Home -> Law Blog Directory -> Academic Blogs -> CYB3RCRIM3

Academic

: CYB3RCRIM3

Evidence Eliminator and Daubert

As Wikipedia notes, the Daubert standard governs ?the admissibility of expert witnesses? testimony during United States federal legal proceedings.? The standard comes from the U.S. Supreme Court?s decision in Daubert v. Merrell Dow Pharmaceuticals, 509 U.S. 579 (1993).

The Daubert Court rejected the earlier test that was used for this purposes, which came from the District of Columbia Court of Appeals? decision in Frye v. United States, 293 F. 1013 (1923). The Frye court held that expert opinion testimony based on a scientific technique is inadmissible unless the technique is ?generally accepted? as reliable in the relevant scientific community.

The Daubert Court held that when one side wants to present expert testimony, ?the trial judge must determine . . . whether the expert is proposing to testify to (1) scientific knowledge that (2) will assist the trier of fact to understand or determine a fact in issue.? Daubert v. Merrell Dow, supra. It noted that this ?entails a preliminary assessment of whether the reasoning or methodology underlying the testimony is scientifically valid and of whether that reasoning or methodology properly can be applied to the facts in issue.? Daubert v. Merrell Dow, supra.

The Daubert Court also noted that ?many factors will bear on this inquiry? and said it would ?not presume to set out a definitive checklist or test? to be used in this assessment. Daubert v. Merrell Dow, supra. It did note some factors a judge could consider in making the assessment: whether the theory or technique ?can be (and has been) tested?; whether it?s been subjected to peer review and publication; the known or potential rate of error; and whether there is ?widespread acceptance? of the technique within the relevant scientific community. Daubert v. Merrell Dow, supra.

This post is about a case in which a defendant tried to use Daubert to challenge the propriety of admitting certain testimony in his criminal trial. The case is State v. Starner, 2009 WL 3532307 (Ohio Court of Appeals 2009), and it began when Danny Starner was indicted ?on thirteen counts of gross sexual imposition in violation of? Ohio Revised Code § 2097.05(A)(4) and on ?nineteen counts of rape of a child under the age of thirteen? in violation of Ohio Revised Code § 2907.01(A)(1)(b). State v. Starner, supra.

Starner married Nancy McDaniel sometime in the early 1990's. . . . Nancy had two daughters, Vicky and Yvonne. Vicky eventually had two children, Doug, born 1995, and Meg, born1998. Yvonne also had a child, Emma, who was born in1994.

By four, Emma was living with her father and step-mother and visiting with Nancy and Starner on occasion. Two years later, Yvonne moved to Pennsylvania and was unable to exercise her bi-weekend visitation with Emma. Instead, Nancy and Starner began exercising these visitation periods with Emma. For the next several years, Emma visited her grandmother and Starner, whom she called `Poppy,? every other weekend.

State v. Starner, supra. In 2008, Nancy died, and shortly afterward Emma said ?Starner sexually abused her nearly every time she visited since she was six or seven years old.? State v. Starner, supra. She said in addition to physically abusing her, Starner ?showed her photographs on his computer of adults who were nude, . . . had her sit on his lap and watch films of adults having sex, and took photographs of her while she had her clothing on and off.? State v. Starner, supra. Meg and Doug then said that Starner ?had engaged in sexual activity with them? when they were children. State v. Starner, supra.

The authorities opened a criminal investigation of the allegations and executed search warrants at Starner?s home on February 20 and March 5 2008. They seized

numerous computers, hard drives, USB drives, computer accessories, cameras [and] girls' underwear. . . . .

A forensic analysis of the electronic equipment found numerous photographs of Emma clothed, some of which show her in seemingly provocative poses. However, no nude photographs of Emma or any other children were found. The analysis did find several photographs of nude adults on the hard drives. . . . [that] contained images of various sexual acts being performed. . . . In addition, a program entitled `Evidence Eliminator? was found, as was evidence of its installation and use, on two of the computers seized from Starner's home. This program is designed to permanently remove files . . . from a hard drive. Further analysis showed that Evidence Eliminator was last accessed on one of the computers on . . . the day of the first search of Starner's home.

The analysis also discovered a number of sexually explicit stories on the hard drives. The subject matter of the vast majority of these stories centered around acts of incest and the molestation of children. . . .

