Searching over 5,500,000 cases.


searching
Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

United States v. Mahler

United States District Court, D. Oregon, Portland Division

March 22, 2018

UNITED STATES OF AMERICA, Plaintiff,
v.
ROBERT EVANS MAHLER, Defendant.

          OPINION AND ORDER

          ANN AIKEN UNITED STATES DISTRICT JUDGE

         In February 2016, defendant Robert Evans Mahler was indicted on one count of being a felon in possession of a firearm, in violation of 18 U.S.C. § 922(g)(1). On December 7, 2017, defendant filed a set of four pretrial motions: a motion in limine (doc. 88), a motion for recusal (doc. 90), a motion to suppress (doc. 93), and a motion to dismiss for outrageous government conduct (doc. 95), I previously denied the motions in limine and for recusal. At a March 12, 2018 hearing, I orally denied the motions to suppress and to dismiss. This opinion and order explains in greater detail the reasons for that denial.

         BACKGROUND

         Defendant's motions to suppress and to dismiss rest on the same underlying factual allegation: he contends that an agent of the Bureau of Alcohol, Tobacco and Firearms ("ATF") entered his home and searched his property without a warrant on January 25, 2016. The evidentiary basis of that contention is a set of still images, taken by a motion-activated trail camera mounted on defendant's back porch, which show an individual entering the back door of defendant's home. The individual is dressed in clothing that covers him or her from head to toe. No facial features are visible, and it appears that the individual may have a mask or some other item covering his or her face. The back of the individual's shirt or jacket appears to have the letters "ATF" stamped on it. The images are marked with the date 01/25/2016 and times between 12:23AM and 12:37AM. In some of the images, the individual is carrying items; government witnesses identified those items as a rifle case and an ammunition belt. The parties' dispute with respect to the suppression and dismissal motions centers entirely on whether those images are sufficient proof that there was an unauthorized ATF search of defendant's home on January 25.

         The government's first witness was Amanda Johnson, the lead ATF agent assigned to defendant's case, Agent Johnson testified that she had supervised this case since its inception on January 19, 2016; that she had no knowledge of any ATF agents entering defendant's property before February 16, 2016, at which point their entry and search was justified by a warrant; and that she specifically asked each ATF agent who had been involved in defendant's case whether he or she had entered the property prior to February 16, and they all responded "no." Agent Johnson also looked at still frames from the surveillance footage and confirmed that the images appear to have been taken on defendant's property-specifically, on his back porch. Finally, Agent Johnson testified that it is not ATF agents' practice to cover their faces during searches.

         The government also called a forensic expert, Michelle Beltz.[1] Through her testimony, Ms. Beltz defined some relevant technical terms. First, she discussed metadata. Ms. Beltz testified that metadata can provide information such as whether a digital image has been modified or saved, GPS location of the photo, information about the camera that was used, whether a flash was used, the software that wrote the image to the computer, camera setting speeds, and image name. Ms. Beltz also explained that a hash value is a "digital fingerprint, " which consists of a variety of letters and numbers that give a unique identified to a file. As long as the contents of an image remain unaltered, the hash value stays the same. But if changes are made to the contents or metadata of the image, the hash value changes. Thus, the hash value can be used to see if changes have been made to still images that appear, upon visual inspection, to be identical.

         Ms. Beltz testified that she first reviewed an image related to this case on December 18, 2017, when she was asked, via email, to authenticate it, Ms. Beltz testified that her initial thought, based on her expertise and experience, was that the image did not "look right." She noted that the photo was similar to infrared images she has seen in the past, but that the tint

         (purple) was different from typical infrared images. Ms. Beltz testified that the metadata from the image she received by email showed that the image had been manipulated on November 27, 2017, with Microsoft Photo Editor. The metadata did not show the nature of the manipulation, but Ms. Beltz testified that the change was not simply copying the file, because copying does not show up in metadata. Ms. Beltz also noted that when an image is downloaded multiple times, it is assigned a number in parenthesis to differentiate it from previous downloads of the same file. The name for the image she received included a "3" in parenthesis, indicating that it was the third version of an image that was downloaded.

         On January 17, 2018, Ms. Beltz received a Dropbox link with a larger set of images; she received a follow-up hard copy CD with the same images on January 29, 2018. Later, on February 9, 2018, she received a second Dropbox link from Deadbolt Forensics.

         On February 15, 2018, Ms. Beltz received the camera that took the images in question in this case. The camera had been tagged as evidence and came with two different S.D. memory cards, one 4GB in size and one 16GB in size. Ms. Beltz examined the camera and came to the following conclusions. First, she found that the camera was "completely user-dependent" for date and time; there is no way to verify whether the date and time stamped on a digital image from the camera is the actual date and time the photo was taken rather than some other data and time input by the user. Second, she learned that the camera requires an S.D. card to operate; it will not take photos without a memory card in place and does not store images without a memory card.

         Ms. Beltz also examined the S.D. cards. She did not perform a complete forensic examination due to time constraints. She testified that the 4GB S.D. card at first appeared to be blank, but that she was able to forensically extract deleted images. The 16GB S.D. card had images on it that had not been deleted, which she also forensically extracted. She testified that the two S.D. cards had duplicate images on them; those images also matched, in part, the images provided to her via the two Dropbox links. Because the camera does not operate without an S.D. card in it and can hold only one S.D. card at a time, she concluded that someone must have copied the images from one S.D. card to the other. Ms. Beltz then compared the images from the 4G and 16G S.D. cards to one another. She found that three "pairs" of images, i.e., images that appeared visually identical, contained different hash values. She concluded from that information that at least three of the images had been altered, though she could not say for sure the nature of the alteration.

         Ms. Beltz noted that the camera is motion-triggered and takes sets of images in eight-image bursts. The camera's naming convention automatically assigns sequential numbers to the images. Ms. Beltz testified that there are time and number gaps in the image series. For example, she noted that an eight-image burst numbered 381 to 388 has a 12:23AM time stamp. There is then a three-minute gap, a missing image (389), and slight shift in camera angle. There are then five images time-stamped 12:26AM; those images are numbered 390, 391, 392, 393, 394, and 396 (395 was missing.) Ms. Beltz testified that she could not explain with certainty why there are missing images, different hash values, or time gaps. However, she hypothesized that the slight shift in camera position could be explained by someone swapping out the memory cards, which are spring-loaded, while the camera was still in place.

         Ms, Beltz testified that, in her expert opinion, the photographic ...


Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.