Category Archives: Evidence

Social networking evidence presents challenge in prosectuion over alleged threats made after Virgina Tech shootings

U.S. v. Voneida, 2008 WL 189667 (M.D. Pa. January 18, 2008)

Professor Goldman kindly emailed me a copy of the U.S. District Court for the Middle District of Pennsylvania’s decision in the case of U.S. v. Voneida. This criminal prosecution arose out of some postings that defendant Voneida is alleged to have made on his MySpace page about last April’s Virginia Tech shootings.

The court approached the case with all the awe for the Internet suitable for 1994:

[Voneida's statements] did not occur in a moment, like words being spoken; nor were they sent from one place to another once and only once, like mailing a letter, broadcasting a message over television or radio, or even sending an email. Rather, Defendant’s comments were communicated, and had the potential to reach an audience, for at least nine days. This is one of the ways in which speech on the internet, and on social networking sites in particular, challenges existing methods of legal analysis.

In this case, the feds claimed that Voneida’s postings ran afoul of 18 U.S.C. 875(c), which prohibits the transmitting in interstate commerce of “any threat to injure the person of another.” Voneida filed a motion in limine requesting that several pieces of evidence be excluded at trial.

One of the pieces of evidence that Voneida wanted kept out was an email message that a student in Pennsylvania sent to university authorities to report the postings. The court denied Voneida’s request on this point.

The court held that in determining whether Voneida’s statements were “true threats,” it would be instructive for the jury to consider the effect of the statements on their audience. Addressing this point, the court observed the following about an online “audience”:

Even if [the student who reported the postings] was an unintended viewer, the context of the internet and social networking sites like Myspace.com may make her part of Defendant’s audience regardless of his intent to reach her as opposed to others. As a part of his audience, her response to his comments is relevant and properly considered when evaluating whether they are “true threats.”

A few more facts would be interesting. What if a social network participant adjusts his profile settings to allow only “friends” see the content? Would the so-called “audience” still be the world at large? To what extent can a publisher technologically constrain his or her audience?

Parties must use neutral forensics examiner in file-sharing case

Case highlights important privacy interests in electronic discovery dispute.

From Ray Beckerman, we learn of the U.S. District Court for the Eastern District of Texas’s decision on a motion to compel discovery filed by the recording industry against an accused file-sharer. While the defendant will have to submit her hard drive for forensic examination to see whether she had any copyrighted sound recordings stored on it, she will not have to turn it over to the recording industry’s forensic expert.

Instead, seeking to “balance the legitimate interests of both sides,” the court ordered the parties to select a neutral computer forensics expert to conduct the inspection. Such an approach, the court found, would protect the disclosure of the defendant’s personal information, such as personal correspondence, household financial matters, school homework, and perhaps attorney-client privileged information.

Although in theory this sounds like a reasonable approach to protect the confidentiality of the defendant’s information, one could be troubled by a particular part of the court’s decision. The order states that “the Plaintiffs shall have the right to suggest hard drive search methodologies to the neutral expert and the expert shall make every effort to utilize those methodologies.”

But there is nothing in the order giving the defendant the right or opportunity to object to those methodologies. With an obligation to “make every effort” to comply with the suggestions of the plaintiffs, just how neutral is that forensic examiner really going to be?

Sony BMG Music Entertainment et al. v. Arellanes, No. 05-CV-328 (E.D. Tex., October 27, 2006).

Kansas Supreme Court overturns conviction because hard drive was searched without valid warrant

Agents of the Kansas State Gaming Agency visited Zeke Rupnick in his office, and questioned him about allegations that he was illegally in possession of confidential business information. The agents seized his laptop computer, and a magistrate in a different county issued a warrant authorizing the search of the hard drive’s contents. Rupnick was convicted of felony computer crime based on the evidence obtained from the laptop.

Before trial, Rupnick sought to suppress the evidence contained on the computer, claiming violation of his Fourth Amendment rights. The trial court denied the motion to suppress. Rupnick sought review with the Kansas Supreme Court, which overturned the conviction.

The court held that the initial seizure of the laptop computer from Rupnick’s office without a warrant was justified, on the basis of probable cause plus the exigent circumstances presented by the possibility that Rupnick could easily delete the relevant data. The later warrant and search of the laptop, however, provided the basis for the reversal of the conviction.

The court began its analysis of the legality of the search by answering the question, which was one of first impression before the court, of whether a warrant must be obtained before the government may search the contents of a personal computer. In answering the question in the affirmative, the court looked to the Tenth Circuit cases of U.S. v. Carey, 172 F.3d 1268 (10th Cir. 1999) and U.S. v. Walser, 275 F.3d 981 (10th Cir. 2001).

In this case, the agents had indeed obtained a warrant before searching the contents of the laptop’s hard drive. However, the warrant failed to comply with the relevant Kansas statute (K.S.A. 22-2503), which requires that the search warrant be executed in the judicial district in which the magistrate judge resides. Because the magistrate that issued the warrant did not reside in the county in which the warrant was executed (i.e., where the search of the hard drive was made), the warrant was invalid, and the search was unlawful.

Despite the government’s argument that the defect in the warrant was a mere “technical irregularity,” the court strictly enforced the statute. The felony conviction was reversed and remanded for further proceedings.

State v. Rupnick, — P.3d —, 2005 WL 3439897 (Kan., December 16, 2005).

[Text of opinion]

Pennsylvania court addresses authentication of instant messages

(This was a juvenile delinquency proceeding, thus the names of the parties involved are abbreviated with initials.)

F.P. suspected that Z.G. had stolen a DVD from him. One day in September 2003, as Z.G. was getting off the school bus, F.P. approached Z.G. and “struck him numerous times about the head and face.” F.P. was adjudicated a delinquent, and sought review.

On appeal, F.P. challenged the introduction of printed transcripts of instant messages purportedly sent back and forth between F.P. and Z.G. before the attack. In these messages, the boys discussed the alleged theft of the DVD, and F.P. threatened Z.G. with violence.

F.P. argued that in order for the instant messages to have been admitted into evidence, the prosecution should have introduced information regarding their source with an ISP, or testimony from a computer forensics expert. The “inherent unreliability” of e-mail and instant messaging communications, F.P. argued, made the authentication of the documents through circumstantial evidence improper.

The court rejected F.P.’s arguments, and held that the trial court did not abuse its discretion in admitting the communications. It found that there was sufficient evidence to support the conclusion that F.P. had sent them. In the messages, F.P. had referred to himself by his first name. He accused Z.G. of stealing from him, which mirrored other testimony in the case. Furthermore, he referenced the fact that Z.G. had involved school authorities regarding the dispute between the two, which is a fact that few others would have known.

The court concluded that the applicable Pennsylvania rule of evidence (901) provided a sufficient framework for the analysis. The court held that there “was no justification for constructing unique rules for admissibility of electronic communications such as instant messages; they are to be evaluated on a case-by-case basis as any other document to determine whether or not there has been an adequate foundational showing of their relevance and authenticity.”

In the Interest of F.P., — A.2d —, 2005 WL 1399264 (Pa.Super., June 15, 2005).

Even the courts know the Internet is the first place to turn for information

One of the issues in the recent Indiana case of Munster v. Groce was whether the plaintiff had exercised due diligence in locating the missing defendant. In concluding that the plaintiff hadn’t done his part, the court noted that the plaintiff had neither conducted a public records search nor hired a skip-trace service.

Moreover (and perhaps more shockingly), the plaintiff hadn’t even done a Google search. The court seemed to chastise this failure: “[W]e discovered, upon entering “Joe Groce Indiana” into the Google search engine, an address for Groce that differed from either address used in this case, as well as an apparent obituary for Groce’s mother that listed numerous surviving relatives who might have known his whereabouts.”

Munster v. Groce, — N.E.2d —-, 2005 WL 1364662, at n. 3 (Ind.App., June 8, 2005).

What does it mean to “possess” an image file?

In a case of first impression under Virginia law, the Virginia Court of Appeals has applied “familiar principles of constructive possession of contraband” to define “possession” in the context of computer files.

In the case of Kromer v. Commonwealth, the appellant challenged the sufficiency of the evidence put forward to convict him of unlawful possession of child pornography. Specifically, the appellant argued that the Commonwealth failed to prove that he knowingly possessed the illegal images contained on the hard drive of his computer. The Court of Appeals rejected the appellant’s arguments and affirmed the conviction.

The appellant had contended that the images were “hidden” on his computer, and that someone else could have downloaded them from the Internet. However, the court tipped its hat to the federal case of U.S. v. Tucker, 305 F.3d 1193 (10th Cir. 2002) to conclude that whether the appellant or someone else sought after the images was not relevant to the analysis. Instead, the relevant inquiry was whether the appellant knowingly possessed the images after they were downloaded.

In holding that there was sufficient evidence to show that the appellant had knowingly possessed the images, the court applied a “constructive possession of contraband” analysis. Under the “totality of the circumstances,” the trial court was correct in determining that the appellant knowingly possessed the illegal images.

To support a conviction based on constructive possession under Virginia law, the Commonwealth had to show (1) that the appellant was aware of the presence and character of the illegal images and (2) that the illegal images were subject to his dominion and control.

The appellant had stored the images in a KaZaA directory which was linked to a desktop shortcut. This provided sufficient evidence to show he was aware of the presence of the files. Furthermore, the descriptive file names would have put him on notice of the character of the images. Regarding the question of whether the appellant had control of the images, the court observed that the appellant had disallowed sharing of the contents of the KaZaA folder in which the images had been stored. Moreover, the copy of Windows XP on the computer was registered in the appellant’s name, and he had provided consent for the F.B.I. to search his residence and computer.

Kromer v. Commonwealth, — S.E.2d —, 2005 WL 1388056 (Va.App., June 14, 2005).

Escort’s website relevant evidence for truthfulness

Defendant was hired as an independent “escort” and accompanied her client to the Embassy Suites Hotel in Livonia, Michigan. During the encounter, a scuffle ensued, and the defendant shot her client. She was charged with and convicted of assault with intent to commit murder. At trial, the defendant argued self-defense, claiming that her client had attacked her first.

Throughout the trial, the defendant had maintained that she did not engage in prostitution, and that there was nothing illegal about the services she provided. Although the question of whether the defendant was a prostitute was not related to any of the elements of the crime or to her defense, the prosecution wanted to challenge her truthfulness. To do that, the prosecution introduced into evidence the defendant’s website, which she apparently used to attract new clients.

The defendant argued that this evidence was improperly admitted because it was not relevant. The court disagreed, however, and held that it was relevant to her truthfulness, and that the jury could properly consider it to determine whether or not she was likely telling the truth in her testimony. The court further held that the website’s probative value outweighed its prejudicial effect.

People v. Earle, 2005 WL 1224611 (Mich.App., May 24, 2005).

Microsoft website unreliable as a matter of law

An appellate court in Michigan has affirmed the trial court’s refusal to take judicial notice of information on Microsoft’s website relating to the corruption of server event log files. The court found that Microsoft’s website is not a “source whose accuracy cannot be reasonably questioned.”

After Valrene Mae Schilke was terminated from her position as a technical analyst for Express Management Services, she did what a lot of fired IT workers have probably dreamed of doing: she wrought havoc on the company’s network. Unfortunately for Schilke, however, she didn’t cover her tracks well enough to prevent investigators from tracing malicious activity to the IP address for her home computer. She was charged with one count of “unauthorized access to a computer” under Michigan law, and a jury convicted her of the crime.

At trial, Schilke admitted that she changed the network’s administrative password, deleted user accounts, and took home backup tapes and CDs without authorization. Schilke was also accused of deleting the computer system’s “event log,” but she denied this claim. She argued that a known defect in Microsoft software was instead responsible for the missing event log information. She asked the court to take judicial notice of information contained on Microsoft’s website regarding corruption of event log files.

According to the decision, under Michigan law, for a court to take judicial notice, a fact “must be one not subject to reasonable dispute in that it is either (1) generally known within the territorial jurisdiction of the trial court or (2) capable of accurate and ready determination by resort to sources whose accuracy cannot reasonably be questioned.” The trial court found that the alleged problem with the event logs was not “capable of accurate and ready determination,” and that “the Microsoft web site does not constitute ‘a source whose accuracy cannot be reasonably questioned.’”

The appellate court held that the trial court did not err in refusing to take judicial notice of the Microsoft website. It affirmed the defendant’s conviction and sentence.

People v. Schilke, 2005 WL 1027039 (Mich.App., May 3, 2005).

Decision further exposes loophole in Electronic Communications Privacy Act

A federal court in Utah has held that although evidence obtained through illegal interception of wire or oral communication would not be admissible at trial, any evidence obtained through illegal interception of an electronic communication is admissible.

A confidential FBI informant accessed defendant Jones’s email account without his permission and printed out several messages which she turned over to FBI agents. Based on these messages, the agents obtained a search warrant and arrested Jones. Before trial, Jones moved to suppress the evidence contained in the e-mail messages, as well as the evidence derived from the search warrant based on those messages.

Jones argued that Section 2515 of the federal Electronic Communications Privacy Act (“ECPA”) prohibited the court from considering this evidence which he argued was illegally obtained by the confidential informant. Section 2515 provides, in relevant part: “Whenever any wire or oral communication has been intercepted, no part of the contents of such communication and no evidence derived therefrom may be received in evidence in any trial . . . if the disclosure of that information would be [prohibited].”

The court rejected Jones’s argument and denied the motion to suppress. Although the ECPA prohibits the introduction into evidence of wire or oral communications that may have been illegally obtained, the court held that the statute specifically excludes electronic communications from the statute’s suppression remedy. “Even though the [ECPA] prohibits the interception and disclosure of any wire, oral or electronic communication, the suppression remedy in §2515 applies only to intercepted wire and oral communications.”

U.S. v. Jones, — F.Supp.2d —, 2005 WL 850991 (D.Utah, April 12, 2005).

Court upholds admissibility of weblog evidence used to convict

Case gives good example of what not to say on one’s weblog.

On May 19, 2002, police in Henderson County, North Carolina investigated an incident where a rock had been thrown off an overpass damaging a rig traveling on Interstate 26. Earlier that day, Gerald Velardi had written in his weblog “I’m going to trash some s**t tonight, maybe my damage will be shown on the news.” Velardi was arrested for the crime of assault with a deadly weapon with intent to kill and sentenced to no less than two years in prison.

At trial, the prosecutor brought up Velardi’s weblog during cross examination. On appeal, Velardi argued that this evidence was gathered as the result of an illegal search and seizure. The appellate court rejected this argument and denied relief to Velardi, as he had not properly raised any objection to the alleged illegal search and seizure at the trial court level.

State v Velardi, 2005 WL 757057 (N.C.App., April 5, 2005).