TACDL is opposed to the proposed rule change regarding the disclosure of child pornography. The amendment will likely not solve any existing problem, will deny defendants the ability to obtain potentially exonerating evidence, will add financial burden to defendants who may be unable to afford the additional costs, and will likely lead to wrongful convictions.
As an initial matter, this is largely a "solution in search of a problem." TACDL is not aware of a single incident in which child pornography has been improperly released by a criminal defense attorney or an expert while working a case in this state. By contrast, there are many examples of persons exonerated by vigorous forensic investigation. Thus, the proposed increased restrictions will primarily affect only the ability of innocent people to raise a defense with no corresponding benefit.
There is no legal conflict in allowing defense attorneys and experts to possess these materials. In State v. Allen, the Tennessee Court of Criminal Appeals held that 18 U.S.C. § 3509(m) (part of the Adam Walsh Act) does not preempt state rules regarding discovery in state prosecutions involving child pornography. No. E2007-01018-CCA-R3-CD, 2009 WL 348555 (Tenn. Ct. App. Aug 17, 2009). Further, the court pointed out that § 3509 "has been interpreted to allow disclosure of offending materials where a defendant has shown that an analysis of the material at a government facility would be cost prohibitive; doubt about the reliability of an expert's equipment would be raised if the expert were forced to move the equipment; or that the expert's ability to analyze the material is so compromised that he is of no effective service to Defendant or Defendant's attorney." This decision was cited with approval by a federal court in a case in which an attorney was prosecuted for child pornography he claimed was obtained in his official legal capacity. United States v. Flynn, 709 F. Supp. 2d 737, 741 (D.S.D. 2010). See also U.S. v. Knellinger, 471 F.Supp.2d 640, 647-48 (E.D. Va. 2007).
TACDL believes that requiring a defense attorney and expert to work in a government facility-while probably being supervised by an agent of the prosecution-significantly impairs the ability to a defense in several ways. Computer technicians have their own equipment and programs which may not be easily brought into a government facility, which has its own equipment. The defense attorney and expert cannot candidly discuss the evidence with a government agent listening. It may take an expert many hours to personally review potentially thousands of files.
A recent case handled by a TACDL attorney-who is also a forensic computer expert- demonstrates the likelihood that wrongful convictions will result from the overly-restrictive limitations in the proposed amendment. In that case, the defendant was charged with possession of child pornography after 192 suspect images were found on his computer by the TBI. Once these images were discovered, the TBI did not do any further analysis to determine the source of the images. In fact, the TBI rarely performs such analysis to confirm that the suspect knowingly obtained the materials.
The defense was allowed to obtain a forensic "mirror" image of the defendant's computer which was then analyzed by a computer forensics expert. The expert utilized specialized computer equipment, advanced forensic software tools and old-fashioned "gum-shoe" investigative technics to analyze numerous artifacts on the computer including:
- File System Indexing and Search
- Internet Browser History Analysis
- Review of all Internet Cookies
- Thumbnail Cache Analysis
- Photo Image Analysis
- System Log File Analysis
- Windows Event Log Analysis
- Windows Registry Search and Analysis
- Recycle Bin History Analysis and Carving
- USB Device Connection History
- Carved Space Recovery, Analysis and Search
- Shadow Copy Image Extraction and Analysis
- Windows Search Indexer windows.edb and Gatherer File Analysis
After over sixteen (16) hours of analysis, the expert conclusively reported that the images found on the defendant's computer were exclusively thumbnail images from "pop-up" web pages. There was no evidence that the defendant had ever searched for child pornography, that he had ever visited any websites known to contain child pornography, nor had he ever intentionally downloaded images containing child pornography. In other words, the defendant did not knowingly or intentionally acquire the illegal images. After reviewing the expert's report, the forensic analysts at the Tennessee Bureau of Investigation confirmed his findings. The District Attorney dismissed the case.
This defendant was charged with Sexual Exploitation of a Minor, a Class B Felony carrying 8-30 years in prison with no parole eligibility and lifetime placement on the Sex Offender Registry. The plea offer from the State was 10 years in prison. Without the expert's analysis and report, an innocent person would likely have spent a decade in prison and forever been labeled a sexual predator.
According to the TACDL member who performed the analysis, the defendant's exoneration might not have been possible if the expert been required to conduct his work at a government facility and/or utilizing only tools provided by the State for several reasons. First, the specialized computer used by the expert in this case was a large, server-class machine which is difficult to move from location to location. To understand why such specialized equipment is required, it helps to review the factors and process involved.
- A suspect computer must first be "imaged," meaning that an EXACT, bit-by-bit copy of the computer's storage device is copied and verified in a forensically sound and verifiable process.
- This mirror image of the suspect computer is then "ingested" by the forensic analysis computer. This includes copying the entire contents of the mirror image onto storage on the forensics computer. This process alone can take up to one (1) hour or more for a one (1) Terabyte image, even using a high-speed device and a properly configured forensic analysis computer.
- As the size of storage on personal computers increases, the time required to analyze the data on those devices increases.
- To accommodate this increase in data volume, specialize forensic analysis computers utilize a drive array, which is a group of multiple hard drives which are "bundled" by the computer to function as a single virtual hard drive. Functionally, this allows multiple drives to "share" the task of reading the data, meaning that, for example, a four-drive array would have each drive doing ¼ of the work simultaneously with the other three drives.
