Third Circuit Court of Appeals: Suspect Who Refuses to Provide Password Can Only Be Held in Contempt For 18 Months

The Third Circuit Court of Appeals has decided the case of United States v. Apple Mac Pro Computer, holding that the suspect in a Philadelphia federal child pornography case could only be held for eighteen months for refusing to provide the password to his laptop in response to a court order.

In Pennsylvania and the federal system, prosecutors have increasingly sought court orders in an attempt to compel suspects to unlock their electronic devices in investigations involving internet crimes and illegal pornography. Pennsylvania state courts have found that these types of orders are likely to violate a defendant’s Fifth Amendment rights, but the Third Circuit Court of Appeals has adopted the foregone conclusion doctrine which holds that a suspect can be compelled to produce a password when the Government can prove that the suspect owns the device in question and knows the password. The penalty for refusing to comply can be civil contempt in which the person is jailed until they eventually give up the password. This decision holds that a suspect who refuses to comply with this type of order can only be incarcerated for at most eighteen months, meaning they can no longer be held indefinitely.

United States v. Apple Mac Pro Computer

The defendant was a former Philadelphia Police Sergeant who was under federal investigation for possessing child pornography. As part of that investigation, the Delaware County Criminal Investigations Unit executed a search warrant on the suspect’s residence. As a result of that search warrant, government agents obtained the suspect’s Apple iPhone 5S, an Apple iPhone 6 Plus, and an Apple Mac Pro Computer with two attached Western Digital External Hard Drives, all of which were protected with encryption software.

Agents from the Department of Homeland Security then obtained a federal search warrant to examine the seized devices. The suspect voluntarily provided the password for the Apple iPhone 5S, but he did not provide the passwords to decrypt the Mac Pro or the external hard drives. Ultimately, forensic analysts discovered the password to decrypt the Mac Pro, they but could not determine the passwords to decrypt the external hard drives. Forensic examination of the Mac Pro revealed (1) an image of a pubescent girl in a sexually provocative position, (2) logs showing that the Mac Pro had been used to visit websites with titles common in child exploitation, and 3) that the suspect had downloaded thousands of files known to be child pornography. Those files were not on the Mac Pro. Instead, they were stored on the encrypted external hard drives. In the course of their investigation, officers interviewed the man’s sister who stated that the suspect had shown her hundreds of images of child pornography on the encrypted external hard drives, which included videos of children who were nude and engaged in sex acts with other children. However, without a password to decrypt the hard drives, the agents could not access the files themselves, making a criminal prosecution difficult.

In August 2015, a Federal Magistrate Judge ordered the former Philadelphia Officer to produce all encrypted devices, including his external hard drives, in a fully unencrypted state. The suspect did not appeal the order, but instead filed a motion to quash the Government’s application to compel decryption, arguing that the act of decrypting the devices would violate his Fifth Amendment privilege against self-incrimination. Eventually, his motion was denied, and he was directed to fully comply with the decryption order. The Magistrate Judge acknowledged the suspect’s Fifth Amendment objection but held that because the Government possessed his devices and knew that their contents included child pornography, the act of decrypting them would not be testimonial for purposes of the Fifth Amendment privilege against self-incrimination.

Approximately one week after the denial of the motion to quash, the suspect and his attorney appeared at the Delaware County Police Department for the forensic examination of his devices. He produced the Apple iPhone 6 Plus in a fully unencrypted state by entering three separate passwords on the device. The phone contained adult pornography, a video of the defendant’s niece in which she was wearing only her underwear, and approximately twenty photographs which focused on the genitals of his niece. The man stated that he could not remember the passwords necessary to decrypt the hard drives and entered several incorrect passwords during the forensic examination.

Following the forensic examination, the Government moved for an order to show cause why the suspect should not be held in contempt for his failure to abide by the decryption order. Following the hearings on this issue, the District Court found that the suspect remembered the passwords but chose not to provide them to the government agents. On September 30, 2015, the suspect was held in contempt. The court ordered that he would be held indefinitely until he agreed to comply with the order. He immediately appealed this decision, and the Third Circuit upheld his contempt order. The suspect eventually filed a motion to vacate the contempt order and order his release because, at the time of this subsequent appeal, he had been in custody for more than 18 months.

What is Civil Contempt in Federal Court?

28 U.S.C. § 1826 (a) governs civil contempt. The statute states:

Whenever a witness in any proceeding before or ancillary to any court or grand jury of the United States refuses without just cause shown to comply with an order of the court to testify or provide other information, including any book, paper, document, record, recording, or other material, the court, upon such refusal, or when such refusal is duly brought to its attention, may summarily order his confinement at a suitable place until such time as the witness is willing to give such testimony or provide such information.

In other words, this statute gives judges authority to incarcerate or fine individuals who refuse to comply with an order to provide requested information. This order could involve testimony in a court proceeding (i.e. a grand jury proceeding), but it could also involve specific documents, passwords, emails or almost anything that could be of some evidentiary value.

