The Dual Sovereignty Threat: Maryland State vs. Federal Prosecution

One of the most critical facts to understand is that child pornography offenses in Baltimore County violate both Maryland state law and United States federal law simultaneously. Under the legal doctrine of “dual sovereignty,” both the state and federal governments have the independent authority to prosecute you for the same underlying conduct without violating the double jeopardy clause. The decision of where to file charges often depends on the investigating agency and the specific details of the case.

As a defense lawyer practicing in both court systems, I’ve seen how this plays out. A case might start with a tip to the Baltimore County Police Department, but if the evidence suggests a large collection of images or interstate distribution, federal agencies like the FBI will often take over. It is essential to understand the statutes in both jurisdictions, as the penalties and procedures differ significantly.

Maryland State Law

• Maryland Criminal Law § 11-207 (Possession): Makes it a felony to knowingly possess any material that depicts a minor engaging in a sexual act or sexually explicit conduct. A conviction carries a potential sentence of up to 10 years in prison and/or a $10,000 fine.
• Maryland Criminal Law § 11-208 (Distribution): This is a more serious felony that prohibits producing, financing, promoting, or distributing child pornography. This includes uploading files or using peer-to-peer (P2P) software that shares files. A conviction under this statute carries a potential sentence of up to 20 years in prison and/or a $25,000 fine.

State prosecutions are handled by the Baltimore County State’s Attorney’s Office and are tried in the Baltimore County Circuit Court in Towson.

United States Federal Law

• 18 U.S.C. § 2252A (Possession): The federal possession statute. A conviction carries a sentence of up to 20 years in prison. Crucially, if the defendant has a prior sex offense conviction, this statute imposes a **mandatory minimum sentence of 5 years**.
• 18 U.S.C. § 2252 (Distribution/Transportation): The federal statute for transporting, distributing, receiving, or reproducing child pornography across state lines (which the internet does by default). A first-offense conviction carries a **mandatory minimum prison sentence of 5 years** and a maximum of 20 years. A second offense carries a **mandatory minimum of 15 years**.

Federal prosecutions are handled by the U.S. Attorney’s Office for the District of Maryland and are tried in the U.S. District Court in Baltimore. Federal cases are often more severe due to the application of the rigid U.S. Sentencing Guidelines and the mandatory minimum sentences required by law, which strip judges of much of their sentencing discretion. A defendant in Baltimore County must be prepared for the terrifying possibility of facing the full force of the federal government.

The Digital Investigation: How These Cases Are Built

Child pornography cases are not won or lost based on eyewitness testimony; they are won and lost on digital forensic evidence. Law enforcement agencies have highly sophisticated methods for tracing illicit files from the internet to a specific household. Understanding their process is key to understanding the evidence that will be used against you and where potential vulnerabilities in the government’s case may lie.

In my experience defending these cases, the investigation almost always follows a predictable path, turning an anonymous online action into a search warrant executed at a home in Baltimore County.

1. The IP Address Warrant

The investigation often begins with law enforcement monitoring peer-to-peer (P2P) file-sharing networks like BitTorrent or Gnutella.

• Investigators, using their own computers, search these networks for known child pornography files. They can identify these files instantly using unique digital “fingerprints” called hash values (e.g., MD5, SHA-1).
• When they find a computer sharing one of these files, they record the user’s Internet Protocol (IP) address.
• They then serve a subpoena or search warrant on the Internet Service Provider (ISP), such as Comcast/Xfinity or Verizon, demanding the subscriber information for that IP address at that specific date and time. The ISP provides the name and physical street address associated with the account.

2. The Search Warrant (“Knock and Announce”)

With a physical address in hand, investigators prepare a detailed affidavit and obtain a search warrant from a judge. A team of officers—often from a BCPD cybercrimes unit or a federal task force—will then execute the warrant at the target residence. They will announce their presence and have the authority to seize any and all electronic storage devices: computers, external hard drives, smartphones, tablets, routers, thumb drives, and more.

3. The Forensic Examination

The seized devices are taken to a digital forensics laboratory. There, trained examiners create a perfect, bit-for-bit copy (a “forensic image”) of the hard drives. They use specialized software to:

• Recover Deleted Files: They can often recover files that the user has deleted, even if the recycle bin has been emptied.
• Analyze Internet History: They will examine browser history, search terms, and temporary internet files for evidence of searches for or access to illicit material.
• Examine P2P Software: They will look for evidence of file-sharing software, analyze its configuration files, and identify which files were being shared or downloaded.
• Hash Analysis: They will run a hashing algorithm on all image and video files on the drive. This process compares the hash values of the files against a massive database of hash values from known child pornography images. A “hash hit” is powerful evidence for the prosecution.

