Dissenting judge in CP case argues that "sexual predator" label for 17 yr old offender, as applied, was cruel and unusual punishment

In In re Welfare of: J.E.M., 2012 Minn. App. Unpub. LEXIS 326, a 17-year-old's conviction for possession  of child pornography was upheld; that's not the main story, though. Judge Randall, concurring specially, made an impassioned argument that under the facts of this case, which were somewhat tenuous, applying the sexual predator label to a 17-year-old (for ten years) who hadn't actually had anything to do with their production or distribution, but had merely looked at them, "begs a constitutional challenge on the grounds of 'arbitrary and capricious, and cruel and unusual punishment.'"

The facts of the case are interesting in that the basis for the conviction was on circumstantial evidence, tied with an analysis of the thumbs.db file. Thumbs.db is created when images are opened in thumbnail view, or in full. The file has essentially mini-images of the files within the directory that were opened/looked at/viewed in thumbnail. The defendant was alleged to have looked at 54 images of child pornography, by way of their inclusion in the thumbs.db. When doing forensic analysis, sometimes it is hard or impossible to tell whether someone viewed a file in a large enough form to prove that they knew it was child pornography. Thumbs.db is created if the images are icon size or full gallery view.

Tied with the thumbs.db was the time of access, which was nailed down to when the defendant had possessed the computer and logged in with a password. The court essentially deferred to the determination of the jury with respect to fact-finding and appeared to give deference to the agent who had testified regarding whether or not the defendant had actually viewed the files.

In my opinion, a conviction of a 17-year-old under this factual scenario may be somewhat harsh - given the mandatory 10-year "sexual predator" label and the lack of concrete evidence of how the defendant viewed the images, or if he did so repeatedly (or whether they just loaded as part of a page he did not view in totality). But, I am of the opinion that the jury was in the best position to make this determination and to assess the veracity of the evidence, so upholding the conviction was proper.

Judge Randall, in his concurrence, first describes the mandatory label as something that should not be slapped on without a determination of context. He then goes on to lament the effect such a label would have on an individual over the course of that 10-year period - that it wouldn't just be for those ten years, but would essentially be a life sentence, and that it would prevent the individual from obtaining a large swath of occupations. He states, colloquially, that:

A man or woman with the label "predatory offender" applies for an advertised job at a loading dock and passes the basic fitness and aptitude tests and now there are 10 qualified applicants for five openings. What does the foreman/boss say behind closed doors, "for  ___ sake, dump that assaulter, pedophile, sexual deviant, or whatever the hell he is!"

He then makes what I believe to be a strange argument - that the fact that the Internet is filled with porn is reason to excuse the defendant's behavior to some degree; that it was just part of being on the Internet. He opines that "[t]he figures vary, but approximately 60% to 80% of worldwide computer Internet is pornography. If you cannot find it on your computer, you do not even know how to read your email."

Judge Randall then begs the question of why there is what I would call an "offensiveness gap" between pictures of 17-year-olds vs. 18-year-olds:

Minors are supposed to make it so terribly more offensive?! If you have scantily clad or naked 17-year-olds "doing time" in the "Caymans?" why is that so much more offensive than naked or partially clad 18-year-olds "doing time" in the "Caymans." 

I understand the argument, but I think this distinction is an inevitable part of drawing a line at what age pictures of individuals constitute child pornography. Also, it is nearly impossible (without knowing about the individual in a picture beforehand) to determine what the exact age of a person is in a pornographic image.  When you search (as a forensic investigator) a computer for CP, you are operating under the "I'll know it when I see it" credo - which typically pushes that age at which you would call something child pornography below even 17. But regardless, this argument is fruitless here because the pictures the defendant was alleged to have looked at were of a 9-year old girl. 

Judge Randall concludes by reiterating that the Minn. statute that requires the mandatory predator label for life (essentially) without a judicial assessment of the context of the situation "is an unconstitutional denial of due process, and is so arbitrary and so capricious and so damaging that it is cruel and inhumane punishment as applied in this case."

