“Digital Forensics and Child Pornography”

I’ve posted a copy of my presentation for my upcoming lecture to the Delaware Association of Criminal Defense Lawyers on SlideShare.net. Check it out.


“American Privacy: The 400-Year History of Our Most Contested Right”

American Privacy: The 400-Year History of Our Most Contested Right from Frederick Lane

Personal privacy is an important theme running though much of my work on computer forensics, so I thought that readers would be interested in my presentation for the 2013 Privacy XChange Forum in Paradise, Valley, AZ. I’ve posted a copy of the slides on SlideShare.net. Check it out.


December Seminar for Federal Defenders in Indiana (N.D.)

I’m pleased to announce that I will be doing a 6-hour CLE for the federal defenders and CJA panel attorneys for the District of Indiana (N.D.) on December 18, 2013.

The seminar will be an expanded version of my seminar, “Digital Forensics and Child Pornography.” It will also feature one hour of ethics, addressing such topics as appropriate handling of potential CP by defense attorneys, advice that should be given to clients on the retention or destruction of evidence, and legal and ethical restrictions on investigation of Web sites that may possible contain child pornography.

Please contact me at FSLane3@gmail.com or 802-318-4604 if you would like additional information about this seminar, or if you would like to schedule a version of it for your district or bar association. The content can be adjusted for a seminar lasting anywhere from 2-6 hours.


“Computer Forensics: Images and Integrity”

Computer Forensics and Hash Values from Frederick Lane

I’ve posted a copy of my presentation for my upcoming lecture at the NHADCL Fall 2013 CLE on SlideShare.net. Check it out.


A Positive Outcome

I received the following e-mail this afternoon from one of my clients, Attorney Frank Twarog of Murdoch Hughes & Twarog, regarding a case on which we’ve been collaborating:

Props to Megan Campbell;  A grateful nod to Fred Lane.

I filed a motion to dismiss a child pornography case after determining that the State’s expert could not testify that there was evidence that my client “knowingly” possessed contraband images because she could not say that the images had been opened from a flood of other downloaded materials.  Notwithstanding this testimony, Judge Zonay DENIED my motion, without a hearing, citing the expert’s opinion that my client had “moved” the suspect materials from one folder to another, therein inferring the requisite element of knowledge.

Fred Lane then reviewed the order and went as far as completing a forensic review of the mirrored hard drive at the barracks.  He discovered that the images remained in their original downloaded folder and were not moved or opened (the downloaded date, last modified date and last viewed date occurred during the same 7 seconds as it originally took to download).

Last week, I filed a renewed motion to dismiss and requested a hearing.  To my pleasant surprise, Attorney Campbell reviewed Fred’s report with her own expert and prior to the scheduling of a hearing, took it upon herself to dismiss the charge.  It is a rare moment that such a serious charge is dismissed in this way, but in the face of solid exculpatory evidence, I am pleased that she demonstrated the integrity to short circuit a process that would have likely cost my client quite a bit in emotional and financial anxiety.

The key aspect of this case was that the Defendant used the news browser Newsleecher to download content. After reviewing the forensics evidence at the VT State Police lab, I downloaded Newsleecher and examined its default settings. By doing so, I was able to demonstrate that the Defendant had established a default download directory, but had not exercised any dominion or control of the files after they downloaded.


Lecture at the NHACDL Fall 2013 CLE

I am pleased to announce that I will be delivering a lecture to the New Hampshire Association of Criminal Defense Lawyers (NHACDL) at their Fall 2013 CLE on October 18, 2013. The title of my talk is “Computer Forensics: Images and Integrity.”

My talk will focus primarily on the role of hash values in computer forensics. I will update this post with a link to the Powerpoint presentation once it’s completed. If you have any questions, please don’t hesitate to contact me.


A New Online Case Digest

Welcome to CPCaseDigest.com. Over the coming weeks and months, I will be using this space to summarize significant federal and state court decisions in the area of child pornography. These cases offer fascinating insights into the growing role of electronic evidence in criminal prosecutions, and highlight some of the concerns about search-and-seizure of personal electronic devices. I have been working in the field of computer forensics for the past fifteen years, and have seem significant and occasionally alarming changes in the way evidence is collected and handled. More information about my professional work is available at ComputerForensicsDigest.com.


United States v. Rogers, 714 F.3d 82 (1st Cir. 2013)

Metadata:

Date of Decision: 30 April 2013.
Vote: 3-0
Author: Stahl, J.
Other Panelists: Lynch, C.J., and Thompson, J.
Ruling Below:
Subsequent Proceedings: Petition for certiorari filed 24 June 2013.

Facts:

Defendant Brian Rogers and his then-wife Heather sold two laptop computers to a pawn shop. During the reformatting process of defendant’s computer, the pawnshop’s computer technician observed videos of young children engaged in sexually explicit acts. The Brunswick, ME police were notified, and a few days later, collected the laptop from the pawnshop.

A forensic examination revealed both images and videos of CP in various locations on the laptop hard drive, including a Limewire “Shared” folder, the Internet cache, and in “lost files” folders. An examination of defendant’s Internet history, cookies, and bookmarks found entries with names suggesting CP. Defendant was indicted by a grand jury of one count of possessing CP in violation of 18 U.S.C. §§ 2252A(a)(5)(B) and 2256(8)(A). A jury found him guilty, and he was sentenced to 60 months and 8 years supervised release. Rogers was also ordered to pay restitution of $3,150 to “Vicky,” an identified CP victim.

Issues:

A) Whether the government proved that Rogers “knowingly possessed” the CP images on the laptop sold to the pawn shop; and

B) Whether the government established a causal connection between Rogers’ behavior and the alleged harm to “Vicky.”

Rules:

A) To show “knowing possession,” the government must show that the defendant possessed, and knew that he possessed CP.

B) The 1st Circuit looks at three issues related to restitution: “(1) whether someone is a victim of a child pornography offense; (2) what causation requirement applies to identify the compensable losses suffered by the victim as a result of the offense; and (3) what amount of restitution is reasonable.” See United States v. Kearney, 672 F.3d 81 (1st Cir. 2012), cert. dismissed, 133 S. Ct. 1521, 185 L. Ed. 2d 570 (2013). Along with other circuits, the 1st Circuit has elected to apply a proximate causation standard.

Analysis:

A) The evidence from the Defendant’s Internet history made it clear that the CP on the laptop was downloaded intentionally. The cache contained the names of numerous Web sites suggestive of CP. The fact that the defendant bookmarked some of the sites suggests a “deliberate” interest.

The court rejected defendant’s claim that malware was responsible for the CP on the laptop, noting that a forensic test of the viruses found on defendant’s laptop did not result in any CP being downloaded onto a law enforcement computer. CP was found on a desktop computer as well, making it less likely that the contraband on the laptop was obtained accidentally. And finally, the court noted that some of the contraband images on the laptop were located in the Recycle Bin, indicating that defendant tried to delete them (and thus was aware that they had been downloaded).

The court then considered whether the government had proved that the defendant was the person who downloaded the content. It concluded that the government had successfully linked the user account on the laptop to defendant; among other things, defendant provided the password for the account to the pawn shop technician, and used the same ID on other Web sites. There was no evidence to support defendant’s claim that his ex-wife was responsible for downloading the CP. Based on the evidence presented, it was reasonable for the jury to conclude that defendant was the one who downloaded the CP.

B) A District Court’s ruling on restitution is reviewed for abuse of discretion, with legal issues being considered de novo and findings of fact for clear error. The materials submitted by Vickey “amply established ‘that Vicky has suffered immensely . . . from the continued dissemination and viewing of’ material depicting her abuse,” quoting United States v. Kearney672 F.3d 81 (1st Cir. 2012), cert. dismissed, 133 S. Ct. 1521, 185 L. Ed. 2d 570 (2013).

In light of the fact that the underlying crime and restitution materials of this case are essential identical to Kearney, it was not an abuse of discretion for the District Court to order restitution of $3,150, an amount slightly less than the Kearney court assessed.

Holding:

The defendant’s conviction and the restitution order are affirmed.


United States v. Kornhauser, 2013 U.S. App. LEXIS 5968 (2d Cir. 2013)

* Unpublished *

Metadata:

Date of Decision: 26 March 2013
Vote: 3-0
Author: Summary Opinion
Panelists: Walker, J., Wesley, J., and Droney, J.
Ruling Below: Consolidated appeals from the United States District Court for the Southern District of New York (McMahon, J. and Preska, C.J.). [Not Reported]
Subsequent Proceedings:

Facts:

[Editor’s Note: In lieu of a written decision by the District Court or a recitation by the Court of Appeals, the following facts are taken from the Government’s Sentencing Submission, filed 7 December 2011]

Kornhauser was on supervised release following a tax fraud conviction, and a search was conducted of his apartment pursuant to a condition of his release. During the search, officers observed a computer next to his bed and clicked on the “Favorites” tab of Internet Explorer. Instead of names, the bookmarks consisted of Roman numerals. When the officer clicked on several of the bookmarks, he immediately observed images of child pornography. The computer and a CD labeled “Back-up” were seized.

A forensics examination of the computer revealed that more than 700 images of child pornography had been deleted from the Internet cache of the computer, but had not yet been overwritten. The investigator also observed that Kornhauser had installed the program CleanUp!, and that it had been run shortly before the probation officers arrived for their inspection. The CD contained a copy of the “Favorites” bookmarks from Internet Explorer.

A grand jury indicted Kornhauser on 18 August 2010, charging him “unlawfully, willfully, and knowingly possessing (Count One) and receiving (Count Two) child pornography that had been mailed, shipped, and transported in interstate and foreign commerce, in violation of Title 18, United States Code, Sections 2252A(a)(5)(B) and 2252A(a)(2)(A). After trial, he was convicted by a jury on both counts on 4 November 2010.

Issue:

Kornhauser raised four issues on appeal:

A) The trial court erred by allowing the government to show images of alleged CP to the jury, despite Kornhauser’s contention that there was no dispute as to the nature of the images. Kornhauser argued that the display was unduly prejudicial.

