Wednesday, December 02, 2015

The Flash Drive, ImageScan Software and Lay Testimony

This post examines an opinion from the Colorado Court of Appeals:  People v. Froehler, 2015 WL 4571431 (2015).  The court begins the opinion by explaining that “Kenneth Froehler appeals the judgment of conviction entered on a jury verdict finding him guilty of sexual exploitation of a child.”  People v. Froehler, supra.
It goes on to outline the events that led to his being charged and, ultimately, convicted:
Froehler checked into the Renaissance Hotel in Denver in the early afternoon of March 17, 2009. That evening, two men who appeared to be hotel guests found a flash drive plugged into one of the hotel's business center computers. The men opened some of the files on the flash drive and discovered child pornography. They immediately turned the flash drive over to hotel security. The men did not identify themselves and asked not to be involved further. The security guard contacted the police and gave them the flash drive.

The next morning, Froehler called the front desk and asked if anyone had turned in a flash drive. He described the missing flash drive as black with the words `DataTraveler’ on it. Because that description matched the flash drive turned in the night before, the clerk contacted the police.

Responding officers approached Froehler in the hotel parking lot and asked him about the flash drive. Froehler described its appearance and told them it contained personal pictures, pictures of Christmas lights, pictures of his dog, and business invoices from his company. Later investigation revealed that the flash drive contained those items, as well as 155 images and 4 videos of child pornography. Police later searched five laptops found in Froehler's home but discovered no child pornography on any of them.

The prosecution charged Froehler with one count of sexual exploitation of a child, a class four felony. At trial, the defense argued that someone else put child pornography on the flash drive after Froehler had accidently left it in the hotel computer. A jury convicted Froehler, and the trial court sentenced him to two years in the custody of the Department of Corrections and three years mandatory parole.
People v. Froehler, supra.
In his appeal, Froehler argued that the trial court judge
abused its discretion by allowing the detective who investigated the case to give improper lay testimony about (1) the dates associated with the images on the flash drive and (2) ImageScan, the software program used to search Froehler's laptops. Froehler contends that this evidence constituted expert testimony that should have been excluded because the detective was not disclosed or qualified as an expert. 
People v. Froehler, supra.
The Court of Appeals began its analysis of his arguments by explaining that
[w]e review the trial court's evidentiary rulings for an abuse of discretion. People v. Stewart, 55 P.3d 107 (Colorado Supreme Court 2002); People v. Veren, 140 P.3d 131 (Colorado Court of Appeals 2005). A trial court abuses its discretion if its ruling is manifestly arbitrary, unreasonable, or unfair, or based on an erroneous view or application of the law. People v. Stewart, supra; People v. Bondurant, 296 P.3d 200 (Colorado Court of Appeals 20120; People v. Esparza–Treto, 282 P.3d 471 (Colorado Court of Appeals 2011).
People v. Froehler, supra.
It went on to point out that Froehler
timely objected to the detective's testimony. Accordingly, we apply the harmless error standard for reversal. See People v. Stewart, supra; People v. Ramos, 2012 WL 5457354 (Colorado Court of Appeals 2012). Under this standard, we may not reverse a conviction if we `can say with fair assurance that, in light of the entire record of the trial, the error did not substantially influence the verdict or impair the fairness of the trial.’ People v. Stewart, supra (internal quotation marks omitted).

We reject Froehler's contention that the constitutional harmless error standard applies here. Colorado appellate courts have uniformly applied the ordinary harmless error standard where, as here, the defendant contends that expert testimony was improperly admitted as lay testimony and the objection was preserved. See, e.g., People v. Stewart, supra; People v. Ramos, supra.
People v. Froehler, supra.
The court then took up the law that governed its decision in the case, noting, first, that
[w]hether the trial court abused its discretion here turns on whether admission of the detective's testimony was proper under Colorado Rules of Evidence 701 (CRE 701). People v. Stewart, supra. That rule, which governs lay opinion testimony, applies because the prosecution did not seek to qualify the detective as an expert witness under Colorado Rules of Evidence 702 (CRE 702).

