Best Practices for Exculpatory Digital Evidence

Best Practices for Exculpatory Digital Evidence

By:  Sy Ray, Director of Market Planning, LexisNexis Risk Solutions

This article originally appeared in Associate, Volume 24, Number 1, Q1 2022, The Magazine of the FBI National Academy Associates. FBINAA.org

Over the last 25 years, I have investigated, peer-reviewed, and consulted on thousands of criminal investigations in which mobile device records were obtained for their evidentiary value, providing the driving force in securing convictions. Conversely, I have seen the records exonerate an individual who was thought to have committed the crime, but ultimately did not.  By utilizing evidence-based policing, we can develop best practices when analyzing mobile device records while ensuring exculpatory evidence is preserved and identified.

Evidence-Based Policing - “The use of the best available research on the outcomes of police work to implement guidelines and evaluate agencies, units and officers.”

The evidence-based policing (EBP) concept of encouraging law enforcement agencies to adopt problem-solving philosophies based on the best available evidence to create policies and procedures ensures effective and unbiased investigative processes. 

Mobile Device Records – Third party records maintained in the normal course of business by telecommunication providers and obtained by law enforcement in reference to a criminal investigation by a probable cause-based search warrant.

Mobile Device Records provide incredible insight on trends and anomalies related to who someone communicates with, the frequency of that communication, travel patterns, detailed location information, and periods of no activity that, when combined, provide a detailed pattern of that person’s life.

Exculpatory Evidence – “Evidence that tends to clear an individual from alleged fault or guilt.” 

This type of evidence is evidence that would indicate a particular person did not commit a crime or was not in the area where the crime was committed. All criminal justice practitioners can support the philosophy that law enforcement should make every effort to identify and preserve exculpatory evidence when it is known it does or may exist.

Establishing Evidence-Based Policing Best Practices

Can we apply the evidence-based policing philosophy to the exculpatory nature of mobile device records to establish a best practice? The simple answer is yes, but the moral answer driven by ethical investigative practices requires it. 

The first step to institute such a practice will require a clear explanation of why mobile device records provide empirical exculpatory evidence. All of this is related to pattern of life. Pattern of life is the ability to analyze sufficient data to visualize routines. Routines can include call, text, and data patterns that identify a particular individual’s behavior and interactions that are unique to the individual. Routines can include location data that identifies travel and stationary patterns that are unique to a particular individual’s behavior. A detailed routine can establish the identity to the mobile device user.  If users change, the behavior pattern associated with the device changes. It is a digital fingerprint.

Mobile device records are extremely powerful evidence, but only evidence of device usage, not necessarily who was using the device. It is the process of analyzing and developing distinct patterns of life that can be associated to a unique individual that provides the “who.” Without this analysis, we are only left with “what.”  To associate a particular user to a specific device, we must analyze and develop a unique pattern of life that can be associated to the user. The pattern of life will always exist and like a fingerprint; it will always be unique to a specific individual. This preciseness provides incredible value to the evidentiary nature of the records. More importantly, this evidence can be both inculpatory (a person committed a crime) or exculpatory (a person didn’t commit a crime).

To develop best practices associated with geolocation and call detail record evidence, we must clearly define what is required to establish a sufficient data sample that reveals a reliable “pattern of life.” 

• Time. The primary best practice requirement associated with exculpatory digital evidence is time. A span of time that provides a large enough data sample to clearly identify patterns within the records is mandatory. This typically requires a minimum span of 30 days to determine if a device has had consistent usage. However, 60 days or more is always preferred.
• Usage. A secondary requirement is usage within that time. Ideally, the data will contain daily activity providing data that detail voice call connections, text message connections, and data connections. In addition to the voice, text, and data records, geolocation data is also required. Gaps of non-usage, or lack of activity within the span of time, should be carefully examined to determine if any gaps seen are part of a pattern within the records or an isolated anomaly.
• Analysis. A detailed analysis of device activity and pattern of life is always required as a best practice. The process of completing a “detailed analysis” is far too complex and lengthy to be discussed here; however, a final requirement to a detailed analysis is the peer review process. A peer review is having a group of your peers review the analysis for accuracy. Peer reviews should be conducted within a group of peers, not one to one review.

Evidentiary Concerns

By identifying the necessary requirements to develop a pattern of life, we can move onto the evidentiary concerns associated with digital data. This data is digitally stored and maintained by communication service providers in the normal course of business. Within the normal course of business, the communication providers will purge the data at some point. This evidence has a shelf life.  Therefore, establishing and following required best practices is critical to the exculpatory nature of digital evidence. Failure to do the simple task of record preservation could result in evidence suppression, or even worse, a wrongful conviction.

