Kane County Bar Association Computer Forensics And Defending A Criminal Case 021909

A View From The Defense Perspective The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World February 19, 2009 - Geneva, IL

DEFENDING A COMPUTER CRIME CASE The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World

CHALLENGING GOVERNMENT EVIDENCE PRESENTING DEFENSE EVIDENCE The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World

ARE YOU DEFENDING A COMPUTER CRIME? The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World

IS THIS A COMPUTER CRIME? The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World

EXPANDING THE DEFINITION Computer Used To Commit Crime Computer Used To Plan Or Conceal Crime Computer Capable Of Transmitting Evidence Of Crime The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World

EXPANDING THE DEFINITION Computer Crime = Crime In Which There Might Exist Computer (Digital) Evidence The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World

WHO CARES? Any Criminal Law Practitioner The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World

WHO CARES? Illinois Rules of Professional Conduct Rule 1.1(a) (Competence) A lawyer shall provide competent representation to a client. Competent representation requires the legal knowledge, skill, thoroughness and preparation necessary for the representation. The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World

WHO CARES? ABA Criminal Justice Standard 4-4.1 (a) Defense counsel should conduct a prompt investigation of the circumstances of the case and explore all avenues leading to facts relevant to the merits of the case and the penalty in the event of conviction … The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World

WHO CARES? ABA Criminal Justice Standard 4-6.1(b) Defense counsel may engage in plea discussions with the prosecutor. Under no circumstances should defense counsel recommend to a defendant acceptance of a plea unless appropriate investigation and study of the case has been completed , including an analysis of controlling law and the evidence likely to be introduced at trial. The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World

ANY OBJECTIONS? The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World

DEFENDING A COMPUTER CASE Unique Search and Seizure Issues Unique Admissibility Issues Unique Forensic Issues The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World

GOVERNMENT EVIDENCE Acquisition Analysis Admissibility The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World

ACQUISITION Fourth Amendment Issues Statutory Issues The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World

FOURTH AMENDMENT ISSUES Warrantless Searches Search Warrants The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World

U.S. v. Carey, 172 F.3d 1268, 10 th Circuit (Kan.), 1999

U.S. v. Walser, 275 F. 3d 981, 10 th Circuit (Wyo.), 2001

The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World

Consent

Search Incident To Arrest

Exigent Circumstances

Plain View

Inventory Search

Automobile Search

Third Party Consent

Implied Consent

Practical Considerations

Authority To Consent

Apparent Authority

Parental

System Administrators

Joint Access Or Control

U.S. v. Smith, 27 F.Supp.2d 1111, C.D. IL, 1999

Password-protected Files

Trulock v. Freeh, 275 F.3d 391, 4 th Circuit (Va.), 2001

“ Parents can consent to searches of their children’s rooms when the children are under 18 years old.”

Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations, Computer Crime and Intellectual Property Section, Criminal Division, United States Department of Justice, 2002.

Parental Consent – Adult Children

U.S. v. Rith, 164 F.3d 1323, 10 th Circuit (Utah), 1999

Withdrawal Of Consent

Scope Of Consent

Focus Of Search Is Key

United States v. Carey, 172 F.3d 1268, 10 th Circuit (Kan.) 1999

Focus Of Search Is Key

United States v. Sell, 2005 U.S. Dist LEXIS 26452, N.D. Ill., 2005

Investigation Of Cannabis Offense

Consent Refused

Consent Provided During Attempt To Obtain Warrant

Computer Search Held Beyond Scope

Accessing Pager Memory

U.S. v. Reyes , 922 F.Supp. 818, S.D.N.Y., 1996

Deletion Of Data

U.S. v. David, 756 F.Supp. 1385, D.C. Nev., 1991

Pagers

U.S. v. Romero-Garcia, 991 F.Supp. 1223, D.C. Ore., 1991

U.S. v. Ortiz, 84 F.3d 977, 7 th Circuit (Wis.), 1996

Case-by-Case Determination

Limitations

Seizure

Search

“ The plain view doctrine does not authorize agents to open and view the contents of a computer file that they are not otherwise authorized to open and review.”

