Searching over 5,500,000 cases.


searching
Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

United States v. Cano

United States District Court, D. Arizona

January 9, 2017

United States of America, Plaintiff,
v.
David Cano, Defendant.

          REPORT AND RECOMMENDATION ON DEFENDANT'S MOTION TO DISMISS INDICTMENT

          Eric J. Markovich, United States Magistrate Judge

         Pending before the Court is the defendant's Motion to Dismiss the Indictment which alleges a due process violation as a result of the government's destruction of evidence. [Doc. 101.] Specifically, the defendant argues that government agents, lacking adequate training and experience, destroyed evidence from his cell phones while attempting to conduct a forensic search of the phones. For that reason, the defendant argues that the indictment should be dismissed. The government argues that due process was not violated, and therefore, dismissal of the indictment is not warranted, because the defendant cannot establish that exculpatory evidence was lost or destroyed due to bad faith on the part of the agents. For the reasons stated below, the Court recommends that the District Court deny the Motion to Dismiss.

         Factual Background

         On March 25, 2015, the defendant, David Cano, was arrested at the DeConcini Port of Entry ("POE") in Nogales, Arizona and charged in a criminal complaint with possession with the intent to distribute methamphetamine in violation of 21 U.S.C. § 841(a)(1) and 841(b)(1)(C). [Doc. 1.] The criminal complaint alleges that at approximately 7:30 a.m. on March 25, 2015, the defendant attempted to enter the United States from Mexico at the Nogales POE driving a Ford pick-up truck which was found to contain 12.18 kilograms of methamphetamine concealed in the firewall of the truck. The complaint further alleges that when attempting to enter the United States, the defendant told a U.S. Customs and Border Protection Officer that he crosses the border every day and was going to Nogales, Arizona to pay bills. However, after being advised of and waiving his Miranda rights, the defendant told law enforcement that he was actually crossing into the United States to pick up money, which he assumed was from drug smuggling, from the Phoenix area and transport it back to Mexico. On April 22, 2015, a federal grand jury in Tucson, Arizona, returned a four-count indictment charging the defendant with the following offenses: conspiracy to possess with intent to distribute methamphetamine; possession with intent to distribute methamphetamine; conspiracy to import methamphetamine; and importation of methamphetamine.

         The Instant Motion

         The defendant's Motion to Dismiss pertains to the destruction of certain electronic evidence that was contained on two cell phones that were seized from the defendant at the time of his arrest. At the Port of Entry, the defendant consented to a search of his phones. Prior to questioning the defendant, agents attempted to extract data from the phones using a Cellebrite UFED machine. They were successful in doing so for a United States based cell phone, but could not do so for a Mexican based phone. Subsequently, agents obtained a search warrant to conduct a forensic examination of the phones. As discussed below, that forensic search never happened for the Mexican based phone.

         At the hearing on the Motion to Dismiss, the government called John Tillisch, who is an Intelligence Research Specialist with the Department of Homeland Security. (12/6/16 Tr. at 4.)[1] Mr. Tillisch was tasked with conducting the forensic search of the cell phones. His first assignment toward that end was to obtain the identifiers for the phones so that a search warrant could be obtained. (Tr. at 12.) On April 10, 2015, Mr. Tillisch removed the phones from an evidence locker to obtain the serial numbers from the phones. (Tr. at 12.) Mr. Tillisch could not recall if the batteries were in the phones, but he took off the back casing for the batteries to obtain the serial numbers. (Tr. at 13, 15.) Again, while he does not recall if the batteries were already in the phones or if he installed them, Mr. Tillisch testified that he powered on both cell phones to determine if either was pass code protected. (Tr. at 16.) He explained that if either phone was pass code protected, it would have been difficult to do a data extraction and that fact may have impacted whether the agents would seek a search warrant. (Tr. at 16, 55.) Neither phone was pass code protected and were functioning properly. (Tr. at 16, 45, 51.) When he powered on the phones, both were connected to the network. (Tr. at 17-18.) Mr. Tillisch attempted to put both phones on “airplane mode.” (Tr. at 18-19.) He explained that he wanted to put the phones on airplane mode to ensure that they did not connect to the network, and thus be at risk for a remote wiping of the phone's data when they were subsequently turned on for the search. (Tr. at 18-19.) He was able to put the U.S. based phone on airplane mode, but he could not find the airplane mode for the Mexican based phone. (Tr. at 19, 22.) He powered down both phones to ensure they were both off network so they could not be remotely “wiped, ” and placed them back in the evidence locker. (Tr. at 19, 59.)

