The Hard Drive and the Stolen Car

This post is about a federal case in which a defendant moved to suppress certain evidence as having been seized in violation of his rights under the 4^th Amendment. As I’ve explained in earlier posts, the 4^th Amendment protects us from “unreasonable” searches and seizures.

And as I’ve noted, under the U.S. Supreme Court’s decision in Katz v. U.S., 389 U.S. 347 (1967), a “search” violates a reasonable expectation of privacy in a place or thing. Under Katz, you have a 4^th Amendment reasonable expectation of privacy in a place/thing if (i) you subjectively believe it’s private and (ii) society accepts your belief as objectively reasonable.

This post deals with a case in which a defendant claimed he had a reasonable expectation of privacy in a laptop computer seized from a car that had been impounded by the local police department. U.S. v. Soto, __ F.Supp.2d __, 2011 WL 1557878 (U.S. District Court for the District of Massachusetts 2011).

The case seems to have begun on April 28, 2006, when a federal-state task force

descended on 56 Lawrence Road in Lynn, Massachusetts, to execute arrest warrants for Steven Soto and his brother, Pedro Soto, Jr. The Soto brothers listed 56 Lawrence Road as their mailing address in various Registry of Motor Vehicles (RMV) documents, including vehicle registrations and drivers' licenses. Steven did not live at 56 Lawrence Road, although he often spent the night visiting his brother and his father and mother, Pedro, Sr. and Carmen Soto. A neighbor told the officers . . . that Steven Soto's car was frequently parked at 56 Lawrence Road and had been seen there as recently as the previous day.

U.S. v. Soto, supra.

The officers searched the home and seized evidence, including a desktop computer; a federal judge later found that the officers didn’t have reason to believe Stephen lived at 56 Lawrence Road or would be there, which meant that the warrant for his arrest didn’t justify the officers’ entry into the home. U.S. v. Soto, supra. The next step in the case came in February, 2007, when Secret Service Agent Everett

received a fraud alert from Eastern Bank informing him Steven Soto had opened a checking account for a company called Aggressive Construction, identifying himself as its owner, `Gregory E. Bradley.’ . . . [T]he real Bradley was incarcerated at the Essex County House of Correction. Later that day, Steven was arrested by Saugus police at a branch of Eastern Bank where he was attempting to cash a fraudulent check for $5,700 made out to Bradley.

Soto had presented the teller with a driver's license and an American Express card in Bradley's name. As Soto was being escorted out of the bank by police, he gestured to a Hispanic woman (Yessica Amaro), who then drove off in the Chrysler. A record search indicated that the Chrysler had been purchased and registered in the name of `Gregory Bradley’ in February of 2007. . . .

Amaro later arrived at the Saugus police station in the Chrysler. . . . [and] attempted to retrieve a set of car keys from Steven’s impounded belongings. When officers confronted [her] about the ownership of the Chrysler, [she] claimed it had been purchased a few days earlier by Bradley. . . . Police impounded the Chrysler. An inventory of the contents disclosed the Gateway laptop.

U.S. v. Soto, supra.

On March 27, 2007, a federal Magistrate Judge issued a “warrant for the search of the contents” of the Gateway laptop seized from the Chrysler. U.S. v. Soto, supra. The laptop was searched and officers found evidence that was later used to charge Soto with fraud in violation of federal law. U.S. v. Soto, supra.

Soto moved to suppress the evidence seized fro the hard drive of the Gateway laptop, arguing that the search violated his rights under the 4^th Amendment. U.S. v. Soto, supra. The prosecution argued that Soto “lacked standing” to challenge the search of the laptop. As Wikipedia explains, “standing” refers to “ the ability of a party to demonstrate to the court sufficient connection to and harm from the . . . action challenged to support that party's participation in the case.” As Wikipedia also notes, to have standing the person must have personally suffered “an invasion of a legally protected interest”. Here, this meant that Soto’s rights under the 4^th Amendment must have been implicated by the search of the laptop.

