Tag Archives: Computer Forensics

Indiana US State Law Legal System Concept

Indiana Allows Police Officer to Testify as Facebook Expert

A man convicted of stalking a woman by sending her Facebook messages from several different accounts complained on appeal that a police officer should not have been allowed to give expert testimony linking him to the Facebook messages. The Indiana Court of Appeals concluded that the officer’s expert testimony was properly admitted.

Facts of the Case

Christopher Johnson met a woman identified as D.K. in 2012. He repeatedly contacted her by means of telephone calls, texts, and social media. D.K. did not welcome Johnson’s attention and asked him to stop. When he did not, D.K. obtained a protective order that prohibited further contact. She obtained the order in May 2014 but the contact continued.

Johnson went to D.K.’s home in 2015. When he was arrested for violating the protective order, he denied that he knew the order existed. The police then served him with the order and released him.

Johnson went to D.K.’s home twice after being served with the protective order. On the second occasion, Johnson was arrested. He was charged with multiple counts of stalking for visiting D.K.’s home, for texting her, and for sending Facebook messages both before and after the protective order was entered.

Expert Testimony

The Facebook messages were sent to D.K. from several accounts. The prosecution alleged that the accounts all belonged to Johnson, who opened them using false identities.

To prove that claim, the prosecution offered the expert testimony of Sergeant Steven Schafer, a member of the Computer and Digital Forensic Unit of the Indianapolis Metropolitan Police Department. He testified as an expert in “forensic analysis of social media records and digital trails.”

The defense objected that Schafer was not qualified to link Johnson to the Facebook accounts. The trial court overruled that objection and permitted Schafer to testify.

Schafer testified that he attributed five Facebook accounts to Johnson that were not in Johnson’s name. He concluded that the accounts belonged to Johnson because each account user logged into Facebook from the same IP address. In addition, each account was associated with the same “cookie” on Johnson’s computer. Those facts caused Schafer to conclude that the same person, presumably Johnson, logged into each Facebook account from Johnson’s computer.

The defense presented no expert testimony to counter Schafer’s testimony. Johnson was convicted. On appeal, Johnson argued that the trial court erred by admitting Schafer’s expert testimony.

Appellate Court’s Ruling

Schafer is not a computer scientist. He learned about the significance of IP addresses and cookies from “classes put on by … the Indiana State Police cyber crimes unit,” a Secret Service class on internet investigations, “several small classes,” online training provided by Internet Crimes Against Children, and on-the-job training which included an analysis of social media records in 300 or more cases.

The appellate court’s decision does not reveal whether the classes were taught by computer scientists or other qualified personnel. The court of appeals nevertheless concluded that the trial court did not abuse its discretion in allowing Schafer to testify as an expert.

Although the court of appeals’ analysis is cursory, it seems likely that Schafer’s training was sufficient because the concepts of internet cookies and IP addresses are so widely understood that even someone with rudimentary training would be able to explain them. In addition, the court noted that the case was tried to a judge, not a jury. Judges are presumably less likely to be swayed by police officers who are labeled as “experts” than juries might be.

If the case had involved more complex technological issues, the outcome might have been different. Presumably, if there had been a serious dispute about the accuracy of Schafer’s testimony, the defense would have called a computer scientist as an expert witness to contest Schafer’s conclusions.

Polar Bear Analogy

A second issue on appeal addressed one of Schafer’s conclusions. When asked how likely it was that five different people would have used a device that shared the same Facebook cookie and the same IP address, Schafer answered that it was less likely “than being struck by lightning while hitting the super lotto and being bitten by a polar bear at the same time.”

The answer was colorful but not supported by facts. Schafer is not a statistician but the question called for a probability analysis. An honest answer would have been “I don’t know.” The appellate court nevertheless concluded that Schafer’s answer was merely an analogy, not a statistical analysis. The opinion does not explain how an inaccurate analogy that isn’t grounded in fact could be relevant evidence.

Schafer’s answer could not have been helpful to the judge because the judge could just as easily have drawn the same conclusion that several different people would be very unlikely to send similar messages to the same person from the same computer. Since Schafer wasn’t qualified to give an expert statistical opinion and since his lay opinion was not helpful, he should not have been allowed to answer the question.

The defense, however, did not object to the question, which made it possible for Schafer to answer. The defense objected when the prosecution asked whether Schafer could say definitively that one person sent all the Facebook messages, and the judge sustained the objection because Schafer clearly did not have any basis for offering an expert opinion. The judge might also have sustained an objection to the probability question if one had been made.

In the absence of an objection, Johnson needed to show that Schafer’s answer deprived him of a fundamentally fair trial. Since there was no reason to believe that Schafer’s colorful answer influenced the outcome of the trial, Johnson was not entitled to reversal of his conviction.

Lessons Learned

Two lessons should be drawn from this decision. First, experts should not express opinions they are not qualified to give. Police experts have been criticized in some instances for their zealous desire to help the prosecution, and this appears to be another case of a police expert going too far.

