Friday, February 26, 2010

Entrapment by Estoppel

As Wikipedia notes, entrapment is usually a defense to a criminal charge. As Wikipedia also notes, entrapment occurs when a law enforcement officer induces one who was not otherwise predisposed to commit a particular crime to commit that crime.


In the famous (or perhaps infamous) case of Jacobson v. United States, 503 U.S. 540 (1992), the U.S. Supreme Court reversed a Nebraska man’s conviction for receiving child pornography because a majority of the Justices found he had been entrapped by postal inspectors. The majority in Jacobson found that since it took postal inspectors two years to finally get Jacobson to order child pornography indicated that he was not predisposed to commit the crime – he was, instead, induced to commit it by their efforts.


The U.S. Supreme Court recognized a related defense – the entrapment-by-estoppel defense – in Raley v. Ohio, 360 U.S. 423 (1959). The Raley Court held that to convict someone for doing what the government had told him was legal was “an indefensible sort of entrapment” which violated Constitutional guarantees of due process. Raley v. Ohio, supra. A defendant in a criminal case can, therefore, “assert an entrapment by estoppel defense when the government affirmatively assures him that certain conduct is lawful, the defendant thereafter engages in the conduct in reasonable reliance on those assurances, and a criminal prosecution based upon the conduct ensues.” U.S. v. Hernandez, 284 Fed. Appx. 24 (U.S. Court of Appeals for the 4th Circuit 2008).


This post is about a tax preparer who was prosecuted for filing false claims with the federal government and tried to use an entrapment-by-estoppel defense to avoid being convicted. Here’s how the case arose:

Onessimus M. Govereh ran the Norcross, Georgia office of Icon Tax Service from January 2, 2007 until February 15, 2007. . . . During that time, 107 personal income tax returns were filed electronically using Govereh's Electronic Filing Identification Number (`EFIN’), which he had obtained from the Internal Revenue Service (`IRS’). Each return bore Govereh's name as the tax preparer, and a copy of each return was saved on a password-protected computer he used. . . .


Govereh sat at a computer and entered information while taxpayers talked to him. He entered false information on their returns, including false information about dependants, earnings, and educational expenses. Govereh did not show his customers the returns he filed for them, so many were surprised to see the false information when they finally saw their returns. In all the returns, Govereh claimed the taxpayer was entitled to Telephone Excise Tax Refund [`TETR’] credits, even though he never discussed telephone use with any of them, nor did any provide any documentation about telephone use. . . .

Govereh . . . utilized a process called Refund Anticipated Loans. A taxpayer whose return indicates a refund is due can file for such a loan through an approved intermediary, such as Govereh, in advance of receiving the refund from the IRS. The bank that issues such a loan receives a certain commission from that loan and ultimately receives a check from the IRS in the total amount of the refund. A bank will not issue a loan in the full-agreed upon amount until the return is filed with the IRS, and, for the tax year 2006, no return could be filed electronically before January 12, 2007. Nonetheless, the participating banks -- HSBC Bank and Santa Barbara Bank and Trust -- permitted Govereh to print a check up to . . . $1600 prior to filing the return, and once [it] was filed electronically after January 12, the bank sent a check for the balance of any refund due.


Govereh had his customers cash both the advance check and the second loan check at the check-cashing business next door and return with his fees, which were often several thousand dollars. When the IRS ultimately refused to fund the claimed refunds and the banks contacted the customers about repaying their loans, many were surprised to learn they had even been parties to a loan. . . .

U.S. v. Govereh, 2010 WL 28565 (U.S. District Court for the Northern District of Georgia 2010). Govereh “was charged with twenty counts of filing false claims based on twenty returns that were filed in January 2007 in violation of 18 U.S. Code § 287, the False Claims Act (FCA).” U.S. v. Govereh, supra. (The opinion says the government “could have” charged him with 107 counts, but decided not “to extend trial time unnecessarily.”)


The False Claims Act provides as follows:

Whoever . . . presents to any person or officer in the civil, military, or naval service of the United States, or to any department or agency thereof, any claim upon . . . the United States, or any department or agency thereof, knowing such claim to be false, fictitious, or fraudulent, shall be imprisoned not more than five years and . . . subject to a fine. . . .

18 U.S. Code § 287. The IRS is an “agency” to which § 287 applies and false claims for refund are “claim[s] . . . upon the United States”. U.S. v. Ferguson, 615 F. Supp. 8 (U.S. District Court for the Southern District of Indiana 1985).


Govereh went to trial on the charges, despite the fact that the government’s evidence seems to have been pretty overwhelming. Fourteen of the people whose returns he prepared testified at trial and told “essentially the same story” – the scenario outlined above in which he sat at a computer and entered information while they talked to him. U.S. v. Govereh, supra. Another witness, who worked for Govereh in his office, testified that “Govereh told him he made most of his money selling phony dependents.” U.S. v. Govereh, supra. And the government had evidence showing the returns were prepared on the password-protected computer in Govereh’s office. U.S. v. Govereh, supra. He took the stand and testified “that he did not file the tax returns” but, as the court noted, a “jury is free to reject a defendant’s testimony and instead believe the prosecution’s witnesses.” U.S. v. Govereh, supra.


Not surprisingly, it seems, Govereh was convicted, after which he filed motions asking the judge either to reverse the jury and acquit him outright or grant him a new trial. U.S. v. Govereh, supra. He had several arguments as to why he should be acquitted or get a new trial, but we’re only concerned with the entrapment-by-estoppel argument.

[Govereh] argues that the Court should have instructed the jury that [his] actual and reasonable reliance upon a misrepresentation on a point of law by a Government official is a defense to the charged offense. [Govereh] contended that he believed that another employee at this tax preparation office, Kendra Robertson, worked for the IRS and it is she who [Govereh] offers as the Government official on whom he relied.