The end result is a detailed forensic report that forms the backbone of the government’s case. A knowledgeable defense requires the ability to scrutinize this report for errors, omissions, and alternative interpretations.

Possession vs. Distribution: A Critical Distinction

In the eyes of the law, there is a significant legal and sentencing difference between merely possessing illicit material and actively distributing it. While both are serious felonies, distribution is treated with far greater severity, often involving much longer prison sentences and mandatory minimums at the federal level. A critical aspect of these cases is understanding how the government attempts to prove distribution, especially in the context of P2P file-sharing.

From a defense perspective, one of the first goals is to challenge the evidence of distribution. The line between these two offenses can be blurry, particularly for individuals who may not fully understand how their software operates.

Simple Possession (The “Consumer”)

A pure possession case involves evidence that illicit files were found on a defendant’s device but little or no evidence that the files were shared with others. This could involve files downloaded directly from a website or found in an old email attachment. While still a felony under both Maryland law (§ 11-207) and federal law (18 U.S.C. § 2252A), the sentencing guidelines are generally less severe than for distribution. The core of the charge is the “knowing possession” of the material.

Distribution (The “Trader” or “Producer”)

Distribution involves taking an active role in making the material available to others. This includes:

• Uploading: Actively uploading files to a website, forum, or cloud storage service for others to access.
• Emailing or Messaging: Sending illicit files directly to another person.
• Producing: Creating the illicit material itself, which is the most serious offense of all.

The Peer-to-Peer (P2P) Trap

This is where many individuals find themselves facing distribution charges without intending to be distributors. P2P software, such as BitTorrent, is designed to share files simultaneously while they are being downloaded. When you download a file using this software, your computer automatically makes the pieces you’ve already downloaded available to other users on the network. Law enforcement investigators can easily document this outgoing “sharing” activity. Consequently, an act that the user may have perceived as a simple download (possession) is legally treated by prosecutors as distribution, triggering the harsher penalties of § 11-208 in Maryland or the mandatory minimum sentences of 18 U.S.C. § 2252 at the federal level.

The Maryland § 11-207/208 Case Preparation Ledger

When facing a child pornography investigation, a systematic collection of facts is essential for your defense. Your memory and understanding of your digital environment are critical assets. We developed the **Maryland § 11-207/208 Case Preparation Ledger** as a confidential tool to help clients organize vital information before their first comprehensive meeting with their attorney. This is not legal advice, but a structured framework for a productive legal consultation.

Part 1: The Device & Network Inventory

Create a detailed list of every piece of technology in your home.

• Computers & Laptops: List make, model, operating system, and primary user for each.
• Smartphones & Tablets: List make, model, and primary user.
• Storage Devices: List all external hard drives, USB flash drives, memory cards, and network-attached storage (NAS) drives.
• Network Hardware: List the make and model of your internet modem and Wi-Fi router. Note if the Wi-Fi network is password-protected and who has the password.
• Seized Items: Clearly mark every item that was taken by law enforcement during the search.

Part 2: The User Access Log

Attribution is key. Who could have used the devices?

• List every person who lives in the residence.
• List every person who has had access to your computers or Wi-Fi network in the past year (e.g., frequent guests, relatives, roommates, house sitters).

Part 3: The Software Audit

Be honest about the software on your devices.

• List any peer-to-peer (P2P) or file-sharing software installed (e.g., BitTorrent, uTorrent, FrostWire).
• List any anonymous Browse tools (e.g., Tor Browser) or Virtual Private Network (VPN) services used.

Part 4: The Law Enforcement Interaction Record

Document the search warrant execution in detail.

• What time did the police arrive? Which agency were they from (BCPD, FBI, etc.)?
• What did they say to you? What did you say to them? Write down the conversation as best you can recall.
• Did you sign any documents? Did they ask you to unlock any devices?

Presenting this organized ledger to your attorney provides them with a crucial head start in analyzing the forensic and legal challenges of your case.

Challenging the Evidence: Core Defense Principles

A defense against a child pornography charge is a defense against the government’s evidence. The prosecution’s case is built on a chain of digital data, and every link in that chain must be scrutinized and challenged. The goal is to show that the government cannot prove, beyond a reasonable doubt, that you are the individual who knowingly possessed or distributed the illicit material.

In my decades defending clients in Baltimore County and federal court, I have found that a formidable defense is built on a deep understanding of technology and a rigorous application of constitutional law. The following are fundamental principles we evaluate in every case.

