Re: COMMONWEALTH v. Damien Ryan EUTSLER Case No.: CR17000248-00 (00-99) Circuit Court of Virginia September 11, 2018 Counsel The Honorable Timothy A. Martin, Commonwealth's Attorney, Alexandra Meador, Assistant Commonwealth's Attorney, Office of the Commonwealth's Attorney, 6 E. Johnson Street, Staunton, Virginia 24401 Thomas B. Weidner, IV, Esquire, P. O. Box 999, Fishersville, Virginia 22939 Ludwig, Victor V., Judge Motion to Suppress *1 Dear Ms. Meador and Gentlemen: The Defendant, Damian Ryan Eutsler (Eutsler), has filed a Motion to Suppress (the Motion), asking this Court to suppress “electronic evidence contained on a cell phone [the Cellphone] because the Augusta County Deputies [the Deputies], after seizing the cell phone, but before making a forensic image to preserve all evidence thereon in the condition in which it was seized, used the cell phone in a manner that deleted exculpatory information....” Eutsler's argument in the Motion is that the Deputies overwrote “metadata regarding the last use and modification dates stored on the telephone's hard drive or memory thereby deleting relevant data regarding when the phone was last used for any programs, applications and viewing of materials accessed on the telephone by the [Deputies].”[1] Further, Eutsler characterizes the Deputies' action as “intentional and knowing.” I. Facts: The Deputies seized the Cellphone on December 8, 2016, between the hours of 2:00 and 2:30 p.m. Because the Cellphone was password-protected and open at the time of the seizure, the Deputies activated the “airplane mode” feature and continued to tap the screen from time to time to keep it open. Shortly thereafter, they delivered it to Deputy Caleb Spence (Spence), who (perhaps with others) was charged with the responsibility of conducting a forensic examination of the Cellphone. Spence said that, to his knowledge, no one had accessed the Cellphone after it had been seized from Eutsler and before it was delivered to him, except to turn on airplane mode (although he later acknowledged that the Deputies could have looked at its contents without his knowledge). Spence, who was unaware that the Deputies had seized the Cellphone pursuant to a search warrant, testified that, without there having been a warrant to seize a cellphone, it would not be common practice for anyone to access a seized cellphone prior to delivering it to the forensic examiners for imaging because it would alter the original state of the phone. Spence acknowledged that he had seized cellphones in the past with a warrant, and he had looked at their contents, but he agreed that it is not common practice. Indeed, although not a written policy, it is the practice for Deputies seizing cellphones not to access them (although he qualified that answer to apply to circumstances in which there is no search warrant). Spence testified that he did not access the data on the Cellphone until 4:23 p.m., and he then ran an imaging program on it two times (extracting different information on each run). He testified that he did not look through the data on the Cellphone to destroy exculpatory evidence; he was running the imaging program pursuant to a search warrant to produce a report of its contents. Alan Garretson (Garretson), having first qualified as an expert in the field of forensic computer analysis (for the purpose of this hearing only), testified that, in August 2017, he made a full forensic image of the Cellphone (as opposed to a logical image),[2] “from bit zero all the way to the end,” and then used a program Cellebrite[3] to translate that image into a readable human report.[4] Because of the magnitude of data on it, the imaging process took approximately 11 hours. *2 Garretson testified that he understood that the Cellphone had been taken from Eutsler on December 8, between 2:00 and 2:30 p.m. and that, by the time he imaged the Cellphone, he could identify 770[5] files that “had been accessed since the phone had been taken from” Eutsler. In addition, there had been some post-seizure browser activity when someone used Firefox to access the web. Each time the Cellphone was accessed, it created a thumbnail and stored the data on the Cellphone's memory in unallocated space[6] or “slack space.”[7] Garretson testified that, to study the memory of a cellphone, it is important to make an image of it as soon as possible and to do nothing with it prior to imaging it (except put it into airplane mode). The accepted standard in the industry is to make the image prior to there being any further activity on the device that is to be imaged. He testified that if one accesses the memory, even only to look at a picture or a file stored on it, one creates a new thumbnail, and, because that thumbnail must be stored somewhere, it adds (and alters) the memory of the phone.[8] On this Cellphone, each discrete activity after it was taken from Eutsler, created a file, and each file was stored somewhere on the Cellphone's memory. He said that the “user has no control on where it is stored. It could be in empty space, or it could have overwritten existing data, and there is no way to tell.”[9] One can identify the location at which the new data is stored, but one cannot tell what, if anything was overwritten. II. Applicable Law: First, I observe that despite my comments during the hearing that the considerations in Brady might be implicated, this does not appear to be a Brady motion because Eutsler is not complaining that the Commonwealth has withheld, or is withholding, exculpatory evidence known to it.