Criminal Law

 < Day Day Up > 



Criminal acts are those acts offending society as a whole. Should an individual be the victim of a criminal act, it is deemed to be a criminal act against society. Interestingly, it is possible that criminal acts may also form the basis for civil suits. So the offender may suffer a criminal sentence for violating criminal statutes and may be sued, resulting in financial awards for victims. Criminal laws are found on federal, state, and local levels with many overlapping one another, resulting in jurisdiction controversies.

The primary distinction between criminal law and civil law is the degree and type of punishment. Criminal laws vary widely in their penalties, including fines, restitution, asset forfeiture, incarceration, and supervised probation. Because the nature of criminal punishment is so potentially devastating, there are many safeguards protecting the defendant's rights. Defendants have the right to be faced by their accusers, they have the right to competent legal counsel, they have the right against self-incrimination, they have the right to their possessions from unwarranted search and seizure, they have a right to have a jury of their peers decide their case, and they have the right to legal appeal.

Distinguishing criminal proceedings from civil actions is the assumption that defendants are not guilty, with the burden of proof resting on the prosecution. As criminal laws are found on multiple levels, so it is with prosecution. It is important to note that although there are different levels of prosecution, the steps taken by prosecutors are basically the same. Cases are characterized, regardless of venue, on the establishment of probable cause, with convictions proved beyond a reasonable doubt.

Allegations

In their most basic form, these are the steps of a criminal investigation and conviction.

Most cases start with an allegation. This allegation may be a factual statement made by a witness, a logical conclusion based on a credible witness' experience, a series of news reports, the findings of an audit, or something similar.

Two prongs must generally be present before starting an investigation: (1) are the allegations reasonable? and (2) are the allegations corroborable?

Investigations cannot be motivated by personal or political reasons; they must be based on articulated facts and circumstances. Law enforcement officers, agents, prosecutors, and the courts have many levels of supervisory, appellate, citizen, legislative, and legal safeguards. Administrative and legal penalties face law enforcement investigators if they engage in prohibited conduct, ranging from censure, dismissal, civil suit, and incarceration.

The Investigation

Investigators are tasked with evidence collection. The most valuable evidence comes from those who have direct knowledge of the criminal act supported by physical evidence. Of course, what a witness has observed or heard determines direct knowledge. If a witness sees someone committing a criminal act, that is direct knowledge. However, if the systems administrator tells her supervisor about an alleged criminal act committed by the help desk manager, that is considered hearsay and, depending on a number of circumstances, may or may not be admissible. Just because overheard statements may be hearsay does not necessarily diminish their value. For example, in most jurisdictions, statements made by defendants that are overheard by third parties are admissible as hearsay statements in legal proceedings. Hearsay should be documented as part of the investigator's interview report but only after documenting their direct knowledge. Investigators must separate what is direct knowledge from hearsay when interviewing witnesses.

Witnesses

For the most part, witnesses are divided into several categories. They may be witnesses of fact; they may possess specialized experience, training, and expertise and be called as expert witnesses; or they may be witnesses that may testify about a defendant's history, character, or credibility.

If witnesses or other people having material facts or evidence are reluctant to provide these facts, or it is deemed important to generate a transcript of testimony, these individuals may receive a summons or subpoena to appear before a grand jury or a judge. During such appearances, the witnesses are examined while a recording of their testimony is made. Such proceedings may be open to the public or in the case of a grand jury, they are held in secret.

Grand Juries

Grand juries are bodies of common persons empaneled for a period of a year or more who have the job of reviewing evidence and deciding the existence of probable cause. Prosecutors with supervision and oversight conduct grand jury proceedings by a presiding judge. Defense lawyers may not enter the chambers representing their client's interests. However, if a witness so desires, she may stop the proceeding and consult with her attorney outside the grand jury chambers. Grand juries listen to witness examinations conducted by prosecutors, review physical evidence, and listen to arguments from prosecutors. Defense attorneys are rarely allowed to address grand juries. This may seem unfair, but the task of the grand jury is merely that of deciding the existence of probable cause; they are not charged with deliberating the defendant's guilt or innocence. Grand juries decide whether sufficient probable cause exists that a crime has been committed and whether there is sufficient probable cause to believe that the defendant committed that crime. Grand juries are generally chosen from voter rolls or similar lists. Selection is random and the term of service may vary from one year to more than 18 months. Depending on the nature of the case under investigation, it is possible that a grand jury might be named to hear only one case. Depending on the matters before them, they may meet monthly or more often.

In most cases, grand jury proceedings are secret. Grand jurors, prosecutors, and reporters suffer criminal prosecution if they reveal the content of the proceedings; however; witnesses generally are free to discuss their testimony and the proceedings without sanction.

Experience Note 

Probable cause is a term that has vexed many people and is defined by legal terms that can become overly entwined. For argument's sake, consider that probable cause is defined by a set of facts and circumstances that lead reasonable people to believe that it is probable that an alleged event actually happened.

