Opinion
CR 15-00768-TUC-JAS(EJM)
01-09-2017
United States of America, Plaintiff, v. David Cano, Defendant.
REPORT AND RECOMMENDATION ON DEFENDANT'S MOTION TO DISMISS INDICTMENT
Pending before the Court is the defendant's Motion to Dismiss the Indictment which alleges a due process violation as a result of the government's destruction of evidence. [Doc. 101.] Specifically, the defendant argues that government agents, lacking adequate training and experience, destroyed evidence from his cell phones while attempting to conduct a forensic search of the phones. For that reason, the defendant argues that the indictment should be dismissed. The government argues that due process was not violated, and therefore, dismissal of the indictment is not warranted, because the defendant cannot establish that exculpatory evidence was lost or destroyed due to bad faith on the part of the agents. For the reasons stated below, the Court recommends that the District Court deny the Motion to Dismiss.
Factual Background
On March 25, 2015, the defendant, David Cano, was arrested at the DeConcini Port of Entry ("POE") in Nogales, Arizona and charged in a criminal complaint with possession with the intent to distribute methamphetamine in violation of 21 U.S.C. § 841(a)(1) and 841(b)(1)(C). [Doc. 1.] The criminal complaint alleges that at approximately 7:30 a.m. on March 25, 2015, the defendant attempted to enter the United States from Mexico at the Nogales POE driving a Ford pick-up truck which was found to contain 12.18 kilograms of methamphetamine concealed in the firewall of the truck. The complaint further alleges that when attempting to enter the United States, the defendant told a U.S. Customs and Border Protection Officer that he crosses the border every day and was going to Nogales, Arizona to pay bills. However, after being advised of and waiving his Miranda rights, the defendant told law enforcement that he was actually crossing into the United States to pick up money, which he assumed was from drug smuggling, from the Phoenix area and transport it back to Mexico. On April 22, 2015, a federal grand jury in Tucson, Arizona, returned a four-count indictment charging the defendant with the following offenses: conspiracy to possess with intent to distribute methamphetamine; possession with intent to distribute methamphetamine; conspiracy to import methamphetamine; and importation of methamphetamine.
The Instant Motion
The defendant's Motion to Dismiss pertains to the destruction of certain electronic evidence that was contained on two cell phones that were seized from the defendant at the time of his arrest. At the Port of Entry, the defendant consented to a search of his phones. Prior to questioning the defendant, agents attempted to extract data from the phones using a Cellebrite UFED machine. They were successful in doing so for a United States based cell phone, but could not do so for a Mexican based phone. Subsequently, agents obtained a search warrant to conduct a forensic examination of the phones. As discussed below, that forensic search never happened for the Mexican based phone.
At the hearing on the Motion to Dismiss, the government called John Tillisch, who is an Intelligence Research Specialist with the Department of Homeland Security. (12/6/16 Tr. at 4.) Mr. Tillisch was tasked with conducting the forensic search of the cell phones. His first assignment toward that end was to obtain the identifiers for the phones so that a search warrant could be obtained. (Tr. at 12.) On April 10, 2015, Mr. Tillisch removed the phones from an evidence locker to obtain the serial numbers from the phones. (Tr. at 12.) Mr. Tillisch could not recall if the batteries were in the phones, but he took off the back casing for the batteries to obtain the serial numbers. (Tr. at 13, 15.) Again, while he does not recall if the batteries were already in the phones or if he installed them, Mr. Tillisch testified that he powered on both cell phones to determine if either was pass code protected. (Tr. at 16.) He explained that if either phone was pass code protected, it would have been difficult to do a data extraction and that fact may have impacted whether the agents would seek a search warrant. (Tr. at 16, 55.) Neither phone was pass code protected and were functioning properly. (Tr. at 16, 45, 51.) When he powered on the phones, both were connected to the network. (Tr. at 17-18.) Mr. Tillisch attempted to put both phones on "airplane mode." (Tr. at 18-19.) He explained that he wanted to put the phones on airplane mode to ensure that they did not connect to the network, and thus be at risk for a remote wiping of the phone's data when they were subsequently turned on for the search. (Tr. at 18-19.) He was able to put the U.S. based phone on airplane mode, but he could not find the airplane mode for the Mexican based phone. (Tr. at 19, 22.) He powered down both phones to ensure they were both off network so they could not be remotely "wiped," and placed them back in the evidence locker. (Tr. at 19, 59.)