Second, when experts are qualified in a narrow field (such as computer forensics) and are asked for a question that requires additional expertise (such as a probability analysis), the opposing attorney should object. In the absence of an objection, it is difficult to base an appeal on an expert’s improper answer.

Seal of State of Florida and Gavel

Florida Computer Expert Arrested for Lying About Credentials Under Oath

While awaiting trial on more than a dozen felonies involving sexual abuse of a child, Jason Eugene Daniels got a tip from his cellmate about an expert witness who could assist his defense. The expert, Chester Kwitowski, had testified as a computer forensics expert in other Polk County, Florida cases.

Daniels passed the expert’s name to his defense attorney, who asked Kwitowski for his resume. Impressed with Kwitowksi’s credentials, the attorney decided to engage his services. That turned out to be an unfortunate decision, particularly for Kwitowski. After he testified, Kwitowski was arrested for perjury. Even more unfortunate is the opportunity Kwitowski gave the Polk County Sheriff to criticize defense experts.

Kwitowski’s Arrest

The Tampa Bay Times reports that a sheriff’s detective who was serving as a prosecution expert in Daniels’ case became suspicious about “inconsistencies in Kwitowski’s qualifications.” The Sheriff’s Office began an investigation. Kwitowski was arrested after detectives discovered that some of his credentials were falsified.

Kwitowski was charged with committing perjury when he testified about his education, his professional certifications, and his military service. Kwitowski falsely claimed to have a master’s degree in computer science and engineering and to have multiple computer forensics certifications. He also gave false testimony about having a “Top Secret clearance” and working on “sensitive government projects.”

An investigation by the Tampa Bay Times also cast doubt on Kwitowski’s claim that he had “information technology and systems support contracts” with two government offices. Those offices had no record of contracting with Kwitowski.

Kwitowski said he testified as a computer forensics expert at least fifty times in state and federal courts. The Sheriff’s Office is investigating that claim to determine whether it was exaggerated.

Sheriff Criticizes Defense Experts

An interview that the Polk County Sheriff gave to a news station suggests that the Sheriff’s Office had a grudge against Kwitowski. The Sheriff said, “We call him Chester who defends the molesters.”

The implication is that expert witnesses should not testify for the defense in child pornography or child molestation cases. The Sheriff’s uncharitable attitude is inconsistent with the presumption of innocence and the constitutional right to present a defense.

Experts should not be impugned simply because they testify for one side or the other in a criminal prosecution. Experts are advocates for the truth, not for a particular party.

The Importance of Defense Experts

Computer forensics experts play a crucial role in assuring that juries understand the evidence against individuals who are accused of crime. Sloppy work by a prosecution expert, left unchallenged, can lead to a wrongful conviction.

Julie Amero is a case in point. While working as a substitute teacher, Amero used a classroom computer to check her email. The computer began to display pornographic images in a series of popups. As quickly as Amero closed one, another would take its place.

Students in the classroom saw the images. She reported it to school officials, who told her not to worry. Concerned parents, however, pressured the school to report Amero to law enforcement authorities. Amero was accused of surfing pornographic websites in the classroom. The accusations led to her arrest for causing a risk of injury to a minor.

The prosecution called a computer forensics expert who testified that the computer could not have displayed pornographic popups, as Amero claimed. The defense did not call an expert and Amero was convicted.

If Amero’s defense attorney had hired an expert, it is likely the case would have been dropped. After her conviction, forensic computer experts volunteered to help her. They explained that her version of events was consistent with a malicious spyware program. Their assistance shamed the prosecution into sending the computer’s hard drive to the state police forensics laboratory. An analysis found evidence that supported Amero and that contradicted the state’s expert witness.

Based on the new expert evidence, a judge overturned Amero’s conviction. The judge also found that the prosecution’s computer forensics expert had given false testimony. But for the willingness of experts to step in and remedy an injustice, Amero’s wrongful convictions would still be haunting her.

Lessons Learned

Jack Townley, the president of the Florida chapter of the Forensic Expert Witness Association, told the Tampa Bay Times that once someone has testified as an expert, lawyers tend to assume that the expert’s credentials have been verified. That isn’t always the case, as Kwitowski’s history demonstrates.

It never hurts to ask an expert to verify claims made on a resume. Producing a copy of a diploma or of certifications shouldn’t be burdensome for most experts, and a failure to do so should cause lawyers to raise an eyebrow and ask whether the expert might be hiding something.

Only a small percentage of expert witnesses fabricate their resumes, which might lull lawyers into a false sense of security. As Townley notes, the more time lawyers spend verifying credentials, the less time they have available to prepare for court. At the same time, an attorney who fails to check credentials runs the risk that a lawyer on the other side of the case will do so. It’s better to learn about an expert’s problematic resume before making a decision to put the expert on the witness stand than to watch the expert’s credibility be destroyed on cross-examination.