Law enforcement faces waiting game to unlock technological clues in crimes
By Kyle Spurr
The Daily Astorian
Astoria Police had to wait more than seven months before arresting a man for possessing up to 500 images of child pornography on his laptop and flash drives.
Christopher York’s laptop was seized in May 2013, but he was not arrested until January 2014, when his laptop was finished being examined by an analyst with Oregon Department of Justice.
Astoria Police Deputy Chief Eric Halverson said it is unsettling to know criminals such as York are free for months after they are identified because of the delay in scrubbing technology for evidence. York was eventually convicted and sent to prison, where he is serving a six-year sentence.
“That’s the scary part when you are having to wait to confirm what you believe is there,” Halverson said.
The clash between Apple and the Obama administration over an iPhone from one of the terrorists in the San Bernardino attack in December has raised difficult questions about privacy in an era where cellphones and tablets are a staple of modern life. But the debate has also shown the practical challenges as law enforcement adapts to technology.
Law enforcement agencies across Oregon, including in Clatsop County, rely on only a few experts from the Department of Justice and the Northwest Regional Computer Forensics Laboratory in Portland to process technology used in criminal cases.
The wait can be anywhere from six months to a year.
The Department of Justice is mission-oriented and specifically helps examine technology from child pornography cases. Resources come from its Internet Crimes Against Children Task Force. At the time of York’s case, the agency only had one computer analyst for the whole state.
“He was buried in computers,” Halverson said.
Meanwhile, the regional forensics lab examines all other criminal cases involving electronic devices. In this technology savvy generation, many crimes involve a cellphone, tablet or computer.
The forensics lab is part of the FBI. The lab is funded by the federal government, the Oregon State Police and police agencies in the Portland-metro area. Some of the police agencies have officers assigned to work for the lab.
Clatsop County law enforcement agencies are considered nonparticipating members of the lab, since none help fund it or send an officer. As non-members, local cases are a low priority, adding to the wait time.
Even if Clatsop County agencies did pay to participate, local officials say, they would still be at the end of the line compared to the larger caseloads around the state.
Ryan Humphrey, a detective with the Clatsop County Sheriff’s Office, said he has not sent any technology to the forensic lab in the past two years. He uses local resources and partners with law enforcement agencies that are participating members to submit electronics and speed up the process.
“The RCFL is a resource,” Humphrey said of the lab. “I have the ability to submit stuff to the RCFL, but it’s going to be long time before I get it back.”
Last fall, Astoria Police partnered with other local agencies to purchase Cellebrite software that pulls data off cellphones and other mobile devices smaller than a laptop. Laptop and desktop computers still have to be sent to the Department of Justice or the forensics lab.
The Cellebrite technology cost $15,000, which includes training officers.
Before the technology was made available locally, officers would have to make an appointment with the forensics lab and spend a day driving to Portland. Collecting all the data from a cellphone could take as long as 12 hours, so for the longer transfers, officers would have to make a second trip.
“For me, it’s a drive across town,” Humphrey said. “I no longer have to plan an entire week around when I can get to Portland.”
Knowing cellphones and tablets can now be processed quicker has made officers more willing to seize the devices. Examining the data has helped in burglary, domestic violence and drug cases.
Properly handling electronic devices in criminal cases is important, Humphrey said, especially considering the recent example involving Apple, which has refused to override security to help the FBI unlock an iPhone used by one of the shooters in the San Bernardino terror attack.
“You have to know what you are doing,” he said.
Humphrey occasionally comes across a locked device, but said there are ways around the obstacle.
Sometimes a victim will know the password and help, or the forensic lab will have the expertise.
Clatsop County Deputy District Attorney Dawn Buzzard said it is important to remember that a search warrant is required for any seized electronic device.
“You can’t go on a fishing expedition,” she said.
The reality for law enforcement is that examining electronic devices takes time. More officers are going to training sessions to learn about how to use technology in criminal cases.
Many times, a detective can find evidence online through social media without ever seizing any devices. An investigation can be conducted without contacting the suspect.
“We just don’t have the funds to send a person to be a part of RCFL,” Buzzard said of the lab. “It’s good different agencies are working together on this. We need to really keep up with the training.”
Consequence of delay
Law enforcement officers accept the delay in examining technology, Halverson said, but there is still a level of frustration.
In York’s case, Halverson applied for a second warrant to seize more hard drives and flash drives while the laptop was being processed.
York accepted a plea deal in October 2014, knowing the additional search could uncover more illegal material. One month later, the seized materials were returned to the police showing more child pornography, but the case was already resolved.
“I finally got it back in November, but they had already gone through and done that,” Halverson said of the plea deal.