Grand juries have the task of deciding probable cause. Based on testimony and evidence:

  • Is there probable cause to believe a crime has taken place?

  • Is there probable cause to believe that a person, named or unnamed, committed that crime?

Grand juries may not be persuaded by conversations heard outside their deliberations or by news reports; they may only consider the case by the evidence and arguments presented in their chambers.

Transcripts of their proceedings include the examination of witnesses, introduction and examination of evidence, and statements made by the prosecutors. Grand jury deliberations are not recorded and are not subject to discovery. After hearing testimony, reviewing evidence, and hearing argument, grand juries deliberate. At this time, the prosecutor is not permitted to participate in their deliberations and is excused along with the recorder. Prosecutors present them with an indictment. Basically, an indictment is a formal document where a defendant is charged with violating the law. If grand jurors arrive at a decision, there are two paths: true bill and no bill. True bills result in indictments. Indictments mean the grand jury has decided there is sufficient probable cause to charge the defendant with a crime. Traditionally, indictments are divided by the number of times the defendant allegedly violated the law. In many jurisdictions, defendants are not invited to the grand jury and they do not have the opportunity to deliver evidence or testimony that would show that the evidence is not sufficient to accuse them. There are jurisdictions that send "target letters" to potential defendants who are subjects of grand jury investigations. They are invited to deliver any exculpatory evidence to the grand jury before they deliberate.

In the true bill, the grand jury decided there was probable cause and the prosecutor takes the indictment to the presiding judge, requesting either a warrant to arrest the defendant or a summons for the defendant to appear. In the case of a no bill, the prosecutor has the grand jury's decision and she must decide whether all the evidence has been presented and the matter is closed, or seek more evidence and present the matter again for further consideration.

In jurisdictions not having grand juries, the accusatory process is similar, except the matter is presented to a single judge listening to the witness testimony and reviewing physical evidence. In this case, the proceedings are recorded as they are before the grand jury. The judge is responsible for making the probable cause decision. This decision also results in either an arrest warrant or a summons to appear.

Arrest warrants are documents commanding law enforcement officers to arrest individuals, assuring their appearance before the court of jurisdiction, meaning the court where they are accused. If defendants are arrested outside the originating venue, then it becomes a matter of whether prosecutors will seek extradition of the defendant, wherever he may be found. Extradition may be waived or pursued at the pleasure of the defendant, as there are certain rights that attach. The defendant has the right to dispute whether he is the person named in the arrest warrant and to be represented during those proceedings. Summons are similar to invitations in that they command an individual to appear before the court; however, if they fail to do so, the judge will dismiss the summons to appear and issue an arrest warrant.

Arrest warrants can be executed by law officers and, depending on the circumstances, by ordinary citizens. They are enforceable at any hour on any day.

Subpoenas and Summons

Subpoenas may be issued by the grand jury and are basically predicated on investigative need. They are demands for a witness to appear or evidence to be brought before the grand jury. A summons is a document issued by judges demanding a witness appearance or evidence. Subpoenas may be quashed (dismissed) if the person named provides sufficient cause contesting the subpoena, validity of the subpoena, or the demands made by it.

Experience Note 

A person receiving a grand jury subpoena is commanded to appear at the grand jury for testimony. She is not the same person as named in the subpoena and advises the court of the matter. The prosecutor is convinced she is the correct person and refuses to withdraw the subpoena, so her attorney files a motion to quash the subpoena triggering a hearing. At the hearing, the presiding judge hears testimony and argument, deciding if the subpoena should be enforced.

If there is sufficient cause to quash, then the court of jurisdiction withdraws the subpoena or summons. Failing to file a motion to quash, or sufficient other reason, the person must comply with the subpoena or summons, or the court issues an arrest warrant to have the named person arrested and brought before the court.

If a person is taken before the examining body, either a grand jury or judge, he retains his rights. In these proceedings, he has a right to legal counsel (although his lawyers may not appear before the grand jury, the proceedings may be stopped and they may consult with their client outside the grand jury room for advice), and he has the right against self-incrimination in his testimony. There have been many cases where an individual who received a subpoena and was commanded to appear before a grand jury invoked his Fifth Amendment rights when questioned. But he appeared because if he failed to do so, he would have been arrested.

There are generally two types of subpoenas: one resulting from a grand jury investigation and the other being issued by a judge. Both are documents based on need carrying the weight of the court. Judge-issued subpoenas are issued for witnesses and evidence to be presented before them at judicial proceedings, usually trials.

Search Warrants

Only law enforcement officers may obtain search warrants, as these documents carry the force of law in their execution. These are instruments that allow the search and seizure of evidence, persons in the case of third-party residences, assets to be seized, and instrumentalities or fruits of a crime. Because they carry force of law, force may be used in their execution should there be any impediment. However, if the executing officers fail to follow the law as well as their department's policies and procedures then they may be successfully sued.

