Tag Archives: social media

Laptop with headset

Experts Help Justice Department Make Cases Against Capitol Rioters

The Capitol riot investigation has benefitted from people who recognized neighbors, co-workers, and relatives in videos that were posted to social media accounts. Many individuals who stormed the Capitol were either proud of their actions or thought their friends would be entertained by their antics. As they added evidence of their crimes to social media accounts, acquaintances who were shocked by the January 6, 2021 riot brought that evidence to the attention of law enforcement.

Within weeks, rioters who had treated their actions as a lark were scrambling to remove their posts from social media accounts. To conceal evidence of their presence inside the Capitol, individuals closed social media accounts, deleted pictures and videos from their phones, and even smashed their phones to hinder recovery of deleted files. Law enforcement has turned to amateur and professional experts to make cases against hundreds of participants in the Capitol breach.

Open Source Experts

Fortunately for law enforcement, journalists and other concerned Americans recognized the risk that evidence would be scrubbed from social media. Beginning on January 6, they began a collective effort to search Facebook, Instagram, and other social media sites and to archive the livestreams, pictures, videos, and narratives that they found. Open source experts used “automated social media scraping programs” to find incriminating evidence and created shared spreadsheets to catalog and archive their discoveries.

One individual used “open source machine learning and facial recognition software” to capture “every face from the 827 videos that were posted to Parler from inside and outside the Capitol building on January 6.” All of those faces were posted to a website. While some of the individuals who were outside the Capitol might not have trespassed, the site made it possible for individuals who recognized faces to contact law enforcement officers who could investigate further.

The evidence archive has been beneficial to law enforcement, but it has also promoted a broader search for the truth. False claims by politicians and cable media outlets that the riot was caused by antifa or left-wing agitators failed to gain traction, in part because archived video evidence failed to support those claims.

Facial Recognition Experts

Law enforcement officers were able to supplement the open-source archive with pictures and videos taken by security cameras within and surrounding the Capitol. With help from a variety of sources, law enforcement has been able to identify hundreds of individuals whose faces appear in pictures and videos.

While many individuals who breached the Capitol were identified by people who knew them, law enforcement officers turned to facial recognition experts to identify others. In some cases, experts received tips that identified people who were suspected of entering the Capitol, then used technology to find those individuals in videos of the riot.

In other cases, experts began with a picture of a rioter and compared the picture to databases that include photos from multiple sources, including mug shots, driver’s license photos, dating apps, and selfies found on social media. For example, experts using facial recognition technology were able to identify Stephen Chase Randolph, who was seen on video “assaulting multiple US Capitol Police officers.”

Cellphone Tracking Experts

Cellphone tracking experts gathered the “phone numbers of congressional members and staffers, responding law enforcement officers and agents, Secret Service protectees, responding medical personnel, and other authorized governmental employees” who were inside the Capitol during the riot. Cellphone tracking experts then used technology to identify cellphones that were present in the Capitol during the riot. 

The cellphone data came from GPS locations transmitted by the phones, as well as information about nearby Wi-Fi access points and Bluetooth beacons. By subtracting phones belonging to persons whose presence was authorized, authorities were able to identify phones that may have belonged to trespassers and rioters. That evidence contributed to the arrest of Jeremy Daniel Groseclose after experts concluded that a phone associated with Groseclose was probably inside the Capitol during the riot.

Expert Witnesses

None of the Capitol riot cases have gone to trial, in part because video evidence, selfies, and incriminating social media posts have provided compelling evidence of guilt in most cases. If cases do go to trial, expert witnesses are likely to pay a vital role.

While selfies have generally created clear images, it is not always easy to pick out faces from videos of the rioting crowd. Digital enhancement experts will likely testify about techniques they used to stabilize moving images, remove blurs, and increase the clarity of images. Combined with cellphone and facial recognition experts, the Department of Justice hope to present convincing expert evidence to prove the guilt of Capitol rioters. 

Indiana US State Law Legal System Concept

Indiana Allows Police Officer to Testify as Facebook Expert

A man convicted of stalking a woman by sending her Facebook messages from several different accounts complained on appeal that a police officer should not have been allowed to give expert testimony linking him to the Facebook messages. The Indiana Court of Appeals concluded that the officer’s expert testimony was properly admitted.

Facts of the Case

Christopher Johnson met a woman identified as D.K. in 2012. He repeatedly contacted her by means of telephone calls, texts, and social media. D.K. did not welcome Johnson’s attention and asked him to stop. When he did not, D.K. obtained a protective order that prohibited further contact. She obtained the order in May 2014 but the contact continued.

