Monday, September 30, 2013

Strangulation, the Laptop and the Expert Witnesses

-->
After he was convicted of first-degree murder in violation of North Carolina General Statutes § 14-17 and “sentenced to life in prison without the possibility of parole,” Bradley Graham Cooper appealed.  State v. Cooper, 747 S.E.2d 398 (North Carolina Court of Appeals 2013).  He was convicted of killing his wife: Nancy Lynn Rentz Cooper.  State v. Cooper, supra.



According to the opinion, Graham and Nancy were married in October of 2000 and moved from Canada to Cary, North Carolina in January 2001. State v. Cooper, supra. They had two daughters but by 2008, the marriage “was in difficulty” and by April of that year Nancy “had hired a family law attorney and planned to move out”, presumably with the daughters. State v. Cooper, supra. Graham and Nancy were still living in the home in July 2008, but “were leading mostly separate lives and sleeping in separate bedrooms.” State v. Cooper, supra.



On July 11, 2008, they “attended a party at a neighbor's house”; witnesses later said they argued there.  State v. Cooper, supra. Graham left “around 8:00 p.m., to put the daughters to bed” and Nancy left “a little after midnight”. State v. Cooper, supra. She disappeared some time during the morning of July 12, 2008. State v. Cooper, supra.



Graham later gave police this account of what happened that morning:



[O]ne of the daughters awoke between 4:00 a.m. and 4:30 a.m., and had difficulty getting back to sleep. [She] wanted milk, but there was none at the house. [Graham] went to a Harris–Teeter at about 6:30 a.m. to buy milk, and returned home. [Nancy] was doing laundry, but had run out of detergent. [Graham] returned to the Harris–Teeter to buy detergent and, while on his way there, received a call from [Nancy] asking him to get some `green juice.’



Receipts and surveillance video from the Harris–Teeter confirm that [he] bought milk at 6:25 a.m., left . . . , returned and bought detergent and juice at 6:44 a.m. After [Graham] bought the detergent and juice, he returned home. At about 7:00 a.m., [Nancy] called to [Graham], who was upstairs, and told him she was going running. [He] remained at home with the daughters and, when [she] did not return from her run when expected, [Graham] called a friend and cancelled a tennis date he had planned. [He later said] he did laundry and cleaned around the house and, in the early afternoon, drove around with his daughters, looking for [Nancy].



State v. Cooper, supra.  (For more on the case, check out this news story.)



Police questioned Graham and investigated for the next three days, when “a woman’s body”, later identified as Nancy, “was found on Fielding Drive.”  State v. Cooper, supra.  The next day, July 15, the body was identified as Nancy. State v. Cooper, supra.  The cause of death was strangulation but the time of death “could not be determined with specificity.” State v. Cooper, supra. Investigators were able to determine that Nancy died  “some time in the twelve-hour period between shortly after midnight on 12 July . . . and approximately noon that same day.”  State v. Cooper, supra. 



“Around 5:20 p.m.” on July 15, Graham moved out to “preserve the house as a possible crime scene.” State v. Cooper, supra. He left a laptop, which “was connected to the internet for approximately twenty-seven hours on 15 and 16 July”.  State v. Cooper, supra. After he left, police, who had a search warrant, searched the house and Graham’s car.  State v. Cooper, supra.  They “also seized the laptop, along with another computer, and various other computer-related components.” State v. Cooper, supra. 



He was charged with murdering Nancy and went to trial on February 28, 2011.  State v. Cooper, supra.  The “sole direct evidence linking” Graham “to the murder was obtained from the laptop that had been left on and connected to the internet after” he moved out.  State v. Cooper, supra. 



At trial, the prosecution presented testimony from FBI Special Agent Greg Johnson and Durham Police Detective Chris Chappell, both of whom testified as forensic computer analysts. State v. Cooper, supra.  Both were forensic examiners



of the Computer Analysis Response Team (CART). CART extracts `evidence off of seized digital media’ such as computer hard drives. The first part of the forensic process involves taking inventory of the components. CART then checks for any portable media in or attached to the computer, opens up the case of the CPU and removes the hard drive(s). . . . 

According to Johnson's testimony, the integrity of the hard drive is protected by making a `forensic image’ of the drive, which is `a. . . . bit-per-bit copy, which gets every piece of . . . information off of the hard drive and puts it into what we call forensic image.’ Examination then occurs of a different hard drive containing the forensic image, not the original hard drive. The forensic image requires some type of specialized software to read and `interpret those files that it creates.’ . . .



