WEBVTT
1
00:00:00.150 --> 00:00:05.150
SJC-13598 in the matter of an impounded case.
2
00:00:11.748 --> 00:00:13.534
May it please the Court-
Okay.
3
00:00:13.534 --> 00:00:14.668
Good morning, Your Honor.
Please continue.
4
00:00:14.668 --> 00:00:15.600
Good morning.
5
00:00:15.600 --> 00:00:17.303
Eddie McNaught for the appellant.
6
00:00:18.630 --> 00:00:22.890
Justices, I'm asking this court to reverse the conviction
7
00:00:22.890 --> 00:00:26.910
in this case, because the trial Judge impermissibly
8
00:00:26.910 --> 00:00:29.430
allowed the Commonwealth to introduce testimony
9
00:00:29.430 --> 00:00:32.490
that went beyond the scope of what is allowed
10
00:00:32.490 --> 00:00:34.323
of a lay witness.
11
00:00:35.250 --> 00:00:38.850
Like to start by reviewing, if I may,
12
00:00:38.850 --> 00:00:41.193
the testimony and how it came in.
13
00:00:42.030 --> 00:00:45.900
It's important to point out that at the top,
14
00:00:45.900 --> 00:00:48.330
defense counsel alerted the trial judge
15
00:00:48.330 --> 00:00:51.150
that there was a concern about the scope
16
00:00:51.150 --> 00:00:52.560
of the testimony that would be coming in
17
00:00:52.560 --> 00:00:54.420
through Detective McLaughlin.
18
00:00:54.420 --> 00:00:56.880
There's a short discussion where the Commonwealth
19
00:00:56.880 --> 00:01:01.880
represented to the trial judge that essentially
20
00:01:02.220 --> 00:01:04.920
Detective McLaughlin's testimony would be limited.
21
00:01:04.920 --> 00:01:07.530
And the trial judge said
22
00:01:07.530 --> 00:01:10.260
his understanding was it would fall in line
23
00:01:10.260 --> 00:01:12.690
with the other officers who testified.
24
00:01:12.690 --> 00:01:14.670
And with that the Commonwealth-
25
00:01:14.670 --> 00:01:17.550
Well wait, can you just, 'cause I think most of us
26
00:01:17.550 --> 00:01:21.057
are familiar with the record, and the preserved nature
27
00:01:21.057 --> 00:01:23.490
of the error that you're suggesting occurred.
28
00:01:23.490 --> 00:01:28.490
What part of McLaughlin's testimony is the part
29
00:01:29.100 --> 00:01:33.753
that you're saying went into expert testimony?
30
00:01:34.860 --> 00:01:37.023
Well, there are a few parts, Your Honor.
31
00:01:39.270 --> 00:01:42.780
Most concerning to our position is the fact
32
00:01:42.780 --> 00:01:45.150
that Detective McLaughlin testified
33
00:01:45.150 --> 00:01:49.740
that the images were not cached.
34
00:01:49.740 --> 00:01:51.840
In other words, they couldn't have been
35
00:01:51.840 --> 00:01:56.840
on this phone accidentally by virtue of visiting a website.
36
00:01:57.120 --> 00:02:02.120
That in concept, meaning the discussion of a cache file is,
37
00:02:02.400 --> 00:02:03.900
we would argue beyond the scope
38
00:02:03.900 --> 00:02:06.720
of what what the average person understands.
39
00:02:06.720 --> 00:02:07.770
Counsel, excuse me.
40
00:02:08.940 --> 00:02:10.949
When you make that argument,
41
00:02:10.949 --> 00:02:15.949
can you respond to sort of the nature of the report,
42
00:02:17.310 --> 00:02:21.210
the extraction report, that the detective was working from?
43
00:02:21.210 --> 00:02:24.270
And my understanding based on looking at the report
44
00:02:24.270 --> 00:02:27.000
is that we're looking on what was admitted as an exhibit,
45
00:02:27.000 --> 00:02:31.080
is that the report literally says that the images
46
00:02:31.080 --> 00:02:33.847
were found in a sub folder that was titled,
47
00:02:33.847 --> 00:02:37.650
"Something/something/screenshots."
48
00:02:37.650 --> 00:02:42.650
So can you respond to the fact of, can you deal with that?
49
00:02:42.768 --> 00:02:44.760
Sure. Thank you, Justice.
50
00:02:44.760 --> 00:02:48.420
So had the only evidence in trial at trial
51
00:02:48.420 --> 00:02:53.420
been the admission of this report in the form that it was,
52
00:02:54.990 --> 00:02:58.530
it might have been okay, though I'm not conceding that point
53
00:02:58.530 --> 00:03:03.530
given the defense was, if you will, caught off guard
54
00:03:05.490 --> 00:03:08.280
by the notice provided by the Commonwealth in this case.
55
00:03:08.280 --> 00:03:12.600
But getting back to your question, that wasn't how
56
00:03:12.600 --> 00:03:15.985
Detective McLaughlin presented his testimony.
57
00:03:15.985 --> 00:03:19.980
"This is what we received, or I received,
58
00:03:19.980 --> 00:03:23.490
in so many words, from my extraction.
59
00:03:23.490 --> 00:03:25.740
And also, here's what it means."
60
00:03:25.740 --> 00:03:27.810
And that gets back to Justice Wendlandt's question
61
00:03:27.810 --> 00:03:30.480
about really what is appropriate, what isn't.
62
00:03:30.480 --> 00:03:33.930
And when Detective McLaughlin is ultimately allowed
63
00:03:33.930 --> 00:03:37.500
to say, you know, "By virtue of the appearance
64
00:03:37.500 --> 00:03:42.000
of these images in this report in this way, we know,
65
00:03:42.000 --> 00:03:44.818
I know, and you can know, finder of fact,
66
00:03:44.818 --> 00:03:49.230
that these files were, were in effect screenshotted
67
00:03:49.230 --> 00:03:51.270
by the person who had the phone."
68
00:03:51.270 --> 00:03:54.960
But Counsel, if we're going to the difference
69
00:03:54.960 --> 00:03:58.710
between lay opinion and expert opinion,
70
00:03:58.710 --> 00:04:02.640
and if I could marry the two points that Justice Dewar
71
00:04:02.640 --> 00:04:04.860
and Justice Wendlandt just alluded to, it's like,
72
00:04:04.860 --> 00:04:06.630
we still haven't gotten your answer.
73
00:04:06.630 --> 00:04:09.930
If the lay opinion testimony is supposed to be testimony
74
00:04:09.930 --> 00:04:12.870
that's to be helpful to the fact finder,
75
00:04:12.870 --> 00:04:16.147
and the extraction report says,
76
00:04:16.147 --> 00:04:21.147
"These images were found in a particular place,
77
00:04:21.315 --> 00:04:25.350
and therefore they're in a file,
78
00:04:25.350 --> 00:04:27.660
they're with a bunch of other images,
79
00:04:27.660 --> 00:04:29.910
and based on the extraction report,"
80
00:04:29.910 --> 00:04:33.330
Detective McLaughlin says, "they couldn't have been cached.
81
00:04:33.330 --> 00:04:34.980
They couldn't have been something just by virtue
82
00:04:34.980 --> 00:04:37.560
of going to a website, because they were found
83
00:04:37.560 --> 00:04:41.940
in a discrete file that had a bunch of other images
84
00:04:41.940 --> 00:04:43.200
that were in there."
85
00:04:43.200 --> 00:04:45.330
W what what is it about that
86
00:04:45.330 --> 00:04:50.310
that delves into specialized technical experience
87
00:04:50.310 --> 00:04:52.740
that only an expert would give?
88
00:04:52.740 --> 00:04:56.017
Why isn't that just proper lay opinion testimony?
89
00:04:56.017 --> 00:04:59.490
"Here's where I found it, and because of where I found it,
90
00:04:59.490 --> 00:05:01.230
it's helpful for you to know that
91
00:05:01.230 --> 00:05:05.820
it's more likely than not from this happening,
92
00:05:05.820 --> 00:05:08.220
the happenstance of going to a website."
93
00:05:08.220 --> 00:05:09.690
If I understand your question, Your Honor,
94
00:05:09.690 --> 00:05:12.660
I think there are two responses to that possibly.
95
00:05:12.660 --> 00:05:16.410
First of all, with respect to Cellebrite itself,
96
00:05:16.410 --> 00:05:20.850
most people, we would argue, don't understand exactly how,
97
00:05:20.850 --> 00:05:23.400
you know, they understand we'd argue,
98
00:05:23.400 --> 00:05:26.340
that phones and devices have a lotta data.
99
00:05:26.340 --> 00:05:28.860
They probably also understand
100
00:05:28.860 --> 00:05:32.010
that the data can be extracted in somehow,
101
00:05:32.010 --> 00:05:35.850
but when you get into the Cellebrite software itself
102
00:05:35.850 --> 00:05:39.330
and what the Cellebrite software does or can do,
103
00:05:39.330 --> 00:05:41.700
I think we'd probably lose the majority of the population.
104
00:05:41.700 --> 00:05:43.560
But lay people know what screenshots are, right?
105
00:05:43.560 --> 00:05:46.503
Right, for sure Justice Gaziano, yes.
106
00:05:47.370 --> 00:05:52.370
But that, connecting your point to Justice Georges' point,
107
00:05:52.950 --> 00:05:56.610
if we were just to say that, "I found these screenshots
108
00:05:56.610 --> 00:05:59.310
manipulating the phone personally in this way,"
109
00:05:59.310 --> 00:06:03.030
which I don't believe was testified to
110
00:06:03.030 --> 00:06:05.587
by Detective McLaughlin, Detective McLaughlin's saying,
111
00:06:05.587 --> 00:06:08.850
"I found these things that we can trust are screenshots
112
00:06:08.850 --> 00:06:12.696
that you know, fact finder, about, and I found them,
113
00:06:12.696 --> 00:06:17.630
you know, because this software generated this report
114
00:06:17.630 --> 00:06:20.250
in the software implicitly."
115
00:06:20.250 --> 00:06:21.960
But that's not what he's doing.
116
00:06:21.960 --> 00:06:25.140
He's saying it, to the fact finder's determination
117
00:06:25.140 --> 00:06:27.810
of whether or not they were from a website
118
00:06:27.810 --> 00:06:31.230
or their screenshot, "It's helpful for you to know
119
00:06:31.230 --> 00:06:34.440
that the Cellebrite software found it here."
120
00:06:34.440 --> 00:06:37.260
He's not getting into what the software does.
121
00:06:37.260 --> 00:06:40.080
He's, "Like all of the other cases that you cite
122
00:06:40.080 --> 00:06:42.870
and the other side sites, Cellebrite is something
123
00:06:42.870 --> 00:06:45.421
that we've gone through a bunch of times.
124
00:06:45.421 --> 00:06:46.410
It's plug and play, here's what it does,
125
00:06:46.410 --> 00:06:48.390
it takes out the stuff," and then the people talk
126
00:06:48.390 --> 00:06:52.140
about what the stuff was that was extracted from the phone.
127
00:06:52.140 --> 00:06:55.950
If we're just limiting to that, what is it about the fact
128
00:06:55.950 --> 00:06:58.350
that he said, "These are screenshots filed in this file
129
00:06:58.350 --> 00:07:01.920
from this extraction, and then it's helpful to you to know
130
00:07:01.920 --> 00:07:05.517
that it wasn't from a website, it was from this file."
131
00:07:06.810 --> 00:07:09.090
Well, Your Honor, it becomes extremely problematic
132
00:07:09.090 --> 00:07:12.690
when a detective or a witness says
133
00:07:12.690 --> 00:07:16.177
in response to questioning from the prosecution, you know,
134
00:07:16.177 --> 00:07:18.240
"Is there any way for this to be"-
135
00:07:18.240 --> 00:07:22.230
But that's a different point, and I think your best point,
136
00:07:22.230 --> 00:07:24.600
that how explains that Cellebrite
137
00:07:24.600 --> 00:07:26.880
is an uncorruptible mirror image.
138
00:07:26.880 --> 00:07:29.370
Right, and that's, when you marry that
139
00:07:29.370 --> 00:07:32.340
to Justice Georges' point about, you know,
140
00:07:32.340 --> 00:07:36.150
the inherent problem with the testimony
141
00:07:36.150 --> 00:07:37.770
as it was presented at a whole,
142
00:07:37.770 --> 00:07:41.400
'cause parts of it would have to agree,
143
00:07:41.400 --> 00:07:44.670
under the federal rules at least right now
144
00:07:44.670 --> 00:07:47.100
seem to be permissible, and probably are
145
00:07:47.100 --> 00:07:50.880
rules of evidence here as well, condone some form-
146
00:07:50.880 --> 00:07:53.190
Well, could we give you a little more time
147
00:07:53.190 --> 00:07:55.200
to answer Justice Wendlandt's initial question,
148
00:07:55.200 --> 00:07:57.060
which is, if you are assuming that it's okay,
149
00:07:57.060 --> 00:07:59.490
as you just said, that some of this can come in,
150
00:07:59.490 --> 00:08:02.640
if it were just, "I plugged it in, this is what came out."
151
00:08:02.640 --> 00:08:04.920
Can you answer her question, which I realize
152
00:08:04.920 --> 00:08:06.150
I interrupted you in the middle of answering,
153
00:08:06.150 --> 00:08:08.850
about like what precisely, like almost going
154
00:08:08.850 --> 00:08:11.940
through the transcript basis, like what are the exact things
155
00:08:11.940 --> 00:08:14.340
that you think came in wrongly?
156
00:08:14.340 --> 00:08:16.650
Other than the cache, 'cause you talked about that.
157
00:08:16.650 --> 00:08:18.120
Other than the cache.
Thank you.
158
00:08:18.120 --> 00:08:20.040
The testimony.
I apologize Judge,
159
00:08:20.040 --> 00:08:21.060
for losing the point.
160
00:08:21.060 --> 00:08:26.060
So to that question, we would argue that metadata is,
161
00:08:27.450 --> 00:08:29.430
the general public may have some sense
162
00:08:29.430 --> 00:08:32.130
of what metadata can do, but not specifically.
163
00:08:32.130 --> 00:08:34.950
And there was obviously references to metadata.
164
00:08:34.950 --> 00:08:37.260
Would also argue-
So you're saying
165
00:08:37.260 --> 00:08:40.200
that a non-expert witness can't refer
166
00:08:40.200 --> 00:08:43.200
to the existence of metadata in testimony.
167
00:08:43.200 --> 00:08:45.729
[Eddie[ That would not be the best approach,
168
00:08:45.729 --> 00:08:47.036
in our opinion.
169
00:08:47.036 --> 00:08:49.680
In the existence of metadata or what metadata is?
170
00:08:49.680 --> 00:08:52.230
Well if, we're talking about matters of degree,
171
00:08:52.230 --> 00:08:53.790
but in this, in this case it was,
172
00:08:53.790 --> 00:08:57.210
there was what is metadata, and how does it function?
173
00:08:57.210 --> 00:09:01.170
And that sort of renders, and I hope this gets back
174
00:09:01.170 --> 00:09:04.470
to the question, renders Detective McLaughlin
175
00:09:04.470 --> 00:09:06.719
an expert, versus just someone
176
00:09:06.719 --> 00:09:08.370
who's explaining their perceptions.
177
00:09:08.370 --> 00:09:11.700
And just from a factual perspective,
178
00:09:11.700 --> 00:09:14.010
'cause I am not as familiar with the transcript
179
00:09:14.010 --> 00:09:19.010
as you I'm sure are, did he testify that,
180
00:09:19.207 --> 00:09:24.207
"In the report, reports, the metadata as follows,
181
00:09:25.380 --> 00:09:28.020
and the metadata means that this screenshot
182
00:09:28.020 --> 00:09:31.350
was saved on X date at this time?"
183
00:09:31.350 --> 00:09:34.170
That is effectively, that is a fair characterization
184
00:09:34.170 --> 00:09:37.380
of the testimony, at least part of the testimony.
185
00:09:37.380 --> 00:09:39.360
Yeah, and then the other part,
186
00:09:39.360 --> 00:09:44.290
just to put a fine point on it, is that he testifies
187
00:09:45.960 --> 00:09:48.870
that Cellebrite does not manipulate
188
00:09:48.870 --> 00:09:52.216
or change the data on the phone.
189
00:09:52.216 --> 00:09:56.430
And I guess I'm surprised that I hadn't heard you say,
190
00:09:56.430 --> 00:09:58.950
although perhaps you were interrupted,
191
00:09:58.950 --> 00:10:02.280
that that was the most problematic part
192
00:10:02.280 --> 00:10:05.580
of McLaughlin's testimony, given that he has no idea
193
00:10:05.580 --> 00:10:07.260
how Cellebrite works.
194
00:10:07.260 --> 00:10:08.093
Thank you for that, your Honor.
195
00:10:08.093 --> 00:10:11.190
Yes, absolutely agree with the Court's point to that.
196
00:10:11.190 --> 00:10:14.070
You know, there was that testimony,
197
00:10:14.070 --> 00:10:18.483
which we would argue was out of bounds, and also,
198
00:10:19.740 --> 00:10:22.260
and it was, pardon me, I believe it was repeated
199
00:10:22.260 --> 00:10:25.145
in different forms throughout Detective McLaughlin.
200
00:10:25.145 --> 00:10:30.145
So the effect of that is, in a case where perhaps,
201
00:10:32.610 --> 00:10:36.240
you know, the evidence was strong for the Commonwealth
202
00:10:36.240 --> 00:10:41.100
in respects that were addressed in the appellee's brief,
203
00:10:41.100 --> 00:10:43.770
but not insurmountable, not not in a way
204
00:10:43.770 --> 00:10:48.030
that were we to reduce the evidence to what maybe
205
00:10:48.030 --> 00:10:50.322
I think the trial judge probably had in mind
206
00:10:50.322 --> 00:10:53.610
when he initially made the finding for the record,
207
00:10:53.610 --> 00:10:55.500
that if this is a plug and play situation,
208
00:10:55.500 --> 00:10:59.580
following the lead of the circuit courts,
209
00:10:59.580 --> 00:11:02.940
that probably was a fair ruling on, on the law.
210
00:11:02.940 --> 00:11:07.230
The issue became that the Commonwealth didn't confine
211
00:11:07.230 --> 00:11:10.830
Detective McLaughlin's testimony to the boundaries
212
00:11:10.830 --> 00:11:14.070
that the trial court set, and the trial court in this
213
00:11:14.070 --> 00:11:16.770
didn't enforce that as it pertained
214
00:11:16.770 --> 00:11:19.650
to the issue that we're discussing.
215
00:11:19.650 --> 00:11:22.470
Well assuming, are you done answering
216
00:11:22.470 --> 00:11:23.490
Justice Wendlandt's question,
217
00:11:23.490 --> 00:11:26.610
as far as the categories that were problematic?
218
00:11:26.610 --> 00:11:27.510
I'm sorry?
Are you done
219
00:11:27.510 --> 00:11:29.656
answering her question, as far as the categories
220
00:11:29.656 --> 00:11:32.250
that were problematic?
I believe so.
221
00:11:32.250 --> 00:11:34.560
Okay, assuming we agree with you
222
00:11:34.560 --> 00:11:38.340
that at least with respect to the how Cellebrite works
223
00:11:38.340 --> 00:11:41.430
was impermissible expert testimony,
224
00:11:41.430 --> 00:11:44.220
how is this in any way prejudicial error,
225
00:11:44.220 --> 00:11:48.000
given all the evidence against your client?
226
00:11:48.000 --> 00:11:48.900
Thank you, Judge.
227
00:11:48.900 --> 00:11:51.603
So Your Honor, with respect to the prejudice,
228
00:11:52.980 --> 00:11:55.050
there are two points that the Commonwealth made
229
00:11:55.050 --> 00:11:56.400
I wanna respond to specifically.
230
00:11:56.400 --> 00:11:58.590
Yes, we have these statements
231
00:11:58.590 --> 00:12:01.350
that are powerful for the state.
232
00:12:01.350 --> 00:12:04.800
Additionally we have the observations of the officers, so-
233
00:12:04.800 --> 00:12:06.990
The two officers who saw the photos?
234
00:12:06.990 --> 00:12:07.890
Yes, Your Honor.
235
00:12:07.890 --> 00:12:11.820
So with respect to the statements, it has to be pointed out
236
00:12:11.820 --> 00:12:16.820
that to begin with, my client said to both the civilian
237
00:12:18.720 --> 00:12:22.237
and the investigating officers at the grocery store,
238
00:12:22.237 --> 00:12:25.020
"Here, have my phone, take a look through it."
239
00:12:25.020 --> 00:12:29.190
Not the kinda conduct that we might say is consistent
240
00:12:29.190 --> 00:12:32.280
with a person who's aware that the phone has
241
00:12:32.280 --> 00:12:35.400
the types of images that are later found there.
242
00:12:35.400 --> 00:12:39.540
Further, to my client's statements,
243
00:12:39.540 --> 00:12:44.540
no one ever confronts him with a specific image to say,
244
00:12:46.170 --> 00:12:49.770
I think this is crucial, "Do you know that this
245
00:12:49.770 --> 00:12:51.480
is on your phone, this specific thing?"
246
00:12:51.480 --> 00:12:52.380
And that ties-
Well-
247
00:12:52.380 --> 00:12:54.450
to the second-
I don't know about that,
248
00:12:54.450 --> 00:12:59.450
because perhaps your client misinterpreted
249
00:13:00.450 --> 00:13:03.210
how far they would look, in as much as,
250
00:13:03.210 --> 00:13:05.970
perhaps he only thought they were just gonna look
251
00:13:05.970 --> 00:13:08.469
to see whether any pictures of this woman's children
252
00:13:08.469 --> 00:13:10.443
were on the phone, and that was it.
253
00:13:10.443 --> 00:13:12.120
"And as long as they were satisfied,
254
00:13:12.120 --> 00:13:13.470
they'd gimme my phone back."
255
00:13:13.470 --> 00:13:16.650
But later on when when he's upstairs,
256
00:13:16.650 --> 00:13:20.936
he talks about CP, he talks about,
257
00:13:20.936 --> 00:13:24.630
so the idea that he wouldn't have any heads up,
258
00:13:24.630 --> 00:13:26.430
he offers that there may,
259
00:13:26.430 --> 00:13:29.220
he gives some reason why to justify that.
260
00:13:29.220 --> 00:13:33.330
But how would that affect the prejudice analysis,
261
00:13:33.330 --> 00:13:36.990
where he makes these really powerful admissions
262
00:13:36.990 --> 00:13:41.550
that in fact there's child porn on this?
263
00:13:41.550 --> 00:13:43.050
Well, when we get to the specifics
264
00:13:43.050 --> 00:13:45.720
of what he says upstairs, it's important
265
00:13:45.720 --> 00:13:47.550
that the sequence of events, he now knows
266
00:13:47.550 --> 00:13:50.250
that the officer has found something of concern,
267
00:13:50.250 --> 00:13:52.380
he inferentially put that together.
268
00:13:52.380 --> 00:13:56.520
But crucially, when he is upstairs being interviewed,
269
00:13:56.520 --> 00:14:00.150
there's the discussion of the specific CP,
270
00:14:00.150 --> 00:14:03.570
centers around this single image involving
271
00:14:03.570 --> 00:14:08.570
what he described, he was aware of as a young male,
272
00:14:08.790 --> 00:14:12.210
as a young male who, in the nude.
273
00:14:12.210 --> 00:14:15.180
Categorically speaking, that may qualify.
274
00:14:15.180 --> 00:14:17.340
He said it was concerning enough to him
275
00:14:17.340 --> 00:14:19.830
to screenshot that specific image.
276
00:14:19.830 --> 00:14:22.770
Okay, but we don't know whether it actually does
277
00:14:22.770 --> 00:14:25.950
because how young is young, okay?
278
00:14:25.950 --> 00:14:28.830
What about it is concerning, what about the posture?
279
00:14:28.830 --> 00:14:30.930
As to the other images that appeared,
280
00:14:30.930 --> 00:14:33.513
that the officers testified to,
281
00:14:34.500 --> 00:14:37.200
those for sure would have to qualify.
282
00:14:37.200 --> 00:14:40.740
But the image where, that he admitted to specifically,
283
00:14:40.740 --> 00:14:43.530
is only de described in the most generic terms,
284
00:14:43.530 --> 00:14:48.360
leaving open the possibility that he was only aware
285
00:14:48.360 --> 00:14:52.633
of this one concerning image of a male.
286
00:14:52.633 --> 00:14:56.700
And that's, to get back to Justice Gaziano's question,
287
00:14:56.700 --> 00:15:00.240
where the prejudice falls in this case,
288
00:15:00.240 --> 00:15:04.470
and why there is no way to say that this was harmless.
289
00:15:04.470 --> 00:15:06.960
Sorry, can I just circle back to the metadata point?
290
00:15:06.960 --> 00:15:09.840
So I just refreshed my recollection, which,
291
00:15:09.840 --> 00:15:13.143
and I just wanted to make something clear.
292
00:15:15.630 --> 00:15:18.930
Almost all of the testimony about metadata
293
00:15:18.930 --> 00:15:21.480
consisted of the prosecution going through
294
00:15:21.480 --> 00:15:25.410
the extraction report, which has thumbnails of the images,
295
00:15:25.410 --> 00:15:28.830
and then next to the image it says the file path,
296
00:15:28.830 --> 00:15:31.530
where it was found, and like a little bit
297
00:15:31.530 --> 00:15:33.360
of other information like the date,
298
00:15:33.360 --> 00:15:35.730
and I forget all of the items.
299
00:15:35.730 --> 00:15:38.437
So every single question from the Commonwealth says,
300
00:15:38.437 --> 00:15:39.660
"Okay, here we have this image,
301
00:15:39.660 --> 00:15:41.910
and what does the metadata say about this?"
302
00:15:41.910 --> 00:15:45.450
And the Commonwealth could have rephrased the question as,
303
00:15:45.450 --> 00:15:47.700
you know, "What does the extraction report
304
00:15:47.700 --> 00:15:49.887
say this came from?"
305
00:15:50.970 --> 00:15:54.123
Do you think that would've been an impermissible question?
306
00:15:56.250 --> 00:15:58.751
If I understand you Justice, yes,
307
00:15:58.751 --> 00:16:02.133
and partly because of the way it started.
308
00:16:03.000 --> 00:16:05.760
It's not our strongest position,
309
00:16:05.760 --> 00:16:09.270
because I recognize that it's sort of at odds,
310
00:16:09.270 --> 00:16:11.640
if I understand the Court correctly,
311
00:16:11.640 --> 00:16:13.680
with the way the circuit courts are going.
312
00:16:13.680 --> 00:16:17.610
But again, I kinda go back to how this started,
313
00:16:17.610 --> 00:16:21.960
with respect to, this is all the testimony will be,
314
00:16:21.960 --> 00:16:22.860
it'll be a plug and play.
315
00:16:22.860 --> 00:16:25.410
And I think if you go to that focus on that point,
316
00:16:25.410 --> 00:16:28.410
it's really more of an explanation.
317
00:16:28.410 --> 00:16:31.200
It's like, "This is what you can understand
318
00:16:31.200 --> 00:16:32.430
about what was on the phone,
319
00:16:32.430 --> 00:16:34.860
by virtue of what I see here."
320
00:16:34.860 --> 00:16:39.860
It would be so much less valuable if we were just to allow,
321
00:16:40.470 --> 00:16:42.750
if it was just the report itself
322
00:16:42.750 --> 00:16:45.210
admitted through the detective,
323
00:16:45.210 --> 00:16:48.300
as the person who generated it himself.
324
00:16:48.300 --> 00:16:52.380
So if the, to follow up on Justice Dewar's question.
325
00:16:52.380 --> 00:16:56.640
So if the, I think it was exhibit nine or 10,
326
00:16:56.640 --> 00:17:01.640
were admitted, and it showed the thumbnails
327
00:17:02.040 --> 00:17:06.690
with the file data, basically the extraction report,
328
00:17:06.690 --> 00:17:11.690
and the officer were asked, "Is this the report
329
00:17:14.220 --> 00:17:16.357
that you generated using Cellebrite?"
330
00:17:16.357 --> 00:17:19.917
"Yes," "True and accurate copy?" "Yes."
331
00:17:21.337 --> 00:17:24.900
"What does it say about the first thumbnail
332
00:17:24.900 --> 00:17:26.827
or the first photograph?"
333
00:17:26.827 --> 00:17:31.350
"It says it shows it was stored in the screenshots folder
334
00:17:31.350 --> 00:17:36.090
on such and such a date, and it's the size of a file."
335
00:17:36.090 --> 00:17:38.493
In your view, that would be permissible.
336
00:17:42.180 --> 00:17:45.284
Yes, but not how it came through in this case.
337
00:17:45.284 --> 00:17:47.589
It wasn't how it was asked precisely
338
00:17:47.589 --> 00:17:50.640
in those ways, but the substance of that testimony
339
00:17:50.640 --> 00:17:53.940
would've come in, and it is essentially
340
00:17:53.940 --> 00:17:57.150
the substance of the officer's testimony,
341
00:17:57.150 --> 00:18:00.187
even though the questions were phrased differently here.
342
00:18:00.187 --> 00:18:02.659
Yes, Your Honor.
Okay, thanks.
343
00:18:02.659 --> 00:18:03.707
Okay.
Out of time.
344
00:18:03.707 --> 00:18:05.437
Thank you very much, Your Honor.
345
00:18:05.437 --> 00:18:07.623
Thank you, Attorney Langsam.
346
00:18:12.870 --> 00:18:14.400
Good morning, may it please the Court.
347
00:18:14.400 --> 00:18:16.920
Jessica Langham, Assistant District Attorney for Middlesex,
348
00:18:16.920 --> 00:18:19.920
appearing on behalf of the Commonwealth.
349
00:18:19.920 --> 00:18:22.620
If I could just pick up, with respect to the question
350
00:18:22.620 --> 00:18:25.683
that the Court just ended with,
351
00:18:29.670 --> 00:18:32.260
Detective Sergeant McLaughlin's testimony
352
00:18:33.660 --> 00:18:37.560
essentially adhered to the report, that there was,
353
00:18:37.560 --> 00:18:39.870
with respect to your question, Justice Wendlandt,
354
00:18:39.870 --> 00:18:43.980
there was some testimony that went outside of that,
355
00:18:43.980 --> 00:18:46.560
and that was arguably opinion
356
00:18:46.560 --> 00:18:48.600
about the claim about reliability.
357
00:18:48.600 --> 00:18:52.110
That was, when he says, "It doesn't alter the data,
358
00:18:52.110 --> 00:18:54.090
there's no risk that other data can transfer
359
00:18:54.090 --> 00:18:56.370
onto the phone when it's in airplane mode.
360
00:18:56.370 --> 00:18:58.350
That the photographs that were extracted were not altered."
361
00:18:58.350 --> 00:19:03.060
That was, let's see, transcript 163, 176, 178.
362
00:19:03.060 --> 00:19:05.520
But most of his testimony really was
363
00:19:05.520 --> 00:19:08.670
what the extraction report was, even if the questions
364
00:19:08.670 --> 00:19:10.067
could have been phrased a little bit differently.
365
00:19:10.067 --> 00:19:11.730
How is he qualified
366
00:19:11.730 --> 00:19:14.373
to say what the report was?
367
00:19:15.270 --> 00:19:17.490
In what sense, Your Honor?
368
00:19:17.490 --> 00:19:22.230
That it, you know, isn't the point of the report
369
00:19:22.230 --> 00:19:25.590
and his testimony to say that Cellebrite
370
00:19:25.590 --> 00:19:30.590
is actually extracting this thumbnail photo from the phone,
371
00:19:34.440 --> 00:19:38.610
and that the dates and places recorded there
372
00:19:38.610 --> 00:19:40.470
in the metadata are accurate?
373
00:19:40.470 --> 00:19:45.030
Isn't that implied in the report itself?
374
00:19:45.030 --> 00:19:47.580
Well Your Honor, he's testifying,
375
00:19:47.580 --> 00:19:49.950
as Justice Georges had mentioned previously,
376
00:19:49.950 --> 00:19:53.070
he's testifying based on his experience
377
00:19:53.070 --> 00:19:55.830
as a, quote unquote, certified Cellebrite operator
378
00:19:55.830 --> 00:19:58.170
and physical analyzer-
No, but when he goes
379
00:19:58.170 --> 00:20:03.170
and reads the report, what's the purpose of that?
380
00:20:05.280 --> 00:20:08.610
Well-
Show that Cellebrite
381
00:20:08.610 --> 00:20:10.350
is doing an accurate,
382
00:20:10.350 --> 00:20:13.350
reliable extraction from the cell phone.
383
00:20:13.350 --> 00:20:15.330
I'm not sure that's a fair implication.
384
00:20:15.330 --> 00:20:16.750
I know that's what my brother-
What is the implication?
385
00:20:16.750 --> 00:20:18.540
Well, I'm not sure there's any implication
386
00:20:18.540 --> 00:20:21.030
at all, Your Honor, he's simply relating the information
387
00:20:21.030 --> 00:20:23.820
that's in the report, which was properly admitted.
388
00:20:23.820 --> 00:20:27.600
To the extent that some of his testimony went beyond that,
389
00:20:27.600 --> 00:20:30.094
for example, as my brother just argued-
390
00:20:30.094 --> 00:20:32.250
Why do you say it was properly admitted?
391
00:20:32.250 --> 00:20:33.083
I beg your pardon, Your Honor?
392
00:20:33.083 --> 00:20:35.670
Why was it properly admitted?
393
00:20:35.670 --> 00:20:39.176
If we don't know if Cellebrite does what it says it does,
394
00:20:39.176 --> 00:20:40.296
you know, why was it properly admitted?
395
00:20:40.296 --> 00:20:41.550
Well actually, Your Honor, I would argue
396
00:20:41.550 --> 00:20:43.710
that there's evidence in the record that we do know that,
397
00:20:43.710 --> 00:20:46.200
and that would be because the defendant,
398
00:20:46.200 --> 00:20:48.997
when he's up in the market basket manager's office, he said,
399
00:20:48.997 --> 00:20:52.410
"Gee you know, there's some things that I looked at."
400
00:20:52.410 --> 00:20:56.190
There was, I think he said it was maybe a Gramps SC,
401
00:20:56.190 --> 00:20:58.230
it was a photograph of a juvenile male
402
00:20:58.230 --> 00:20:59.370
with his genitals showing.
403
00:20:59.370 --> 00:21:04.370
I think that's at page 109 of the transcript, and,
404
00:21:05.280 --> 00:21:07.800
or excuse me, I think that's the officer's testimony.
405
00:21:07.800 --> 00:21:12.480
So, and then what the images are,
406
00:21:12.480 --> 00:21:14.040
and I know that this court has
407
00:21:14.040 --> 00:21:17.250
that impounded exhibit number 10, which is the, the images.
408
00:21:17.250 --> 00:21:21.480
The images that are there in exhibit number 10 are the same
409
00:21:21.480 --> 00:21:24.480
images that Lieutenant Columbus saw,
410
00:21:24.480 --> 00:21:25.950
that Lieutenant Connor saw,
411
00:21:25.950 --> 00:21:28.383
and that Sergeant Peterson saw on the defendant's phone-
412
00:21:28.383 --> 00:21:29.216
And that's in the-
In the market basket.
413
00:21:29.216 --> 00:21:31.080
And that's in the transcript?
414
00:21:31.080 --> 00:21:32.490
That you know, "Oh, this image
415
00:21:32.490 --> 00:21:34.770
from this report is the same one."
416
00:21:34.770 --> 00:21:36.210
Well, no Your Honor, because the report
417
00:21:36.210 --> 00:21:37.200
hadn't been generated yet.
418
00:21:37.200 --> 00:21:39.236
So in other words, what I'm saying is that-
419
00:21:39.236 --> 00:21:42.480
The descriptions matched
Shores up, exactly.
420
00:21:42.480 --> 00:21:44.610
That shores up the reliability,
421
00:21:44.610 --> 00:21:47.670
and that testimony was a Lieutenant Columbus.
422
00:21:47.670 --> 00:21:49.410
That was at 68 and 69.
423
00:21:49.410 --> 00:21:52.080
Lieutenant Connor, that was transcript 82, 83.
424
00:21:52.080 --> 00:21:54.750
And Sergeant Peterson, that was transcript page 102.
425
00:21:54.750 --> 00:21:57.900
And their descriptions of these images is the same image
426
00:21:57.900 --> 00:21:59.610
that's contained in exhibit number 10.
427
00:21:59.610 --> 00:22:00.720
Well, it's not all of the images,
428
00:22:00.720 --> 00:22:01.553
if I recall correctly.
429
00:22:01.553 --> 00:22:02.582
Correct Your Honor, it is not.
430
00:22:02.582 --> 00:22:04.328
There were only two images-
There were only two
431
00:22:04.328 --> 00:22:05.617
that they testified to.
432
00:22:05.617 --> 00:22:06.686
When, I'm sorry Your Honor, I interrupted.
433
00:22:06.686 --> 00:22:08.145
There were only two that they testified to.
434
00:22:08.145 --> 00:22:09.620
There were only two that they-
435
00:22:09.620 --> 00:22:11.706
And I think there were-
They were altogether-
436
00:22:11.706 --> 00:22:12.720
Over 10, 19?
There were 19-
437
00:22:12.720 --> 00:22:15.990
What was the number?
There were 15,
438
00:22:15.990 --> 00:22:18.960
one of the images was part of a chat with three,
439
00:22:18.960 --> 00:22:21.060
and another one was a part of, I believe,
440
00:22:21.060 --> 00:22:23.100
a chat with two images, so there-
441
00:22:23.100 --> 00:22:27.480
So there's no, so you can't really use
442
00:22:27.480 --> 00:22:30.510
what the officer used, what the officer saw,
443
00:22:30.510 --> 00:22:33.690
to help authenticate or buttress the reliability
444
00:22:33.690 --> 00:22:36.180
of the ones that they didn't see.
445
00:22:36.180 --> 00:22:37.590
Well that's true, Your Honor.
446
00:22:37.590 --> 00:22:41.310
But I think if we're talking about reliability,
447
00:22:41.310 --> 00:22:42.630
I'm just pointing out to the Court
448
00:22:42.630 --> 00:22:46.860
that the officers saw images that they used a certain word
449
00:22:46.860 --> 00:22:49.230
to describe the images, and it's plain
450
00:22:49.230 --> 00:22:51.540
that that's the image that was subsequently found
451
00:22:51.540 --> 00:22:53.520
in the Cellebrite extraction, and that was admitted
452
00:22:53.520 --> 00:22:54.960
into evidence as exhibit number 10.
453
00:22:54.960 --> 00:22:58.290
So, let's try and explore lay versus expert.
454
00:22:58.290 --> 00:23:03.270
I think you all but, or probably conceded that the testimony
455
00:23:03.270 --> 00:23:06.300
that the Cellebrite doesn't alter images,
456
00:23:06.300 --> 00:23:09.153
is impermissible by a lay witness, correct?
457
00:23:10.170 --> 00:23:11.880
Yes Your Honor, I mean that would be-
458
00:23:11.880 --> 00:23:13.650
We'll take your concession.
Thank you, Your Honor.
459
00:23:13.650 --> 00:23:18.030
All right, is this similar to a testimony
460
00:23:18.030 --> 00:23:22.170
of a breathalyzer operator who testifies that,
461
00:23:22.170 --> 00:23:24.967
not asked how the machine works, but a police officer says,
462
00:23:24.967 --> 00:23:26.910
"The person blew into the machine,
463
00:23:26.910 --> 00:23:29.553
I looked at it and here's the report, it's a .18."
464
00:23:29.553 --> 00:23:32.400
Well yes Your Honor, arguably it is,
465
00:23:32.400 --> 00:23:36.000
except Cellebrite doesn't even do a test
466
00:23:36.000 --> 00:23:37.500
as a breathalyzer does.
467
00:23:37.500 --> 00:23:41.280
Cellebrite simply takes data that's in the phone,
468
00:23:41.280 --> 00:23:43.860
and moves it to a piece of paper and organizes it,
469
00:23:43.860 --> 00:23:45.300
so it can be read by a lay person.
470
00:23:45.300 --> 00:23:47.700
But in fairness, the defendant basically,
471
00:23:47.700 --> 00:23:51.660
if you have a witness like this who's not an expert,
472
00:23:51.660 --> 00:23:54.000
the defendant could cross-examine the person,
473
00:23:54.000 --> 00:23:55.770
and probably say, "You have no idea
474
00:23:55.770 --> 00:23:58.470
whether or not this is corruptible, et cetera."
475
00:23:58.470 --> 00:24:00.720
Well, in fact, the prosecutor asked him those questions,
476
00:24:00.720 --> 00:24:01.957
Your Honor, and said,
477
00:24:01.957 --> 00:24:05.880
"Do you know how it transfers code keys?" "No, I don't."
478
00:24:05.880 --> 00:24:09.690
And that's something that Justice Bailey plainly recognized
479
00:24:09.690 --> 00:24:11.250
in ruling that the officer could testify,
480
00:24:11.250 --> 00:24:13.350
that the officer plugs in the phone,
481
00:24:13.350 --> 00:24:16.650
can read what it spits out, is not a cell phone expert,
482
00:24:16.650 --> 00:24:20.340
and doesn't understand the technology or how it works.
483
00:24:20.340 --> 00:24:22.350
Can I ask, sorry, are you done, Justice?
484
00:24:22.350 --> 00:24:23.183
I am done.
485
00:24:23.183 --> 00:24:26.040
So I was focused on the best cases,
486
00:24:26.040 --> 00:24:27.930
'cause the Feds have issued a couple
487
00:24:27.930 --> 00:24:31.803
of pretty extensive discussions of this technology.
488
00:24:34.890 --> 00:24:37.230
I'm wondering which, are those cases
489
00:24:37.230 --> 00:24:39.963
we should use as a model, which ones?
490
00:24:41.250 --> 00:24:42.150
'Cause the, yeah-
I'm sorry,
491
00:24:42.150 --> 00:24:43.710
are they federal cases?
492
00:24:43.710 --> 00:24:45.630
Yeah, there are at least two that I read
493
00:24:45.630 --> 00:24:47.103
that are very detailed.
494
00:24:48.090 --> 00:24:49.440
Unfortunately, I just got the excerpts.
495
00:24:49.440 --> 00:24:51.690
I don't have the name of the cases in front of me, but-
496
00:24:51.690 --> 00:24:53.790
Well Your Honor-
There's a First Circuit case
497
00:24:53.790 --> 00:24:57.330
and then there's another one.
498
00:24:57.330 --> 00:24:59.730
There was the Fifth Circuit case of US versus Williams,
499
00:24:59.730 --> 00:25:02.430
which is 83-F fourth at page 997.
500
00:25:02.430 --> 00:25:06.390
Did we adopt their, I mean it sounds like this is a case
501
00:25:06.390 --> 00:25:08.880
in which there's a lot of evidence,
502
00:25:08.880 --> 00:25:10.260
there may be some mistakes here,
503
00:25:10.260 --> 00:25:11.910
but the legal standard's gonna be
504
00:25:11.910 --> 00:25:13.830
the most important thing we develop here.
505
00:25:13.830 --> 00:25:16.770
I'm just wondering which one of those cases
506
00:25:16.770 --> 00:25:19.410
you think we should turn to for guidance,
507
00:25:19.410 --> 00:25:21.607
and if so, should we modify it in any way?
508
00:25:21.607 --> 00:25:23.940
And can I just add a further addition onto that?
509
00:25:23.940 --> 00:25:26.040
Can you address the concept of the, quote unquote,
510
00:25:26.040 --> 00:25:28.050
tech-savvy layperson, that I believe
511
00:25:28.050 --> 00:25:30.210
the Fifth Circuit inserted as a concept?
512
00:25:30.210 --> 00:25:31.890
Yes, Your Honor.
513
00:25:31.890 --> 00:25:34.800
So I think that the tech-savvy layperson
514
00:25:34.800 --> 00:25:38.100
comes from US versus, I believe it comes
515
00:25:38.100 --> 00:25:40.023
from US versus Williams,
516
00:25:41.130 --> 00:25:43.680
and that was the Fifth Circuit case.
517
00:25:43.680 --> 00:25:46.380
And I would suggest to the Court
518
00:25:46.380 --> 00:25:48.570
in response to your question, Justice Kafker,
519
00:25:48.570 --> 00:25:51.540
that that's the same issue that happens here.
520
00:25:51.540 --> 00:25:53.010
That the defendant in that case claimed
521
00:25:53.010 --> 00:25:57.090
that Cellebrite was complex, therefore that operation
522
00:25:57.090 --> 00:25:59.340
of Cellebrite requires specialized knowledge,
523
00:25:59.340 --> 00:26:01.470
and that introduction of a Cellebrite report
524
00:26:01.470 --> 00:26:03.270
demands qualification as an expert.
525
00:26:03.270 --> 00:26:04.447
And then the Court says quote,
526
00:26:04.447 --> 00:26:07.050
"But this ignores the basic realities of life."
527
00:26:07.050 --> 00:26:10.320
So as the bench elicited earlier
528
00:26:10.320 --> 00:26:14.460
during my brother's argument, there are many concepts.
529
00:26:14.460 --> 00:26:17.061
We sign up for apps on our phones, we-
530
00:26:17.061 --> 00:26:20.550
I think we have a feel for where this went beyond,
531
00:26:20.550 --> 00:26:22.454
and where it's within.
Yes, Your Honor.
532
00:26:22.454 --> 00:26:23.790
But I'm just, what is there,
533
00:26:23.790 --> 00:26:28.170
do we adopt this tech-savvy, you know standard,
534
00:26:28.170 --> 00:26:29.790
or do we, what do you think?
535
00:26:29.790 --> 00:26:34.290
Is there, help us on which case sets the proper standard,
536
00:26:34.290 --> 00:26:37.410
'cause we're gonna need to provide better guidance out there
537
00:26:37.410 --> 00:26:39.330
on how to use this technology.
538
00:26:39.330 --> 00:26:40.320
Yes, Your Honor.
539
00:26:40.320 --> 00:26:43.260
Well, I would suggest that US versus Williams
540
00:26:43.260 --> 00:26:47.580
does provide guidance, and indicates after a review
541
00:26:47.580 --> 00:26:50.440
of all of the circuits that evidence
542
00:26:52.230 --> 00:26:54.120
obtained with Cellebrite,
543
00:26:54.120 --> 00:26:56.610
it does not require expert testimony.
544
00:26:56.610 --> 00:26:58.050
And Your honor, Justice Dewar,
545
00:26:58.050 --> 00:27:00.630
when I referred to the tech-savvy witness,
546
00:27:00.630 --> 00:27:05.630
it's a lay witness who is apprised of computer matters,
547
00:27:06.840 --> 00:27:09.543
as many people today are, and-
548
00:27:09.543 --> 00:27:12.390
Well Counsel, that's what bothers me about Williams.
549
00:27:12.390 --> 00:27:16.410
I'm still stuck at the difference between lay and expert,
550
00:27:16.410 --> 00:27:18.750
because we have all of these cases
551
00:27:18.750 --> 00:27:21.180
that are kind of hybrids of that,
552
00:27:21.180 --> 00:27:25.140
where there are lay witnesses that have more
553
00:27:25.140 --> 00:27:28.811
information and experience than most lay people,
554
00:27:28.811 --> 00:27:31.830
but not as much as experts.
555
00:27:31.830 --> 00:27:34.020
We've got cases out there that talked about people
556
00:27:34.020 --> 00:27:35.850
that have used drugs for a long time,
557
00:27:35.850 --> 00:27:38.340
so that they're able, under lay opinion testimony,
558
00:27:38.340 --> 00:27:41.970
to testify that this was cocaine without having to,
559
00:27:41.970 --> 00:27:46.890
but the Williams case doesn't help this case or me,
560
00:27:46.890 --> 00:27:49.830
in that what's the foundation in order
561
00:27:49.830 --> 00:27:53.280
for this to be a tech-savvy person?
562
00:27:53.280 --> 00:27:57.210
What, because here all he testifies to is,
563
00:27:57.210 --> 00:28:02.210
he does these two-week Cellebrite training,
564
00:28:02.430 --> 00:28:05.130
and nothing in Williams helps inform
565
00:28:05.130 --> 00:28:08.130
what should trial judges look to,
566
00:28:08.130 --> 00:28:10.590
to say that these are the tech-savvy folks
567
00:28:10.590 --> 00:28:13.890
that are still lay witnesses, they're not experts,
568
00:28:13.890 --> 00:28:16.560
but what are the metrics to inform
569
00:28:16.560 --> 00:28:19.290
what makes you tech-savvy, if all you do
570
00:28:19.290 --> 00:28:23.190
is just go to the Cellebrite two-week trainings?
571
00:28:23.190 --> 00:28:26.520
Well Your Honor, I would also direct the Court's attention
572
00:28:26.520 --> 00:28:28.710
then to Montito Maisonette,
573
00:28:28.710 --> 00:28:32.643
which is also cited in my brief at 974 F third 34.
574
00:28:33.750 --> 00:28:37.566
But I think that, had this case been tried before a jury,
575
00:28:37.566 --> 00:28:41.010
perhaps a voir dire, or voir dire should have been held,
576
00:28:41.010 --> 00:28:43.530
and then the Court could have better understood
577
00:28:43.530 --> 00:28:47.430
the contours of Detective Sergeant McLaughlin's testimony.
578
00:28:47.430 --> 00:28:51.450
What was the Commonwealth planning to elicit from him?
579
00:28:51.450 --> 00:28:53.730
How much information did he have that could-
580
00:28:53.730 --> 00:28:55.200
You're hitting the nail right on the head
581
00:28:55.200 --> 00:28:58.560
as to what my problem is, this wasn't done.
582
00:28:58.560 --> 00:29:03.210
So, how can we really assess whether this
583
00:29:03.210 --> 00:29:07.560
was proper lay opinion testimony when we didn't know,
584
00:29:07.560 --> 00:29:11.613
what is it that you would base his tech savviness on?
585
00:29:12.630 --> 00:29:15.270
Well, and I would suggest to Your Honor
586
00:29:15.270 --> 00:29:20.130
that Justice Bailey, in hearing the testimony
587
00:29:20.130 --> 00:29:22.200
of Detective Sergeant McLaughlin as it came out,
588
00:29:22.200 --> 00:29:26.070
had a better understanding of what the parameters were.
589
00:29:26.070 --> 00:29:30.120
Defense counsel continued to object to admission
590
00:29:30.120 --> 00:29:33.630
of certain exhibits, not all of them, based on the fact
591
00:29:33.630 --> 00:29:35.910
that there was, quote unquote, metadata.
592
00:29:35.910 --> 00:29:38.040
And that this metadata, which was part
593
00:29:38.040 --> 00:29:39.270
of the extraction report,
594
00:29:39.270 --> 00:29:42.090
should have been coming in through an expert witness.
595
00:29:42.090 --> 00:29:47.090
But unlike in the federal cases where,
596
00:29:48.000 --> 00:29:53.000
in Wehrle, for example, that's the W-E-H-R-L-E, 985-F 3549,
597
00:29:53.790 --> 00:29:56.580
that's the 2021 case, I believe.
598
00:29:56.580 --> 00:29:58.320
That's the first circuit case, Your Honor,
599
00:29:58.320 --> 00:30:00.273
that's also cited in my brief.
600
00:30:02.160 --> 00:30:04.410
In that case, of say for example,
601
00:30:04.410 --> 00:30:06.510
if voir dire had been done in that case,
602
00:30:06.510 --> 00:30:08.430
the voir dire would have, that's a case
603
00:30:08.430 --> 00:30:13.260
where the expert explained how these concepts fit together
604
00:30:13.260 --> 00:30:15.480
and why the program was reliable.
605
00:30:15.480 --> 00:30:17.460
So here, while Detective Sergeant McLaughlin
606
00:30:17.460 --> 00:30:19.117
kind of put a toe in the water with respect to,
607
00:30:19.117 --> 00:30:21.900
"Well, the images aren't altered and this is reliable,"
608
00:30:21.900 --> 00:30:26.730
that is opinion testimony, it was just this small part,
609
00:30:26.730 --> 00:30:28.560
but he didn't explain further.
610
00:30:28.560 --> 00:30:30.945
He didn't purport to hold himself out to arcane-
611
00:30:30.945 --> 00:30:34.380
He does explain, so I see a distinction
612
00:30:34.380 --> 00:30:39.380
between simply reciting whatever the Cellebrite report says
613
00:30:41.550 --> 00:30:45.300
and what it means, I see a distinction there.
614
00:30:45.300 --> 00:30:48.870
So if the exhibit says,
615
00:30:48.870 --> 00:30:53.807
gives a file path name that includes the word screenshot,
616
00:30:56.730 --> 00:30:57.600
that's one thing.
617
00:30:57.600 --> 00:31:00.510
He may very well be able to simply testify
618
00:31:00.510 --> 00:31:02.340
to what the report says.
619
00:31:02.340 --> 00:31:07.340
But when he testifies that it means that all screenshots
620
00:31:08.430 --> 00:31:11.760
are stored in the screenshot folder,
621
00:31:11.760 --> 00:31:13.860
that seems to me something else.
622
00:31:13.860 --> 00:31:18.180
Because what he's testifying is that the defendant
623
00:31:18.180 --> 00:31:20.340
took a screenshot, and as a result
624
00:31:20.340 --> 00:31:22.200
it was stored in the screenshot folder,
625
00:31:22.200 --> 00:31:25.440
which goes to the whole notion of,
626
00:31:25.440 --> 00:31:28.053
was this accidentally stored on his phone?
627
00:31:29.190 --> 00:31:31.620
And that piece of it troubles me,
628
00:31:31.620 --> 00:31:34.920
because I'm not sure how he's qualified
629
00:31:34.920 --> 00:31:38.490
to testify to what the printout means,
630
00:31:38.490 --> 00:31:41.343
as opposed to what the printout says.
631
00:31:42.660 --> 00:31:44.910
I understand the point that Your Honor is making,
632
00:31:44.910 --> 00:31:49.230
and I have in front of me Exhibit six,
633
00:31:49.230 --> 00:31:51.900
which is plainly not an, excuse me, my apologies,
634
00:31:51.900 --> 00:31:53.730
exhibit eight, which is not an impounded exhibit.
635
00:31:53.730 --> 00:31:55.920
It was one of the photographs of the defendant,
636
00:31:55.920 --> 00:32:00.870
and when Detective Sergeant McLaughlin was testifying,
637
00:32:00.870 --> 00:32:02.130
he explained the file path.
638
00:32:02.130 --> 00:32:04.530
So for example, the file path for this exhibit,
639
00:32:04.530 --> 00:32:09.530
it says, "Filepath:phone/WhatsApp/media/WhatsAppimages."
640
00:32:11.580 --> 00:32:16.470
So a, any person who has some level of tech savvy
641
00:32:16.470 --> 00:32:20.100
would understand that this image is stored there
642
00:32:20.100 --> 00:32:22.920
on the phone within WhatsApp in this media,
643
00:32:22.920 --> 00:32:24.390
in WhatsApp images.
644
00:32:24.390 --> 00:32:26.880
So to the extent that Detective Sergeant McLaughlin
645
00:32:26.880 --> 00:32:30.480
was explaining that, it could be that,
646
00:32:30.480 --> 00:32:34.350
it's unclear what Justice Bailey's level of understanding
647
00:32:34.350 --> 00:32:39.350
of what the, I guess the metadata or what the background
648
00:32:42.390 --> 00:32:45.390
of surrounding information of the thumbnail
649
00:32:45.390 --> 00:32:46.648
or of the images was.
650
00:32:46.648 --> 00:32:48.510
But he also says, "Will the metadata indicate to you,
651
00:32:48.510 --> 00:32:50.610
whether it's downloaded, screenshotted,
652
00:32:50.610 --> 00:32:52.417
taken on the camera?"
653
00:32:52.417 --> 00:32:55.350
"It'll show where the file was saved to, yes."
654
00:32:55.350 --> 00:32:58.950
Yes, and I think, Your Honor, the question could have,
655
00:32:58.950 --> 00:33:01.200
getting back to before, the question could have been
656
00:33:01.200 --> 00:33:02.750
better phrased, in other words,
657
00:33:03.877 --> 00:33:06.300
"The metadata here, what does it say?"
658
00:33:06.300 --> 00:33:08.940
And then it says exactly what I just read to the Court.
659
00:33:08.940 --> 00:33:13.940
And when something is in WhatsApp images,
660
00:33:14.259 --> 00:33:17.820
where would that be found on the phone?
661
00:33:17.820 --> 00:33:19.412
That would be found
662
00:33:19.412 --> 00:33:21.480
in the WhatsApp application on the phone.
663
00:33:21.480 --> 00:33:24.150
So it's not so much, what does it mean?
664
00:33:24.150 --> 00:33:25.830
It's, where is it located?
665
00:33:25.830 --> 00:33:27.390
And I think had the prosecutor
666
00:33:27.390 --> 00:33:28.440
used slightly different language-
667
00:33:28.440 --> 00:33:30.990
Well, it's what does this file path mean?
668
00:33:30.990 --> 00:33:31.823
Yeah, well I'm not sure-
669
00:33:31.823 --> 00:33:33.450
And that's exactly what it is.
670
00:33:33.450 --> 00:33:37.140
It's, what does this file path on this report now mean,
671
00:33:37.140 --> 00:33:39.300
in terms of what's on the defendant's phone?
672
00:33:39.300 --> 00:33:42.240
Well, it's sort of like looking at a map, you know?
673
00:33:42.240 --> 00:33:45.150
So what does it mean? The directions say go left.
674
00:33:45.150 --> 00:33:47.820
I mean it that's all, it doesn't mean anything.
675
00:33:47.820 --> 00:33:52.230
It just is what it is, just as the data is what it is.
676
00:33:52.230 --> 00:33:55.830
Just as when Lieutenant Columbus was,
677
00:33:55.830 --> 00:33:57.097
the defendant was urging her, you know,
678
00:33:57.097 --> 00:33:59.940
"Here, look at my phone. Sure, you can look everywhere."
679
00:33:59.940 --> 00:34:01.770
And that's when she opens the screenshot folders
680
00:34:01.770 --> 00:34:04.560
and she immediately, these two images jump out
681
00:34:04.560 --> 00:34:08.520
that are plainly C-SAM, and-
682
00:34:08.520 --> 00:34:13.520
On page 175 of the transcript, the question is,
683
00:34:14.017 --> 00:34:16.950
"And are you able to tell whether it was downloaded
684
00:34:16.950 --> 00:34:20.047
from another source or taken on that device?"
685
00:34:20.047 --> 00:34:22.590
"Answer, 'So if something is downloaded,
686
00:34:22.590 --> 00:34:24.900
generally it saves to a downloaded file.
687
00:34:24.900 --> 00:34:26.580
If it is a picture that's taken,
688
00:34:26.580 --> 00:34:28.260
it's saved in a camera roll.
689
00:34:28.260 --> 00:34:31.707
If it's a screenshot, it's saved in a screenshot file.'
690
00:34:32.850 --> 00:34:34.530
'And will the metadata indicate to you
691
00:34:34.530 --> 00:34:36.437
whether it's downloaded, screenshot taken on the camera?'
692
00:34:36.437 --> 00:34:39.330
'It'll show where the file was saved to, yes.'"
693
00:34:39.330 --> 00:34:43.470
How is that not testimony beyond simply,
694
00:34:45.637 --> 00:34:47.790
"I use Cellebrite, this is what it did,
695
00:34:47.790 --> 00:34:52.710
it gave me this report, it shows this."
696
00:34:52.710 --> 00:34:57.060
How is this not veering into expert testimony?
697
00:34:57.060 --> 00:34:59.040
Well, and that's a a key point
698
00:34:59.040 --> 00:35:01.500
that Your Honor just made, sort of leading into,
699
00:35:01.500 --> 00:35:06.500
because it's a person who is well-versed in the,
700
00:35:06.540 --> 00:35:09.650
this individual was a, quote unquote, certified operator.
701
00:35:09.650 --> 00:35:11.670
He is trained on using this.
702
00:35:11.670 --> 00:35:14.040
He understands what these things mean.
703
00:35:14.040 --> 00:35:18.480
In fact, he testified that he had used Cellebrite 46 times.
704
00:35:18.480 --> 00:35:23.037
So he's done this before, and the point-
705
00:35:25.200 --> 00:35:28.860
It's sounding like he's an expert.
706
00:35:28.860 --> 00:35:31.530
Well, and Your Honor, we know that just because
707
00:35:31.530 --> 00:35:33.060
the police call him the expert,
708
00:35:33.060 --> 00:35:34.710
or he's a certified operator, doesn't-
709
00:35:34.710 --> 00:35:37.290
And he's done it a lot, 46 times,
710
00:35:37.290 --> 00:35:39.240
and he knows what this stuff means.
711
00:35:39.240 --> 00:35:43.080
Right, as Your Honor, as I knew what it means,
712
00:35:43.080 --> 00:35:47.993
as anyone, in fact, if I could direct Your Honors to,
713
00:35:49.800 --> 00:35:53.260
in looking at these, quote unquote, expert terms
714
00:35:54.527 --> 00:35:58.203
that my brother has raised,
715
00:35:59.100 --> 00:36:02.725
these terms are actually defined in the case law, and-
716
00:36:02.725 --> 00:36:04.380
Counsel, can I ask you a different question,
717
00:36:04.380 --> 00:36:06.660
going back to Justice Wolohojian's question?
718
00:36:06.660 --> 00:36:08.010
Yes.
719
00:36:08.010 --> 00:36:09.780
This is a practical question.
720
00:36:09.780 --> 00:36:11.370
I understand that they used Cellebrite
721
00:36:11.370 --> 00:36:15.450
to download the entire phone, and put the data on the phone
722
00:36:15.450 --> 00:36:18.420
into a means that's more easy to review,
723
00:36:18.420 --> 00:36:20.400
in a spreadsheet, essentially.
724
00:36:20.400 --> 00:36:22.110
Can they also at the same time
725
00:36:22.110 --> 00:36:23.850
just go through the phone manually,
726
00:36:23.850 --> 00:36:24.960
looking at different folders?
727
00:36:24.960 --> 00:36:28.020
Because I would imagine that an officer
728
00:36:28.020 --> 00:36:32.070
would have an ability to gain some experience
729
00:36:32.070 --> 00:36:36.480
that the file path name in the extraction report
730
00:36:36.480 --> 00:36:38.580
aligns with that officer's experience
731
00:36:38.580 --> 00:36:40.230
in actually physically going through phones.
732
00:36:40.230 --> 00:36:42.000
So even if the officer wasn't really
733
00:36:42.000 --> 00:36:43.140
any kind of computer expert,
734
00:36:43.140 --> 00:36:45.360
they would know that, "I've typically seen,"
735
00:36:45.360 --> 00:36:46.800
and I realize this, you did not,
736
00:36:46.800 --> 00:36:48.870
the Commonwealth did not introduce his testimony,
737
00:36:48.870 --> 00:36:51.900
but that the 46 times of using a software,
738
00:36:51.900 --> 00:36:55.590
a person could as a layperson have experience with that?
739
00:36:55.590 --> 00:36:58.080
Yes Your Honor, and in fact, that's the part of the point,
740
00:36:58.080 --> 00:36:59.400
although Detective Sergeant McLaughlin
741
00:36:59.400 --> 00:37:01.770
didn't do that in this case, he didn't kind of go back,
742
00:37:01.770 --> 00:37:04.590
and he said he physically manipulated the phone,
743
00:37:04.590 --> 00:37:06.450
but really he ran the phone through the,
744
00:37:06.450 --> 00:37:07.980
so he never testified to what he found,
745
00:37:07.980 --> 00:37:10.170
or whether or not what he found correlated
746
00:37:10.170 --> 00:37:12.330
to what was produced in the extraction report.
747
00:37:12.330 --> 00:37:15.780
But yes, and that's exactly, this is, an officer could,
748
00:37:15.780 --> 00:37:19.170
and regularly do scroll through, take photos of texts,
749
00:37:19.170 --> 00:37:21.180
and then that's what was found on the phone.
750
00:37:21.180 --> 00:37:24.260
Say for example, if the phone couldn't be downloaded.
751
00:37:24.260 --> 00:37:29.260
And I think in, I'm just trying to find the case
752
00:37:30.570 --> 00:37:35.570
where the Cellebrite download wasn't reliable,
753
00:37:41.280 --> 00:37:43.280
and I think defense counsel had used it.
754
00:37:44.550 --> 00:37:46.860
Yes Your Honor, the officer could have
755
00:37:46.860 --> 00:37:50.460
just taken photos of what he saw.
756
00:37:50.460 --> 00:37:53.340
And going back to the point I made earlier,
757
00:37:53.340 --> 00:37:55.290
that's what Cellebrite does.
758
00:37:55.290 --> 00:37:57.090
It just takes it from the phone
759
00:37:57.090 --> 00:38:00.330
and it puts it onto a piece of paper so that we can read it.
760
00:38:00.330 --> 00:38:03.090
And if I could briefly go back to my point,
761
00:38:03.090 --> 00:38:05.850
looking through the opinions of this court,
762
00:38:05.850 --> 00:38:08.820
for example, cache is mentioned in the Arrington case,
763
00:38:08.820 --> 00:38:11.040
which is a case from this year,
764
00:38:11.040 --> 00:38:13.710
that it's a temporary storage, and hash value
765
00:38:13.710 --> 00:38:16.200
is defined and done, a case from this year.
766
00:38:16.200 --> 00:38:20.360
Dorelas talks about what SMS and MMS means.
767
00:38:20.360 --> 00:38:24.960
So these are somewhat technical concepts,
768
00:38:24.960 --> 00:38:27.660
but they are understood by the public as a whole,
769
00:38:27.660 --> 00:38:30.310
broadly understood and even referenced by this court.
770
00:38:34.710 --> 00:38:38.580
And if I could also, with respect to the extent
771
00:38:38.580 --> 00:38:41.830
to which Detective Sergeant McLaughlin's testimony
772
00:38:43.440 --> 00:38:46.140
either constituted opinion testimony,
773
00:38:46.140 --> 00:38:49.740
as in sort of claiming about the reliability of Cellebrite,
774
00:38:49.740 --> 00:38:52.230
or otherwise somehow exceeded
775
00:38:52.230 --> 00:38:56.670
the bounds of his lay testimony,
776
00:38:56.670 --> 00:39:00.420
I would argue that that error was not prejudicial.
777
00:39:00.420 --> 00:39:02.850
It didn't influence the judge, again,
778
00:39:02.850 --> 00:39:05.130
because this case was tried before Justice Bailey.
779
00:39:05.130 --> 00:39:07.650
And given that the images that Your Honors
780
00:39:07.650 --> 00:39:09.900
have before you in exhibit number 10,
781
00:39:09.900 --> 00:39:11.370
along with the testimony
782
00:39:11.370 --> 00:39:13.650
of the investigating police officers,
783
00:39:13.650 --> 00:39:16.031
the evidence in this case was overwhelming.
784
00:39:16.031 --> 00:39:19.170
So if there are no further questions,
785
00:39:19.170 --> 00:39:20.910
I would ask that you affirm the conviction,
786
00:39:20.910 --> 00:39:22.360
and I would rest on my brief.