U.S. v. Govereh, supra. The federal district judge, though, found that Govereh didn’t establish the elements of the defense and so could not assert it. U.S. v. Govereh, supra. The judge noted that the first requirement is that the advice be given by a federal official:

There is no evidence that Kendra Robertson was an IRS employee. [Govereh’s] only basis for this assertion is that someone in the office told him she was an employee and she had confirmed that information. Even assuming someone had so informed [him], that does not prove Robertson was, in fact, employed by the federal government. Thus, on this record, there is no evidence that Robertson was a Government official.

U.S. v. Govereh, supra. The judge also noted that it wasn’t enough if Govereh believed she was a federal official; she had to actually be a federal official. U.S. v. Govereh, supra.


The judge also found Govereh hadn’t established the second element of the defense:

it was never [Govereh’s] contention that he innocently filed returns that exaggerated the telephone excise taxes of clients based on the erroneous advice of Robertson. Indeed, to the contrary, it was [his] testimony that he never filed returns claiming false excise tax credits. It was [his] consistent story that others in the office -- usually Kendra, but never [Govereh] --prepared and filed these returns. As it was [his] testimony that he was not involved in claiming any telephone excise credits for clients, it is therefore impossible that he would have been relying on the opinion of anyone for actions he never took.

U.S. v. Govereh, supra. And the judge found that had

[Govereh] prepared tax returns containing false TETR credits and had he received specific advice from someone else in the office that it was okay to falsify this information, his reliance on any such advice would not have been objectively reasonable. . . . It is difficult to understand how one could reasonably rely on the representation of a co-worker that it is proper to lie on a return.

U.S. v. Govereh, supra. The judge therefore held that because Govereh “failed to establish a factual predicate for an entrapment-by-estoppel defense”, the “Court properly refused to give” the jury instruction he submitted on the issue. U.S. v. Govereh, supra.

As this news story explains, in December of 2009, Govereh was sentenced to serve 8 years in prison and pay $62,000 in restitution. Since the district court judge denied his motions for acquittal or for a new trial, I assume he’ll appeal his conviction.


The estoppel-by-entrapment defense doesn’t seem to come up much, at least not in cases involving computers, and it usually seems to fail. I think my favorite use of it was in U.S. v. Parker, 267 F.3d 839 (U.S. Court of Appeals for the 8th Circuit 2001). Lonnie Parker was convicted of possessing child pornography and appealed, arguing that the trial judge should have directed an acquittal based on entrapment-by-estoppel. U.S. v. Parker, supra. Parker claimed that the child pornography found on his computer was sent to his daughter and that he contacted the FBI and told them what had happened; he also claimed an FBI agent told him to download the images and send them to the FBI. U.S. v. Parker, supra.


The problem was that he never gave prosecutors the name of the FBI agents he spoke with and never sent the FBI copies of the images. U.S. v. Parker, supra. The Court of Appeals therefore held that the judge did not err in failing to order an acquittal based on

entrapment by estoppel. Parker can point to no evidence illustrating that he reasonably relied upon a law enforcement official's assertion that possessing child pornography was legal or that any such assertion was made to him. The evidence instead indicates that Parker was fully aware that his possession of such materials was a crime.

U.S. v. Parker, supra.


Wednesday, February 24, 2010

Text Messages: Authentication and Hearsay Issues

As Wikipedia notes, the law of evidence “governs the use of testimony (e.g., oral or written statements, such as an affidavit) and exhibits and (e.g., physical objects) or other documentary material which is admissible (i.e., allowed to be considered by the (trier of fact, such as jury) in a judicial . . . proceeding.” Wikipedia also outlines the policies that underlie the law of evidence and some of the major principles it encompasses.


This post is about a case in which two of those principles were at issue: the requirement that evidence be authenticated in order to be admissible; and the default prohibition on the use of hearsay evidence.


As I explained in an earlier post, authentication means the proponent of the evidence (the party asking the court to admit it) has to show the evidence is what it purports to be. Each U.S. state and the federal judicial system has its own rules of evidence, which are quite similar. Rule 901(a) of the Federal Rules of Evidence says the “requirement of authentication . . . as a condition precedent to admissibility is satisfied by evidence sufficient to support a finding that the matter in question is what its proponent claims” it to be. Rule 901(b) gives some examples of how evidence can be authenticated: testimony by someone who can identify it; an expert’s comparing it with “specimens which have been authenticated:’ distinctive characteristics; public records; or any other method prescribed by law. Every state has a similar rule that governs authentication in court proceedings in that state.


And as I explained in another post, every U.S. state and the federal system bans the use of hearsay evidence unless it falls within one of several exceptions to the rule barring its use. Rule 801(c) of the Federal Rules of Evidence defines hearsay as “a statement, other than one made by the declarant while testifying at the trial or hearing, offered in evidence to prove the truth of the matter asserted.” Rule 802 of the Federal Rules of Evidence says hearsay “is not admissible unless provided by these rules”. Every U.S. state has a similar provision. As I explained in my prior post on hearsay, it’s excluded because to allow the use of second-hand evidence – John repeating what Jane allegedly told him – opens up all kinds of possibilities for unfairness and error. The hearsay rules are intended to guard against those possibilities.


