Commonwealth v. Ruddock , 26 Mass. L. Rptr. 175 ( 2009 )

Kottmyer, Diane M., J.

INTRODUCTION

The defendant, Andrew Ruddock, is charged with one count of possession of child pornography in violation of G.L.c. 272, §29C, one count of possession with intent to disseminate visual material of a child in a state of nudity in violation of G.L.c. 272, §29B(a), and one count of possession with intent to disseminate visual material of a child in sexual conduct in violation of G.L.c. 272, §29B(b). The defendant has filed a Motion for Production of Computer Data, in which he requests an order requiring the Commonwealth to provide copies of computer data seized from him, including a mirror image in Encase format of all seized hard drives.

In support of this motion, the defendant has submitted the affidavit of Brett Greenberg (“Greenberg”), a forensic computer expert retained by the defendant. Greenberg states that he uses sophisticated equipment that cannot be easily transported to and from the Commonwealth’s facilities and is therefore is unable to conduct a forensic examination of the computer evidence while such evidence is in the possession of the Commonwealth. Further, he states that a forensic computer examination leaves a record of activity that would be accessible to the Commonwealth, jeopardizing the confidentiality of his work product.

In its opposition, the Commonwealth relies on 18 U.S.C. §3509(m), the Adam Walsh Child Protection and Safety Act (the “Walsh Act”), which provides that, notwithstanding the provisions of Fed.R.Crim.P. 16, federal courts “shall deny any request by a defendant to copy” child pornography.

BACKGROUND

On August 13, 2008, members of the Belmont Police Department executed a search warrant at the defendant’s residence, 17 Maple Street in Belmont, Massachusetts (“the residence”). Among other items, a Hewlett Packard Pavilion laptop computer was seized from the basement of the residence.

During a subsequent forensic examination, Belmont Police Officer James Schwab (“Schwab”) discovered a folder named “Limewire.”¹ Within the Limewire folder was a folder labeled “incomplete” and another labeled “shared.” When Schwab opened a video file in the “incomplete” folder, he observed a female child between the ages of nine and eleven exposing her genitals and masturbating. Schwab found several additional files in the “shared” folder that had names associated with child pornography.

Schwab terminated his examination of the laptop and applied for a warrant to search its contents. After the warrant issued, he resumed his examination of the laptop and found twenty-three video files depicting children under the age of eighteen years in the “shared” Limewire folder. Several of these files included images of children posing in a state of nudity or engaging in sexual conduct.

On December 5, 2008, the defendant was indicted on one count of possession of child pornography in violation of G.L.c. 272, §29C, one count of possession with intent to disseminate visual material of a child in a state of nudity in violation of G.L.c. 272, §29B(a), and one count of possession with intent to disseminate visual material of a child in sexual conduct in violation of G.L.c. 272, §29B(b).

On August 26, 2009, the defendant filed a Motion for Production of Computer Data, requesting that the Commonwealth produce “a copy of the computer data that was seized from [him], including a mirror image in "Encase" format of all seized hard drives, zip drives, flash drives, disks, CD-ROMs, DVDs, or similar computer data storage devices; and ... a full copy of the Encase . . . report concerning the Commonwealth’s examination of the computer data." The Commonwealth has given notice that it intends to call Schwab as an expert witness to testify as to the results of his forensic examination of the computer data.

DISCUSSION

The Commonwealth opposes the motion, pointing out that the Walsh Act, 18 U.S.C. §3509(m), limits the scope of discovery under the Federal Rules of Criminal Procedure, by requiring courts to deny any motion by the defendant for copies of materials containing child pornography.²

Pursuant to Mass.R.Crim.P. 14(a)(1)Cvii), the Commonwealth is obligated to “permit the defense to discover, inspect, and copy . . . photographs, tangible objects, all intended exhibits, [and] reports of . . . scientific tests or experiments” provided such materials are relevant to the case and are within the control of the prosecutor. The Commonwealth does not contest that computer files used in a prosecution for child pornography are covered by this rule. Cf. United States v. O’Rourke, 470 F.Sup.2d 1049, 1054 n.1 (D.Ariz. 2007); State v. Dingman, 149 Wash.App. 648, 661-62 (2009). Determining whether information is properly subject to discovery under Mass.R.Crim.P. 14 is a matter of discretion for the Court. See Commonwealth v. Hernandez, 421 Mass. 272, 274 (1995).

