Digital Evidence in Criminal Cases Before the US Courts of Appeal

Journal of Digital Forensics, Security and Law

Volume 14 Number 4 Article 3

April 2020

Digital Evidence in Criminal Cases Before the U.S. Courts of Appeal: Trends and Issues for Consideration

Martin Novak National Institute of Justice, [email protected]

Follow this and additional works at: https://commons.erau.edu/jdfsl

Part of the Computer Law Commons, Criminal Law Commons, and the Science and Technology Law Commons

Recommended Citation Novak, Martin (2020) "Digital Evidence in Criminal Cases Before the U.S. Courts of Appeal: Trends and Issues for Consideration," Journal of Digital Forensics, Security and Law: Vol. 14 : No. 4 , Article 3. DOI: https://doi.org/10.15394/jdfsl.2019.1609 Available at: https://commons.erau.edu/jdfsl/vol14/iss4/3

This Article is brought to you for free and open access by the Journals at Scholarly Commons. It has been accepted for inclusion in Journal of Digital Forensics, Security and Law by an authorized administrator of (c)ADFSL Scholarly Commons. For more information, please contact [email protected]. Digital Evidence in Criminal Cases... JDFSL V14N4

DIGITAL EVIDENCE IN CRIMINAL CASES BEFORE THE U.S. COURTS OF APPEAL: TRENDS AND ISSUES FOR CONSIDERATION Martin Novak National Institute of Justice [email protected]

1. INTRODUCTION While computer forensics involves all digital storage, digital evidence is information stored or transmitted in binary form that Though the use of computer forensics in crim- may be relied on in court. There are count- inal investigations has expanded in recent less potential sources of digital evidence, in- years, there is little empirical evidence about cluding text messages, images downloaded the prevalence of the use of digital evidence to a computer, a mobile device’s call log, in the court system and its impact on prose- network access logs, chat sessions, internet cutorial outcomes. [1] browser history and cache files, passwords, documents, spreadsheets, and databases. The terms digital evidence and computer forensics are closely related, yet there are This paper is an examination of federal differences. Computer forensics is the uncov- criminal cases before the United States Court ering and examination of evidence located of Appeal in which legal issues were related on all electronic devices with digital stor- to digital evidence. The purpose of this re- age, including computers, cell phones, and search was to determine the most common net-works. Though there is no universally ac- legal basis for appeals relating to the intro- cepted standard for computer forensics, there duction or exclusion of digital evidence, the are generally accepted practices in place. [2] frequency with which cases involving an ap- In 2014, the Scientific Working Group on Dig- peal regarding digital evidence affirmed or ital Evidence (SWGDE) published its Best reversed for the defense, whether certain chal- Practices for Computer Forensics to describe lenges to digital evidence are more prevalent the best practices for collecting, acquiring, than others, and whether there are trends analyzing, and documenting the data found or areas of the law as applied to computer in computer forensic examinations. Similar forensics and digital evidence needing further to other published best practices, it is not a attention by the criminal justice system. step-by-step guide nor legal advice, and only The digital evidence produced by com- addresses the types of technologies available puter forensics has the potential to identify at the time of publication. suspects, win acquittal, or obtain a convic-

c 2020 JDFSL Page 1 JDFSL V14N4 Digital Evidence in Criminal Cases...

tion. Information obtained through digital reason for being admitted into evidence and evidence can be used to both corroborate and notwithstanding any related jury instructions establish necessary elements of prosecution as to the limitations of that evidence.” [4] and defense cases such as motive, suspect or The kind of effect may depend on the quality witness location, and alibis. Two high-profile of the evidence presented. Matt McCusker, cases anecdotally illustrate both the value of of the American Society of Trial Lawyers, introducing digital evidence, as well as the warns that “the average juror does not have limited value of that evidence in the absence the expertise to differentiate between ’good of clarity and credibility of the forensic meth- science’ and ’junk science,’ so the court must ods used to obtain it. help them by excluding dubious evidence.” [5] The murder trial of Casey Anthony, outlined 1.1 Cobb County, Georgia below, is a case in point. On September 14, 2014, Ross Harris was charged with two counts of felony murder 1.2 Orange County, Florida in the death of his son, Cooper Harris. The On October 14, 2008, Casey Anthony was Cobb County, Georgia charging documents indicted by an Orange County, Florida grand stated that Harris maliciously caused the jury with Capital Murder in the First Degree death of his son by leaving him alone in a in the death of her daughter, Caylee Anthony. hot motor vehicle with the windows shut on Prosecutors alleged that Anthony used chlo- June 18, 2014. [3] He was also charged with roform on Caylee, then suffocated her by Criminal Cruelty to a Child and Criminal covering the girl’s mouth and nose with duct Attempt to Commit a Felony. tape. They also alleged that Anthony put Investigators were at first puzzled as to her daughter’s body in her car trunk before why a seemingly loving father would murder disposing of it. The child’s skeletal remains his child. A forensic examination of a com- were found in December 2008, less than a puter, mobile device, thumb drive, external mile from the home of Anthony’s parents. hard drive, SD card, and DVD – all belong- A computer forensics examiner testified ing to Harris – led police to discover the for the prosecution, stating that someone motive for the murder. Text messages recov- had searched the words “chloroform” a total ered from the computer showed that Harris of 84 times on a computer seized from the was having an affair with a 17-year-old high Anthony home. [6] The examiner further school student. Online searches recovered testified that the searches were found in a from his computer demonstrated that Harris portion of the hard drive believed to have was searching for information on the age of held deleted files. The implication was that consent in the State of Georgia and “how to Anthony had made those searches and was survive in prison.” Examination of his mobile evidence of premeditation. device also recovered evidence that Harris During his forensic examination of the com- had been “sexting” with several other women puter, the examiner used two tools to per- while his son was dying in the overheated car. form the keyword searches that found the On November 14, 2016, Harris was convicted word “chloroform.” While it is generally good of murder in the first degree of his son and forensic practice to duplicate one’s searches sentenced to life without parole. with multiple tools, in this case, it caused con- According to the American Bar Associa- fusion for the jury. The timestamps, which tion, digital evidence “can have a long-lasting indicate when a particular search was made, effect on the court or jurors, regardless of the did not synch between the two tools used.

Page 2 c 2020 JDFSL Digital Evidence in Criminal Cases... JDFSL V14N4

This could have easily been explained in that 2.1 Search and Seizure the tools used different methods to conduct their respective searches, but the prosecution gave no such explanation. Search and seizure allows law enforcement to search and seize property after obtaining a The counsel for the defense saw a weakness warrant based on probable cause. In consid- in the prosecution’s case and swiftly brought ering the prevalence and impact of computer it to the jury’s attention. Jose Baez, lead forensics in the court system, it is important counsel for the defense, stated, “The state’s to consider digital evidence regarding search computer forensic evidence involving chlo- and seizure practices. Because it is inher- roform research, a central element of their ently different from physical evidence, digital premeditation argument, was used to mislead evidence presents a unique set of search and the jury and that the flaws in that evidence seizure complications. infected their entire case like a cancer.” [7] Anthony was found not guilty on the As Garfinkel states in Digital Forensics, charge of capital murder in the first degree on electronic storage devices can serve as two July 5, 2011. The jury based its decision, in different kinds of digital evidence, each with part, on the lack of credible forensic evidence its own set of complications. [8] In the first linking her to the alleged crime. case, an electronic storage device might con- These two cases clearly illustrate the power tain evidence of a crime that took place in that digital evidence can have in the disposi- the physical world, such as murder, rape, or tion of a case, and raise questions about the child molestation. In these cases, the device legal precedent regarding digital evidence and is incidental to the crimeit is a vessel that its impact on prosecutorial outcomes. The helped facilitate a crime, but not an object next section discusses relevant literature that directly involved in the physical criminal act. has helped inform the debate about computer In this case, investigators face the difficulty forensics and digital evidence. that, as Garfinkel states, “Computerization has made the evidence harder for investigators to analyze than paper records.” [9]

2. LITERATURE The second scenario in which an electronic storage device serves as a form of digital ev- REVIEW idence is where it is inherently part of the crime committed. An example of this is hack- Although the literature on computer forensics ing or possession of child pornography. In is somewhat limited, particularly in regard to these cases, Garﬁnkel says, “investigators are courts, there is research that discusses issues often hampered by the technical sophistica- relevant to computer forensics and digital evi- tion of the systems and the massive amount dence in courts. This literature can be largely of evidence to analyze.” [10] be broken into the three areas of Search and Seizure, Admissibility, and Precedent. To- In both cases, the presence of digital evi- gether, the literature under each topic forms dence raises important questions about how a foundation of research on which the research and seizure practices should be ap- search questions of this study were built. In plied. This review examines the literature this literature review, each body of literature around these debates, particularly with re- is discussed. gard to Warrants and Plain View.

c 2020 JDFSL Page 3 JDFSL V14N4 Digital Evidence in Criminal Cases...

2.1.1 Search and Seizure: Warrants a container — that requires a separate open- ing to determine what is inside.” [13] Clancy A warrant provides police with the legal au- states that accepting this view does not imply thority to conduct a search of physical prop- accepting that a particularized warrant will erty. However, the concept of warrants was become a general warrant. Instead, the rules developed in and for a context of physical that are in place that limit the scope of the evidence, and its application to digital evi- search itself, such as the nature of the crime dence is complicated. The Fourth Amend- or the evidence one expects to find, will allow ment protects against unreasonable search, the court to determine the sufficiency of the but there is debate among scholars with re- information provided to them in the warrant gard to whether and how the rules for search- that authorized the search. ing for digital evidence should be adapted so In 2015, the Supreme Court offered clarity as not to violate this protection. This debate with regard to the warrant requirement to is outlined below. search digital content. In Riley v. California The scholars Kerr (2005), Rummel (2011), decision [14], the Supreme Court declared and Bartholomew (2014) argue that the that the “answer to the question of what po- search for digital evidence is not a one-step lice must do before searching a cell phone process, as with physical evidence, but rather seized incident to an arrest is . . . simple a two-step process. Kerr explains that “the — get a warrant.” [15] [16] This landmark police first execute a physical search to seize ruling closed a debate regarding whether law computer hardware, and then later execute enforcement needed to obtain a warrant be- a second electronic search to obtain the data fore searching for digital evidence. from the seized computer storage device.” [11] Although the Supreme Court declaration Similarly, Ohm (2011) believes that a sec- established the need for a warrant, ques- ond warrant should be required in order to tions remained regarding the details of war- meet the particularity requirements of the rants used to collect digital data. Gershowitz Fourth Amendment. Ohm states that this (2015) suggests two approaches for searches warrant should “clearly approv[e] the search involving cell phones. First, he says that of a particular computer’s hard disk or stor- “judges should impose search protocols that age media, which is already secured and specify in advance exactly how police should seized by the government pursuant to an ear- execute warrants and sift through electronic lier probable cause search (ideally a first war- data.” [17] In a second method, Gershowitz rant) . . . [ensuring that] when a magistrate suggests that “magistrates should initially re- approves that search, he or she is aware of strict warrants to a manual search of the what is being authorized.” [12] particular functions or applications for which Other scholars have historically disagreed there is probable cause.” [18] He predicts that with this two-step view. Some have argued the use of these restrictions will protect the that computer searches should be viewed by privacy rights of individuals, prevent the use the courts in the same manner as the physical of the “good faith” exception, [19] and allow search of documents and other containers of law enforcement to conduct searches of cell information, such as a filing cabinet. Clancy phones when there is probable cause to do (2005) explains that “a computer is a con- so. tainer of containers of documents, that is, Similarly to Gershowitz, Huynh (2015) sug- each individual file is a separate container — gests a process-based protocol for the search just like each manila file in a filing cabinet is of cell phones in which forensic examiners

Page 4 c 2020 JDFSL Digital Evidence in Criminal Cases... JDFSL V14N4

must describe the following in warrant appli- 2.1.2 Search and Seizure: Plain cations: a technical explanation of the search View procedure, an explanation of what is being sought, the extent of the process being used, Closely related to the issues of warrants in description of the process used to copy the collecting and searching digital data is the device for analysis, methods used to isolate issue of the Plain View Doctrine. In a context information that is outside of the scope of of physical evidence, plain view allows a law the warrant, plans for purging nonresponsive enforcement officer to search items found in data, and detail of the access control policies plain sight without a warrant. However, the in place by the examining agency. [20] Huynh definition of plain view is complicated in the contends that the protocol would enhance the context of digital evidence. particularity within a search, and limit the Because inculpatory evidence can be hid- number of successful defense challenges at den, obfuscated, or encrypted, law enforce- trial. ment regularly receives authorizations to seize large amounts of data. This leads to con- An additional complication in the applica- cerns of over-seizure, and complicates the def- tion of search and seizure principles to dig- inition of plain view once data is in the hands ital evidence relates to the problem of non- of law enforcement. Angeli et al. (2005) state responsive digital data. In Commentary on that the “seizure and search of electronic data the Ganias Case, Kerr (2015) discusses a way presents unique challenges and illustrates the to avoid the problem of over-seizure and the tension between the legitimate law enforce- disposition of non-responsive data. In the ment need to search for and seize evidence, case of paper records that have been seized, on the one hand, and the Fourth Amendment once the non-responsive records have been privacy interests of individuals and other en- filtered, they can easily be returned. This tities, on the other.” [23] is not the case with records that exist on digital media because “[w]e cannot cut off The literature presents several views on a piece of the physical hard drive. Even if the debate of how the concept of plain view we could, data is not stored contiguously on should apply to digital evidence. Some schol- the medium.” [21] It is simply not possible ars believe that plain view in the traditional to return non-responsive data in a computer sense should apply to computer searches. [24] search. This leads to the concern that law Mantei (2011) states that the “scope of plain enforcement will use initially non-responsive view seizure, like the search itself, is dictated data as grounds for future searches unrelated by the factual circumstances of an investiga- to the initial search warrant. Kerr’s solution tion.” He also advises that law enforcement is to forbid law enforcement from obtaining a should seek a second warrant when evidence second warrant based on non-responsive data is discovered that is not part of the original found in the first warrant. To use the non- warrant. Hood (2011) says that “the inad- responsive data, Kerr says, “The exclusion- vertent discovery requirement in the context ary rule would not apply if the government of plain view seizures of electronically stored searched the seized computer under a second evidence offers the most viable method for warrant when it could prove by a preponder- ensuring that government seizures of electron- ance that the evidence sought in the second ically stored evidence do not become general warrant would have been obtained elsewhere.” or exploratory and comply with the explicit [22] commands of the Fourth Amendment.” [25]

c 2020 JDFSL Page 5 JDFSL V14N4 Digital Evidence in Criminal Cases...