That brings us to State v. Thompson, 2010 WL 93233 (Supreme Court of North Dakota 2010). Jennifer Thompson was convicted of “simple assault upon a family or household member” in violation of North Dakota Century Code § 12.1-17-01. Section 12.1-17-01(1) says someone is “guilty of an offense if he/she “[w]illfully causes bodily injury to another human being”. Section 12.1-17-01(2)(b) makes the offense a class B misdemeanor if the victim is a member of the perpetrator’s family or household. Here, according to one of the briefs filed in the case, is how Jennifer came to be charged with violating § 12.1-17-01:

On October 31, 2008, Jennifer . . . and Wesley Thompson were married and had three children. On the morning of October 31, [Jennifer] began sending text messages to [Wesley] asking for money and asking him to pick up the children and bring them to school. A number of the text[s] . . . contained threatening statements directed at [him]. When [he] arrived at their residence in Grafton, the children and [Jennifer] got in his vehicle. After driving the children to school, [Wesley] drove back to their residence to drop [Jennifer] off, so he could go to work. [Jennifer] refused to get out . . .until he gave her $150.00. [He] offered to take her shopping, but [she] refused, stating she wanted cash. After approximately one hour, [Jennifer] raised her demand to $250.00, and . . . [Wesley] drove to the police station for assistance. [Jennifer] still refused to get out of the vehicle and [Wesley] requested assistance from Sheriff Lauren Wild. Sheriff Wild was successful in getting [Jennifer] to leave the vehicle and [Wesley] went to work.


[Wesley] stopped answering [Jennifer]'s phone calls, but later transferred $60.00 to [her] account. After work, [he] called [Jennifer] and they took the children trick or treating. At . . . 9:30-10:00 p.m., they returned to the house and [Jennifer] wanted to go out for the . . . evening. [Wesley] brought her to Polly's Lounge and gave her $20.00. [He] returned home to watch the children and at approximately 10:30 p.m., [Jennifer] began sending several text messages to [Wesley] asking for money. [He] responded that he was not going to bring her any more money. At approximately 11:00 p.m., [Jennifer] arrived at the residence, confronted [Wesley] and demanded he give her more money. [Wesley] refused to go and get her more money. [They]] continued to argue regarding money and [Wesley] told [Jennifer] he was leaving. [He] went to leave and [Jennifer] began hitting him in the face and the back. [Wesley] ran towards the bathroom and called 911.

Appellee Brief, State v. Thompson, 2009 WL 3308769 (transcript references omitted). (This statement of facts comes from one side’s brief, so it may or may not be a little biased.) After Wesley called 911, police officers showed up, saw his eye was injured, asked Jennifer how that happened and she said “she hit him.” Appellee Brief, supra. The officers arrested her for violating § 12.1-17-01, and she eventually went to trial on the charge; a jury convicted her and she appealed. State v. Thompson, supra.


On appeal, Jennifer claimed the trial court shouldn’t have admitted “testimony about text messages sent from her cell phone” to Wesley’s phone because (i) the evidence wasn’t properly authenticated and/or (ii) it was inadmissible hearsay. State v. Thompson, supra.


At trial, Wesley testified about texts Jennifer sent him on October 31: He said he knew they were from her because they said “`Fr: Jen” at the beginning, which was the way he stored her phone number in his cell phone, and the end of the message included her phone number and her signature, `cuzImJenIcan,’ which he was familiar with.” State v. Thompson, supra. When Jennifer took the stand, she claimed Wesley “may have used her phone to send” one particular message – which “included profane and threatening language” – to himself. State v. Thompson, supra. She also argued (on appeal) that

e-mails or text messages are inherently unreliable because of their relative anonymity and can rarely be connected, to a certainty, with a specific author. . . . [S]omeone with the correct password or access to the cellular phone can send a message ostensibly from that person. Further, . . . . text messages. . . are more unreliable due to the . . . recipient not being able to hear a voice or observe handwriting. . . . Ms. Thompson argues that . . . this Court should review the authenticity and admissibility at a higher standard then voice recordings and writing samples.

Appellant Brief, State v. Thompson, 2009 WL 3308770.


When Jennifer challenged the authentication of the “profane and threatening” text at trial, the prosecution introduced a picture of it; when Jennifer claimed the picture hadn’t been authenticated, the prosecutor asked her for her cell phone number and her “signature for text messages, which were both depicted on the picture of the text” in question. The trial judge admitted the picture of the message into evidence, saying it was authenticated by Jennifer’s testimony and by what Wesley had said earlier. State v. Thompson, supra.


In ruling on Jennifer’s claim that the texts and the picture of the particular text shouldn’t have been admitted, the Supreme Court noted that authentication was within the trial court’s discretion, so it would not reverse the trial judge if his decision was reasonable. The court explained that while it had not “previously considered . . . the foundational requirements for the admissibility of text messages, other courts have held that similar electronic messages were authenticated by circumstantial evidence establishing the evidence was what the proponent claimed it to be.” State v. Thompson, supra. The North Dakota Supreme Court also noted that it wasn’t going to create a heightened standard of review for texts and other electronic messages. It cited a Pennsylvania court’s opinion, in which that court said that text, emails and other electronic messages “can be properly authenticated” under existing rules of law. State v. Thompson, supra (quoting In re F.P., 878 A.2d 91 (Superior Court of Pennsylvania 2005).


The Court then held that the trial judge heard enough evidence from Wesley, “including the circumstances of that day and his knowledge of [Jennifer’s] cell phone number and signature . . . to authenticate [his] testimony about the text messages he received on October 31.” State v. Thompson, supra. It also rejected Jennifer’s claim that the picture of the “profane and threatening “ text was not properly authenticated; it noted that she never claimed the picture “did not correctly and accurately depict the text message” and it found that Jennifer’s and Wesley’s testimony established that Jennifer’s cell phone number and signature were included in the message. State v. Thompson, supra.


Then there was the hearsay issue: When Jennifer raised the issue at trial, the judge held that the texts weren’t hearsay. Appellant Brief, supra. The North Dakota Rules of Evidence bar the use of hearsay but they, like the Federal Rules of Evidence, specify that certain statements do not constitute hearsay. Under Rule 801(d)(2)(i) of the North Dakota Rules of Evidence, a statement that “is offered against a party and is . . . the party’s own statement” doesn’t constitute hearsay. The trial judge held that Jennifer’s texts fell within this rule, i.e., it constituted what is known as a “party admission.” On appeal, Jennifer claimed the trial judge erred because a threat to do something in the future isn’t “an admission of past wrongdoing.” State v. Sutphin, 195 W. Va. 1995, 466 S.E.2d 402 (Supreme Court of West Virginia 1995). I found a few decisions from other states that address this issue; a West Virginia court held that it doesn’t matter, i.e., that a “threat to do something in the future” can constitute a party admission under rules like 801(d)(2)(i) of the North Dakota Rules of Evidence. State v. Sutphin, supra. The North Dakota Supreme Court seems to have reached the same conclusion, because it held that the trial judge correctly rejected Jennifer’s hearsay argument. State v. Thompson, supra.


