of child pornography;

Second, That the images of child pornography knowingly possessed by Defendant Stuart Romm, had been mailed, shipped, or transported in interstate or foreign commerce by any means, including by computer.

A person has possession of something if the person knows of its presence and has physical control of it, or knows of its presence and has the power and intention to control it.

(Third emphasis added.) Just as in Lacy, the instructions failed explicitly to require the jury to find whether Romm knew images of child pornography were present on his disk.

Furthermore, the jury sent out a note after six hours of deliberations expressing confusion over the Lacy standard. The note read:

We need clarification on the [Possession] Charge. Are we trying to determine if Mr. Romm knew that he possessed three or more images could [sic] be found on his hard drive. Or is simply viewing pictures considered knowing of its [sic] presence and being in control of it.

The court, with the affirmative agreement of both counsel,17 referred the jury back to the original, flawed instructions and told the jury that no further guidance could be given.

The government contends that the instructions are distinguishable from the instructions given in Lacy because of the second instruction's reference to "images ... knowingly possessed by Romm." But this phrase is in fact a peremptory instruction that Romm knowingly possessed the unlawful images; not that the jury should determine whether he knowingly possessed them. The jury was told that they only needed to find whether the images that Romm "knowingly possessed" had a nexus to interstate commerce. Rather than requiring a finding that Romm knowingly possessed the images, the instructions dictated this finding.

Given that we squarely addressed the same issue in Lacy, we conclude that the instructions were in error and that the error was "plain."18 We assume, without deciding, that the omission of the knowledge element affected Romm's substantial rights. We also assume, without deciding, that the district court's failure to supplement the flawed instructions was plainly an abuse of discretion. See United States v. Southwell, 432 F.3d 1050, 1053 (9th Cir. 2005) ("Failure to provide the jury with a clarifying instruction when it has identified a legitimate ambiguity in the original instructions is an abuse of discretion."). Even so, we nonetheless may affirm if the record contains "strong and convincing evidence" that the missing element of the crime was adequately proved by the prosecution, such that it is "extremely unlikely" that a properly instructed jury would not have convicted. See United States v. Perez, 116 F.3d 840, 848 (9th Cir.1997) (en banc). Here, while Romm disputed whether he knew the images were being stored to the cache, the evidence of his knowledge of the presence of the visual depictions in his cache and their content was overwhelming.

When stopped and interviewed by ICE, Romm was in a hurry to continue his travels and asserted that the laptop contained his company's proprietary software. He also acknowledged Canadian authorities knew about his prior conviction. It was against this background that Romm acknowledged having "lapses" from his "therapy," and viewing images of child pornography. He also acknowledged to Agent Swenson that he had "saved" and viewed the images, for up to five minutes, but claimed to have deleted them. Importantly, he said he had "saved" or "downloaded" the images to his computer in Las Vegas.

After Agent Macho confronted Romm with Swenson's relation that ten images of child pornography had been found19 and questioned Romm as to why he had lied to Macho, Romm did not look surprised, or state he was surprised; rather, he let his shoulders slump and looked down at the ground rather than maintain eye contact with Agent Macho, in a demeanor that Agent Macho described as "confessional." Then, Romm stated that "he knew [they] were gonna find something on the computer."

In addition to his statements, the forensic analysis of Romm's computer showed that he had erased his internet history at 2:25 p.m. on February 2, 2004, the same afternoon he was placed on a flight back to Seattle. Romm's internet cache was completely empty, and the government's expert opined through his experience and training that Romm had manually deleted the files or instructed his browser to empty it. Therefore, the forensic evidence strongly corroborated Romm's direct admission that he knew the images were on his disk.

In sum, because of the overwhelming evidence of Romm's knowledge, we decline to exercise our discretion to correct the plain error in the jury instructions on knowing possession.

At sentencing, the government claimed Romm's prior convictions under Florida law for promoting sexual performance by a child and child exploitation by means of a computer were predicate offenses under 18 U.S.C. § 2252A(b). The district court found the Florida statutes were overly broad, but also that Romm's convictions qualified as predicate offenses under the modified categorical approach. The parties agreed at argument that the categorical approach applies but that the record currently does not support the sentence enhancement. In accordance with their agreement, we vacate Romm's sentences and remand for resentencing on an open record, allowing the government to supplement the record necessary to apply the modified categorical approach.

In sum, we hold first that the ICE's forensic analysis of Romm's laptop was permissible without probable cause or a warrant under the border search doctrine. Second, we hold there was sufficient evidence for the jury to find the images in Romm's internet cache were visual depictions, and that he both received and possessed these images. Third, we hold the district court's refusal of Romm's proffered instruction defining "visual depiction" was not error because the instructions defining possession adequately covered Romm's theory of the case. Fourth, while we find the instructions on "knowing possession" were plainly in error under our decision in Lacy, we decline to reverse Romm's conviction due to the overwhelming evidence of the required knowledge. Fifth, we vacate Romm's sentences and remand for resentencing in accordance with the stipulation reached by the parties.

Accordingly, Romm's convictions are AFFIRMED. His sentences are VACATED, and the case is REMANDED.