Warrant Needed to Search Cell Phone

On December 15, 2009, the Supreme Court of Ohio decided State v. Smith. You can find the opinion here. The Smith court addressed an issue I’ve done posts on before: whether officers who arrest someone can search the contents of her cell phone without first obtaining a search warrant.

As I explained in an earlier post, when someone is arrested in a manner that does not violate the Fourth Amendment (i.e., with an arrest warrant in their home, with or without an arrest warrant anywhere else), that triggers an exception to the 4^th Amendment’s requirement that officers obtain a warrant before conducting a search of a person or place.

As I’ve explained, the exception is known as the “search incident to arrest” exception and it lets an officer search (i) the person being arrested (including the contents of pockets, etc.) and (ii) the immediate area (the lunge area) into which they could reach for weapons or to destroy evidence. As I think I’ve also noted, an officer doesn’t have to articulate facts establishing that the lunge area search was necessary in a given case; those justifications for conducting a search incident of the lunge area are blanket policies that automatically justify such a search.

As I’ve noted in earlier posts, courts have been grappling with whether the search incident exception lets an officer turn on a cell phone (or a Blackberry or other device) and search through the data it contains. Defendants in a number of cases have argued that while the officer can seize the cell phone (to ensure the arrestee can’t use it as a weapon or destroy evidence it contains), the officer should have to get a search warrant to go through its contents. So far, that argument hasn’t done very well. As a federal judge noted earlier this year, “a number of courts have held that the contents of a cell phone, such as text messages, the call log, and the address book, may be examined as a search incident to arrest. Brady v. Gonzalez, 2009 WL 1952774 (U.S. District Court for the Northern District of Illinois 2009).

And that brings us back to State v. Smith. Here are the facts that led to Smith’s arrest:

On January 21, 2007, Wendy Thomas Northern was transported to Miami Valley Hospital after a reported drug overdose. While at the hospital, she was questioned by Beavercreek police. Northern agreed to call her drug dealer, whom she identified as . . . Antwaun Smith, to arrange for the purchase of crack cocaine at her residence. Beavercreek police recorded the cell phone conversations between Northern and Smith arranging for the purchase.

That evening, the Beavercreek police arrested Smith at Northern’s residence. During the arrest, police searched Smith and found a cell phone on his person. The arresting officer put the cell phone in his pocket and placed Smith in a cruiser, then searched the scene for evidence. Later, police recovered bags containing crack cocaine at the scene.

While the record does not show exactly when they first searched Smith’s cell phone, at some point police discovered that the call records and phone numbers confirmed that Smith’s cell phone had been used to speak with Northern. There was testimony that at least a portion of the search took place when officers returned to the police station and were booking into evidence the items seized from the crime scene. The police did not have either a warrant or Smith’s consent to search the phone.

State v. Smith, supra.

After being indicted for cocaine trafficking and several related crimes, Smith moved to suppress evidence obtained from his cell phone. The trial court held that it would allow

testimony regarding the cell phone’s call records and phone numbers but would not allow use of photographs that had been discovered in the phone. The trial court based its decision on a decision from the Fifth Circuit, in which cell phones were likened to containers found on an arrestee’s person and subject to search for the preservation of evidence for use at trial. U.S. v. Finley (C.A.5, 2007), 477 F.3d 250.

State v. Smith, supra. Smith went to trial and was convicted on all charges, after which he appealed his conviction to the Ohio Court of Appeals for the Second District. State v. Smith, supra. The Court of Appeals upheld the trial judge’s ruling, but the Ohio Supreme Court agreed to review that decision. State v. Smith, supra. The issue it agreed to decide was whether “the Fourth Amendment prohibits the warrantless search of contents of a cellular telephone when it is seized incident to a valid arrest.” State v. Smith, supra.

In its decision, the Ohio Supreme Court noted that the “two leading cases” on this issue are the U.S. Court of Appeals’ decision in U.S. v. Finley, supra, and the U.S. District Court for the Northern District of California’s decision in U.S. v. Park, 2007 WL 1521573 (2007). It noted that the defendant in the Finley case “had conceded that a cell phone was analogous to a closed container” for the purposes of 4th Amendment analysis. State v. Smith, supra. The Supreme Court noted that “[b]ecause Smith does not concede here that a cell phone is analogous to a closed container, the analysis in Finley is not entirely applicable” in the Smith case. State v. Smith, supra.

In U.S. v. Park, officers executed a valid arrest of Park, searched him, found a cell phone and searched the cell phone without first obtaining a search warrant. U.S. v. Park, supra. When Park moved to suppress evidence found in his cell phone, the prosecution said the search was valid under the search incident to arrest exception. U.S. v. Park, supra. As I explained in an earlier post, the federal district court disagreed:

This district court reasoned that modern cell phones “have the capacity for storing immense amounts of private information” and thus likened the devices to laptop computers, in which arrestees have significant privacy interests, rather than address books or pagers found on their persons, in which they have lesser privacy interests. . . Because the search of the cell phone’s contents was not conducted out of concern for the officer’s safety or to preserve evidence, the court found that it did not fall under the search-incident-to-arrest exception and that the officers should have obtained a warrant to conduct the search.

State v. Smith, supra (summarizing the holding in U.S. v. Park, supra).