The CART team used software called Forensic Tool Kit, or FTK, to process that hard drive. FTK and similar programs index files retrieved from the hard drive, allowing for specific searches for particular data to be performed. An FTK report was then created based upon the particular search parameters utilized. One of the sub-sets of files collected in the FTK report for [Graham’s] laptop was temporary internet history files for dates close in time to [Nancy’s] murder.



Johnson and Chappell testified that the temporary internet files recovered from the laptop indicated someone conducted a Google Map search on [it] at approximately 1:15 p.m. on 11 July, the day before [Nancy] was murdered. They concluded this search was done by someone using the laptop while it was at the Cisco office where [Graham] worked. [They] testified that the Google Map search was initiated by someone who entered the zip code associated with [Graham’s] house, and then moved the map and zoomed in on the exact spot on Fielding Drive where [Nancy’s] body was found.



State v. Cooper, supra. 



-->
Graham called Jay Ward to testify about “the incriminating Google Map files recovered from the laptop.” State v. Cooper, supra.  Ward had ”more than fifteen years in the computer field, specializing in computer network security.” State v. Cooper, supra. The prosecution objected, "challenging [Ward's] credentials to  testify as an expert concerning the relevant Google Map files.” State v. Cooper, supra. 



In objecting to Ward’s testifying as an expert, the prosecution focused on Ward’s



lack of training and experience as a forensic computer analyst. The trial court agreed with the State and, on 19 April 2011, ruled that Ward could not testify specifically about the Google Map files. Ward was allowed to give general testimony concerning the ease with which files could be altered or planted on a computer that, like [Graham’s], had been left connected to the internet. 

[Graham] argued, since the trial court did not find the methods by which Ward obtained his data to be reliable, that Ward be allowed to testify based upon the data produced by the State's forensic analysts. The trial court denied [his] request.



Ward testified on voir dire that had he been allowed to, he would have offered his opinion that the incriminating Google Map files had been planted on [Graham’s] computer, and he would have further testified to the specific aspects of the files that had led him to this conclusion.



State v. Cooper, supra. 



After the judge made that ruling, Graham “immediately” began looking for a



forensic computer analyst he could call to testify concerning the Google Map files. [He] located a forensic computer analyst, Giovanni Masucci (Masucci), on 20 April 2011. As the court session began on 21 April 2011, [Graham] gave notice of Masucci as [his] replacement expert. Masucci had examined the data produced by the State's forensic computer analysts, and produced a report. Masucci's report indicated that the data results obtained by Ward matched the results obtained by CART.



Masucci's conclusion was the same as Ward's: that the Google Map files had `been placed on the hard drive [and] could not have been the result of normal internet activity.’ [His] curriculum vitae was sent to the State on 22 April 2011, and Masucci's report was sent the next day. Court was not in session on these days.



State v. Cooper, supra. 



When court resumed on April 25, the prosecution objected to letting Masucci testify because his name “not on the list of experts [Graham] provided to the State before trial, nor had the State been provided with Masucci's report prior to trial, and these failures constituted discovery rules violations.”  State v. Cooper, supra.  The judge agreed and did not let Masucci testify.  State v. Cooper, supra.  Graham was “therefore prohibited from calling any witness to testify that the Google map files relied upon by the State to connect [him] to the site where [Nancy’s] body was found were corrupt or had been tampered with in any manner.”  State v. Cooper, supra. 



His first argument on appeal was that the judge’s ruling that Ward was not qualified to give expert testimony about tampering on his computer “`was an abuse of discretion and deprived [him] . . . of his state and federal constitutional due process right to present a defense.”  State v. Cooper, supra.  The Court of Appeals agreed. State v. Cooper, supra. 



It noted, first, that the Supreme Court has said “[a]ccuracy in criminal proceedings is a particularly compelling public policy concern” and has said that “a defendant on trial has a greater interest in presenting expert testimony in his favor than the State has in preventing such testimony.” State v. Cooper, supra (citing Ake v. Oklahoma, 470 U.S. 68 (1985)).  It then explained that the “admissibility of expert testimony is controlled by Rule 702 of the North Carolina Rules of Evidence”. State v. Cooper, supra. 



Rule 702 says that if “scientific, technical or other specialized knowledge will assist the trier of fact to understand the evidence or to determine a fact in issue, a witness qualified as an expert by knowledge, skill, experience, training, or education, may testify thereto in the form of an opinion, or otherwise” if the testimony satisfies three factors. State v. Cooper, supra.  The factors are that (i) the testimony is “based upon sufficient facts or data”; (ii) it “is the product of reliable principles and methods” and (iii) the witness applied "the principles and methods reliably to the facts of the case."

