Court of Appeals of Ohio, Eighth District, Cuyahoga
Criminal Appeal from the Cuyahoga County Court of Common
Pleas Case No. CR-16-611747-A
ATTORNEY FOR APPELLANT Eric M. Levy
ATTORNEYS FOR APPELLEE Michael C. O'Malley Cuyahoga
County Prosecutor BY: Carl Sullivan Assistant County
BEFORE: Boyle, J., E.A. Gallagher, A.J., and Laster Mays, J.
J. BOYLE, J.
Defendant-appellant, Amir Rubin, appeals his convictions and
sentence. He raises five assignments of error for our review:
1. The trial court erred when it imposed consecutive
sentences absent any analysis of the statutory criteria and
where its findings under R.C. 2929.14(C)(4) are not supported
by the evidence and facts in the record.
2. The trial court erred when it imposed a ten-year prison
sentence upon appellant the length of which is not supported
by the record.
3. The trial court erred in finding appellant guilty where
the evidence presented at trial was insufficient to overcome
appellant's Crim.R. 29 motion and to support a conviction
at the close of the evidence.
4. The trial court erred in finding appellant guilty after a
jury trial where the manifest weight of the evidence did not
support appellant's convictions.
5. The trial court committed plain error when it failed to
instruct the jury to find whether minors depicted were real
children or virtual images.
Finding no merit to his arguments, we affirm.
Procedural History and Factual Background
In November 2016, Rubin was indicted on 95 counts related to
child pornography: 21 counts of pandering sexually oriented
matter involving a minor in violation of R.C. 2907.322(A)(1)
and (2), felonies of the second degree; 30 counts of illegal
use of a minor in nudity-oriented material or performance in
violation of R.C. 2907.323(A)(1), felonies of the fifth
degree; 15 counts of pandering sexually oriented matter
involving a minor in violation of R.C. 2907.322(A)(5),
felonies of the fourth degree; 28 counts of illegal use of a
minor in nudity-oriented material or performance in violation
of R.C. 2907.323(A)(3), felonies of the fifth degree; and one
count of possessing criminal tools in violation of R.C.
2923.24(A), a felony of the fifth degree. Rubin pleaded not
guilty to all charges, and the case proceeded to a jury trial
where the following evidence was presented.
David Frattare, director of state investigations and
commander of the Internet Crimes Against Children Task Force
("ICAC") for the Cuyahoga County Prosecutor's
Office, testified that between November 2014 and October
2015, the task force conducted an investigation that
identified two separate "IP addresses,"
126.96.36.199 and 188.8.131.52, which were advertising
child pornography files or making them available to others.
An IP address is a unique address for an individual computer
that is using the internet. Investigator Frattare prepared a
subpoena to Time Warner Cable to obtain the physical location
of the IP addresses in question. He learned that the name on
the account of both IP addresses belonged to Yeda, L.L.C., a
business located in Cleveland, Ohio.
Investigator Frattare explained that he and other officers
began the investigation by looking at a "peer to peer
program" that is "known as E-Mule" Between
November 8, 2014 and March 2, 2015, the first IP address,
184.108.40.206, made 11 files of suspected child pornography
available for sharing. The investigators were able to
download 5 complete and 6 partial files, and determined that
6 of the 11 files were child pornography.
Between June 12, 2015 and October 19, 2015, the investigators
attempted to download 54 files of known or suspected child
pornography from the second IP address, 220.127.116.11. Of
those 54 files, they downloaded 7 complete and 4 partial
files, and determined that 7 of the 54 were child
pornography. Based on this information, the investigators
obtained a search warrant of the business that used the IP
Investigator Frattare and other officers executed the search
warrant. Rubin was the only person there at the time. There
were several rooms, including a main office area, a large
work area, supply areas, a garage, and a laundry room. The
investigators found two computers in the office area. One
computer was on a "simple" desk with a couple of
drawers. The "simple" desk had envelopes on it with
Shlomo Rubin's name on them. Shlomo Rubin's personal
items were also on the desk. Shlomo Rubin is the
The other computer, a laptop, was on a "more modern desk
with a credenza above it," which they determined
belonged to Rubin. The laptop was running and had "the
E-Mule icon for the peer to peer program" on the
desktop. It also had a "U Torrent.exe" icon, a
shortcut to the "Bit Torrent network," which is
another peer-to-peer network. There was a men's wallet
beside the laptop containing Rubin's credit cards and a
driver's license. There was a credit card belonging to
Rubin on the desk next to the computer. There were also
several name badges on the desk from conferences or trade
shows with Rubin's name on them.