I believe this to be a constitutional overreach by the judge given the substantial interest the government has in preventing child pornography, as well as protecting the community from individuals who have exhibited behavior consistent with that equated with sexual offenders. Additionally, its hard to see where a case like this fits within juvenile 8th Amendment cases such as Roper v. Simmons, 543 U.S. 551 (2005) - but more importantly, cases where juveniles have been tried as adults. However, Judge Randall does gain a modicum of support from the Ohio Supreme Court - in In Re C.P., 2012 Ohio 446 (2012), the court held that a juvenile, not tried as an adult, was subject to cruel and unusual punishment when he was required to register as a sex offender for life. But there, it was key that he was tried within the juvenile system. This case can clearly be distinguished.

I am sympathetic to the argument that kids do make mistakes and this is quite a harsh punishment. I just don't think sympathy is enough.

Read More

Last week's tweets from @CybercrimeRev

Don't forget to follow Cybercrime Review on Twitter (@CybercrimeRev). Here are some of the stories we've tweeted about in the past week that we didn't discuss on the blog.

• 92-year-old WWII vet sends bootlegged movies to American soldiers abroad
• Germany's high court holds that phishing victims' losses are their own fault
• Justice Department clears Google in Wi-Fi sniffing scandal
• How to wipe your hard drive DoD-Clean
• Employee snooping in IRS database: it’s like looking people up on Google or Facebook
• The political effects of conflating separate meanings of "cybersecurity"
• Facebook announces more than 901 million users
• India now world's leading spam source

Read More

6th Circuit finds probable cause to search camera for evidence of underage drinking, one judge disagrees

The Sixth Circuit recently affirmed the denial of a motion to suppress in United States v. Westerlund, 2012 FED App. 0440N (6th Cir.). In the case, a 15-year-old boy was found drunk by his parents. He and his girlfriend claimed that Westerlund gave them alcohol. The boy's older brother (age 16) told police that he had also been given alcohol and marijuana by Westerlund before and that "a camera had been used at some of their parties and pictures had been taken but he thinks most of them were deleted."

On this information, law enforcement requested a search warrant to find "evidence relating to alcohol, marijuana, and devices used to photograph, record, and store images of minors without clothes or using alcohol or controlled substances." The district court found that no probable cause existed to search for child pornography, but a search for evidence of providing alcohol to minors was allowed including a search of digital cameras. Subsequently, photographs of unclothed minors and minors consuming alcohol were found. The Sixth Circuit affirmed the denial of the motion to suppress.

In a concurring opinion, Judge Cole agreed that probable cause existed to search for evidence of providing alcohol to minors, but suggested that it did not extend to searching cameras. Still, he concurred because of the "ever-widening Leon good-faith exception jurisprudence (an exception that will surely soon, if it has not already, swallow the rule)."

Cole argued that the only evidence suggesting that Westerlund had photographic evidence was a quote from the teenager saying that pictures had been taken but were deleted. The statement did not specify that Westerlund was the one who had taken them or that he was still in possession of them. Cole found this "disturbing" and suggested that it would allow a search warrant to be applied to nearly every person there because they likely had cameras on their cell phones.

[T]here would be a similarly "fair" probability that their devices would contain photos depicting criminal activity. To presume that there is a "fair probability" that photos of criminal activity would be found at Westerlund's home based on this statement alone requires an understanding of the word "fair" that I do not have.

 Judge Cole continued:

The district court latched onto the latter clause of W.J.'s statement, which referred to the photos being deleted, to note that photos may be resurrected from the trash folder on a computer, so their deletion should pose no bar to obtaining a search warrant. But such an argument puts the cart before the horse; it is not the photos' ability to be seized that is at issue, but whether the photos may be sought at all. Similarly, the majority opinion erroneously applies the "plain view" exception to justify the police officers' seizure of the photographs, while what is actually at issue is whether the police were able to look for any photos. As Westerlund makes clear, the photos that were immediately incriminating were not laying around in plain view; the government underscores this by noting that "[i]n the course of reviewing the pictures, other photographs were found that clearly and immediately appeared to be evidence of other crimes . . . ." Given that the officers had no authority to rifle through the photos in the first place, it cannot be reasonably stated that the incriminating photos were in plain view. To say otherwise would obviate any need for a search warrant to specifically list the items sought.

While Judge Cole's argument certainly brings up an important issue in the case, it does also seem reasonable that even without the testimony about pictures being taken, an officer would be able to search a camera for the evidence. The fact that alcohol was in Westerlund's house does not alone provide evidence of providing alcohol to teenagers. Something more was needed, and pictures that might have been taken are certainly a great source. Regardless, Cole's acknowledgment of the ever-expanding good faith rule is well-received - at least by this author.

Read More

Tech Watch: Onion Browser for iPhone allows encrypted browsing, Tor traffic tunneling

Onion Browser, an app just released for the iPhone and iPad, uses the Tor network to allow users to access the Internet with encryption and anonymity. The app, which is not made by the Tor Project, is available for $0.99 in the iTunes store.

The website lists the following features and benefits of the browser:

• Internet access is tunneled through the Tor network: traffic is sent through an encrypted tunnel and over several "onion router" machines before reaching the destination.
• Websites do not see your actual IP address.
• Web browsing activities are protected from eavesdropping by ISPs or other users of your wireless or wired network
• Freely access the entire internet from behind restrictive firewalls.
• Access to the "dark net" of hidden services (".onion" web sites) not accessible via the regular internet
• Ability to spoof HTTP User-Agent header.
• Ability to change cookie storage policy (Allow All / Block Third Party / Block All)
• “New Identity” button clears cookies, history, and cache and requests a new IP address in one quick step.
• Startup page contains a list of well-known, stable .onion sites.

Tor software is, however, officially available for Android. According to Tor's website, the software, called Orbot, "allows mobile phone users to access the web, instant messaging and email without being monitored or blocked by their mobile internet service provider."

Read More

1st Circuit affirms sentence despite erroneous calculation in presentence report

In United States v. Roman-Portalatin, 2012 U.S. App. LEXIS 8393 (1st Cir. 2012), the First Circuit upheld a sentence for persuading a minor to engage in unlawful sexual conduct and possession of child pornography despite the defendant's argument that an enhancement was erroneously applied.

The enhancement of USSG § 2G2.1(b)(6)(B)(ii) is applied for the use of a computer to "solicit participation with a minor in sexually explicit conduct for the purpose of producing sexually explicit material or for the purpose of transmitting such material live." It doesn't apply to direct communications with the victim, however, but instead only when the communications are with a third party. § 2G2.1(b)(6)(B)(i) is applied when the act is directly with the victim. Either way, it's a two-level enhancement.

The issue arose when the enhancement was suggested in the presentence report and a range of 168-210 months was established. Despite the defendant's plea agreement recommending 135 months, the sentencing judge imposed a 145-month sentence. On appeal, the defendant argued that the erroneous enhancement (which he had not objected to at sentencing) prejudicially affected him as the judge was calculating the sentence.

The First Circuit (in an opinion by Justice Souter, sitting by designation) held that even if the error had been preserved, it did not appear to affect the district court's decision as the defendant's plea admitted to the same level enhancement under § 2G2.1(b)(6)(B)(i). Also, a claim of ineffective assistance failed because at most, the attorney's act "would have resulted in substituting '(i)' for '(ii)'.

Read More

District court denies restitution to child pornography victim because government failed to prove damages

A federal district court has denied an award of restitution to "Cindy," an individual depicted in child pornography. United States v. Veazie, 2012 U.S. Dist. LEXIS 57772 (D. Maine 2012). In the past, Cindy has been awarded restitution twelve times with awards ranging from $1,000 to $5,000, and she is seeking to recover approximately $71,000 total.

The court first determined that the defendant was the proximate cause of Cindy's harm. However, "[j]oint and several liability is inappropriate" because he did not cause all of her injuries, and it is possible that it can't be "imposed upon defendants in separate cases." The government did not present any specific evidence of damage caused by the defendant. "[T]he Government [has not] shown that Veazie even viewed one image of Cindy or compared the conduct of Veazie with the conduct of the defendants in the twelve other cases involving restitution awards to Cindy."

Because the government did not provide a method for determining damages caused by the defendant, the court was unable to award restitution. "[C]ourts may not speculate, and the Court cannot do so here."

For a more detailed look at how courts award restitution in child pornography cases, click here.