What is the Difference Between Civil Contempt and Criminal Contempt?

Civil contempt is frequently used in Federal litigation. The main difference between civil and criminal contempt is that civil contempt is designed to compel compliance with a particular order, whereas criminal contempt is designed to punish. Although in the instant case involves a potential criminal proceeding, civil contempt is very common in cases where a witness is compelled to testify in a grand jury hearing but refuses to do so even after being granted immunity.

It is also important to note that the burden of proof is different in each type of hearing. In a criminal contempt case, the Government must prove its case beyond a reasonable doubt, whereas in a civil contempt hearing, the burden is clear and convincing evidence and thus not as difficult to prove as criminal contempt.

The Third Circuit’s Decision

The Third Circuit ordered the suspect be released. In its ruling, the Third Circuit specifically stated that § 1826(a) specifically states that “no period of such confinement shall exceed the life of 1) the court proceeding, or 2) the term of the grand jury including extensions, before which such refusal to comply with the court order occurred, but in no event shall such confinement exceed eighteen months.” The Third Circuit specifically found that the suspect qualified as a witness for purposes of § 1826(a) and it was of no consequence that the suspect was also a suspect in connection with other offenses. Therefore, because his detention exceeded eighteen months, the Third Circuit ordered his immediate release from custody. This is an important decision because it imposes a finite limit on the ability of the Government to hold someone for failing to comply with an order to decrypt an electronic device. Given the possibility of decades in prison for federal child pornography offenses, it may make sense to risk civil contempt rather than unlock a device that could support a federal prosecution.

Facing Criminal Charges? We Can Help.

If you are facing criminal charges or under investigation by the police, we can help. We have successfully defended thousands of clients against criminal charges in courts throughout Pennsylvania and New Jersey. We have successfully obtained full acquittals in cases involving charges such as Conspiracy, Aggravated Assault, Rape, and Murder. Our award-winning Philadelphia criminal defense lawyers offer a free criminal defense strategy session to any potential client. Call 267-225-2545 to speak with an experienced and understanding defense attorney today.

Zak Goldstein 6/5/18 Zak Goldstein 6/5/18

PA Superior Court: Tracing IP Addresses at Trial Requires Authentic Evidence and Expert Witnesses

Philadelphia Criminal Defense Lawyer Zak T. Goldstein, Esq.

The Pennsylvania Superior Court has decided the case of Commonwealth v. Manivannan. In Manivannan, the Superior Court reversed the defendant’s cyber-stalking related convictions after finding that prosecutors improperly failed to prove that the defendant was the person who accessed the complainant’s e-mail account without permission. This is an important decision because it continues a trend of Pennsylvania appellate courts recognizing that electronic evidence can easily be fabricated and therefore must be properly authenticated in order to be admitted into evidence.

The Facts of Commonwealth v. Manivannan

In August 2011, the defendant worked at the United States Department of Energy. While employed there, he met and began dating the complainant. The complainant would occasionally use his computer to access her email, but she never gave him permission to access her email account. In November 2013, the complainant ended the relationship with the defendant and began seeing another man.

The defendant did not take the breakup well. By January 2014, the defendant was regularly contacting the complainant through various means of communication despite being asked to stop. On one night, the complainant and her new boyfriend were sitting in her car when the defendant pulled up behind them. The defendant proceeded to follow the two after the complainant drove away. Thereafter, the complainant confronted the defendant and told him that he needed to stop following her.

The defendant continued to engage in this type of behavior. For example, the complainant and her new boyfriend planned a weekend trip to Morgantown, West Virginia. While there, she became aware that the defendant was in the area, as well. Obviously, she became suspicious that the defendant’s presence was not coincidental. She then learned that the accommodation emails she obtained from the hotel were forwarded to her mother, even though the complainant did not send them herself.

The complainant checked the log-in records for her email account and learned that her email account had been accessed twenty-one times from thirteen different Internet Protocol (“IP”) addresses located in various states. She screenshotted the suspicious activity and gave the photos to the police. The police then used a website called Geektools.com to determine which internet service providers owned the IP addresses, and the police then subpoenaed the account information for those IP Addresses from Comcast.

Comcast provided the police with a fax on Comcast letterhead with information stating that the IP addresses used to access the complainant’s e-mail account belonged to the defendant. The defendant was then charged criminally with five counts of unlawful use of a computer and one count of harassment.

The defendant pleaded not guilty and went to trial. At trial, the judge permitted the Commonwealth to introduce the screenshots taken from the complainant’s log-in records despite the defendant’s objection that there was no basis for authenticating that those IP addresses were actually the addresses that accessed the complainant’s e-mail account. The trial court also permitted the Commonwealth to introduce the letter from Comcast. This letter did not indicate an individual author, but it was signed “Comcast Legal Response Center.” The defendant objected to the introduction of this letter because it failed to identify an individual author and it was not an original as required under Rule 1002 of the Pennsylvania Rules of Evidence. To overcome this, the Commonwealth provided a separate, faxed, boilerplate Pa.R.E. 902(11) declaration that was dated on April 18, 2016 that gave no context for the document its signor purported to certify. This document made no reference to the Comcast letter, and the Commonwealth also presented no evidence that the certification it offered had actually accompanied the Comcast letter. The Commonwealth argued that it qualified as a Business Record and thus an exception to the rule against hearsay. After argument, the trial court allowed the introduction of this letter.