1. Attacking Attribution: “It Wasn’t Me”

The government traces an IP address to a house, not to a person. The core of many defenses is arguing that the prosecution cannot prove who was actually behind the keyboard at the moment the alleged crime occurred. This involves investigating and presenting evidence of:

• Third-Party Access: Other individuals in the home—roommates, family members, children, guests—who had access to the computers and the network.
• Unsecured Wi-Fi: If the home’s Wi-Fi network was open or had a weak, easily guessable password, a neighbor or someone sitting in a car outside could have used the network to conduct the illegal activity, routing it through your IP address. This is known as “piggybacking.”

2. Challenging “Knowing” Possession

The State or federal government must prove you *knew* the illicit files were on your computer. It is not a strict liability crime. A defense can be built around the argument that the files were placed on the device without your knowledge through:

• Malware or Viruses: Certain types of malware can download files to a computer without the user’s consent or knowledge.
• Bundled Files: Illicit files may have been unknowingly downloaded as part of a larger package, such as a zip file or a torrent containing many other legitimate files.
• File-Sharing Software Vulnerabilities: Some P2P programs could be exploited to place files in a user’s shared folder without their direct action.

This defense often requires the assistance of an independent digital forensics expert to analyze the computer for evidence of such an intrusion.

3. Contesting the Search Warrant

The Fourth Amendment protects you from unreasonable searches and seizures. A defense attorney must meticulously review the affidavit that law enforcement submitted to a judge to get the search warrant. If the affidavit fails to establish probable cause, or if it contains false or misleading information, a “Motion to Suppress” can be filed. If successful, this motion could result in all evidence found during the search being thrown out, often leading to a dismissal of the entire case.

4. Forensic Evidence and Chain of Custody

We scrutinize the government’s forensic process. Were the devices handled properly? Was the forensic image created correctly? Is the chain of custody for the evidence intact and documented? Any error or gap in the process can be used to cast doubt on the reliability of the government’s digital evidence.

Irreversible Errors to Avoid During an Investigation

Being the subject of a child pornography investigation is a terrifying and confusing experience. The actions you take in the first few hours can have a permanent impact on your case. Having seen clients make devastating errors under pressure, I urge anyone in this situation to avoid these critical mistakes.

1. Speaking to Investigators: This is the single most destructive mistake. When police or federal agents execute a search warrant, they will try to interview you. They are not there to help you. They are there to get a confession. Any statement you make—denials, explanations, admissions—will be used against you. Politely but firmly state: “I am exercising my right to remain silent, and I will not answer any questions without my lawyer present.”
2. Consenting to Searches: If officers do not have a warrant, they may ask for your consent to search your home, car, or devices. Never give consent. Forcing them to get a warrant preserves your ability to challenge the legality of that warrant later in court.
3. Trying to “Clean” Your Computer: The moment you suspect you are under investigation, you may be tempted to delete files, wipe your hard drive, or physically destroy your computer. This is a catastrophic error. It is a separate felony (Obstruction of Justice), and forensics can almost always detect the attempt. It is the most powerful evidence of “consciousness of guilt” that a prosecutor can present to a jury.
4. Unlocking Your Phone or Computer for Police: You are generally not required to provide passwords or biometric data (fingerprint, face ID) to unlock your devices for law enforcement. Providing this access can give them entry to a trove of information. Do not volunteer this access without speaking to an attorney.
5. Assuming a Lawyer is Unnecessary: These are not cases you can handle on your own. They involve complex constitutional law, cutting-edge digital forensics, and severe penalties. The government has teams of lawyers and experts; you need a knowledgeable defense team from the moment you learn of the investigation.

Glossary of Key Digital Forensics and Legal Terms

IP Address (Internet Protocol Address)

A unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication. Law enforcement uses this to identify the source of internet traffic.

Peer-to-Peer (P2P) Network

A distributed computer network where participants make a portion of their resources (like files) directly available to other network participants, without the need for central coordination instances. BitTorrent is a common example.

Hash Value (or Hash)

A unique digital “fingerprint” created by a mathematical algorithm for a specific file. Even a one-bit change in the file creates a completely different hash value. Investigators use these to positively identify known contraband files.

Digital Forensics

The science of recovering and investigating material found in digital devices, often in relation to computer crime.

Dual Sovereignty

A legal doctrine holding that more than one sovereign (e.g., the state of Maryland and the federal government) may prosecute an individual for the same act if that act violates the laws of each sovereign.