Another line of thought among scholars is cusses the issue of admissibility. To be con- that the forensic examination of computers sidered in court, evidence — physical or dig- should be excluded from the plain view doc- ital — must pass the test of admissibility, trine. Their reasoning is that some potential which includes consideration of whether the evidence on a computer may not be discover- evidence is relevant, reliable, and not un- able without the use of specialized tools, fairly prejudicial. Givens (2004) points to such as the contents of a computer’s mem- major differences between electronic and pa- ory, metadata, the internet cache, deleted per evidence that should be addressed when files, password protected files, file fragments, consid-ering admissibility, using email for his and files in unallocated space. This evidence examples. The first difference is obtainabil- will never be in plain view. For these rea- ity. Givens points out that “without email, sons, Daniel (2009) concludes that a “targeted many conversations simply would not exist.” forensic examination should be completely ex- [28] The second difference is one of availabil- cluded from the plain view doctrine as it is ity. Email often passes through and is stored an intrusive search and allows the examiner by third-party systems, such that “a simple to see everything on the computer, regardless search of the third party system could turn of its location or origin.” [26] up several ‘deleted’ or otherwise misplaced A third opinion, expressed by Weinstein files.” [29] Finally, there is a difference in and Drake (2014), is that the federal wire- the content of an email versus a paper docu- tap stat-utes could be applied to computer ment. Email contains information not found searches, thereby protecting the privacy of in pa-per documents, such as file header infor- individuals and the investigative needs of law mation, distribution lists, and receipts of ac- enforcement. Wiretap orders function much knowledgment. With this knowledge, Givens like search warrants, except they allow for the says, those offering email as evidence “should collection of information as it occurs in real at least be required to present witness testi- time (such as phone conversations). There mony to show the reliability of the computer are a series of procedures that the government system used to store or create the electronic must follow if wiretapping. These procedures data being offered.” [30] are designed to minimize privacy challenges, In Lorraine v. Markel American Insurance and require the government to minimize the Company, 241 F.R.D. 534 (D. Md. May 4, interception of non-criminal conversations, 2007), [31] Magistrate Judge Paul D. Grimm report information seized to the judge within (United States District Court for the District 14 days of authorization, and be subject to of Maryland) provided the field with guidance ongoing monitoring by the presiding judge. on the admissibility of electronic evidence. In Applying these wiretap protocols to computer the ensuing years, the case drew comments searches would be a “model for consistent and criticism from legal scholars. According procedures and judicial oversight.” [27] Em- to the court, when Electronically Stored In- ploying these protocols could even provide formation (ESI) is offered as evidence, the an incentive for law enforcement to conduct following evidentiary rules must be consid- searches more efficiently, knowing that the ered: relevancy, authenticity, hearsay, best protocols for reporting are in place. evidence, and probative value. [32] Levy-Sachs and Archambault (2008) stated 2.2 Admissibility that “[D]espite the fact that the Court pro- The second body of literature relevant to vides a general roadmap for admissibility of questions of digital evidence and courts dis- ESI, the Court does not indicate whether

Page 6 c 2020 JDFSL Digital Evidence in Criminal Cases... JDFSL V14N4

more stringent standards are necessary or de- Legal scholars have since weighed in on sirable.” [33] Frieden and Murray (2011) be- the Daubert Standard as it applies to digital lieve that the methods for authentication pro- evidence as well as the expert witnesses that scribed in Lorraine v. Markel are similar to testify on that evidence. Meyers and Rogers those of traditional evidence. They state that (2004) wrote of the need for standards and though “certain issues, such as authentication, certification in the field of computer forensics. may be more complicated in the context of One area of concern noted was the inability electronic evidence, traditional evidentiary to know the exact functionality of the tools principles can be consistently adapted to ad- used in computer forensics. Their observation dress questions regarding the admissibility of that the “majority of the tools and software electronic evidence.” [34] used in computer forensics is proprietary and In an article written for the American Bar copyrighted, thus negating the ability to ac- Association, Grimm, the presiding judge in cess the source code” [38] is still valid today. the Markel case, recognizes that some courts They also noted a lack of known error rates subject electronic evidence “..to far greater for these same tools. They conclude that, levels of scrutiny than applied to non-digital much like a certified professional accountant, evidence when deciding whether to admit it.” the field of computer forensics needs meth- [35] He provides advice for those who con- ods that “ensure that the practice is credible sider submitting digital evidence at trial: “If and reliable and that the individuals claiming you identify the digital evidence you want to to be professionals have met a certain cer- use prior to trial, learn as much as possible tification criterion.” [39] In their conclusion, about how it works (using the Internet can Meyers and Rogers warn that the “continued be an inexpensive and helpful way to do so), lack of a professional certification, investiga- carefully select which authentication method tive standards, and peer-reviewed method, you want to use, and (if it involves using may ultimately result in computer forensics an expert or subpoenaing records) make ar- being relegated to a “junk science,” as op- rangements sufficiently far in advance to be posed to a recognized scientific discipline.” prepared at trial, you will greatly enhance [40] your chances of success.” [36] Atkinson similarly argues for the need to 2.3 The Daubert Standard validate data. According to him, the means The Daubert Standard requires that the five to produce digital evidence are software pro- factors of testing, peer review, error rate, grams, for which formal proofs are virtually standards, and acceptability be applied to nonexistent. These programs are themselves scientific evidence. The Daubert Standard a sequence of binary digits and are subject was promulgated in the landmark Daubert v. to frequent changes in their code. This leads Merrell Dow Pharmaceuticals, 579 U.S. 92 to Atkinson to ask: “At what point should a (June 28, 1993), which establishes the afore- mess of ones and zeroes be trusted either as mentioned standard for admitting expert sci- evidence, or to provide it?” [41] To address entific testimony in federal court. This ruling these concerns, Atkinson contends that soft- was further expanded in Kumho Tire Co. v. ware engineers should promote transparency Carmichael, 119 U.S. 1167 (Mar. 23, 1999) in the “inner workings” of the tools that pro- [37], which established that the Daubert stan- duce digital evidence, providing more oppor- dard must be applied to expert testimony tunities for validation of tools, and provide from non-scientists. the tools more credibility in court.

c 2020 JDFSL Page 7 JDFSL V14N4 Digital Evidence in Criminal Cases...

Garfinkel (2010) also grappled with the their analysis included the unanimity of the lack of known error rates in the field of com- precedent ruling, the complexity of the mat- puter forensics, noting that the “research com- ter ruled upon, and the age of the precedent munity should work to develop digital foren- being overruled. Their results showed that sic techniques that produce reportable rates the circuit courts complied with the over- for error or certainty when they are run.” [42] ruling of older precedents more quickly than Garfinkel also notes the benefit to tool devel- more recent precedents. However, those same opers and those evaluating tools for use in circuit courts “were more reluctant to comply having a standardized set of digital corpora. with new criminal procedure precedents than This would enable developers to test their they were precedents in other areas.” [45] tools with larger data sets and allow others Kassow, et al. (2012) examined the to replicate their results more easily. responsiveness of state supreme courts to The Daubert Standard also applies to tes- precedents set by the U.S. Supreme Court. timony of expert witnesses, Garrie and Mor- Their methodology included scrutinizing the rissy (2014) suggest that a well-written com- treatment of those precedents in the state puter forensic report could circumvent the court’s opinions to test the value of precedent need for an expert’s testimony altogether. Ac- strength versus the influence of the ideologi- cording to the authors, the adequately writ- cal preferences of the state courts. [46] They ten report should sufficiently detail the meth- found that the “more the U.S. Supreme Court ods used, document the assumptions made reinforced its original precedent with subse- by the computer forensic examiner, the tools quent decisions indicating continued support used to complete the forensic exam, elim- for the precedent, the more likely state courts inate any superfluous information, and be were to provide a positive treatment of the objective in its tone. Finally, the findings in precedent.” [47] the report “should be qualified in regard to Re (2016) found that the lower courts may the capabilities of the [computer forensics] apply more narrow readings of the federal tool used in the exam, and the scope of the court’s precedent. He called this action “nar- investigation.” [43] rowing from below.” There are several reasons lower courts may narrow from below, includ- 2.4 Precedent ing “to update obsolete precedents, mitigate The American legal system relies heavily on the harmful consequences of the Court’s er- the doctrine of stare decisis, which means rors, and enhance the transparency of their to stand by things decided. In an exami- decision-making process.” [48] He cites the nation of Supreme Court cases from 1946 following legitimacy conditions that lower through 1995, Spriggs and Hansford (2001) courts consider when narrowing from above: found that “a precedent is more likely to be whether the precedent applies, whether it is overruled when it is ideologically incongruent correct, and whether it implicates other le- with the preferences of a subsequent Court.” gal principles. Re concludes that “narrowing [44] In other words, conservative precedents from below is usually legitimate when lower are more likely to be overruled by liberal courts adopt reasonable readings of higher courts. court precedent, even though those readings Benesh and Riddick (2002) examined prece- are not the most persuasive ones available.” dent and circuit characteristics to determine [49] whether a circuit court was likely to follow Alan Butler discusses how the precedent Supreme Court precedence. The factors in set in Riley v. California, (134 S. Ct. 2473.

Page 8 c 2020 JDFSL Digital Evidence in Criminal Cases... JDFSL V14N4

2014), may affect how lower courts rule on these precedents may have been set in a legal the issue of how long law enforcement may context that is no longer relevant. collect, search, and store digital data. Butler Although the literature on the prevalence begins by pointing out that Riley precedent and impact of digital evidence in courts is “supports the conclusion that the retention some-what limited, the bodies of literature of electronic data should be subject to differ- discussing Search and Seizure, Admissibility, ent Fourth Amendment rules than those used and Precedent does provide a context for the for handling physical evidence, [and that] Ri- research this paper undertakes. The existing ley would also support a narrower construc- literature forms the foundation on which the tion of the ‘plain view’ exception for digital research questions of this study were built — searches.” [50] He then demonstrates how the allowing the researcher to ask questions of Riley precedent may be interpreted by the the prevalence and impact of digital evidence lower courts. in courts. In United States v. Ganias, (F. App. 9706 2nd Cir. 2016), Butler finds that the Sec- 3. METHEDOLOGY ond Circuit’s ruling that “the government’s ‘seizure and retention’ of digital files beyond 3.1 Scope the scope of their 2003 warrant was unrea- The following analysis is based on a review sonable under the Fourth Amendment” [51] of relevant criminal cases in the U.S. Circuit was consistent with the privacy interests ex- Courts of Appeal from 2010 through 2015. pressed in Riley, and that other courts would The United States circuit courts of appeal likely follow precedent in this regard. were an ideal sample for this study for two In United States v. Miller (34 F. Supp. principal reasons. First, the 11 circuit courts 3d 695), Butler found that the Third Cir- of appeal and the associated 94 United States cuit rejected the defendant’s argument that a district courts cover the nation. There is at forensic search of his digital camera violated least one court in each state and the District his rights under the Fourth Amendment. In of Columbia. Second, the 11 courts of ap- this in-stance, the court took a narrower view peals and the 94 district courts adhere to the of Riley, saying that “the search of a digi- same rules of evidence – the Federal Rules tal camera is different than the search of a of Evidence. This is important when trying smartphone because cameras only ‘contain a to compare across or between the 11 circuit limited type of data, restricted to image and courts of appeal. video files that do not touch the breadth or analysis" from a warrantless search incident 3.2 Research Questions and to arrest.’ [52] Objectives Finally, Atkinson (2014) asserts that the advancement of technology occurs at a rate A retrospective study was used to answer the that leaves the legal system in a constant following research questions: state of trying to catch up. According to • What is the most common legal basis him, the courts depend on precedent “set in for appeals relating to the introduction wholly different contexts” that are “reliant or exclusion of digital evidence? on a digital forensics field still in its infancy.” [53] While it is essential to review examples • How often are cases involving an appeal of precedent set in previous cases, we should regarding digital evidence affirmed or also keep in mind that, as Atkinson argues, reversed for the defense?

c 2020 JDFSL Page 9 JDFSL V14N4 Digital Evidence in Criminal Cases...