         On May 12, 2015, after a search warrant was obtained, Mr. Tillisch again took the cell phones out of the evidence locker to conduct a forensic search using the Cellebrite device. (Tr. at 21-22.) On the U.S. based phone, Mr. Tillisch was not able to conduct a physical or file system extraction of the data. (Tr. at 25, 48.) He was able to conduct a logical extraction of the phone's data. (Tr. at 25.) He explained that a physical extraction is a “bit-by-bit copy of the phone's flash memory.” (Tr. at 26-28.) A logical extraction has to rely on an application programming interface, which is sort of an intermediary used to extract data. (Tr. at 28-29.) A logical extraction may not capture all of the phone's data. (Tr. at 58.) Mr. Tillisch does not recall if he authenticated the data that he obtained from this cell phone. (Tr. at 30-31.) Authentication would ensure that the data he obtained actually came from this phone. (Tr. at 31.) If he did not do the authentication on May 12th, it would not now be possible to do so. (Tr. at 43-44.)

         When the Mexican based phone was turned on, it displayed a message of “Welcome to LG, ” which meant to Mr. Tillisch that it had been reset to its original factory settings. (Tr. at 32, 51.) He did not get this welcome message on April 10, 2015. (Tr. at 51.) Mr. Tillisch concluded that the phone had been “wiped, ” meaning that the data on the phone was gone. (Tr. at 33.) However, he never hooked this phone up to the Cellebrite device to confirm that the data was gone because the phone was not compatible with the Cellebrite device. (Tr. at 33, 50.) Mr. Tillisch had never seen a phone “wiped” before and could not explain how it happened here with the Mexican based phone. (Tr. at 42-43, 52-54.) His suspicion is that it was either wiped remotely when it connected to the network on May 12, 2015, or just “crashed.” (Tr. at 54-55.) He testified both that he does not know how to “wipe” this phone model (even if he wanted to), and that it would have been impossible for him to accidentally wipe the phone while trying to find the airplane mode. (Tr. at 54-55, 60.)

         Mr. Tillisch powered down this phone and proceeded to conduct a SIM card extraction using the Cellebrite device. (Tr. at 34-35.) He explained that a SIM card is a chip that exists in some phones that allows the phone to access the network to make calls and for mobile data. (Tr. at 34.) It is not possible to authenticate the data on the SIM card to determine if this data was also on the phone. (Tr. at 43, 49-50, 60-61.)

         In terms of Mr. Tillisch's training on data extraction from electronic devices, he admitted that as of April 10, 2015 - the date he first turned on the phones - he had not been certified in cellular device data extraction. (Tr. at 11, 36.) At that time, he also had not received any formal training on how to handle cell phones and preserving evidence in order to conduct forensic search, but he had received some “on-the-job training.” (Tr. at 37.) Basically, he was told to put phones on airplane mode and power them off to prevent a remote wiping of a phone's data. (Tr. at 37.) Mr. Tillisch received a certificate documenting his Cellebrite training a few days prior to the searches of the phones on May 12, 2015. (Tr. at 38; Ex. 12.)

         Discussion

         To establish a due process violation as a result of the destruction of evidence, a defendant must make two showings. “First, that the government acted in bad faith, the presence or absence of which “turns on the government's knowledge of the apparent exculpatory value of the evidence at the time it was lost or destroyed.'” United States v. Sivilla, 714 F.3d 1168, 1172 (9th Cir. 2013). Second, the defendant is unable to obtain comparable evidence by other reasonably available means because of the nature of the missing evidence. Sivilla, 714 F.3d at 1172. Evidence is materially exculpatory if its exculpatory nature is apparent. Id.

         To establish bad faith, a defendant does not have to show that the government intentionally destroyed evidence to gain an unfair advantage at trial. The government's negligent or reckless conduct can establish bad faith. However, the government's negligence or recklessness must reflect or result in “a conscious effort to suppress exculpatory evidence” in order to establish bad faith. United States v. Zaragoza-Moreira, 780 F.3d 971, 977 (9thCir. 2015); see also Sivilla, 714 F.3d at 1172 (government's negligence in preserving evidence where exculpatory value not evident does not rise to level of bad faith). ...


Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.