Read More

FBI seizes server used to anonymize e-mail

The FBI recently seized an entire server that was used to anonymously make bomb threats against the University of Pittsburgh. The server was running Mixmaster, an anonymous remailer service, that was predominantly used by many civil and human rights groups. The shutdown of the server took out 300 email accounts, 50-80 email lists, and several websites. The organizations behind these accounts are not suspected of any wrongdoing.

“The FBI is using a sledgehammer approach, shutting down service to hundreds of users due to the actions of one anonymous person,” said Devin Theriot-Orr, a representative for one of the groups.

Here's a description of how the server works:

Anonymous remailers are used to send email anonymously, or pseudonymously. Like other anonymizing services such as the Tor network, these remailers are widely used to protect the identity of human rights activists who place themselves and their families in grave danger by reporting information about abuses. Remailers are also important for corporate whistle blowers, democracy activists working under repressive regimes, and others to communicate vital information that would otherwise go un-reported. 

The Mixmaster software is specifically designed to make it impossible for anyone to trace the emails. The system does not record logs of connections, details of who sent messages, or how they were routed.

As long as that's true, it makes you wonder why the FBI bothered to seize the server. In the meantime, these groups are doing a good job of making it seem like nothing more than an attack on free speech. You can read more about the seizure, the groups affected, and how the server works on Riseup Networks' website.

Read More

Missouri appellate court finds search unconstitutional, affirms conviction

In State v. Sachs, the Missouri Court of Appeals considered whether pictures of a computer's screen introduced at trial were improperly obtained. 2012 Mo. App. LEXIS 571. Law enforcement had tracked child pornography activity to the defendant's home. They arrived to talk with him without a search warrant, and the defendant admitted downloading child pornography. When the defendant stepped outside to call his parents, the detective began opening programs on the computer and taking pictures of the screen.

On appeal, the defendant argued that the search of the computer without a warrant was unconstitutional and the evidence should have been suppressed. The court found that "using a mouse and/or keyboard to shuffle between files that are not plainly visible" is a search. The prosecution argued that an exigent circumstance existed because shutting down the computer would have cleared the RAM. The court disagreed, finding that an officer could have remained with the computer until the search warrant was obtained and that an "inconvenience for the officers and Appellant's roommates" is irrelevant.

The state argued the evidence was admissible under inevitable discovery. The court held:

The State has failed to explain, nor do we perceive, how access to the active files on the computer to view and take pictures of the active programs was inevitable. Detective Anderson testified to his intent to turn off, unplug, and remove the computer from the premises prior to applying for a warrant. Thus, the record reflects that, as a result of Detective Anderson's own actions, the ability to view and photograph the active programs would not have existed by the time a warrant could be obtained for a lawful search to have been conducted. Admission of the pictures of the active computer screens or Detective Anderson's testimony related to his access of the active programs could not be justified by the inevitable discovery doctrine.

Of course, the solution was getting the search warrant prior to unplugging the computer. An officer should have remained with the computer until a warrant was obtained, and then the search of the active files could have occurred and photographs could have been taken.

The court ultimately held that although the photos and testimony should not have been admitted, the properly admitted evidence of the defendant's guilt was overwhelming, and the conviction was affirmed.

Read More

Court finds evidence of counterfeiting and giving minors drugs admissible in CP trial

In United States v. Stringer, 2012 U.S. Dist. LEXIS 56458 (W.D. Mo. 2012), the court held that evidence of a defendant's possession of counterfeit currency and giving methamphetamine to minors is admissible in his trial for possession of child pornography.

The defendant had entered a guilty plea for the counterfeiting charge, and evidence of that crime was found on the same computer as the child pornography. He argued that it was immaterial and would be unfairly prejudicial. The court ruled it admissible "if offered to prove Defendant's possession and control of the computer containing child pornography."

Also held admissible was evidence that the defendant gave minors methamphetamine "to make them willing to pose for pornographic pictures."

[T]he question is whether the Government may introduce evidence that the Defendant supplied G.R. and A.K. with methamphetamine in the hope that it would lower their inhibitions and make them more amenable to taking explicit pictures. The Court holds it may. It is well-established, and no expert testimony is needed, to prove that individuals frequently give drugs, such as alcohol or methamphetamine, to others in the hope that it will lower their inhibitions.

Read More

Search validated based on results of the search, rather than the method

The recent case of United States v. Johnston, 2012 U.S. Dist. LEXIS 53323 (E.D. Cal.), raised some thought-provoking questions. Essentially, it is a run of the mill CP motion to suppress - with one twist. The defendant had used his email address to register for a CP website, and an e-mail giving him access was “intercepted.” A search warrant was obtained and during the first search of the defendant’s hard drive plenty of CP was found, and a search for relevant communications turned up “some ‘emails of interest’ and chat logs.”

A second search nearly five years later revealed more emails and CP. On the third search, an agent claimed he did some keyword searches for typical terms related to CP again, but failed to do one important thing – keep a record of what he was doing. As an aside, typically you are taught that when conducting forensics investigations of computers, you record every command that you use to examine the drive (or have a program do that for you), so that you can retrace your steps (and essentially assert that you were remaining within the scope of the warrant). The agent admittedly did not do that here.

The defendant argued in his motion that the searches exceeded the warrant, requiring suppression. Additionally, he argued that the agent’s failure to keep track of his actions were fatal because “it is not possible to determine clearly that the agent acted only within the bounds laid out by the warrant's terms.”

The defendant equated this to “the government[] ‘rummaging’ indiscriminately through [the] defendant's computer in violation of the Fourth Amendment.” (I loved the “rummaging” part). In clearer terms, the defendant is arguing that failure to take those steps turned the particularity of the warrant on its head and the search became a dragnet-type search. The Court reviewed two previous cases that were semi-analogous, and then summed up the review of precedent:

Because "[t]he difficulties of examining and separating electronic media at the scene are well known," a warrant's authorizing "seizure of intermingled materials that are difficult and time-consuming to separate on-site" is reasonable and permissible. The intermingled nature of materials, however, does not justify a detailed examination of the entire content of those materials in the form of "an investigatory dragnet."

The court found no precedent supporting the defendant’s argument that failure to leave investigatory “crumbs” would be fatal to the government’s case. The court denied the motion to suppress, stating that all of the searches that were made by the agent were in furtherance of the goal of obtaining evidence of CP but seemed to base this conclusion merely on the results of the search, and not how they were conducted. Essentially, while the search occurred, they stumbled upon other leads that took them elsewhere. The court analogized such leads under the plain view doctrine to some extent but concluded more importantly:

any information [the agent’s] searches returned that was not limited precisely to possession or receipt of images of child pornography was located by searching only for this kind of material. As in Giberson, although the government here did not seek an additional warrant after the agent discovered the travel information and the chats, the agent continued his search by looking only for evidence of child pornography. There is no indication that he ever diverted his search to areas of inquiry outside the scope of the warrant, conducting the kind of "investigatory dragnet" operation that would violate the Fourth Amendment. (emphasis added)

There is no evidence of diversion, because the government failed to collect the evidence in a forensically sound way, and that failure provided the defendant with no argument and no evidence to prove his version of the facts. While this certainly isn’t a case worth appealing on its particular facts, I could think of one that would be.

Suppose the exact same facts except the evidence of a crime obtained during the third search was wholly unrelated to CP and was, for example, related to federal tax evasion. In that circumstance, the suppression motion should be granted for failure to stay within the scope of the warrant. Here’s why: in Johnston, all of the information that was revealed was ultimately related to the same subject, pedophilia, and was likely to be intermingled – also, it was the target of a child porn investigation. Thus, string searches for words such as “lolita,” “child porn,” “pedo,” etc., are likely to reveal this type of information. But in the federal tax evasion case, would the same be true? Herein lies the conundrum.

The failure of the agent to disclose his steps to discover that information in the third search should be fatal to the government’s case in this hypothetical. Without evidence of the steps of the searches, and what commands were issued during the search, there could be no proof that the government wasn’t using a dirty word list that included phrases outside the scope of the crime they were investigating. The assumption would then be pushed to a “dragnet”- type search – say searching for CP words plus “money laundering,” “cocaine,” “botnet.” Because of the amount of information on a computer hard drive, we have to expect that we retain privacy to some degree in that information. Obviously the Ninth Circuit’s precedent reveals this to some extent, but the cases have not really delved into the Fourth Amendment intricacies of hard drive mechanics and data storage.

Additionally, can plain view even really be applied in these types of situations? Or, more specifically, who is to determine how that works on a hard drive? Under the Wong test used here to analyze plain view, one of the requirements is that the “items incriminating nature was ‘immediately apparent.’” In Johnston, the court is making the assumption that this is true based on the agent’s testimony; however, a court would likely defer to such testimony of plain view by the agent, regardless of whether they know he is telling the truth. Once again, failure to record his actions makes this deference shaky. Also, I’m sure most people would agree that child porn is “immediately apparent” in the sense that you’ll know it when you see it. Can the same be true of evidence of tax evasion? I don’t think I would know tax evasion was staring me in the face from string-based searches of a hard drive.

In sum, it must be decided if a warrant allows anything to be done to a hard drive, or are there strictures? What if it was a shared computer in a family? In my view, the Johnston case (maybe) and surely the hypothetical would be analogous to the cops looking for a hidden gun in your house, but stopping to read your daughter’s diary. We’re essentially confronted with a line-drawing problem. The court has escaped the “dragnet” trap here because of the interrelatedness of the crimes and the ability to draw a conclusion not from a strong footing of evidentiary sufficiency but a favorable factual outcome. But that trap isn’t avoidable forever. When you are conducting a search for evidence of an alleged crime, you are searching for relevant evidence of that crime - not all crimes. The only way to determine if this has been followed is to know what steps the government took to get where they ended up. This case was properly decided, but I think the court should not have given such short shrift to the evidentiary failings because the facts fell in line.

Read More

Pre-Jones GPS data not subject to suppression in 7th, 8th, and 9th Circuits due to good faith exception

In United States v. Amaya, 2012 WL 1188456 (N.D. Iowa 2012), a motion to suppress GPS data because law enforcement obtained it in good faith prior to the Supreme Court's decision in Jones.

The defendant is facing multiple drug charges. After Jones was handed down in January, Amaya was given the opportunity to file a motion to suppress GPS evidence in the case. Law enforcement had used GPS devices on multiple vehicles without a warrant for periods of time ranging from one to four months.

In considering the motion to dismiss, the judge found that even if the use of the GPS devices violated the Fourth Amendment, suppression is not required because under Davis v. United States, the good faith exception would apply. Since the Eighth Circuit had ruled that no warrant was required for the use of GPS (Marquez, 605 F.3d 604), the investigators were acting in good faith based on binding precedent because Jones had yet to be decided.

Prior to Jones, the Seventh, Eighth, and Ninth Circuits had all determined that a search warrant was unnecessary for the use of GPS devices, which could lead to the good faith application in 19 states for data that has already been acquired. Last month, a California district court also held the good faith exception to be applicable (United States v. Nwobi, 2012 WL 769746 (C.D. Cal. 2012)).

In Amaya, the prosecution had also failed to disclose the use of GPS surveillance during discovery, and the court considered if suppression or other sanction was appropriate. The use originally came out during trial, and a mistrial was declared. The judge found that the failure to disclose was in bad faith, but "the prejudice to Amaya has largely been remedied." While the judge decided not to require suppression, a hearing was scheduled to determine a proper sanction including the possibility of "taking away the prosecution's peremptory strikes and/or closing rebuttal argument."

Read More

Social networking actions lead to crimes, but is it anything new?

A disagreement over a Facebook relationship status recently ended with gunshots being fired into the air outside a Georgia Waffle House. In February, a husband and wife unfriending someone on Facebook ended with that person's father shooting the couple.

As these events happen, they get a great deal of news coverage. The stories are somewhat unique as they involve a specific element that hasn't existed before. They seem to demonize social networking websites as the cause of such evil, but is that really fair? Relationships and friendships have always had highs and lows despite technology. The only thing different today is that those changes can be easily broadcast to hundreds or thousands of your closest friends.

The question is whether social networking is creating new issues. Would the couple mentioned above still be alive if the friendship had just faded without such a conclusive end? Is the nature of Facebook changing our emotions and reactions? Or would these same people have wound up feuding as a result of a telegram or letter sent by carrier pigeon? My fear is that social networking is making these types of interactions more common. What are your thoughts?

Read More