Mandatory Minimum Sentence

A statutory requirement that sets a minimum number of years in prison for a conviction of a particular crime. Federal child pornography laws often carry these.

Affidavit for Search Warrant

A sworn written statement of facts that law enforcement presents to a judge to establish the probable cause necessary to obtain a search warrant.

Common Scenarios Leading to Child Pornography Charges

Child pornography investigations in Baltimore County often begin in ways that are opaque to the target until the day law enforcement arrives. These scenarios illustrate how investigations are typically initiated.

Scenario 1: The P2P File-Sharing Investigation

A person in Baltimore County uses a BitTorrent client to download movies or software. Unbeknownst to them, one of the “.torrent” files also contains illicit images. A federal agent in a different state, monitoring the network, detects their IP address sharing pieces of a known child pornography file. The agent obtains a warrant for the subscriber information from Comcast, leading them to the person’s home. A search warrant is executed, and although the person had no intent to acquire illicit material, the files are discovered on their computer, leading to state or federal charges.

Scenario 2: The Online Undercover Tip

An individual is part of a private, encrypted chat group where members share various types of media. One member shares illicit images. Another member of the group is a confidential informant or an undercover officer. The agent reports the activity to an FBI cybercrime task force. Using information from the chat, they are able to identify one of the users as residing in Baltimore County. This triggers a full-scale investigation, subpoenas for chat logs, and eventually a search warrant.

Scenario 3: The “Curiosity” Download

A person, out of what they might describe as morbid curiosity, uses a search engine to find and look at illicit images on a website. They may download one or two images. The website they visited is being monitored by Homeland Security Investigations (HSI). HSI logs the IP address of every visitor and, after obtaining a warrant, traces it back to a home in Maryland. A search of the computer reveals the downloaded images and browser history, forming the basis for a possession charge.

Frequently Asked Questions (FAQ)

1. I was just looking, I didn’t download anything. Can I be charged?

Merely viewing an image that is temporarily stored in your computer’s browser cache can technically constitute “possession” under the law. While harder for the government to prove than a saved file, it is still a significant legal risk. Prosecutors may argue that viewing the image on your screen is a form of electronic possession.

2. My Wi-Fi was unsecured. Is that a good defense?

It can be a powerful defense, but it requires substantial work. The defense would need to show that it was not only possible but plausible that a third party accessed your network to conduct the illegal activity. This may involve neighborhood canvassing, expert testimony on Wi-Fi signal range, and analysis of router logs.

3. Will they really prosecute me for just one or two images?

Yes, absolutely. The law makes no distinction based on the quantity of material. The possession of a single illicit image is a felony. While quantity can affect sentencing, it does not affect guilt or the decision to prosecute.

4. I think someone else used my computer. How can I prove it?

This is a core defense strategy focusing on attribution. Proving it involves a deep forensic analysis of the computer to look for evidence of other user profiles, login times that don’t match your schedule, and other digital artifacts. It also involves investigating the other potential users and their habits.

5. Will I definitely go to prison if convicted?

In the federal system, a conviction for distribution or a second offense of possession carries a mandatory minimum prison sentence. In the state system, while there is no mandatory prison time for a first offense of possession, a prison sentence is extremely likely. For any distribution conviction, prison time is a near certainty.

6. What is the difference between state and federal sex offender registration?

Both are public and lifelong for this type of offense. The federal system (SORNA) sets national standards. Maryland’s registry has its own specific reporting requirements. A conviction usually requires registration on both, and you must comply with the rules of the state in which you reside.

7. How long will the investigation take before I know if I’m being charged?

These investigations can be very slow. After a search warrant is executed, it can take many months, sometimes over a year, for the digital forensics to be completed and for a prosecutor to make a charging decision. This waiting period is agonizing but requires patience and proactive defense preparation.

8. Can I get my computers back?

No. Devices seized as evidence in a child pornography case are considered contraband and will be held until the case is over. If there is a conviction, they are administratively forfeited and destroyed.

9. Does using a VPN or the Tor browser protect me?

While these tools can make it more difficult for law enforcement to trace an IP address, they are not foolproof. Investigators have methods to circumvent or de-anonymize users of these services. Furthermore, the presence of these tools on a computer is often used by prosecutors at trial as evidence of a guilty mind and an intent to hide illegal activity.

10. I am innocent, should I take a polygraph to prove it?

Polygraph (lie detector) results are generally not admissible as evidence in court in Maryland or federal court. Law enforcement may ask you to take one as an interrogation technique. You should never agree to a polygraph examination without first consulting with an experienced criminal defense attorney.