Citations to "12/6/16 Tr." followed by the page number are to the transcript of the hearing on the motion to dismiss. Citations to "Ex." are to the exhibits admitted at that hearing.
On May 12, 2015, after a search warrant was obtained, Mr. Tillisch again took the cell phones out of the evidence locker to conduct a forensic search using the Cellebrite device. (Tr. at 21-22.) On the U.S. based phone, Mr. Tillisch was not able to conduct a physical or file system extraction of the data. (Tr. at 25, 48.) He was able to conduct a logical extraction of the phone's data. (Tr. at 25.) He explained that a physical extraction is a "bit-by-bit copy of the phone's flash memory." (Tr. at 26-28.) A logical extraction has to rely on an application programming interface, which is sort of an intermediary used to extract data. (Tr. at 28-29.) A logical extraction may not capture all of the phone's data. (Tr. at 58.) Mr. Tillisch does not recall if he authenticated the data that he obtained from this cell phone. (Tr. at 30-31.) Authentication would ensure that the data he obtained actually came from this phone. (Tr. at 31.) If he did not do the authentication on May 12th, it would not now be possible to do so. (Tr. at 43-44.)
When the Mexican based phone was turned on, it displayed a message of "Welcome to LG," which meant to Mr. Tillisch that it had been reset to its original factory settings. (Tr. at 32, 51.) He did not get this welcome message on April 10, 2015. (Tr. at 51.) Mr. Tillisch concluded that the phone had been "wiped," meaning that the data on the phone was gone. (Tr. at 33.) However, he never hooked this phone up to the Cellebrite device to confirm that the data was gone because the phone was not compatible with the Cellebrite device. (Tr. at 33, 50.) Mr. Tillisch had never seen a phone "wiped" before and could not explain how it happened here with the Mexican based phone. (Tr. at 42-43, 52-54.) His suspicion is that it was either wiped remotely when it connected to the network on May 12, 2015, or just "crashed." (Tr. at 54-55.) He testified both that he does not know how to "wipe" this phone model (even if he wanted to), and that it would have been impossible for him to accidentally wipe the phone while trying to find the airplane mode. (Tr. at 54-55, 60.)
Mr. Tillisch powered down this phone and proceeded to conduct a SIM card extraction using the Cellebrite device. (Tr. at 34-35.) He explained that a SIM card is a chip that exists in some phones that allows the phone to access the network to make calls and for mobile data. (Tr. at 34.) It is not possible to authenticate the data on the SIM card to determine if this data was also on the phone. (Tr. at 43, 49-50, 60-61.)
In terms of Mr. Tillisch's training on data extraction from electronic devices, he admitted that as of April 10, 2015 - the date he first turned on the phones - he had not been certified in cellular device data extraction. (Tr. at 11, 36.) At that time, he also had not received any formal training on how to handle cell phones and preserving evidence in order to conduct forensic search, but he had received some "on-the-job training." (Tr. at 37.) Basically, he was told to put phones on airplane mode and power them off to prevent a remote wiping of a phone's data. (Tr. at 37.) Mr. Tillisch received a certificate documenting his Cellebrite training a few days prior to the searches of the phones on May 12, 2015. (Tr. at 38; Ex. 12.)
Discussion
To establish a due process violation as a result of the destruction of evidence, a defendant must make two showings. "First, that the government acted in bad faith, the presence or absence of which "turns on the government's knowledge of the apparent exculpatory value of the evidence at the time it was lost or destroyed.'" United States v. Sivilla, 714 F.3d 1168, 1172 (9th Cir. 2013). Second, the defendant is unable to obtain comparable evidence by other reasonably available means because of the nature of the missing evidence. Sivilla, 714 F.3d at 1172. Evidence is materially exculpatory if its exculpatory nature is apparent. Id.