Search warrants are not valid for civil and administrative actions and may not be executed to obtain evidence for these actions. Under the Fourth Amendment to the U.S. Constitution and subsequent case law, a law officer must provide a judge or magistrate with a sworn affidavit detailing the facts and circumstances surrounding the alleged crime. The information delivered by the affidavit must be complete, and the search warrant can only be weighed by its content. Search warrants usually contain the case's allegations, citations of criminal statute violations, a description of the area to be searched, and the reason there is probable cause to search the area. The presiding judge may ask questions by way of clarification, but the affidavit must be a document that stands on its own.

Basically, the judge is going to apply the following test to the affidavit:

  • Is there probable cause to believe that a crime has been committed?

  • Is there probable cause to believe that a person (named or not) committed that crime?

  • Does this court have jurisdiction over the specified crime?

  • Is there probable cause to believe that these fruits or instrumentalities are at that specified location now?

Search warrants are composed of two separate documents: the actual warrant and the affidavit. The search warrant is composed of a formal document describing in detail the area to be searched, the items to be seized, and the court of jurisdiction. Affidavits are statements of facts and circumstances supporting the search warrant.

Search warrants must specify what it is that is going to be seized. The actual area to be searched must be specified on the warrant and may not be expanded by the officers without obtaining another search warrant. Officers may use their observations in the currently valid search warrant to obtain probable cause for another search warrant to expand the area not covered in the first warrant. However, if an item of evidence or contraband is located "in plain sight" while legitimately executing the current search warrant, it may be seized even though the item was not specified on the warrant. This "plain sight seizure" may be used as predication for a second search warrant expanding the original one.

Experience Note 

While officers were executing a search warrant for electronic evidence, they ventured into a cabinet looking for storage media and relevant documentation. The cabinet was within the bounds of the warrant. One of the officers located a bag, weighing approximately one pound, of what appeared to be cocaine. The officer administered a commercially available field test for cocaine, returning a positive reaction. The bag was seized and, based on this discovery and other evidence, the cabinet's owner was charged with criminally distributing cocaine. The court ruled at a suppression hearing that the cocaine seizure was a "plain sight seizure" and was executed within the confines of the search warrant. The cocaine was admitted as evidence.

Any legal challenges to the search warrant such as the reliability of the affidavit's information, the freshness of the information, and the truthfulness of the information, must be addressed through formal hearings and may result in the exclusion of the seized evidence from proceedings or trial.

Experience Note 

It is unwise to impede the execution of a search warrant in any way. Such actions will generally result in the arrest of the person who is obstructing. In most jurisdictions, impeding or obstructing a search warrant is a felony and receives a commensurate sentence. However, persons legally present during a search warrant are well within their rights to ask for the identities of the executing officers, they may make notes or photographs of any officer conversations or actions that they witness, they may also leave the search area. Officers executing a search warrant secure the area, meaning they are going to look for persons or things that may be harmful or capable of evidence destruction.

Persons found at the location of a search warrant are to be told to move away from equipment, workstations, and media. It is also within the officer's purview to pat down the occupants, looking for weapons or devices that might destroy evidence. Once occupants have departed the search area, it is unlikely the officers will allow them to return, and this is a legal act on their part until the search warrant is completed. In some cases, officers may answer telephones and ask details of the callers.

Search warrants are valid only during daylight hours, meaning from 6 a.m. until 10 p.m., unless the officers have established that there are special circumstances that must be stated and justified to the court. Additionally, all search warrants must be executed by knocking and announcing the officers' identities and intentions at the door. Officers may provide special circumstances to the court relieving them of these knock-and-announce obligations. These are the infamous "no-knock" search warrants that have been widely publicized. If the executing officers can provide sufficient cause to the court that knocking and announcing will result in the destruction of evidence or place lives in peril, then the court may be moved to grant this type of warrant. Similarly, justification must be made to the court when officers want to execute the search warrant outside the daylight-hours provision.

Experience Note 

The fact that search warrants must be executed during daylight hours does not mean they must be completed in that time frame. It means the warrant must be started during that time frame.

When officers are executing search warrants, they are in control of the area, meaning they control people's comings and goings, telephone calls, computer activities, etc. If there are any objections to the fashion in which the search warrant was executed, the time and place for contesting a search warrant is in the courts, not during the search warrant execution.

Experience Note 

Search warrant execution has the goal of obtaining evidence or fruits of a crime. There cannot be another purpose such as using a search warrant to seize a business' computer network, resulting in the closure of the business.

The law enforcement agency is required to take every reasonable step to return the business to normal operation as soon as is reasonably possible. Officers must copy data and documentation and return the equipment necessary for the business to continue operation. Search warrants are not analogous to injunctions or cease-and-desist orders. Allegations of outrageous government conduct are often made regarding the fashion in which search warrants are executed or the reason for the warrant.