B) The trial court refused to allow Kornhauser to testify about an uncle’s “history of problem[atic] sexual behavior,” which Kornhauser claims would support his argument that the uncle downloaded the CP to the computer.

C) The trial court rejected Kornhauser’s preferred jury instruction.

D) The evidence was insufficient to support conviction.

Rule / Analysis:

A) In other cases, the 2d Circuit has endorsed the admission of CP images even when a defendant has stipulated as to their nature. See, e.g., United States v. Polouizzi, 564 F.3d 142, 152-153 (2d Cir. 2009). Here, the trial court assessed whether the probative value of the images was substantially outweighed by their prejudicial effect, and was justified in admitting them.

B) Evidence of a third party’s alleged guilt for the alleged offense(s) “may be excluded where it … is speculative or remote” as the charged crime(s). Holmes v. South Carolina, 547 U.S. 319, 327, 126 S. Ct. 1727, 164 L. Ed. 2d 503 (2006). Here, the trial court was within its discretion to reject Kornhauser’s proffered testimony, given the risk of undue jury confusion and lack of relevance.

C) When challenging a trial court’s jury instruction, a defendant “‘must show that his proposed charge accurately represented the law in every respect, and that the charge actually given, viewed as a whole, prejudiced him.'” United States v. Archer, 671 F.3d 149, 158 (2d Cir. 2011) (quoting United States v. Feliciano, 223 F.3d 102, 116 (2d Cir. 2000)). In this case, the district court’s instructions clearly explained to the jury that the government was required to “prove beyond a reasonable doubt that the defendant. . . was aware that he had received or attempted to receive the visual depiction that constitutes child pornography.” Kornhauser was not prejudiced by the instructions.

D) Automatic downloading of CP images to an Internet cache can constitute “knowing receipt” where a defendant demonstrates an awareness of the likelihood that CP was downloaded by attempting to delete the Internet cache.  United States v. Ramos, 685 F.3d 120, 132 (2d Cir. 2012). Given that Kornhauser viewed over 700 CP images, and installed a program to regularly sweep his cache, it was reasonable for the jury to conclude that he had “knowingly” received CP on his computer.

Holding:

The judgment of the District Court is affirmed.


United States v. Marandola, 489 Fed. Appx. 522 (2d Cir. 2013)

* Unpublished *

Metadata:

Date of Decision: 10 January 2013
Vote: 3-0
Author: Summary Opinion
Panelists: Jacobs, C.J., Pooler, J., and Chin, J.
Ruling Below: United States v. Marandola, 2010 U.S. Dist. LEXIS 93875 (W.D.N.Y., Sept. 9, 2010) (Arcara, J.)
Subsequent Proceedings: None

Facts:

[From the District Court opinion] Defendant and his wife owned two computers, a Dell and an Apple G4, which were both purchased using joint marital funds. Defendant’s wife primarily used the Dell but would occasionally use the Apple to check e-mail.  The couple shared Internet access paid for by defendant’s wife, and sometime their 11-year-old daughter used the Apple computer. On February 28, 2008, defendant’s wife decided to use the Apple to pull up Mapquest for driving instructions. Defendant had renamed the system icons, making it hard for his wife to locate Internet Explorer. Instead, she used the Apple “recent applications” feature. When she did so, however, she saw several videos listed with names suggesting child pornography. She tried to view family photos on the Apple computer and saw images of child pornography interspersed. Many of the images depicted young girls who resembled the couple’s daughter.

Two days later, after consulting with family and friends, she called a sexual abuse hotline. Later that afternoon, detectives from the Lancaster Police Department came to the marital home and asked defendant’s wife for her consent to seize the computers and search them. She signed the consent form and later provided a statement regarding what she saw. A forensics examination of the Apple computer revealed multiple CP images and movies.

Defendant’s motion to suppress the results of the search was denied by the District Court, and he was convicted of violating 18 U.S.C. § 2252A(a)(5)(B). He appealed.

Issue:

Whether Defendant’s wife had authority to grant third-party consent to a search of the Apple computer by law enforcement.

Rule:

A third party has actual authority to provide consent to search if “first, the third party had access to the area searched, and second, either: (a) common authority over the area; or (b) a substantial interest in the area; or (c) permission to gain access.” United States v. Davis, 967 F.2d 84, 87 (2d Cir. 1992). Alternatively, the exception for consent extends to those situations where law enforcement officers reasonably — but erroneously — believe that the third-party has authority to grant consent. See Georgia v. Randolph, 547 U.S. 103, 109, 126 S. Ct. 1515, 164 L. Ed. 2d 208 (2006)

Analysis:

Under either rule, the search was valid. Based on the facts presented, defendant’s wife met all of the criteria for actual authority. The Apple computer was in the living room, to which defendant’s wife had access. Defendant’s wife had a substantial interest in the Apple computer (half of joint funds used to purchase it), and she paid for Internet access. She was never told she couldn’t use the Apple computer, and even though it was password-protected occasionally, it wasn’t on the day she discovered the CP.

Given the facts observed by the police officers, it was entirely reasonable for them to assume that defendant’s wife had authority to consent to a search.

Holding:

The District Court’s denial of Defendant’s motion to suppress is affirmed.