To establish bad faith, a defendant does not have to show that the government intentionally destroyed evidence to gain an unfair advantage at trial. The government's negligent or reckless conduct can establish bad faith. However, the government's negligence or recklessness must reflect or result in "a conscious effort to suppress exculpatory evidence" in order to establish bad faith. United States v. Zaragoza-Moreira, 780 F.3d 971, 977 (9th Cir. 2015); see also Sivilla, 714 F.3d at 1172 (government's negligence in preserving evidence where exculpatory value not evident does not rise to level of bad faith). Stated another way, the government's negligence or recklessness does not, in and of itself, amount to bad faith. This distinction is well made in Zaragoza-Moreiga.
The Ninth Circuit has made clear that "[b]ad faith is the wrong legal standard for a remedial jury instruction" based on the destruction of evidence. Sivilla, 714 F.3d at 1173. When a defendant seeks a remedial jury instruction, as opposed to dismissal of an indictment, a court "must balance the quality of the Government's conduct against the degree of prejudice to the accused." Id. The government bears the burden of justifying its conduct and the defendant bears the burden of demonstrating prejudice. Id. Here, the parties have waived their right to a jury trial so this Court need not address whether a remedial jury instruction is warranted. At or prior to the bench trial, the district court can decide whether it will admit and consider evidence pertaining to the destruction of the phone data. Likewise, if the defendant withdraws his waiver of a jury trial, the district court can then consider whether a remedial jury instruction is warranted.
In Zaragoza-Moreiga, the defendant was charged with importing drugs from Mexico into the United States. The defendant approached the United States Port of Entry with drugs taped to her body. She told agents she had drugs taped to her body almost immediately when they began to search her. She also told agents during a post-arrest interview that she had been forced to carry the drugs, that she "wanted to get caught," and that she "made [herself] obvious" by engaging in attention-seeking behavior while in the pedestrian lane at the Port of Entry. The defendant's attorney sent the prosecutor a letter asking that the video footage at the Port of Entry be preserved for trial. Defense counsel later made a motion to compel discovery and preserve evidence, specifically, the video footage. The district court ordered the government to preserve the video evidence. Pursuant to the court's order, the prosecutor requested the Port of Entry video footage, but was informed that the footage had already been destroyed. The defendant moved to dismiss the indictment due to the government's destruction of the video footage. The district court denied that motion finding that the exculpatory value of the evidence was not apparent to the agent and that neither the agent or the prosecutor destroyed potentially exculpatory evidence in bad faith.
The Ninth Circuit concluded that the district court clearly erred in denying the motion to dismiss the indictment based on the destruction of evidence. The court first found that the exculpatory value of the video footage was readily apparent to the agent given the defendant's statements during the interview about her duress claim and her attention-seeking behavior while in the pedestrian lane. In response to the government's argument that "negligence" or "recklessness" was not sufficient to establish a finding of bad faith, the court first stated: "[i]n the context of the instant case, we disagree." However, the court went on to hold that "contrary to the government's contentions, [the agent's] actions were not merely negligent or reckless, nor was the [evidence] destroyed in the normal course of the government's usual procedures." The court pointed out that the agent knew of the potential exculpatory value of the evidence but "made no attempt to view or preserve the Port of Entry video before it was destroyed." The court also noted that although the agent authored four reports on the case, only one (which was prepared shortly before the hearing on the motion to dismiss) included the defendant's statements about being coerced to transport drugs and trying to draw law enforcement's attention while in the pedestrian lane. Even more disturbing to the court was the failure to include the duress claim in the probable cause statement of the criminal complaint presented to the magistrate judge. The court further noted that the agent did no follow up investigation regarding the video footage that would corroborate the defendant's statements about a prior border crossing. The court concluded that the agent's actions and inactions following the defendant's interview were "sufficient to establish that she made 'a conscious effort to suppress exculpatory evidence,' thereby acting in bad faith."
The court went on to address another fact not considered by the district court, that is, the prosecutor's actions (or inactions) in light of the defense letter requesting preservation of the video footage. The court held that the agent was not "the only relevant actor in the court's bad faith analysis." The court rejected the government's argument that the prosecutor's failure to notify the Port of Entry of the defense request to preserve the video footage was "an oversight" because the parties were engaged in plea negotiations. The court reasoned that the potential duress evidence would have been relevant to sentencing and the prosecutor did not comply with Fed.R.Crim.Pro. 16 by failing to make a preservation request. However, because the court found that the agent's actions demonstrated bad faith, the court did not decide whether the prosecutor's actions also constituted bad faith.