The trial court further allowed the police officer and the complainant to testify that the defendant was in Los Angeles, California when someone accessed the complainant’s email account with an IP address that was located in Los Angeles. However, neither the complainant nor the officer were qualified as expert witnesses. At the conclusion of the trial, the jury convicted the defendant, and the court sentenced him to nearly five years of probation. The court also attempted to ban the defendant from the Commonwealth of Pennsylvania, although it later rescinded that unconstitutional provision. The defendant appealed his conviction based on the unreliable electronic evidence, and the Commonwealth appealed the fact that the court did not sentence the defendant to jail time.

The Superior Court Appeal

The Superior Court reversed the conviction. It found both that the Commonwealth failed to properly authenticate the IP address tracking that the police had done and that authenticating these documents required the testimony of an expert witness.

What is the Business Record Exception to the Hearsay Rule?

Typically, hearsay is not admissible in trial. Hearsay is an out of court statement offered to prove the truth of the matter asserted. Hearsay is typically not admissible because it is not trustworthy and because the defense has no opportunity to cross-examine the person that made the statement. However, there are exceptions to the general ban on hearsay. One such exception is the Business Records Exception. This rule allows statements that would otherwise be hearsay to be admitted into evidence if certain requirements are met. The logic behind is the rule these records are inherently reliable because businesses have an interest in having accurate records. It is important to remember that the record does not have to come from the traditional definition of a business. Associations, institutions, non-profit organizations, etc. can all produce documents that qualify as a “business record” for purposes of this rule.

Prosecutors routinely use the Business Records Exception in their cases. In Pennsylvania, there is a five part test that must be satisfied for a statement to qualify as an Business Record: 1) the record was made at or near the time by-or from information transmitted by-someone with knowledge; 2) the record was kept in the course of regularly conducted activity of a “business”; 3) making the record was a regular practice of that activity; 4) all these conditions are shown by the testimony of the custodian or another qualified witness, or by a certification that complies with Rule 902(11) or (12), or with a statute permitting certification; and 5) neither the source of the information nor other circumstances indicate a lack of trustworthiness (i.e. a document that was made in anticipation of litigation would not be deemed reliable). All of these elements must be met before a document can be entered into evidence.

The Court’s Ruling

In Manivannan, one of the main issues was whether the Commonwealth properly authenticated the Comcast letter. Notably, the Commonwealth failed to present testimony from a custodian of records or other qualified witness. Instead, it attempted to authenticate the Comcast letter using the vague certification. The problem with the certification was that it was not specific. Specifically, the court stated that there was “no discernable correlation between this document and the evidence it purports to authenticate.”

This is very significant because prosecutors frequently attempt to introduce documents under the Business Record Exception without complying with all of the requirements. Here, the court held that the trial court erred when it admitted this letter into evidence. The Court further held that this was reversible error because the letter provided the only direct evidence of the defendant’s connection to the IP address that unlawfully accessed the complainant’s e-mail account.

The Commonwealth Must Present Expert Witnesses to Trace IP Addresses At Trial

The Superior Court also found that the trial court should have required the Commonwealth to present expert witnesses as to the IP address tracing. The court found that lay witnesses cannot draw conclusions from highly technical issues such as ascertaining geographic locations from IP addresses and testify to these conclusions at trial. In Manivannan’scase, the Commonwealth introduced evidence of various IP accounts, testimony about how IP addresses work, and how those addresses were traced back to the defendant without ever offering evidence that the officer or complainant were expert witnesses in the relevant field. The Superior Court rejected the introduction of this testimony without an expert witness, finding that expert testimony is required when the Commonwealth seeks to introduce this highly technical evidence. In other words, subjects such as IP addresses, how e-mail accounts are maintained, the ability to link a physical addresses to an IP address, and other computer science related issues are not common knowledge. Therefore, the trial court should have prohibited this testimony without an expert witness. Accordingly, the court reversed the defendant’s conviction for this reason, as well.

Facing Criminal Charges? We Can Help

Manivannan illustrates that a case can be won or lost based on challenges to the evidence that is allowed to be presented to the jury. If you are charged with a highly technical crime, you need a skilled defense attorney who is up-to-date on the rules of evidence and able to use them to your advantage. Our award-winning Philadelphia criminal defense lawyers have successfully defended thousands of clients at trial and on appeal. We offer a free 15-minute criminal defense strategy session to anyone who is facing criminal charges or under investigation. Call 267-225-2545 to discuss your case with an experienced and understanding criminal defense attorney today.