I often get asked if there is a standard protocol for examining Child Pornography, Child Abuse and Child Exploitative material in the possession of law enforcement. The answer is no and according to one FBI lab supervisor there is no need for one because access is grounded in law. I find that this is somewhat of a problem, because courts, prosecutors and law enforcement are not on the same page. I don’t know how many times a court has ordered law enforcement to ship CP material to our lab for analysis without a protective order and even in one case used Dropbox to store the files. Other times I have had courts enter a protective order regarding the material and make a record that law enforcement is not to arrest or intercede in the analysis of the data and that all data is to be destroyed afterwards. I get this feeling that no one wants to address this issue from a wider perspective. I have personally performed numerous examinations of material containing Child Pornography, Child Abuse and Child Exploitative material and no two law enforcement centers treat it the same. I have seen everything from absolute professionalism from places like Lake County, Illinois to a DA’s office where I was threatened for taking notes and once when I forgot my pen on the desk and walked back in the room and found an officer removing a covert video camera they had installed and recorded conversations I had with defense counsel while defense counsel was in the room for the end of the examination. We have a problem and hopefully this article will assist you in framing arguments as to access and includes a protocol for examination (you might have caught that I did not say protective order) that has been vetted by more than one law enforcement lab and a State’s Attorney.
*DISCLAIMER: I am not an attorney and therefore any information below is not legal advice and is for informational purposes only.
FEDERAL LAW: DISCOVERY RIGHTS AND OBLIGATIONS
Rule 16 reads as follows:
(a) Government’s Disclosure.
(1) Information Subject to Disclosure.
(A) Defendant’s Oral Statement. Upon a defendant’s request, the government must disclose to the defendant the substance of any relevant oral statement made by the defendant, before or after arrest, in response to interrogation by a person the defendant knew was a government agent if the government intends to use the statement at trial.
(B) Defendant’s Written or Recorded Statement. Upon a defendant’s request, the government must disclose to the defendant, and make available for inspection, copying, or photographing, all of the following:
(i) any relevant written or recorded statement by the defendant if:
(ii) the portion of any written record containing the substance of any relevant oral statement made before or after arrest if the defendant made the statement in response to interrogation by a person the defendant knew was a government agent; and
(iii) the defendant’s recorded testimony before a grand jury relating to the charged offense.
(C) Organizational Defendant. Upon a defendant’s request, if the defendant is an organization, the government must disclose to the defendant any statement described in Rule 16(a)(1)(A) and (B) if the government contends that the person making the statement:
(i) was legally able to bind the defendant regarding the subject of the statement because of that person’s position as the defendant’s director, officer, employee, or agent; or
(ii) was personally involved in the alleged conduct constituting the offense and was legally able to bind the defendant regarding that conduct because of that person’s position as the defendant’s director, officer, employee, or agent.
(D) Defendant’s Prior Record. Upon a defendant’s request, the government must furnish the defendant with a copy of the defendant’s prior criminal record that is within the government’s possession, custody, or control if the attorney for the government knows—or through due diligence could know—that the record exists.
(E) Documents and Objects. Upon a defendant’s request, the government must permit the defendant to inspect and to copy or photograph books, papers, documents, data, photographs, tangible objects, buildings or places, or copies or portions of any of these items, if the item is within the government’s possession, custody, or control and:
(i) the item is material to preparing the defense;
(ii) the government intends to use the item in its case-in-chief at trial; or
(iii) the item was obtained from or belongs to the defendant.
(F) Reports of Examinations and Tests. Upon a defendant’s request, the government must permit a defendant to inspect and to copy or photograph the results or reports of any physical or mental examination and of any scientific test or experiment if:
(i) the item is within the government’s possession, custody, or control;
(ii) the attorney for the government knows—or through due diligence could know—that the item exists; and
(iii) the item is material to preparing the defense or the government intends to use the item in its case-in-chief at trial.
(G) Expert Witnesses. At the defendant’s request, the government must give to the defendant a written summary of any testimony that the government intends to use under Rules 702, 703, or 705 of the Federal Rules of Evidence during its case-in-chief at trial. If the government requests discovery under subdivision (b)(1)(C)(ii) and the defendant complies, the government must, at the defendant’s request, give to the defendant a written summary of testimony that the government intends to use under Rules 702, 703, or 705 of the Federal Rules of Evidence as evidence at trial on the issue of the defendant’s mental condition. The summary provided under this subparagraph must describe the witness’s opinions, the bases and reasons for those opinions, and the witness’s qualifications.
(2) Information Not Subject to Disclosure. Except as permitted by Rule 16(a)(1)(A)-(D), (F), and (G), this rule does not authorize the discovery or inspection of reports, memoranda, or other internal government documents made by an attorney for the government or other government agent in connection with investigating or prosecuting the case. Nor does this rule authorize the discovery or inspection of statements made by prospective government witnesses except as provided in 18 U.S.C. §3500.
(3) Grand Jury Transcripts. This rule does not apply to the discovery or inspection of a grand jury’s recorded proceedings, except as provided in Rules 6, 12(h), 16(a)(1), and 26.2.
However, there is a special exception regarding cases involving child pornography, child abuse and child exploitative material.
18 U.S.C 3509(m) is as follows:
(m) Prohibition on Reproduction of Child Pornography. —
(1) In any criminal proceeding, any property or material that constitutes child pornography (as defined by section 2256 of this title) shall remain in the care, custody, and control of either the Government or the court.
