Friday, February 19, 2010

Evidence Eliminator and Daubert

As Wikipedia notes, the Daubert standard governs “the admissibility of expert witnesses’ testimony during United States federal legal proceedings.” The standard comes from the U.S. Supreme Court’s decision in Daubert v. Merrell Dow Pharmaceuticals, 509 U.S. 579 (1993).


The Daubert Court rejected the earlier test that was used for this purposes, which came from the District of Columbia Court of Appeals’ decision in Frye v. United States, 293 F. 1013 (1923). The Frye court held that expert opinion testimony based on a scientific technique is inadmissible unless the technique is “generally accepted” as reliable in the relevant scientific community.


The Daubert Court held that when one side wants to present expert testimony, “the trial judge must determine . . . whether the expert is proposing to testify to (1) scientific knowledge that (2) will assist the trier of fact to understand or determine a fact in issue.” Daubert v. Merrell Dow, supra. It noted that this “entails a preliminary assessment of whether the reasoning or methodology underlying the testimony is scientifically valid and of whether that reasoning or methodology properly can be applied to the facts in issue.” Daubert v. Merrell Dow, supra.


The Daubert Court also noted that “many factors will bear on this inquiry” and said it would “not presume to set out a definitive checklist or test” to be used in this assessment. Daubert v. Merrell Dow, supra. It did note some factors a judge could consider in making the assessment: whether the theory or technique “can be (and has been) tested”; whether it’s been subjected to peer review and publication; the known or potential rate of error; and whether there is “widespread acceptance” of the technique within the relevant scientific community. Daubert v. Merrell Dow, supra.


This post is about a case in which a defendant tried to use Daubert to challenge the propriety of admitting certain testimony in his criminal trial. The case is State v. Starner, 2009 WL 3532307 (Ohio Court of Appeals 2009), and it began when Danny Starner was indicted “on thirteen counts of gross sexual imposition in violation of” Ohio Revised Code § 2097.05(A)(4) and on “nineteen counts of rape of a child under the age of thirteen” in violation of Ohio Revised Code § 2907.01(A)(1)(b). State v. Starner, supra.

Starner married Nancy McDaniel sometime in the early 1990's. . . . Nancy had two daughters, Vicky and Yvonne. Vicky eventually had two children, Doug, born 1995, and Meg, born1998. Yvonne also had a child, Emma, who was born in1994.


By four, Emma was living with her father and step-mother and visiting with Nancy and Starner on occasion. Two years later, Yvonne moved to Pennsylvania and was unable to exercise her bi-weekend visitation with Emma. Instead, Nancy and Starner began exercising these visitation periods with Emma. For the next several years, Emma visited her grandmother and Starner, whom she called `Poppy,’ every other weekend.

State v. Starner, supra. In 2008, Nancy died, and shortly afterward Emma said “Starner sexually abused her nearly every time she visited since she was six or seven years old.” State v. Starner, supra. She said in addition to physically abusing her, Starner “showed her photographs on his computer of adults who were nude, . . . had her sit on his lap and watch films of adults having sex, and took photographs of her while she had her clothing on and off.” State v. Starner, supra. Meg and Doug then said that Starner “had engaged in sexual activity with them” when they were children. State v. Starner, supra.


The authorities opened a criminal investigation of the allegations and executed search warrants at Starner’s home on February 20 and March 5 2008. They seized

numerous computers, hard drives, USB drives, computer accessories, cameras [and] girls' underwear. . . . .

A forensic analysis of the electronic equipment found numerous photographs of Emma clothed, some of which show her in seemingly provocative poses. However, no nude photographs of Emma or any other children were found. The analysis did find several photographs of nude adults on the hard drives. . . . [that] contained images of various sexual acts being performed. . . . In addition, a program entitled `Evidence Eliminator’ was found, as was evidence of its installation and use, on two of the computers seized from Starner's home. This program is designed to permanently remove files . . . from a hard drive. Further analysis showed that Evidence Eliminator was last accessed on one of the computers on . . . the day of the first search of Starner's home.


The analysis also discovered a number of sexually explicit stories on the hard drives. The subject matter of the vast majority of these stories centered around acts of incest and the molestation of children. . . .

State v. Starner, supra. Starner went to trial on the charges, was convicted and appealed, claiming the trial judge erred in allowing Agent Jim Hawks of the Ohio Bureau of Criminal Investigation (BCI) to testify “regarding the use of the Evidence Eliminator program.” State v. Starner, supra. Starner argued that Hawke shouldn’t have been allowed to testify because his testimony “failed the Daubert test for scientific reliability.” State v. Starner, supra. Here’s a summary of Hawke’s testimony:

[He said] his analysis of the computers . . . seized revealed that Evidence Eliminator was installed on two of them. State's Exhibit 1, a SunPro computer found in Starner's kitchen, showed Evidence Eliminator Version 6 was installed on the computer on January 8, 2008. Agent Hawke also found remnants of an earlier version of Evidence Eliminator on this computer. The analysis of this exhibit also revealed that this program was accessed several times, including at approximately 7:29 a.m. on the day Starner's home was first searched. . . .


Hawke testified that Evidence Eliminator is `marketed as a program to delete and overwrite data . . . we call it antiforensic program to delete the tools that I use in the laboratory to get the data back. It makes it so that I can't find the data because it's destroyed.’ . . . He also testified that `one of the things it does is it overwrites data that's on the hard drive.’ . . . [and] that Evidence Eliminator advertises that `it defeats the forensic tools we have to use to get the data back to be used as evidence or information in an investigation.’

State v. Starner, supra. All I know about the substance of Starner’s Daubert argument is what’s noted above. I assume it had something to do with . . . what? . . . with whether the Evidence Eliminator program itself is scientifically valid? With whether Hawke’s analysis of the installation and use of Evidence Eliminator on the two computers was based on a methodology that was scientifically valid? I’m really not sure.


And the Court of Appeals’ opinion doesn’t help me out. It held that contrary to Starner’s

assertions in his brief to this Court, the testimony about the marketing of Evidence Eliminator had nothing to do with any expert scientific testing or other such specialized information. Anyone with basic computer skills could find the website on the Internet and view how it is marketed. Thus, the Daubert test for scientific reliability was unnecessary.

State v. Starner, supra. I would agree with the Court of Appeals’ conclusion that testimony about the marketing of Evidence Eliminator wouldn’t raise a Daubert issue. (The court did consider the propriety of admitting the testimony under other evidentiary standards, and ultimately found it was properly admitted.) That seems a really narrow Daubert argument, though.


I wonder if Agent Hawke’s testimony also went to other issues involving Starner’s acquisition, installation and use of Evidence Eliminator and how that related to the facts at issue in the case. I wonder if any of that part of his testimony could have raised a Daubert issue. I’ve found a couple of reported cases in which Daubert was raised with regard to the propriety of admitting the testimony of a computer forensics expert. In one, a federal district court judge ordered a Daubert hearing held on the issue; in another case, a civil case, the court conducted a Daubert hearing and then held that a proposed defense expert witness wouldn’t be allowed to testify because the proponent of his testimony hadn’t shown that his methodologies were reliable under the Daubert standard. U.S. v. Kassir, 2009 WL 910767 (U.S. District Court for the Southern District of New York 2009); Rivera-Cruz v. Latimer, Biaggi, Rachid & Godreau, LLP, 2008 WL 2446331 (U.S. District Court for the District of Puerto Rico 2008).


I’m afraid this post is completely inconclusive. This is one of those opinions that makes me wonder if the proponent’s argument was as specious as the court makes it seem. I found one case in which a court held a Daubert hearing on the reliability of the methods a computer forensics expert used “pertaining to the alleged wiping of data from” a laptop and the conclusions he drew from his analysis. Nucor Corp. v. Bell, 2008 WL 4442571 (U.S. District Court for the District of South Carolina 2008). The court found that the expert’s methods didn’t meet the Daubert standard and therefore barred him from testifying.


That court, though, focused on the methodologies the prospective witness himself had devised and used to determine that evidence had been wiped. It therefore wasn’t dealing, as was the Starner court, with testimony about the functioning of a software program (or at least I’m assuming that was an issue in Starner’s Daubert argument). I know NIST tests the reliability of computer forensic tools, but I don’t know that it’s tested (or will test) Evidence Eliminator. If NIST had tested the tools Agent Hawke used to conduct his Evidence Eliminator analysis of Starner’s computers I assume that would mean they’d presumptively survive a Daubert challenge.