[10] On the contrary, Eutsler's complaint relates to evidence, the nature of which the Commonwealth cannot know and which is not in its possession. Eutsler did not (and cannot) argue that the information is exculpatory; at most, he argues that the missing information could be potentially helpful to the defense. As such, the applicable constitutional jurisprudence is grounded in California v. Trombetta, 467 U.S. 479 (1984) and Arizona v. Youngblood, 488 U.S. 51 (1988) and cases which follow them. *3 In Trombetta, Justice Marshall stated the general question to be “whether the Fourteenth Amendment also demands that the State preserve potentially exculpatory evidence on behalf of defendants.” Id. at 480. In that case (addressing two different convictions for driving under the influence), the State failed to preserve samples of the defendants' breath. Each claimed that, had the sample been preserved, he would have been able to impeach the State's inculpatory test results. After briefly recounting a history of “the area of constitutionally guaranteed access to evidence,” United States v. Valenzuela-Bernal, 458 U.S. 858, 867 (1982), the Court acknowledged that it had: ... never squarely addressed the government's duty to take affirmative steps to preserve evidence on behalf of criminal defendants. The absence of doctrinal development in this area reflects, in part, the difficulty of developing rules to deal with evidence destroyed through prosecutorial neglect or oversight. Whenever potentially exculpatory evidence is permanently lost, courts face the treacherous task of divining the import of materials whose contents are unknown and, very often, disputed. Id. at 486. Observing that the State had not destroyed the breath samples “in a calculated effort to circumvent the disclosure requirements of Brady” and that the “officers here were acting ‘in good faith and in accord with their normal practice,’ ” id. at 488 (citation omitted), the Court concluded that the failure to retain the samples was not a violation of the Due Process clause of the Constitution. Further, the Court concluded that a State's obligation to preserve evidence must meet a “standard of constitutional materiality,” meaning that it “must both possess an exculpatory value that was apparent before the evidence was destroyed, and be of such a nature that the defendant would be unable to obtain comparable evidence by other reasonably available means.” Id. at 489. Although the facts of the case and other observations that the Court made in Trombetta distinguish it from the case at bar,[11] I cite it because it is the first identifiable ancestor addressing the issue at hand and for the basic analytic principles that it prescribes when addressing the destruction of evidence. From it, we learn that, in order for the defendant to avail himself of the Due Process argument, he must establish that: (a) the destroyed evidence must possess an exculpatory value, that is it must be evidence that might be expected to play a significant role in the defense; and (b) the exculpatory nature of the evidence was apparent before the evidence was destroyed; and (c) the defendant must have no reasonable alternate means of obtaining comparable evidence; and, (d) the officers of the state acted in bad faith in destroying the evidence; and (e) the officers of the state acted in a manner not consistent with their normal practices. The next time the Court addressed the issue of the destruction of evidence in any substantive way was in Arizona v. Youngblood, 488 U.S. 51 (1988). In that case, the issue was “the extent to which the Due Process Clause of the Fourteenth Amendment requires the State to preserve evidentiary material that might be useful to a criminal defendant.” Id. at 52. (As the facts reveal, the alternate inquiry, more relevant to the case at bar, could as easily have been the extent to which the Due Process Clause requires that the State not permit the degradation of evidence that might be helpful to a criminal defendant.) *4 Youngblood involved the tragic case of a child whom the defendant sexually molested. Shortly after the event, the child was taken to a hospital where the physician took samples from the child's mouth and rectum and of his saliva, blood, and hair. A few days later, a police criminologist examined the samples, but only to determine that sexual contact had occurred (and nothing more). In addition, the police collected the victim's underwear and T-shirt but took no adequate steps to preserve them. More than a year after the crime, the criminologist attempted to test the clothing, with no success. In the event, none of the samples nor the clothing yielded evidence helpful to the prosecution.[12] In response to the question presented, as it framed it, and responding to Youngblood's argument that he was denied due process because he did not have access to the evidence, the Court held “that unless a criminal defendant can show bad faith on the part of the police, failure to preserve potentially useful evidence does not constitute a denial of due process.” Id. at 58. The Court also stated its rationale for that rule. We think that requiring a defendant to show bad faith on the part of the police both limits the extent of the police's obligation to preserve evidence to reasonable bounds and confines it to that class of cases where the interests of justice most clearly require it, i.e., those cases in which the police themselves by their conduct indicate that the evidence could form a basis for exonerating the defendant. Id. The requirement that the defendant show that the authorities acted in bad faith is as bright as lines get in constitutional law (and we are talking about the Due Process clause),[13] so bright that it eclipses the additional requirement of Trombetta that the authorities have acted in accordance with their normal procedures. Moreover (although curiously stated only in a footnote), the Court opined that the “presence or absence of bad faith by the police for purposes of the Due Process Clause must necessarily turn on the police's knowledge of the exculpatory value of the evidence at the time it was lost or destroyed.” Youngblood at 56, n.