Computer Forensics Case Digest -- October 2010

Breadcrumbs

Home

CF Resources

Follow CFD on Facebook

CFD Google Search

Custom Search

CFD Site Search

FSL Social Networks

Facebook	LinkedIn
Plaxo	Pandora
Twitter

Computer Forensics Case Digest -- October 2010

2nd Circuit Court of Appeals

U.S. v. Rosa, 09-0636-cr (2nd Cir. 10-27-2010) — Following reports by two young children that they had been sexually abused by a neighbor and shown child pornography on a computer, New York law enforcement agents applied for a warrant to search the home of Defendant. The search warrant authorized the search of Defendant's premises for a wide range of electronic and computer equipment "which would tend to identify criminal conduct[.]" However, the warrant did not include any supporting information or detail the criminal conduct in question. The application for the search warrant was more detailed: it listed the crimes being investigated and included an affidavit from the lead investigator that detailed the allegations of the boys. Following execution of the warrant, a forensics examination of the seized computer equipment revealed hundreds of CP videos and thousands of images. Images of sexual abuse of the children by the Defendant were also discovered. After entering a conditional guilty plea to three counts of production of child pornography, Defendant appealed, arguing that the search warrant lacked particularity and therefore was an unconstitutional general warrant. The Court of Appeals agreed that the search warrant as issued was not sufficiently particular to permit a "tailored search of his electronic media." The Court underscored the fact that in the electronic age, the "particularity requirement" is increasingly important. The Court also agreed with Defendant that the U.S. Supreme Court has disallowed reliance on unincorporated and unattached material in determining the constiutionality of a search warrant. See Groh v. Ramirez, 540 U.S. 551 (2004). Notwithstanding the clear constitutional error, however, the Court of Appeals upheld the District Court's refusal to suppress the evidence. Relying on Leon, the Court concluded that the negligence in failing to more carefully draft the search warrant was "isolated" and that exclusion of the evidence was not necessary to deter deliberate police misconduct.

3rd Circuit Court of Appeals

U.S. v. Scalise, 09-3710 (3rd Cir. 10-27-2010) — Defendant's home and computer were searched by the FBI after the agency received a report from a computer technician that he had found child pornography on Defendant's computer. A forensics search of Defendant's computer uncovered multiple movie clips and hundreds of images of child pornography. Defendant admitted to using LimeWire to download and share child pornography two to three times a week, plead guilty to receipt and possession of child pornography, and was sentenced to concurrent sentences of 168 and 120 months in prison. Defendant appealed his sentence, asserting various errors. Among other things, he argued that the Court improperly relied on a statement by an FBI agent that Defendant had traded child pornography for a "fairly lengthy course of time." The Court of Appeals held that there was nothing inaccurate about the agent's statement; "nine months can properly be characterized as a 'lengthy period of time,'" the Court said.

U.S. v. Dye, No. 09-3410 (3rd Cir. 10-22-2010) [Unpublished] — Defendant was convicted of one count of using his computer to entice a girl under the age of 18 to engage in sexual activity, and of traveling in interstate commerce to engage in illicit sexual conduct. At trial, the government introduced numerous online chats between Defendant and a "14-year-old girl named Jess," who in reality was an undercover male police officer. The chats demonstrated Defendant's strong interest in traveling to have intercourse with Jess and in photographing and recording the encounter. After trial, Defendant was sentenced to 180 months in prison with 10 years supervised release. Defendant challenged both the verdict and the sentencing calculation, which included a 4-level enhancement for the cross-referenced crime of offering a minor to engage in a sexual performance for the purpose of creating a visual production. The Court of Appeals upheld the verdict, stating that the evidence was overwhelming that Defendant intended to commit the crime if given the opportunity. The Court also categorically rejected Defendant's objection to the sentence enhancement, concluding that there was ample evidence that one of Defendant's goals during the online chats was to induce Jess into participating in an adult photo and video production.