• What were the most frequently occur- that the Other Issues category basis of ap- ring legal grounds for reversed judgments peals (i.e., Double Jeopardy, Prosecutorial for the defense when digital evidence is Misconduct, Sentencing, etc.) have little to involved? do with either the way the evidence was obtained, or how it was presented in court. For • What was the most frequently occurring these reasons, appeals that were based on legal ground for affirmed judgments for “other” issues were excluded from the results the defense when digital evidence is in- and analysis for this study. volved? 4. RESULTS AND • Are some of the challenges to computer forensics and digital evidence more DISCUSSION prevalent than others? If so, why? The search parameters mentioned above iden- • Based on the results of this study, are tified 145 appeals involving legal issues re- there trends or areas of the law as ap- lated to digital evidence heard by the Unit- plied to computer forensics and digital ed States Courts of Appeal for the period evidence that need further attention? 2010-2015. All of these appeals followed convictions 3.3 Data and Search Terms for federal criminal offenses (see table 6 in appendices for types of criminal offenses pros- Used ecuted). The types of technology where evi- Data for this project was drawn from cases dence was discovered included desktop com- that were affirmed or reversed by the United puters, laptops, GPS tracking units, mobile States Courts of Appeal for the period 2010- devices, and external storage devices. Of 2015. Cases were identified via LexisNexis, the 145 appeals included in this study, 138 using the following search terms: Computer, appeals (95.17 percent) were either affirmed Computer Forensics, Chat Log, Electronic or reversed for the government. Seven ap- Evidence, Cell Phone, Sexting, iPhone, Child peals (4.83 percent) were either affirmed or Pornography, Digital Evidence, Computer re-versed for the defense. [55] Investigation, GPS, and Encryption. Data In a 2010 article in Judge’s Journal, Clancy was compiled in a Microsoft Access database points out that nearly “70 percent of all and analyzed using Microsoft Excel. [54] re-ported appellate decisions involving the search or seizure of digital evidence are con- 3.4 Cases Excluded cerned with the recovery of child pornogra- While searching for cases, three categories phy.” [56] In line with this finding, 89 percent of appeals became apparent: Search and of appellate decisions in this study were re- Seizure, Evidence Presented at Trial, and lated to the search and seizure of digital evi- Other Issues. The digital forensic process dence related to the recovery of child pornog- has three major components: Seizure, Acqui- raphy. sition and Analysis, and Reporting. From Sufficiency of Evidence was the most fre- Figure 1, we can see that the three compo- quently occurring legal issue encountered as nents of the digital forensic process line up a basis for appeal at 31.03 percent, followed quite well with the first two categories for by Probable Cause at 27.59 percent; Defec- bases of appeal: Search and Seizure and Evi- tive Warrants at 12.24 percent; and Defective dence Presented at Trial. It is also apparent Warrants at 12.41 percent. Other legal issues

Page 10 c 2020 JDFSL Digital Evidence in Criminal Cases... JDFSL V14N4

Figure 1. Digital Forensic Process Compared to Bases for Appeal

less frequently encountered included Scope 4.1.1 Search and Seizure of the Warrant, Probative Value, Expecta- tion of Privacy, Scientific Merit, Exclusionary Probable Cause Digital evidence pro- Rule, Relevancy, Authenticity, and Hearsay. duced at trial must have been obtained with A complete list of legal issues can be found a valid search warrant based on probable in Table 2 of Appendix II. cause to search for evidence of a crime or criminal activity. The Fourth Amendment limits the ability of law enforcement agents to 4.1 Legal Issues search for evidence. If probable cause cannot be demonstrated, then evidence will likely The United States District Court Systems ad- be suppressed under the Exclusionary Rule. heres to the Federal Rules of Evidence (FRE), This legal principle was first established by first adopted in 1975. [57] The rules regard- the United States Supreme Court in 1914 [58] ing the introduction of digital evidence are when the court held that “evidence obtained similar to that of any other evidence pro- by unconstitutional means cannot be used duced at trial. The legal issues encountered against a defendant.” [59] Although val-id within the 145 cases in this study were cate- warrants have always been generally required gorized as Search and Seizure, and Evidence by the courts, there are exceptions that allow Presented at Trial. Pertinent FRE Rules or law enforcement to engage in warrant-less precedent rulings, along with exemplar cases, searches. The exceptions include: Detention are provided in the following sections that Short of Arrest: Stop-and-Frisk [60]; Search detail the legal issue argued on appeal, the Incident to Arrest [61]; Vehicular Searches reasoning of the court, and the outcome of [62]; Vessel Searches; Consent Searches; Bor- the appeal. der Searches; “Open Fields” [63]; Plain View

c 2020 JDFSL Page 11 JDFSL V14N4 Digital Evidence in Criminal Cases...

[64]; Public Schools [65]; Prisons and Regu- Hamp-ton appealed his conviction on charges lation of Probation [66]; and Drug Testing. of receipt of child pornography in violation of [67] 18 U.S.C.S. § 2252(a)(2), and possession of In United States v. Schesso, 730 F.3d 1040 child pornography in violation of 18 U.S.C.S. (9th Cir. Wash. 2013), the district court § 2252(a)(4)(B). In his appeal, Hampton ar- for the Western District of Washington ap- gued that the affidavit used to obtain to pealed a district court ruling on the suppres- search his residence was “stale because the sion of evidence gained from a search of the warrant was executed more than ten months defend-ant’s home. In ruling to suppress the after German law enforcement officers ob- evidence, the district court held that “the served child pornography shared through his affidavit failed to connect generalized state- IP address.” [73] ments about child pornography collectors to The panel for the Sixth Circuit found that Schesso, thus rendering the warrant facially given “the nature of child pornography and deficient and the good faith exception inap- our prior decisions upholding search warrants plicable.” [68] despite similar delays, the ten-month delay The Ninth Circuit Court of Appeals re- in obtaining a search warrant for Hampton’s versed this decision determining that “be- residence did not cause the information to cause there was a fair probability that ev- be-come stale by the time that [United States idence of child pornography would be found Department of Immigration and Customs En- on the defend-ant’s computer system, the un- forcement (ICE) Special Agent] Oberholtzer derlying facts supported a finding of probable requested the search warrant.” [74] Hamp- cause; that the warrant was not overbroad ton’s convictions and sentence were affirmed. and did not raise the risks inherent in over- seizing that this court considered in United Warrantless Seizure The Supreme Court States v. Comprehensive Drug Testing, Inc., has consistently held that warrantless seizures 621 F.3d 1162 (9th Cir. 2010).” [69] are per se unreasonable, with only a few specifically established and well-delineated Defective Warrant Defective Warrant exceptions. [75] One of those exceptions is appeals tend to center on the notion of the exigent circumstances, which require two con- staleness of the warrant. In general, “stale ditions: “an objectively reasonable basis for information cannot be used in a probable concluding that the loss or destruction of ev- cause determination.” [70] Yet, whether infor- idence is imminent; and that governmental mation in a warrant is stale is dependent in interest being served by the intrusion has part by the inherent nature of the crime. For been weighed against the individual interest example, child pornography “is not a fleeting that would be protected if a warrant were crime" and "is generally carried out in the required.” [76] secrecy of the home and over a long period.” In United States v. Bradley, 488 F. App. [71] The staleness of a warrant is difficult 99 (6th Cir. July 12, 2012), Eric J. Bradley to prove with regard to child pornography was convicted and sentenced for receiving vi- because the pornography is stored on comput- sual depictions of minors engaged in sexually ers, may readily be duplicated, retained indef- explicit conduct, in violation of 18 U.S.C.S. § initely, and may well be recovered by forensic 2252(a)(2). In his appeal, Bradley contended software long after it has been deleted. [72] “that [Fayette County, Kentucky Investigator] In United States v. Hampton, 504 F. App. Bell had seized his computer without obtain- 402 (6th Cir. Nov. 5, 2012), Jack Eugene ing a search warrant and without Bradley’s

Page 12 c 2020 JDFSL Digital Evidence in Criminal Cases... JDFSL V14N4

consent and that no exception to the warrant authorized the seizure of his computers, cam- requirement applied.” [77] era, and other electronic media, it did not In considering whether the destruction of authorize a search of the black computer’s evidence was imminent in Bradley’s case, the hard drive, and the police therefore unlaw- panel from the Sixth Circuit stated that “it is fully exceeded the scope of the warrant when objectively reasonable to seize a container an they searched the contents of the computer officer has probable cause to believe contains with-out obtaining a second warrant.” [82] In evidence of a crime, rather than leave it un- rendering their decision in this appeal, the guarded in the hands of a suspect who knows panel of judges from the Sixth Circuit noted that it will be searched.” [78] The panel also that although the search warrant used to ex- considered the balance of interests at stake, ecute the search of Evers’ home was not a stating that “the government’s interest in de- model of precision, “it cross-referenced [the terring the production and dissemination of investigating officer’s] affidavit, which in turn child pornography is significant.” [79] In rul- recited the underlying factual circumstances ing that exigent circumstances existed and of the alleged sexual crimes, identified the that the execution of the warrantless seizure victim, gave the address of Evers’ residence, was reasonable, the panel affirmed Bradley’s and listed a "Digital Camera, Photo’s [sic], conviction and sentence. Personal Computer and accessories" — items linked by [the victim] to the offenses — as ob- Scope of Warrant Under the Fourth jects subject to seizure.” [83] In this instance, Amendment, search war-rants are required the court affirmed both the conviction and to describe with particularity to prevent the sentence for Evers. seizure of one thing under a warrant describ- ing another, hence providing the scope of the Expectation of Privacy The expectation warrant. Appeals based on the scope of the of privacy is derived from Katz v. United warrant incorporate two is-sues with regard States, 389 S. Ct. 347 (Dec. 18, 1967). This to particularity: whether the warrant sup- Supreme Court ruling deter-mined that in- plies adequate information to guide officers trusion with technology could be classified in selecting what items to seize, and whether as a search, and as such could also result the category of items specified in the warrant in an unreasonable search and seizure if the is too broad because it includes articles that defendant exhibited an actual (subjective) should not be seized. [80] The requirement expectation of privacy and, second, that the for particularity ensures that searches “will expectation be one that society is prepared not take the character of the wide-ranging to recognize as "reasonable." [84] exploratory searches the Framers intended to In United States v. Wheelock, 772 F.3d prohibit.” [81] 825 (8th Cir. Nov. 20, 2014), Guy Edward In United States v. Evers, 669 F.3d 645 Whee-lock appealed his conviction and sen- (6th Cir. Feb. 10, 2012), Ovell Evers, Sr. tence for receiving child pornography in vio- challenged his conviction and sentence for lation of 18 U.S.C.S. § 2252(a). In this case, production of child pornography, in violation Wheelock was arrested after law enforcement of 18 U.S.C.S. § 2251(a); possession of child used in-formation gleaned from an adminis- pornography, in violation of 18 U.S.C.S. § trative subpoena to match the defendant to a 2252(a)(4)(B); and a forfeiture count under computer that downloaded child pornography 18 U.S.C.S. § 2253. In his appeal, Evers us-ing peer-to-peer software. In his appeal, contended that “although the search warrant Wheelock contended that an administrative

c 2020 JDFSL Page 13 JDFSL V14N4 Digital Evidence in Criminal Cases...

subpoena “violated his Fourth Amendment the District of Arizona under 18 U.S.C.S. § privacy interest in the subscriber information 2252 of attempted transportation and ship- obtained from Comcast.” [85] [86] ping of child pornography, possession of child In deciding his appeal, the panel from the pornography in violation of 18 U.S.C.S. § Eighth Circuit determined that the investigat- 2252(a)(4)(B).” [90] ing officer requested retrievable information In his appeal, Flyer argued that “there was from Comcast, and demonstrated that “that insufficient evidence to establish that he ex- the requested records [were] relevant to an ercised dominion and control over the images ongoing, legitimate law enforcement investi- recovered from the unallocated space on the gation of Distribution of Child Pornography.” hard drive. Alternatively, he argues that even [87] Recognizing that this was all that the cur- if he could be said to have "possessed" the rent statute required, the court concluded by images before their deletion, no evidence in- saying that “federal courts in a federal prose- dicated that the possession occurred during cution do not suppress evidence that is seized the time period charged in the indictment.” by state officers in violation of state law, so [91] long as the search complied with the Fourth During its review, the panel from the Ninth Amendment.” [88] Based on their decision, Circuit Court of Appeals noted that the gov- the court affirmed Wheelock’s conviction and ernment conceded that no evidence was pre- sentence. sented that Flyer knew of the presence of the contraband images in the unallocated space 4.1.2 Evidence Presented at Trial on his computer. They also conceded that Sufficiency of Evidence In United States Flyer did not have the forensic software nec- v. Dixon, 589 F. App. 427 (11th Cir. Oct. 23, essary to view the files in unallocated space. 2014), Travis “Rocky” Dixon was convicted of Further, there was no evidence that Flyer ever receiving child pornography and possession manipulated the images, and Flyer never ad- of child pornography, both in violation of mitted to viewing the charged images. The 18 U.S.C.S. § 2252(a) (4) (B). Following his government countered that evidence demon- conviction, Dixon contended that the govern- strating that the charged files were at some ment produced insufficient evidence to prove point deleted were sufficient to establish pos- beyond a reasonable doubt that he was guilty session. The panel from the Ninth Circuit of downloading the child pornography found disagreed. on a computer in his bedroom. In their opinion, the panel noted that In reviewing his appeal, the panel for the “deletion of an image alone does not sup- Eleventh Circuit found that “Dixon’s admis- port a conviction for knowing possession of sion that he searched for and downloaded child pornography on or about a certain date child pornography together with the corrobo- within the meaning of 18 U.S.C.S. § 2252A. rating evidence of downloaded child pornog- No evidence indicated that on or about April raphy found on his computer constituted suf- 13, 2004, Flyer could recover or view any of ficient evidence for a rational jury to conclude the charged images in unallocated space or that Dixon knowingly received and possessed that he even knew of their presence there.” child pornography.” [89] Dixon’s conviction [92] Consequently, Flyer’s conviction for pos- and sentence, in this case, were affirmed. In session of child pornography was reversed. United States v. Flyer, 633 F.3d 911 (9th The convictions for attempted shipping of Cir. Feb. 8, 2011), Andrew Flyer appealed child pornography and possession of child his conviction “in the U.S. District Court for pornography on CDs were affirmed.

Page 14 c 2020 JDFSL Digital Evidence in Criminal Cases... JDFSL V14N4

Relevancy Digital evidence must be rele- was probative as to whether each of four per- vant. According to FRE Rule 401, Test for sons who generally had access to a desktop Relevant Evidence, the evidence is relevant if computer was absent from the computer’s “it has any tendency to make a fact more or location while child pornography was down- less probable than it would be without the loaded onto that computer.” [95] According evidence; and the fact is of consequence in to the court, the evidence also showed “that determining the action.” [93] However, rele- Reynolds’s absence from the residence could vant evidence may be excluded under Rule not be demonstrated, permitting an infer- 403, Excluding Relevant Evidence for Prej- ence that Reynolds was the only one out of udice, Confusion, Waste of Time or Other four house-hold members who was at the resi- Reasons, if “its probative value is substan- dence during the time child pornography was tially outweighed by a danger of one or more down-loaded onto a desktop computer in that of the following: unfair prejudice, confusing residence.” [96] His conviction and sentence the issues, misleading the jury, undue delay, were thusly affirmed by the panel from the wasting time, or needlessly presenting cumu- Sixth Circuit. lative evidence.” [94] In United States v. Reynolds, 626 F. App. Probative Value In United States v. Bal- 610 (6th Cir, 2015), Donald Reynolds ap- lard, 448 F. App. 987 (11th Cir. Dec. 15, pealed his conviction and sentencing for re- 2011), Kenneth Allen Ballard appealed his ceipt and distribution of child pornography conviction for distribution and receipt of child in violation of 18 U.S.C.S. § 2252A(a)(2); and pornography in violation of 18 U.S.C.S. § one count of possession of child pornography, 2252A(a)(2). Ballard argued that the district in violation of 18 U.S.C.S. § 2252A(a)(5)(B). court for the Middle District of Alabama had Reynolds argued that expert witness testi- abused its discretion “by allowing into evi- mony based on historical cell-site data lacked dence every image and a portion of the videos relevancy and that the district court erred in of child pornography that were charged in admitting this evidence. the indictment, despite Ballard’s stipulation During a search of his residence on April that the 15 pictures and three videos were 7, 2011, agents from the Federal Bureau of child pornography.” [97] Ballard contended Investigation (FBI) discovered over 8,000 im- that the images unfairly prejudiced the jury ages of child pornography on a laptop owned and that the impact of the images off-set by Reynolds. Reynolds disputed that he had its probative value and should have been ex- downloaded the images, stating that as many cluded under Rule 403, Excluding Relevant as three other persons living in the house Evidence. had access to his laptop, including his two In considering Ballard’s appeal, the court adult children. The FBI introduced histori- noted that FRE Rule 403 is an "extraordinary cal cell-site tracking analysis at trial to assist remedy which the district court should invoke in their determination of who was not at sparingly and that the balance should be home during the relevant download periods struck in favor of admissibility.” [98] In its in their investigation. This information also decision affirming the District Court’s ruling, did not show that Reynolds was absent from the panel from the Seventh Circuit found the home during the same relevant download that the “relevant evidence of the images and periods. videos was not extrinsic to the crime, but was The court determined that the historical part of the actual pornography possessed.” cell phone records were relevant because “it [99]

c 2020 JDFSL Page 15 JDFSL V14N4 Digital Evidence in Criminal Cases...