The district court judge explained that the issue to be decided, therefore, was whether the officers’ examining the laptop’s hard drive was a “search” that “invaded” Soto’s 4^th Amendment rights. As noted above, for the examination of the hard drive to have been a “search,” Soto had to have had a reasonable expectation of privacy in the hard drive. That is, he had to have a subjective expectation of privacy in the hard drive and society must regard that subjective expectation of privacy as objectively reasonable.

The district court judge began his analysis of those issues by noting that it was “not a mater of serious debate” that the officers had probable cause to impound the Chrysler in which officers found the laptop. U.S. v. Soto, supra. The judge then explained that

[i]t is a common-sense proposition that `a defendant who knowingly possesses a stolen car has no legitimate expectation of privacy in that car.’ U.S. v. Tropiano, 50 F.3d 157 (U.S. Court of Appeals for the 2d Circuit 1995). It is equally well established that the contents of a lawfully impounded vehicle may be without a warrant as part of a standardized administrative procedure. . . . If the impoundment is proper, evidence of criminal activity will not be suppressed even if officers have a contingent suspicion that the vehicle contains incriminating items. . . . Finally, the Fourth Amendment permits officers following a standardized procedure to inventory the contents of closed containers, locked or unlocked, found in the storage compartments of the vehicle.

U.S. v. Soto, supra.

The judge noted, though, that even if “ the inventory policy of the Saugus police permitted the opening of closed containers (there is no evidence of the policy in the record, but most do), it is doubtful that such a policy would permit the `inventory’ of the contents of a computer hard drive, effectively a secure container within a closed container.” U.S. v. Soto, supra. The judge also noted that there

is some authority supporting the proposition that a person may retain a reasonable expectation of privacy in the contents of a closed or locked container that he leaves in a place in which he can claim no reasonable expectation of privacy. In State v. Mooney, 218 Conn. 85, 588 A.2d 145 (1991), the Connecticut Supreme Court concluded that a homeless man retained an expectation of privacy in the contents of a duffel bag and cardboard box he had stored beneath a bridge.

The case turned on the fact that for want of an alternative, the defendant considered the bridge his home. There is no evidence Steven Soto had a similar subjective regard for the sanctity of the Chrysler -- it appears to have been merely one of the many vehicles that he acquired by fraud and freely shared with his associates.

U.S. v. Soto, supra.

The judge decided, however, that Soto’s claim was “more properly weighed in the context of the law of abandonment”, noting that in

`the law of search and seizure, the question is whether the defendant has, in discarding the property, relinquished his reasonable expectation of privacy so that its seizure and search is reasonable within the limits of the Fourth Amendment. . . . In essence, what is abandoned is not necessarily the defendant's property, but his reasonable expectation of privacy therein.’

U.S. v. Soto, supra (quoting City of St. Paul v. Vaughn, 306 Minn. 337, 237 N.W.2d 365 (Minnesota Supreme Court 1976)).

The federal district court judge then explained that

Whether a defendant has retained an objectively reasonable expectation of privacy in allegedly abandoned property is a matter of law for the court. . . . Here, I have no difficulty concluding that by leaving his computer in a stolen car given over to the possession of a third party, Steven Soto forfeited any legitimate expectation of privacy that he may have had in its hard drive. In sum, despite a legitimate claim of ownership, [Soto’s] motion to suppress the contents of the hard drive will be denied for lack of standing.

U.S. v. Soto, supra.

The judge also pointed out, in a footnote, that the officers did not justify the search of the laptop on the grounds either that it was an inventory search or that it was a lawful search under the vehicle exception. U.S. v. Soto, supra. Instead, “they took no chances and . . . secured the laptop and obtained a warrant to search its hard drive.” U.S. v. Soto, supra.

“Technological Heebie-Jeebies”

This post is essentially a follow-up to a post I did last year – “Authenticating a Pseudonymous MySpace Posting.”

As I explained in that post, Antoine Griffin was convicted of second-degree murder, first degree assault and use of a handgun in the commission of a felony/crime of violence and appealed, arguing that the trial court improperly admitted “five pages printed on December 5, 2006, from . . . a MySpace profile in the name of `SISTASOULJAH’”. Griffin v. State, 2010 WL 2105801 (Maryland Court of Special Appeals 2010) (Griffin No. 1).