Isn’t it amazing that a class B misdemeanor could generate all these issues?


Monday, February 22, 2010

Kyllo and "A Forensic Software Program"

In a 2008 post, I talked about the U.S. Supreme Court’s decision in Kyllo v. U.S., 533 U.S. 27 (2001). I reviewed the holding in the case – which involved law enforcement’s using a thermal imager to detect heat radiating from Danny Kyllo’s home.


As I noted in that post, the Supreme Court found it was a search for a federal agent to stand across the street from the garage and use the thermal imager to detect heat signatures emanating from the garage. The Court held that it is a 4th Amendment “search” to (i) use technology that is not in general public usage (ii) to detect information from inside a home. (Since the garage was, I believe, attached to Kyllo’s home, that made it part of the home for 4th Amendment purposes.)


The Kyllo decision came down in 2001. I noted in 2008 that I was waiting for a case to apply the Kyllo (Nearly all of the cases involving the Kyllo standard deal with whether or not it applies to the use of drug detection dogs.) I finally found one. holding to the use of computer technology, including computer forensic software.

The case is U.S. v. Borowy, 2010 WL 537501 (U.S. Court of Appeals for the 9th Circuit 2010) and here, according to the Court of Appeals, is how it arose:

On May 3, 2007, Special Agent Byron Mitchell logged onto LimeWire, a . . . peer-to-peer file-sharing computer program, to monitor trafficking in child pornography. Agent Mitchell conducted a keyword search in LimeWire using the term `Lolitaguy,’ a term known to be associated with child pornography. From the list of results returned by this search, Agent Mitchell identified known images of child pornography using a software program that verifies the `hash marks’ of files and displays a red flag next to known images of child pornography. At least one of these files was shared through what was later determined to be [Charles] Borowy's IP address.

Using the `browse host’ feature of LimeWire, Agent Mitchell viewed a list of the names of all of the approximately 240 files being shared from Borowy's IP address, several of which were explicitly suggestive of child pornography and two of which were red-flagged. Agent Mitchell downloaded and viewed seven files from Borowy's IP address, four of which were child pornography. Prior to downloading the files, Agent Mitchell did not have access to the files' contents. Execution of a search warrant resulting from Agent Mitchell's investigation led to the seizure of Borowy's laptop computer, CDs, and floppy disks. Forensic examination of these items revealed more than six hundred images of child pornography, including seventy-five videos.

U.S. v. Borowy, supra. Borowy was indicted for distributing and possessing child pornography in violation of 18 U.S. Code § 2252A. Appellant’s Opening Brief, U.S. v. Borowy, 2009 WL 2898223. After being indicted, Borowy moved to suppress the evidence seized from his home, claiming that Mitchell’s

locating and downloading the files from LimeWire constituted a warrantless search and seizure without probable cause that violated Borowy's Fourth Amendment rights. Borowy argued that because he had purchased and installed a version of LimeWire that allows the user to prevent others from downloading or viewing the names of files on his computer and because he attempted to engage this feature, he had a reasonable expectation of privacy in the files. However, for whatever reason, this feature was not engaged when Mitchell downloaded the seven files from Borowy's computer, and there was no restriction on Mitchell's accessing those files. The district court refused to suppress the evidence, finding Mitchell's conduct was not a search under the Fourth Amendment and that Mitchell had probable cause to download the files.

U.S. v. Borowy, supra. Borowy pled guilty to possessing child pornography in violation of 18 U.S. Code § 2252A(a)(5)(B), but reserved his right to appeal the district court’s denial of his motion to suppress. U.S. v. Borowy, supra. The primary issue on appeal, therefore, was whether Mitchell’s accessing and downloading the files constituted a 4th Amendment “search.”


As I’ve explained in earlier posts, the standard courts use to determine if conduct constituted a search under the 4th Amendment is the standard the Supreme Court articulated in Katz v. U.S., 389 U.S. 347 (1967). For law enforcement activity to constitute a “search” under Katz it must violate an individual’s “reasonable expectation of privacy” in a place or thing. To have a reasonable expectation of privacy under Katz, I must subjectively believe a place is private and society must accept my belief as objectively reasonable. If you want to read more about the application of the Katz standard, check out this post.


Lots of cases – including lots of computer search cases – involve the applicability of the Katz standard. That isn’t what makes the Borowy case interesting (and, ultimately, aggravating): What makes it interesting is that Borowy invoked the Supreme Court’s decision in Kyllo, along with Katz. What makes it aggravating is that the Kyllo argument wasn’t particularly well-developed.


Under Rule 28 of the Federal Rules of Appellate Procedure, three briefs (excluding any amicus briefs) are filed in an appeal from a decision of a federal district court: The first is the Appellant’s Brief, i.e., the brief filed by the party initiating the appeal; the second is the Appellee’s Brief, which is filed by the party who won below. The third and final brief is the Appellant’s Reply Brief, in which the Appellant responds to the arguments the Appellee made in its Reply Brief.