The Smith prosecutor argued that the Ohio Supreme Court should follow the decision in Finley because “a cell phone is akin to a closed container and is thus subject to search upon a lawful arrest.” State v. Smith, supra. The court declined to do so:

Even the more basic models of modern cell phones are capable of storing a wealth of digitized information wholly unlike any physical object found within a closed container. We thus hold that a cell phone is not a closed container for purposes of a Fourth Amendment analysis.

State v. Smith, supra. Since the Ohio court held that cell phones are not closed containers, it had to decide “how they should be classified” for purposes of 4^th Amendment analysis. It explained that the classification should not require “officers to discern the capabilities of a cell phone” before deciding how it should be approached. State v. Smith, supra.

[T]here are legitimate concerns regarding the effect of allowing warrantless searches of cell phones, especially so-called smart phones, which allow for high-speed Internet access and are capable of storing tremendous amounts of private data. While . . . Smith’s cell phone could not be called a smart phone . . . , it is clear . . . that [it] had phone, text messaging, and camera capabilities. . . . [I]n today’s advanced technological age many `standard’ cell phones include a variety of features above and beyond the ability to place phone calls. Indeed, like Smith’s phone, many cell phones give users the ability to send text messages and take pictures. Other modern `standard’ cell phones can also store and transfer data and allow users to connect to the Internet.

State v. Smith, supra. The court then held that cell phones and similar devices cannot be searched pursuant to the search incident exception; instead, an officer must obtain a search warrant:

Given their unique nature as multifunctional tools, cell phones defy easy categorization. On one hand, they contain digital address books very much akin to traditional address books carried on the person, which are entitled to a lower expectation of privacy in a search incident to an arrest. On the other hand, they have the ability to transmit large amounts of data in various forms, likening them to laptop computers, which are entitled to a higher expectation of privacy.

But cell phones are. . . . more intricate and multifunctional than traditional address books, yet they are still, in essence, phones, which makes them distinguishable from laptop computers. Although cell phones cannot be equated with laptop computers, their ability to store large amounts of private data gives their users a reasonable and justifiable expectation of a higher level of privacy in the information they contain. Once the cell phone is in police custody, the state has satisfied its immediate interest in collecting and preserving evidence and can take preventive steps to ensure that the data found on the phone is neither lost nor erased. But because a person has a high expectation of privacy in a cell phone’s contents, police must then obtain a warrant before intruding into the phone’s contents.

State v. Smith, supra.

IMHO, the Ohio Supreme Court got this one right. Now, as I’ve said before, I want to see how a court deals with whether the search incident exception applies to a laptop. The exception will be triggered when (i) Jane Doe is arrested and (ii) either is carrying her laptop (on her shoulder, say) or has the laptop next to her at the moment she’s arrested. As I noted earlier, the exception encompasses the person and whatever they’re carrying plus the immediate area around the person at least when they’re not arrested in a vehicle.

(The scope of a vehicle area search incident is a little murky since the U.S. Supreme Court’s decision in Arizona v. Gant, 129 S.Ct. 1710 (2009). The Smith Court cites Gant once, in passing, but doesn’t rely on Gant in its holding.)

Ghost v. EnCase

I could have entitled this post “battling computer forensic software programs.” It’s about a discovery dispute in a criminal case that centered around two such programs: EnCase and Ghost.

The case is State v. Dingman, 149 Wash.App. 648, 202 P.3d 388 (Washington Court of Appeals 2009), and it arose when Robert Dingman was charged with 21 counts of theft and 33 counts of money laundering in violation of Washington state law. I’m not going to summarize the facts that supported each count, because they’re redundant. Instead, I’m going to summarize the facts and charges in a few representative counts:

Dingman owned a business called Quality Home Enclosures (QHE), which installed residential sunroom additions. Starting in March 2001, he distributed sunrooms manufactured by Four Seasons. . . .

On June 6, 2001, Kent and Joyce Sharpe entered into a contract with QHE for a Four Seasons sunroom. They gave Dingman a $15,000 deposit. . . . On February 27, 2002, they paid him $7,652.75 for materials. In March, Dingman began preparing the site for the sunroom, and he poured a concrete slab by April 18. QHE did no further work. Four Seasons ultimately installed the sunroom. Count I, theft. . . .

Georgia and Louis Murphy entered into a contract for a sunroom on September 21, 2001. They gave Dingman a $10,000 deposit. On October 13, they gave him an additional check for materials. QHE did limited work at the site by August 2002, but then its work ceased. Count VII, theft. . . .

June and Wilford Gosnell entered into a contract with QHE for a sunroom in July 2002. On July 20, they paid Dingman $13,600. Count XLVIII, money laundering. . . .

Dree Snider and Liesl Bohn contracted for a sunroom in July 2002. They . . . Count LI, money laundering. . . .

State v. Dingman, supra. You get the idea. Dingman went to trial and was convicted of 16 counts of theft and 11 counts of money laundering, after which he appealed. State v. Dingman, supra.

His primary argument on appeal was that the “trial court erred in ruling on his discovery motions” and therefore “denied him an opportunity to prepare his defense.” State v. Dingman, supra. As I noted in an earlier post, the purpose of discovery is to make the trial as fair and efficient as possible; in criminal cases, discovery is designed to give the defense access to the information it needs to rebut the prosecution’s case. If you’re interested, you can read more about criminal discovery here.

