« Ind. Decisions - "The Indiana Securities Law requires more of a director than a simple assumption that all is well." | Main | Ind. Courts - "Monroe courts picked as computer test site" »

Tuesday, November 27, 2007

Ind. Courts - More on "Admissibility of electronic evidence -- is it "authentic"?

On Nov. 16, 2007 the Lafayette Journal & Courier published a story headlined "Transcript leads to man's conviction," written by Sophia Voravong, that reported:

For nearly two hours Wednesday, a Tippecanoe County jury listened to a sordid exchange between a 24-year-old man and someone he believed was a 13-year-old girl.

The line-by-line recitation came from several online conversations that Justin W. Hicks, now 25, of New Castle had with the "girl," in which he detailed wanting to perform kinky sexual acts on her.

It was a key piece of evidence presented by the Tippecanoe County prosecutor's office during a two-day trial in Tippecanoe Circuit Court -- resulting in Hick's conviction Thursday of two counts of Class A felony attempted child molestation and five counts of Class C felony child solicitation.

Jurors deliberated for about three hours before returning the verdict.

"He was found guilty as charged," deputy prosecutor Laura Zeman said. "We're pleased because we don't want child predators traveling to our community to have sex with our children."

Hicks, a prison guard at New Castle Correctional Facility, was arrested as part of an undercover sting by the Lafayette Police Department. The "girl" he had been chatting with was detective Sgt. Tom Davidson.

He showed up in December 2006 to a Lafayette apartment where he believed the teen lived. The meeting had been arranged online.

Given that authentication of computer-related evidence is a relatively new area, the ILB wondered about the steps the prosecution took to get the chat room conversations admitted. In response to a question from the ILB, an observer at the trial responded:
The detective posing as the girl and an a female investigator actually read printed pages of the transcripts out loud. The detective read the suspect's "lines" and the investigator (a female) read the 13-year-old's lines.

There were probably a good 20 pages or so of printed chat from a Yahoo chatroom, took about two hours for them to go through it all line-by-line (every LOL, brb, etc).

I know the detective saved each chat at the end and those were copied to a disk. He also printed off copies. They seized Hicks' computer, too. I'm not sure how exactly it works, but we have a similar chat system and you can save all chats verbatim. It gives a timestamp after each entered line.

The ILB sent a message to the proscutor asking about how the chat room conversations had been authenticated, but received no response.

In an entry dated June 18th, headed "Admissibility of electronic evidence -- is it "authentic"?", the ILB pointed to the May 4, 2007 opinion issued by U.S. Magistrate Judge Paul W. Grimm in the case of Lorraine v. Markel (D Md). The ILB posted the 101-page opinion online, along with a linked TOC. From the TOC it is easy to see the five evidence standards that electronically stored information must satisfy in order to be admissible under Judge Grimm's ruling. These are (1) relevance, (2) authenticity, (3) hearsay, (4) the original writing rule, and (5) balancing probative value against unfair prejudice.

[The second standard, authenticity, has been the focus of several Res Gestae articles I have written, focused on the problems of assuring the authenticy and admissibility of Indiana rules and statues where the official text of these basic legal documents is no longer available in print, but solely online.]

Judges Grimes' May 4, 2007 ruling has a discussion on the admission of "Text Messages and Chat Room Content," found on pp. 43-44 of the Md. federal court opinion.

Interestingly, another federal district case, out of Nebraska, issued a little over a month earlier than Lorraine, illustrates what can go wrong in the authentication of chat room discussions. The decision is U.S. v. Gerald Jackson (D. Neb., 3/28/07), and involves a motion in limine to exclude the chat room evidence. Some quotes:

In his current motion in limine, defendant seeks an order prohibiting the government from introducing the cut-and-paste document of alleged online chat conversations between “gnesta18" and “k8tee4fun” into evidence at trial. * * *

The evidence at issue involves certain “instant message” or “chat” conversations conducted via computer between Margritz, posing as fourteen-year-old girl with the screen name k8tee4fun, and the defendant, using the screen name gnesta18. The conversations occurred between July 17, 2001, and August 14, 2001. The parties agree that both defendant’s and Margritz’s computers are missing. The parties also agree that there are no longer original electronic computer printouts or copies on floppy discs or hard drives or disc drives capturing the computer conversations between Margritz and the defendant during that period of time. None of the conversations were saved. It appears from the testimony of Margritz that he wiped his computer clean during a routine upgrade a couple of years after this investigation. Although it is not totally clear, the court believes the government agrees that the computer seized from the defendant has been lost or destroyed. Consequently, the government is attempting to introduce copy-and-paste notes taken by Margritz from the online chats and saved into a Microsoft Word document. Defendant objects to the admissibility of this evidence.