Here, the defendant cannot establish that the government's negligence or recklessness demonstrates "a conscious effort to suppress exculpatory evidence." Agents did not ignore potentially exculpatory evidence as was done in Zaragoza-Moreiga. To the contrary, the agent's actions here, unlike in Zaragoza-Moreiga, were aimed at preserving and obtaining evidence. Indeed, the search warrant obtained for the phones demonstrates that the government also wanted the evidence on the phones. If the government had not obtained a search warrant and these same events unfolded, the defense would have a far better argument that the government made a conscious desire to ignore and then suppress exculpatory evidence based on both their actions and inaction.
At best (or maybe at worst), the agents were arguably negligent in entrusting the cell phones to a person like Mr. Tillisch who, as of April 10, 2015, had not yet been formally trained in handling electronic evidence or conducting a forensic search. There was no need for Mr. Tillisch to power on the phones when he was looking for identifiers for the search warrant, but his reason for doing so was not sinister. Mr. Tillisch was simply trying to ascertain whether it was worth the effort for agents to write an affidavit for a search warrant for phones they may never be able to search. More importantly, there is no evidence that Mr. Tillisch's actions on April 10, 2015, caused the phone to be wiped. The phone was functioning properly when he turned it off on April 10, 2015, and it was not connected to the network in the month between that day and the day of the search. The only logical conclusion is that the phone was somehow wiped (or crashed) on May 12, 2015, when it was turned on for the search. Thus, that would have happened even if Mr. Tillisch had not turned on the phone on April 10, 2015.
Mr. Tillisch did not intentionally wipe the phone since he testified that he had, and still has, no idea of how to do that, and the defense did not intimate that he did so intentionally.
Arguably, the agents who seized the phones on the day of the defendant's arrest should have put the phones on airplane mode (perhaps with the defendant's assistance) before turning the phones off and putting them into the evidence locker. That would have ensured that the phones were not connected to the network when later turned on and could not be remotely wiped. But, given the evidence of the government's desire for the phone data, the failure of the agents to do that was a mistake and does not amount to evidence of a conscious desire to suppress exculpatory evidence.
Because the Court concludes that the government did not act in bad faith, there is no need to address whether the defendant has met his burden to establish that the phones actually contained exculpatory evidence. The defense has made a vague assertion that the information on the phone would have corroborated the defendant's statement that he was tasked with picking up money, not transporting drugs. But the defense does not pinpoint whether that information would be contained in a text message, a voice message, and/or an email communication. Likewise, the defense does not set forth the substance of the supposed corroborating information that existed on the phone. Moreover, the defendant never pointed to exculpatory information on the phones when he spoke with agents on the day of his arrest. Thus, the Court is skeptical that the defense could establish that the phone contained exculpatory information even if the government acted in bad faith. Finally, the defense does not address whether he could obtain comparable evidence by other reasonably available means, such as subpoenaing the phone and/or email provider.
Apparently, no one will ever know what caused the one phone to revert to its factory settings, and the evidence on that phone (as opposed to the SIM card) appears to be lost forever. But the loss of that evidence, even if caused by the government's negligence, is not the product of the government's desire to suppress exculpatory evidence.
Oddly, neither the government nor the defense has attempted to conduct a forensic search of the Mexican based phone using a device other than the non-compatible Cellebrite device to verify that the phone's data has indeed been wiped. Nor has either party requested forensic examiners to try to determine what caused this phone to revert to its factory settings. --------
Accordingly, it is recommended that the Motion to Dismiss the Indictment be denied.
Pursuant to 28 U.S.C. §636(b)(1)(B), the parties have fourteen (14) days from the date of this Report and Recommendation to file written objections to these findings and recommendations with the District Court. Any objections and Responses to objections filed should be filed as CR 15-00768-TUC-JAS. No Replies shall be filed unless leave is granted from the District Court.
DATED this 9th day of January, 2017.
/s/_________
Eric J. Markovich
United States Magistrate Judge