Plea Negotiation When the Evidence Is Digital.

Digital proof can strengthen or collapse plea leverage. If prosecutors have executed valid search warrants, conducted thorough forensics, and have a solid authentication theory, then the defendant’s plea offer and prospects will likely lean toward acceptance. If the defense is able to uncover preservation problems, metadata inconsistencies, chain-of-custody gaps, or authentication flaws, then digital proof can weaken the government’s case, and plea offers can lean toward strengthening the defendant’s position.

At Spodek Law Group, we have found that early defense testing of the government’s digital evidence is an incredibly important step. By testing the government’s evidence at the negotiation stage, our lawyers are able to uncover digital evidence weaknesses before prosecutors’ expectations harden in response to a sentencing or trial risk assessment.

When considering the risks associated with taking a case to trial, the government’s plea offer will be based on a calculation of the risks associated with getting its evidence admitted at trial. This means that prosecutors must assess the probability that the government will be able to satisfy all of the authentication requirements under the Federal Rules of Evidence. At Spodek Law Group, we take a critical look at the government’s evidence in order to force the government to reconsider the risks of taking the case to trial and to get prosecutors to offer more favorable plea terms for our clients.

However, it is not uncommon for plea negotiations to have little to no effect on a client’s sentencing exposure. This is because mandatory minimum statutes can severely limit the practical value of plea concessions. This means that in some situations prosecutors hold all the cards, and they can use the threat of going to trial to coerce defendants into accepting plea deals that do not reflect the strengths or weaknesses of the government’s case. The only exceptions to these sentencing rules are:

• 18 U.S.C. § 3553(f) (the federal “drug safety valve”)
• 18 U.S.C. § 3553(e) (requires a government motion in order to impose a sentence below a mandatory minimum sentence due to “substantial assistance”)
• U.S.S.G. § 5K1.1 (permits a guideline departure for “substantial assistance”)

How Can My Lawyer Test Whether the Digital Evidence Is Reliable?

There are many ways defense lawyers can test the reliability of digital evidence in federal cases. These tests fall into four categories: (i) data integrity, (ii) data authenticity, (iii) data accuracy, and (iv) data relevance.

Data integrity testing confirms that the government has a reliable, complete, and unadulterated copy of the data that was on the device at the time of seizure. A key component of this testing is ensuring that the digital evidence was extracted through a forensic image. A forensic image is a bit-for-bit copy of the target device’s data. Because the image is a separate file, it permits analysis without altering the original data. Additionally, defense lawyers must also request the “native” files that were extracted from the device. Native files are important because they contain metadata that is absent in screenshots, PDFs, printouts, or other file conversions. For example, an SMS message’s native file can reveal the exact time it was sent and the source IP address, but a screenshot of an SMS message can only show the date and time as displayed on the device.

Testing for data authenticity ensures that the data found on the device actually belongs to the defendant. Validating the forensic image is a key step in this testing. When an investigator acquires a forensic image, the software that is used to create the image calculates a mathematical value called a hash. If the image is later verified by the same software, the software calculates the image’s hash again. If the hashes are the same, then the images are identical and the data has not been modified.

Extraction reports can also provide insight into the authenticity of the digital evidence. When the government extracts data from a device, the software that was used should generate an extraction report identifying the software, its version, the extraction method used, and the device and operating system that were tested. If the extraction report is incomplete, then the government’s data may not be authentic. Additionally, gaps in the chain of custody can also impact the weight of the government’s evidence.

The last two steps for testing the reliability of digital evidence are verifying its accuracy and assessing its relevance. Digital evidence should be analyzed for accuracy as well. This involves both testing the reliability of the extraction software and testing the accuracy of any automated forensic classifications.

The reliability of extraction software varies by device model and operating-system version. In addition to testing the extraction software, the defense must also test the accuracy of any automated forensic classifications. Many forensic tools use automated classifications to identify file types, app metadata, or themes. While these tools are useful, they can and do produce errors. All automated forensic classifications should be validated against the evidence itself.

Finally, even if digital evidence is integral, authentic, accurate, and reliable, the government must still prove that it is relevant. Under Federal Evidence Rule 401, “evidence is relevant if it has any tendency to make a fact more or less probable than it would be without the evidence and the fact is of consequence in determining the action.” In federal cases, this means that the evidence must meet this standard to be admissible at trial. If the evidence is not relevant to proving a criminal act, then it must be challenged.

What If the Digital Discovery Is Incomplete or the Device Is Encrypted?

In cases involving digital evidence, “incomplete” discovery can take several forms. For example, incomplete discovery can look like:

• Missing metadata. Metadata can be essential for evaluating authorship, timing, and location.
• Missing extraction reports. An extraction report identifies which device data was acquired and if any data was unable to be extracted.
• Data residing on encrypted devices. This is a unique scenario where the government has the device, but is unable to review the data residing on the device. The evidence resides on the device but is essentially invisible to the government.
• Evidence that cannot be retrieved. This can include data from deleted files, and data from cloud storage. Depending on the device, storage medium, and any other factors, deleted files can be unrecoverable, and cloud storage providers routinely delete user data in accordance with retention schedules.