Here is how the discovery issue Dingman raised on appeal came up during the pretrial process: Dingman moved for access to

his seized computers' hard drives to create his own mirror images, or receive mirror images of the drives in a readable format. . . . [T]he State created mirror image copies of the drives using the EnCase program.

At argument on the motion, Dingman asserted that neither his computer forensic expert nor defense counsel had access to the EnCase program. His expert, Larry Karstetter, testified that a copy of the program cost $3,607. Karstetter said that he did not use the program because it was created for use by law enforcement, and he expressed concern that its search function could contain inherent bias against the defense. He added that in all other cases in which he needed hard drive copies, the State provided the copies to him in a readable (non-EnCase) format.

The State's witnesses included Detective Gregory Dawson, who created the EnCase mirror image file for the State. He expressed two reservations about providing Dingman with the hard drives: the program, Ghost, used by Dingman's expert, could produce an inaccurate copy of the drives and the hard drives could be damaged because they had not been used for some time. Dawson stated that his office had a license to use Ghost but that he did not use it for forensic investigations.

In summarizing Dingman's request to the trial court, defense counsel stated that he merely wanted the discovery in a format that the defense and its expert could use. He gave this example:

`The State has translated the computers into Farsi, a foreign language that we don't speak, and asked us to take Farsi because that's what they decided to do and it was convenient and maybe very wise on their part. Well, we don't want it in their language, your Honor. We want the discovery as it existed in Mr. Dingman's computers and as it still exists in Mr. Dingman's computers.’

He added that the State already had an exact copy of the files . . . so it could easily detect if either Ghost or the age of the computers somehow altered the evidence.

The State countered that it did `not need to conform its investigation . . . to the whims . . . of the defense.’ . . . It added it had never had a problem with providing the copies of the files -- in EnCase format - to the defense. . . .

State v. Dingman, supra. The trial judge denied Dingman’s motion and ordered the prosecution to give EnCase copies to the defense. State v. Dingman, supra. He found

that the Ghost program would not provide an accurate image of files contained in the single Redundant Array of Independent Disks (RAID)-configured computer. It also noted that the EnCase search function, criticized by the defense, was not the only search program available.

State v. Dingman, supra. Dingman sought, and was given, a continuance to allow his experts to analyze the EnCase copies; when he needed more time, his attorney asked for another continuance, submitting an affidavit from two experts as providing support for the motion:

Dingman's expert submitted an affidavit stating he was only able to review two of nine drives and, for the two examined, he encountered files that he could not yet open.

The Department of Assigned Counsel's Information Technology Specialist, Kathleen LaCoste, submitted an affidavit stating defense counsel had purchased a new hard drive, submitted it to the State, and received 77 folders and 4,868 files on the drive from the State. She also said the EnCase program is `not usable without program specific training.’ . . . She told the trial court no one in her office or the entire Pierce County computer support office was trained to use EnCase. She stated that the office had not purchased EnCase and that she had viewed some of the EnCase files using a 30-day trial version of another program, Mount Image Pro Software. This software could support the EnCase images, but it did `not substitute as an operating system that will actually run any of the associated programs required to open a specific file.’. . .

State v. Dingman, supra. The trial court denied the motion for another continuance and Dingman went to trial. On appeal, he relied on the rule I discussed in that earlier post: the prosecution’s obligation to give the defend access to documents, data and other tangible evidence that is within its possession.

In ruling on his argument, the Court of Appeals cited a federal district court decision which held that to satisfy this discovery requirement, a defense expert should be able to “`utilize his or her hardware or software.’” State v. Dingman, supra (quoting United States v. Flinn, 521 F.Supp.2d 1097, 1101 (U.S. District Court for the Eastern District of California 2007)). The Dingman court concluded that under the Washington Supreme Court’s interpretation of Washington criminal discovery law, the state was required to show “a need for appropriate restrictions before the trial court can limit a computer forensic expert’s analysis of a defendant’s hard drive to only the State’s chosen software format.” State v. Dingman, supra.

The court ultimately found that the prosecution had not done that in this case:

[A]ny potential alteration to the hard drives’ original condition that the Ghost software might cause can be detected because the State has the EnCase mirror image copies. Moreover, the State has a license to use Ghost. The State's remaining related objections, that the conversion to Ghost would be time consuming and that it need not conform discovery to Dingman's whims, are insufficient to overcome the goal of open discovery set out in [State v. Boyd, 160 Wash.2d 424, 158 P.3d 54 (Washington Supreme Court 2007)].

State v. Dingman, supra. The Court of Appeals therefore held that the trial court “erred by requiring that the State provide only an EnCase mirror image of Dingman’s hard drives to the defense.” State v. Dingman, supra. It found that the remedy for the error was “to reverse and remand for a new trial”, which is exactly what it did. State v. Dingman, supra. Since the Washington Supreme Court declined to review the propriety of this decision, it stands as final. See State v. Dingman, 166 Wash. 2d 1037, 217 P.ed. 783 (Washington Supreme Court 2009).

I wasn’t able to find any news stories about what happened next. I assume the state is either going to try Dingman again on similar charges or maybe they’ve worked out some kind of plea bargain.