Authenticity Digital evidence must be au- 235 F.3d 1318, 1322 (11th Cir. 2000), the thentic. FRE Rule 901, Authenticating or court stated that a “district court has the dis- Identifying Evidence states that to "satisfy cretion to determine authenticity, and that the requirement of authenticating or iden- determination should not be disturbed on ap- tifying an item of evidence, the proponent peal absent a showing that there is no com- must produce evidence sufficient to support petent evidence in the record to support it.” a finding that the item is what the proponent In United States v. Lanzon, 639 F.3d 1293 claims it is." [100] (11th Cir. May 4, 2011), the court stated that To demonstrate the authenticity of digi- "evidence may be authenticated through the tal data being presented as evidence, such testimony of a witness with knowledge." [106] as a hard drive from a computer or mobile Potential evidence is also subject to the device, the court must be shown that it “was FRE Rules 1002 and 1003 for Best Evi- acquired from a specific computer and/or lo- dence. Rule 1002, Requirement of the Origi- cation, that a complete and accurate copy of nal, states that “[a]n original writing, record- digital evidence was acquired, and that it has ing, or photograph is required in order to remained unchanged since it was collected.” prove its content unless these rules or a fed- [101] In practice, this process is called mak- eral statute provides otherwise.” [107] ing a forensic image or mirror image, and With regard to digital evidence, this is best is well-understood by the courts. “Making understood in terms of the digital image of a mirror image of the hard drive is central the original evidence that is made for anal- to the examination process and is a routine, ysis purposes. The original is not available, technical step taken by well-trained. . . agents. be-cause using it might destroy or alter the It is done to maintain the integrity and secu- original evidence. Rule 1003, Admissibility rity of the original evidence. A mirror image of Duplicates, allows this type of evidence is an exact duplicate of the entire hard drive to be admissible. The rule states that “a and includes all the scattered clusters of the duplicate is admissible to the same extent active and deleted files and slack and free as the original unless a genuine question is space. Having such a mirror image of the raised about the original’s authenticity or the hard drive also allows the examiner to recon- circumstances make it unfair to admit the struct the steps of the examination at a later duplicate.” [108] time.” [102] In United States v. Lebowitz, 676 F.3d A hash value is used to authenticate an 1000 (11th Cir. Apr. 5, 2012), Adam individual file within the mirror image of a Lebowitz appealed his convictions for pro- hard drive, or the forensic image file itself. ducing child pornography in violation of 18 [103] A hash value is a “unique numerical U.S.C.S. § 2251(a), and of attempting to en- identifier that can be assigned to a file, a tice a child to engage in unlawful sexual ac- group of files, or a portion of a file, based on tivity in violation of 18 U.S.C.S. § 2422(b). a standard mathematical algorithm applied At trial, the United States District Court for to the characteristics of the data set . . . the Northern District of Georgia admitted ‘Hashing’ is used to guarantee the authentic- into evidence printed transcripts of chat mes- ity of an original data set and can be used as sages between Lebowitz and a minor whom a digital equivalent of the Bates stamp used he was attempting to engage in illegal sex- in paper document production.” [104] ual activity. In his appeal, Lebowitz argued Case law has further clarified the issue of that “admission of the printouts violated the authenticity. In United States v. Siddiqui, authentication requirement in Federal Rule

Page 16 c 2020 JDFSL Digital Evidence in Criminal Cases... JDFSL V14N4 of Evidence 901.” [109] The minor who pro- defend-ant claimed that he was still on the duced the printout of the chat sessions in Mexican side of the border prior to his arrest, question testified at trial that these printouts awaiting instructions from a smuggler. accurately represent-ed the conversations he The federal agents that arrested Lizarraga- had with Lebowitz, though he could not re- Tirado testified to their familiarity with the call when he had produced the printouts. border area where they made the arrest and In forming its opinion, in this case, the were sure that they arrested him north of the panel relied on previous decisions made by border. The agents recorded the GPS coordi- the Eleventh Circuit in finding that “appellate nates of the arrest on a hand-held device. A courts reviewing a cold record give particular Google Earth satellite image with the GPS co- deference to credibility determinations of a ordinates marked was introduced as evidence fact-finder who had the opportunity to see at trial. By default, Google Earth marks cer- live testimony.” [110] In so doing, the panel tain areas on an image, such as nearby towns, determined that the district court did not err and bodies of water. The program also of- in admitting the chat session printouts into fers users two ways to add markers of their evidence. The conviction and sentence for own to the maps it produces. First, a user Lebowitz were therefore affirmed. can manually add a tack, or digital marker, to a map, which the user can label. Users Hearsay Under FRE Rule 801, hearsay is can also type GPS coordinates into Google an out-of-court statement introduced for the Earth, which then automatically creates a truth of the matter asserted; it applies if the tack at the proper place on the map. Sig- proponent plans to use the record’s contents nificantly, the map introduced as evidence as substantive evidence. [111] Hearsay gener- had the second type of markers produced by ally may not be admitted as evidence. With Google Earth. regard to digital evidence, the rules regard- In considering whether the Google Earth ing Hearsay apply in two ways: email, text image was hearsay, the panel “held that a messages, and computer-generated reports photograph isn’t hearsay because it makes are considered written statements, while dig- no assertion. Rather, a photograph merely ital video or audio recordings are considered depicts a scene as it existed at a particu- spoken statements. Regardless, there are lar time.” [112] They determined that the specific documents (in written or electronic Google Earth program had accurately placed form) that are considered factual, including the tack. In their deliberations, the panel pro- computer-generated reports, business records, duced an ex-act replica of the map introduced family records, and public records. at trial, with the GPS coordinates marked In United States v. Lizarraga-Tirado, 789 exactly as they were in evidence. Further, F.3d 1107 (9th Cir. June 18, 2015), the ques- the user of the program has no role in deter- tion before the Ninth Circuit was whether mining where the marker will be placed on a Google Earth satellite image and a digital the map because the Google Earth program tack labeled with GPS coordinates should be does that work. considered hearsay. The panel stated that “[b]ecause the pro- On January 17, 2003, while near the Mex- gram makes the relevant assertion — that ican border, Paciano Lizarraga-Tirado was the tack is accurately placed at the labeled arrest-ed as a previously removed alien and GPS coordinates — there is no statement charged with illegal re-entry into the United as defined by the hearsay rule. In reaching States under 8 U.S.C.S. § 1326. At trial, the that conclusion, we join other Circuits that

c 2020 JDFSL Page 17 JDFSL V14N4 Digital Evidence in Criminal Cases...

have held that ma-chine statements are not In examining the pertinent facts, the U.S. hearsay.” The defendant’s conviction was sub- Court of Appeals for the Fourth Circuit found sequently affirmed. that agent Gilmer was part of a lengthy voir dire that established her “education, training, experience, and knowledge of the forensic Scientific Merit Since digital evidence tools and procedures she utilized, as well produced by computer forensics is consid- as detailed explanations of her use of the ered scientific, it must also meet the Daubert forensic software in this particular case.” [117] Standard. The standard stems from Daubert During this proceeding, Agent Gilmer also v. Merrell Dow Pharmaceuticals Inc., 509 explained that the tools used to examine the U.S. 579, 595 (1993), and has five factors defendant’s laptop were accepted as a reliable for judges to determine whether scientific ev- practice by the Maryland State Police. idence is admissible in court: testing, peer In denying Stanley’s appeal, the court review, error rate, standards, and acceptance. found that the record strongly supported the The Daubert Standard is also applied to ex- determination by the district court of Agent pert witnesses in federal criminal trials. Un- Gil-more’s competence as an expert and the der FRE Rule 702, Opinions and Expert Tes- reliability of her findings. timony, the court must determine (a) the ex-pert’s scientific, technical, or other spe- 4.2 Revisiting the Research cialized knowledge will help the trier of fact Questions to understand the evidence or to determine a fact in issue; (b) the testimony is based on • What was the most common legal basis sufficient facts or data; (c) the testimony is for appeals of computer forensics evi- the product of reliable principles and meth- dence? For Search and Seizure related ods; and (d) the expert has reliably applied appeals, Probable Cause was the most the principles and methods to the facts of common basis of an appeal. For Evi- the case.” [115] dence Presented at Trial, the most frequently occurring basis of the appeal was In United States v. Stanley, 533 F. App. Sufficiency of Evidence. 325 (4th Cir. July 19, 2013), Paul Stanley appealed his conviction for receipt, transporta- • How often were cases involving an appeal tion, and possession of child pornography regarding computer forensics affirmed or in violation of 18 U.S.C.S. § 2252A(a)(1), reversed for the defense? Of the cases 18 U.S.C.S. § 2252A(2), and 18 U.S.C.S. included in this study, twelve appeals § 2252A(a)(5)(B), arguing that the district (8.16 percent) were affirmed or reversed court erred in admitting expert testimony for the defense. from an agent who conducted the forensic • What were the most frequently occur- examination of Stanley’s laptop computer. ring legal grounds for reversed judgments Stanley argued specifically that Agent Crys- for the defense? Out of the 10 reversals tal Gilmer of the Maryland State Police “pos- for the defense, five were based on Suffi- sessed in-sufficient specialized knowledge or ciency of Evidence. skill in the software programs used to extract data from Stanley’s computer, and failed to • What was the most frequently occur-ring offer testimony regarding the reliability of legal ground for affirmed judgments for the forensic tools used in the examination.” the defense? There were two instances of [116] affirmed judgments for the defense: one

Page 18 c 2020 JDFSL Digital Evidence in Criminal Cases... JDFSL V14N4

based on a defective warrant and the formation in the cloud, or the Internet of other based on the scope of the warrant. Things. Future research should consider how these • Are some challenges to digital evidence newer technologies have affected the legal more prevalent than others? If so, why? landscape. For example, future research The majority of challenges seen in this should investigate the impact of Carpenter study were based on Search and Seizure v. United States, 138 S. Ct. 2206 (2018) on issues, rather than the science of com- appeals related to probable cause, or the ex- puter forensics. The “why” part of the pectation of privacy. Researchers may want question is more difficult to discern. This to consider civil matters before the court with study only examined appeals from crim- regard to digital evidence. inal cases heard by the U.S. Courts of Additionally, the methodology for the cur- Appeal. Future re-search may involve rent study included analyzing cases from an in-depth look at cases at the federal Lexus Nexus. As such, the potential bias district court level to examine this issue. of the jurists was outside the scope of the current study. Future researchers may also • Based on the results of this study, are want to consider any potential bias in the there trends or areas of the law as ap- decision making process used by jurists in plied to computer forensics that needs rendering their opinions. further attention? One area of concern is particularity in regard to the scope of search war-rants. Particularity gov- 6. CONCLUSIONS erns how far the government can search based on a particular factual predicate. Of the 145 cases included in this study, only Several important cases with regard to 22 appeals were based on the science of com- particularity have been decided by the puter forensics, including probative value, au- courts recently (Riley v. California, 134 thenticity, hearsay, relevancy, and scientific S. Ct. 2473 (2014), and United States merit. In each of those cases, previous rulings v. Ganias, 725 F.3d 125 (2d Cir. 2014). were affirmed. This raises several questions This issue will continue to be central to contemplate: to appeals based on Search and Seizure Overall, digital evidence does not seem in general, and those involving digital to play a large role in federal criminal ap- evidence specifically. peals filed within the U.S. Courts of Appeals. While the search terms used in this study may have missed some of the cases that would oth- 5. LIMITATIONS erwise have been included, the fact that only The overall goal for the current study was to 147 of the 45,030 federal, criminal cases af- examine the legal basis for appeals related firmed or reversed for the years 2010 through to digital evidence and the subsequent U.S. 2015 raises questions. Circuit Courts of Appeal rulings on such appeals. This study surveyed appeals from fed- • Does digital evidence tend to support eral criminal cases heard before the United previously supported facts of a particu- States Courts of Appeal from 2010 to 2015. lar case (i.e., corroborative), or is it so Subsequently, new technologies have become strong as to overbear any evidence to part of the fabric of life, such as storing in- the contrary (i.e., conclusive)?

c 2020 JDFSL Page 19 JDFSL V14N4 Digital Evidence in Criminal Cases...