U.S. v. Carey, 172 F.3d 1268, 10 th Circuit (Kan.), 1999

U.S. v. Walser, 275 F. 3d 981, 10 th Circuit (Wyo.), 2001

Contrast

U.S. v. Runyan, 275 F.3d 449, 5 th Circuit (Tex.), 2001

U.S. v. Slanina , 283 F.3d 670, 5 th Circuit (Tex.), 2002

People v. Phillips , 215 Ill.2d 554, 831 N.E.2d 574, 2005

Establishing Probable Cause

Describing Property To Be Searched, Seized

Execution Issues

Post-execution Issues

Evidence That Crime Has Occurred

Evidence That Evidence Of That Crime Will Be Found At Site

Nexus Between Location And Crime

Staleness

Lack Of Corroboration

General Insufficiency

Computer

Premises

Establishing Probable Cause That There Is Relevant Evidence On A Computer …

Computer As “Repository,” Not “Tool”

Portable Media

How Does The Government Know There Is Relevant Evidence On A Computer?

Sometimes, It Doesn’t!

Investigation

Creativity

Indicia Of Residency, Occupancy

How Do You Know There Is Relevant Evidence On A Computer?

Sometimes, You Don’t!

Probable Cause That Evidence Exists In Electronic Format Not Required

U.S. V. Reyes, 798 F.2d 380, 10 th Circuit (N.M.), 1986

How Do You Know There Is Relevant Evidence On A Computer?

Images Of Child Pornography

U.S. v. Griesbach, 540 F.3d 380, 7 th Circuit (Wis.), 2008

Establishing Probable Cause That There Is A Computer In The Premises …

Online Child Enticement

Online Auction Fraud

How Do You Know There Is A Computer In The Premises?

Non-computer Crimes

Seek Evidence Of The Implicated Offense, Regardless Of The Form In Which It Exists

U.S. v. Hudspeth, 459 F.3d 922, 8 th Circuit (Mo.), 2006

Case-by-case Determination

4-1/2 Months

U.S. District Court, E.D. Missouri

U.S. v. Fazio, 2006 WL 1307614, E.D. Mo., 2006

13-15 Months

U.S. Court of Appeals, 3 rd Circuit

U.S. v. Harvey, 2 F.3d 1381, 3 rd Circuit (Pa.), 1993

U.S. v. Fazio

“ … the affidavit … computer files … can be recovered months or even years after they have been downloaded … deleted or viewed … “

2006 WL 130764 at p. 7

U.S. v. Delatorre, 508 F.Supp.2d 648, N.D. Ill., 2007

Two-year Between Dates Of Information And Execution Of Warrant Did Not Render Warrant Invalid

U.S. v. Watzman, 486 F.3d 1004, 7 th Cir. (Ill.)., 2007

One Year Delay Between Provision Of Information And Issuance Of Warrant Did Not Render Warrant Invalid

Again, No “Bright Line”

U.S. v. Strauser, 247 F.Supp.2d 1147, E.D. Mo., 2003

Yahoo Records

Email Account Subscribed To CP Site

2 Associated, Sexually Suggestive Screen Names

General Information Re: CP Collectors

Strauser

Only Those Interested In CP Would Subscribe And Not Unsubscribe

Person Undertaking Action = “Collector And Distributor”

Likely To Have Received And Kept CP From Site

Protecting Against “ … general, exploratory rummaging in a person's belongings …”

U.S. v. Alagic, 2007 WL 128947, E.D. Mo., 2007

Volume Of Data Poses Unique Particularity Issues

Danger Of General Warrant

Investigating Financial Crime

Tax Returns

Banking Records

Wife’s Dissertation

Son’s School Project

Baseball Coaching Materials

Courts requiring inclusion of search terms in search warrant

In the Matter of the Search of 3817 W. WEST END, FIRST FLOOR, CHICAGO, ILLINOIS 60621, 321 F.Supp.2d 953, N.D. Ill., 2004

Courts NOT Requiring Inclusion Of Search Terms In Search Warrant

U.S. v. Kaechele, 2006 WL 3510898, E.D. Mich., 2006

U.S. v. Burns, 2008 U.S. Dist. LEXIS, 35312, N.D. Ill., 2008

U.S. v. Umgelder, 2007 U.S. Dist. LEXIS, 89719, S.D. Ill., 2007

Other Means For Dealing With Scope

Special Masters

“ Taint Teams”

U.S. v. Triumph, 211 F.R.D. 31, D.C. Ct., 2002

U.S. v. Budd , 549 F.3d 1140 (7 th Cir. Ill.)

