All I Want for Christmas Is. . .

Actually, I'm all set. My husband got me a bitchin' livescribe pen that records hundreds of hours of audio and can match the audio to my notes. Not that I really have occasion to use it. I just think it's really cool. Next thing on my gadget list is a pen-sized scanner. That baby will store thousands of pages of text. Go to the library, scan in the content, download to the laptop and you're off to the races! Technology is a wonderful thing. Especially when you compare what we have today with how Alexander Hamilton and Abe Lincoln had to practice- candlelight and a sharp quill was the best they could hope for.

Even though I have all that I could ever want or need, I'll start by saying what I ask for isn't for me. It's for Connecticut law enforcement and the cause of justice. So, since I'm asking for a big cause, I'm aiming high.

1.   The search warrant statute (CGS 54-33c) says that search warrants have to be executed within 10 days. Well, there are many interpretations out there when it comes to digital evidence and other evidence that requires forensic analysis. As I’m sure you know, sometimes analyses take upward of a year. Nobody has launched an appeal in earnest, and nobody’s really squawked about getting their stuff back yet. Besides, often they don’t want to, because there’s child porn on it. . . Nonetheless, it’s something that’s just clearly illegal. The law says 10 days and the police take a year to do the search. Doesn’t take a genius to figure it out. The lab people have always said that they interpreted the law to mean that the search was executed when the evidence was submitted to the lab. That, of course, is not only intellectually dishonest but factually wrong. Especially in the case of a computer search, it doesn’t even begin until the case is cracked and the source is duplicated. I’m not the only authority on the subject. Prof. Orin Kerr, a big guy in the field, shares the view that there are separate and continuing searches and that the traditional 10-day search warrant execution requirement needs to be changed.

One suggestion would be to require that police re-apply for authority to continue the search every 15 days, similar to what’s required for wiretaps. That way, they would have some accountability to the judicial branch for their continued intrusion into the subject’s private property. I think it’s a judicious course to take, especially given that we keep so much of our personal information on our computers. The feds check in periodically on digital exams for this reason. There should be an explicit requirement in CT that for any search that has more than one stage and/or exceeds the 10 day limit that police must reapply for search authority and justify the need for continued custody and search.

2.   The search warrant statute requires that searches be conducted by CT police officers. Well, when police need information from third parties who hold information, such as Internet Service Providers, communications providers, the electric company, credit card companies, etc, they give the search warrant to the company and the company employees conduct the search. Another fiction/lie- the interpretation by law enforcement is that the search is executed when the warrant is handed to the company representative. No, it’s not. In other states, they’ve dealt with the issue by allowing for a ‘special circumstances’ exception for specialized information or circumstances in which the police cannot effectively conduct the search and the statute allows them to rely on the third party data holder to conduct the search.

3.    Many of the third party data holder searches are extra-territorial. The companies and data are located outside of the state. Police have tried to get around jurisdictional limits by serving the search warrant on either the agent for service of process or the secretary of the state. This came from civil/commercial law that allows for this to facilitate legal process for foreign corporations. When it comes to criminal procedure, there’s a dearth of authority on the matter, and in CT, there is a situation in which the judges down in GA 2 refuse to sign any warrants for any evidence located out of state because they believe it is beyond the scope of their authority and jurisdiction. That is absolutely incorrect under any interpretation of the United States Constitution’s Full Faith and Credit Clause, but, hey- that’s what’s going on, and without a statute, this refusal is going to spread like a virus to other GAs and JDs.

4.    Finally, a recent 9^th Circuit case has held that the plain view doctrine does not apply to computer searches (United States v. Comprehensive Drug Testing). That may not seem like a very big deal, but what they’re talking about in the opinion is. It’s a case that came out of the baseball player steroid use investigation, and some of what happened was that the FBI (being the FBI) scooped up a bunch of electronic data under the auspices of a broadly worded search warrant and took it back to the lab for examination. They went through the data and discovered, in ‘plain view,’ a bunch of inculpatory information about baseball players, other than the targets of the investigation, who tested positive for steroid use. The 9^th Circuit Court put the brakes on, saying that the feds overstepped their boundaries by looking at data that went beyond the scope of the warrant. Importantly- the court said that the feds should not have used investigators to do the ‘searching.’ Instead, they should have used unbiased civilian forensic examiners who should have reviewed the data and turned over to the investigators ONLY the data relevant to the investigation and specifically identified in the search warrant.

That holding, if applied to CT cases involving digital evidence emanating from the Computer Crimes folks in Meriden would invalidate more than half of their cases and cast doubt on the others. The National Academy of Sciences put out a report recently that recommended that all crime labs be removed from the supervision of the police to avoid the appearance of and actual bias. The 9^th Circuit decision in Comprehensive Drug Testing underscores that sentiment and makes it a bit more critical to address. The feds chose not to appeal the decision in Comprehensive Drug Testing to the Supreme Court- I’m thinking because they know they’d lose and they don’t have the present ability to make the wholesale nationwide changes that would be required to make their system right.