• What is the frequency with which dig- 5. Matt McCusker, "The Real Danger from ital evidence is being admitted in the Casey Anthony’s Trial: Scary Scientific U.S. District Courts? Precedents," Deliberations (blog), entry posted July 4, 2011, accessed November • What are the legal bases for those in- 19, 2015, http://jurylaw.typepad. stances where computer forensics is sup- com/deliberations/2011/07/index. pressed as evidence? html. • Is computer forensics underutilized as 6. Casey Anthony was living at the home evidence? of her parents at the time the murder To answer these questions, it will be neces- was alleged to have occurred. sary to more closely examine the trial pro- 7. Craig Wilson, "Digital Evidence Dis- ceedings at the U.S. District Court level. crepancies – Casey Anthony Trial," Digital Detective, last modified July 11, 2011, accessed November 7. NOTES 19, 2015, http://www.digital- detective.net/digital-evidence- 1. William J. Sabol, "Social Science discrepancies-casey-anthony- Research on Forensic Science: Dear trial/. Colleague Letter from William Sabol, Fiscal Year 2015," Funding and Awards, 8. Electronic storage devices include, but last modified December 5, 2014, not limited to computers, mobile devices, accessed November 13, 2015, http: and wearable technology //nij.gov/funding/pages/fy15- dear-colleague-forensics.aspx. 9. Simson L. Garfinkel, "Digital Foren- sics," American Scientist 101, no. 2. Among others, the following organiza- 5 (September/October 2013), http: tions have published “best practices” for //www.americanscientist.org/ computer forensics: National Institute of issues/pub/digital-forensics. Standards and Technology (NIST), Fed- eral Bureau of Investigation (FBI), and 10. Ibid the National Institute of Justice (NIJ). 11. Orin S. Kerr, "Search Warrants in an 3. The State of Georgia v. Justin Ross Har- Era of Dig-ital Evidence," Mississippi ris, Indictment #143124, (Cobb Judicial Law Journal 75, no. 85 (February 11, District, Georgia Oct. 20, 2014). 2005)

4. Zachary G. Newman and Anthony 12. Paige Bartholomew, "Seize First, Search Ellis, "The Reliability, Admissibility, Later: The Hunt for Digital Evidence," and Power of Electronic Evidence," Touro Law Re-view 30, no. 4 (2014) American Bar Association - Section of 13. Thomas K. Clancy, "The Fourth Amend- Litigation, last modiﬁed January 25, ment Aspects of Computer Searches and 2011, https://apps.americanbar. Seizures: A Perspective and a Primer," org/litigation/committees/ Mississippi Law Journal 75 (2005). trialevidence/articles/012511- electronic-evidence.html. 14. 134 S. Ct. 2473 (2014)

Page 20 c 2020 JDFSL Digital Evidence in Criminal Cases... JDFSL V14N4

Figure 2. APPEALS INCLUDED IN THIS STUDY

15. Harvard Law Review, "Riley v. Califor- lished in Riley applies to a search of the nia," Harvard Law Review, last modi- contents of a cell phone once the cell ﬁed November 10, 2014, accessed April 7, phone is properly obtained (through an 2017, http://harvardlawreview.org/ original warrant, search incident to ar- 2014/11/riley-v-california/. rest, etc.).

16. It is important to note that in Riley, the 17. Adam M. Gershowitz, "The Post-Riley cell phone was obtained as a result of Search Warrant: Search Protocols and a search incident to arrest rather than Particularity in Cell Phone Searches," through a search authorized by a war- Vanderbilt Law Review 69, no. 3 (April rant. The warrant requirement estab- 2016): 586.

c 2020 JDFSL Page 21 JDFSL V14N4 Digital Evidence in Criminal Cases...

Figure 3. APPEALS INCLUDED IN THIS STUDY

18. Ibid lected the evidence (i.e., they reasonably thought their actions were lawful).

19. The good faith exception allows the in- 20. Andrew D. Huynh, "What Comes after troduction of evidence that otherwise ’Get a Warrant’: Balancing Particularity would have been excluded for violation and Practicality in Mobile Device Search of privacy rights if law enforcement were Warrants Post-Riley," Cornell Law Re- acting in good faith when they col- view 101, no. 1 (2015): 218.

Page 22 c 2020 JDFSL Digital Evidence in Criminal Cases... JDFSL V14N4

Figure 4. APPEALS INCLUDED IN THIS STUDY

21. Orin S. Kerr, "Commentary on the Ga- 24. The plain view doctrine allows a law en- nias Case," The Washington Post (Wash- forcement oﬃcer to seize evidence of a ington, DC/USA), June 24, 2014. crime, with-out obtaining a search warrant, when that evidence is in plain sight. 22. Ibid 25. Hood, Nicholas. "No Requirement Left 23. Angeli, David H., Christina Schuck, Behind: The Inadvertent Discovery Re- and Avalyn Taylor. "Article: The quirement—Protecting Citizens One File Plain View Doctrine and Computer at a Time." Valparaiso University Law Searches: Balancing Law Enforcement’s Review 45, no. 4 (Summer 2011): 1529- Investigatory Needs with Privacy Rights 87. in the Digital Age." The Champion, Au-gust 2010, 18-24. Accessed April 26. Larry E. Daniel, "Plain View Doc- 4, 2017. https://advance.lexis. trine in Digital Evidence Cases—a com/api/permalink/810a0c0a-462b- Common Sense Approach," Foren- 4302-9f92-4db3c87e81e4/?context= sic Magazine, October 23, 2009, 1000516. http://www.forensicmag.com/

c 2020 JDFSL Page 23 JDFSL V14N4 Digital Evidence in Criminal Cases...

Figure 5. SUMMARY TABLES: Summary of Results, By Circuit

Figure 6. Summary Results by Legal Issue

article/2009/10/plain-view- ity: A New Approach to Search War- doctrine-digital-evidence- rants for Digital Evidence," Electronic cases\%E2\%80\%94-common-sense- Commerce & Law Report 19 (May 7, approach 2014)

27. Jason Weinstein and William Drake, 28. J. Shane Givens, "The Admissibility of "Public Safety, Privacy, and Particular- Electronic Evidence at Trial: Courtroom

Page 24 c 2020 JDFSL Digital Evidence in Criminal Cases... JDFSL V14N4

Figure 7. Summary of Decisions Reversed for the Defense

Figure 8. Summary of Decisions Aﬃrmed for the Defense

Figure 10. Summary of Technologies

31. Lorraine v. Markel American Insurance Company, 241 F.R.D. 534 (D. Md. May Figure 9. Summary of federal oﬀenses 4, 2007). 32. Ibid, 542. Admissibility Standards," Cumberland 33. Rebecca Levy - Sachs and Taylor Ar- Law Review 34 (2003). chambault, "Hurdling toward the Fu- ture: Navigating Electronically Stored 29. Ibid. Information through the Federal Rules of Evidence: Lorraine V. Markel 30. Ibid. America Insurance Co.," 2008 FDCC

c 2020 JDFSL Page 25 JDFSL V14N4 Digital Evidence in Criminal Cases...

Winter Meeting; Technology and E- and Quality," Northwestern Journal of Commerce/Intellectual Property Sec- Technology and Intellectual Property 12, tion, February 29, 2008, accessed April no. 2 (April 2014): 127. 4, 2017, http://www.thefederation. org/documents/10.LevySachs.pdf. 44. James F. Spriggs and Thomas G. Hans- ford, "Explaining the Overruling of U.S. 34. Jonathan D. Frieden and Leigh M. Mur- Supreme Court Precedent," Journal of ray, "The Admissibility of Electronic Ev- Politics 63, no. 4 (November 2001): idence under the Federal Rules of Evi- 1107. dence," Richmond Journal of Law and Technology XVII, no. 2 (2011) 45. Sara C. Benesh and Malia Reddick, "Overruled: An Event History Analysis 35. Paul D. Grimm, "Authenticating Digital of Lower Court Re-action to Supreme Evidence," GP Solo 31, no. 5 (Septem- Court Alteration of Precedent," Journal ber/October 2014) of Politics 64, no. 2 (May 2002): 546.

36. Ibid. 46. Treatment of precedents may be examined using Shepard’s Citations. Estab- 37. Kumho Tire Co. v. Carmichael, 526 lished in 1873, it helps legal scholars U.S. 137 (1999) determine the precedential value of a 38. Matthew Meyers and Marcus Rogers, case through history, evaluates and an- "Computer Forensics: The Need for Stan- alyzes what subsequent decisions have dardization and Certiﬁcation," Interna- said about the precedent, and traces tional Journal of Digital Evidence 3, no. the discussion to speciﬁc points of law 2 (Fall 2004): 5. through the use of head-notes.

39. Ibid, 10. 47. Benjamin Kassow, Donald R. Songer, and Michael P. Fix, "The Inﬂuence of 40. Ibid, 11 Precedent on State Supreme Courts," Political Research Quarterly 65, no. 2 41. John S. Atkinson, "Proof Is Not Binary: (March 18, 2011): 380. The Pace and Complexity of Computer Systems and the Challenges Digital Evi- 48. Richard M. Re, "Narrowing Supreme dence Poses to the Legal System," Birk- Court Precedent from Below," George- beck Law Review 2, no. 2 (December town Law Journal 104, no. 4 (April 2014): 253. 2016): 921.

42. Simson L. Garﬁnkel, "Digital Foren- 49. Re, "Narrowing Supreme," 921 sics," American Scientist 101, no. 5 (September/October 2013): [Page 50. Alan Butler, "Get a Warrant: The #], accessed March 14, 2017, http: Supreme Court’s New Course for Digital //www.americanscientist.org/ Privacy Rights after Riley v. California," issues/pub/digital-forensics. Duke Journal of Constitutional Law & Public Policy 10, no. 1 (October 2014): 43. Daniel B. Garrie and J. David Mor- 21. rissy, "Digital Forensic Evidence in the Courtroom: Under-standing Content 51. Ibid, 22.

Page 26 c 2020 JDFSL Digital Evidence in Criminal Cases... JDFSL V14N4

52. Ibid 24. 61. See Weeks v. United States, 232 U.S. 383, 392 (1914); Carroll v. United States, 53. John S. Atkinson, "Proof Is Not Binary: 267 U.S. 132, 158 (1925); Agnello v. The Pace and Complexity of Computer United States, 269 U.S. 20, 30 (1925) Systems and the Challenges Digital Evi- dence Poses to the Legal System," Bir- 62. See Carroll v. United States, 267 U.S. beck Law Review 2, no. 2 (December 132, 158 (1925); Chambers v. Maroney, 2014) 399 U.S. 42 (1970); Arizona v. Johnson, 129 S. Ct. 781, 786 ( 2009); Michigan 54. The status of all cases analyzed in this Dep’t of State Police v. Sitz, 496 U.S. study, confirming whether rulings from 444 (1990); United States v. Martinez- that court stood, and whether these rul- Fuerte, 428 U.S. 543 (1976);and City of ings received subsequent negative treat- Indianapolis v. Edmond, 531 U.S. 32 ment or criticism may found in Appendix (2000) I. 63. See 265 U.S. 57 (1924), 466 U.S. 170 55. For the period 2010 – 2015, there were (1984), and California v. Greenwood, 45.030 criminal appeals where the out- 486 U.S. 35 (1988) come was either affirmed or re-versed 64. See Steele v. United States, 267 U.S. for all United States Circuit Courts of 498 (1925); Arizona v. Hicks, 480 U.S. Appeals (92.2 percent were affirmed for 321 (1987); and Illinois v. Andreas, 463 the government, while 7.8 percent were U.S. 765, 771 (1983). reversed for the defendant). 65. See New Jersey v. T.L.O, 469 U.S. 325 56. Thomas K. Clancy, "Digital Child (1985); and Safford Unified School Dis- Pornography and the Fourth Amend- trict #1 v. Red-ding, 129 S. Ct. 2633 ment," Judges’ Journal 49, no. 3 (Sum- (2009). mer 2010): 26. 66. See Hudson v. Palmer, 468 U.S. 517, 57. Federal Rules of Evidence, 28 U.S.C. §§ 526 (1984) for prison cell searches; and 93-595 (1975 & Supp. 2014). Griffin v. Wisconsin, 483 U.S. 868 (1987) for probation. 58. Weeks v. United States, 232 U.S. 383 (1914) 67. See Skinner v. Railway Labor Execu- tives’ Ass’n4, 89 U.S. 602 (1989); and 59. "Olmstead v. United States: The upheld in National Treasury Employees Constitutional Challenges of Pro- Union v. Von Raab, 489 U.S. 656 (1989) hibition Enforcement — Historical Background and Documents," History 68. United States v. Schesso, 730 F.3d 1040, of the Federal Judiciary, last modified (9th Cir. 2013). 2016, ac-cessed August 10, 2016, http: 69. Ibid. //www.fjc.gov/history/home.nsf/ page/tu_olmstead_questions.html. 70. United States v. Frechette, 583 F.3d 374 (6th Cir. Oct. 8, 2009) 60. United States v. Watson, 423 U.S. 411 (1976) 71. Ibid.

c 2020 JDFSL Page 27 JDFSL V14N4 Digital Evidence in Criminal Cases...

72. United States v. Terry, 522 F.3d 645, 90. United States v. Flyer, 633 F.3d 911, 650 n.2 (6th Cir. 2008). (9th Cir. Feb. 8, 2011)

73. United States v. Hampton, 504 F. App. 91. Ibid. 402 (6th Cir. Nov. 5, 2012) 92. United States vs. Flyer 2011. 74. Ibid. 93. Cornell Law School, "Rule 401. Test for 75. See United States v. Jacobsen, 466 U.S. Rele-vant Evidence," Legal Information 109, and United States v. Matlock, 415 Institute, last modified 2015, accessed U.S. 164. November 13, 2015, https://www.law. 76. United States v. Plavcak, 411 F.3d 655 cornell.edu/rules/fre/rule_401. (6th Cir. June 6, 2005) 94. Cornell Law School, "Rule 403. Exclud- 77. United States v. Bradley, 488 F. App. ing Rel-evant Evidence for Prejudice, 99, (6th Cir. July 12, 2012) Confusion, Waste of Time, or Other Rea- sons," Legal Information Institute, last 78. Ibid. modified 2015, accessed Novem-ber 13, 2015, https://www.law.cornell.edu/ 79. Ibid. Citing United States v. Moore, rules/fre/rule_403. 916 F.2d 1131, 1139 (6th Cir. 1990) 95. United States v. Reynolds, 626 F. App. 80. United States v. Richards, 659 F.3d 527 610 (6th Cir, 2015) (6th Cir. Tenn. 2011) 81. Marron v. United States, 275 U.S. 192, 96. 626 F. App. 610 196 (1927) 97. United States v. Ballard, 448 F. App. 82. United States v. Evers, 669 F.3d 645 987 (6th Cir. Feb. 10, 2012) 98. Ibid, quoting United States v. Dodds, 83. Ibid. 347 F.3d 893 (2003) 84. Katz v. United States, 389 U.S. 347 99. Ibid (U.S. Dec. 18, 1967). 100. Cornell Law School, "Rule 901. Au- 85. United States v. Wheelock, 772 F.3d thenticating or Identifying Evidence," 825 (8th Cir. Nov. 20, 2014) Legal Information In-stitute, last modified 2015, accessed November 19, 86. An administrative subpoena under U.S. 2015, https://www.law.cornell.edu/ law is issued by a federal agency without rules/fre/rule_901. prior judicial oversight. 101. Eoghan Casey, "Digital Evidence in the 87. United State v. Wheelock. Court-room," in Digital Evidence and 88. Ibid. Citing United States v. Bach, 310 Computer Crime, 3rd ed. (New York, F.3d 1063, 1066 (8th Cir. 2002). NY: Elsevier, 2011), 60. 89. United States v. Dixon, 589 F. App. 427 102. United States v. Crim. Triumph Capital (11th Cir. Oct. 23, 2014). Group, 211 F.R.D. 31 (D. Conn. 2002)

Page 28 c 2020 JDFSL Digital Evidence in Criminal Cases... JDFSL V14N4

103. For a discussion on forensic image 112. United States v. Lizarraga-Tirado, 789 file formats, see Forensics File For- F.3d 1107. Also, see United States mats, Forensics Wiki, http://www. v. May, 622 F.2d 1000, 1007 (9th forensicswiki.org/wiki/Category: Cir. 1980); wherein Apprehen-sion Data Forensics_File_Formats. Cards were not hearsay because they were not "offered in evidence to prove 104. Barbara J. Rothstein, Ronald J. the truth of the matter asserted. The Hedges, and Elizabeth C. Wiggins, photographs on them were introduced "Managing Discovery of Electronic as circumstantial evidence." Information: A Pocket Guide for Judges," Federal Evidence Review, last 113. Ibid modi-fied 2007, accessed March 27, 2017, http://federalevidence.com/pdf/ 114. Kumho Tire Co. v. Carmichael, 524 U.S. 2008/09-Sept/FJC\_\%20Managing\ 936 (U.S. 1998) extended Daubert to %20Discovery\%20of\%20Electronic\ include any form of technical evidence. %20Information.pdf. 115. Cornell Law School, "Rule 702. Tes- 105. United States v. Siddiqui, 235 F.3d 1318 timony by Expert Witnesses," Le- (11th Cir. 2000) gal Information Institute, last modified 2015, accessed November 13, 106. United States v. Lanzon, 639 F.3d 1293 2015, https://www.law.cornell.edu/ (11th Cir. May 4, 2011) rules/fre/rule\_702.