The larger the digital production, the more time the defense needs to review the data. This means that, in digital evidence cases, the longer the delay of digital production, the more time the defense team needs to review it. Importantly, plea advice must not be given until it is based on the review of the discovery produced.

If the government does not produce all of the evidence required under Federal Rule of Criminal Procedure 16, the defense can demand compliance. Rule 16 governs the rules and requirements for criminal discovery and requires prosecutors to produce a broad range of evidence, including:

• Documents and tangible things
• Defendants’ prior criminal convictions
• Statements made by the defendant
• Expert testimony
• Other items under Rule 16(a)(1)(E)

Rule 16(a)(1)(E) states that, upon the defendant’s request, the government “must permit the defendant to inspect and to copy or photograph books, papers, documents, data, photographs, tangible objects, buildings or places, or copies or portions of any of these items, if the item is within the government’s possession, custody, or control and: (i) the item is material to preparing the defense; (ii) the government intends to use the item in its case-in-chief at trial; or (iii) the item was obtained from or belongs to the defendant.” As Spodek Law Group explains in its analysis of Rule 16(a)(1)(E), this rule grants the defense a right to an inspection of any and all materials within the government’s possession that could potentially reduce the defendant’s culpability or support a valid defense. Additionally, Rule 16(a)(1)(E) is important in cases involving the government’s digital evidence. This means that the defense should be able to inspect not only the metadata, but also the original sources of the digital evidence, such as the device itself and the forensic images that the government acquired from the device. All of these inspections are important for ensuring that prosecutors do not under- or overstate the evidentiary value of the digital proof they have uncovered.

Can Prosecutors Prove the Phone, Account, or Wallet Was Actually Mine?

To use digital evidence to incriminate, prosecutors typically need to link a specific device or account to a specific person. To do this, they can rely on various types of evidence, though this is not always easy, and evidence often points to the device or account but not necessarily to the defendant.

Depending on the type of device or account, prosecutors may use social media records, business records, IP addresses, account credentials, and blockchain data to authenticate digital evidence.

In social media cases, the government typically attempts to link an account to the defendant. Even if the government is able to prove that the defendant owns the account, that doesn’t necessarily prove that the defendant is the author of every post or message. Another user may have used the defendant’s account and password to post an illegal advertisement or send an illegal message, or the account may have been compromised. Either way, the defendant should not be held responsible for fraudulent posts and messages that weren’t theirs.

Business record certifications are useful for establishing that a phone number or account belongs to a particular person. But certifications alone are generally insufficient to prove that the account user wrote a specific illegal message or post.

IP addresses are also frequently used in authentication. An IP address is a computer network identifier. It can identify a connection, but not necessarily a person. The defense can challenge the use of IP addresses to prove identity, and again, the fact that a device or account was used does not prove that the defendant was the one who used it at the time the digital evidence was created.

Credential sharing is also a serious issue, and it can make it difficult to definitively attribute account activity to one defendant. Compromised accounts can also make messages appear to come from an innocent user.

Blockchain technology presents similar challenges. Blockchain records show transactions between cryptocurrency wallets, but they are not linked to a specific person. A prosecution team would have to go much further to connect those blockchain wallets to their human owners.

The only way that a prosecutor can establish authentication is by satisfying Federal Evidence Rule 901(a). This rule states that, to introduce an exhibit at trial, prosecutors must first authenticate it by showing that it “is what the proponent claims it is.” If they can’t do this, they should not be allowed to introduce the evidence at trial.

If you are facing this situation, Spodek Law Group handles federal criminal defense matters nationwide, from offices in New York and Los Angeles.

Should I Challenge the Search of My Phone or Other Device Before Pleading Guilty?

When the government searches a device as part of a criminal investigation, prosecutors must generally prove the search was constitutionally sound. If a federal agent or law enforcement officer executed an unconstitutional search, then this can provide grounds for suppression of any digital evidence found during the search.

This means that defendants who are thinking about pleading guilty should generally raise any suppression arguments they have before entering their guilty plea. Federal Rule of Criminal Procedure 12(b)(3)(C) states that if there is a pretrial suppression motion, it must be made before the plea. Most critically, once a defendant enters an unconditional guilty plea, they no longer have the ability to present their suppression arguments in court. So, if the evidence should have been suppressed, you want to challenge the search of your phone (or other digital device) before you plead guilty.

Can (or should) I challenge the search of my device before I plead guilty?

In many cases, the answer is yes. Digital evidence, like all evidence, should be admissible. This includes challenges based on the Fourth Amendment.

The Fourth Amendment states that, “[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.” In practice, this requires warrants that have “particularity,” so, if the government executed your phone (or other device) search, your lawyer should first establish what the warrant required in order to execute the search.