(A) Notwithstanding Rule 16 of the Federal Rules of Criminal Procedure, a court shall deny, in any criminal proceeding, any request by the defendant to copy, photograph, duplicate, or otherwise reproduce any property or material that constitutes child pornography (as defined by section 2256 of this title), so long as the Government makes the property or material reasonably available to the defendant.
(B) For the purposes of subparagraph (A), property or material shall be deemed to be reasonably available to the defendant if the Government provides ample opportunity for inspection, viewing, and examination at a Government facility of the property or material by the defendant, his or her attorney, and any individual the defendant may seek to qualify to furnish expert testimony at trial.
(3) In any criminal proceeding, a victim, as defined under section 2259(c)(4), shall have reasonable access to any property or material that constitutes child pornography, as defined under section 2256(8), depicting the victim, for inspection, viewing, and examination at a Government facility or court, by the victim, his or her attorney, and any individual the victim may seek to qualify to furnish expert testimony, but under no circumstances may such child pornography be copied, photographed, duplicated, or otherwise reproduced. Such property or material may be redacted to protect the privacy of third parties.
However, 18 U.S.C 3509(m) binds federal courts only and does not preclude State Courts from ordering discovery.
State courts have made some efforts in resolving issues of access:
In cases where all the data belongs to the defendant, FRCrP 16(a)(1)(E) the material should be available to the defense consultants as to not violate your client’s due process rights. Although state courts can place protective orders upon your client’s data those orders are restricted to limited access, use, distribution and that the material must be stored in a secure facility. These protective orders are placed with the presumption that law enforcement would never copy or take the contraband out of the control of government; but an expert examiner would.
What materials should you expect to receive from the prosecution?
Some of the common items we request prior to examination is below:
Recording of Defense Expert
Law enforcement cannot record the screen of the forensic examiner as he may be taking notes that are attorney work product and considering law enforcement had not recorded their screen during examination of the evidence it creates unequal due process.
WHAT IS A DEFENSE EXPERT LOOKING FOR?
In cases involving CP possession and distribution there is a lot of exculpatory information subject to Brady that is necessary to be viewed and copied that does not contain contraband that can be used to establish motive, logged in user, owner of the device among hundreds of others that are needed in order to advise you as to the charges.
There are two ways that forensic experts examine evidence and whether they work for law enforcement or the defense does not matter. Most law enforcement use tools such as Encase, Magnet Axiom and Xways examine the digital media for evidence that a crime has been committed and as soon as that is established, they stop their analysis. The problem in using modern forensic tools is that they are not all equal and can be ran quickly as a surface scan or a deep analysis. Law enforcement has special versions of most commercially available software that conducts what I would consider a quick analysis and if they find evidence of possession or distribution of CP, they charge the client. Considering that most of these types of cases either plead guilty or accept a plea deal there is no need to conduct a deep analysis to put the evidence into context. Some of the questions that need answered is:
Defense experts conduct a deep analysis of the digital media in order to advise defense counsel of the content. This is very important as there is always the off chance that law enforcement may process the evidence again performing a deep analysis and uncover more evidence that could be harmful to your client.
DEFENSE EXPERT PROTOCOL
The following protocol we had vetted by one of the largest ICAC shops in Illinois and the State’s Attorney weighed in outside of a case:
Protocol for Examination
The process above is the same process used by the Regional Computer Forensic Labs across the US.
LAW ENFORCEMENT TACTICS TO RESTRICT ACCESS
I find that many law enforcement officers are obstructionists when it comes to access the contraband material. Below are some tactics I have seen used before:
I recently was informed that the FBI conducted a two-person three-month investigation into one expert to try and discredit them and did so by a simple typographical error as to a date of graduation from college. Defending these types of a cases surely makes some very upset.
The problem with making a long lengthy protective order to try and mitigate these types of issues is that it assumes law enforcement will do the above. I have found that most of the law enforcement try to do a good job and are accommodating, but you do have to watch out for the above. The same is true for when the prosecutor wants to place a protective order as to the defense expert including things such as qualifying them as an expert prior to analysis which is a Daubert issue reserved for trial and this type of tactic assumes defense experts would do something wrong. If a defense expert were to copy and take with him or her contraband, there is laws against that and does not need to be spelled out in a protective order.
WHAT DO YOU DO IF LAW ENFORCEMENT OR THE PROSECUTOR IS NOT COOPERATING?
Shift the burden to someone who will follow the rules!
The Department of Justice created Regional Computer Forensic Labs (RCFL’s) across the United States to assist law enforcement in areas where they do not have the resources, are understaffed, not trained or lack of funding to conduct forensic examinations in support of criminal investigations.
Each RCFL has a viewing room that is designed for defense attorneys and defense experts to view contraband material. There is no charge to law enforcement for using their services and all services are funded by the DOJ.
Each RCFL has multiple computers in the viewing room and in most cases has forensic software installed for viewing. Although your expert may want to use his or her own equipment, I have found that the RCFL has been more than accommodating with allowing an expert to bring his own equipment as long as that equipment will not retain any of the contraband material. It is best practice to share an examination protocol with the lab supervisor prior to showing up as gain a level of trust between the parties. I have even left equipment overnight to process and the RCFL has signs in most labs that are placed on your equipment that states “do not touch” as a courtesy to keep others whom use the room for viewing from touching your equipment as it runs overnight.
Having a forensic copy of the contraband shipped to the RCFL is a sure way to gain access, reduce costs for travel and avoid the discord in law enforcement’s approach.