May 23, 2012 Top Story

Forensic Expert Permitted to Identify Keyboard User

Limited access to multiple computers with similar file structures is an acceptable ultimate issue opinion

John W. Joyce

A computer forensics expert may identify a specific person who downloaded information on particular computers based on the user’s access to the computers and a similarity of “file structures.” Although experts appear split as to whether such testimony is permissible, a recent Eighth Circuit decision provides insight on this issue for litigators using computer forensics experts.

In United States v. Huether, Ray Leon Huether’s girlfriend, “CT,” filed a complaint with the Minot, North Dakota, police department, alleging that Huether sexually abused her daughter. The police searched two residences owned by Huether—one in Minot and the other over 250 miles away in Fargo.

At the Minot residence, police seized computers and optical discs containing child pornography stored in approximately 90 hours of video and 257 images. At the Fargo residence, officers interviewed Huether for about two hours, and Huether made incriminating statements about his sexual abuse of CT’s child and the pornography found at the Minot residence. Law enforcement seized a laptop from the Fargo residence.

The Expert Testimony

At trial, a North Dakota Bureau of Criminal Investigation (the Bureau) computer forensic specialist testified that Huether put the child pornography on the hard drives. The expert based his opinion on the “detailed file structure and the way that they were consistent among all the computers that we discovered child porn,” and the fact that “the only person that was at both residences was Ray Huether.”

Huether was convicted by a jury for knowing receipt of child pornography in violation of 18 U.S.C. §2252(a) and §2252(b)(1). He was also convicted of knowing possession of child pornography in violation of 18 U.S.C. §2252(a)(4)(B) and §2252(b)(2).

Eighth Circuit Affirms Conviction

On appeal, Huether argued that the expert’s testimony violated Federal Rules of Evidence 702 on the grounds that it was not helpful to the jury. He further argued the testimony violated Rule 704 because it embraced the ultimate issue, i.e., that Huether put the child pornography on the hard drives in both Minot and Fargo.

The Eighth Circuit rejected Huether’s arguments under Federal Rules of Evidence 702, reasoning that “[b]ecause knowledge of computers and internet use differ widely among lay jurors, [the expert]’s testimony appropriately helped [the jury] better understand the evidence.” It further observed that, “[h]is testimony assisted the jury in processing information relating to whether Huether downloaded and saved the images and videos to his hard drives.”

The appeals court pointed out that the expert, an agent with the Bureau, was present at both searches, knew that Huether had access to the computers, and knew that Huether admitted to moving the downloaded images to the folders and hard drives. With respect to the arguments under F.R.E. 704, the court pointed out that the rule itself permits testimony on the ultimate issue.

Eighth Circuit Reduces Sentence

Huether also asserted arguments under the FourthFifth, and Sixth Amendments to the United States Constitution. The court rejected the arguments under the Fourth and Sixth Amendments.

It did hold, however, that Huether’s conviction on the receipt and possession counts violated the Double Jeopardy Clause of the Fifth Amendment because the jury charges did not instruct jury that they could not convict on both counts on same facts. As such, it remanded with instruction to the trial court to vacate one of the sentences.

Should the Court Allow Expert Testimony?

“The court simply allowed an expert to explain computer processes that were beyond the ken of people of ordinary intelligence and to suggest the inferences to be drawn from his expert and specialized knowledge,” says Jeffrey A. Beaver, Seattle, cochair of the ABA Section of Litigation’s Committee on Expert Witnesses. Beaver believes the court was correct to permit the expert testimony.

Perhaps the better question would be whether the court properly permitted the expert to expressly identify Huetter. “When an expert is comparing file structure patterns on multiple computers, the expert may offer an opinion that the same person used the computers, but to identify a specific individual stretches too far,” says Richard S. Stockton, Chicago, cochair of the Section of Litigation’s Technology for the Litigator Committee.

Factors in Allowing File Structure Testimony

The court of appeals did not identify the type of “detailed file structures” that Erickson relied upon. “Detailed file structure” is not a term of art in the field, and can mean many different things, explains Jason T. Briody, Columbia, Maryland, a computer forensic analyst and an active member of Section’s Technology for the Litigator Committee.

“In this case, the expert is most likely referring to the way the files and folders were named and organized, since that can be particularly important in cases involving child pornography,” continues Brody. “But in other situations, the term could refer to the internal structural makeup of a file—basically, the building blocks of the file itself,” he concludes.

Stockton says that the type of “file structure” can sometimes be important in deciding whether expert testimony is permissible. “Sometimes, specialized knowledge is helpful for the jury—for example, when the issues involve patterns of file compression and conversion,” Stockton says. “Other times, when the data is easily understood by anybody who has ever used a computer, such as organization of folders, the knowledge is neither specialized nor the testimony helpful to the jury,” adds Stockton.

Need for Expert Witness on Both Sides of the Issue

Beaver suspects that the absence a defense expert impacted the court’s analysis regarding the admissibility of the government’s expert. “Often times that decision comes down to a battle of the experts,” suggests Beaver. “I am surprised in this case that there is no mention of a competing expert to advance the argument that the government’s witness could not offer the expert testimony,” he says.

Stockton agrees and believes the situation may have been different in the context of a civil lawsuit. “Also, a civil case almost certainly would present expert testimony on both sides of the issue,” Stockton says.

John W. Joyce is an associate editor for Litigation News.

Keywords: computer forensic expert, expert testimony, Eighth Circuit, file structure, ultimate issue

Copyright © 2017, American Bar Association. All rights reserved. This information or any portion thereof may not be copied or disseminated in any form or by any means or downloaded or stored in an electronic database or retrieval system without the express written consent of the American Bar Association. The views expressed in this article are those of the author(s) and do not necessarily reflect the positions or policies of the American Bar Association, the Section of Litigation, this committee, or the employer(s) of the author(s).