I have found no Massachusetts case that addresses the issue whether a court has discretion under Rule 14 to deny a defendant’s request to copy computer data containing child pornography that the Commonwealth intends to offer in evidence at trial. The appellate courts of other states that have considered the issue have reached differing results. Those decisions that have upheld the denial of a defendant’s motion for copies of the computer data containing child pornography are of somewhat limited value in the present case for either or both of two reasons: First, the issue addressed is whether the trial court abused its discretion in denying the motion. See, e.g., State v. Bowser, Criminal Action No. 2008AP206, 2009 WL 2308068 *6 (Wis.App. July 30, 2009) (“in light of the serious harms associated with child pornography and the ease with which electronically-stored files are widely disseminated, the district court properly exercised its discretion in granting the State’s proposed protective order, which required Bowser’s defense team to inspect and analyze the data at the DCI office in accordance with its protocol”). Second, unlike Mass.R.Crim.P. 14, the discovery rule at issue did not expressly provide that a defendant is entitled to copy all intended exhibits. See, e.g., State v. Wells, Criminal Action No. 06-1942, 2007 WL 2769686 *3 (Minn.App. Sept. 25, 2007) (unpublished opinion) (“because nothing in the rules of criminal procedure indicates that every piece of evidence must be copied and produced to the defense, we conclude that the district court did not abuse its discretion” in limiting discovery to an opportunity to inspect computer evidence at the police department).

Other state courts have declined to endorse a blanket restriction on discovery of materials constituting child pornography under their rules of criminal procedure, notwithstanding the public policy embodied in §3509(m). E.g., State v. Boyd, 160 Wash.2d 424, 433-37 (2007);³ Westerfield v. Supe-riorCourt, 99 Cal.App.4th 994, 997-98 (Cal.App.4th Dist. 2002).

That forensic examination of the computer data by an expert retained by the defense is an essential component of effective assistance of counsel in this case is self-evident. As noted by the court in Boyd, forensic examination may provide valuable evidence as to how the images in question made their way onto the laptop and when, how often and by whom they were accessed. 160 Wash.2d at 436. Whether the images were actually disseminated or stored in a manner consistent with an intent to disseminate them is a critical issue in this case. Indeed, absent consultation with an expert, defense counsel will be severely handicapped in his cross-examination of the Commonwealth’s expert.

The Commonwealth’s argument that it is sufficient if the defense expert is given reasonable access to the computer data in its offices fails for two principal reasons. First, it unduly burdens the exercise of the right to effective assistance by circumscribing the nature of the expert’s examination in that it makes access subject to appointment and travel and deprives the expert of the ability to use his own diagnostic equipment in his own laboratory. See Dingman, 149 Wash.App. at 663-64 (“An ample opportunity [to examine computer materials] will permit a defense expert to utilize his or her hardware or software” to minimize the risk that the “analysis will be impeached because it was not supported by the proper hardware or software”).

Second, requiring that defense experts conduct their analyses at a government facility creates the risk that their work product will be accessible to government agents. Computer activity, whether that of a criminal defendant or his expert, leaves traces (termed “metadata”) that are visible to computer analysts; where the computer in question is in the custody of the government and subject to inspection by a government computer analyst, the risk to a defendant’s rights cannot be ignored. See generally Frees, Inc. v. McMillan, Civil Action No. 05-1979, 2007 WL 184889 *3 (W.D.La. Jan. 22, 2007) (recognizing the need to protect work product from discovery during forensic computer examination).

I recognize that the Court has an obligation to assure that the dissemination of computer data containing child pornography be strictly limited. It is a fact, however, that these crimes cannot be prosecuted without disclosure of such materials, e.g., to defense counsel, the court and the jury, and the Court’s role is to protect against unnecessary disclosure. As set forth above, I find that providing a copy of a mirror image of the hard drive of the laptop is essential to effective assistance of counsel in this case. To protect against unnecessary disclosure of the images, I am entering a protective order that limits access to the mirror image to defendant’s counsel of record and Mr. Greenberg and otherwise protects against further dissemination of the images. See Mass.R.Crim.P. 14(a)(6); see also Boyd, 160 Wash.2d at 438. See, e.g., Cadet, 423 F.Sup.2d at 4-5; Hill, 322 F. Sup.2d at 1092-93. The terms of the protective order are set forth below and a signature copy is attached.

CONCLUSION AND ORDER

For the foregoing reasons, it is Ordered that the Commonwealth shall provide one mirror image in Encase format of the hard drive of the laptop seized from the defendant’s residence to counsel of record for the defendant, subject to the following conditions;

1. Counsel of record for the defendant and Mr. Greenberg must sign copies of this protective order before the mirror image is provided and file the original signed copies with the Court.

2. Access to the mirror image provided by the Commonwealth (the “computer data”) by any person other than defendant’s counsel of record and Mr. Greenberg, including the defendant, must be authorized by court order before such access is given. A motion seeking such authorization must be supported by good cause.

3. The computer data must be kept in a secure manner so that it is inaccessible to anyone other than counsel of record and Mr. Greenberg.

4. Defendant’s counsel of record and Mr. Greenberg shall access the computer data only as necessary for the defense of the charges in this case.

5. A copy of this protective order shall be kept with the computer data at all times.

7. No copies of the computer data shall be made unless authorized by the court. Amotion seeking such authorization must be supported by good cause.

8. All transfers of the computer data between the Commonwealth, defendant’s counsel of record and Mr. Greenberg shall be in person. The computer data shall not be transported across state lines. (See 18 U.S.C. §2252.)

9. Any computer through which the evidence is accessed shall be a stand-alone computer, le., a computer that is not connected to any other computer or to the Internet.

10. Any computer through which the computer data is accessed shall be cleansed of all traces of the computer data upon entry of final judgment.

11. The mirror image must be returned to the Commonwealth promptly upon conclusion of the trial, direct appeal or other disposition of this case. Transfers of the computer data must be in person at the offices of the Commonwealth or to a law enforcement officer authorized by the Commonwealth to pick up the computer data and deliver it to its offices.

12.Notwithstanding the entry of any order terminating this case, this Protective Order shall remain in effect unless terminated by order of the Court

PROTECTIVE ORDER

For the foregoing reasons, it is Ordered that the Commonwealth shall provide to counsel of record for the defendant one mirror image in Encase format of the hard drive of the laptop seized from the defendant’s residence, subject to the following conditions:

1. Counsel of record for the defendant and Mr. Greenberg must sign copies of this protective order before the mirror image is provided and file the original signed copies with the Court.

2. Access to the mirror image provided by the Commonwealth (the “computer data”) by any person other than defendant’s counsel of record and Mr. Greenberg, including the defendant, must be authorized by written court order before such access is given. A motion seeking such authorization must be supported by good cause.

3. The computer data must be kept in a secure manner so that it is inaccessible to anyone other than counsel of record and Mr. Greenberg.

4. Defendant’s counsel of record and Mr. Greenberg shall access the computer data only as necessary for the defense of the charges in this case.

5. A copy of this protective order shall be kept with the computer data at all times.

7. No copies of the computer data shall be made unless authorized by the court. A motion seeking such authorization must be supported by good cause.

8. All transfers of the computer data between the Commonwealth, defendant’s counsel of record and Mr. Greenberg shall be in person. The computer data shall not be transported across state lines. (See 18 U.S.C. §2252.)

9. Any computer through which the evidence is accessed shall be a stand-alone computer, Le., a computer that is not connected to any other computer or to the Internet.

10. Any computer through which the computer data is accessed shall be cleansed of all traces of the computer data upon entry of final judgment.

11. The mirror image must be returned to the Commonwealth promptly upon conclusion of the trial, direct appeal or other disposition of this case. Transfers of the computer data must be in person at the offices of the Commonwealth or to a law enforcement officer authorized by the Commonwealth to pick up the computer data and deliver it to its offices.

12. Notwithstanding the entry of any order terminating this case, this Protective Order shall remain in effect unless terminated by order of the Court.

Diane M. Kottmyer

Justice of the Superior Court

I hereby acknowledge that I have received a copy of this Protective Order, that I have reviewed it and that I agree to be bound by its terms.

Date:_(Signature and BBO Number of Defense Counsel)

Date:_(Signature, Business Affiliation and Address of Expert)

1 Limewire is a peer-to-peer file sharing service that enables users to share copies of computer files, usually multimedia flies, across the Internet.

2 Under the terms of §3509(m), notwithstanding Fed.R.Civ.P. 16, “a court shall deny, in any criminal proceeding, any request by the defendant to copy, photograph, duplicate, or otherwise reproduce any property or material that constitutes child pornography . . .” Instead, such materials “shall remain in the care, custody, and control of either the Government or the court” and the government need only “make the property or material reasonably available to the defendant.” Id. See, e.g., United States v. O'Rourke, 470 F.Sup.2d 1049, 1054 n.1 (D.Ariz. 2007).

Before §3509(m) was enacted in 2006, federal defendants were permitted to obtain copies of computer devices containing child pornography under Fed.R.Crim.P. 16. See, e.g., United States v. Cadet, 423 F.Sup.2d 1, 4-5 (E.D.N.Y. 2006); United States v. Frabizio, 341 F.Sup.2d 47, 51 (D.Mass. 2004); United States v. Hill 322 F.Sup.2d 1081, 1091 (C.D.Cal. 2004).

In Frabizio, Fed.R.Crim.P. 16 was construed to allow the defendant to copy computer materials containing child pornography in order to avoid placing an unreasonable burden on defense experts. 341 F.Sup.2d at 51, quoting Hill 322 F. Sup. 2d at 1091. In Hill the court found that the “defendant will be seriously prejudiced if his expert and counsel do not have copies of the materials.” 322 F.Sup.2d at 1091. First, the court observed that “an in-depth analysis" of the materials could not be completed in a single visit to a government facility, thus requiring multiple trips that would prove burdensome for a computer analyst. Id. at 1091-92. In addition, retaining the materials at a government facility was “inadequate” because “the defense expert needs to use his own tools in his own lab.” Id. at 1092.

3 In Boyd, the court held that preparation for trial “will likely require revisiting the evidence many times before and during trial.” Id. at 436. Therefore, where the evidence consists of a computer hard drive, “adequate representation requires providing a ‘mirror image’ of that hard drive; enabling a defense attorney to consult with computer experts who can tell how the evidence made its way onto the computer.” Id. Anything less could place an undue burden on defense counsel or a defense expert, interfering with a defendant’s constitutional rights. Id. at 436-37.