State v. Cooper, supra. 



In testifying on voir dire, Ward described his experience with computers and networks, which began in 1997 and continued until the trial.  State v. Cooper, supra. He said he used “software programs, such as EnCase and FTK” but there were limitations in using the software alone.” State v. Cooper, supra.  Ward’s testimony is too long to summarize here.  State v. Cooper, supra. 



The Court of Appeals noted that, at trial, the prosecution “did not seriously challenge Ward's ability to understand and interpret the actual data retrieved” and that his voir dire testimony indicated he “had been examining precisely the kind of files at issue -- temporary internet files -- on a regular basis throughout his long career as a digital data security professional.” State v. Cooper, supra.  

 It also noted that “[a]ccording to his voir dire testimony, Ward was engaged in a specific profession in the type of analysis in which the defense wanted him to testify, and was experienced with the identical subject matter -- temporary internet files -- at issue.” State v. Cooper, supra (emphasis in the original). The court therefore found Ward was “certainly `in a better position to have an opinion on the subject than [wa]s the trier of fact.’” State v. Cooper, supra (quoting State v. Morgan, 604 S.E.2d 886 (North Carolina Supreme Court 2004)).  



The Court of Appeals noted that the trial judge believed that, because the



digital data was recovered using forensic tools and methods, only an expert forensic computer analyst was qualified to interpret and form opinions based on the data recovered. The evidence on voir dire does not support this understanding of the nature of Ward's expertise. Assuming arguendo that the data Ward recovered from the forensic copy of the hard drive was suspect, neither the State nor [Graham] argued that the data recovered by the State's experts was flawed -- just that there was disagreement concerning the interpretation of that data.



Nothing in evidence supports a finding that Ward was not qualified to testify using the data recovered by the State. Ward, based upon expertise `acquired through practical experience,’ was certainly `better qualified than the jury to form an opinion as to the subject matter to which his testimony applie[d].’ Miller v. Forsyth Memorial Hospital, 618 S.E.2d 838 (North Carolina Court of Appeals 2005)).



State v. Cooper, supra. 



The court also noted that the



Google Map files recovered from [Graham’s] laptop were perhaps the most important pieces of evidence admitted in this trial. We hold that the trial court abused its discretion in excluding Ward from testifying, relying on the State's own evidence, to his opinion that the Google Map files recovered from [Graham’s] laptop had been tampered with.



State v. Cooper, supra. 



The court also addressed the trial judge’s barring Masucci from testifying. State v. Cooper, supra.  It assumed, arguendo, that Graham “technically violated North Carolina Statutes§ 15A-905”, which requires defendants to give the prosecution notice of any experts they intend to call as witnesses as trial.  State v. Cooper, supra.  The Court of Appeals also found, however, that the trial judge’s excluding Masucci’s testimony was “disproportionate to the purposes this state's discovery rules were intended to serve.”  State v. Cooper, supra. 



The court noted that the Supreme Court has held that if a trial judge determines that a defendant “willfully” did not comply with the obligation to identify expert witnesses in advance in order to “obtain a tactical advantage that would minimize the effectiveness of cross-examination and the ability to adduce rebuttal evidence,” it would be constitutionally permissible for the judge to bar the defendant from offering that witness’ testimony at trial. State v. Cooper, supra (citing Taylor v. Illinois, 484 U.S. 400 (1988)).



It then noted that here, Graham, in



failing to provide earlier notice to the State, was clearly not seeking any tactical advantage. The trial court made no finding of willful misconduct, and the record divulges none. [He] only sought out another expert, Masucci, after the State was successful in moving to limit Ward's testimony in the middle of the trial. At that point, [Graham] had no way to present vital expert testimony and comply with North Carolina Statutes § 15A–905(c)(2).



State v. Cooper, supra. 



The court therefore held that “excluding Masucci's testimony as a sanction for a discovery rules violation violated [Graham’s] rights under the constitutions of the United States and North Carolina.” State v. Cooper, supra. It also found “the error was of such magnitude, in light of the earlier exclusion of Ward's relevant testimony, that it requires . . . a new trial.” State v. Cooper, supra. 



For all these reasons, the court granted Graham a new trial.  State v. Cooper, supra.  For more on that, check out the news story you can find here.

No comments: