As I’ve noted in earlier posts, for an attorney to introduce evidence at trial, he/she must “authenticate” it, i.e., must show that the evidence is what it’s claimed to be. This post is about a challenge to the authentication of certain images recovered from computers a Texas defendant used.
The case is Creech v. State, 2011 WL 1663040 (Texas Court of Appeals 2011), and this is how it arose:
[John Preston Creech] taught human sexuality at Collin County Community College (CCCC). On August 21, 2006, he reported to the IT department that his computer keyboard was not working and his computer was performing slowly. Rob Hurst, a . . . technician for CCCC, responded. . . . While performing standard procedures to update the system, Hurst noticed files with suspicious names. He notified his supervisor that he may have found pornographic images on a computer.
Shane Ammons, executive director of academic technologies and network services for CCCC, removed the computer from [Creech’s] office. He copied images from [the] hard drive and put them in a separate folder on the computer's desktop. He copied the folder onto a flash drive. He showed Kim Russell, the vice president of human resources, print outs of some of the images and she contacted the president of CCCC.
College administrators met with [Creech] on August 23, 2006 and he admitted the images were on his computer and provided a `fairly lengthy explanation of his rationale,’ including looking at pornography to desensitize himself and researching to determine the line between legal and illegal images. CCCC terminated [his] employment.
CCCC notified the Frisco police department regarding the child pornography on [Creech’s] work computer. Officer Walters [searched] [his] home looking for additional evidence of child pornography. He seized [Creech’s] home computer, which also had images of child pornography. Walters noticed several pictures in the home of [Creech]with a young girl. He wanted to determine [her] identity and contact the family because he had concerns [Creech] may have victimized her.
Creech v. State, supra.
Before Walters determined her identity, he got a call from Creech’s girlfriend, Annette Cameron, who was the girl’s mother. Creech v. State, supra. When she learned Creech was being investigated for child pornography, she became concerned that he might have “acted inappropriately” with “A.R.”, her daughter. Creech v. State, supra. A.R. was interviewed by a child psychiatrist, and that interview eventually led A.R. to reveal that Creech had touched her sexually on at least two occasions. Creech v. State, supra.
Creech was charged with “aggravated sexual assault of a child, two counts of indecency with a child, and five counts of possession of child pornography”, went to trial and was convicted on all charges except for one of the indecency with a child counts. Creech v. State, supra. He was sentenced to “five ten-year sentences, one twenty-year sentence, and a life sentence to run concurrently,” and appealed. Creech v. State, supra.
Creech raised several issues on appeal, but we’re only concerned with the authentication issue I noted earlier. Creech claimed the trial court abused its discretion
by admitting unauthenticated images allegedly retrieved from his work and home computers. Because members of CCCC's IT department accessed [his] work computer and allegedly downloaded numerous images of child pornography as part of their `investigation,’ he claims the State failed to prove the images shown to the jury were what they purported to be: the true contents of [Creech’s] computer hard drives before the hard drives were removed from his custody and control.
Creech v. State, supra.
The Court of Appeals began its analysis of Creech’s argument by noting that under Texas Rule of Evidence 901(a), the “`requirement of authentication . . . as a condition precedent to admissibility is satisfied by evidence sufficient to support a finding that the matter in question is what its proponent claims.’” Creech v. State, supra. The court also noted that a chain of custody must be established when:
(1) there is a possibility of commingling the item with items similar in appearance, (2) the sponsoring witness has not marked with distinctive markings an item not having distinctive characteristics, or (3) there is a suggestion the evidence has been tampered or changed in some manner. Ballard v. State, 23 S.W.3d 178 (Texas Court of Appeals 2000). Proof of chain of custody goes to the weight of the evidence rather than the admissibility of the evidence. Lagrone v. State, 942 S.W.2d 602 (Texas Court of appeals 1997). Absent evidence of tampering or commingling, theoretical breaches in the chain of custody do not affect the admissibility of evidence.
Creech v. State, supra.
During the trial, the court held a hearing on Creech’s motion to suppress the images. Creech v. State, supra. Creech presented expert testimony from Timothy Hanners,
a computer forensic analyst. He testified the IT department did not use the best practices for securing [Creech’s] work hard drive because they should have created a binary copy of the drive and worked from it. He stated they worked for over twelve hours on the computer before it was secured and during that time, they changed dates on approximately sixteen thousand files, created or modified over six thousand files, and installed applications that would have deleted older files. He further testified there were viruses that could create links within a user's favorite links.
On cross-examination, Hanners could not say with certainty [Creech’s] work computer contained any viruses that would put images on the hard drive, in the computer's cookies, or on appellant's list of favorites. He also acknowledged all the images had a created, modified, and accessed date, and by simply viewing a file on August 21, 2006, the IT staff could not give an image an earlier created date.
Creech v. State, supra.
The prosecution relied on the testimony of Hurst and Ammons, who said they did not
add any pornography to [Creech’s] work computer. While both admitted to opening some files, which changed the accessed date, these actions only affected files already on the computer rather than adding new files. In fact, Hurst testified he did not change the created dates and to make such changes would require specialized software not installed on [Creech’s] work computer.
Ammons admitted that while he did not use the best practices for securing [the] work computer, he created a new folder in the middle of the desktop named FOUND 8/21 of ′06 and copied questionable images from the temporary internet files and put them in the new folder. He made an exact copy of images in the temporary internet files because he did not want to change the created date of the image.
He testified nothing in the process would have added pornography that was not already present on [Creech’s] work computer. While he admitted to using [the] work computer to access images that would have been saved in the temporary internet files, the access date would have been August 21 or August 22.
Creech v. State, supra.
The state also relied on the testimony of Rod Gregg, a digital forensic examiner, who
confirmed there were images viewed on [Creech’s] work computer prior to August 21, 2006 and some files were viewed repeatedly. The images and files accessed prior to August 21 were not put on [his] work computer by Hurst or Ammons. He said while it was more complicated, it was not impossible for him to sort through what the IT staff did to [Creech’s] work computer prior to him examining it. He specifically testified all the information on State's Exhibit 20, a CD containing images of child pornography, were retrieved from [Creech’s] work computer.
Creech v. State, supra.
After reviewing this testimony, the Court of Appeals held that the trial judge acted within his discretion in “determining Hurst and Ammons did not tamper or change the contents of [Creech’s] work hard drive in such a manner that the State failed to authenticate the images as coming from [his] computer.” Creech v. State, supra. The Court therefore held that the images were properly authenticated and properly admitted. Creech v. State, supra.
The Court of Appeals also rejected Creech’s challenge to the authentication of images recovered from his home computer. Creech v. State, supra. The opinion doesn’t tell me exactly what Creech’s argument was here, but the Court of Appeals noted that Creech’s “home computer was properly seized by Officer Walters during a search of his home and transferred to the Regional Computer Forensic Crime Laboratory operated by the FBI in Dallas where it was logged in and bar coded.” Creech v. State, supra.
The court pointed out that the CCCC “IT staff never had possession” of Creech’s home computer and “therefore . . . did not, nor has [Creech] alleged, they tampered or altered the hard drove” of that computer. Creech v. State, supra. The court consequently rejected Creech’s challenge to the admission of this evidence, as well. Creech v. State, supra.
And because the Court of Appeals rejected Creech’s other arguments on appeal, it affirmed the conviction. Creech v. State, supra.
If you’re interested, here’s a story with a photo of Creech and his explanation as to why the images were on his computers.
No comments:
Post a Comment