Investigator Frattare explained that when they execute search
warrants, they use a "mobile investigations
vehicle," which is a van divided into two sections. The
van has an interview section in the back, and various
"forensic work stations" in the front that allow
the officers to examine hardware and software devices in the
Rubin voluntarily spoke to the investigators during the
search. He told them that he and his father were the only
people who worked there. Rubin agreed that Bit Torrent and
E-Mule were installed on his computer. He also agreed that he
used the programs for personal use, not business. He told the
officers that he used peer-to-peer networks to download
"T.V., music and movies."
Jason Howell, a digital forensics investigator for the
Cuyahoga County's Prosecutor's Office, assigned to
the ICAC, testified that he operates mobile investigations
when investigators conduct "on scene triage examinations
of computer evidence during search warrants." He was in
charge of the mobile investigations vehicle when
investigators executed the search warrant at Yeda, L.L.C.
Investigator Howell said that the first device he examined on
the scene was a Dell laptop computer, which was registered to
"Rubin-97F5C5643" Investigator Howell explained
that before he examined the laptop, he attached it to a
"hardware write block device," which made it
"read only." With the "write blocker,"
examiners could not alter what was on the computer in any
way. Investigator Howell said that when he examined the
laptop, it was in the process of sharing two child
pornography files titled "Evelyn 12YO Evelyn 2010"
and "PTHC 2009 New Brianna Jesse." "PTHC
stands for preteen hardcore." There were also 16 files
in the "temp folder" that the user was trying to
Investigator Howell testified that he found "search
terms" on the E-Mule software that a user of the laptop
entered into the program. The user of the Dell laptop entered
search terms that included "Nastia Mouse," which he
explained was the name of a series of images of females from
infants to teens in various states of nudity. It also
included other common child pornography search terms such as
"PTHC, PTSC, 16YO, 15YO, 14YO, 12YO, Evelyn,
jailbait" PTSC "stands for preteen softcore."
Investigator Howell discovered that multiple "USB
devices" had been connected to the laptop. When a file
is accessed, "Windows operating system" creates
link files. The files that the user connected to the laptop
were files of child pornography relating to children from 3
to 16 years old. He also found child pornography videos on
the computer; one was titled, "12Y Evelyn blow
job." In sum, Investigator Howell discovered hundreds of
child pornography images and videos on the laptop computer.
He also examined an external hard drive and USB drive that
were found in the storage area of the building. These devices
also had hundreds of child pornography videos and images. The
child pornography files were "created" between 2008
At the close of the state's case, Rubin moved for a
Crim.R. 29(A) acquittal that the trial court overruled. Rubin
presented one witness on his behalf, Mark Vassel, a
self-employed "computer forensic examiner."
Vassel testified that he started his company, Midwest Data
Group, in September 2001. Before starting his own company, he
worked for Olmsted Township Police Department. He became a
police officer in 1991. Vassel testified his examination
showed that someone accessed files on the laptop computer
after the search warrant was executed (at 11:23 a.m.) but
before the "write blocker" was installed (at 11:47
a.m.). He explained that "[t]he "write
blocker" is "essentially an evidence bag" that
"protects the integrity of the data of the information
stored on the computer." Thus, Vassel stated that
Investigator Howell could not have been correct when he
stated that no one accessed the laptop before the write
blocker was installed. Vassel further stated that in his
opinion, the laptop was not running the E-Mule program at the
time the computer was seized.
At the close of his case, Rubin renewed his Crim.R. 29(A)
acquittal that the trial court again denied.
The jury found Rubin not guilty of two counts of
second-degree illegal use of a minor in nudity-oriented
material or performance, one count of second-degree pandering
sexually oriented matter involving a minor, and two counts of
fifth-degree illegal use of a minor in nudity-oriented
material or performance. The jury found Rubin guilty of the
remaining 90 counts.
The trial court merged Counts 54 through 94 into Counts 11
through 51. The state elected to proceed on the higher level
felony counts. Thus, the trial court sentenced Rubin on
Counts 1 through 51. The trial court sentenced Rubin to a
total of ten years in prison; four years each for multiple
counts of second-degree felony pandering in violation of R.C.
2907.322(A)(2) to be served concurrent to each other but
consecutive to the other offenses, three years each for
multiple counts of second-degree felony pandering in
violation of R.C. 2907.322(A)(1) to be served concurrent to
each other but consecutive to the other offenses, and three
years each for multiple counts of second-degree illegal use
of a minor in nudity-oriented material or performance in
violation of R.C. 2907.323(A)(1) to be served concurrent to