While the Fourth Amendment is the key to many suppression arguments, there are also additional protections for devices and digital information. For example, in Riley v. California, the Supreme Court of the United States held that law enforcement officers generally need a warrant to search a cellphone following an arrest. Another case, Carpenter v. United States, severely restricted warrantless government access to historical cell-site location records.

All of this protections highlight the fact that digital forensics are subject to numerous substantive and procedural limitations. This means that overbroad digital warrants can open up avenues for arguing for suppression, and this can greatly improve the government’s prosecutors’ leverage during plea negotiations. If the government’s digital evidence must be suppressed, it can completely collapse the government’s trial leverage, forcing them to either abandon charges or offer a more-favorable plea.

How Can My Plea Agreement Limit What I Admit About Digital Evidence?

There are also three ways that a plea agreement can inadvertently expose you to sentencing exposure that exceeds your actual culpability, or even expose you to civil liability and other collateral consequences. To protect yourself, ensure that your plea agreement:

• Limit Your Admissions of Factual Basis. A plea factual basis should be a neutral summary of the allegations, not an admission of guilt. For example, if you are pleading to wire fraud, a plea factual basis can admit that you owned a device but refuse to admit that you were the one who sent a fraudulent message or posted a fraudulent ad online. Another example is to limit your victim count admissions. In fraud, child exploitation, and other cases, the number of victims found during a device or account search determines the sentencing guideline exposure. While admitting to a particular count of the indictment, the factual basis may leave open the question as to how many victims there are.
• Limit Your Admissions of Relevant Conduct. An admission of relevant conduct can extend sentencing exposure. While your plea will relate to a specific count of the indictment, your sentencing exposure can be based on relevant conduct. Your plea agreement should specifically state that you are not admitting to additional relevant conduct that would increase your guideline exposure.
• Limit Your Admissions of the Facts that Support Supervised Release Conditions. In digital evidence cases, supervised release conditions may include restrictions such as:
• No computer access.
• No social media access.
• No possession of smartphones.

While these conditions can be justifiable in some cases, you should limit your admissions in your plea agreement to the extent possible.

The risk of admitting to digital evidence found on a device also relates to licensing, immigration status, and other collateral consequences. For example, it may be the case that a certain admission would make it possible for you to lose your business license or be deported. If so, again, you should limit your admissions to the extent possible.

In federal courts, a conditional guilty plea allows a defendant to acknowledge the charges while preserving the ability to challenge pretrial rulings on appeal. Federal Rule of Criminal Procedure 11(a)(2)(B) requires the condition of the plea to be agreed upon by the defendant and the government and accepted by the court. A conditional plea can be helpful in a digital evidence case, as it allows the defendant to enter a guilty plea while preserving the grounds for appealing a pretrial ruling.

There are several disadvantages to pleading guilty by condition. As a result, in many situations, defendants are better off negotiating for a favorable plea deal. For example, by accepting a conditional guilty plea, a defendant is unable to request a sentence reduction for admitting guilt, thereby leaving the defendant to face potentially up to 10 years of probation and imprisonment. Furthermore, conditional pleas only preserve the appellate court’s ability to review the pretrial rulings specifically identified in the conditional plea. If your lawyer failed to raise an evidentiary objection, then your appeal will be limited to a review of that ruling.

Is It Better to Take a Plea Deal or Go to Trial?

According to the United States Sentencing Commission’s statistics, roughly 97% of offenders who received a sentence entered a guilty plea during fiscal year 2023. When measured against convictions, this number was 94%. It was even lower when measured among all defendants who had charges filed against them.

Whether a plea deal is on the table depends on the federal prosecutor’s discretion. Prosecutors can decide to offer terms that make it worthwhile to plead guilty in some cases and to decline to offer terms and instead force trial in others. Ultimately, the defendant has the power to decide whether to accept the plea or insist on a trial.

In many cases, this decision will be easy. But, sometimes it can be quite difficult. For instance, a defendant might receive a favorable plea offer, but it may be better to take the case to trial if it is likely that the digital evidence can be suppressed. Also, prosecutors can use the fact that they have information that is reliable, but inadmissible, to persuade the defendant to accept a plea deal when that evidence would not lead to a conviction at trial.

When it comes time to decide, prosecutors and defendants will negotiate. If you are considering taking a plea, it is important to have the guidance of an experienced federal defense lawyer. The following are some key points regarding the procedures of pleading guilty in a federal case:

• Federal Rule of Criminal Procedure 11 governs how guilty pleas are made in federal courts.
• Federal Rule of Criminal Procedure 11 provides rules and requirements for:

- Negotiating a plea deal

- Entering the guilty plea in open court

- Ensuring the guilty plea is voluntary and knowing

• Federal defendants can plead guilty, not guilty, or nolo contendere.

Talk to Spodek Law Group

Every case turns on its own facts, and general information is no substitute for advice about yours. Todd Spodek, managing partner of Spodek Law Group, and the firm's attorneys defend federal criminal and white collar matters nationwide. Reach the firm at 212-300-5196.