Computer Porn Charges Dropped: No Possession Of Images Found In Temporary Internet Files And In Lost Files
As part of an unrelated investigation, detectives from the Port St. Lucie Police Department and Martin County Sheriff’s Office (MCSO) went to AR’s place of business. AR was “cooperative” and made non-custodial statements about both the unrelated investigation and the computer found at his place of business.
The MCSO secured a search warrant for the place of business which was executed on the same day. The officers seized a computer, peripherals and related items from the place of business for subsequent inspection.
AR was arrested on May 26, 2005, for possession of computer pornography. The State filed a 13-count information on June 15, 2005.
AR retained and discharged two separate attorneys following his initial arrest and prosecution. AR was being represented by his third attorney, Fran O. Ross, when he retained Jeffrey H. Garland to assist with the cases. Garland was retained at the end of February, 2006. Garland worked with Attorney Ross as part of a team defense.
Although the computer pornography case was almost ten months old at the time that Garland was retained, the State had provided no technical discovery regarding the computer or the images. Attorney Garland immediately filed a request for additional discovery on March 7, 2006, which requested internet service provider (ISP) records and any computer forensics report, as well as a list of any computer experts upon which the State might rely at trial. The following day, Attorney Garland filed defendant’s first witness and evidence list, which included computer forensics expert, John A. Magliano, and the following published material: Electronic Crime Scene Investigation: A Guide for First Responder (published by United States Department of Justice (USDOJ)); Forensic Examination of Digital Evidence: A Guide for Law Enforcement (published by USDOJ); and Digital Evidence and Computer Crime (authored by Eoghan Casey).
The State responded to the request for additional discovery by listing Dr. Philip Colaizzo, an expert in pediatric sexual abuse. Dr. Colaizzo could be expected to provide opinion testimony regarding the images which were found on the computer, but not yet disclosed to the defense. Garland responded to the State’s listing of Dr. Colaizzo by filing defendant’s second request for additional discovery which sought any report which may have been prepared by Dr. Colaizzo as part of his evaluation of evidence in this case. It would later be determined that Dr. Colaizzo had not prepared any report and, in fact, had no independent recollection of the case.
Dr. Colaizzo had been previously listed by the State as a pediatric sex abuse expert in other cases. Attorney Garland was familiar with Dr. Colaizzo’s expertise. He usually provides expert opinions as to the ages of persons depicted in questioned images, e.g.: under the age of 18, or under the age of 12. Dr. Colaizzo is an expert who virtually volunteers his time. As such, he is not the typical “hired gun” expert. Attorney Garland spoke directly with Dr. Colaizzo in an effort to schedule his deposition. It was during this process that it became apparent that Dr. Colaizzo had no recollection of reviewing the questioned images or that, possibly, he had never viewed the images in this case.
Garland filed defendant’s motion to compel discovery on March 31, 2006. This motion sought to require the State to produce the En Case Computer Analysis Report, which was referenced in other police reports, but never produced as part of the discovery. The State would subsequently provide a copy of the report.
Upon receiving the En Case Report, and conferring with computer expert, John Magliano, Garland requested for the State to allow a defense examination of the digital “mirror image” hard drive which was created as part of the law enforcement investigation. It is important for law enforcement to properly handle digital evidence. If a computer is improperly processed, valuable digital evidence may be lost, or the context of such evidence may be obscured. The loss of such evidence may either hinder the prosecution of a given case or impede the defense. In fairness, therefore, the US Department of Justice has created guideline manuals for handling computers and related equipment, so that the risk of data loss is minimized.
In this case, the computer was seized from AR’s place of business, then transported to the MCSO for subsequent examination. The State utilized MCSO Det. Brian Broughton as its computer expert to conduct the computer examination. To preserve and maintain the integrity of the original hard drive, the examination procedure involves the creation of a byte-by-byte duplicate of the original hard drive, which is sometimes referred to as a “mirror image” of the original. Special software is utilized which allows the mirror image hard drive to be created without changing the original in any way. The purpose of this process is to maintain the integrity of the original evidence.
As part of this examination procedure, Det. Broughton found 13 images which he believed depicted minors in inappropriate ways. These are the “questioned images”.