Multiple Images of Child Pornography: 1 Crime or Many?

This post returns to an issue I've dealt with in prior posts: How do you decide when one crime or more than one crime should be charged?

As I explained in a post I did last year, in criminal procedure charging documents (e.g., indictments, informations) charge separate crimes in separate “counts” of the document.

As I explained in another post, if an indictment breaks one crime up into many counts, it will be challenged as multiplicitous, i.e., as breaking what should be a single crime up into many different crimes. As I explained in the initial post, if an indictment charges two or more crimes in a single count, it will be challenged as being duplicitous.

And, finally, as I explained in a post I did a few months ago, the standard courts use to decide when two crimes are the same is the Blockburger test: In Blockburger v. United States, 284 U.S. 299, 304 (1932), the U.S. Supreme Court held that the standard is “whether each provision requires proof of a fact which the other does not.”

All of that brings us to the issue this post addresses: It is a crime under both state and federal law to possess child pornography, i.e., to possess material that depicts a minor engaged in sexual activity. Since those who possess child pornography usually possess multiple images, the question as to arisen as to whether possessing, say, 10 images of child pornography is (i) 10 counts of possessing child pornography or (ii) 1 count of possessing child pornography. In other words, the issue is the standard to be used in parsing the possession of some quantity of child pornography into a crime or into multiple crimes.

This issue seems to have come up primarily at the state level, and the courts that have addressed it tend to disagree on the correct answer. I suspect the disagreement is, at least in part, a function of the idiosyncrasies of state law.

In Peter v. Ogle, 2009 WL 1163838 (California Court of Appeals for the First District 2009), for example, the court held that the defendant’s “possession of multiple images of child . . . was a single criminal violation” of California Penal Code § 311.11(a). Section 311.11(a) makes it a crime to knowingly possess

any matter, . . . including, but not limited to, any film, filmstrip, photograph, negative, slide, photocopy, videotape, video laser disc, computer hardware, computer software, computer floppy disc, data storage media, CD-ROM, or computer-generated equipment or any other computer-generated image that contains or incorporates in any manner, any film or filmstrip, the production of which involves the use of a person under the age of 18 years, knowing that the matter depicts a person under the age of 18 years personally engaging in or simulating sexual conduct. . . .

Jeffrey Ogle was charged with violating this provision when he was arrested at

approximately 10:45 p.m. . . .in relation to a prowling charge which occurred outside a 13-year-old girl's residence in the City of Napa. During a search of [Ogle’s] vehicle incident to his arrest, the police recovered a video camera, which was camouflaged with black electrical tape. The cassette inside the video camera contained separate footage of 12 different teenage girls in various stages of undress, some completely nude, filmed through the windows at their respective residences. . . . The girls ranged from 13 to 19 years old.

People v. Ogle, supra. Ogle was charged with and eventually pled no contest to three counts of possessing child pornography, but preserved his right to “argue on appeal that `despite pos[s]ession of multiple images’, he was guilty of a single” . . . offense of possessing child pornography. People v. Ogle, supra.

On appeal, Ogle claimed he “improperly suffered multiple convictions for a single act of possession of child pornography because the same videotape provided the factual basis for each of [his] convictions.” People v. Ogle, supra. In other words, he claimed there was only crime – and therefore should have been only one count – because the possession charge was based on one videotape. The prosecution argued that there were “`separate and discrete offenses’ because each segment of the videotape involved separate young women videotaped at different times.” People v. Ogle, supra.

In ruling on the issue, the Court of Appeals noted that the California Court of Appeals for the Third District had held, in People v. Hertzig, 156 Cal. App.4^th 398, 67 Cal. Rptr. 3d 312 (2007) that a defendant’s

possession `of multiple images on one computer’ was a single violation of section 311.11, subdivision (a). . . . The court pointed out that the act proscribed by section 311.11, subdivision (a), is the act of possessing child pornography, not the act of abusing or exploiting children.

People v. Ogle, supra. A year later, the California Court of Appeals for the Fifth District held that “possession of multiple images of child pornography cannot be `fragmented’ into separate counts so long as the images are possessed `simultaneously’ and are `found at the same time and in the same place.” People v. Ogle, supra (quoting People v. Manfredi, 169 Cal. App.4^th 622, 87 Cal. Rptr.3d 810 (2008)).

The Ogle court adopted “the reasoning in Hertzig and Manfredi” and therefore held that Ogle’s “possession of multiple images of child pornography on his video camera as a result of his surreptitious recording of young women was a single criminal violation of” § 3111.11(a). People v. Ogle, supra. The California Court of Appeals for the Sixth District reached the same conclusion in People v. Ciccarelli, 2009 WL 3635801 (2009).

Other courts have reached different conclusions. In State v. Fussell, 974 So.2d 1228 (Louisiana Supreme Court 2008), the court was required to decide if, under Louisiana Revised Statutes § 14:81.1(A), a defendant could “be charged with possessing multiple counts of child pornography or . . . should be charged with only one count for a single act of possession of multiple images of child pornography.” The Louisiana statute makes it a crime to possess “any photographs, films, videotapes or other visual reproductions of any sexual performance” involving a child under 17.

