TACDL is opposed to the proposed rule change regarding the disclosure of child pornography. The amendment will likely not solve any existing problem, will deny defendants the ability to obtain potentially exonerating evidence, will add financial burden to defendants who may be unable to afford the additional costs, and will likely lead to wrongful convictions.
As an initial matter, this is largely a "solution in search of a problem." TACDL is not aware of a single incident in which child pornography has been improperly released by a criminal defense attorney or an expert while working a case in this state. By contrast, there are many examples of persons exonerated by vigorous forensic investigation. Thus, the proposed increased restrictions will primarily affect only the ability of innocent people to raise a defense with no corresponding benefit.
There is no legal conflict in allowing defense attorneys and experts to possess these materials. In State v. Allen, the Tennessee Court of Criminal Appeals held that 18 U.S.C. § 3509(m) (part of the Adam Walsh Act) does not preempt state rules regarding discovery in state prosecutions involving child pornography. No. E2007-01018-CCA-R3-CD, 2009 WL 348555 (Tenn. Ct. App. Aug 17, 2009). Further, the court pointed out that § 3509 "has been interpreted to allow disclosure of offending materials where a defendant has shown that an analysis of the material at a government facility would be cost prohibitive; doubt about the reliability of an expert's equipment would be raised if the expert were forced to move the equipment; or that the expert's ability to analyze the material is so compromised that he is of no effective service to Defendant or Defendant's attorney." This decision was cited with approval by a federal court in a case in which an attorney was prosecuted for child pornography he claimed was obtained in his official legal capacity. United States v. Flynn, 709 F. Supp. 2d 737, 741 (D.S.D. 2010). See also U.S. v. Knellinger, 471 F.Supp.2d 640, 647-48 (E.D. Va. 2007).
TACDL believes that requiring a defense attorney and expert to work in a government facility-while probably being supervised by an agent of the prosecution-significantly impairs the ability to a defense in several ways. Computer technicians have their own equipment and programs which may not be easily brought into a government facility, which has its own equipment. The defense attorney and expert cannot candidly discuss the evidence with a government agent listening. It may take an expert many hours to personally review potentially thousands of files.
A recent case handled by a TACDL attorney-who is also a forensic computer expert- demonstrates the likelihood that wrongful convictions will result from the overly-restrictive limitations in the proposed amendment. In that case, the defendant was charged with possession of child pornography after 192 suspect images were found on his computer by the TBI. Once these images were discovered, the TBI did not do any further analysis to determine the source of the images. In fact, the TBI rarely performs such analysis to confirm that the suspect knowingly obtained the materials.
The defense was allowed to obtain a forensic "mirror" image of the defendant's computer which was then analyzed by a computer forensics expert. The expert utilized specialized computer equipment, advanced forensic software tools and old-fashioned "gum-shoe" investigative technics to analyze numerous artifacts on the computer including:
- File System Indexing and Search
- Internet Browser History Analysis
- Review of all Internet Cookies
- Thumbnail Cache Analysis
- Photo Image Analysis
- System Log File Analysis
- Windows Event Log Analysis
- Windows Registry Search and Analysis
- Recycle Bin History Analysis and Carving
- USB Device Connection History
- Carved Space Recovery, Analysis and Search
- Shadow Copy Image Extraction and Analysis
- Windows Search Indexer windows.edb and Gatherer File Analysis
After over sixteen (16) hours of analysis, the expert conclusively reported that the images found on the defendant's computer were exclusively thumbnail images from "pop-up" web pages. There was no evidence that the defendant had ever searched for child pornography, that he had ever visited any websites known to contain child pornography, nor had he ever intentionally downloaded images containing child pornography. In other words, the defendant did not knowingly or intentionally acquire the illegal images. After reviewing the expert's report, the forensic analysts at the Tennessee Bureau of Investigation confirmed his findings. The District Attorney dismissed the case.
This defendant was charged with Sexual Exploitation of a Minor, a Class B Felony carrying 8-30 years in prison with no parole eligibility and lifetime placement on the Sex Offender Registry. The plea offer from the State was 10 years in prison. Without the expert's analysis and report, an innocent person would likely have spent a decade in prison and forever been labeled a sexual predator.
According to the TACDL member who performed the analysis, the defendant's exoneration might not have been possible if the expert been required to conduct his work at a government facility and/or utilizing only tools provided by the State for several reasons. First, the specialized computer used by the expert in this case was a large, server-class machine which is difficult to move from location to location. To understand why such specialized equipment is required, it helps to review the factors and process involved.
- A suspect computer must first be "imaged," meaning that an EXACT, bit-by-bit copy of the computer's storage device is copied and verified in a forensically sound and verifiable process.
- This mirror image of the suspect computer is then "ingested" by the forensic analysis computer. This includes copying the entire contents of the mirror image onto storage on the forensics computer. This process alone can take up to one (1) hour or more for a one (1) Terabyte image, even using a high-speed device and a properly configured forensic analysis computer.
- As the size of storage on personal computers increases, the time required to analyze the data on those devices increases.
- To accommodate this increase in data volume, specialize forensic analysis computers utilize a drive array, which is a group of multiple hard drives which are "bundled" by the computer to function as a single virtual hard drive. Functionally, this allows multiple drives to "share" the task of reading the data, meaning that, for example, a four-drive array would have each drive doing ¼ of the work simultaneously with the other three drives.
- Once the suspect image is ingested by the forensic system, the entire contents of the image are indexed according to a predefined set of forensic rules and targets. This process can be very taxing on the forensic computer's memory, processor and its storage drives. As such, a properly configured forensic analysis computer requires significantly more power in each of these subsystems than the average end-user's computer. Even with such a properly configured forensic analysis computer, this indexing process can take hours for larger images.
- Once all of the aforementioned preparatory activities are complete, the forensic expert's work truly begins. Modern computer systems are extremely complex, and the needs of the investigator are entirely dependent on the facts of the case. Determining what computer evidence and artifacts are relevant or important and then investigating that evidence is often an iterative, tedious and time - consuming process that is unpredictable at best. Forcing this investigative process into a confined "box" within a State facility during business hours makes the expert's job extremely difficult if not impossible.
- Because the process is often iterative, and as the expert uncovers new information or clues, he must discuss his findings with defense counsel and adjust his inquiry accordingly. In the earlier example, the expert had numerous calls with defense counsel regarding various discoveries he made during his analysis which led to new lines of investigation.
- Finally, there are currently a VERY limited number of experts in Tennessee who possess the knowledge and equipment to conduct the necessary analysis. In the example case herein, the case was being prosecuted in a county over 120 miles from the expert's office. Requiring the expert to travel to the State's facility to conduct his investigation is overly burdensome when the two are located in the same city. When they are geographically separated by large distances, it become impossible.