I’m probably making way too much of this. Maybe there really was no Evidence Eliminator issue in this case, as such; maybe the only use the prosecution made of Evidence Eliminator was to show what lawyers call “consciousness of guilt,” i.e., to infer from his possession and use of the program that he knew he was doing something “wrong.” As one court noted, instructions that “permit the jury to infer `consciousness of guilt’ from proven facts, such as making false statements regarding the crime, . . . suppression of evidence . . . and flight” have been held valid. People v. Lewis, 2010 WL 367297 (California Court of Appeals 2010). So maybe that’s all that was going on here.


4 comments:

Anonymous said...

I am a regular user of Evidence Eliminator and have been for the last 5 years. Everytime we discard an old computer (such as donate to Good Will), I always make sure the hard drive is 'cleaned'.

I also recall a case from Minnesota a couple of years ago where a court made an adverse presumption or something against a defendant who had no porn, but was accused of having porn and did have an encryption program. http://news.cnet.com/Minnesota-court-takes-dim-view-of-encryption/2100-1030_3-5718978.html

Maybe if the name of the program was changed to "Happy bunnies dancing in flowers" juries or courts would not be so turned off about it. But the stuff really does work - as your posting clearly shows!

By the way - I really like the new way you have formatted your blog. A HUGE improvement and much easier read. Thanks for doing this and doing a good job!!

Roland Bernier said...

Interesting post. From the scant evidence given, I understand the confusion. I believe it accurate to say that Evidence Eliminator removes data in such a manner that greatly reduces the chances of recovering by most (if not all) forensics "tools." Whether making that statement should subject me to a Daubert test is a wonderful question, but even if so, it's likely that Mr. Starner has sufficient knowledge to make that claim.

As to explaining how the recovery tools work in the first place...that might require a greater depth of knowledge.

I was involved in a case where we proved that Evidence Eliminator (or a similar tool) was installed on the day the court ordered the computer owner to submit his computer for forensic examination. We were unable to prove that anything damaging to his case was removed, but the mere fact that the installation occurred on that date threw the case in our favor.

BTW, (referencing the other comment) there are good reasons for installing a wiping program, and using it regularly. The mere fact that one has installed such an application certainly should not raise a presumption of guilt.

Anonymous said...

I don't know about the Daubert test and all of that, but I do know about this particular case and the idea of the criminal knowing that he had done something wrong and his house of cards was collapsing around him is clear from other evidence that was given at the trial. For example, a few days AFTER his wife's death, this man decided to seek treatment for impotence and difficulty with marital relations that he had been experiencing for several years. the doctor discovered that he had some physical issues that would cause this. One of the arguments presented at trial were that the inability to perform sexually would cause him to be unable to abuse a child, and the physician was called as a witness, his horror upon discovering that his new patient had attempted to use him to establish an alibi is likely something that will stick with him for the rest of his life, I would imagine.
Running programs on computers to eliminate problematic evidence, attempting to establish a medical excuse, washing clothing to remove potential evidence, and stashing things in out of the way areas of one's house are all things that clearly show a consciousness of one's guilt.
It was not ONLY the running of this wiping program that was used to demonstrate the actions of this criminal and most definitely not the only thing that raised the presumption of guilt which led to the investigation, trial and eventual guilty verdict.

Anonymous said...

Given that the identity of the minor children in this post is not something that is necessary for the support of your post, the fact that these children were horribly abused and humiliated by what happened to them, and that people tend to stigmatize victims of abuse, I am humbly asking that you remove the names of these children and their mothers from your post. I am well aware that this information is able to be tied to them, but the fewer places that they are tied to what happened to them the lower the chances of it finding its way back to be thrown in the face of these kids. It found its way to me quite easily.
Perhaps you could use their initials or just "juvenile male" and "juvenile female".
I know that I do not have the ability to force you to do this, but I would hope that you would feel a moral inclination to do what you can to help prevent any additional harm to these young victims that have been hurt quite enough by the criminal as well as what they all experienced at the hands of the criminal justice system.
Please.
Signed,
A Mother of a child victim