Attorney Garland requested the State to allow the defense expert, John Magliano, to examine the mirror image hard drive using a police computer. It was important to allow access to the police computer, because the police computer was loaded with the special software which allowed a forensic examination of the mirror image hard drive.
At the agreed time, Det. Broughton was present for the examination. Det. Brougton was courteous and helpful during the course of the examination. Magliano was given an opportunity to review the location of the questioned images within the mirror image hard drive. The location of the questioned images would provide information whether the images were intentionally saved into the computer and whether they were still accessible to a person using a Windows operating system.
Magliano found that all 13 of the questioned images were located either in the temporary internet files or in “lost files”. None of the images had been intentionally stored on the hard drive. The “lost files” could not have been accessed using a Microsoft operating system.
Det. Broughton theorized that the “lost files” became that way when the original Windows operating system was reinstalled on April 10, 2005. However, during his deposition, Det. Broughton was unable to determine whether a new operating system was installed or the old system was reinstalled or updated. During the comprehensive search of AR’s place of business, no installation discs for a Windows operating system were found. The only internet access available at AR’s place of business was via a dial-up telephone connection. Det. Broughton had no knowledge whether an operating system could be downloaded via a dial-up connection. Even if it could be, there was no indication via the records of the ISP that such a lengthy download actually took place.
Det. Broughton theorized that AR had intentionally reinstalled the operating system in a calculated effort to erase inappropriate data which may have been on the computer. As just noted, Det. Broughton’s theory was unsupported by actual evidence. The defense expert theorized, to the contrary, that such a download through a dial-up connection would have been impossible without leaving an obvious footprint. In the absence of such a footprint, the only reasonable conclusion would be that no operating system was downloaded on April 10.
It became clear that law enforcement forensic expertise did not extend to the details of how the Windows operating system works. This is an important fact, because police inferences often depend upon certain assumptions about the Windows operating system. If the forensic expert does has insufficient training and experience, then the conclusions may be unsupportable. In this case, the State’s expert could not determine when the questioned images became lost files or what may have happened in order to cause them to become so.
The defense expert further considered the questioned images located in the temporary internet files. Based upon the general appearance and size of the questioned images, as well as their digital signatures, the defense expert believed that the questioned images were actually pop-ups, advertisements or banners. Magliano said that these types of internet advertisements could appear without any intentional and willful act by the computer operator. There was no evidence that the computer operator (who the State assumed was AR) actually “clicked on” any one of the images or on any site which could have been accessed through a web address located on the advertisements.
How does one determine whether an image might be an advertisement? There are several factors which might be considered:
The defense expert examined the registry and security settings on the computer. He found that the security settings were low and, specifically, did not prohibit pop-ups. These settings provided an ample opportunity for internet advertisers to access the screen without the computer operator wishing or desiring to receive such advertisements. In this case, the computer examination determined that the ISP was Netzero. The defense expert observed that Netzero software provided little assistance to customers to prohibit, restrict or block unwanted advertisements. Unwanted advertisements can substantially impair the usefulness of a computer – especially when internet access is via a dial-up connection. As part of his statement to law enforcement, AR explained that inappropriate images had popped up on the screen “like cards in a deck”. He denied intentionally conjuring up the images by any willful act. To the contrary, AR said he did all that he could to eliminate those images. There was nothing in the computer examination to disprove AR’s assertions. The defense expert examined the questioned images found in the temporary internet files. There was no indication that the questioned images had been accessed or reaccessed by clicking on the internet history. A computer operator can use internet history to access or re-access a website used previously that day or another day or event another week. After the defense examination of the duplicate hard drive was completed, Attorney Garland filed a motion to dismiss, alleging that AR was not in “possession” of questioned images located in the temporary internet files, and similarly, that he was not in possession of questioned images located in lost files. See Strouse v. State, 932 So.2d 326 (Fla. 4th DCA 2006). The motion was never ruled upon. The State elected to drop all 13 counts of possession of computer pornography in return for resolution of the “other” case, which did not involve a computer. State v. AR, Martin County Case No. 05-CF-760. |