State v. Starner, supra. Starner went to trial on the charges, was convicted and appealed, claiming the trial judge erred in allowing Agent Jim Hawks of the Ohio Bureau of Criminal Investigation (BCI) to testify ?regarding the use of the Evidence Eliminator program.? State v. Starner, supra. Starner argued that Hawke shouldn?t have been allowed to testify because his testimony ?failed the Daubert test for scientific reliability.? State v. Starner, supra. Here?s a summary of Hawke?s testimony:

[He said] his analysis of the computers . . . seized revealed that Evidence Eliminator was installed on two of them. State's Exhibit 1, a SunPro computer found in Starner's kitchen, showed Evidence Eliminator Version 6 was installed on the computer on January 8, 2008. Agent Hawke also found remnants of an earlier version of Evidence Eliminator on this computer. The analysis of this exhibit also revealed that this program was accessed several times, including at approximately 7:29 a.m. on the day Starner's home was first searched. . . .

Hawke testified that Evidence Eliminator is `marketed as a program to delete and overwrite data . . . we call it antiforensic program to delete the tools that I use in the laboratory to get the data back. It makes it so that I can't find the data because it's destroyed.? . . . He also testified that `one of the things it does is it overwrites data that's on the hard drive.? . . . [and] that Evidence Eliminator advertises that `it defeats the forensic tools we have to use to get the data back to be used as evidence or information in an investigation.?

State v. Starner, supra. All I know about the substance of Starner?s Daubert argument is what?s noted above. I assume it had something to do with . . . what? . . . with whether the Evidence Eliminator program itself is scientifically valid? With whether Hawke?s analysis of the installation and use of Evidence Eliminator on the two computers was based on a methodology that was scientifically valid? I?m really not sure.

And the Court of Appeals? opinion doesn?t help me out. It held that contrary to Starner?s

assertions in his brief to this Court, the testimony about the marketing of Evidence Eliminator had nothing to do with any expert scientific testing or other such specialized information. Anyone with basic computer skills could find the website on the Internet and view how it is marketed. Thus, the Daubert test for scientific reliability was unnecessary.

State v. Starner, supra. I would agree with the Court of Appeals? conclusion that testimony about the marketing of Evidence Eliminator wouldn?t raise a Daubert issue. (The court did consider the propriety of admitting the testimony under other evidentiary standards, and ultimately found it was properly admitted.) That seems a really narrow Daubert argument, though.

I wonder if Agent Hawke?s testimony also went to other issues involving Starner?s acquisition, installation and use of Evidence Eliminator and how that related to the facts at issue in the case. I wonder if any of that part of his testimony could have raised a Daubert issue. I?ve found a couple of reported cases in which Daubert was raised with regard to the propriety of admitting the testimony of a computer forensics expert. In one, a federal district court judge ordered a Daubert hearing held on the issue; in another case, a civil case, the court conducted a Daubert hearing and then held that a proposed defense expert witness wouldn?t be allowed to testify because the proponent of his testimony hadn?t shown that his methodologies were reliable under the Daubert standard. U.S. v. Kassir, 2009 WL 910767 (U.S. District Court for the Southern District of New York 2009); Rivera-Cruz v. Latimer, Biaggi, Rachid & Godreau, LLP, 2008 WL 2446331 (U.S. District Court for the District of Puerto Rico 2008).

I?m afraid this post is completely inconclusive. This is one of those opinions that makes me wonder if the proponent?s argument was as specious as the court makes it seem. I found one case in which a court held a Daubert hearing on the reliability of the methods a computer forensics expert used ?pertaining to the alleged wiping of data from? a laptop and the conclusions he drew from his analysis. Nucor Corp. v. Bell, 2008 WL 4442571 (U.S. District Court for the District of South Carolina 2008). The court found that the expert?s methods didn?t meet the Daubert standard and therefore barred him from testifying.

That court, though, focused on the methodologies the prospective witness himself had devised and used to determine that evidence had been wiped. It therefore wasn?t dealing, as was the Starner court, with testimony about the functioning of a software program (or at least I?m assuming that was an issue in Starner?s Daubert argument). I know NIST tests the reliability of computer forensic tools, but I don?t know that it?s tested (or will test) Evidence Eliminator. If NIST had tested the tools Agent Hawke used to conduct his Evidence Eliminator analysis of Starner?s computers I assume that would mean they?d presumptively survive a Daubert challenge.

I?m probably making way too much of this. Maybe there really was no Evidence Eliminator issue in this case, as such; maybe the only use the prosecution made of Evidence Eliminator was to show what lawyers call ?consciousness of guilt,? i.e., to infer from his possession and use of the program that he knew he was doing something ?wrong.? As one court noted, instructions that ?permit the jury to infer `consciousness of guilt? from proven facts, such as making false statements regarding the crime, . . . suppression of evidence . . . and flight? have been held valid. People v. Lewis, 2010 WL 367297 (California Court of Appeals 2010). So maybe that?s all that was going on here.

Full post as published by CYB3RCRIM3 on February 19, 2010 (boomark / email).