The Maryland Court of Special Appeals found that the printout had been sufficiently authenticated to justify its admission into evidence, and therefore affirmed Griffin’s conviction. Griffin No. 1, supra. Griffin then appealed his conviction to the Maryland Court of Appeals which, as Wikipedia notes, “is the supreme court of the . . . state of Maryland.”

This post examines how the Maryland Court of Appeals dealt with Griffin’s argument regarding the admission of the pages printed from the MySpace profile. Griffin v. State, _ A.3d _, 2011 WL 1586683 (Maryland Court of Appeals 2011) (Griffin No. 2).

I’m not going to repeat the facts that led to Griffin’s being charged with the offenses noted above; you can find those in my prior post. Nor am I going to describe in detail what the pages from the MySpace profile said or how they were relevant to the issues in the case; basically, the prosecution used them to demonstrate that Griffin’s girlfriend, Jessica Barber, had “threatened another witness called by the State.” Griffin No. 1.

As the Court of Appeals notes, when Ms. Barber took the stand at trial (“after being called by the State”), she “was not questioned about the pages allegedly printed from her MySpace profile.” Griffin No. 2. Instead, the prosecution “attempted to authenticate the pages, as belonging to Ms. Barber, through the testimony of Sergeant John Cook, the lead investigator in the case.” Griffin No. 2. Griffin’s attorney objected, and was allowed to voir dire Sergeant Cook outside the presence of the jury; if you check my earlier post on this case, you can read the relevant exchange between the defense attorney and Cook.

The trial judge decided he would permit Cook “to testify in support of authentication of . . . the pages printed from MySpace, containing the photograph `of a person that looks like Jessica Barber’ and [Griffin], allegedly known as `Boozy,’ adjacent to a description of the woman as a 23 year-old from Port Deposit, and the blurb `FREE BOOZY!!!! JUST REMEMBER SNITCHES GET STITCHES!! U KNOW WHO YOU ARE!!’”. Griffin No. 2.

Rather than have Cook testify, Griffin’s attorney, “while maintaining his objection to the” admission of the MySpace pages, agreed to a stipulation that was read to the jurors. Griffin No. 2. The stipulation stated that if called, Cook would testify (i) that he went to MySpace, downloaded “information from a posting someone put there”, (ii) that parts of the content on the site had been redacted because it “might be inflammatory without proving anything”, (iii) that the unredacted portion of the content says “just remember snitches get stitches” and (iv) that whether the printout “represents that which it purports to be, not only a MySpace profile created by Ms. Barber, but also upon which she had posted, `FREE BOOZY!!!! JUST REMEMBER SNITCHES GET STITCHES!! U KNOW WHO YOU ARE!!,’ is the issue before us.” Griffin No. 2. Before the Court of Appeals, Griffin reiterated his claim that it was reversible error for the trial court to allow this evidence to go to the jury. Griffin No. 2.

The Court of Appeals began its consideration of Griffin’s argument (which you can read about in my prior post) by noting that “[a]nyone can create a MySpace profile” and that “anyone can create a fictitious account and masquerade under another person's name or gain access to another's account by obtaining the user's username and password”. Griffin No. 2. The court cited U.S. v. Drew, 259 F.R.D. 449 (U.S. District Court for the Central District of California 2009) as illustrating how the “possibility for use abuse exists on MySpace.” Griffin No. 2. It then noted that the potential for fabricating or tampering with electronically stored information on a social networking site, thus poses significant challenges from the standpoint of authentication of printouts of the site”. Griffin No. 2.

The Court of Appeals pointed out that under Maryland Rule 5-901(a), the requirement that evidence be authenticated as “a condition precedent to admissibility is satisfied by evidence sufficient to support a finding that the matter in question is what its proponent claims” it to be. Griffin No. 2. It also noted that Maryland Rule 5-901(b) cites examples of how evidence can be authenticated, one of the use of circumstantial evidence “such as appearance, contents, substance, internal patterns, location, or other distinctive characteristics” that the evidence is what it is claimed to be. Griffin No. 2.