107. Cornell Law School, "Rule 1002. 116. United States v. Stanley, 533 F. App. Requirement of the Original," Le- 325, (4th Cir. July 19, 2013) gal Information Institute, last mod- 117. Ibid. iﬁed 2015, accessed November 19, 2015, https://www.law.cornell.edu/ 118. No subsequent action includes those rules/fre/rule\_1002 cases where US Supreme Court certiorari was denied 108. Cornell Law School, "Rule 1003. Admis- sibility of Duplicates," Legal Information 119. Validity questioned in United States v. Institute, last modiﬁed 2015, accessed Wencewicz, 63 F. Supp. 3d 1238, 2014 November 19, 2015, https://www.law. U.S. Dist. LEXIS 151322 (D. Mont. Oct. cornell.edu/rules/fre/rule_1003. 24, 2014)

109. 109. United States v. Lebowitz, 676 120. Criticized in United States v. Unknown F.3d 1000 (11th Cir. Apr. 5, 2012) (In re Unknown), 701 F.3d 749, 2012 U.S. App. LEX-IS 23802 (5th Cir. Tex. Nov. 110. 110. Owens v. Wainwright, 698 F.2d 19, 2012) 1111, 1113 (11th Cir. 1983) 121. United States v. Graves, 951 F. Supp. 111. Cornell Law School, "Rule 801. Exclu- 2d 758, 2013 U.S. Dist. LEXIS 90324 sions from Hearsay," Legal Information (E.D. Pa. June 27, 2013) Institute, last modiﬁed 2015, accessed November 13, 2015, https://www.law. 122. United States v. Unknown (In re Un- cornell.edu/rules/fre/rule\_801. known), 701 F.3d 749, 2012 U.S. App.

c 2020 JDFSL Page 29 JDFSL V14N4 Digital Evidence in Criminal Cases...

LEXIS 23802 (5th Cir. Tex. Nov. 19, [8] Barbara, J. J. (2012, Septem- 2012) ber 4). Computer forensics standards and controls. Forensic Mag- 123. United States v. Adams, 2016 U.S. Dist. azine. Retrieved from https: LEXIS 105471 (M.D. Fla. Aug. 10, //www.forensicmag.com/article/ 2016) 2012/09/computer-forensics- standards-and-controls. REFERENCES [9] Bartholomew, P. (2014). Seize ﬁrst, [1] [Special issue]. (2015). Cornell Law Re- search later: The hunt for digital evi- view, 101(1). dence. Touro Law Re-view, 30(4), 10.

[2] Administrative Oﬃce of the U.S. Courts, [10] Benesh, S. C., & Reddick, M. (2002). Cases Filed, Terminated, and Pend- Overruled: An event history analysis of ing (Summary), Doc. No. Table 2 (). lower court reaction to Supreme Court Retrieved from http://www.uscourts. alteration of precedent. Journal of Poli- gov/file/19017/download tics, 64(2), 534-550.

[3] AmiNarh, J. T., & Williams, P. A.H. [11] Butler, A. (2014). Get a warrant: The (2008). Digital forensics and the legal Supreme Court’s new course for digital system: A dilemma of our times. Aus- privacy rights after riley v. California. tralian digital forensics conference. Duke Journal of Constitutional Law & Public Policy, 10(1), 83-108. [4] Angeli, D. H., Schuck, C., & Taylor, [12] Casey, E. (2011). Digital evidence in the A. (2010, August). Article: The plain court-room. In Digital evidence and com- view doctrine and computer searches: puter crime (3rd ed., pp. 49-82). New Balancing law enforce-ment’s investiga- York, NY: Elsevier. tory needs with privacy rights in the digital age. The Champion, 18-24. Re- [13] Chism v. State of Washington, 661 F.3d trieved from https://advance.lexis. 380 (9th Cir. Nov. 7, 2011). com/api/permalink/810a0c0a-462b- [14] Churchill, M. H., Mauler, D. D., 4302-9f92-4db3c87e81e4/?context= McLaughlin, M. J., & Vincent, M. K. 1000516 (2015). Admitting and authenticating [5] Arizona v. Hicks, 480 S. Ct. 321 (1987). electronic evidence in court, including trial-like demonstrations. The federal [6] Atkinson, J. S. (2014). Proof is not bi- bar association’s 2015 federal litigation nary: The pace and complexity of com- conference, pp. 1-20. puter systems and the challenges digital evidence poses to the legal system. Birk- [15] Churchill, M. H., Mauler, D. D., beck Law Review, 2(2), 245-261. McLaughlin, M. J., & Vincent, M. K. (2015, October 27). Admitting and au- [7] Bagley, W. A. (2011). Don’t be evil: The thenticating electronic evidence in court, fourth amendment in the age of google, including trial-like demonstrations. Pa- national security, and digital papers and per presented at The Federal Bar Asso- eﬀects. Albany Law Journal of Science ciation’s 2015 Federal Litigation Confer- Technology, 21(1), 153-192. ence, Salt Lake City, Utah/USA.

Page 30 c 2020 JDFSL Digital Evidence in Criminal Cases... JDFSL V14N4

[16] Clancy, T. K. (2005). The fourth amend- [23] Daniel, L. E. (2009, October 23). ment aspects of computer searches and Plain view doctrine in digital evi- seizures: A perspective and a primer. dence cases—a common sense ap- Mississippi Law Journal, 75, 193-272. proach. Forensic Magazine. Retrieved from http://www.forensicmag. [17] Clancy, T. K. (2010). Digital child com/article/2009/10/plain- pornography and the fourth amendment. view-doctrine-digital-evidence- Judges’ Journal, 49(3), 26-32. cases\%E2\%80\%94-common-sense- approach. [18] Clark, W. (2015). Protecting the priva- cies of digital life: Riley v. California, [24] Digital duplications and the fourth the fourth amendment’s particularity re- amendment. (2016). Harvard Law quirement, and search protocols for cell Review, 129(4), 1046. Editorial Board. phone search warrants. Bos-ton College (2014). Riley v. California. Harvard Law Review, 56(5), 1981-2018. Law Review, 128(1). Retrieved from http://harvardlawreview.org/ [19] Cole, K. A., Gupta, S., Gurugubelli, D., 2014/11/riley-v-california/. & Rogers, M. K. (2015). A review of [25] Epstein, J. (2016). Child pornog- recent case law related to digital foren- raphy and exploitation. In A. Mo- sics: The current issues. 2015 ADFSL rosco (Comp.), The prosecution conference on digital forensics, security and defense of sex crimes (Rev. and law, pp. 95-104. ed.). Retrieved from https://www. lexis.com/research/retrieve?_m= [20] Congressional Research Agency Library 9cc0553738975770940ffffafb78ac5a& of Congress. (1996). The constitution of csvc=toc2doc&cform=&_fmtstr= the United States of America: Analysis FULL&docnum=1&_startdoc=1& and interpretation (Report No. 103–6) wchp=dGLbVzk-zSkAl&_md5= (J. H. Killian & G. A. Costello, Eds.). 685308ea17f6414e6a924c278fe5dec1. Washington, DC/USA: U.S. Govern- ment Printing Oﬃce. [26] Expectation of privacy. (2009, Septem- ber 17). Retrieved December 20, 2016, [21] Court role and structure. (n.d.). from Legal In-formation Institute web- Retrieved February 7, 2017, from site: https://www.law.cornell.edu/ United States Courts web-site: http: wex/expectation_of_privacy. //www.uscourts.gov/about-federal- courts/court-role-and-structure. [27] Febus, C., Claude, J., & Singer, K. (2010, Febru-ary). Understanding prob- [22] Crocker, A. (2016, June 3). Ap- able cause and over-coming staleness is- peals court avoids hard questions sues in child pornography cases. CEOS about the “Collect it all” approach Quarterly Newsletter, 9-20. to computer searches [Blog post]. [28] Federal Rules of Evidence, 28 U.S.C. §§ Retrieved from DeepLinks Blog: 93-595 (1975 & Supp. 2014). https://www.eﬀ.org/deeplinks/2016/06/appeals- court-avoids-hard-questions-about- [29] Frieden, J. D., & Murray, L. M. (2011). collect-it-all-approach-computer. The admissibility of electronic evidence

c 2020 JDFSL Page 31 JDFSL V14N4 Digital Evidence in Criminal Cases...

under the federal rules of evidence. Rich- [37] Goldfoot, J. (2011). The physical mond Journal of Law and Technology, computer and the fourth amend- XVII (2). ment, Berkeley Journal of Criminal Law, 16(1), 112. Retrieved from [30] Friess, N. (2013). When rummaging goes http://scholarship.law.berkeley. digital: Fourth amendment particularity edu/bjcl/vol16/iss1/3. and stored e-mail surveillance. Nebraska Law Journal, 90(4), 972-1016. [38] Goodison, S. E., Davis, R. C., & Jackson, B. A. (2015). Digital evidence and the [31] Frost, A. (2015). Inferiority complex: U.S. criminal justice system (Research Should state courts follow lower federal Report No. RR-890-NIJ). Santa Monica, court precedent on the meaning of fed- CA: RAND. Grimm, P. D. (2014). Au- eral law? Vanderbilt Law Review, 68, thenticating digital evidence. GP Solo, 53-103. 31(5), 47-49.

[32] Galves, F., & Galves, C. (2004). Ensur- [39] Grimm, P. W., & Brady, K. F. ing the admissibility of electronic foren- (n.d.). Admissibility of electronic sic evidence and enhancing its probative evidence [Blog post]. Retrieved value at trial. Criminal Justice Magazine, from Drug Device Law Blog: 19(1). https://www.reedsmith.com/ files/uploads/DrugDeviceLawBlog/ [33] Garﬁnkel, S. L. (2010). Digital foren- Electronic_Evidence_-_Admission_ sics re-search: The next 10 years. Guide_pdf.pdf#page=1&zoom=auto,- Digital Investiga-tion, 7(Supplemen- 35,798. tal), S64-S73. Garﬁnkel, S. L. (2013). Digital forensics. Ameri-can Scientist, [40] Gruenspecht, J. (2011). "Reasonable" 101(5), 370. Retrieved from http: grand jury subpoenas: Asking for infor- //www.americanscientist.org/ mation in the age of big data. Harvard issues/pub/digital-forensics. Journal of Law & Technology, 24(543).