Under CRE 701 a witness who is not testifying as an expert may give testimony in the form of opinions or inferences only if those opinions or inferences are (a) rationally based on the perception of the witness, (b) helpful to a clear understanding of the witness' testimony or the determination of a fact in issue, and (c) not based on scientific, technical, or other specialized knowledge within the scope of CRE 702.

Froehler's argument focuses on the third requirement, which prohibits opinions based on `scientific, technical, or other specialized knowledge’ from being admitted as lay testimony.
People v. Froehler, supra.
The Court of Appeals then took up the issue Froehler raised on appeal, explaining that
[w]hether the trial court abused its discretion here turns on whether admission of the detective's testimony was proper under CRE 701. People v. Stewart, supra.  That rule, which governs lay opinion testimony, applies because the prosecution did not seek to qualify the detective as an expert witness under CRE 702. People v. Stewart, supra.

Under CRE 701, a witness who is not testifying as an expert may give testimony in the form of opinions or inferences only if those opinions or inferences are (a) rationally based on the perception of the witness, (b) helpful to a clear understanding of the witness' testimony or the determination of a fact in issue, and (c) not based on scientific, technical, or other specialized knowledge within the scope of CRE 702.  Froehler's argument focuses on the third requirement, which prohibits opinions based on “scientific, technical, or other specialized knowledge” from being admitted as lay testimony. People v. Stewart, supra.
People v. Froehler, supra.
It went on to explain that
[i]n determining whether testimony is lay or expert, the critical inquiry is whether a witness' testimony is based upon `specialized knowledge.’  People v. Veren, supra. Lay witness opinion testimony is proper only if the opinions or inferences `do not require any specialized knowledge and could be reached by any ordinary person.’ People v. Veren, supra. In deciding whether an opinion is one that could be reached by any ordinary person, courts consider whether ordinary citizens can be expected to know certain information or to have had certain experiences. People v. Veren, supra. Courts also consider `whether the opinion results from ‘a process of reasoning familiar in everyday life,’ or ‘a process of reasoning which can be mastered only by specialists in the field.’ People v. Veren, supra (quoting People v. Rincon, 140 P.3d 976 (Colorado Court of Appeals 2005)).
People v. Froehler, supra.
The court then went on to explain how courts in Colorado, and elsewhere, have analyzed, and resolved, these issues:
In People v. Stewart, supra, the supreme court recognized the difficulty in classifying a police officer's testimony as expert or lay opinion testimony. . . .  Police officers regularly, and appropriately, offer testimony under CRE 701 based on their perceptions and experiences. People v. Stewart, supra.  However, `[o]fficer testimony becomes objectionable when what is essentially expert testimony is improperly admitted under the guise of lay opinions.’ People v. Stewart, supra The court held that where an officer's testimony is based not only on his or her perceptions, observations, and experiences, but also on the officer's specialized training or education, the officer must be properly qualified as an expert before offering such testimony. People v. Stewart, supra.

The parties have not cited, and we have not found, any published Colorado appellate case that has addressed the distinction between lay and expert testimony in the context of computer-related testimony. Because CRE 701 mirrors Rule 701 of the Federal Rules of Evidence, we look to federal cases construing that rule for guidance. See People v. Stewart, supra.
People v. Froehler, supra.
The Court of Appeals then noted that in U.S. v. Ganier, 468 F.3d 920 (2006),
the [U.S. Court of Appeals for the] Sixth Circuit considered testimony by a forensic computer specialist who used forensic software to determine what searches were run on a computer. The court rejected the Government's argument that this was `simply lay testimony available by running commercially-available software, obtaining results, and reciting them.’ U.S. v. Ganier, supra. The court reasoned that interpreting the reports generated by the software would require the specialist to `apply knowledge and familiarity with computers and the particular forensic software well beyond that of the average layperson.’ U.S. v. Ganier, supra.