The court noted that in this case, Griffin argued that the prosecution did not

[a]ppropriately . . . authenticate the pages allegedly printed from Jessica Barber's MySpace profile, because the State failed to offer any extrinsic evidence describing MySpace, as well as indicating how Sergeant Cook obtained the pages in question and adequately linking both the profile and the `snitches get stitches’ posting to Ms. Barber. The State counters that the photograph, personal information, and references to freeing `Boozy’ were sufficient to enable the finder of fact to believe that the pages printed from MySpace were indeed Ms. Barber's.

Griffin No. 2. The Court of Appeals then disagreed with the Special Court of Appeals – which “gave short shrift to the concern” that someone other than Barber accessed the account and posted the message – and sided with Griffin:

[T]he trial judge abused his discretion in admitting the MySpace evidence pursuant to Rule 5-901(b) because the picture of Barber, coupled with her birth date and location, were not sufficient `distinctive characteristics’ on a MySpace profile to authenticate its printout, given the prospect that someone other than Barber could have not only created the site, but also posted the `snitches get stitches’ comment. The potential for abuse and manipulation of a social networking site by someone other than its purported creator and/or user leads to our conclusion that a printout of an image from such a site requires a greater degree of authentication than merely identifying the date of birth of the creator and her visage in a photograph on the site in order to reflect that Barber was its creator and the author of the `snitches get stitches’ language.

Griffin No. 2.

The court explained that its ruling was prompted in part by the fact that the MySpace printout “was a key component of the” prosecution’s case, but noted it was not suggesting “that printouts from social networking sites should never be admitted.” Griffin No. 2. It suggested that “avenues . . . to properly authenticate a posting or a profile printed from a social networking site will continue to develop as” efforts to use data from such sites increases. Griffin No. 2.

Judge Harrell dissented, because he believed that “the technological heebie-jeebies discussed in the Majority Opinion go . . . not to the admissibility of the print-outs . . . but rather to the weight to be given the evidence by” the jury. Griffin No. 2. He noted that the “`purpose of authentication is to . . . filter untrustworthy evidence.’” Griffin No. 2 (quoting Philip M. Adams & Assocs. V. Dell, Inc., 621 F.Supp.2d 1173 (D. Utah 2009)). He therefore concluded that “[l]ike many filters that are unable to remove completely all impurities, Rule 5-901 does not act to disallow any and all evidence that may have `impurities’ (i.e., in this case, evidence that could have come, conceivably, from a source other than the purported source).” Griffin No. 2.

Judge Harrell therefore argued in his dissent that as “long as a reasonable juror could conclude that the proffered evidence is what its proponent purports it to be, the evidence should be admitted.” Griffin No. 2. He believed that the “potentialities that are of concern to the Majority Opinion are fit subjects for cross-examination or rebuttal testimony and go properly to the weight” the jury can give to the print-outs. Griffin No. 2.

The majority, not surprisingly, disagreed with Judge Harrell. It point that that while he minimized as “`technological heebie jeebies’” the challenges inherent in authenticating . . . social networking websites”, “[n]one of the authorities” he cited “even addresses the authentication of social networking sites.” Griffin No. 2 (emphasis in the original). The majority explained that authentication concerns involving “e-mails, instant messaging correspondence, and text messages differ significantly from those involving a MySpace profile and posting printout, because such correspondences is sent directly from one party to an intended recipient or recipients, rather than published for all to see.” Griffin No. 2.

Finally, the majority pointed out that “the `reasonable juror’ standard to which the dissent refers is apparently derived from the federal analogue to Rule 5-104(b), concerning `relevance conditioned on fact,’ a protocol not addressed in this case.” Griffin No. 2 (citing U.S. v. Logan, 949 F.2d 1370 (U.S. Court of Appeals for the 5^th Circuit 1991). The majority then explained why the protocol was not at issue in this case:

Federally, some of the uncertainty involving evidence printed from social networking sites has been addressed by embracing the notion of `conditional relevancy,’ pursuant to Federal Rule 104(b), which provides `[w]hen the relevancy of evidence depends upon the fulfillment of a condition of fact, the court shall admit it upon, or subject to, the introduction of evidence sufficient to support a finding of the fulfillment of the condition.’ In this way, the [jury] could weigh the reliability of the MySpace evidence against the possibility that an imposter generated the material in question. . . . Maryland Rule 5-104(b) establishes a nearly identical protocol; we, however, have not been asked in this case to address the efficacy of the Rule 5-104(b) protocol [in this case].