Experience Note 

Subpoenas and summons are based on "investigative need" and not probable cause. Obtaining a search warrant in place of a subpoena is basically at the discretion of the officer and prosecutor commensurate with the amount of probable cause.

If allegations of outrageous conduct have sufficient merit, they may trigger sanctions by the presiding court, evidence exclusion, civil suits against the officers and their agency as well as administrative actions against the offending officers.

Experience Note 

Search warrants are required in the case of third-party residence and if an officer wants to search for a person she wants to arrest. Also, search warrants must be obtained if an officer wants to search a location for assets to be seized pursuant to forfeiture actions.

When the search warrant is executed, whether anything was seized or not, a copy of the search warrant must be deposited at the location where it was executed along with an inventory of seized items. This search warrant is the document describing the area to be searched and the items to be taken. It does not include the supporting affidavit.

The second part of the search warrant is the affidavit constituting a sworn statement by the officer swearing to the truthfulness of the matter. The officer swearing to the warrant is known in legal terms as the affiant. The law does not require the affiant to have first-hand knowledge of the details of the statement, merely that he has reliable knowledge.

Court Orders

Court orders are issued by a court of jurisdiction and may be requested by law enforcement officers and non-law enforcement officers, depending on the nature of the case. Federal court orders may be filed for a wide variety of actions. For example, an officer installing a video camera on a public building to monitor the area below might require a court order. Court orders are also two-part documents with an application stating the facts and circumstances to the judge justifying the order and the second document being the actual court order.

Testimony

Witness testimony is obtained through interviews, depositions, and examinations. Remember that interviewing is a conversation directed toward specific events. Interrogations are different from interviews; they are deemed coercive, are conducted in a much more hostile atmosphere with the administration of advice of rights, and usually contemporaneous to an arrest. Interviews may be recorded in audio and video form or the investigator may take notes that serve as the basis for a written report of interview.

Experience Note 

Recording media and all forms of notes are considered evidence and must be retained along with a chain of custody schedule.

In the case of the report of interview, this document is not considered a verbatim transcript of the interview; rather, it is a synopsis of the witness statement and serves to deliver information to the prosecutor and defense, and may serve to refresh the witness' memory at trial.

Depositions are formal examinations attended by attorneys, parties to the action, and persons responsible for generating a formal record of the proceedings. Attorneys ask questions of the witnesses, attempting to ask questions that will cause the witness to provide testimony or evidence favorable to their side.

When a judge or magistrate judge examines a person, witnesses are sworn to tell the truth and the judge asks questions with the proceedings recorded. Attorneys representing their clients are present during these hearings along with the prosecution.

Expert Testimony

Typically, expert witnesses are people who are known for their expert knowledge in specific matters. Such knowledge may be technical, scientific, or by virtue of their experience. Federal Rules of Evidence, Rule 702, indicates that if scientific, technical, or other specialized knowledge will assist the trier of fact, then a witness qualified as an expert may testify in the form of an opinion. The U.S. Supreme Court expanded this rule (Daubert v. Merrell Dow Pharmaceuticals, Inc.) in that FRE Rule 702 requires an obligation from trial judges ensuring that expert testimony is reliable and relevant. In this decision, the Court ruled that there is a "gate keeping" obligation placed on judges applicable to all other types of expert testimony.

While it is common to label expert witnesses as people with advanced college degrees, many experts are people who are experienced systems administrators, help desk operators, or risk managers. It is possible to qualify someone as an expert witness just because the individual possesses great knowledge about a particular information technology system or a specific application. The advantage in using such expertise is that it brings a sense of honesty and sincerity to the courtroom.

The basic definition of an expert witness is someone who knows more about a particular topic than the jury and someone who can materially contribute to the jury's task. Nothing is specifically required in terms of background, training, knowledge, or education, other than a sufficient understanding of the relevant subject, contributing to the jury's ability to understand the truth of the matter at hand.

Expert witnesses might participate in grand jury proceedings, judicial hearings, trials, and sentencing.

Defense Arguments Relative to Expert Witnesses

While the expert witness may be someone who advertises or is well known among legal firms as available to testify, too often she is a person that regards herself as able to testify about almost everything.

It is important to note that these so-called experts base their abilities on an engineering background and education. Such experts are vulnerable to vigorous cross-examination by using their previous testimony or depositions. Usually a cross-examination enumerates the various cases that the expert witness has testified, showing that this person claims to be an expert on almost any subject. This activity has the effect of canceling her credibility.

There is an art to delivering expert testimony and not giving away the case. Many inexperienced witnesses tend to believe that the purpose of cross-examination is to discover the truth. The actual purpose of cross-examination might be to make the witnesses appear to be saying something different than what they are trying to say or have said previously. By contradicting themselves, they appear to be less credible to the jury. Experienced expert witnesses think carefully before they answer questions and tend to deliver answers that are exactly responsive to the question.