It distinguished this type of knowledge from the average lay person's familiarity with commonly used software programs:

`Software programs such as Microsoft Word and Outlook may be as commonly used as home medical thermometers, but the forensic tests [the specialist] ran are more akin to specialized medical tests run by physicians. The average layperson today may be able to interpret the outputs of popular software programs as easily as he or she interprets everyday vernacular, but the interpretation [the specialist] needed to apply to make sense of the software reports is more similar to the specialized knowledge police officers use to interpret slang and code words used by drug dealers.’
U.S. v. Ganier, supra. The court concluded that the testimony at issue involved `scientific, technical, or other specialized knowledge and constituted expert testimony. U.S. v. Ganier, supra.

In U.S. v. Wilson, 408 Fed.Appx. 798 (U.S. Court of Appeals for the 5th Circuit 2010), the Fifth Circuit considered testimony by an investigator who reviewed the defendant's e-mail account and, based on the empty sent-box, determined that the defendant had deleted all sent e-mails. U.S. v. Wilson, supra. The investigator did not use forensic software, and his computer experience was limited to using Microsoft Office products. U.S. v. Wilson, supra. The court concluded that his examination of the e-mail account fell `within the realm of knowledge of the average lay person’ and was `based on reasoning familiar in everyday life.’ U.S. v. Wilson, supra. (internal quotation marks omitted). Accordingly, it was properly admitted as lay opinion testimony. U.S. v. Wilson, supra. . . .

With these cases in mind, we now turn to the detective's testimony in this case.
People v. Froehler, supra.
The court prefaced that analysis with some introductory comments:
Froehler first contends that the trial court abused its discretion in allowing the detective to testify that the `date created’ and `date modified’ associated with the pornographic images on the flash drive preceded the date of Froehler's hotel stay. Froehler argues that this constituted expert testimony that was improperly admitted as lay testimony. We disagree.
People v. Froehler, supra.
It went on to explain that during her investigation, the detective sent the flash drive to
The Rocky Mountain Computer Forensic Lab. The lab used forensic software to extract information about the images, including dates they were created, modified, and accessed. The lab placed the contents of the flash drive on a CD and provided a report listing the dates associated with the images.

The defense requested disclosure of expert testimony before trial. The prosecution represented that it would not introduce any expert testimony but would have the detective testify as a lay witness about the dates in the lab report. On the morning of trial, the defense moved to exclude the report and related testimony, arguing, among other grounds, that its admission through a lay witness would be improper.

After hearing arguments from counsel, the trial court ruled that the detective would not be permitted to testify about information obtained from the lab's forensic analysis. However, the court ruled that the detective could give lay testimony about any information she herself observed by looking on the flash drive.
People v. Froehler, supra.
The court then pointed out that,
[f]ollowing the court's ruling, the detective plugged the flash drive into her computer and examined the images herself without the assistance of the lab's forensic software. She was then permitted to testify at trial based on her own personal observations.

On direct examination, the detective testified that she personally observed the created, modified, and accessed dates when she clicked on the images on the flash drive. She explained that she right-clicked each image file and hit `properties,’ and the computer then showed the created, modified, and accessed dates associated with the file. She was unable to view prior access dates because when she clicked on the file, the accessed date changed to the date she looked at it. However, she did observe the created and modified dates. She testified that those dates were prior to March 17, 2009, the date Froehler checked into the hotel.
People v. Froehler, supra.
The Court of Appeals then outlined its analysis of, and ruling on, this issue:
We conclude that the detective's testimony about the dates associated with the image files was properly admitted as lay witness testimony. The detective testified about the dates she personally viewed during her examination of the flash drive, which was separate from the lab's forensic analysis. She did not use forensic software to extract the dates, nor did she rely on information generated by the lab's forensic analysis. . . .