Johnson went to D.K.’s home in 2015. When he was arrested for violating the protective order, he denied that he knew the order existed. The police then served him with the order and released him.

Johnson went to D.K.’s home twice after being served with the protective order. On the second occasion, Johnson was arrested. He was charged with multiple counts of stalking for visiting D.K.’s home, for texting her, and for sending Facebook messages both before and after the protective order was entered.

Expert Testimony

The Facebook messages were sent to D.K. from several accounts. The prosecution alleged that the accounts all belonged to Johnson, who opened them using false identities.

To prove that claim, the prosecution offered the expert testimony of Sergeant Steven Schafer, a member of the Computer and Digital Forensic Unit of the Indianapolis Metropolitan Police Department. He testified as an expert in “forensic analysis of social media records and digital trails.”

The defense objected that Schafer was not qualified to link Johnson to the Facebook accounts. The trial court overruled that objection and permitted Schafer to testify.

Schafer testified that he attributed five Facebook accounts to Johnson that were not in Johnson’s name. He concluded that the accounts belonged to Johnson because each account user logged into Facebook from the same IP address. In addition, each account was associated with the same “cookie” on Johnson’s computer. Those facts caused Schafer to conclude that the same person, presumably Johnson, logged into each Facebook account from Johnson’s computer.

The defense presented no expert testimony to counter Schafer’s testimony. Johnson was convicted. On appeal, Johnson argued that the trial court erred by admitting Schafer’s expert testimony.

Appellate Court’s Ruling

Schafer is not a computer scientist. He learned about the significance of IP addresses and cookies from “classes put on by … the Indiana State Police cyber crimes unit,” a Secret Service class on internet investigations, “several small classes,” online training provided by Internet Crimes Against Children, and on-the-job training which included an analysis of social media records in 300 or more cases.

The appellate court’s decision does not reveal whether the classes were taught by computer scientists or other qualified personnel. The court of appeals nevertheless concluded that the trial court did not abuse its discretion in allowing Schafer to testify as an expert.

Although the court of appeals’ analysis is cursory, it seems likely that Schafer’s training was sufficient because the concepts of internet cookies and IP addresses are so widely understood that even someone with rudimentary training would be able to explain them. In addition, the court noted that the case was tried to a judge, not a jury. Judges are presumably less likely to be swayed by police officers who are labeled as “experts” than juries might be.

If the case had involved more complex technological issues, the outcome might have been different. Presumably, if there had been a serious dispute about the accuracy of Schafer’s testimony, the defense would have called a computer scientist as an expert witness to contest Schafer’s conclusions.

Polar Bear Analogy

A second issue on appeal addressed one of Schafer’s conclusions. When asked how likely it was that five different people would have used a device that shared the same Facebook cookie and the same IP address, Schafer answered that it was less likely “than being struck by lightning while hitting the super lotto and being bitten by a polar bear at the same time.”

The answer was colorful but not supported by facts. Schafer is not a statistician but the question called for a probability analysis. An honest answer would have been “I don’t know.” The appellate court nevertheless concluded that Schafer’s answer was merely an analogy, not a statistical analysis. The opinion does not explain how an inaccurate analogy that isn’t grounded in fact could be relevant evidence.

Schafer’s answer could not have been helpful to the judge because the judge could just as easily have drawn the same conclusion that several different people would be very unlikely to send similar messages to the same person from the same computer. Since Schafer wasn’t qualified to give an expert statistical opinion and since his lay opinion was not helpful, he should not have been allowed to answer the question.

The defense, however, did not object to the question, which made it possible for Schafer to answer. The defense objected when the prosecution asked whether Schafer could say definitively that one person sent all the Facebook messages, and the judge sustained the objection because Schafer clearly did not have any basis for offering an expert opinion. The judge might also have sustained an objection to the probability question if one had been made.

In the absence of an objection, Johnson needed to show that Schafer’s answer deprived him of a fundamentally fair trial. Since there was no reason to believe that Schafer’s colorful answer influenced the outcome of the trial, Johnson was not entitled to reversal of his conviction.

Lessons Learned

Two lessons should be drawn from this decision. First, experts should not express opinions they are not qualified to give. Police experts have been criticized in some instances for their zealous desire to help the prosecution, and this appears to be another case of a police expert going too far.

Second, when experts are qualified in a narrow field (such as computer forensics) and are asked for a question that requires additional expertise (such as a probability analysis), the opposing attorney should object. In the absence of an objection, it is difficult to base an appeal on an expert’s improper answer.