[34] Garrie, D. B., & Morrissy, J. D. (2014). [41] Hart, A. (2014, July 26). In court, Digital forensic evidence in the court- digital evidence can shine or ﬁzzle. room: Under-standing content and qual- The Atlanta Journal-Constitution. Re- ity. Northwestern Journal of Technology trieved from http://www.myajc. and Intellectual Prop-erty, 12(2), 121- com/news/crime--law/court- 128. digital-evidence-can-shine- fizzle/dsdyFH23L3IZZaoTrLYZAO/. [35] Gershowitz, A. M. (2016). The postriley search warrant: Search protocols and [42] Holley, B. (2010). Digitizing the fourth particularity in cell phone searches. Van- amendment: Limiting the private search derbilt Law Review, 69(3), 585-638. exception in computer investigations. Virginia Law Re-view, 96(3), 677-717. [36] Givens, J. S. (2003). The admissibility of electronic evidence at trial: Court- [43] Hood, N. (2011). No requirement room admissibility standards. Cumber- left behind: The inadvertent discovery land Law Review, 34, 95. requirement—protecting citizens one ﬁle

Page 32 c 2020 JDFSL Digital Evidence in Criminal Cases... JDFSL V14N4

at a time. Valparai-so University Law Re- [52] Kerr, O. S. (2011, June 23). The view, 45(4), 1529-1587. How courts work. historical role of warrants, particularity, (2016). Retrieved January 15, 2016, from and magistrates [Blog post]. Retrieved American Bar Association - Division from The Volokh Conspiracy website: for Public Education website: http: http://volokh.com/2011/06/23/the- //www.americanbar.org/groups/ historical-role-of-warrants- public_education/resources/law_ particularity-and-magistrates/. related_education_network/how_ courts_work/appeals.html. [53] Kerr, O. S. (2013). Foreword: Account- ing for technological change. Harvard [44] Huynh, A. D. (2015). What comes af- Journal of Law and Public Policy, 36, ter "get a warrant": Balancing particu- 403-408. larity and practicality in mobile device search warrants post-Riley. Cornell Law [54] Kerr, O. S. (2014, June 24). Commen- Review, 101(1), 187-222. tary on the Ganias case. The Washing- [45] Jekot, W. (2007). Computer forensics, ton Post. search strategies, and the particularity requirement. University of Pittsburgh [55] Kerr, O. S. (2015). Executing warrants School of Law Journal of Technology for digital evidence: The case for use re- Law and Policy, 7, 1-44. strictions on non-responsive data. Texas Tech Law Review, 48(1), 1-36. [46] The Judiciary Act of 1789, 1 Stat. 73 U.S.C. § SEC. 35 (1789). [56] Knapp, M. (2015, July 6). Second circuit grants rehearing in United [47] Kassow, B., Songer, D. R., & Fix, M. States V. Ganias [Blog post]. Re- P. (2011). The inﬂuence of precedent on trieved from Lawfare website: https: state supreme courts. Political Research //www.lawfareblog.com/second- Quarterly, 65(2), 372-384. circuit-grants-rehearing-united- [48] Katz v. United States, 389 S. Ct. 347 states-v-ganias#. (Dec. 18, 1967). Kerr, O. S. (2003). A user’s guide to the stored communica- [57] Kozel, R. J. (2014). The scope of prece- tions act, and a legislator’s guide to dent. Michigan Law Review, 113(1), 179- amending it. George Washington Law 230. Re-view, 72, 1208-1243. [58] Kumho Tire Co. v. Carmichael, 119 [49] Kerr, O. S. (2005). Searches and seizures U.S. 1167 (Mar. 23, 1999). Lee county in a dig-ital world. Harvard Law Review, man nets 17 1/2 years in federal 119(2), 531-585. prison for downloading child pornog- [50] Kerr, O. S. (2005). Search warrants in raphy on LimeWire. (2011, January an era of digital evidence. Mississippi 12). Retrieved March 17, 2017, from Law Journal, 75(85). The U.S. Attorney’s Oﬃce for the Middle District of Alabama website: [51] Kerr, O. S. (2010). Fourth amendment https://www.justice.gov/archive/ seizures of computer data. Yale Law usao/alm/press/2011/2011_01_12_ Journal, 119(4), 700-724. ballard.html.

c 2020 JDFSL Page 33 JDFSL V14N4 Digital Evidence in Criminal Cases...

[59] Levy - Sachs, R., & Archambault, sics (pp. 43-50). New York, NY: Inter- T. (2008). Hurdling toward the national Federation for Information Pro- future: Navigating elec-tronically cessing. stored information through the federal rules of evidence: Lorraine V. [65] Meyers, M., & Rogers, M. (2006, fall). Markel America Insurance co. 2008 Computer forensics: The need for stan- FDCC winter meeting; Technology dardization and certiﬁcation. In M. Pol- and e-commerce/intellectual property litt & S. Shenoi (Eds.), Advances in dig- section, pp. 6-13. Retrieved from ital forensics (Vol. 194, pp. 42-50). New http://www.thefederation.org/ York, NY: Springer International Pub- documents/10.LevySachs.pdf. lishing.

[60] Liles, S., Rogers, M., & Hoebich, M. [66] Miranda v. Arizona, 384 U.S. 486 (June (2009). [A Survey of the Legal Issues 13, 1966). Facing Digital Forensic Experts]. In G. Peterson & S. Shenoi (Eds.), Advances [67] Murphy, E. (2014). The mismatch be- in digital forensics V (Vol. 306, pp. 266- tween twenty-first-century forensic evi- 267). Berlin, Germany: Springer. dence and our antiquated criminal justice system. Southern California Law Re- [61] Mantei, C. J. (2011). Pornography view, 87(3), 633-672. and privacy in plain view: Apply- ing the plain view doctrine to com- [68] Nance, K., & Ryan, D. J. (2011). puter searches. Arizona Law Review, Legal aspects of digital forensics: A 53(3), 985-1012. Retrieved from http: research agenda. Proceedings of the //arizonalawreview.org/mantei/. 44th Hawaii international conference [62] Mestitz, M. (2017). Unpacking digital on system sciences (HICSS-44), pp. containers: Extending Riley’s reasoning 1-6. Newman, Z. G., & Ellis, A. to digital files and subfolders. Stanford (2011, January 25). The reliability, Law Review, 69(1), 321-357. admissibility, and power of electronic evidence. Retrieved from American Bar [63] Meyer, D. L. (2009). MelendezDiaz v. Association - Section of Litigation web- Massachusetts: What the expanded con- site: https://apps.americanbar. frontation clause ruling means for com- org/litigation/committees/ puter forensics and electronic discovery. trialevidence/articles/012511- Temple Journal of Science, Technology electronic-evidence.html. & Environmental Law, 28(2), 243. [69] Newman, Z. G., & Ellis, A. (2011, [64] Meyers, M., & Rogers, M. (2004). Com- January 25). The reliability, admissibil- puter forensics: The need for standard- ity, and power of electronic evidence. ization and certification. International Retrieved March 15, 2017, from Section Journal of Digital Evidence, 3(2). Mey- of Litigation Trial Evidence web- ers, M., & Rogers, M. (2005). Digital site: https://apps.americanbar. forensics: Meeting the challenges of sci- org/litigation/committees/ entific evidence. In S. Shenoi & M. Pol- trialevidence/articles/012511- litt (Eds.), Advances in digital foren- electronic-evidence.html.

Page 34 c 2020 JDFSL Digital Evidence in Criminal Cases... JDFSL V14N4

[70] Ohm, P. (2005). The fourth amendment from Legal In-formation Institute web- right to delete. Harvard Law Review Fo- site: https://www.law.cornell.edu/ rum, 119, 10-18. Ohm, P. (2011). Mas- rules/fre/rule_401. sive hard drives, general warrants, and the power of magistrate judges. Virginia [78] Rule 403. Excluding relevant evidence Law Review, 97, 1-12. for preju-dice, confusion, waste of time, or other rea-sons. (2015). Re- [71] Olmstead v. United States: The trieved November 13, 2015, from constitutional challenges of prohibition Legal Information Institute website: enforcement — historical background https://www.law.cornell.edu/ and documents. (2016). Retrieved rules/fre/rule_403. August 10, 2016, from History of the [79] Rule 901. Authenticating or identify- Federal Judiciary website: http://www. ing evidence. (2015). Retrieved Novem- fjc.gov/history/home.nsf/page/ ber 19, 2015, from Legal Information tu\_olmstead\_questions.html. Institute website: https://www.law. [72] Re, R. M. (2016). Narrowing Supreme cornell.edu/rules/fre/rule\_901. Court precedent from below. George- [80] Rule 1003. Admissibility of duplicates. town Law Journal, 104(4), 921-971. (2015). Retrieved November 19, 2015, [73] Riley v. California, 134 S. Ct. 2473 from Legal In-formation Institute web- (2014). site: https://www.law.cornell.edu/ rules/fre/rule\_1003. [74] Riley v. California. (2014). Harvard Law Review, 128(1). Retrieved from [81] Rule 1002. Requirement of the original. http://harvardlawreview.org/ (2015). Retrieved November 19, 2015, 2014/11/riley-v-california/. from Legal In-formation Institute website: https://www.law.cornell.edu/ [75] Rothstein, B. J., Hedges, R. J., & Wig- rules/fre/rule\_1002. gins, E. C. (2007). Managing discovery [82] Rule 702. Testimony by expert witnesses. of electronic in-formation: A pocket (2015). Retrieved November 13, 2015, guide for judges. Retrieved March 27, from Legal In-formation Institute web- 2017, from Federal Evi-dence Review site: https://www.law.cornell.edu/ website: http://federalevidence. rules/fre/rule_702. com/pdf/2008/09-Sept/FJC_\% 20Managing\%20Discovery\%20of\ [83] Rummel, J. A. (2011). When warrants %20Electronic\%20Information. uncover digital evidence: The tenth cir- pdf. cuit’s ruling in United States V. burke. Oklahoma City University Law Review, [76] Rule 801. Exclusions from hearsay. 36(3), 713-735. (2015). Retrieved November 13, 2015, from Legal In-formation Institute web- [84] Ryan, D. J., & Shpantzer, G. (2002). site: https://www.law.cornell.edu/ Legal aspects of digital forensics. Pro- rules/fre/rule_801. ceedings: Foren-sics workshop. [77] Rule 401. Test for relevant evidence. [85] Salgado, R. P. (2013). Fourth amend- (2015). Retrieved November 13, 2015, ment search and the power of the hash.

c 2020 JDFSL Page 35 JDFSL V14N4 Digital Evidence in Criminal Cases...

Federal Evidence Review. Retrieved [91] United States v. Ballard, 448 F. App. from http://federalevidence.com/ 987 (11th Cir. Dec. 15, 2011). pdf/2013/02Feb/EE-4thAmSearch- Power\%20of\%20Hash.pdf. [92] United States v. Barrington, 648 F.3d 1178 (11th Cir. Aug. 11, 2011). [86] Spriggs, J. F., & Hansford, T. G. (2001). Explaining the overruling [93] United States v. Beasley, 688 F.3d 523 of U.S. Supreme Court precedent. (8th Cir. July 31, 2012). Journal of Politics, 63(4), 1091-1111. [94] United States v. Beatty, 437 F. App. 185 Statistical tables for the federal ju- (3d Cir. July 14, 2011). diciary. (n.d.). Retrieved January 13, 2016, from United States Courts [95] United States v. Benoit, 713 F.3d 1 website: http://www.uscourts.gov/ (10th Cir. Apr. 2, 2013). statistics-reports/analysis- reports/statistical-tables- [96] United States v. Bershchansky, 788 F.3d federal-judiciary. 102 (2d Cir. June 5, 2015). [87] Statistical tables for the federal judi- [97] United States v. Blauvelt, 638 F.3d 281 ciary - December 2015. (2015, December (4th Cir. Mar. 9, 2011). 09-4601 31). Retrieved January 17, 2017, from United States Courts website: http: [98] United States v. Botta, 405 F. App. 196 //www.uscourts.gov/statistics- (9th Cir. Dec. 8, 2010). reports/statistical-tables- [99] United States v. Bradley, 488 F. App. federal-judiciary-december-2015. 99 (6th Cir. July 12, 2012).

[88] Statistics & reports. (2015, Decem- [100] United States v. Broxmeyer, 616 F.3d ber). Retrieved December 9, 2015, 120 (2d Cir. Aug. 3, 2010). from United States Courts website: http://www.uscourts.gov/ [101] United States v. Budziak, 697 F.3d statistics-reports. SWGDE digital 1105 (9th Cir. July 17, 2012). & multimedia evidence glossary (Report No. Version 3.0). (n.d.). Retrieved from [102] United States v. Burdulis, 753 F.3d 255 https://www.swgde.org/documents/ (1st Cir. May 23, 2014). Current\%20Documents/SWGDE\ [103] United States v. Burgos, 786 F.3d 92 %20Digital\%20and\%20Multimedia\ (1st Cir. May 13, 2015). %20Evidence\%20Glossary. [104] United States v. Burke, 633 F.3d 984 [89] Thomson, L. L. (2013). Mobile devices: (10th Cir. Feb. 2, 2011). New challenges for admissibility of electronic evidence. The SciTech Lawyer, [105] United States v. Burkhart, 602 F.3d 9(3&4). United States Code, 2006 Edi- 1202 (10th Cir. Apr. 23, 2010). tion, Supplement 5, Title 18 - CRIMES AND CRIMINAL PRO-CEDURE, 18 [106] United States v. Bush, 727 F.3d 1308 U.S.C. § 110 (2006 & Supp. 2011). (11th Cir. Aug. 27, 2013). [90] United States v. Allen, 625 F.3d 830 [107] United States v. Bynum, 604 F.3d 161 (5th Cir. Nov. 4, 2010). (4th Cir. May 5, 2010).

Page 36 c 2020 JDFSL Digital Evidence in Criminal Cases... JDFSL V14N4

[108] United States v. Carroll, 750 F.3d 700 [124] United States v. Dixon, 589 F. App. (7th Cir. Apr. 29, 2014). 427 (11th Cir. Oct. 23, 2014).

[109] United States v. Chase, 717 F.3d 651 [125] United States v. Doyle, 650 F.3d 460 (8th Cir. June 25, 2013). (4th Cir. May 23, 2011).

[110] United States v. Chiaradio, 684 F.3d [126] United States v. Dudley, 804 F.3d 506 265 (1st Cir. July 11, 2012). (1st Cir. Oct. 30, 2015).

[111] United States v. Clark, 668 F.3d 934 [127] United States v. Durdley, 436 F. App. (7th Cir. Feb. 13, 2012). 966 (11th Cir. Aug. 9, 2011). [128] United States v. Easterwood, 415 F. [112] United States v. Clark, 685 F.3d 72 App. 883 (10th Cir. Feb. 23, 2011). (1st Cir. July 16, 2012). [129] United States v. Edens, 380 F. App. [113] United States v. Comprehensive Drug 880 (11th Cir. May 26, 2010). Testing, Inc., 621 F.3d 1162 (9th Cir. Aug. 26, 2009). [130] United States v. Edwards, 813 F.3d 953 (10th Cir. Dec. 29, 2015). [114] United States v. Connor, 521 F. App. 493 (6th Cir. Apr. 11, 2013). [131] United States v. Elbe, 774 F.3d 885 (6th Cir. Nov. 20, 2014). [115] United States v. Cordero-Rosario, 786 F.3d 64 (1st Cir. May 4, 2015). [132] United States v. Epps, 570 F. App. 197 (3d Cir. June 26, 2014). [116] United States v. Cotterman, 709 U.S. 952 (9th Cir. Mar. 30, 2013). [133] United States v. Evans, 802 F.3d 942 (8th Cir. Sept. 18, 2015). [117] United States v. Cowan, No. 11-15989 (11th Cir. Nov. 19, 2012). [134] United States v. Evers, 669 F.3d 645 (6th Cir. Feb. 10, 2012). [118] United States v. Crespo, 645 F.3d 37 [135] United States v. Farlow, 681 F.3d 15 (1st Cir. June 8, 2011). (1st Cir. June 1, 2012). [119] United States v. Crespo-Rios, 645 F.3d [136] United States v. Figueroa, 793 F.3d 37 (1st Cir. June 8, 2011). 179 (1st Cir. July 17, 2015).

[120] United States v. Curbelo, 726 F.3d [137] United States v. Fisher, 745 F.3d 200 1260 (11th Cir. Aug. 9, 2013). (6th Cir. Mar. 7, 2014).