Rather, she accessed the dates simply by plugging the flash drive into her computer and right-clicking on the image files. In our view, the method she used to view the dates did not require any specialized knowledge or familiarity with computers beyond that of the average lay person. Right-clicking on a file to view its properties requires some basic computer competency, but it is within the realm of knowledge of ordinary people who use computers in everyday life. See also U.S. v. Wilson, supra viewing e-mail sent-box was `within the realm of knowledge of the average lay person’); U.S. v. Lee, 339 Fed. Appx. 153 (U.S. Court of Appeals for the 3rd Circuit 2009) (using GPS map ‘require[d] no specialized training or knowledge’).
People v. Froehler, supra.  The court also noted that the detective did not testify about
the meaning or significance of the dates on the flash drive. For example, she did not explain whether `date created’ referred to the date that the file was originally created or the date the file was loaded onto the flash drive. Nor did she testify to conclusions or inferences based on the dates. She simply reported the dates she observed, without interpreting them. Any ordinary person could make the same observation simply by clicking on the file.

Under these circumstances, we conclude that the detective's testimony about the image dates was not based on `scientific, technical, or other specialized knowledge within the scope of CRE 702. Accordingly, it was properly admitted as lay testimony under CRE 701.
People v. Froehler, supra. 
The court then took up the issue of the testimony about ImageScan Software, noting that Froehler claimed the trial court “abused its discretion in allowing the detective to give lay testimony about the ImageScan software program used to search Froehler's home computers, arguing that it also constituted expert testimony.” People v. Froehler, supra.  It also explained that the parties to this case
stipulated to certain facts regarding the search of Froehler's home computers. During cross-examination of the detective, the court read this stipulation to the jury:
The parties have agreed upon the following facts which you may accept as true:
1) Pursuant to a legal request from the Denver Police Department, the McHenry County Illinois Sheriff's Department seized computers from the home of Kenneth Froehler . . . on November 11, 2009.
2) The Sheriff's [sic] did not call Mr. Froehler prior to appearing at his home to conduct the search.
3) They collected two Toshiba Satellite notebook computers, a Panasonic notebook computer, and two Sony notebook computers.
4) Utilizing a program called Image Scan, the McHenry County Illinois Sheriff's Department scanned all files and media in Mr. Froehler's computers.
5) Image Scan is a software tool which was created for law enforcement by the FBI's Computer Analysis Response Team.
6) No images of child pornography were found on any of the computers seized from Mr. Froehler's home.
People v. Froehler, supra.  The opinion goes on to explain that on
redirect examination, the prosecutor asked the detective what ImageScan was. Defense counsel objected on the basis that the detective had not been qualified as an expert. The court overruled the objection and allowed the detective to testify as follows:

`ImageScan was developed by the FBI for law enforcement to do on-site search of a computer, . . . it just runs through the computer and pulls out any pictures. . . . It
doesn't do like a full forensic search or anything, literally just pulling the pictures. And once it does that, then it puts it in a format where you can click through thumbnails of pictures and see if any of them are related to your case, but it doesn't go beyond just the images.’

The detective also confirmed that she had personally used ImageScan.
People v. Froehler, supra.  According to the opinion, the prosecutor then asked the
detective what types of things ImageScan would not find. Defense counsel again objected, and the court again overruled her objection. The detective then testified about the limitations of ImageScan:
`It's not going to give you a history of what's been going on with the computer. It literally just pulls up the images that are on the computer. If somebody's used a wipe program on a computer, or if they have a file sharing program and then they clear it out afterwards, ImageScan is not going to give you the history of that. It's only going to give you the images that are on there.’

`[I]f it had been deleted but not cleared out yet, then it would pull up the deleted image, but it's not going to do a search for anything really beyond that.’

`[I]f it's an image and you just deleted it, ImageScan might still have it, but as time goes on, that area gets written over, so if that's a file there or an image and it's deleted and then it's written over, I believe ImageScan is not going to find it.’