* *5 In the Commonwealth, the case with facts more similar to this case than any other is Gagelonia v. Commonwealth, 53 Va. App. 99 (2008). It is a curious case in that the Court noted that the defendant (White) argued “that the Commonwealth withheld exculpatory evidence in violation of Brady v. Maryland,” id. at 102, but then addressed the issue on the basis of a cellphone and a videotape which the Commonwealth had misplaced and could not produce. Without going into the facts in detail and focusing on the matter nearest to the overwritten data in the case at bar, in Gagelonia, the police seized a cellphone from White during a search incident to arrest, (and apparently there was a videotape of the surveillance leading to White's arrest).[14] Responding to White's specific argument that the missing cellphone merited a reversal under Brady, the Court noted that “this allegation is actually controlled by the holdings” in Trombetta and Youngblood. Why the Court did not simply dismiss the argument on the basis that White had not demonstrated a violation of Brady is something of a mystery, but the Court's re-casting of White's argument for him and its dictum in addressing a matter not squarely put to it is, nevertheless, helpful. After discussing the holdings of Trombetta and Youngblood, the Court noted that White had “not met his burden in showing that either the police or the Commonwealth acted in bad faith in losing the tape and cell phone.” Id. at 115. Moreover, he did not demonstrate that “the police had knowledge that these pieces of evidence were exculpatory, nor [did White] proffer[ ] the nature of any exculpatory information either the videotape or the cell phone would show.” Id. III. Analysis: This case differs from all three of those cited in one particular: if the Deputies manipulated the Cellphone in a way that added data to the Cellphone's memory after it had been seized from Eutsler, there is a reasonable inference that they did so intentionally and in a way that may have overwritten data already there. That is not quite the same as (a) failing to preserve samples from which evidence might have been derived (a passive action, as in Trombetta), or (b) allowing physical items to degrade, which, if properly maintained, might have yielded evidence (again, a passive action, as in Youngblood), or (c) misplacing recorded data from which evidence might have been obtained (an action which does not directly impact the evidence, as in GageIonia). In each of those cases, the action of the authorities was either passive or peripheral, but each of them resulted in the absolute or practical unavailability of the physical items which might have been further examined or tested. In this case, the Cellphone remains in the possession of the Commonwealth; it has been examined, it has been made available to the defendant, and it remains available for further testing. The problem is that someone, probably the agents of the Commonwealth have altered the memory under examination and possibly rendered some underlying data unavailable for examination. *6 Notwithstanding that distinction, the Court concludes that the principles developed by the appellate courts apply, and I will address each of the requirements of Trombetta, as amplified by Youngbood and applied in Gagelonia. Recall, those requirements are stated in the conjunctive, so that, unless Eutsler demonstrates each of them, he cannot prevail: (a) There is no proof that the evidence destroyed was even potentially exculpatory. For that matter, there is no proof that any evidence was destroyed. Regarding the former, Mr. Weidner acknowledged in his oral argument that “we do not know what was overwritten” and that there is no way to ascertain whether it was exculpatory. Garrettson testified that it cannot be determined if any data was overwritten or, if any was, what it was. Hence, it is equally possible that, if data was overwritten, it may as likely have been inculpatory as exculpatory, but even without that editorial observation, Eutsler's Motion fails on this requirement of the case law. (b) There is no evidence that the exculpatory nature of the evidence was apparent before it was destroyed. As I have noted, whether any evidence (or any data at all) was destroyed is a matter of speculation. (c) Although it can be determined where the new data is stored on the memory of the Cellphone, there is no means of determining what, if anything, was overwritten. Whether there is a reasonable means of obtaining comparable evidence is a theoretical question because it assumes that there is evidence to obtain. (d) There was no evidence that the Deputies acted in bad faith, assuming that they did destroy evidence. Mr. Weidner accurately argues that their action was intentional, and he asserts that it was more than negligent, even that it was in violation of policy (or, to use the phrase borrowed from Trombetta, not “in accord with their normal practice”). Given that the Deputies acted intentionally[15] and assuming that it was in violation of policy,[16] that issue was put to rest by the decision in Youngblood. The bright line articulated in that case is that the Deputies must have acted in bad faith, and it dispensed with the consideration of normal practices or procedures.[17] And recall the footnote in Youngblood which explicitly prescribes the minimum that the defendant must prove to show bad faith: the “presence or absence of bad faith ... must necessarily turn on the police's knowledge of the exculpatory value of the evidence at the time it was lost or destroyed.” Youngbloodat 56, n.