The Supreme Court further ruled that FRE Rule 702 does not distinguish between scientific, technical, and other specialized knowledge that might be the subject of expert testimony. The Court also highlighted that the essential function of gate keeping is to ensure the reliability of expert and experience-based testimony, and the trial court should consider tests where there are reasonable measures of reliability.

The simplest way of providing valuable testimony is to listen to the question; answer the question sincerely, truthfully, and completely; avoid incomplete responses; do not talk to the jury; and do not address matters outside your knowledge or expertise.

Computer Evidence

For more information, there is an article authored by Orin S. Kerr, Trial Attorney, Computer Crime and Intellectual Property Section, U.S. Department of Justice, written in March 2001. [13] His article is well documented, citing case law and addressing electronic evidence, its authenticity and reliability. There are many urban legends about electronic evidence and Mr. Kerr's article dispels many popular misconceptions.

In executing a search warrant, these are the usual steps by law officers ensuring credible testimony. Law enforcement officers should be trained in the legal and correct methods to collect evidence, ensuring its admissibility at the time of their testimony. If evidence is not gathered in accordance with the greatest attention of detail, it is likely that the evidence will be excluded from further use and may render the case impotent.

Law officers will gather evidence using a process similar to the following:

  • Secure the area where potential evidence is stored, and remove anyone from equipment that could cause the alteration or destruction of the evidence.

  • Ensure there are no devices or weapons that could be used to harm the officers or destroy evidence.

  • Determine if the environment is networked to the outside in an effort to determine if all information is being obtained within the boundaries described by the search warrant. Search warrants are valid for very specific areas and may not be extended. If other potential evidence is discovered outside the scope of the search warrant, officers will secure the area and another search warrant sought to expand the search area. If officers expand the area to be searched without a superceding search warrant, any seized item will likely be rendered inadmissible when attempting to introduce it in court.

  • An officer or examiner with technical forensic training will begin to conduct interviews in order to determine the types of equipment, software, network topology, location of network equipment, network connectivity, and location of backup media.

  • Investigators will photograph and document the search site. This allows them to have a reference for evidence seizures as well as an inventory of seized items.

  • Investigators will generally conduct interviews at this time.

  • Depending on the search warrant, the investigators will seize the target machines or forensically copy the hard drives. Also depending on the search warrant, investigators will either forensically copy the removable media or seize it and copy it later.

  • Investigators will likely seize documentation and media associated with the target machines. Documentation will likely include notes, scraps of paper, user documentation, calendars, diaries, "Post-Its," and items located in the trash.

  • The investigators will initial, date, and tag all the seized items. Seized items will be entered on the seizure inventory. A chain-of-custody schedule will be made, documenting the discovery, location, and anyone who has custody of the evidence.

  • Upon completing the search, the officers will deposit a copy of the search warrant, not including the affidavit, and a copy of the seized-item inventory.

  • Within five days of the executed search warrant, the search warrant return must be made to the court that issued the search warrant. This return is the information that the search warrant was executed, when and where it was executed, and is accompanied by the seized-item inventory. Depending on the case, the search warrant, affidavit, and the inventory may be sealed and may not available until a motion for unsealing is filed.

Experience Note 

The Privacy Protection Act of 1980, 42 U.S. Code 2000aa, requires law enforcement officers to obtain a subpoena, rather than a search warrant, when acquiring materials that are reasonably believed to relate to publication, broadcast, or similar communication to the public.

Means of Collecting Electronic Evidence under Federal Statutes

The laws governing electronic collection are very specific. These statutes also apply to court-ordered wiretaps and microphone recordings (see Exhibit 1).

Exhibit 1

start example

Type of Communication

Court Order

Search Warrant

Subpoena

Wire, electronic, or oral communications (e.g., telephone calls, pager messages, facsimile, e-mail, computer transmissions, and face-to-face communications)

Pursuant to 18 USC 2510 (Title III); must be signed by a federal district court judge and based on affidavit and technique necessity. Interceptions are 30 or less unless extended by another affidavit

  

Stored electronic communications (e.g., e-mail, pager messages, voice mails) in storage 180 days or less; see 18 USC 2703(a)

Unopened electronic communications require Title III warrant. Opened electronic communications require search warrant

18 USC 2703(a) and Rule 41, Federal Rules of Criminal Procedure; no prior notice to customer or subscriber required

 

Stored electronic communications in electronic storage more than 180 days; see 18 USC 2703(a)

18 USC 2703(d); prior notice to customer or subscriber unless notice is delayed pursuant to § 2705; magistrate judge may sign

18 USC 2703(a), (b); no prior notice required

18 USC 2703(a), (b); prior notice to customer or subscriber unless notice is delayed under § 2705

Material held or maintained on a remote computing service (e.g., e-mail, business records, credit records, payroll records); see 18 USC 2703(b)