U.S. v. Merz, No. 09-3692 (3rd Cir. 10-12-2010) [Unpublished] — Defendant was sentenced to life in prison after being convicted of advertising, possessing, receiving, and transporting child pornography. Defendant's conviction stemmed from an investigation of a message board called "Ranchi," which specialized in images and stories of child pornography. During the investigation, an FBI agent posted two files to the message board, along with text suggesting that the files contained child pornography. However, when people on the message board tried to download the files, their IP addresses were captured and transmitted to the FBI. Roughly 8 months later, one of the captured IP addresses was traced to Defendant's home, and he was arrested. A search of his home resulted in the seizure of a computer and 106 DVDs. The forensic exam of the computer revealed that Defendant was an administrator child pornography Web site called "My Kingdom Forum." The exam also revealed that Defendant had transmitted a sexually explicit video of a young girl to another user on the site. The Defendant appealed on a variety of grounds, including the argument that the information contained in the search warrant was stale. The Court rejected that argument, noting that it is common wisdom that child pornography collectors retain contraband for a long time, "as it is difficult to obtain." The Court also noted that similar length of time between investigation and the search warrant had been validated in United States v. Vosburgh, 602 F.3d 512 (3d Cir. 2010).

U.S. v. Dennington, No. 10-1357 (3rd Cir. 10-7-2010) [Unpublished] — Defendant was charged with receipt and possession of child pornography. Defendant moved to suppress the evidence on the grounds that it was seized without probable cause. After analyzing the investigation and the supporting affidavit, the Court concluded that it was a "close case." Among other things, the magistrate relied on a five-year-old statement by an informant that was little more than a guess, and Defendant's membership in a Yahoo! group containing child pornography without any accompanying assertion that Defendant actually downloaded any images. The District Court upheld the warrant on a "totality of circumstances," but the Circuit Court clearly had doubts about whether the standard had been met. However, the Circuit Court went on to apply the Leon "good-faith" test. There was no question, the Court said, that officers relied on the affidavit in good faith; it rejected Defendant's arguments that the exception did not apply because it was either facially invalid or obtained through subterfuge or omission.

8th Circuit Court of Appeals

U.S. v. Foster, No. 10-1122 (8th Cir. 10-20-2010) — Defendant was convicted of possessing child pornography. He appealed, alleging that the District Court erred by allowing the government to introduce evidence intended to show that Defendant physically and sexually abused his wife, and that Defendant's wife exhibited characteristics consistent with those of a battered woman. Defendant alleged that such evidence was irrelevant to the charge of possession of child pornography and was unduly prejudicial. The Government respondeded that the evidence was necessary to rebut Defendant's claim that his wife's testimony regarding his possession of child pornography had been coerced by police, as well as Defendant's assertion that any child pornography on the computers was there due to his wife's "fetish." The Court rejected Defendant's appeal, concluding that the evidence offered by the Government was relevant for the reasons stated. Moreover, the Court said, there was no indication that the Defendant suffered any prejudice as a result of the admission of the evidence; "the case against Mr. Foster was so overwhelming," the Court said, "that we can't think that there is the remotest chance that he would not have been convicted had the evidence that he complains about not been admitted."

9th Circuit Court of Appeals

U.S. v. Marinko, No. 09-30430 (9th Cir. 10-22-2010) [Unpublished] — Defendant plead guilty to possession and transportation of child pornography. He appealed the District Court's refusal to suppress images found on his computer, arguing that he was coerced by the FBI into giving consent to the search of his computer. The Court of Appeals upheld the District Court's ruling, agreeing that there was nothing coercive about the FBI's 90-minute visit to Defendant's home. Defendant's consent to a forensic search of his computer, the Court concluded, was given "freely and voluntarily."

10th Circuit Court of Appeals

U.S. v. Jean-Claude, 09-5138 (10th Cir. 10-29-2010) — Defendant was convicted of possessing firearms while being an unlawful user of a controlled substance. Defendant was stopped for a traffic violation and at the request of the state trooper, consented to a search of his vehicle. The search uncovered various weapons and ammunition, along with defendant's cell phone. The state trooper examined the phone and found images of the defendant smoking marijuana and other images apparently showing the weapons found in the car. After a more extensive search at a police impound, defendant was released and his cell phone returned to him. The next day, ATF agents requested a search warrant for Defendant's home to look for various types of items, including "electronic equipment." The warrant was approved by a magistrate, but the phrase "electronic equipment" was eliminated. Notwithstanding that, Defendant's cell phone was among the material seized, and the photos were used at trial to convict Defendant. The District Court declined to suppress the phone, holding that the totality of circumstances of the original stop justified its seizure, and that even if not, the Leon good-faith exception would allow its introduction. On appeal, Defendant argued for the first time that the phone should be suppressed because the magistrate had explicity excluded "electronic equipment" from the search of the home. The Tenth Circuit rejected that basis for appeal, noting that Defendant had failed to raise the argument with the District Court and therefore had waived it. There was no substantive discussion as to whether the original seizure was justified.