The following case summaries provide real-life examples illustrating the need to establish best practices associated with the methodologies discussed:

• During a homicide investigation, investigators identify a suspect and obtain only three days of their carrier’s cell phone records. By analyzing the records at the time of the crime, the geolocation data reveals the mobile device is in the immediate area of the homicide. This association of device location at/near the crime scene at the time of the crime is heavily relied on for the criminal prosecution.
  • By developing a limited pattern of life based on three days of data, the suspect’s device is found to be in the area of the homicide all three days. This is the inculpatory value of the records.
  • If investigators had requested 60 days of carrier cell phone records, the pattern of life would have revealed the person is commonly in the area of the homicide, thereby revealing the exculpatory value of the records.
  • When investigators improperly analyze a single point of time and determined the evidentiary value in a vacuum, a pattern of life is not developed, and the records appear to provide convincing evidence the suspect is related to the crime scene. When properly analyzed with 60 days of records and a complete pattern of life is developed, it is found the suspect device is regularly in the area of the homicide scene as the suspect’s work location is in near proximity to the scene. This evidence is exculpatory in nature.

     

• During a drive-by shooting investigation that resulted in the homicide of a child, investigators identify a cell phone associated with a potential suspect and obtain 60 days of records. The investigators analyzed the records for only the day of the drive by and discovered the phone was in the area of the drive-by at the time of the shooting. The records indicated there were calls between the suspect’s phone and the victim’s phone. The subscriber of the phone was arrested, largely based on the evidence related to the mobile device records on the day of the drive-by.
  • In completing a thorough analysis and developing a detailed pattern of life for the 60-day sample, in lieu of analyzing just the day of the crime, there was a major deviation in the subscriber’s pattern of life on the day of the crime. The common phone numbers the device regularly interacts with daily, are not seen in the records on the day of the crime. This is exculpatory evidence, as it indicates the subscriber may not have been the device user on the day of the crime.
  • Further investigation revealed a family member borrowed the subscriber’s device on the day of the crime. The exculpatory evidence eliminated the subscriber as the perpetrator and the actual suspect was apprehended.
  • In this case, 60 days of records were obtained, but were not thoroughly analyzed to determine exculpatory patterns of behavior.

Gaining Insight into Mobile Device Records is Critical

I spent a considerable amount of time researching recent evidence-based policing trends and law enforcement policies and procedures involving exculpatory evidence to write this article.  I had an idea of what I wanted to communicate, but the more articles I came across in my research, the more this article changed, evolved, and revealed itself to me. It was during my basic research I saw the hidden topic, in plain sight. Evidence-based policing models must include insight on mobile device records and the undeniable exculpatory nature the records may have. 

There is no denying mobile device records provide an unbiased view into the finite details of a person’s day to day life. When properly obtained and analyzed they provide extremely powerful evidence that can lead to a conviction or an exoneration. Additionally, this evidence has a limited shelf life and will be destroyed if not properly preserved. Knowing this, I have developed “Best Practices” to help provide guidance to investigators.

1. Preserve. Mobile device records can be preserved, allowing them to be obtained later though a legal process. While these records require a search warrant, every communication provider has a preservation process to allow law enforcement to preserve the records during the period of time it takes to build enough probable cause to obtain a search warrant. Given the varying timelines of record destruction, records should ALWAYS be preserved immediately upon identifying them as related to an investigation.

    

2. Data Sample Size. As previously discussed, this type of evidence should never be viewed as a single point in time. There will always be an identifiable, unique pattern within the records.The data sample must include enough data, and a large enough period of time, to allow investigators to identify this pattern. It is within this pattern that the records truly become evidentiary in nature. A 60-day data sample is always preferred to ascertain and understand patterns and anomalies of usage within the records.

    

3. Unbiased Review of the Data. Once we preserve the records and obtain a sufficient data sample, the analysis of the data must be unbiased. Unbiased review can be accomplished by reviewing the entire data set chronologically, without consideration of specific details of the case. Once the facts of the data are identified through detailed patterns of device use and travel, it is then that the records can be compared against the known details of the crime being investigated. Additionally, care and consideration should always be applied to the exculpatory nature of the data and identifying all components that could be exculpatory in nature.

    

4. Peer Review. Over the years I have looked at millions of lines of data created from mobile devices.These data sets are complicated, ambiguous at times, and contain enormous amounts of data.Thus, the more eyes, the better. Throughout the analysis and investigative process, several people should be involved in reviewing and summarizing the data. Once conclusions are reached, new sets of eyes should review those conclusions. This process will provide the platform for a more thorough analysis, maintain an unbiased approached to the evidentiary nature of the data, and provide some assurance that best practices and appropriate knowledge was applied to the final summary.

By providing this basic model, we are creating the first step in establishing evidence-based policing “Best Practices.”  This method is critical to criminal investigations in which mobile device records are obtained for evidence – and can mean the difference between innocence and guilt.