Legislation should be passed that will remove the lab from state police involvement and supervision. It could be maintained under the DPS for administrative purposes or better placed under the Judicial Branch. Judicial may not be equipped to deal with the additional responsibility, but there’s got to be an appropriate administrative home for it. 

Police Officer Experts in the 2nd Circuit

Now Here's an Interesting Case. . . 

 "Second Circuit Vacates Convictions Due to Improper Admission of "Officer Expert" Testimony

A frequent occurrence at trial is the presentation of the "officer expert" – a police officer or agent who testifies about aspects of a criminal scheme that are outside the experience of a typical juror, such as organizational hierarchies or jargon used by the participants.  The problem with this kind of testimony, as the Second Circuit noted yesterday in United States v. Mejia, 05-2856-cr, 2008 WL 4459289 (2d Cir. October 6, 2008), is that "[w]hen case agents testify as experts, they gain 'unmerited credibility when testifying about factual matters from first-hand knowledge.'"  In Mejia, the Court has given eloquent expression to the defense's objection to such evidence:

[The use of officer-expert evidence] must be limited to those issues where sociological knowledge is appropriate. An increasingly thinning line separates the legitimate use of an officer expert to translate esoteric terminology or to explicate an organization's hierarchical structure from the illegitimate and impermissible substitution of expert opinion for factual evidence. If the officer expert strays beyond the bounds of appropriately "expert" matters, that officer becomes, rather than a sociologist describing the inner workings of a closed community, a chronicler of the recent past whose pronouncements on elements of the charged offense serve as shortcuts to proving guilt . . .

The Government cannot satisfy its burden of proof by taking the easy route of calling an "expert" whose expertise happens to be the defendant.

Facts

Mejia and his co-defendants were charged with various violent acts that supported the notorious MS-13 gang.  At trial, the government presented the testimony of Hector Alicea, a police officer, as an expert witness on MS-13's background, "its history, its presence on Long Island, and its national and international presence; about the gang's colors, hand signs, graffiti use, naming practices, and tattoos; and about its local subunit structure, leadership structure, division of responsibilities, and membership rules."  In addition, Alicea testified to more specific details about MS-13's operations: how they traveled to other states, their attendance at organizational meetings and how they spent money on guns and narcotics.  He also summarized specifics of the investigation, including firarms and ammunition seizures, arrest for narcotics trafficking, and the numbers of murders MS-13 had allegedly committed on Long Island between June 2000 and the trial.  The defendants were convicted on all counts.

Holding

Vacating the convictions, the Court agreed with the defendants' objections to Alicea’s testimony.  The Court found the testimony problematic on three levels (and non-harmless error):

• Alicea testified about facts that were "well within the grasp of the average juror" – such as statistics from the investigation of this case about actual firearms seizures, arrests for narcotics trafficking, and commission of murders.  "No expertise is required to understand any of these facts."  In effect acting as a "case-agent," " [t]hose parts of [Alicea's] testimony that involved purely factual matters, as well as those in which [he] simply summarized the results of the Task Force investigation, fell far beyond the proper bounds of expert testimony."

• Some of Alicea's testimony involved "merely repeating information he had read or heard – information he learned from witnesses through custodial interrogations, newspaper articles, police reports, and tape recordings:"  While experts may rely on hearsay evidence and "analyze" or "synthesize" this evidence, "[t]he expert may not, however, simply transmit that hearsay to the jury."

• Alicea’s testimony improperly communicated out-of-court testimonial statements of cooperating witnesses and confidential informants under the guise of expert testimony, in violation of the Confrontation Clause and the Supreme Court's holding in Crawford v. Washington, 541 U.S. 36 (2004).  Significantly, the Court went on to point out that since Alicea clearly communicated one fact to the jury that he had learned from a co-conspirator's proffer statements (a very specific fact regarding MS-13’s tax policies), "[t]his impugn[ed] the legitimacy of all of his testimony and strongly suggests that Alicea was 'simply summarizing an investigation by others that was not part of the record,' and presenting it 'in the guise of an expert opinion.'"

Comment

This case highlights how cavalier the government has become in presenting officer-expert testimony, to the extent that it, in this case, the government back-doored a co-conspirator's proffer statements through the so-called "expert."  The case is an important reminder of the importance of exploring the basis for this testimony (as the defense lawyers did so impressively here) and objecting to it, while simultaneously providing terrific ammunition in ensuring that that objection is heard.  Practitioners should be especially wary of prosecutors' efforts to end-run the holding in this case, by getting their "expert-officer" to present all his/her improper facts via some bogus "synthesizing" questions."

Excellent blog at http://www.nyfederalcriminalpractice.com/2008/10/second-circuit-vacates-convict.html

So, what does that mean for computer forensics??? Oh my, where do I begin? 

Many times, if not most of the time, the prosecution's expert in computer crimes and electronic evidence cases is that of a police officer, and that police officer is frequently the case officer/principle investigator. This case tends to support the notion that the case officer-as-examiner interjects bias into the mix. It also begins to examine the 'cavalier' approach of the government, which, anybody who has attended a federal trail regarding this topic has seen.