11th Circuit Court of Appeals

U.S. v. Harper, No. 09-16077 Non-Argument Calendar (11th Cir. 10-5-2010) [Unpublished] — Defendant appeals his conviction and sentencing for possession of child pornography. Following execution of a search warrant and seizure of defendant's computer, a forensics examination revealed more than 600 images and more than 10 videos of child pornography. Defendant did not challenge forensics findings. Defendant based his appeal on an alleged violation of double jeopardy by dint of his conviction for both receipt and possession of child pornography. Defendant also argued that the judge improperly calculated his sentence. The Court of Appeals rejected both arguments.

D. Georgia

U.S. v. Asher, 1:09-CR-414-WSD-AJB-1 (N.D.Ga. 10-21-2010) — An investigation into the peer-to-peer sharing program GigaTribe discovered child pornography files associated with an IP address traced to Defendant. Eight law enforcement officers executed a search warrant for computer equipment at Defendant's home beginning at 7 a.m. At one point during the search and contemporaneous interview, Defendant was briefly restrained (less than 5 seconds) by officers when he became agitated. Defendant moved to suppress the evidence found on his computer on the grounds that his consent to the search was coerced and that he was effectively put in custody without being read his Miranda rights. The Court agreed with the Magistrate that Defendant's consent to the search was voluntary and that given the totality of the circumstances, Defendant was never in custody. The Defendant's objections to the Magistrate's report and recommendation were overruled.

D. Indiana [N.D.]

U.S. v. Simon, CAUSE NUMBER 3:10-CR-56 RM (N.D.Ind. 10-20-2010) — In 2007, Internal Revenue Service agents executed a search warrant at Defendant's home, looking for financial records and computer equipment as part of a tax evasion investigation. Eleven armed agents participated in the raid, all wearing protective gear and body armor. The search of Defendant's 4,000-square-foot home and imaging of various evidence took nearly a full day. At the end of the day, agents seized some items they were unable to image on-site. Some seized materials later found to be outside the scope of the warrant were returned a week later; other equipment was returned upon request six months later. Defendant moved to suppress, arguing that the search was inherently unreasonably in light of the number of agents, their extensive gear, and the length of time taken to conduct the search and return the equipment. The Court rejected all of Defendant's arguments, noting that he proffered no citations in support of any of his arguments, and that under the circumstances of the case, the actions of the agents was reasonable.

D. Kentucky [W.D.]

U.S. v. Hampton, CRIMINAL ACTION NO. 10-39-JBC (W.D.Ky. 10-22-2010) — Defendant was identified as an individual possessing or distributing child pornography on three occasions between January, 2008 and March, 2009. A search warrant was executed at Defendant's home on January 27, 2010. Defendant moved to suppress the evidence seized, arguing that the evidence on which the warrant was based was stale. In reviewing a magistrate's recommendation to deny the motion, the District Court applied the four factor staleness test enunciated in United States v. Frechette, 583 F.3d 574 (6th Cir. 2009). 1) The character of the crime: possession and distribution of child pornography typically occurs over a long period of time; 2) The criminal: if a suspect has lived at the targeted location for a long time, that supports a finding that evidence will be kept there for months or years; 3) The thing to be seized: By their nature, digital images of child pornography can be stored indefinitely; and 4) The place to be searched: A person's home, particularly one in which they have resided for many years, constitutes a "secure operational base" that supports a finding of probable cause that child pornography will be found there, even a year after the original identification of defendant. The District Court conceded that the magistrate had not specifically applied Frechette, but had applied the substance of the elements. The recommendation to deny was adopted.

U.S. v. Smallwood, CASE NO. 5:08-CR-38 (W.D.Ky. 10-12-2010) — During an investigation of possible arson following a deadly fire at Fort Campbell, Kentucky, investigators seized (among other things) a hard drive they discovered in a desk firefighters had pulled from the house. Defendant moved to suppress all of the items seized, including the hard drive. The Court upheld the seizure of certain items located in the house under the plain view doctrine, but suppressed the hard drive and other items taken from inside the desk, since those items were not in plain view and not obviously connected with the lawful arson investigation.