[121] United States v. Darr, 661 F.3d 375 [138] United States v. Flyer, 633 F.3d 911 (8th Cir. Nov. 16, 2011). (9th Cir. Feb. 8, 2011).

[122] United States v. Dawson, 425 F.3d 389 [139] United States v. Franz, 772 F.3d 134 (7th Cir. 2005). (3d Cir. Nov. 4, 2014).

[123] United States v. Diaz, 435 F. App. 329 [140] United States v. Frechette, 583 F.3d (5th Cir. July 29, 2011). 374 (6th Cir. Oct. 8, 2009).

c 2020 JDFSL Page 37 JDFSL V14N4 Digital Evidence in Criminal Cases...

[141] United States v. Fritz, 453 F. App. 204 [156] United States v. Houston, 665 F.3d 991 (3d Cir. Nov. 30, 2011). (8th Cir. Jan. 11, 2012).

[142] United States v. Galpin, 720 F.3d 436 [157] United States v. Howard, 766 F.3d 414 (1st Cir. June 25, 2013). (5th Cir. Sept. 9, 2014).

[143] United States v. Ganias, 725 F.3d 125 [158] United States v. Howe, 545 F. App. 64 (2d Cir. 2014). (2d Cir. Nov. 24, 2013).

[144] United States v. Ganias, 2016 F. App. [159] United States v. Hughes, 640 F.3d 428 9706 (2d Cir. 2016). (1st Cir. Apr. 8, 2011).

[145] United States v. Ganias - second cir- [160] United States v. Husman, 765 F.3d 169 cuit creates a potential "right to dele- (3d Cir. Sept. 3, 2014). tion" of imaged hard drives. (2014). Har- [161] United States v. Johnson, 537 F. App. vard Law Review, 128(743). Retrieved 717 (9th Cir. Aug. 12, 2013). from http://harvardlawreview.org/ 2014/12/united-states-v-ganias/. [162] United States v. Johnson, 579 F. App. 920 (11th Cir. Sept. 16, 2014). [146] United States v. Grzybowicz, 747 F.3d 1296 (11th Cir. Apr. 4, 2014). [163] United States v. Johnston, 789 F.3d 934 (9th Cir. May 26, 2015). [147] United States v. Gumbs, 562 F. App. 110 (3d Cir. Mar. 28, 2014). [164] United States v. Joubert, 778 F.3d 247 (1st Cir. Feb. 11, 2015). [148] United States v. Hamilton, 413 F.3d 1142 (10th Cir. 2005). [165] United States v. Kearney, 672 F.3d 81 (1st Cir. Feb. 29, 2012). [149] United States v. Hampton, 504 F. App. 402 (6th Cir. Nov. 5, 2012). [166] United States v. Keith, 440 F. App. 503 (7th Cir. Oct. 4, 2011). [150] United States v. Harrell, 572 F. App. [167] United States v. Kernell, 667 F.3d 746 452 (7th Cir. July 24, 2014). (6th Cir. Jan. 30, 2012).

[151] United States v. Hemetek, 393 F. App. [168] United States v. Killingbeck, 616 F. 67 (4th Cir. Aug. 26, 2010). App. 14 (2d Cir. Oct. 5, 2015).

[152] United States v. Henderson, 595 F.3d [169] United States v. Kinison, 710 F.3d 678 1198 (10th Cir. Feb. 17, 2010). (6th Cir. Mar. 19, 2013).

[153] United States v. Hentzen, 638 F. App. [170] United States v. Koch, 625 F.3d 470 427 (6th Cir. Aug. 17, 2015). (8th Cir. Nov. 17, 2010).

[154] United States v. Hester, 627 F. App. [171] United States v. Konn, 634 F. App. 818 867 (11th Cir. Oct. 1, 2015). (2d Cir. Dec. 17, 2015).

[155] United States v. Hoﬀmann, 74 Military [172] United States v. Kornhauser, 519 F. Justice 542 (N-M.C.C.A. Dec. 11, 2014). App. 41 (2d Cir. Mar. 26, 2013).

Page 38 c 2020 JDFSL Digital Evidence in Criminal Cases... JDFSL V14N4

[173] United States v. Krueger, 809 F.3d [189] United States v. McNealy, 625 F.3d 858 1109 (10th Cir. Nov. 10, 2015). (5th Cir. Nov. 5, 2010).

[174] United States v. Krupa, 658 F.3d 1174 [190] United States v. Merz, 396 F. App. 838 (9th Cir. Feb. 7, 2011). (3d Cir. Oct. 12, 2010).

[175] United States v. Landsdown, 735 F.3d [191] United States v. Miknevich, 638 F.3d 805 (8th Cir. Nov. 7, 2013). 178 (3d Cir. Mar. 1, 2011).

[176] United States v. Lanzon, 639 F.3d 1293 [192] United States v. Moreland, 665 F.3d (11th Cir. May 4, 2011). 137 (5th Cir. Dec. 14, 2011).

[177] United States v. Larman, 547 F. App. [193] United States v. Myers, 560 F. App. 475 (5th Cir. Nov. 13, 2013). 184 (4th Cir. Mar. 10, 2014).

[178] United States v. Lebowitz, 676 F.3d [194] United States v. Nance, 767 F.3d 1037 1000 (11th Cir. Apr. 5, 2012). (10th Cir. Sept. 23, 2014).

[179] United States v. Leet, 406 F. App. 830 [195] United States v. Needham, 718 F.3d (5th Cir. Nov. 19, 2010). 1190 (9th Cir. June 14, 2013).

[180] United States v. Leon, 468 U.S. 897 [196] United States v. Norman, 448 F. App. (July 5, 1984). 895 (11th Cir. Oct. 4, 2011).

[181] United States v. Lizarraga-Tirado, 789 [197] United States v. Oliver, 630 F.3d 397 F.3d 1107 (9th Cir. June 18, 2015). (5th Cir. Jan. 6, 2011). United States v. Lovvorn, 524 F. App. [198] United States v. Orisakwe, 624 F. App. 485 (11th Cir. July 25, 2013). 149 (5th Cir. Aug. 5, 2015).

[182] United States v. Lowe, 795 F.3d 519 [199] United States v. Oufnac, 449 F. App. (6th Cir. July 28, 2015). 472 (6th Cir. Dec. 2, 2011).

[183] United States v. Lynn, 636 F.3d 1127 [200] United States v. Pavulak, 700 F.3d 651 (9th Cir. May 31, 2011). (3d Cir. Nov. 21, 2012).

[184] United States v. Majeroni, 784 F.3d 72 [201] United States v. Pelland, 494 F. App. (1st Cir. Apr. 27, 2015). 475 (5th Cir. Oct. 17, 2012).

[185] United States v. Manning, 738 F.3d [202] United States v. Penton, 380 F. App. 937 (8th Cir. Jan. 3, 2014). 818 (11th Cir. May 25, 2010).

[186] United States v. Martin, 297 F.3d 1308 [203] United States v. Pickett, 602 F. App. (11th Cir. Jan. 29, 2002). 774 (11th Cir. Mar. 16, 2015).

[187] United States v. McClellan, 792 F.3d [204] United States v. Pires, 642 F.3d 1 (1st 200 (1st Cir. July 6, 2015). Cir. Apr. 6, 2011).

[188] United States v. McGlothlin, 391 F. [205] United States v. Pirosko, 787 F. App. App. 542 (7th Cir. July 28, 2010). 358 (6th Cir. July 16, 2015).

c 2020 JDFSL Page 39 JDFSL V14N4 Digital Evidence in Criminal Cases...

[206] United States v. Plavcak, 411 F.3d 655 [223] United States v. Schaﬀ, 454 F. App. (6th Cir. June 6, 2005). 880 (11th Cir. Jan. 17, 2012).

[207] United States v. Price, 582 F. App. 846 [224] United States v. Schesso, 730 F.3d 1040 (11th Cir. Nov. 14, 2014). (9th Cir. Sept. 18, 2013).

[208] United States v. Pruitt, 638 F.3d 763 [225] United States v. Schwinn, 376 F. App. (11th Cir. Apr. 13, 2011). 974 (11th Cir. Apr. 28, 2010).

[209] United States v. Ransfer, 749 F.3d 914 [226] United States v. Sedaghaty, 728 F.3d (11th Cir. Apr. 14, 2014). 885 (9th Cir. Aug. 23, 2013).

[210] United States v. Raymonda, 780 F.3d [227] United States v. Seiver, 692 F.3d 774 105 (2d Cir. Mar. 2, 2015). (7th Cir. Aug. 28, 2012).

[211] United States v. Reichling, 781 F.3d [228] United States v. Sensi, 542 F. App. 8 883 (7th Cir. Mar. 27, 2015). (2d Cir. Sept. 20, 2013).

[212] United States v. Reiilly, 662 F.3d 774 [229] United States v. Seymour, 598 F. App. (6th Cir. 2011). 867 (10th Cir. Mar. 27, 2015).

[213] United States v. Rendon, 607 F.3d 982 [230] United States v. Shelabarger, 770 F.3d (4th Cir. June 17, 2010). 714 (8th Cir. Oct. 21, 2014).

[214] United States v. Renigar, 613 F.3d 990 [231] United States v. Sims, 603 F. App. 479 (10th Cir. July 13, 2010). (6th Cir. Mar. 9, 2015).

[215] United States v. Reynolds, 626 F. App. [232] United States v. South, 359 F. App. 610 (6th Cir. Sept. 11, 2015). 960 (11th Cir. Jan. 11, 2010).

[216] United States v. Richardson, 607 F.3d [233] United States v. Springstead, 526 F. 357 (4th Cir. June 11, 2010). App. 168 (4th Cir. Apr. 15, 2013).

[217] United States v. Robertson, 560 F. App. [234] United States v. Stanley, 533 F. App. 626 (8th Cir. Mar. 20, 2014). 325 (4th Cir. July 19, 2013).

[218] United States v. Roetcisoender, 792 [235] United States v. Steele, 595 F. App. F.3d 547 (5th Cir. July 2, 2015). 208 (4th Cir. Dec. 24, 2014).

[219] United States v. Rosa, 626 F.3d 56 (2d [236] United States v. Strausbaugh, 534 F. Cir. Oct. 27, 2010). App. 178 (3d Cir. Aug. 9, 2013).

[220] United States v. Rose, 714 F.3d 362 [237] United States v. Stringer, 739 F.3d 391 (6th Cir. Apr. 18, 2013). (8th Cir. Jan. 6, 2014).

[221] United States v. Russo, 408 F. App. [238] United States v. Suing, 712 F.3d 1209 753 (4th Cir. Jan. 21, 2011). (8th Cir. Apr. 10, 2013).

[222] United States v. Salva-Morales, 660 [239] United States v. Syed, 616 F. App. 973 F.3d 72 (1st Cir. Oct. 31, 2011). (11th Cir. Sept. 17, 2015).

Page 40 c 2020 JDFSL Digital Evidence in Criminal Cases... JDFSL V14N4

[240] United States v. Talley, 392 F. App. [256] Weinstein, J., & Drake, W. (2014). 129 (4th Cir. Aug. 9, 2010). Public safety, privacy, and particularity: A new approach to search [241] United States v. Terry, 522 F.3d 645 warrants for digital evidence. Electron- (6th Cir. Apr. 15, 2008). ic Commerce & Law Report, 19, [242] United States v. Thomas, 788 F.3d 345 1-6. Who does what - judges. (n.d.). (2d Cir. June 11, 2015). Retrieved November 10, 2015, from Inside the Federal Courts web- [243] United States v. Trepanier, 576 F. App. site: http://www.fjc.gov/federal/ 531 (6th Cir. Apr. 13, 2014). courts.nsf/autoframe?OpenForm& [244] United States v. Vallimont, 378 F. App. nav=menu5a&page=/federal/courts. 972 (11th Cir. May 11, 2010). nsf/page/304?opendocument. [245] United States v. Vanbrackle, 397 F. [257] Wiesenberger, G. (1992). The Supreme App. 557 (11th Cir. Sept. 22, 2010). Court and the interpretation of the federal rules of evidence. Ohio State [246] United States v. Vonneida, 601 F. App. Law Journal, 53(5), 1615-1639. Re- 38 (2d Cir. Mar. 2, 2015). trieved from http://hdl.handle.net/ 1811/64620. [247] United States v. Walden, 478 F. App. 571 (11th Cir. May 3, 2012). [258] Williford v. Texas, 172 2004 Tex. [248] United States v. Wellman, 663 F.3d App 309 (Court of Appeals of Texas, 224 (4th Cir. Dec. 7, 2011). Eastland 2004). Wilson, C. (2011, July 11). Digital evidence dis-crepancies [249] United States v. Westerlund, 477 F. – Casey Anthony trial. Retrieved App. 366 (6th Cir. Apr. 25, 2012). November 19, 2015, from Digital De- tective website: http://www.digital- [250] United States v. Wheelock, 772 F.3d detective.net/digital-evidence- 825 (8th Cir. Nov. 20, 2014). discrepancies-caseyanthony- [251] United States v. Williams, 592 F.3d trial/. 511 (4th Cir. Jan. 21, 2010). [259] Wilson, C. (2011, July 11). Digi- [252] United States v. Winkler, 639 F.3d 692 tal evidence dis-crepancies: Casey (5th Cir. Apr. 25, 2011). Anthony trial [Blog post]. Re- trieved from Digital Detective [253] United States v. Woerner, 703 F.3d 527 website: http://www.digital- (5th Cir. Feb. 22, 2013). detective.net/digital-evidence- [254] United States v. Wurie, 612 F. Supp. discrepancies-caseyanthony- 2d 104 (2009). trial/. [255] Ward, K. B. (2011). The plain (or not [260] Yellon, A. (2009). The fourth amend- so plain) view doctrine: Applying the ment’s new frontier: Judicial reasoning plain view doctrine to digital seizures. applying the fourth amendment to elec- University of Cincinnati Law Review, tronic communications. Journal of Busi- 79(3), 1163-1187. https://doi.org/10. ness & Technology Law, 4(2), 411-437. 15779/Z38GS5N. Zappala, R. A. (2008). Evidence ESI

c 2020 JDFSL Page 41 JDFSL V14N4 Digital Evidence in Criminal Cases...

and the hearsay rule. 2008 FDCC winter meeting, pp. 2-5.

Page 42 c 2020 JDFSL