18 USC 2703(d); prior notice to customer or subscriber unless notice is delayed under § 2705; magistrate judge may sign

As provided for in 18 USC 2703(b); no prior notice required

As provided for in 18 USC 2703(b); prior notice to customer or subscriber unless notice is delayed under § 2705

A record of other information about a subscriber or customer of a communications service provider or remote computing service (not including the contents of a communication); see 18 USC 2703(B) (1)(B)

18 USC 2703(d); magistrate may sign; no prior notice to customer or subscriber is required

18 USC 2703(c) (1)(B); no prior notice to customer or subscriber is required

 

Installation or use of a pen register or a trap-and-trace device

18 USC 3121, et seq.; magistrate judge may sign; order sealed until otherwise ordered by court

  

end example

Federal Legal Requirements for Electronic Surveillance

Exhibit 2 details the legal requirements for law enforcement agencies to engage in electronic surveillance and monitoring.

Exhibit 2

start example

Technique

Device

Authority

Statute

Official Authorizing

Duration of Authority

Weight of Evidence

Phone number dialed real-time (outgoing)

Pen register

Court order

18 USC 3121

U.S. Magistrate Judge

60 days

Relevance to investigation

Phone number dialed real-time (incoming)

Trap-and-trace

Court order

18 USC 3121

U.S. Magistrate Judge

60 days

Relevance to investigation

Face to face, oral communications w/o consenting party

Electronic device to capture and transmit

Title III court order

18 USC 2518

U.S. District Court Judge with DOJ approval

30 days

Probable cause and technique necessity

Computer messages sent via e-mail, Internet, computer network system (real-time interception)

Electronic devices including network equipment allowing real-time message interceptions, all nonpertinent transmissions must be minimized

Title III court order

18 USC 2518

U.S. District Court Judge with DOJ approval

30 days

Probable cause and technique necessity

Names and numbers from electronic address book

Electronic data notebook

Search warrant

Search warrant Rule 41 FRCP (Federal Rules of Criminal Procedure)

U.S. Magistrate Judge

 

Probable cause

Tracking device: transponder bumper, beeper, GPS

Search warrant (to install or monitor signal in Fourth Amendment protected area)

Search warrant

Rule 41 FRCP

U.S. Magistrate Judge

 

Probable cause

Wire communications (real-time): cellular phone, hard-wired telephone (business or residence), and cordless phone

Electronic devices including network equipment allowing real-time message interceptions, all nonpertinent transmissions must be minimized

Title III court order

18 USC 2518

U.S. District Court Judge with DOJ approval

30 days

Probable cause and technique necessity

Computer files stored or downloaded; computer, stand-alone

 

Search warrant (if information in storage 180 days or less)

18 USC 2703(a) and Rule 41 FRCP

U.S. Magistrate Judge

 

Probable cause

end example

Experience Note 

The term Title III refers to the section of the original 1968 law known as the Omnibus Crime and Safe Streets Act. Title III was the section that detailed the legal requirements of intercepting live wire and oral communications. Federal laws governing live interceptions of communications are found in 18 U.S. Code 2500.

Evidence

Evidence has a lifecycle that is begun at the time it is generated and collected, and progresses until it is eventually returned to the original owner or destroyed. It is important to note that many law enforcement agencies have evidence destruction and retention policies. These are the general phases of the evidence lifecycle:

  • Evidence creation or generation. This is the time or event when the evidence is created. For example, at this time an employee installs a pirated version of a graphics program on her office workstation and allows her coworkers to use it.

  • Collection or seizure. At this time, the investigators (law enforcement or corporate) make forensic duplicates of the hard drive where the software is located on the employee's workstation.

  • Examination and analysis. During this phase, the investigators or analysts will search the duplicated hard drive, discovering the location of the pirated software. Depending on the case circumstances, they will search the portions of the hard drive, looking for other pieces of evidence.

  • Storage and preservation. After appropriate levels of examination and analysis have taken place, the hard drive will be stored in conditions preserving its integrity. Access to the evidence and related materials such as the chain-of-custody schedule will be extremely limited. For example, the only persons allowed to access the evidence will be the investigators in charge of the case.

  • Presentation in legal proceedings. The evidence will be retrieved from storage and presented in legal proceedings. When they are completed, it will be returned to storage along with relevant materials.

  • Destruction or return to original owner. At some future time, a determination will be made relative to the policy of whether or not the evidence should be returned to the owner. In the example of the pirated software, because the duplicated hard drive was not the property of the owner, it will be destroyed. The guiding principle of whether or not the evidence is retained depends greatly on whether it will be needed in the future. For example, if a person's hard drive containing pornography were seized, it may be cleansed of the contraband before being returned.

Criminal Procedure

After the officers have completed their job of collecting electronic evidence, they submit it for forensic analysis. Officers taking custody of evidence rarely perform analysis on it. The burden of proof rests with the prosecution, so examination and analysis are critical to proving or disproving the allegations. Crimes must be proved "beyond a reasonable doubt" that the accused defendant intended to violate specific criminal statutes and actually violated them. In the case of digital evidence, it might pass through a single analyst or it may pass through several in an effort to extract all relevant information from it.

