Monday, October 28, 2013

“Bones”, Dreamboard and Computer Forensics

After he was convicted of “engaging in a child exploitation enterprise” in violation of 18 U.S. Code § 2252A(g) and given a “life sentence”, John Wyss appealed.  U.S. v. Wyss, 2013 WL 5701059 (U.S.Court of Appeals for the 5th Circuit 2013). The Court of Appeals begins its opinion by noting that the

key issue at trial was whether Wyss properly was identified as the person, using the screen name `Bones’, who published child pornography onto an internet bulletin board known as `Dreamboard’.

U.S. v. Wyss, supra. In a footnote the court explains that Dreamboard is a

highly encrypted, members-only, internet bulletin board that promotes members to produce, advertise and share pornographic images and videos of child sexual abuse, including links to an approved, password protected, third-party website for downloading.

U.S. v. Wyss, supra.

Before it took up Wyss’ challenges to his conviction, the Court of Appeals noted how the prosecution arose:

As a result of search warrants executed at Dreamboard's host entity, Certified Hosting Solutions, the government seized the hard drives for Dreamboard's servers. Stored IP addresses were obtained from the servers. With those addresses the government's computer forensics specialist, James Fottrell, was able to determine the names of Internet Service Providers, such as Sprint for each IP address.

Subpoenaed records from Sprint allowed Fottrell and other government investigators to identify John Wyss, at a specified address in Monroe, Wisconsin, with an assigned network access identifier `JWYSS14’ as the person who posted child pornography on Dreamboard using the name `Bones’.

Prior to execution of warrants at the latter address, Wyss's half-sister Teresa Dampier was informed by her live-in friend Jerry Dahlen, a member of the Monroe, Wisconsin police department, that her brother was in trouble again and that federal agents were planning to search their residence. Dampier relayed that information to Wyss who denied knowing the reasons for agents' interest in him.

Dampier and Dahlen confirmed that Wyss received mail at their residence, but lived in the sleeper compartment of his tractor-trailer. Wyss's location was subsequently determined through a court order to Sprint. That order authorized agents to obtain cellular tower location information used by Wyss's cellular telephone to connect to the Internet.

U.S. v. Wyss, supra.

According to the opinion, Wyss was arrested and officers executed a search warrant at

his tractor-trailer at a border checkpoint north of Laredo, Texas. Among various items seized during the search of the sleeper compartment and admittedly owned by Wyss, agents found a Gateway laptop computer with a hard drive that was completely empty, a Sprint cellular telephone, three Sprint aircards Wyss admitted using to access the Internet, an empty box for a Toshiba laptop computer, a power cord that did not fit the Gateway laptop, a product key for a Toshiba laptop, and a DVD with the image of a child, nude from waist up, and containing the word `Lolita’.

After receiving his `Miranda’ rights Wyss orally agreed to speak to agents. He denied involvement with child pornography and membership in an internet bulletin board. While denying ever using the screen name Bones, he did admit to visiting other interest websites that corresponded with online activities and postings by Bones.

Subsequently during a series of jailhouse discussions with his cellmate, Wyss admitted he used the name Bones on Dreamboard, describing his and other members use of that internet bulletin board. Wyss further admitted that he destroyed certain incriminating evidence of child pornography before his arrest due to suspicion that he was under investigation. The cellmate, Michael Biggs, was a Dreamland member who testified against Wyss pursuant to a plea agreement. . . .

Over defense objections, [at Wyss’] trial,] Sprint's custodian of records gave testimony to authenticate records of IP addresses, data usage and customer subscriber information. He further explained that the records were maintained by Sprint for billing purposes. The government's computer forensics expert Fottrell testified how he linked the IP addresses and data used by Bones on Dreamboard's servers to the IP addresses and data assigned to Wyss' Sprint account records.

U.S. v. Wyss, supra.

Wyss made several arguments on appeal, only one of which is examined here.  He argued that Rules 702 and 704 of the Federal Rules of Evidence were violated when

the district court [judge], over his timely objection, impermissibly allowed the government's computer forensic expert to opine that Wyss is the same person who participated on Dreamboard using the name Bones. He further argues that the erroneous admission of that testimony gravely affected his substantial rights to a fair and impartial trial.

The prosecution counters that there is no showing of an abuse of discretion because the expert was accepted as a computer forensic expert, sufficient reliable evidence of record formed the basis for his opinion, and that it did not embrace Wyss's mental state or condition.

U.S. v. Wyss, supra.

The Court of Appeals began its analysis of Wyss’ argument by noting that

[w]e review evidentiary rulings for an abuse of discretion, and in the event of error, we will affirm provided the error is harmlessSee U.S. v. Valencia, 600 F.3d 389 (U.S. Court of Appeals for the 5th Circuit 2010). While `review of evidentiary rulings is heightened in a criminal case,’ U.S. v. Gutierrez–Farias, 294 F.3d 657 (U.S. Court of Appeals for the 5th Circuit 2002), to obtain reversal, the appellant `must demonstrate that the district court's ruling caused him substantial prejudice.’ U.S. v. Bishop, 264 F.3d 535, 546 (U.S.Court of Appeals for the 5th Circuit 2001).

U.S. v. Wyss, supra.

The court then outlined the legal issues raised by Wyss’ argument about the trial judge’s letting the government’s expert to express his opinion that Wyss was “Bones”:

An expert witness may testify at trial if his/her `scientific, testimonial or other specialized knowledge will help the trier of fact to understand the evidence or to determine a fact in issue.’ Federal Rules of Evidence 702. Further, an expert may testify `in the form of an opinion or otherwise, if (1) the testimony is based upon sufficient facts or data; (2) the testimony is a product of reliable principles and methods, and (3) the witness has applied the principles and methods reliably to the facts of the case.’ Federal Rules of Evidence 702.

An expert `opinion is not objectionable just because it embraces a ultimate issue’. Federal Rules of Evidence 704. An expert in a criminal case may not, however, offer `an opinion about whether the defendant did or did not have a mental state or condition that constitutes an element of the crime charged or of a defense. Those matters are for the trier of fact along.’ Federal Rules of Evidence 704.

U.S. v. Wyss, supra.

The Court of Appeals then applied this standard and found there was no error:

Testimony from the government's computer forensic expert, Fottrell, was based on examination and comparisons of Wyss's Sprint records, IP addresses and data assigned to him on certain dates and times, along with data retrieved from the Dreamboard servers showing the IP addresses and data that correspond to postings by Bones.

Without objection during his direct examination, the expert explained how he identified the use of Wyss's Sprint internet account to post messages on Dreamboard under the name of Bones on multiple occasions during relevant periods of time. Testimony also showed there was only one Dreamboard member using the name Bones as an identifier.

Cross examination of the expert sought to shift responsibility for Dreamboard postings away from Wyss to the possibility of technical manipulation of his computer by others, including third party access to control his computer, in order to make Dreamboard postings. On re-direct examination, over defense objection, and in response to the defense proffered possibilities of technical manipulation, the expert stated he `believed that John Wyss, Sprint customer, is Bones on Dreamboard.’

As stated before, that conclusion was based on linking up Dreamboard activity with Wyss's Sprint account usage. At that point and upon counsel's request, the district court admonished the jury on the use of expert testimony. While the instruction was neither the full pattern instruction nor an objected-to charge on how to treat expert testimony, the ultimate jury instructions given at the end of trial gave the complete explanation. We discern no substantial harm in the latter regards.

U.S. v. Wyss, supra.

The court also noted that

[e]ven assuming errors from the opinion testimony, it was harmless error in light of the remaining overwhelming evidence, which was discussed above. Wyss acknowledges that prior to the opinion given during redirect examination, the expert provided the jury with adequate information to reasonably decide whether Wyss operated under the online screen name `Bones’. 

In additional consideration of all other evidence in the light more favorable to the prosecution and due deference to the jury's verdict, we agree.

U.S. v. Wyss, supra.

No comments: