By Anthony Diosdi
Digital evidence permeates every aspect of the average person’s life in today’s society. No matter what someone does these days, a digital footprint is likely being created that contains some type of digital evidence that is recoverable. Sending an email, drafting a document, or surfing the internet all creates digital evidence. The collection and analysis of this digital evidence could be extremely important in a criminal tax prosecution. Today, modern devices can serve as huge repositories of personal information yet be carried in a pocket and assessed with a single hand or even a voice command.
In criminal tax cases, the Internal Revenue Service (“IRS”) typically seizes evidence through a search warrant with no forewarning to the persons in possession of the evidence. In many cases, the warrant is written in such a way as to allow the wholesale collection of anything and everything in the realm of electronics, including items like computers, cell phones, and tablets.
Modern devices such as computers, cellphones, and tablets are often the main source of digital evidence. The personal information contained in seized devices can be a treasure trove of digital evidence for the IRS. For example, people today are sharing their everyday activities, their thoughts, their personal photos, and even their locations on Instagram, Facebook, and Twitter. Social media posts of expensive sports cars or exotic vacations of an individual being investigated for tax evasion or filing false tax returns can be highly probative. Emails between two defendants accused of conspiring to defraud the United States discussing a plan to defraud the IRS can also be highly probative.
Overview of Digital Evidence and Digital Forensics
Criminal tax cases can involve many types of digital evidence. The key for a criminal tax attorney is to make sure that he or she is getting all of the evidence needed to defend his or her client effectively. To do this, the criminal tax lawyer must understand digital evidence and digital forensics. Digital evidence begins as electronic data, either in the form of a transaction, a document, or some type of media. Whenever someone creates an email, writes a document, or pays a bill online, they create digital evidence. Surfing the Internet or making a phone call on a cell phone also creates digital evidence.
The term digital forensics can be defined as the application of science to a matter of law. The most accepted definition of digital forensics comes from the definition of computer forensics: computer forensics is the collection, preservation, analysis, and presentation of electronic evidence for use in a legal matter using forensically sound and generally accepted processes, tools, and practices. See Digital Forensics for Legal Professionals, Understanding Digital Evidence From the Warrant to the Courtroom, Larry and Lars Daniel, Syngress (2012).
Digital forensics encompasses four areas:
1. Acquisition
2. Preservation
3. Analysis
4. Presentation
Each of these areas include specific forensic processes and procedures.
Acquisition
Acquisition is the process of actually collecting electronic data. For example, an IRS agent seizing a computer at a home or business is part of the acquisition process. Making a forensic copy of a computer hard drive is part of the acquisition process. Acquisition is the first contact with the evidence and it is the point where evidence is most likely to be damaged. As evidence is collected, it must be preserved in a state that is defensible in court.
Preservation
Preservation is the process of creating a chain of custody that begins prior to acquisition and ends when the evidence is returned to the owner. Any break in the chain of custody can lead to questions about the validity of the evidence. In addition, preservation of evidence includes keeping the evidence safe from accidental modification. A chain of custody log best illustrates an example of prevention. Chain of custody logs should include every instance that a piece of evidence has been touched, including the initial collection of the device storing the evidence, the transportation and storage of the evidence and any time the evidence is checked out for handling. At no time should there be a break in this chain of custody.
Analysis
Analysis is the process of locating and collecting evidentiary items from evidence that has been collected in a case. In a tax fraud case, financial records would be the target of the analysis, as well as the possible deletion of records involving financial transactions. Analysis of digital evidence is more than just determining whether something like a file or email message exists on a hard drive. It also includes finding out how that file or email message got on the hard drive, and if possible, who put the file or message on the hard drive.
Presentation
Presentation is the last step in the process of forensic analysis of electronic evidence. This includes not only the written findings or forensic report, but also the creation of affidavits, depositions of experts, and court testimony. The forensic examination should be written clearly, concisely, and accurately, explaining what was examined, the tools used for the examination, the process used by the examiner, and the results of that examination. The report should also include the collection methods used, including specific steps taken to protect and preserve the original evidence and how the verification of the evidence was performed.
In general, a digital forensic report should include:
1. Background and experience of the examiner.
2. Tools used in the examination.
3. Methods used to verify the data.
4. Processes used to recover and extract the data.
5. Statement of what the examiner found.
6. Actual data recovered to support the statement of findings.
Finally, best practices apply to the collection and preservation of evidence. These are the two critical parts of ensuring that evidence will be accepted in a court as being authentic and an accurate representation of the original evidence. Modification of evidence, either intentionally or accidentally, can have a devastating effect on the entire case.
Obtaining Digital Evidence
Determining what digital evidence the Government has obtained in a criminal tax matter is not only important to understand the strengths and weaknesses of the case, it is also important to determine if there are weaknesses in digital forensics. Afterall, if electronic evidence is defective because it was not properly collected, preserved, analyzed, or presented, it will not likely be admissible in a criminal tax trial. Thus, it is very important to understand the digital evidence in the Government’s possession as early as possible.
Every criminal tax case that is referred to the United States Attorney’s Office for prosecution is unique; however, the process of making sure that a criminal tax attorney is getting all of the digital evidence available from the Government needed to defend his or her client effectively is somewhat consistent. To do this, a criminal tax attorney must first go through the initial discovery provided in the case and then determine what digital evidence might be available, either directly from the IRS or via subpoenas of third parties. Criminal tax attorneys should pay particular attention to items collected as well as clues to items that may be available from third parties:
Search Warrant Returns
Search warrant returns provide a listing of all evidence collected by IRS agents when they execute the warrants. It is important for criminal tax attorneys to pay special attention to the items in the inventory to determine if they might yield digital evidence. While it may appear obvious that a lawyer wants to ensure that he or she gets computers and cell phones, other devices, such as storage devices, can also contain critical evidence.
Paper Discovery
It can be easy to miss potential digital evidence when working through paper discovery if the lawyer is not aware of some of the evidence that can be gathered based on clues provided by witness statements, investigative reports, and documents gathered from third parties. Evidence in the paper discovery can include web pages from social media sites, printouts of emails, and specific computer screenshots.
Preparing for a Discovery Motion and the Language for a Consent Order for Digital Evidence
In order to identify all the evidence that the government has obtained and to build a strong defense, defense counsel should send a detailed letter to the Assistant United States Attorney or federal prosecutor as early as possible requesting the following:
Inventory– a complete inventory of all items taken that may contain any type of digital data.
Requesting Supplemental Documents– a copy of the resume or curriculum vitae of any prosecution expert involved in the collection, handling, imaging, or examination of any electronic evidence and or items collected.
Computers– a duplicate of any foresentic copies made by the Government’s experts of any computer hard drive, digital storage media, including but not limited to CD-ROMs, USB flash drives, floppy disks, memory cards, digital camera storage, smart cards, and portable hard drives.
Portable Devices– a duplicate of any forensic copies made by the Government’s experts of any cell phone and/or SIM cards, media cards, video recording devices, audio recording devices, or any other electric devices collected in this case
Items Not Forensically Imaged– in the event the IRS or the prosecutor did not make forensic copies of any original media, the defense requests that forensically sound copies be made and sent to the defense for examination. In the event that the IRS or the prosecution’s office is unable to make foresentic copies of any evidence, the defense requests access to the evidence so it can arrange for copies of the evidence.
A response from the Government should provide defense counsel with a road map of the digital evidence available and if there are forensic weaknesses with the digital evidence in the Government’s possession. It may also provide a criminal tax attorney with valuable information to build a motion for discovery. Creating effective discovery motions for digital evidence is not a cookie-cutter process. In order to obtain the information needed, defense counsel will need to perform a comprehensive examination of the evidence provided and the discovery motion will need to be tailored to the type of digital evidence that is of interest in the case. One such discovery motion is a consent order for digital evidence. If drafted properly, a consent order should provide defense counsel with the digital evidence along with information regarding the chain of custody of such evidence to defense counsel.
Below, please find an example of a consent order.
Upon Motion of the Defendant, by and through his counsel, appearing to this Court:
UPON MOTION OF THE DEFENDANT, John Doe, by and through his counsel, Steve Smith, and it appearing to the Court:
1. That the Defendant has been indicted for the offenses of filing false tax returns, and tax evasion.
2. That based upon discovery received to date by the Defendant, (list items) were seized and removed from the alleged crime scene by law enforcement and are presently in the custody of the IRS.
3. That counsel for Defendant has a reasonable belief that there exists information contained within the data in the aforementioned computers that is necessary to ensure Defendant receives a fair trial and effective assistance of counsel and to adequately prepare a defense in this matter.
4. That the Defendant is entitled under the discovery statutes of California, as well as Brady v. Maryland, 373 U.S. 83, 83 S. Ct. 1194 10 L. Ed. 2d 215 (1963), and its progeny, to these requested items.
5. That the Assistant United States Attorney, counsel for Defendant consent to the entry of this Order as indicated by the signature of each below.
IT IS THEREFORE ORDERED that:
1. The IRS provide to the Assistant United States Attorney the following:
a. A duplicate of any forensic copies made by IRS personnel or by the prosecution’s experts of any computer hard drive, digital storage media including but not limited to CD-ROMs, USB flash drives, floppy disks, memory cards, smart cards, portable hard drives, or other devices capable of storing electronic data;
b. Duplicates of any forensic copies made by IRS personnel or by the prosecution’s experts or any cell phone and/or SIM cards, media cards, or other storage;
c. In the event the IRS personnel or the prosecution’s experts did not make a forensic copy of any original media, defense requests that forensically sound copies be made and furnished to the defense for examination by the defense expert;
d. In the event that the IRS or the prosecution is unable to provide copies of evidence from any of the devices seized, a defense expert shall be given the appropriate opportunity to make forensic copies of any such devices or storage media;
e. A complete inventory of all items taken that may contain any type of digital data, whether or not such items were examined or copies made by IRS personnel or the prosecution’s experts, and;
f. A complete copy of all forensics reports, chain of custody records, and lab notes generated by IRS personnel or the prosecution’s experts pertaining to the acquisition, preservation, analysis, and or reporting by said personnel or experts in the course of this investigation.
g. A copy of the resume or curriculum vitae of any prosecution expert involved in the seizure, handling, copying, or examination of the items listed in this order.
2. That, upon receipt from the United States Attorney, the Assistant United States provides to the counsel for the Defendant copies of the aforementioned items.
Digital evidence is everywhere and permeates every aspect of an individual’s life. No matter what an individual is doing, a digital footprint is probably being created that contains some type of digital evidence that can be recovered. Sending an email, writing a document, or surfing on the Internet all create digital evidence. Digital evidence now plays an important role in criminal tax cases. Defense counsel must be prepared to deal with digital evidence and digital forensics in a criminal tax case.
Conclusion
Winning or losing a criminal tax evasion case will depend to a large extent on the actual facts of any particular case. Nevertheless, this is one of the few areas of the criminal law where the most vital and damaging facts are consistently developed from the defendant himself, because he makes statements or delivers records or offers early and weak defenses. Even when the IRS proceeds on an indirect method of proof, the defendant invariably admits or supplies vital links which pull together various inferences, assumptions, presumptions, or guesses into what passes in law as a prima facie case. In any area of the law where proof of guilt is thus typically self-generated, the value of a qualified attorney is inestimable.
Anthony Diosdi is one of several tax attorneys and international tax attorneys at Diosdi Ching & Liu, LLP. Anthony Diosdi focuses a part of his practice on criminal tax enforcement, broad-based civil tax compliance and white collar matters generally. He also advises clients on the IRS voluntary disclosure program, with particular focus on disclosure related to offshore banking accounts.
Anthony Diosdi is a frequent speaker at international tax seminars. Anthony Diosdi is admitted to the California and Florida bars.
Diosdi Ching & Liu, LLP has offices in San Francisco, California, Pleasanton, California and Fort Lauderdale, Florida. Anthony Diosdi advises throughout the United States. Anthony Diosdi may be reached at (415) 318-3990 or by email: adiosdi@sftaxcounsel.com.
This article is not legal or tax advice. If you are in need of legal or tax advice, you should immediately consult a licensed attorney.