After the evidence has been reviewed, officers draft an investigative report that will be transmitted first to their supervisor for review and approval and then to the corresponding prosecutor. This investigative summary contains reports of relevant interviews, list of evidence and its analysis, and relevant statutes. It is important to note that all evidence, whether incriminating or exculpatory, must be provided as discovery to the defense or the matter may be dismissed.

Prosecutors will carefully review the investigative report and determine if the case is attractive to prosecution. Depending on the nature of the investigation, the investigators may be asked to complete other interviews, collect more evidence, or conduct more analyses before the prosecutors determine the matter is sufficiently complete to present to a grand jury or a judge for a determination of probable cause.

Experience Note 

Because of laws such as the "Speedy Trial Act" (18 USC §§ 3161-3174), where defendants are guaranteed judicial proceedings within specific periods of time, prosecutors generally want the investigation sufficiently complete to bring to trial at the time of charging or shortly thereafter.

In some jurisdictions, prosecutors must prepare a document outlining arguments about why this matter should be prosecuted as well as anticipating any possible defense contentions. The prosecutor's report, including the officer's report, is then passed to the prosecutor's managers for a final determination as to the case's merit.

If there is some degree of urgency, the prosecutor will draft a complaint supported by an affidavit from the officers, and the matter will be presented before a judge, along with a request for an arrest warrant. As with the search warrant, the matter must be based on an affidavit (sworn statement) propounding the facts and circumstances of the matter within the test of probable cause.

Assuming the defendant is in custody, there are a series of hearings where the court ensures the defendant is aware of his rights and has the opportunity to retain counsel, or the court will appoint counsel preserving his Sixth Amendment rights.

Shortly after appearing at court, the defendant is entitled to an arraignment. At arraignment, the defendant will hear the charges against him, declare himself guilty or not guilty, and the court will ensure he has an attorney, appointing one if needed. If the defendant declares he is not guilty, the matter proceeds to trial; if he pleads guilty, he is scheduled for sentencing.

Once the defendant is charged and in custody, the prosecutor has essentially 70 days to bring the matter to trial under the provisions of the Speedy Trial Act, 18 U.S. Code 3161, unless the defendant waives this right. Cases have been dismissed if prosecutors failed to bring the matter to trial within the specific time limits.

Criminal Discovery

At this point, the process of discovery begins. The defense has the right to review the evidence - not only the incriminating evidence supporting the indictment, but also the exculpatory evidence must be delivered to the defendant's lawyer.

Rule 16 of the Federal Rules of Criminal Procedure provides for the defense to have access for the purpose of inspection, copying, or photographing the prosecution's relevant materials. Relevant materials include but are not necessarily limited to the following:

  • Substance of any oral statement intended to be offered as evidence made by the defendant

  • Defendant's statements made before the grand jury

  • Defendant's prior criminal record

  • Evidence material to the defendant's defense or intended to be introduced by the prosecution

  • Items seized from the defendant and material to the defense

  • Reports of examinations and tests material for the defense or intended to be used by the prosecution

Looking at this list would lead you to think that everything is discoverable; that is not the case. Internal documents consisting of memoranda or other nonevidentiary administrative documents are not subject to criminal discovery processes. For example, the prosecutor's office may require the prosecutor to prepare a memorandum summarizing the case, complete with possible defense arguments before being authorized to present the matter to the grand jury. This case summary would not be subject to discovery because it would be considered an administrative document and exempt as evidence.

Under the provisions of Maryland v. Brady, 373 U.S. 83 and 397 U.S. 742, the prosecution must deliver all relevant items, withholding nothing, including reports, analyses, affidavits, notes, criminal records of potential witnesses, list of potential witnesses, and a list of potential evidence to be introduced. This concept has been expanded to include relevant information about the pertinent law officers' backgrounds, including whether they have been disciplined for administrative infractions impacting their witness credibility. An example would be if a law officer were disciplined for violating an agency's policy regarding official use of an automobile, and during the internal investigation the officer lied to the investigators and was subsequently disciplined. This action would be an item impacting the officer's credibility and would have to be revealed to the defense as possibly affecting the officer's ability to deliver credible testimony. [14]

The discovery phase is one of the most critical phases in judicial proceedings, both criminal and civil. It is important to note that evidence may not be colored or tainted or it will likely be excluded from the case. For example, if it is discovered that seized digital files were encrypted and subsequently decrypted, then the decrypted materials must be provided to the defense. Failure to deliver the readable materials to the defendants will result in the case being dismissed or the evidence excluded from the proceedings.

