“Digital Forensics and Child Pornography”
Posted: 3 December 2013 Filed under: Announcements, Powerpoint Presentations Leave a commentI’ve posted a copy of my presentation for my upcoming lecture to the Delaware Association of Criminal Defense Lawyers on SlideShare.net. Check it out.
“American Privacy: The 400-Year History of Our Most Contested Right”
Posted: 3 November 2013 Filed under: Announcements, Powerpoint Presentations, Privacy Leave a commentPersonal privacy is an important theme running though much of my work on computer forensics, so I thought that readers would be interested in my presentation for the 2013 Privacy XChange Forum in Paradise, Valley, AZ. I’ve posted a copy of the slides on SlideShare.net. Check it out.
December Seminar for Federal Defenders in Indiana (N.D.)
Posted: 17 October 2013 Filed under: Announcements Leave a commentI’m pleased to announce that I will be doing a 6-hour CLE for the federal defenders and CJA panel attorneys for the District of Indiana (N.D.) on December 18, 2013.
The seminar will be an expanded version of my seminar, “Digital Forensics and Child Pornography.” It will also feature one hour of ethics, addressing such topics as appropriate handling of potential CP by defense attorneys, advice that should be given to clients on the retention or destruction of evidence, and legal and ethical restrictions on investigation of Web sites that may possible contain child pornography.
Please contact me at FSLane3@gmail.com or 802-318-4604 if you would like additional information about this seminar, or if you would like to schedule a version of it for your district or bar association. The content can be adjusted for a seminar lasting anywhere from 2-6 hours.
“Computer Forensics: Images and Integrity”
Posted: 16 October 2013 Filed under: Powerpoint Presentations Leave a commentI’ve posted a copy of my presentation for my upcoming lecture at the NHADCL Fall 2013 CLE on SlideShare.net. Check it out.
A Positive Outcome
Posted: 16 October 2013 Filed under: Announcements Leave a commentI received the following e-mail this afternoon from one of my clients, Attorney Frank Twarog of Murdoch Hughes & Twarog, regarding a case on which we’ve been collaborating:
Props to Megan Campbell; A grateful nod to Fred Lane.
I filed a motion to dismiss a child pornography case after determining that the State’s expert could not testify that there was evidence that my client “knowingly” possessed contraband images because she could not say that the images had been opened from a flood of other downloaded materials. Notwithstanding this testimony, Judge Zonay DENIED my motion, without a hearing, citing the expert’s opinion that my client had “moved” the suspect materials from one folder to another, therein inferring the requisite element of knowledge.
Fred Lane then reviewed the order and went as far as completing a forensic review of the mirrored hard drive at the barracks. He discovered that the images remained in their original downloaded folder and were not moved or opened (the downloaded date, last modified date and last viewed date occurred during the same 7 seconds as it originally took to download).
Last week, I filed a renewed motion to dismiss and requested a hearing. To my pleasant surprise, Attorney Campbell reviewed Fred’s report with her own expert and prior to the scheduling of a hearing, took it upon herself to dismiss the charge. It is a rare moment that such a serious charge is dismissed in this way, but in the face of solid exculpatory evidence, I am pleased that she demonstrated the integrity to short circuit a process that would have likely cost my client quite a bit in emotional and financial anxiety.
The key aspect of this case was that the Defendant used the news browser Newsleecher to download content. After reviewing the forensics evidence at the VT State Police lab, I downloaded Newsleecher and examined its default settings. By doing so, I was able to demonstrate that the Defendant had established a default download directory, but had not exercised any dominion or control of the files after they downloaded.
Lecture at the NHACDL Fall 2013 CLE
Posted: 14 October 2013 Filed under: Announcements | Tags: CLE, lectures, NH 1 CommentI am pleased to announce that I will be delivering a lecture to the New Hampshire Association of Criminal Defense Lawyers (NHACDL) at their Fall 2013 CLE on October 18, 2013. The title of my talk is “Computer Forensics: Images and Integrity.”
My talk will focus primarily on the role of hash values in computer forensics. I will update this post with a link to the Powerpoint presentation once it’s completed. If you have any questions, please don’t hesitate to contact me.
A New Online Case Digest
Posted: 14 October 2013 Filed under: General Leave a commentWelcome to CPCaseDigest.com. Over the coming weeks and months, I will be using this space to summarize significant federal and state court decisions in the area of child pornography. These cases offer fascinating insights into the growing role of electronic evidence in criminal prosecutions, and highlight some of the concerns about search-and-seizure of personal electronic devices. I have been working in the field of computer forensics for the past fifteen years, and have seem significant and occasionally alarming changes in the way evidence is collected and handled. More information about my professional work is available at ComputerForensicsDigest.com.