48-day Delay Unreasonable

No Relief Granted

State v. Shinohara, 872 N.E.2d 498, Ill.App.Ct. (1 st Dist)., 2007

Computer Seized 8/24/01

Warrant Obtained 11/7/01

Warrant Return Date 11/9/01

Forensic Exam Completed 1/1/02

“ Filling In The Gaps” – DOJ

Beyond Traditional Fourth Amendment Protections

Varying Levels of Privacy Interests

Communications Held By:

Remote Computing Services

Electronic Communications Services

“ … provision to the public of computer storage or processing services by means of an electronic communications system.”

18 USC 2711(2)

“ … the ability to send or receive wire or electronic communications.”

18 USC 2510(15)

Classifying Network Services Provider

Classifying Information Sought

Electronic Communication Service?

Remote Computing Service?

Neither?

Both?

“ … . depends on the nature of the particular communication sought.”

E-mail Scenario

Recipient’s Email/Internet Service

Sender’s Corporate Email Client

Basic Subscriber Information

18 USC 2703(c)(2)

Customer/Subscriber Information

18 USC 2703(c)(3)

Content

18 USC 2510(8)

Basic Subscriber Information

Name

Address

Telephone Connection Records

Session Times and Durations

Length and Types of Service

Subscriber Number/Identity

Means and Source of Account Payment

Subpoena – 18 USC 2703 (c)(2)

Opened Emails

Subpoena, with Prior Notice

18 USC 2703 (b)(1)(b)

18 USC 2705

Account Logs, Transactional Records

Court Order – 18 USC 2703(d)

Entire Account Contents, Except Unopened Email or Voicemail Stored for 180 Days or Less

Court Order – 18 USC 2703(d) and compliance with notice provisions of 18 USC 2705

Content

Search Warrant

The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World Public Provider Non-public Provider Voluntary Disclosure Allowed? Mechanism To Compel Voluntary Disclosure Allowed? Mechanism To Compel Basic Subscriber, Session and Billing Information Only if §2702 (c) exception applies Subpoena §2703(d) order Warrant Yes Subpoena §2703(d) order Warrant

The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World Public Provider Non-public Provider Voluntary Disclosure Allowed? Mechanism To Compel Voluntary Disclosure Allowed? Mechanism To Compel Other Transactional And Account Records Only if §2702 (c) exception applies §2703(d) order Warrant Yes §2703(d) order Warrant

The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World Public Provider Non-public Provider Voluntary Disclosure Allowed? Mechanism To Compel Voluntary Disclosure Allowed? Mechanism To Compel Opened email, voice mail left with provider; Other stored files Only if §2702 (b) exception applies Subpoena with notice §2703(d) order with notice Warrant Yes Subpoena ECPA does not apply

The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World Public Provider Non-public Provider Voluntary Disclosure Allowed? Mechanism To Compel Voluntary Disclosure Allowed? Mechanism To Compel Including email, voicemail in electronic storage >180 days Only if §2702 (b) exception applies Subpoena with notice §2703(d) order with notice Warrant Yes Subpoena with notice §2703(d) order with notice Warrant

The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World Public Provider Non-public Provider Voluntary Disclosure Allowed? Mechanism To Compel Voluntary Disclosure Allowed? Mechanism To Compel Including email, voicemail in electronic storage <180 days Only if §2702 (b) exception applies Warrant Yes Warrant

Suppression Excluded

18 USC 2708

Civil Actions

18 USC 2707

ANAYLSIS Lab Issues Examiner Issues Examination Issues The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World

LAB ISSUES Accreditation Policies/Procedures The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World

EXAMINER ISSUES Certification Training Expert Qualifications The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World

EXAMINATION ISSUES Policy/procedure Compliance Internal Review Documentation of Work Abnormalities The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World

ADMISSIBILITY Relevance Authentication Hearsay Other Objections The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World

MISSING EVIDENCE What Kind Of Digital Evidence Should The Finder Of Fact From A Competent Investigation? The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World

A DAY IN THE DIGITAL LIFE … The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World

A DAY IN THE DIGITAL LIFE … The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World Pointing Out Missing Evidence Presenting Exculpatory Evidence

CONTACT INFO Craig J. Chval (630) 986-8205 (573) 214-0520 [email_address] www.chvalgroup.com The Chval Law Group, P.C. Digital Lawyers For Today’s Digital World