I don’t know if Borowy raised the Kyllo issue in his motion to suppress, but I suspect he didn’t. The reason I don’t think he raised it at the district court level is that he doesn’t seem to have raised it in his Appellant’s Brief (there’s no citation to Kyllo in that brief). Appellant’s Opening Brief, supra. He raised it in his Reply Brief, as you can see from this excerpt:

The development of tools that allow access to the home or items in the home - that are not available to the general public - exceed what the senses any member of the public could have used to detect the exposed material and thus become a search governed by the Fourth Amendment. The Supreme Court in Kyllo ruled that `[w]here, as here, the Government uses a device that is not in general public use, to explore details of the home that would previously have been unknowable without physical intrusion, the surveillance is a “search”. . . . ’ In Kyllo, the court found that the use of thermal imaging device . . . violated the Fourth Amendment. . . . Without the forensic analysis it is not readily apparent the item is contraband. This was true even though the heat signature via the outside of the home was obviously exposed to the public. The point was that the intrusion revealed intimate details of the home.

Here the agent ran the forensic hashmark program on 240 files. The computer in this case was inside the home. The government intruded by means of a forensic program to which the average member of the public does not have access.

U.S. v. Borowy, supra. The Kyllo argument seems to have been meant to rebut the argument the prosecution made in its Appellee’s Brief (and probably in its opposition to the motion to suppress), i.e., that what Mitchell did wasn’t a 4th Amendment search because Borowy made the files publicly accessible. As I’ve noted in earlier posts, that argument has, as far as I can tell, consistently succeeded in cases in which officers use P2P software to locate child porn on someone’s computers.


The rather belated Kyllo argument ultimately didn’t help Borowy with his appeal. The 9th Circuit Court of Appeals brusquely rejected the argument, as such:

Borowy argues that the use of a `forensic software program’ that is unavailable to the general public to confirm that the files contained child pornography rendered Mitchell's conduct an unlawful Fourth Amendment search. We disagree. Borowy had already exposed the entirety of the contents of his files to the public, negating any reasonable expectation of privacy in those files. . . . Moreover, the hash-mark analysis appears to disclose only whether the files in the list that Mitchell's keyword search returned were known child pornography. . . . In this context, the hash-mark analysis functioned simply as a sorting mechanism to prevent the government from having to sift, one by one, through Borowy's already publically exposed files.

U.S. v. Borowy, supra. The Court of Appeals noted, however, that it wasn’t closing the door on future Kyllo arguments involving computer forensic software:

We do not rule on whether, if confronted with different facts -- for example, where the information was not already exposed to the public at large, where the hash-mark analysis might reveal more than whether a file is known child pornography, or where the government `vacuumed’ vast quantities of data indiscriminately -- we might find a Fourth Amendment violation. Here we are presented only with the limited case of a targeted search of publicly exposed information for known items of contraband.

U.S. v. Borowy, supra. The actual outcome in the case doesn’t really aggravate me; what aggravates me is the cursory treatment Borowy and the Court of Appeals gave the Kyllo argument.


At one level, a Kyllo argument seems a viable option in circumstances like those at issue in the Borowy case because they are analogous to the circumstances at issue in Kyllo, at least in one respect.


In both instances, law enforcement captures information that is being broadcast from inside a home (the most sacrosanct “place” for 4th Amendment purposes). The Kyllo Court found, correctly IMHO, that the fact the officer was outside the home when he captured the heat signatures emanating from Kyllo’s home did not prevent his actions from constituting a 4th Amendment search. Any other result would take us back to the bad old days when Olmstead was the law. (As I’ve noted in other posts, in Olmstead v. U.S. the Supreme Court held it wasn’t a search for federal agents to use a tap on a phone line outside Olmstead’s home to listen in on his phone calls. The Supreme Court reversed Olmstead in Katz.)


I’m not, however, sure a viable Kyllo argument is possible when it’s directed at law enforcement’s using P2P software to access files someone has made available for sharing online. Like other defendants who’ve been caught because they were sharing child porn via P2P networks, Borowy claimed he didn’t realize he was sharing files because he thought he’d disabled the file-sharing feature.


Even if we accept Borowy’s argument at face value, it seems to me the P2P scenario is distinguishable from the scenario at issue in Kyllo in at least one important respect: Danny Kyllo’s broadcasting waste heat into the external atmosphere wasn’t a volitional act. Kyllo’s buying a house with a furnace and/or installing a furnace was a volitional act, just as Borowy’s buying LimeWire was a volitional act, but from there on, IMHO, the two scenarios differ. Borowy had the ability to eliminate his computer’s ability to share files (and file names) via LimeWire but failed to exercise this ability. Like the rest of us, Danny Kyllo didn’t have the ability to prevent his home (and/or garage) from emanating waste heat; as far as I know, there’s no way to prevent a structure from radiating heat, and I gather we wouldn’t want to do that if we could. As I understand it, we’d suffer some unpleasant effects from heat exhaustion, etc.


My point is that Borowy not only knew he was exposing file information online, he was responsible for his computer’s ability to do just that. Since he was, in effect, knowingly broadcasting that information outside his home, I don’t see Borowy can complain when a law enforcement officer picks up on his broadcast. (I’m inferring, maybe extrapolating, knowledge from his having the program installed; I’m assuming he must have noticed, at some point, that the file-sharing function was active.) So I guess I basically agree with the 9th Circuit; I just wish they’d provided a more detailed analysis of the issue.


And yes, I still think there can be viable Kyllo arguments as to other uses of computer forensic software. I’m still waiting for one.


Friday, February 19, 2010

Evidence Eliminator and Daubert

As Wikipedia notes, the Daubert standard governs “the admissibility of expert witnesses’ testimony during United States federal legal proceedings.” The standard comes from the U.S. Supreme Court’s decision in Daubert v. Merrell Dow Pharmaceuticals, 509 U.S. 579 (1993).


The Daubert Court rejected the earlier test that was used for this purposes, which came from the District of Columbia Court of Appeals’ decision in Frye v. United States, 293 F. 1013 (1923). The Frye court held that expert opinion testimony based on a scientific technique is inadmissible unless the technique is “generally accepted” as reliable in the relevant scientific community.


The Daubert Court held that when one side wants to present expert testimony, “the trial judge must determine . . . whether the expert is proposing to testify to (1) scientific knowledge that (2) will assist the trier of fact to understand or determine a fact in issue.” Daubert v. Merrell Dow, supra. It noted that this “entails a preliminary assessment of whether the reasoning or methodology underlying the testimony is scientifically valid and of whether that reasoning or methodology properly can be applied to the facts in issue.” Daubert v. Merrell Dow, supra.


The Daubert Court also noted that “many factors will bear on this inquiry” and said it would “not presume to set out a definitive checklist or test” to be used in this assessment. Daubert v. Merrell Dow, supra. It did note some factors a judge could consider in making the assessment: whether the theory or technique “can be (and has been) tested”; whether it’s been subjected to peer review and publication; the known or potential rate of error; and whether there is “widespread acceptance” of the technique within the relevant scientific community. Daubert v. Merrell Dow, supra.


This post is about a case in which a defendant tried to use Daubert to challenge the propriety of admitting certain testimony in his criminal trial. The case is State v. Starner, 2009 WL 3532307 (Ohio Court of Appeals 2009), and it began when Danny Starner was indicted “on thirteen counts of gross sexual imposition in violation of” Ohio Revised Code § 2097.05(A)(4) and on “nineteen counts of rape of a child under the age of thirteen” in violation of Ohio Revised Code § 2907.01(A)(1)(b). State v. Starner, supra.

Starner married Nancy McDaniel sometime in the early 1990's. . . . Nancy had two daughters, Vicky and Yvonne. Vicky eventually had two children, Doug, born 1995, and Meg, born1998. Yvonne also had a child, Emma, who was born in1994.


By four, Emma was living with her father and step-mother and visiting with Nancy and Starner on occasion. Two years later, Yvonne moved to Pennsylvania and was unable to exercise her bi-weekend visitation with Emma. Instead, Nancy and Starner began exercising these visitation periods with Emma. For the next several years, Emma visited her grandmother and Starner, whom she called `Poppy,’ every other weekend.

State v. Starner, supra. In 2008, Nancy died, and shortly afterward Emma said “Starner sexually abused her nearly every time she visited since she was six or seven years old.” State v. Starner, supra. She said in addition to physically abusing her, Starner “showed her photographs on his computer of adults who were nude, . . . had her sit on his lap and watch films of adults having sex, and took photographs of her while she had her clothing on and off.” State v. Starner, supra. Meg and Doug then said that Starner “had engaged in sexual activity with them” when they were children. State v. Starner, supra.


The authorities opened a criminal investigation of the allegations and executed search warrants at Starner’s home on February 20 and March 5 2008. They seized

numerous computers, hard drives, USB drives, computer accessories, cameras [and] girls' underwear. . . . .

A forensic analysis of the electronic equipment found numerous photographs of Emma clothed, some of which show her in seemingly provocative poses. However, no nude photographs of Emma or any other children were found. The analysis did find several photographs of nude adults on the hard drives. . . . [that] contained images of various sexual acts being performed. . . . In addition, a program entitled `Evidence Eliminator’ was found, as was evidence of its installation and use, on two of the computers seized from Starner's home. This program is designed to permanently remove files . . . from a hard drive. Further analysis showed that Evidence Eliminator was last accessed on one of the computers on . . . the day of the first search of Starner's home.


The analysis also discovered a number of sexually explicit stories on the hard drives. The subject matter of the vast majority of these stories centered around acts of incest and the molestation of children. . . .

State v. Starner, supra. Starner went to trial on the charges, was convicted and appealed, claiming the trial judge erred in allowing Agent Jim Hawks of the Ohio Bureau of Criminal Investigation (BCI) to testify “regarding the use of the Evidence Eliminator program.” State v. Starner, supra. Starner argued that Hawke shouldn’t have been allowed to testify because his testimony “failed the Daubert test for scientific reliability.” State v. Starner, supra. Here’s a summary of Hawke’s testimony:

[He said] his analysis of the computers . . . seized revealed that Evidence Eliminator was installed on two of them. State's Exhibit 1, a SunPro computer found in Starner's kitchen, showed Evidence Eliminator Version 6 was installed on the computer on January 8, 2008. Agent Hawke also found remnants of an earlier version of Evidence Eliminator on this computer. The analysis of this exhibit also revealed that this program was accessed several times, including at approximately 7:29 a.m. on the day Starner's home was first searched. . . .


Hawke testified that Evidence Eliminator is `marketed as a program to delete and overwrite data . . . we call it antiforensic program to delete the tools that I use in the laboratory to get the data back. It makes it so that I can't find the data because it's destroyed.’ . . . He also testified that `one of the things it does is it overwrites data that's on the hard drive.’ . . . [and] that Evidence Eliminator advertises that `it defeats the forensic tools we have to use to get the data back to be used as evidence or information in an investigation.’

State v. Starner, supra. All I know about the substance of Starner’s Daubert argument is what’s noted above. I assume it had something to do with . . . what? . . . with whether the Evidence Eliminator program itself is scientifically valid? With whether Hawke’s analysis of the installation and use of Evidence Eliminator on the two computers was based on a methodology that was scientifically valid? I’m really not sure.


And the Court of Appeals’ opinion doesn’t help me out. It held that contrary to Starner’s

assertions in his brief to this Court, the testimony about the marketing of Evidence Eliminator had nothing to do with any expert scientific testing or other such specialized information. Anyone with basic computer skills could find the website on the Internet and view how it is marketed. Thus, the Daubert test for scientific reliability was unnecessary.

State v. Starner, supra. I would agree with the Court of Appeals’ conclusion that testimony about the marketing of Evidence Eliminator wouldn’t raise a Daubert issue. (The court did consider the propriety of admitting the testimony under other evidentiary standards, and ultimately found it was properly admitted.) That seems a really narrow Daubert argument, though.


I wonder if Agent Hawke’s testimony also went to other issues involving Starner’s acquisition, installation and use of Evidence Eliminator and how that related to the facts at issue in the case. I wonder if any of that part of his testimony could have raised a Daubert issue. I’ve found a couple of reported cases in which Daubert was raised with regard to the propriety of admitting the testimony of a computer forensics expert. In one, a federal district court judge ordered a Daubert hearing held on the issue; in another case, a civil case, the court conducted a Daubert hearing and then held that a proposed defense expert witness wouldn’t be allowed to testify because the proponent of his testimony hadn’t shown that his methodologies were reliable under the Daubert standard. U.S. v. Kassir, 2009 WL 910767 (U.S. District Court for the Southern District of New York 2009); Rivera-Cruz v. Latimer, Biaggi, Rachid & Godreau, LLP, 2008 WL 2446331 (U.S. District Court for the District of Puerto Rico 2008).


I’m afraid this post is completely inconclusive. This is one of those opinions that makes me wonder if the proponent’s argument was as specious as the court makes it seem. I found one case in which a court held a Daubert hearing on the reliability of the methods a computer forensics expert used “pertaining to the alleged wiping of data from” a laptop and the conclusions he drew from his analysis. Nucor Corp. v. Bell, 2008 WL 4442571 (U.S. District Court for the District of South Carolina 2008). The court found that the expert’s methods didn’t meet the Daubert standard and therefore barred him from testifying.


That court, though, focused on the methodologies the prospective witness himself had devised and used to determine that evidence had been wiped. It therefore wasn’t dealing, as was the Starner court, with testimony about the functioning of a software program (or at least I’m assuming that was an issue in Starner’s Daubert argument). I know NIST tests the reliability of computer forensic tools, but I don’t know that it’s tested (or will test) Evidence Eliminator. If NIST had tested the tools Agent Hawke used to conduct his Evidence Eliminator analysis of Starner’s computers I assume that would mean they’d presumptively survive a Daubert challenge.


I’m probably making way too much of this. Maybe there really was no Evidence Eliminator issue in this case, as such; maybe the only use the prosecution made of Evidence Eliminator was to show what lawyers call “consciousness of guilt,” i.e., to infer from his possession and use of the program that he knew he was doing something “wrong.” As one court noted, instructions that “permit the jury to infer `consciousness of guilt’ from proven facts, such as making false statements regarding the crime, . . . suppression of evidence . . . and flight” have been held valid. People v. Lewis, 2010 WL 367297 (California Court of Appeals 2010). So maybe that’s all that was going on here.


Wednesday, February 17, 2010

Wi-fi Privacy, Dogs and Apartments

This is a follow-up to my last post, which, of course, was a follow-up to the earlier post I did on U.S. v. Ahrndt. (And I anticipate that this will be my last wi-fi privacy post for a bit.)


In this post, I’m going to extrapolate a bit on the 4th Amendment. In so doing, I’ll probably refer back to the facts and holding in U.S. v. Ahrndt; since I won’t repeat them here, you should check that post (“Wi-fi Privacy?) for those details. Amendment principles I talked about in that last post.


The Ahrndt court held that Ahrndt didn’t have a 4th Amendment reasonable expectation of privacy in files available for sharing via an unsecured wireless network. The Ahrndt judge said there definitely is a “lower [4th Amendment] expectation of privacy in unsecured wireless networks”, but also factored the file-sharing aspect of the case into his holding that it wasn’t a search for a law enforcement officer to check out some of those files, using Ahrndt’s unsecured wireless network.


In my last post, I extrapolated a bit from the Ahrndt case, explaining that, IMHO, there’s a good argument that if you don’t secure your wireless network any signals that leak out of your residence into the area surrounding it aren’t protected by the 4th Amendment. As I noted in my last post, I can see an argument that the signals have moved outside the 4th Amendment bubble of privacy that encompasses your home (and here, I’m assuming a free-standing house) and into “open fields”, where they lose 4th Amendment protection.


As I explained in my last post, the open fields argument is based on the principle the Supreme Court applies when someone argues that police trespassing on land around their home violated a 4th Amendment expectation of privacy. Under that principle – the open fields doctrine – a free-standing house is divided into two zones for 4th Amendment purposes: the home itself and the bubble of space immediately around it (known as the curtilage) are protected by the 4th Amendment’s guarantees of privacy; the area outside the home and outside the curtilage is considered "open fields" and is therefore not protected. The area outside the curtilage is considered open fields even if you live in a suburb where your yard isn’t exactly expansive, i.e., isn’t the equivalent of the ranches at issue in the two Supreme Court cases I talked about in my last post.


As far as I’m concerned, the open fields-curtilage analysis doesn’t make sense anywhere, let alone when it comes to suburban homes. There is, though, another area where it becomes even more problematic: apartments. To illustrate what I mean, I’m going to use a case involving a drug dog and marijuana.


The case is Fitzgerald v. State, 384 Md. 484, 864 A.2d 1009 (Maryland Supreme Court 2004), and here is how it arose:

In February 2002, an anonymous source informed Detective Leeza Grim of the Howard County Police Department . . . that [Matthew] Fitzgerald and his girlfriend Allison Mancini lived in an apartment at 3131 Normandy Woods Drive in Ellicott City. . . . The source stated that Fitzgerald and Mancini drove a white pick-up truck and sold a high quality grade marijuana called `Kind Bud.’ Grim's subsequent investigation confirmed that the couple lived in the building and the car was registered to Alicia Joy Mancini, apparently Allison’s relative. Grim also learned Fitzgerald had a juvenile record of 1998 arrests for distribution of marijuana near a school and for three first-degree burglaries. . . .