D. Minnesota

U.S. v. Andrist, Criminal No. 10-205(1) (DWF/AJB) (Minn. 10-26-2010) — Defendant moved to suppress search warrants issued for his computers and storage devices, arguing that there was no probable cause to support the warrants. The Court noted that the warrants were issued following a call from a computer repair shop to police reporting the presence of child pornography on Defendant's computer. Based on a totality of the circumstances, the Court said, there was probable cause for the issuance of the warrants.

D. Missouri [E.D.]

U.S. v. Darr, CASE NO. 1:10 CR 391 (E.D.Mo. 10-20-2010) — Defendant challenged the execution of various search warrants that rsulted in the discovery of images of child pornography on an SD memory chip hidden in a VCR container in Defendant's bedroom. The warrant in question authorized police to search Defendant's residence for certain items allegedly associated with child molestation and for "indicia of occupancy or ownership." The Court ruled that police did not exceed the scope of the warrant by looking in the VCR container for such indicia. A second warrant was obtained to examine the discovered memory chip and videotapes. The Court concluded that there was sufficient probable cause to support the issuance of a search warrant for those items.

D. Nevada

Robertson v. Wynn Las Vegas, LLC, 2:10-cv-00303-GMN-LRL (Nev. 10-28-2010) — Plaintiff's law firm filed a motion to withdraw. Defendant had no objection, provided that the withdrawal would not interfere with the ability of its computer forensics expert to examine various electronic evidence. The Court conditioned withdrawal on delivery of certain equipment to defendant's expert, suspended discovery deadlines, and ordered plaintiff to preserve existing electronic information.

Mazzeo v. Arthur, Case No.: 2:08-cv-01387-RLH-PAL (Nev. 10-28-2010) — Plaintiff sued Defendant, the current governor of Nevada, alleging that he committed battery, false imprisonment, and sexual assault against her. Defendant moved for summary judgment, arguing that a forensics analysis of video footage from the site of the alleged assault fails to show any image of plaintiff or defendant. But the Court noted that plaintiff had submitted eyewitness testimony supporting her version of events, and that at most, the contradictory video forensics report creates a triable issue of fact.

D. New Jersey

U.S. v. Suarez, Criminal Action No.: 09-932 (JLL) (N.J. 10-21-2010) — Defendants in a public corruption case filed a discovery request seeking copies of text messages sent between FBI agents and various cooperating witnesses. After some confusion about what material was in fact available, the Government produced messages from the account of one of the FBI agents involved in the investigation. The text messages of other agents were irrecoverable. The Court held a text message discovery hearing in which various technical specialists testified about the transmission and storage of FBI text messages. The Court concluded that the requested messages were relevant, had been in the Government's possession (either in its servers or on the agents' individual mobile devices), and that the Government had violated the Jencks Act by failing to preserve potentially relevant statements of cooperating witnesses despite reasonably anticipated litigation. Because the Court also concluded that the Government had not acted in bad faith, it limited Defendants' remedy to the issuance of a spoliation instruction, which would permit (but not require) the jury to infer that the contents of the text messages was favorable to the Defendants. However, the jury would also be instructed to consider any rebuttal evidence by the Government.

D. New York [E.D.]

Penberg v. Healthbridge Management, 08 CV 1534 (CLP) (E.D.N.Y. 10-19-2010) — Plaintiff worked for Defendant out of a home office, preparing patient assessments, personnel evaluations, and other documents. He filed suit against Defendant after his position was eliminated in a corporate reorganization, alleging that he had been terminated instead due to medical problems (bypass surgery) and his decision to take 12 weeks of medical leave. During the course of litigation, Defendant was notified by a corporate security firm that various proprietary documents had been shared by Plaintiff on a peer-to-peer network. Defendant immediately requested an order instructing Plaintiff to disconnect his computer from the Internet and allowing a forensic exam of his hard drive. The forensics exam revealed that hundreds of files had been deleted in the 11 days between the initial report by the security firm and the forensics exam. There was also a suggestion that hundreds of documents had been copied to external storage. Defendant asked the Court to dismiss Plaintiff's suit as a sanction for the confidentiality breach, the Court limited its remedy to an imposition of costs and fees. Defendant was allowed to amend its Answer to include a claim for breach of fiduciary duty. In reply, Plaintiff sought to amend his original Complaint to include a count alleging that the breach of fiduciary duty claim is retaliatory. The Court allowed the amendment.