After an exhaustive review of cases from Louisiana and elsewhere, and an equally exhaustive analysis of the language and legislative import of the statute, the Louisiana Supreme Court found that the Louisiana legislature

intended to prevent any child from ever being victimized by punishing any of four types of offenders for each action that contributes to that child's sexual exploitation, including a defendant who intentionally possesses child pornography. . . .Thus, in the instant matter, we hold that the language of [§ 14:81.1(A)(3)] evidences a legislative intent to allow a separate conviction on a separate count for each child, in each sexual performance in which that child is victimized, that is captured in any photographs, films, videotapes, or other visual reproductions that a defendant intentionally possesses.

State v. Fussell, supra. This court, therefore, held that the benchmark for determining the scope of a possession count is the discrete act(s) involved in victimizing a child. The Pennsylvania Supreme Court reached the same conclusion in Commonwealth v. Davidson, 595 Pa. 1, 938 A.2d 198 (2007), as did the Indiana Court of Appeals in Brown v. State, 912 N.E.2d 881 (2009).

The U.S. Court of Appeals for the Second Circuit reached the opposite conclusion in U.S. v. Polouizzi, 564 F.3d 142 (2009). After being convicted of multiple counts of possessing child pornography, Polouizzi (aka Polizzi) argued that his convictions “must be vacated because. . . . the conduct charged in the indictment – possessing a single collection of child pornography . . . – constitutes only a single” crime. U.S. v. Polouizzi, supra. Polizzi was convicted under 18 U.S. Code § 2252(a)(4)(B), which makes it a federal crime to possess “1 or more books, magazines, . . . video tapes, or other matter” which contains “any visual depiction” of a child engaged in sexually explicit conduct.

The 11 possession counts in Polizzi’s indictment each alleged that he

` knowingly and intentionally possess[ed]’ one computer file containing a visual depiction of minors engaged in sexually explicit conduct. . . . Collectively, therefore, the eleven counts were for possession of eleven computer files.

U.S. v. Polouizzi, supra. The government argued that the benchmark for determining the scope of a possession count under this statute was “each `matter’”, so the possession of each file (or each image) became a separate count. U.S. v. Polouizzi, supra. The Second Circuit Court of Appeals disagreed:

Based on the clear language of the statute, we conclude that Congress intended to subject a person who simultaneously possesses multiple books, magazines, periodicals, films, video tapes, or other matter containing a visual depiction of child pornography to only one conviction under [18 U.S. Code § 2252(a)(4)(B)].

U.S. v. Polouizzi, supra. The court primarily relied on the language of the statute:

The language`1 or more,’ . . . indicates that a person commits one violation of the statute by possessing more than one matter containing a visual depiction of child pornography. Thus, unlike the word `any,’ which `has “typically been found ambiguous in connection with the allowable unit of prosecution,” for it contemplates the plural, rather than specifying the singular,’ . . . the phrase `1 or more’ specifies the plural. Thus, the plain language of the statute provides that a person who possesses `1 or more’ matters containing a prohibited image has violated the statute only once.

U.S. v. Polouizzi, supra. The Polouizzi court’s distinction between the use of “1 or more” and “any” at least arguably reconciles its decision and the Louisiana Supreme Court’s decision in Fussell. It cannot, however, reconcile the different holdings in Ogle and Fussell, at least not in terms of the plain language used in the respective statutes at issue in those cases.

I tend to agree with the Ogle court that the “harm” criminalized by possession of child pornography statutes is the possession of the material, not the victimization of the child. We have other statutes that can be used to prosecute people who victimize children in order to manufacture child pornography.

If we accept the premise that the gravamen of the crime is “possession,” then treating a single act of possessing some quantum of child pornography makes sense given how we approach possession in other contexts. Assume, for example, that a state statute makes it a crime to possess any of a list of controlled substances; assume, further, that one of those controlled substances comes in pill form. Now assume that police search John Doe’s home and fine 500 pills of a substance the possession of which is outlawed by the statute.

Would it make sense to charge Doe with 500 counts of possessing that substance . . . based on the fact that he possessed 500 different pills, each of which contained that substance? Or does it make more sense to charge him with a single act of possessing that drug?

I think, and I think U.S. law has pretty much taken this approach, that it makes more sense to charge Doe with a single count of possession . . . and then factor the quantity of the item he possessed into the calculation of his sentence. If we go with that theory, then it seems logical to apply the same approach to possession of child pornography.

Forgery and Computer Fraud

As I’ve noted in earlier posts, the test courts use to determine if two crimes are the same is the Blockburger test. In Blockburger v. United States, 284 U.S. 299, 304 (1932), the Supreme Court held that the test is “whether each provision requires proof of a fact which the other does not.”

This post is about a case in which the defendant raised what wasn’t technically a Blockburger argument, but was based on substantive similarities between what were alleged to be two crimes.

The case is State v. Jackson, 2009 WL 4035256 (Kansas Court of Appeals 2009), and here are the essential facts:

Kimberly Ross owned a house . . . in Salina. . . . [and] had not given anyone . . . permission to live in the house. . . . Ross [heard] . . . there was a bicycle on her property and the windows were open. . . . Ross sent her father, Jim Lytle, to the house . . . . Lytle asked [Daniel] Jackson if he lived at the house, and Jackson [said] he. . . . bought [it] . . . .Lytle told Jackson that his daughter owned the house. . . .

Ross contacted the Salina police. Two officers were sent to the property [and] spoke with Jackson. . . . [who] admitted he had been living [there]. Jackson showed one of the officers a lease agreement, which Jackson said allowed him to live in the house. . . .

Lieutenant Salzman. . . . noticed that the landlord's signature appeared to be computer generated. . . . [and] Ross told police she had not rented the property. . . . Salzman told Jackson he did not think the lease agreement was real. Jackson [said] the person he was renting from . . . had drafted the agreement using a computer at the public library.

Salzman and Jackson went in the house. . . . Salzman noticed a . . . laptop computer in the house. Jackson told Salzman that he had used the laptop computer to help draft the lease agreement. Jackson was arrested and taken to the Salina Police Department.

State v. Jackson, supra. When police searched the house, they found “a letter dated July 1, 2007, from Ross to Nijeil Beiker thanking him for the offer on her property;” an identical letter dated September 1, 2007; an owner's affidavit signed by Ross; and a quit claim deed in favor of Beiker signed by Ross. State v. Jackson, supra. Ross would later testify that she never signed any of these documents. State v. Jackson, supra.

At the police station, Jackson told Officer Melissa Short that before he lived at Ross’ house he was homeless for 18 months and was looking for a place to stay when he was approached by Beiker, who told Jackson he purchased a residence and would lease it to Jackson if Jackson would be willing to do some work on it. State v. Jackson, supra.

Jackson [said] he contracted with Beiker to pay a $400 deposit and $400 monthly rent plus utilities for the residence. . . . Jackson [said] Beiker had not been familiar with how to draft a lease agreement so they had drafted the documents at the library. Short asked Jackson about . . . inconsistencies between the lease and his statements to the police, including the amount of the deposit and rent, the date Jackson was supposed to take possession of the property, and the fact that Beiker's signature appeared to be type. . . . Short later testified that Jackson was unable to . . . explain the inconsistencies.

State v. Jackson, supra. Short asked for Beiker's contact information, which Jackson couldn’t provide. State v. Jackson, supra. Short tried to find Beiker by running a driver's license check in Kansas and Missouri and a vehicle registration check in Missouri, running his name through the police department’s computer system and checking city water files. Her efforts were unsuccessful, and Beiker was never found. State v. Jackson, supra.

Jackson was charged with and convicted of one count each of criminal trespass, criminal damage to property, computer crime and forgery. State v. Jackson, supra. Jackson challenged all of the convictions in his appeal to the Kansas Court of Appeals, but we’re only concerned with the forgery and computer fraud counts.

Jackson claimed “there was insufficient evidence for the jury to convict him of forgery because the State failed to prove he had intended to defraud anyone.” State v. Jackson, supra. To find Jackson guilty of forgery under Kansas Statutes § 21-3710(a)(1), the prosecution had to prove each of these elements beyond a reasonable doubt:

1. That Jackson knowingly made, altered, or endorsed a residential lease package so it appeared to have been made or altered by Nijeil Beiker, who did not give such authority;

2. That Jackson did this act with the intent to defraud; and

3. That this act occurred on or between March 5, 2007, and October 5, 2007, in Saline County, Kansas.

State v. Jackson, supra (emphasis in the original).

Kansas Statutes § 21-3110(9) defines intent to defraud as “an intention to deceive another . . . and induce such person . . . to assume, create, transfer, alter or terminate a right, obligation or power with reference to property.” Jackson claimed the evidence was not sufficient to prove

an intent to defraud because the person to whom he intended to show the lease agreement had no authority to `assume, create, transfer, alter or terminate a right, obligation or power with reference to’ the [Ross] property. Jackson contends that although the evidence might have showed that he created the lease agreement `as a ruse to dupe any community member or police officer who questioned his right to be in the house,’ such a scheme was not done with an intent to defraud.

State v. Jackson, supra. The Kansas Court of Appeals agreed with Jackson:

Jackson did not obtain possession of the property . . . because of the lease agreement. Ross was not induced or intended to be induced to part with her property by presentation of the lease agreement. To the contrary, Ross had already been deprived of the use of her property before Jackson presented the lease agreement to the police.

Moreover, the police officers to whom Jackson showed the lease agreement did not have the power to assume, create, transfer, alter, or terminate a right, obligation, or power with reference to the Chester property. The lease agreement was created for and was used to cover up the illegal occupation of Ross' property.

State v. Jackson, supra. The court therefore reversed Jackson’s conviction for forgery.

Jackson then argued that if the Court of Appeals agreed that there was “insufficient evidence to convict him of forgery,” it should also find “that the State failed to present sufficient evidence that he committed a computer crime.” State v. Jackson, supra.

To convict him of computer crime under Kansas Statutes § 21-3755(b)(i)(B), the prosecution had to prove beyond a reasonable doubt that Jackson used a computer for the purpose of devising or executing a scheme or artifice with the intent to defraud or for the purpose of obtaining property, services or any other thing of value by means of false or fraudulent pretense or representation. State v. Jackson, supra. Jackson argued that in deciding whether the evidence was sufficient to prove computer crime, “the only document” the Court of Appeals could consider was the lease agreement. State v. Jackson, supra. His theory was that “the only scheme the jury found the State had proven beyond a reasonable doubt involved the creation of the lease agreement on the library’s computer.” State v. Jackson, supra.