Finally, the prosecutor asked the detective whether ImageScan would be able to find pictures that had been saved on a flash drive. The detective responded: `If somebody's using a computer and moving it—directly downloaded through the computer to an external drive, it's not going to—the images won't be on the computer for ImageScan to pull up.’
People v. Froehler, supra.  Froehler’s lawyer “briefly cross-examined the detective and confirmed that no child pornography had been found on [his] home computers.”  People v. Froehler, supra. 
The Court of Appeals then took up the question of law at issue here, i.e., whether the detective’s testimony about ImageScan was lay or expert testimony, noting that it
is a close question. On the one hand, the testimony was based, at least in part, on the detective's personal experience with using the program. See People v. Stewart, supra. She did not claim to have expertise in forensic computer analysis, nor did she describe any specialized training related to ImageScan as a basis for her testimony. . .

On the other hand, her testimony concerned a particular software program that was developed specifically for law enforcement. The general public could not be expected to have experience with, or even access to, that software. . . . Moreover, the detective's testimony went beyond explaining the search that was conducted in this case. She gave a technical description of the program's capabilities and limitations, and she offered assessments about whether it could retrieve images under various hypothetical scenarios. In our view, this testimony required specialized knowledge beyond that of the average layperson, including at least some technical understanding of how the program operated. . . .

On balance, based on `specialized knowledge’ within the scope of CRE 702 and, therefore, constituted expert testimony. Accordingly, the trial court erred in admitting it as lay testimony under CRE 701.
People v. Froehler, supra. 
The court applied “a harmless error analysis” to decide whether the error warranted reversal, noting that since the “improperly admitted testimony” about ImageScan related
“to the search of Froehler's home computers, not the flash drive which was the basis for the charged offense”, it was
only tangentially relevant to the central disputed issue in this case—whether Froehler `knowingly possessed’ the child pornography on the flash drive. . . .

Froehler argues that the absence of child pornography on his computers `tended to make it less likely’ that he put the child pornography on the flash drive, because one could `infer that someone who has child pornography on a flash drive probably has child pornography on other electronic devices.’ Thus, he claims that the detective's testimony about ImageScan's limitations undermined the exculpatory value of that evidence. Even according to this argument, the link between the ImageScan testimony and the flash drive is attenuated. Evidence about the software used to search Froehler's home computers had no direct bearing on whether Froehler `knowingly possessed’ the child pornography on the flash drive.

Moreover, the detective's testimony about ImageScan was not the only evidence of `knowing possession.’ In his closing argument, the prosecutor relied on other evidence admitted without objection to show that the flash drive contained child pornography before Froehler left it in the hotel's business center. Specifically, the prosecutor highlighted: testimony that the business center was busy during Froehler's stay; photographs showing that the screen of the computer where Froehler's flash drive was found faced the hallway; and testimony that the child pornography on the flash drive was organized into folders.

The prosecutor argued that it was unlikely someone could have downloaded 155 images and 4 videos of child pornography on the business center computer, put them on the flash drive, and organized them into folders without being seen. He also relied on the detective's testimony that the dates on the image files preceded the date of Froehler's stay, which, as we have concluded above, was properly admitted.
People v. Froehler, supra. 
The Court of Appeals therefore found that,
[g]iven the other evidence of `knowing possession,’ as well as the attenuated link between that disputed issue and the ImageScan testimony, we conclude that the improperly admitted testimony did not `substantially influence the verdict or impair the fairness of the trial.’ People v. Stewart, supra. . . .  

Froehler contends that the failure to disclose the detective's expert testimony before trial prevented defense counsel from adequately preparing for cross-examination or hiring an expert to rebut the detective's opinions. However, Froehler did not ask for a continuance at trial. . . . Nor does Froehler explain how defense counsel's cross-examination would have been different had the detective's testimony been disclosed prior to trial. Likewise, he does not explain how, if at all, a defense expert would have rebutted the detective's testimony about ImageScan's limitations.

Under these circumstances, we conclude that any error in admitting the detective's testimony about ImageScan was harmless and does not warrant reversal.
People v. Froehler, supra. 


No comments: