Always get your own expert to review the forensics.
As good as the government investigators are, and as neutral as some may remain, you can still gain an edge if you discover evidence not found by the government. But of course, if you use a government forensic agent to do this work, you are guaranteed that the government entity prosecuting the case will know what you were looking for before you get back to your office.
Know what you are looking at.
Educate yourself before you have the forensics done. As a lay-educated lawyer, I guarantee you know nothing about computers and what they can do behind the scenes. Between the thousands of viruses and the different types of software out there, you might be shocked to learn what a computer can do without a user at the keyboard. Talk to your clients, discover their habits and tendencies, learn what websites they surf, whose emails they read, what they download, what hours they use the computer, their computer setup (wireless or wired, secured or unsecured); it goes on...
A lot of people may be thinking "optional - what?" Remember, as much as discovery helps you, it helps the prosecuting agency equally, if not more. It allows them insight into your defenses and thoughts, so if you are simply on a fishing expedition, tread lightly. If you believe you can build a case without depositions, possibly with only a forensic review or limited depositions, you will catch the prosecution off guard. This is especially true with depositions of forensic examiners. Be careful with your questions. If you are trying to poke holes in the State's case, prosecutors will go back and plug them up the best they can. Most importantly, be prepared for the deposition. Make sure you have completed your independent forensic review and you know what you are talking about. Your forensic expert should have previously reviewed the State's reports and know exactly where the State is coming from....http://www.cybercrimesdefense.com/files/facdl.pdf
No forensic examiner worth their salt will stake their reputations on the accuracy of an electronic time stamp. The clock on a computer is one of the easiest pieces of evidence to manipulate, and there is generally no way to track changes. I can change my computer's clock today to say the date is February 15, 2010 or February 15, 2000. Once I do that, I can go about my business on my machine, and all the timestamps it sets reflect the date I set. Once you go back to the accurate time, you are again manipulating the non-user data. That means there is no certainty about a computer's internal clock, which timestamps files.
Don't fight the image.
The last thing you want to do is draw attention to a sexually explicit image of a minor. All that is going to do is keep an image in front of the jury for one second longer than it should be. Unless you have absolute certainty that the image is altered or computer-generated, do everything in your power to minimize exposure of child pornography to the jury. It is unfortunate that the case law is against us in this regard. The case law allows the prosecuting agency to show the jury images that have been stipulated into evidence, as they are an essential element of the crime. You, as a defense attorney, have to find a way to get away from the images; juries do not want to see them. And the jurors that tell you they are okay with looking at these types of images probably have issues themselves, so you don't want them on your panel.
Chat logs - are they what they purport to be?
Has your agency caught up with the Joneses? What type of technology are they using to track your client's chats? Most agencies are new at the whole cyber crime game, so they are doing things the old-fashioned way: They are cutting and pasting the chat logs into a Word file. Oftentimes, you can argue that is not the "best evidence," as the data is easily manipulated and frequently missing lines of text as well as other important text entries. There is software out there that allows the undercover agent to track the conversations, which does not give them the ability to manipulate the data. Check your jurisdiction's case law. But the best evidence is always the logs. Computers don't generally retain chat logs, but you can often recover excerpts using forensics, which can be helpful.
Always check the little things that can be overlooked. I have seen situations before where an agency is investigating a crime and has subpoenaed IP logs, date/time, etc., but has forgotten to include the appropriate time zone, asked for the wrong time zone or didn't take into account daylight saving time. So make sure the government agency has subpoenaed the right IP logs. For example, if you're examining an AOL email that was sent containing suspected child pornography, the correct IP log to subpoena would be found in the header information of the email that was sent, not the IP log captured when the AOL user registered the account.
Is your client a collector?
Generally speaking, people who possess child pornography have tendencies that are obsessive-compulsive. They collect images and videos and will usually have hundreds, if not thousands, of images. So what does that mean for the client who is found with one or two? It's very important not to dismiss your client's statements about how or why the images are there. Computers these days do a lot of crazy things, so if your client only has a few pictures, I would get ready to dig in your heels in order to determine where they came from and how they got there. (Refer back to No. 1 - a forensic expert is key!)
Does the search warrant authorize what the agency actually did?
Computer search warrants can be very technical and complex these days. With that said, the judge who is reading the warrant oftentimes doesn't understand what the warrant specifically authorizes. Then again, sometimes neither does the affiant of the warrant. This tip on search warrants should be read in conjunction with No. 3, because when you are deposing the affiant, you want to grill them on the warrant to ensure that they accurately portrayed the sworn affidavit to the judge. Fruit of the poisonous tree... Additionally, information contained in a warrant may be inaccurate. For example, the affiant may have used an incorrect IP address as the source of probable cause, used the wrong property description, may not have had probable cause to believe the evidence sought would be stored on a computer; the list goes on. Furthermore, does the warrant even authorize a search of the computer and/or additional seized media post-seizure? ...http://www.cybercrimesdefense.com/files/facdl.pdf
Consent - to what?
Agencies often attempt to secure consent to search electronic media rather than get a search warrant. What you need to look for is what was seized, whose electronic media it was, whether the person who gave consent had the ability to give consent (does that person use the computer on a regular basis, do they have their own login information, is the computer password-protected...). Agencies investigating cyber crime love to execute the knock-and-talk with a consent waiver in their hand. The target is usually not home, and the girlfriend, wife or adult child signs on behalf of the target, who has no idea what is going on. Later, on appeal, the State argues that it had probable cause, and through inevitable discovery, it would have gotten a warrant. I submit to you that this is bogus. If law enforcement had had probable cause, they would have come with warrant in hand...http://www.cybercrimesdefense.com/files/facdl.pdf
Additional resources provided by the author
For additional information please visit www.cybercrimesdefense.com
Our Rating is calculated using information the lawyer has included on their profile in addition to the information we collect from state bar associations and other organizations that license legal professionals. Attorneys who claim their profiles and provide Avvo with more information tend to have a higher rating than those who do not.
What determines Avvo Rating?
Experience & background
Years licensed, work experience, education
Legal community recognition
Peer endorsements, associations, awards
Legal thought leadership
Publications, speaking engagements
This lawyer was disciplined by a state licensing authority in .
Disciplinary information may not be comprehensive, or updated. We recommend that you always check a lawyer's disciplinary status with their respective state bar association before hiring them.