*. Garretson testified that the “user has no control on where [new data] is stored. It could be in empty space, or it could have overwritten existing data, and there is no way to tell.” Given Eutsler's own evidence, the Deputies could not have known where the new data would be stored, they could not have known if the potential storage location was the repository of potentially exculpatory evidence which would be overwritten. *7 For those reasons, the Court dismisses the Motion. I ask that the Commonwealth prepare an order consistent with and incorporating this letter opinion. Very truly yours, /s/ Victor V. Ludwig Judge Footnotes [1] I am not entirely sure what that means, but I am fairly certain that that is not the precise issue which the parties argued at the hearing. [2] A logical image is only the file structure but does not include all the contents of the file. [3] Lest any reader present at the hearing think that I was not listening, I note that there was considerable discussion regarding the imaging and translation programs that are available and comparisons of their relative virtues, but none of it was relevant to the issue before the Court. [4] Garretson used a second program called Axiom. [5] I think he said 772, but after that first quantification, all other references were to 770 images. [6] He explained that unallocated space is space on the system that has not yet been used. [7] Garretson explained that “slack space” is a term used more commonly with computers than with cellphones. It refers to the physical fact that data is stored in 248-bit segments, and sometimes not all of the space, or sector, is consumed by data storage (and at some fuzzy level, I understand what he is saying, but the comment nevertheless merits a “whatever that means”). [8] Garretson also discussed the use of a Farraday bag to avoid hits from cell towers as the phone is transported, but, in the event, that was not an issue in this case. [9] If language appears in quotations, it means that I am reasonably confident, from my notes, that it is a verbatim rendition of what the witness said. It may not be perfect, but it is pretty reliable. [10] The nature of the case, the source of the alleged missing evidence, and all of the circumstances make it clear that Eutsler could not be asserting a Brady motion based on the second matter addressed by that case, i.e., the Commonwealth's withholding impeachment evidence. [11] Trombetta addressed the State's destruction of evidence after it had tested it; in Eutsler's case, it was altered before anyone had analyzed it. In addition, the Court in Trombetta, somewhat remarkably, commented on the low probability of the missing samples producing exculpatory evidence and on the defendants' ability to have attacked the evidence developed by the State from the missing samples. In this case, it is impossible to assess the probability that the missing evidence would be exculpatory, and I doubt that Eutsler has any other avenue to attack the missing evidence (assuming there is missing evidence). [12] It is curious that there is nothing in the decision to indicate whether the evidence was, in fact, destroyed, although it appears that it was permitted to deteriorate to the extent that it could not yield accurate data. We know only that the State did not give it to the defendant. Throughout the opinion, the Court speaks only to the issue of the State's obligation to preserve evidence (see, e.g, id. at 53) (with the implication that it did not), but the dissenters commented that the evidence “was allowed to deteriorate.” Id. at 62. [13] In his concurrence, Justice Stevens implicitly acknowledges the scope of the rule by observing that it should not apply to all cases, regardless of other considerations. In the dissent, Justice Blackmun apparently agrees that the standard is a “bright line,” but he disagrees with its efficacy because of his doubts that it can be clearly drawn. See id. at 66. Part of the bright line is requiring absolutely that the defendant show that the authorities acted in bad faith. The dissenting Justices recognize that, by requiring evidence of bad faith, the majority dispenses with the necessity, articulated by Trombetta, that the authorities prove that they acted in accord with normal practice or usual procedures; indeed, that is the core of the dissent. SeeYoungblood at 65. I note that the per curium decision in Illinois v. Fisher, 540 U.S. 544 (2004), tends to blur the line a little in that it specifically recognizes that the authorities “acted ‘in good faith and in accord with their normal practice’ ” and cites Trombetta. One might infer that the consequence of that factual observation is that the Court may, implicitly, have re-imposed the requirement of showing that the authorities did not act in accord with their normal practice. Nevertheless, the decision in Fisher affirms that the defendant must show “bad faith on the part of police,” id. at 548. [14] In the opinion, one of the Commonwealth's witnesses testified that he had placed the cellphone with White's personal effects when he was booked, although other evidence clearly showed that the witness submitted the device to the Department of Forensic Science for analysis. There was no clear indication of how the cellphone thereafter went missing, but White complained of its being “missing” (id. at 109), and the Court accepted that characterization. The Commonwealth candidly acknowledged that it had misplaced the videotape. [15] There was no direct evidence that it was the Deputies who accessed the Cellphone. To be sure, it was in their exclusive possession, so that is a reasonable inference, but Garretson testified that other external forces could impact the Cellphone's memory. [16] Spence certainly testified that it was the better practice not to access the Cellphone until it had been imaged, but he stopped short of characterizing that as a violation of policy. [17] Despite the factual representation in Fisher, I am not persuaded that the requirement has been revived.