United States v. Kornhauser, 2013 U.S. App. LEXIS 5968 (2d Cir. 2013)
Posted: 26 March 2013 Filed under: 2013, 2d Circuit, Display of CP to Jury, Jury Instructions, Possession, Receipt, Supervised Release | Tags: 2252(a)(5)(B), 2252A(a)(2)(A), bookmarks, CleanUp!, Internet cache Leave a comment* Unpublished *
Metadata:
Date of Decision: 26 March 2013
Vote: 3-0
Author: Summary Opinion
Panelists: Walker, J., Wesley, J., and Droney, J.
Ruling Below: Consolidated appeals from the United States District Court for the Southern District of New York (McMahon, J. and Preska, C.J.). [Not Reported]
Subsequent Proceedings:
Facts:
[Editor’s Note: In lieu of a written decision by the District Court or a recitation by the Court of Appeals, the following facts are taken from the Government’s Sentencing Submission, filed 7 December 2011]
Kornhauser was on supervised release following a tax fraud conviction, and a search was conducted of his apartment pursuant to a condition of his release. During the search, officers observed a computer next to his bed and clicked on the “Favorites” tab of Internet Explorer. Instead of names, the bookmarks consisted of Roman numerals. When the officer clicked on several of the bookmarks, he immediately observed images of child pornography. The computer and a CD labeled “Back-up” were seized.
A forensics examination of the computer revealed that more than 700 images of child pornography had been deleted from the Internet cache of the computer, but had not yet been overwritten. The investigator also observed that Kornhauser had installed the program CleanUp!, and that it had been run shortly before the probation officers arrived for their inspection. The CD contained a copy of the “Favorites” bookmarks from Internet Explorer.
A grand jury indicted Kornhauser on 18 August 2010, charging him “unlawfully, willfully, and knowingly possessing (Count One) and receiving (Count Two) child pornography that had been mailed, shipped, and transported in interstate and foreign commerce, in violation of Title 18, United States Code, Sections 2252A(a)(5)(B) and 2252A(a)(2)(A). After trial, he was convicted by a jury on both counts on 4 November 2010.
Issue:
Kornhauser raised four issues on appeal:
A) The trial court erred by allowing the government to show images of alleged CP to the jury, despite Kornhauser’s contention that there was no dispute as to the nature of the images. Kornhauser argued that the display was unduly prejudicial.
B) The trial court refused to allow Kornhauser to testify about an uncle’s “history of problem[atic] sexual behavior,” which Kornhauser claims would support his argument that the uncle downloaded the CP to the computer.
C) The trial court rejected Kornhauser’s preferred jury instruction.
D) The evidence was insufficient to support conviction.
Rule / Analysis:
A) In other cases, the 2d Circuit has endorsed the admission of CP images even when a defendant has stipulated as to their nature. See, e.g., United States v. Polouizzi, 564 F.3d 142, 152-153 (2d Cir. 2009). Here, the trial court assessed whether the probative value of the images was substantially outweighed by their prejudicial effect, and was justified in admitting them.
B) Evidence of a third party’s alleged guilt for the alleged offense(s) “may be excluded where it … is speculative or remote” as the charged crime(s). Holmes v. South Carolina, 547 U.S. 319, 327, 126 S. Ct. 1727, 164 L. Ed. 2d 503 (2006). Here, the trial court was within its discretion to reject Kornhauser’s proffered testimony, given the risk of undue jury confusion and lack of relevance.
C) When challenging a trial court’s jury instruction, a defendant “‘must show that his proposed charge accurately represented the law in every respect, and that the charge actually given, viewed as a whole, prejudiced him.'” United States v. Archer, 671 F.3d 149, 158 (2d Cir. 2011) (quoting United States v. Feliciano, 223 F.3d 102, 116 (2d Cir. 2000)). In this case, the district court’s instructions clearly explained to the jury that the government was required to “prove beyond a reasonable doubt that the defendant. . . was aware that he had received or attempted to receive the visual depiction that constitutes child pornography.” Kornhauser was not prejudiced by the instructions.
D) Automatic downloading of CP images to an Internet cache can constitute “knowing receipt” where a defendant demonstrates an awareness of the likelihood that CP was downloaded by attempting to delete the Internet cache. United States v. Ramos, 685 F.3d 120, 132 (2d Cir. 2012). Given that Kornhauser viewed over 700 CP images, and installed a program to regularly sweep his cache, it was reasonable for the jury to conclude that he had “knowingly” received CP on his computer.
Holding:
The judgment of the District Court is affirmed.