Electronic Discovery

Computer-based discovery offers substantive advantages over the conventional documentary evidence that would have been difficult to manage in today's world. Documents that were previously lost or destroyed as routine are now retrievable. Most computer-mediated communications methods, from e-mail to videoconferences, are recorded and archived as digital records. Judges are becoming more sophisticated in their rulings about computer-related evidence. Attorneys are now quick to realize they cannot bamboozle the bench or stonewall their way through computer-based discovery. As a matter of course, attorneys seeking discovery of digital information should immediately notify the opposing counsel of that fact, identifying as clearly as possible the types and categories of information that is going to be sought, avoiding possible accusations of negligent spoliation.

E-Mail as Evidence

There is no correlation between e-mail and paper-based communications. E-mail usually is not filed in a rational filing system and is a problem for discovery purposes due to its sheer volume. The most important factor in e-mail as an object for discovery is its characteristic informal, casual, and often playful tone, even in the most formal business environments. These are characteristics that make e-mail very attractive for collection as evidence.

Prosecutors should have a clear understanding of the defendant's e-mail system with special attention paid to the nature of retention policies and procedures, and the extent of backed-up files. Backup tapes and other media are often maintained for months or possibly years. Backup tapes are not organized for retrieval of individual files, but their purpose is for emergencies, requiring large amounts of data are restored to the active system.

Criminal Plea Bargains

After the defendant and her lawyer have time to review the evidence disclosed in the discovery phase of the proceedings, it is common for a "plea bargain" to be sought. This action is one where the defendant agrees to enter a plea of guilty to specified charges, usually less than the original charges, and the prosecution agrees to accept the pleading in consideration of those lesser charges. In today's world, there are many factors impacting pleadings:

  • The strength of the witnesses, defense, and prosecution

  • The strength of the evidence

  • Length of sentence relative to the charges

  • Asset forfeiture action

  • Civil remedies sought by the state or government

  • Cooperation of the defendant impacting other defendants and crimes

  • Return of goods

  • Restitution paid to injured parties

  • Fines paid to court

When the defendant enters a guilty plea, the matter is scheduled for sentencing. If the defendant enters a plea of not guilty, then the matter is scheduled for trial.

Trials

Basically, there are two types of trials: one heard by a judge and the other heard by a jury, called a petit jury, distinguishing it from a grand jury. Most jury panels are composed of ordinary citizens from the court's surrounding geographic area. Pursuant to questioning by both sides, jurors are qualified and candidates empanelled for the proceedings.

Experience Note 

One of the most interesting facts about a petit jury trial is the jury is usually instructed as to what constitutes evidence and what is argument. This fact is significant in that they are instructed to rule on the evidence while excluding argument during their deliberations.

Jurors are instructed in great detail about their obligations and duties. After all the proceedings are completed, the jury adjourns to pursue its deliberations. The jury may only consider and weigh the evidence presented in court and from nowhere else. Argument, which is the attorneys' statements, is supposed to be separated from testimony. If they are convinced beyond a reasonable doubt of the defendant's guilt, then the defendant is found guilty and scheduled for sentencing. If they are not convinced of the defendant's guilt beyond a reasonable doubt, and they all agree that the defendant is not guilty, then the defendant is acquitted. If they cannot agree, then the matter is deadlocked. In this instance, if they cannot deliberate to a guilty verdict or acquittal, then the judge declares a mistrial and dismisses the charges. In this case, the prosecution must decide whether or not to charge the defendant again.

Sentencing

Sentencing the defendant is usually done after a court officer has prepared a report that synopsizes the case, victims and their losses, facts about the defendant's background and criminal history, extent of the crime, defendant's ability to make restitution and pay fines, and makes sentencing recommendations.

Experience Note 

Judges may accept or reject any plea bargain between the prosecutors and defense lawyers before the trial, but once the trial has begun, it is generally allowed to follow its own course.

Sentencing is the process by which the court levies monetary fines, demands victim restitution, declares that the defendant receives supervision in the form of probation, forfeits assets, or is remanded to a period of incarceration.

Appeals

Of course, under the system of justice in the United States, the defendant has the right of appeal. An appeal essentially states that there was an error committed in any part of the proceedings, including the constitutionality of the law under which the defendant was charged. Only matters of law and procedures are heard by appellate courts; they do not hear testimony and they do not review evidence. Decisions made by appellate courts consist of dismissing the matter, remanding the matter for another trial, or modifying the sentence. [15]

[13]Available at: http://www.cybercrime.gov/usamarch2001_4.htm.

[14]More information is available at http://www.fbi.gov/publications/leb/1996/july966.txt.

[15]The latest version of the Federal Rules of Criminal Procedure is available at http://www2.law.cornell.edu/cgi-bin/foliocgiexe/frcrm. The latest version of the Federal Rules of Evidence is available at http://www.law.cornell.edu/rules/fre/overview.html.



 < Day Day Up > 



Critical Incident Management
Critical Incident Management
ISBN: 084930010X
EAN: 2147483647
Year: 2004
Pages: 144

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net