Grim met with Officer Larry Brian of the Police Department's K-9 unit on March 19. Brian then visited Fitzgerald and Mancini's apartment building accompanied by Alex, Brian's certified drug detecting dog. . . . Brian and Alex entered the building through unlocked glass doors leading to a vestibule with a stairwell and mailboxes. Brian led Alex to scan apartment doors A, B, C, and D. Alex `alerted’ at apartment A, indicating the presence of narcotics. Apartment A was Fitzgerald and Mancini's apartment. Sniffs of the other three apartments did not result in alerts. Alex repeated the sniffs with the identical outcome. Finally, on March 20, the anonymous source contacted Grim again and asserted that Fitzgerald and Mancini continued to sell `Kind Bud’ marijuana

The next day, District Court Judge Ellinghaus-Jones issued a search warrant for Fitzgerald and Mancini's apartment based on Grim's affidavit. The warrant was executed on April 2, 2002. Grim seized substantial amounts of marijuana and other evidence of marijuana use and distribution. Fitzgerald and Mancini were arrested and charged with possession of marijuana with intent to distribute and related offenses.

Fitzgerald v. State, supra. (If you’re wondering what Alex did to alert, Officer Brian said “he sits there in that area, and what . . . he'll sit and he looks at me and that is his indication to me that he smells the presence of a narcotic.’” Fitzgerald v. State, supra.)

Fitzgerald moved to suppress the evidence obtained as a result of the execution of the warrant, claiming “a canine sniff of an apartment’s exterior is a search under the 4th Amendment.” Fitzgerald v. State, supra. This argument has two aspects: whether the area outside an apartment door is curtilage; and whether a dog triggers the Supreme Court’s decision in Kyllo v. U.S., 533 U.S. 27 (2001). We’ll start with the curtilage issue and then get to Kyllo.


A few courts have indicated that an officer’s having a drug detection dog like Alex sniff the immediate exterior of a home, e.g., a front door, is a 4th Amendment search because the dog and the officer are within the curtilage of the home. State v. Rabb, 920 So.2d 1175 (Florida Court of Appeals 2006). Most courts, though, have reached the opposite conclusion as long as the officer and the dog were standing on a part of the curtilage – such as the area outside a front door – that is open to use by guests, delivery people and even total strangers. State v. Jardines, 9 So.3d 1 (Florida Court of Appeals 2008).


Courts distinguish an officer's presence (with or without a dog) on a public area of the curtilage from cases in which courts have held that an officer’s walking onto a non-public area of the curtilage (e.g., the side of the home) and peering through a window to see what’s inside is a 4th Amendment search because the officer is within the bubble of 4th Amendment protection that surrounds the home. State v. Carter, 569 N.W.2d 169 (Minnesota Supreme Court 1997).


Most courts have held that an officer’s walking a drug dog down an apartment hallway so the dog can detect odors emanating from the apartment doors isn’t a 4th Amendment search, because the officer isn’t on the curtilage of a home. Some courts have analogized apartment hallways to public sidewalks; the Fitzgerald court held it wasn’t a search to have Alex sniff Fitzgerald’s apartment door because Alex and Brian were in “the apartment building’s common area and hallways were accessible to the public through . . . unlocked glass doors.” Fitzgerald v. State, supra.


I know signals from unsecured wireless networks leak outside houses, so I’m going to assume they also leak outside apartments. If those assumptions are valid, they inferentially indicate that a law enforcement officer walking down the hallway of an apartment carrying a laptop can detect unsecured wireless signals seeping into the hallway, just as the odor of marijuana leaked from Fitzgerald’s apartment into his hallway. If an officer were to do this, would that then constitute a 4th Amendment search or would the result be the same as in the dog sniff cases?


This is where Kyllo comes in: As I explained in my post on the case, in Kyllo the Supreme Court held that it is a 4th Amendment search for an officer, even standing outside a home’s curtilage, to use “technology not in general public use” to detect information from inside the home that he could not otherwise obtain except by actually entering the home. What happens if we factor Kyllo into the scenario I outlined above?


Lots of defendants have argued that the use of drug detection dogs like Alex is a search under Kyllo, but so far they’ve lost. One issue that arises there is whether a drug dog is “technology”. Courts seem to have consistently held that a drug dog isn't "technology," perhaps because a dog isn't mechanical or electrical technology. (I say a dog can be technology because technology can be biological as well as mechanical, but I haven’t seen that argument made yet.) The "isn't-technology" argument won’t arise here because the laptop the officer’s using (I’m using a laptop for a reason; it could be any appropriate technology) is definitely technology.


No one’s sure what the Kyllo Court meant by “not in general public use,” but I think it’s pretty clear that a laptop, even one capable of detecting wireless signals, is in general public use. Not everyone has one, but lots and lots of people do, and all that's needed to acquire one is to buy it (or maybe borrow it). If a laptop is in general public use, I don’t see why an officer couldn’t use a laptop (or any other technology that’s in general public usage) to detect wireless signals leaking into an apartment hallway without violating a 4th Amendment expectation of privacy (at least, under the law as it now stands). If apartment hallways are open to the public, then, according to some courts, what the officer is doing is indistinguishable from his carrying the laptop down a public sidewalk (or driving along a street with it in his car).


If that works, then the laptop can be used in a fashion analogous to the way officers use drug dogs: In the Fitzgerald case, the officer used the dog to get information to establish probable cause for a warrant to search the apartment. I assume the laptop’s detecting wireless signals (and, perhaps, files available for sharing) could be used in much the same way: If using the laptop (like using a drug dog) isn’t a 4th Amendment search, the officer can walk down the hallway with the laptop (or whatever technology) without getting a warrant or having probable cause or any level of 4th Amendment suspicion. The information, if any, obtained by the walk could then be used to get a search warrant, just as it was in the Fitzgerald case.


I'm not arguing that this should be the outcome under the 4th Amendment. I'm just speculating as to what happens if we extrapolate the result in cases like Fitzgerald to leaking wi-fi signals.