The Court of Appeals did not agree with either proposition. As to the first issue, it noted that the prosecutor hadn’t limited the computer crime charge “to the lease agreement.” State v. Jackson, supra. At trial, the prosecutor used the lease agreement and the other documents found in Ross’s house (the letters plus the affidavit and quit claim deed) to prove both the forgery and computer crime charges. State v. Jackson, supra. So Jackson was charged with 5 counts of forgery but the jury convicted him of only one, and that conviction was based on the lease agreement. State v. Jackson, supra.

The Court of Appeals therefore rejected Jackson’s second proposition:

Because . . . forgery and computer crime have different elements, the jury could have found that that Jackson committed computer crime in regard to the documents found at the Chester property but did not commit forgery in regard to those same documents. . . .

Unlike forgery, computer crime does not require that Jackson did something to the documents so it appeared to have been made or altered by Ross. Moreover, based on the use of the disjunctive `or’ in the statute defining computer crime, an intent to defraud is not required for computer crime. As a result, a not guilty verdict for the charged crimes of forgery and a guilty verdict for . . . computer crime are not necessarily inconsistent.

State v. Jackson, supra. The Court of Appeals therefore held that the evidence was sufficient to prove Jackson’s guilt beyond a reasonable doubt. He had shown the

lease agreement to the police and several documents were found within the residence, including two letters allegedly from Ross, an owner's . . . affidavit, and a quit claim deed. All the documents appeared to have been computer generated. . . . Jackson admitted . . . he used his computer and the library computer to generate one of the documents. The . . . documents were part of a scheme . . . to illegally inhabit the . . . property. . . .

[T]he jury could have found Jackson created the quit claim deed and owner's (seller's affidavit) `for the purpose of obtaining property, services or any other thing of value by means of false or fraudulent . . . representation’. . . .

`Fraudulent representation’ . . . is a `false statement that is known to be false. . . and is intended to induce a party to detrimentally rely on it.’ Black's Law Dictionary 1022 (8th ed.2004). . . . Why would Jackson create a quit claim deed and an owner's affidavit with Ross' signatures if he did not intend to assert a property right at a future date and obtain services or money for the property? A lease agreement alone would have been enough for Jackson to cover up his illegal occupation of the property. . . .

State v. Jackson, supra. One thing this opinion illustrates is how the facts in a case can support a variety of charges. Another is how fraud and forgery can have very similar elements; here, both the forgery and fraud (computer crime) offenses required an intent to defraud and incorporated the same statutory definition of that term. Despite their similarities, they are not the same offense under Blockburger because each includes an element the other does not; forgery requires the alteration of a document while fraud (computer crime) requires the use of a computer.

It may seem peculiar for Kansas to use the phrase “computer crime” to refer to what I’m calling fraud, because it really is a fraud crime. The reason is that instead of adopting different statutes to define different computer crimes, Kansas took the same approach as the federal computer crime statute, 18 U.S. Code § 1030. Section 1030 defines a variety of computer crimes, including gaining unauthorized access to a computer, exceeding authorized access to a computer, computer extortion and computer fraud. Kansas’ computer crime statute – Kansas Statutes § 21-3755 – does essentially the same thing. So both the court and the prosecutor are quite correct when they refer to the charge against Jackson as “computer crime.”

"Data Carving" and Metadata

This post is about an argument that was made in U.S. v. Haymond, 2009 WL 3029592 (U.S. District Court for the Northern District of Oklahoma 2009).

In December of 2008, Andre Ralph Haymond was indicted on federal charges of possessing and attempting to possess child pornography.

The indictment charged Haymond with possessing “child pornography `including, but not limited to’ five specific files.” U.S. v. Haymond, supra.

The government apparently found an additional 135 images of child pornography after the indictment was returned:

There are 140 images at issue here. Of these, the Government claims to have identified 78 pornographic images on Defendant's computer hard drive and 62 images (including one video clip) that allegedly were made available through LimeWire from a location associated with Defendant.

U.S. v. Haymond, supra.

The opinion cited above deals with Haymond’s efforts to gain access to these images and other evidence in the case against him. Haymond filed a second Motion to Compel the government to give him access to images

allegedly contained on his computer that was seized by the Government pursuant to a search warrant . . . . The Government made a mirror image of Defendant's computer's hard drive. For convenience, this mirrored hard drive was made available to Defendant's expert, David Penrod (`Penrod’”) at the Regional Computer Forensic Laboratory (`RCFL’) in Denver, . . . near Penrod's home. . . .

Penrod complained he was unable, using his Encase software, to find any pornographic images on the mirrored hard drive. This generated Defendant's first Motion to Compel. On Sept. 2, after the Court directed Penrod to return and work with the RCFL to try again to access the images, he was able to find 14,000 images on the hard drive using the Government's Forensic Tool Kit (`FTK’) software. Allegedly, 78 of these images are unlawful child pornography. Defendant now complains that he cannot tell which of the 14,000 images are the 78 images on the hard drive that the Government contends constitute child pornography. Defendant further complains that the images have been `stripped’ of all metadata that would enable him to prepare a forensic defense to the pending charge.

U.S. v. Haymond, supra.