- Once the suspect image is ingested by the forensic system, the entire contents of the image are indexed according to a predefined set of forensic rules and targets. This process can be very taxing on the forensic computer's memory, processor and its storage drives. As such, a properly configured forensic analysis computer requires significantly more power in each of these subsystems than the average end-user's computer. Even with such a properly configured forensic analysis computer, this indexing process can take hours for larger images.
- Once all of the aforementioned preparatory activities are complete, the forensic expert's work truly begins. Modern computer systems are extremely complex, and the needs of the investigator are entirely dependent on the facts of the case. Determining what computer evidence and artifacts are relevant or important and then investigating that evidence is often an iterative, tedious and time - consuming process that is unpredictable at best. Forcing this investigative process into a confined "box" within a State facility during business hours makes the expert's job extremely difficult if not impossible.
- Because the process is often iterative, and as the expert uncovers new information or clues, he must discuss his findings with defense counsel and adjust his inquiry accordingly. In the earlier example, the expert had numerous calls with defense counsel regarding various discoveries he made during his analysis which led to new lines of investigation.
- Finally, there are currently a VERY limited number of experts in Tennessee who possess the knowledge and equipment to conduct the necessary analysis. In the example case herein, the case was being prosecuted in a county over 120 miles from the expert's office. Requiring the expert to travel to the State's facility to conduct his investigation is overly burdensome when the two are located in the same city. When they are geographically separated by large distances, it become impossible.
Technical concerns are also significant in cases in which the person(s) depicted in the images may not actually be minors. Under the law, the State simply has to show that the person(s) in any given image or video are minors, but they do not have to prove the actual age. Tenn. Code Ann. § 39-17-1002 et seq. This effectively shifts the burden to the defense to establish reasonable doubt that they are not minors by proving their actual age. To accomplish this, one forensic strategy is to compare the suspect images against "known" images of persons who are not minors, but who appear very young. The only way to accomplish this is by comparing the suspect images against a database of known performers of this "genre" to determine if there is a match. This is virtually impossible within the confines of a State facility and without internet access.
Financial cost is an important consideration. Even if an adequate analysis is theoretically possible under the proposed new rules, it will undoubtedly cost more for the defense attorney and expert to work within the state's facilities and time availability, as well as to bring in additional software and computer resources. The proposed rule would put all of these additional costs on the defendant. If the defendant is indigent, investigation would be substantially limited by the caps on attorney time and limitations on expert rates. It is already challenging to find competent experts in many jurisdictions who are prepared to handle these cases at AOC rates, and the proposed change would only make this process more difficult for defendants. It will be unfair to indigent defendants to enact the proposed changes without also providing the additional financial resources required to comply with the new technical restrictions.
The TACDL member who conducted the computer analysis described above is only aware of two forensic experts (including himself) who will accept AOC rates for these kinds of cases. The TACDL member states that, if required to conduct his analysis in a state fascility subject to the additional restrictions contemplated by the proposed amendment, he would charge at least twice his current rate and would not be able to work at AOC rates.
In TACDL's view, the better route to balance a defendant's right to a defense with victims' privacy concerns is a rule that contemplates protective orders that can be tailored to each situation and jurisdiction. Protective orders are regularly used in criminal and civil cases to safeguard dissemination of sensitive material. Attorneys and their experts are regularly trusted to maintain and protect these materials. If the State has a question about a particular defense attorney or expert, this could be raised to the judge in the process of obtaining the protective order. Perhaps the State could create a certification for private experts to demonstrate that they are capable of maintaining this information.
The TACDL member references above has had protective orders in every case of this nature he has worked on. These orders require that he maintain the evidence in a secure location within a locked cabinet within his locked office; that he severely restrict access to only those working directly under my supervision as the expert and only within a "controlled environment"; that no copies of the provided material are made except as required to copy it to his forensic analysis server; that the computer he uses for analysis is NEVER connected to the internet or any other network accessible to anyone else; and that he destroy the evidence using forensically sound methods within thirty (30) days of the termination of the case.
Although the proposed rule does contemplate the possibility for access outside a state facility, the rule would provide extremely limited availability and a high threshold to be able to pursue a protective order. We propose that an opposite approach should be taken. The default should be a protective order to give the defense and its expert direct access under appropriate conditions, and if the defense cannot satisfy an appropriate standard, then the court could order that the materials be made available only at a state facility. Should the court find that the proposed rule strikes a better balance, we propose that more research be done into the extent which investigators are able to do their job subject to these limitations, the cost of doing so, and the extent to which this is truly needed. TACDL would be happy to assist the court or the rules commission in these matters if extended an invitation.
In essence, in a case where digital evidence is involved, the computer or other digital device becomes a "witness" which tells a story about the defendant's actions. The Confrontation Clause of the Sixth Amendment guarantees the right to cross examine every witness and accuser. Without an unfettered ability to fully analyze the extremely complex environment of any computer or digital device, the defendant is extremely prejudiced both in their right to confront and cross examine witnesses as well as their fundamental right to present a defense. Digital devices are "witnesses" which are unbiased and which cannot lie. However, determining the "real" story being told by that "witness" requires considerable skill, advanced tools and, most critically, time. TACDL believes that the proposed amendment will prevent most defendants from sufficient access to this evidence and will directly to wrongful convictions.
For these reasons, TACDL urges the Court not to approve the proposed amendment.
John H. Morris