Griffin No. 2. (If you’d like to read more about conditional relevancy, read the comments to subdivision (b) of Federal Rules of Evidence 104, which you can find here.)

The Court of Appeals therefore reversed Griffin’s conviction and remanded the matter for a new trial in the Circuit Court of Cecil County. Griffin No. 2.

Challenge to Authentication of Images Fails

As I’ve noted in earlier posts, for an attorney to introduce evidence at trial, he/she must “authenticate” it, i.e., must show that the evidence is what it’s claimed to be. This post is about a challenge to the authentication of certain images recovered from computers a Texas defendant used.

The case is Creech v. State, 2011 WL 1663040 (Texas Court of Appeals 2011), and this is how it arose:

[John Preston Creech] taught human sexuality at Collin County Community College (CCCC). On August 21, 2006, he reported to the IT department that his computer keyboard was not working and his computer was performing slowly. Rob Hurst, a . . . technician for CCCC, responded. . . . While performing standard procedures to update the system, Hurst noticed files with suspicious names. He notified his supervisor that he may have found pornographic images on a computer.

Shane Ammons, executive director of academic technologies and network services for CCCC, removed the computer from [Creech’s] office. He copied images from [the] hard drive and put them in a separate folder on the computer's desktop. He copied the folder onto a flash drive. He showed Kim Russell, the vice president of human resources, print outs of some of the images and she contacted the president of CCCC.

College administrators met with [Creech] on August 23, 2006 and he admitted the images were on his computer and provided a `fairly lengthy explanation of his rationale,’ including looking at pornography to desensitize himself and researching to determine the line between legal and illegal images. CCCC terminated [his] employment.

CCCC notified the Frisco police department regarding the child pornography on [Creech’s] work computer. Officer Walters [searched] [his] home looking for additional evidence of child pornography. He seized [Creech’s] home computer, which also had images of child pornography. Walters noticed several pictures in the home of [Creech]with a young girl. He wanted to determine [her] identity and contact the family because he had concerns [Creech] may have victimized her.

Creech v. State, supra.

Before Walters determined her identity, he got a call from Creech’s girlfriend, Annette Cameron, who was the girl’s mother. Creech v. State, supra. When she learned Creech was being investigated for child pornography, she became concerned that he might have “acted inappropriately” with “A.R.”, her daughter. Creech v. State, supra. A.R. was interviewed by a child psychiatrist, and that interview eventually led A.R. to reveal that Creech had touched her sexually on at least two occasions. Creech v. State, supra.

Creech was charged with “aggravated sexual assault of a child, two counts of indecency with a child, and five counts of possession of child pornography”, went to trial and was convicted on all charges except for one of the indecency with a child counts. Creech v. State, supra. He was sentenced to “five ten-year sentences, one twenty-year sentence, and a life sentence to run concurrently,” and appealed. Creech v. State, supra.

Creech raised several issues on appeal, but we’re only concerned with the authentication issue I noted earlier. Creech claimed the trial court abused its discretion

by admitting unauthenticated images allegedly retrieved from his work and home computers. Because members of CCCC's IT department accessed [his] work computer and allegedly downloaded numerous images of child pornography as part of their `investigation,’ he claims the State failed to prove the images shown to the jury were what they purported to be: the true contents of [Creech’s] computer hard drives before the hard drives were removed from his custody and control.

Creech v. State, supra.

The Court of Appeals began its analysis of Creech’s argument by noting that under Texas Rule of Evidence 901(a), the “`requirement of authentication . . . as a condition precedent to admissibility is satisfied by evidence sufficient to support a finding that the matter in question is what its proponent claims.’” Creech v. State, supra. The court also noted that a chain of custody must be established when:

(1) there is a possibility of commingling the item with items similar in appearance, (2) the sponsoring witness has not marked with distinctive markings an item not having distinctive characteristics, or (3) there is a suggestion the evidence has been tampered or changed in some manner. Ballard v. State, 23 S.W.3d 178 (Texas Court of Appeals 2000). Proof of chain of custody goes to the weight of the evidence rather than the admissibility of the evidence. Lagrone v. State, 942 S.W.2d 602 (Texas Court of appeals 1997). Absent evidence of tampering or commingling, theoretical breaches in the chain of custody do not affect the admissibility of evidence.

Creech v. State, supra.

During the trial, the court held a hearing on Creech’s motion to suppress the images. Creech v. State, supra. Creech presented expert testimony from Timothy Hanners,

a computer forensic analyst. He testified the IT department did not use the best practices for securing [Creech’s] work hard drive because they should have created a binary copy of the drive and worked from it. He stated they worked for over twelve hours on the computer before it was secured and during that time, they changed dates on approximately sixteen thousand files, created or modified over six thousand files, and installed applications that would have deleted older files. He further testified there were viruses that could create links within a user's favorite links.

On cross-examination, Hanners could not say with certainty [Creech’s] work computer contained any viruses that would put images on the hard drive, in the computer's cookies, or on appellant's list of favorites. He also acknowledged all the images had a created, modified, and accessed date, and by simply viewing a file on August 21, 2006, the IT staff could not give an image an earlier created date.

Creech v. State, supra.

The prosecution relied on the testimony of Hurst and Ammons, who said they did not

add any pornography to [Creech’s] work computer. While both admitted to opening some files, which changed the accessed date, these actions only affected files already on the computer rather than adding new files. In fact, Hurst testified he did not change the created dates and to make such changes would require specialized software not installed on [Creech’s] work computer.

Ammons admitted that while he did not use the best practices for securing [the] work computer, he created a new folder in the middle of the desktop named FOUND 8/21 of ′06 and copied questionable images from the temporary internet files and put them in the new folder. He made an exact copy of images in the temporary internet files because he did not want to change the created date of the image.

He testified nothing in the process would have added pornography that was not already present on [Creech’s] work computer. While he admitted to using [the] work computer to access images that would have been saved in the temporary internet files, the access date would have been August 21 or August 22.

Creech v. State, supra.

The state also relied on the testimony of Rod Gregg, a digital forensic examiner, who

confirmed there were images viewed on [Creech’s] work computer prior to August 21, 2006 and some files were viewed repeatedly. The images and files accessed prior to August 21 were not put on [his] work computer by Hurst or Ammons. He said while it was more complicated, it was not impossible for him to sort through what the IT staff did to [Creech’s] work computer prior to him examining it. He specifically testified all the information on State's Exhibit 20, a CD containing images of child pornography, were retrieved from [Creech’s] work computer.

Creech v. State, supra.

After reviewing this testimony, the Court of Appeals held that the trial judge acted within his discretion in “determining Hurst and Ammons did not tamper or change the contents of [Creech’s] work hard drive in such a manner that the State failed to authenticate the images as coming from [his] computer.” Creech v. State, supra. The Court therefore held that the images were properly authenticated and properly admitted. Creech v. State, supra.

The Court of Appeals also rejected Creech’s challenge to the authentication of images recovered from his home computer. Creech v. State, supra. The opinion doesn’t tell me exactly what Creech’s argument was here, but the Court of Appeals noted that Creech’s “home computer was properly seized by Officer Walters during a search of his home and transferred to the Regional Computer Forensic Crime Laboratory operated by the FBI in Dallas where it was logged in and bar coded.” Creech v. State, supra.

The court pointed out that the CCCC “IT staff never had possession” of Creech’s home computer and “therefore . . . did not, nor has [Creech] alleged, they tampered or altered the hard drove” of that computer. Creech v. State, supra. The court consequently rejected Creech’s challenge to the admission of this evidence, as well. Creech v. State, supra.

And because the Court of Appeals rejected Creech’s other arguments on appeal, it affirmed the conviction. Creech v. State, supra.

If you’re interested, here’s a story with a photo of Creech and his explanation as to why the images were on his computers.