Apelbaum v. First Data Corporation, CV 08-3186 (TCP) (ARL) (E.D.N.Y. 10-19-2010) — Defendant provided information to the Secret Service which resulted in the issuance of a search warrant and seizure of Plaintiff's computer equipment. Plaintiff sued Defendant, alleging a violation of his civil rights on the grounds that the information provided to the Secret Service was false. During discovery, Plaintiff stated that a Secret Service agent had told his attorney that Defendant had requested that the Secret Service forensically wipe Plaintiff's hard drive, which included various personal information. However, the Secret Service agent was deposed and testified that no data had been damaged and that Defendant had not made any request that the Secret Service do so. Defendant then moved to depose Plaintiff's attorney regarding the conversations with the Secret Service agent. The Court agreed that the conversations were not protected by attorney-client privilege, but rejected the request nonetheless, finding that the substance of the conversations had been obtained from the agent during deposition. Under the circumstances, Defendant did not overcome the presumption against depositions of attorneys.

D. New York [W.D.]

Sun v. Tjepkema, 09-CV-35A (W.D.N.Y. 10-15-2010) — Plaintiff was ordered to undergo a secondary inspection while crossing into the United States from Canada across the Rainbow Bridge. During the secondary inspection, Plaintiff was observed taking photographs on a cell phone. His phone was seized by Customs officials and when it was later returned, Plaintiff discovered that the photographs and certain personal information had been deleted. He sued, alleging discrimination during the border crossing and an illegal search and seizure of his cell phone. Defendants filed a motion to dismiss. The Court noted that Customs officials do not need to articulate any reason, beyond national security, for conducting primary or secondary inspections of individuals entering into the United States. Moreover, Customs officials are authorized to prevent the dissemination of photographs that could compromise the conduct of secondary inspections. The complaint was dismissed in its entirety.

D. Pennsylvania [E.D.]

U.S. v. McNamara-Harvey, Criminal Action No. 10-219 (E.D.Pa. 10-5-2010) — Defendant's laptop was recovered from a garage in which he was sleeping, after defendant had fled the scene. Police later requested and received a warrant to seize and examine the laptop for nine categories of computer files relating to four possible crimes. Defendant moved to suppress the seizure and inspection of the laptop, arguing that the application for the warrant lacked specificity and was therefore a violation of the Fourth Amendment as a general warrant. The Court concluded that the warrant application limited the search to specific categories of files relating to specific crimes, and thus did not give investigators "unbridle discretion" to rummage through Defendant's laptop. The Court also rejected Defendant's objection to the police's use of "boilerplate language" in support of its request to conduct an off-site examination of the entire hard drive. The Court noted that the Third Circuit had specifically upheld a warrant based on similar language in the controlling case of United States v. Ninety-two Thousand Four Hundred Twenty-two Dollars & Fifty-seven Cents ($92,422.57), 307 F.3d 137 (3d Cir. 2002). Lastly, the Court noted that in laying out probable cause for a search of the laptop, police cited a variety of factors tending to support the belief that evidence of criminal intent would be found on the laptop. The motion to suppress was denied.

D. South Dakota

U.S. v. Houston, CR 10-40001 (S.D. 10-6-2010) — Defendant moved to suppress evidence seized pursuant to two search warrants. The primary basis for the search warrants was evidence that Defendant had molested his niece. Defendant argued that such evidence could not provide probable cause for the presence of child pornography on his computer. The Court noted that the Eighth Circuit has held that for the purposes of probable cause, there is an "intuitive relationship" between acts of child molestation and probable cause. United States v. Colbert, 605 F.3d 573 (8th Cir. 2010). Relying on its intuition (as well as outright speculation that Defendant might have photographed his niece), the Court concluded that there is a sufficient nexus between molestation and child pornography to support a finding of probable cause. For good measure, the Court also tossed in the Leon good faith exception. Defendant's motion to suppress was denied.