Discovery in Child Pornography Cases

There’s a recurrent discovery issue in child pornography cases. Generally, it goes like this: the defendant is arrested and charged with a child pornography offense. The prosecution contends that the defendant’s computer contains images of child pornography. The defendant retains a computer expert to examine his computer, hoping to show that the images were downloaded inadvertently, or were downloaded by someone else. The expert requests a copy of the defendant’s hard drive so that the expert can analyze it. The prosecution refuses to provide a copy on the grounds that doing so would amount to distributing child pornography to the expert, so the defendant files a motion asking the court to order the prosecution to provide a copy of the hard drive.

In federal cases, there is a statute that guides the resolution of this issue. Under 18 U.S.C. § 3509(m), “a court shall deny . . . any request by the defendant to copy, photograph, duplicate, or otherwise reproduce any property or material that constitutes child pornography . . . so long as the Government makes the property or material reasonably available to the defendant.” Evidence is “reasonably available” if “the Government provides ample opportunity for inspection, viewing, and examination at a Government facility of the property or material by the defendant, his or her attorney, and any individual the defendant may seek to qualify to furnish expert testimony at trial.” The statute has been upheld against a variety of constitutional challenges. United States v. Shrake, 515 F.3d 743 (7th Cir. 2008); United States v. Spivack, 528 F.Supp.2d 103 (E.D.N.Y. 2007) (collecting cases).

Litigation has focused on what constitutes an “ample opportunity” to review and analyze evidence. Among the leading opinions in this area is United States v. Flinn, 521 F.Supp.2d 1097 (E.D. Ca. 2007), which states:

An ample opportunity to forensically examine seized computer items means an examination whereby the government can supply reasonably up-to-date tools (hardware and software) and facilities such that a defendant can construct a reasonable, available forensic defense, if one is available at all, and whereby the analysis will not be impeached because it was not supported by the proper hardware or software. An ample opportunity will permit a defense expert to utilize his or her hardware or software. An ample opportunity also requires that the analysis be performed in a situation where attorney-client privilege and work product will not be easily, accidentally exposed to the government, and in a facility which is open to the defense at its request during normal working hours, and to the extent feasible, during non-working hours.

I am aware of only one published case in which a court has ruled that the government failed to give the defense team “ample opportunity” to analyze the defendant’s computer. In United States v. Knellinger, 471 F.Supp.2d 640 (E.D. Va. 2007), a defendant argued that he needed a team of experts to analyze video files on his computer to determine whether the files involved real children or virtual representations of children. The defendant’s experts testified that conducting the analysis at a federal facility would involve a week of moving fragile and expensive equipment and a cost of over half a million dollars. Based on the defendant’s showing and the specific facts of the case, the judge ordered that a copy of the defendant’s hard drive be given to the defense team, pursuant to a protective order. Aside from Knellinger, however, courts have generally denied defendants’ requests for copies of digital evidence in child pornography cases, finding that such evidence can be analyzed adequately in a government facility.

But that’s federal court. Section 3509(m) doesn’t apply to state cases: it refers to the Federal Rules of Criminal Procedure and describes the prosecution as the “Government.” State v. Allen, 2009 WL 348555 (Tenn. Ct. Crim. App. Feb. 12, 2007) (unpublished) (“Section 3509(m) does not apply to proceedings in Tennessee state courts.”) Nor is there any other specific statutory provision in North Carolina concerning how child pornography should be handled in discovery.

That leaves us back at square one. Under the general provisions of G.S. 15A-903, images or videos alleged to contain child pornography clearly count as “matter[s] or evidence obtained during the investigation” of the child pornography defendant, and so are presumptively available to be copied by the defense. Yet some prosecutors worry that copying such evidence violates state and federal child pornography laws. What to do?

I’ll start by suggesting that the concern about violating the law by distributing child pornography during discovery may be a bit overblown. By that reasoning, the prosecutor in every child pornography case violates the law by possessing the child pornography, and the prosecutor violates the law during every child pornography trial by distributing the child pornography to the court clerk, the judge, and the jurors. Likewise, the prosecutor in a drug case would be liable for possessing the drugs introduced as evidence, and for distributing the drugs to the clerk during the trial. I assume that there’s an implicit “official duty” exemption that would preclude prosecution in such circumstances, and I’m not aware of a single prosecution based on similar facts.

Nonetheless, I can understand a prosecutor not being enthusiastic about making additional copies of child pornography. (And frankly, if I were a defense lawyer, I wouldn’t be too excited to receive them. Consider United States v. Flynn, __ F.Supp.2d __, 2010 WL 1782157 (D.S.D. Apr. 28, 2010), where an attorney being prosecuted for possessing child pornography claims that he possessed the images in connection with his work.)

The solution, it seems to me, is to move for a protective order under G.S. 15A-908, which allows a court, upon a finding of “good cause,” to enter any appropriate order regarding discovery. Presumably, the court’s discretion includes the authority to enter an order along the lines of what section 3509(m) requires in federal court: that the defendant be given “ample opportunity” to inspect and analyze the digital evidence at a law enforcement facility, but not be given a copy, absent special circumstances that require the making of a copy in a particular case. Although I’m not aware of a North Carolina case on point, cases in other states have generally recognized some discretion to limit defense access to child pornography. Cf. State v. Brady, 894 N.E. 2d 671 (Ohio 2008) (proper to limit defense access to child pornography evidence to the state’s computer system); State v. Bowler, 772 N.W.2d 666 (Wisc. Ct. App. 2009) (court has the discretion to order copying or to forbid it). But cf. State v. Johnson, 2010 WL 1424369 (Ariz. Ct. App. Div.1 Apr. 8, 2010) (unpublished) (affirming dismissal of charges after defendant provided valid reasons for needing a copy of the digital evidence yet the agency with custody of the evidence refused to produce it). It may be useful to think of digital evidence of this type as analogous to controlled substances seized from the defendant — the defendant should be granted reasonable access to drug evidence for the purpose of analysis and testing, but need not be allowed to take the evidence off the premises of a law enforcement facility. As an aside, the SBI, and probably many other law enforcement agencies, have facilities designed for defendants to use to review digital evidence in privacy.

24 thoughts on “Discovery in Child Pornography Cases”

  1. Food for thought: As a prosecutor of these cases, I do not maintain a copy of the child pornography in my file. I treat this contraband like any other. We don’t have cocaine seized in cases in our office either. When it is time to prepare for trial, I go to the investigators office and review the evidence just like the defense attorneys do.

    Reply
  2. If anyone is interested, I have a protective order issued by Judge Webb, which I can share. It basically allowed the state to provide me with a CD-ROM copy of the images, only for the use of my office and the defense experts, with the images to be destroyed at the end of the case.

    It doesn’t address the possession issues stated in the article, but it certainly made me feel safer “possessing” the material during defense preparation.

    Reply
  3. Interesting take on these issues and expertly analyzed. Have you done any follow up work to explore how this is being resolved in the state and federal courts since the date of your post?

    Reply
  4. No. The FTK report, unless you’re including thumbnails of the contraband images, is purely metadata (data about the underlying data). Likewise, I suspect –but have not yet validated myself– that producing a FTK case backup or archive, which would allow the case to be restored (so long as the original media/image is attached), should also be devoid of contraband, so long as the evidence processing criteria did not include creating thumbnail images.

    Reply
  5. You wrote, “I am aware of only one published case in which a court has ruled that the government failed to give the defense team “ample opportunity” to analyze the defendant’s computer.” (citing U.S. v. Knellinger, 471 F.Supp.2d 640 (E.D. Va. 2007)). As of July, 2011, there have been several additional cases, and a decent body of caselaw regarding what constitutes “reaonable access” and “ample opportunity.” Also, several state courts, including Massachusetts, Minnesota, Tennessee, and Missouri, have ruled that the Adam Walsh Act does not apply to state criminal proceedings, although none have resolved the question of whether the FBI can prosecute a defense attorney or expert who has taken custody of contraband under those state statutes or court rules (or, alternatively, under a state court protective order).

    Reply
  6. Can anyone please give me any information on how long a case should generally be in the court system? It took 5 years to bring state (NC) charges, and the Feds did not want the case. Since the arrest it has been about 3.5 years. To me both seem like a long time. It may be 9 – 10 years total before trial or plea. Also, the computer in question was a laptop and it was removed from a home be estranged wife and kept in her possession for 2-3 months before it made its way to local authorities via a college security officer. Does anyone have any information about chain of custody?
    Thanks for any and all help.

    Reply
  7. Can anyone provide any information about exculpatory evidence in regards to download dates and times and if they were altered? Any advise – what if a public defender tells a defendant on their first meeting that he can get 3 of 4 charges dropped if defendant pleas to 1 charge, and will only get 5 years probation?
    To me this does sound really crazy. I do have brain damage and do not understand things as most people do, but it even sounds like the public defender wants a guilty plea or charge. Should that be the case?

    Reply
    • Ummm, any data on a computer’s hard-drive can be manipulated to show certain dates/times by simply changing the date in the computers BIOS to any date he so chooses. For instance, a dirty cop could acquire your “clean” hard-drive, go into his BIOS on his system and change the date back to a certain time when he might want to say you downloaded a file, then proceed to put a “dirty” file onto your hard-drive and the date/time stamp of that file will coincide with his “time-backed” system and adjusted BIOS date. Use of date/time stamps of files on hard-drives seized should not be admissible without the corroborating proof by the prosecution of coinciding data from an ISP showing a match. It would be easy to show how data on a hard-drive can be manipulated to get evidence tossed out.

      Reply
      • Even easier than resetting the system date, with the right tool, you can directly modify access and creation date metadata, outside of the OS.

        Which is why the physical location of the files on disk, as well as metadata is examined in order to determine if a file were actually created at the same time as other files located in the same time-frame.

        Such actions are not, however, available to the general user, and if such changes are suspected, more proof will be needed in order to state that such modifications are probable in a particular case.

        OS’s which use journaled file systems (such as the Mac,) can provide better information regarding metadata because they record all activity for each file. But Windows systems, and even Macs, do not default to journaled file systems, which do require additional drive space and CPU time.

        Reply
      • Has anyone considered the actual internet chain of evidence custodial issues in these cases? And- in the multi-jurisdictional environment, did overseas agencies violate American due process, and possibly entrap a suspect?

        The fact that there are 1) multiple ‘internets’ across the various intelligence agencies, etc. 2) today, we see that InfraGard and Fusion Centers are ‘gray areas’ where unknown conduct occurs 3) the nature of the hidden investigations amost forces one to ask what exactly precedes the defendants use f tis material- ow much of the pre-arrest investigation was actually a hidden effort, and what records did it leave?

        And many more questions. The fact that ‘terrorists’ are often found with cp, and the post-Edward Snowden playing field almost begs the question: are some of these prosecutions actually mind control that sweeps up unsuspecting targets of intelligenece operations?

        Reply
    • Most attorneys, especially public defenders, want nothing to do with these types of cases. Sadly, a plea is better in most cases since juries judge sex crimes harshly, regardless of the evidence. Once they see the images, a “Not guilty” is not likely. My husband did not take a plea and was found guilty of nine counts of 3rd Degree Sexual Exploitation of a Minor. The images were in a temporary Internet file, not saved, and downloaded the morning of the search. His girlfriend at the time has admitted to a couple of people that she did it to set him up. She got her wish and the judicial system handed him over to her on a silver platter.

      Reply
  8. I have handled hundreds of cases as an expert and have not once found evidence of tampering by law enforcement. Changing the dates on a few files is a simple operation, but it is detectable if proper chain of custody has been maintained. There are methods for finding date tampering on a computer hard drive, but they are complex and time consuming.

    Download dates alone are only a small part of the evidence in a case. The whole case needs to be examined for exculpatory evidence.

    Reply
  9. How does the Child Porn law in Michigan turns the First Amendment upside down? Case in point: In 2005, Grand Traverse County’s “Computer Cop” believed he found child porn on a CD-R in a cyberstalking case. Early 2006, Grand Traverse County prosecutors authorized child porn possession charges (4 & 7yrs) based on two videos originating from the internet. A local pediatrician opined they both had underage girls in the two videos. Defense countered one originated from a legal, adult website based in California. The ONE other video could not be proven to satisfy the Affirmative Defense (18+yo). Prosecution pressed on in May of that year and motioned to add 20yr charge a few days before defendant caved-in to a plea of the single 4yr charge. TC felon did 44 months in prison on the charge, and he recently identified the female in the video and confirmed she was 18 when the video was made. MCL 750.145c(5) & (7) are the Michigan statutes that cover the use of “expert” testimony as admissible evidence to attain a conviction and the Affirmative Defense that was practically impossible to use at the time to avoid a conviction.

    Reply
  10. Hey Mr. expert can you explain why about 10,000 innocent people are convicted every year? Do you thinkl it might have something to do with prosecutors being immune from prosecution and law suits even when they manufacture evidence, pay witnesses to lie and knowingly sent innocent people to prison or worse? Go to google and type in the infallible prosecutor and read the story!

    Reply
  11. hi,
    taking a class could anyone tell me what you would do if you found a computer with two images of child pornography on it and did not have COFEE with you.

    Reply
  12. I do many of these forensics cases and in every case there is no need for me to have actual possession of the actual images or video in these cases. Simply having the hashes of those files allows me to compare to the same resources that law enforcement uses to identify the proliferation in the first place.

    The key to defending these cases in many instances is the identification of where the images or videos originated and how they ended up on a suspects computer. Building a time line of activity is very easy and time based analysis as well as the determination of where the files originated, if they are actively being shared on the Internet, how old the imagery is, how long it has it appeared on the Internet and who is sharing it.

    In many cases the people trading this material mess up and expose themselves which is how they get charged in the first place. We have seen cases whereas images appeared on servers owned by the State of North Carolina a few years ago as the servers were hijacked and being used to distribute the content. Had this been a home user there would have been a conviction for sure. There are many cases where people are convicted and are innocent and then there are cases that things are not so clear but a conviction follows and cases where all evidence points to a subject being guilty yet they plea to a lesser charge and that’s the end of it.

    To be honest in my opinion I think the laws need to be changed and just like anything else merely showing a file exist should not be a reason for conviction as it should be up to LE to show where the file came from, how it got there and that it was stored intentionally.

    Reply

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.