Haymond filed his Motion to Compel under Rule 16 of the Federal Rules of Criminal Procedure. Rule 16(E) states that

[u]pon a defendant's request, the government must permit the defendant to inspect and to copy . . . books, papers, documents, data . . . or copies or portions of any of these items, if the item is within the government's possession, custody, or control and:

(i) the item is material to preparing the defense;

(ii) the government intends to use the item in its case-in-chief at trial; or

(iii) the item was obtained from or belongs to the defendant.

As this court noted, and I explained in an earlier post, Congress modified this part of Rule 16 in 2006, when it adopted the Adam Walsh Act, which added § 3509(m) to Title 18 of the U.S. Code. Under § 3509(m) a judge must

deny a defendant's requests to copy or otherwise reproduce child pornography as long as the material is made `reasonably available’ to the defendant. `Reasonably available’ requires the Government to provide an `ample opportunity’ for inspection at a Government facility.

U.S. v. Haymond, supra. Haymond’s argument was that even though the government made the mirrored image of his hard drive “available” to Penrod at the Denver RCFL, Penrod still couldn’t find “the 78 images on the mirrored hard drive that the Government contends constitute child pornography.” U.S. v. Haymond, supra. Haymond therefore made three arguments as to why he was entitled to more comprehensive discovery.

The first was the “missing metadata” argument. Haymond said his expert couldn’t “find any metadata associated with the files on the mirrored hard drive and implie[d] that the Government may have `stripped’ this metadata when it `data carved’ images from the hard drive.” U.S. v. Haymond, supra. The judge didn’t buy this argument:

At the hearing on Sept. 16, 2009, the Government stated that the hard drive provided to Defendant was a `complete, exact’ copy of the hard drive the Government accessed and if Defendant did not have metadata, it is because the metadata is simply not there. . . . Defendant's own expert, Penrod, represented to the Court at the . . . hearing that he did not expect and was not looking for metadata.. . . . [T]he Court specifically asked Penrod if he was seeking metadata on the mirrored hard drive. He replied:

`Metadata is simply data such as the logical path to a file and the date and time of creation. . . . And you're not going to find that with any kind of-or with about 95 percent of data-carved items. All you're going to get is the image in this particular situation and the physical location of where that data is actually located on the hard drive.’

Later when Defense counsel queried Penrod about getting metadata . . . Penrod stated that he was `99.99-percent sure we won't find any metadata associated with these files.’

U.S. v. Haymond, supra. The judge therefore held that since Haymond hadn’t produced evidence showing that the government “`stripped’ metadata from the hard drive before creating the mirror-image”, there was “no basis for [Haymond’s] complaint in this regard”, i.e., no reason to grant what the Motion to Compel sought. U.S. v. Haymond, supra.

Haymond’s second argument was that he was entitled to additional discovery because his expert couldn’t find the 78 images “the Government contends are on the mirrored hard drive without poring over all 14,000 images found there.” U.S. v. Haymond, supra. The judge didn’t have to rule on this argument because the parties had worked it out:

At the Sept. 16 hearing, the Government agreed to send to the RCFL CDs containing all 140 images at issue in this case. These will be made available to Penrod at the RCFL and will remain in the custody and possession of the Government. Penrod will be able to access these images and compare them to data on the mirrored hard drive. Defense counsel stated that this will obviate the need for any cluster/sector information to locate the images as he had previously requested.

U.S. v. Haymond, supra.

That brings us to the third argument Haymond made in support of his Motion to Compel further discovery of digital evidence. He wanted the prosecution to create

redacted copies of the images at issue so he can use them with subpoenas to the internet web sites where the images originated. Defendant plans to subpoena information from the web site owner to the effect that the persons portrayed in the pornographic images are adults, not minors.

U.S. v. Haymond, supra. If the people in the images were adults, then the material was not child pornography and the charges against Haymond would fail. It might sound like a good argument, but it didn’t work, at least not completely:

[T]he Government stated that the core of its case at trial will be based on 10-12 of the 140 images. These include one video file and photographs where the Government has identified a juvenile victim. These images have been identified in the Child Victim Identification Program (`CVIP’) report available to Defendant. While the Government has not absolutely restricted itself to only using these 10-12 images at trial, it has confirmed that these will be the central core of the case. . . . Defense counsel has estimated that only about 15 percent of the images he has reviewed have any web site information embedded in them that would provide a basis for a subpoena. Accordingly, Defendant should focus on the 10-12 images identified in the CVIP report. If there are images with embedded web site information Defendant wants to subpoena, he shall identify those files well before trial and the Government will prepare redacted images for his use.

U.S. v. Haymond, supra. The Haymond judge noted that this procedure had been used in an earlier, similar case: U.S. v. Dobbs. U.S. v. Haymond, supra. He also noted that at the September 26 hearing in the Haymond case, Haymond’s attorney “conceded . . . that the subpoena issued in Dobbs to an internet site in Holland resulted in a `wild goose chase’” because the subpoena recipient ignored the subpoena. U.S. v. Haymond, supra.

Haymond is the only reported case I can find in which data carving was the basis for an altered/destroyed evidence claim. Not being a computer forensics expert, I can’t opine on the viability of such an argument, but my suspicion is that it’s not particularly sound.