Margritz testified he conducted the online sting operation that resulted in the arrest of Jackson. He further testified that, at the end of each chat session, he saved the conversations between k8tee4fun and gnesta18 by clicking and dragging to highlight the complete conversation from start to finish. Filing No. 71 at 11, 18. He then copied and pasted the entire selection into a word processing document in Microsoft Word. Id. He testified that he saved each conversation chronologically in an ongoing log. Filing No. 71, 12:1-2; 18:14-16. He further testified that immediately after he copied and pasted the conversations into Word, he made another copy for himself and added certain notes and edits to that copy. Filing Nos. 71, 73-74, 77-78. He acknowledged that it was possible to leave out words if they were not properly highlighted and dragged, but stated that there was no human error in this case because he took “great pains” to look back at the screen and make sure he captured everything accurately before closing the chat window. Id. at 12-14, 21-22. He further testified that he never modified the document in any way. Id. at 12:9-13. He testified that he never relied on the archives of Yahoo, apparently because it was unavailable or he had been told it was not reliable.

Kevin H. Peden, a computer forensics expert, also testified at the hearing. He stated that he had seventeen years of law enforcement, had background experience investigating crimes involving children, and he had a computer engineering degree from Spokane Community College. He received training at the computer forensic boot camp, and he attended the NTI school of forensics. He has a computer certificate from Oregon State. He testified that he has conducted over 100 investigations and worked on fifteen child pornography cases. He testified that he always produced a bit-stream image of the hard drive, which was the forensic copy of the hard drive and is the best way to confirm the chat. Peden testified that the bit stream image would be the only way to see the evidence exactly as it appeared during the conversations. According to Peden, other ways to accurately save computer chats would include a screen capture where a log file is saved to the hard drive, found in unallocated space, or use of the ypager log found in Yahoo. He also testified that there were third-party software programs available in 2001 that would accurately save the online chats, and the basic “print screen” and “file-print” options would likewise have captured the entire chat. Peden testified that the cut-and-paste method employed by Margritz was the least effective way to capture the chat log. Filing No. 72, 19:4-12. * * *

The court finds the cut-and-paste document is not admissible at trial. First, the burden is on the government to show the document is authentic. United States v. Black, 767 F.2d 1334, 1342 (8th Cir. 1985); Fed. R. Evid. 901(a); United States v. Tank, 200 F.3d 627, 630 (9th Cir. 2000). The government must make a foundational showing that the transcript is trustworthy. United States v. Webster, 84 F.3d 1056, 1064 (8th Cir. 1996) (with regard to recording). The government attempts to introduce the editorialized version of the cut-and-paste document. However, the court finds the evidence offered by Peden is credible and supportable. Peden testified about a number of methods that could have been utilized to accurately capture the chats, but none of these methods were used. As set forth above, there are numerous examples of missing data, timing sequences that do not make sense, and editorial information. The court finds that this document does not accurately represent the entire conversations that took place between the defendant and Margritz. The defendant argues that his intent when agreeing to the meeting was to introduce his grandniece to the fourteen-year-old girl. Defendant is entitled to defend on this basis, as it goes to the issue of intent. Defendant alleges that such information was excluded from the cut-and-paste document or from a lost audiotape of a phone conversation between him and Margritz. The court agrees and finds the missing data creates doubt as to the trustworthiness of the document. See, e.g., Webster, 84 F.3d at 1064 (government must show trustworthiness of tape recording). Changes, additions, and deletions have clearly been made to this document, and accordingly, the court finds this document is not authentic as a matter of law.

Second, in the alternative, defendant argues that the cut-and-paste document is not admissible as it is not the best evidence. This rule provides an original writing or recording to prove the truth of the contents. Fed. R. Evid.1002. A computer printout is considered the original if it accurately reflects the data. Fed. R. Evid. 1001(3). The same is true of a duplicate. Fed. R. Evid. 1001(4), 1003. As the court has previously stated, the cut-and-paste document offered by the government is not an accurate original or duplicate, because, as previously noted herein, it does not accurately reflect the entire conversations between the defendant and Margritz. In addition, Margritz changed this document by including his editorial comments. Unlike the cases relied on by the government in its brief, in the case before the court there is expert testimony that the cut-and-paste document has been altered. Accordingly, for these same reasons the court likewise finds the cut-and-paste document inadmissible. In that same regard, the court finds the document is inadmissible under Fed. R. Evid. 1004 (allows for the secondary evidence when original is destroyed). See United States v. Gerhart, 538 F.2d 807, 809 (8th Cir. 1976). It is clear that the proposed document does not accurately reflect the contents of the original.

The government relies heavily on United States v. Tank, 200 F.3d 627 (9th Cir. 2000) and United States v. Simpson, 152 F.3d 1241, 1249-50 (10th Cir. 1998) for the proposition that chat room logs are admissible. The court finds the cases relied on by the government to be of little assistance. In both cases, it appears that the actual computer files were offered as evidence, not a cut-and-paste version of the computer files. The court would have no difficulty admitting evidence which had been saved on the computer and was the actual computer printout. The cut-and-paste document is not a computer record nor is it a computer printout. * * *

The motion in limine is granted and the cut-and-paste document is excluded for all purposes.

The ILB had an entry earlier this year about another chat room conviction, in federal court, involving a former coach "charged with trolling the Web for sex with young girls," according to the NWI Times (see 7/15/07 ILB entry here).

Posted by Marcia Oddi on November 27, 2007 03:00 PM
Posted to Ind. Trial Ct. Decisions