High-tech computer crime fighting has arrived in Vermont — but at what price?
Courtesy of Stephen Mease
Jonathan Rajewski, digital forensics examiner, shows tools of the trade to local schoolkids.
The gruesome discovery unnerved Old North End residents and marshaled the full investigative resources of the Burlington Police Department. On the morning of October 18, 2010, 50-year-old Kathleen Smith, a social worker with the HowardCenter, was found dead on the floor of her Park Street home. Her hands were bound behind her back, a scarf was wrapped around her neck, and her throat was cut. A medical examiner later determined that she’d bled to death.
The crime scene, as described in the police affidavit, was rife with clues: Smith’s hands were tied with a brownish-green utility rope fashioned in a self-tightening Prusik knot. Bloody footprints, made by a hiking shoe, led from the kitchen to the bathroom. The victim’s fingers were wrapped in silver duct tape that left behind distinctive adhesive markings.
On October 15, a state trooper had recovered Smith’s car from where it had been abandoned in a field off a remote dirt road in Hancock, 65 miles from Burlington. On October 21, detectives learned that an attendant’s booth at Middlebury College Snow Bowl, five miles from where Smith’s car was found, had recently been broken into and used as a shelter.
During a search of the area on October 23, police found 45-year-old Jose Miguel Pazos, a homeless man from the Burlington area, asleep in a storage shed. According to court records, a search of Pazos’ belongings turned up, among other items, a HowardCenter first-aid kit, a laptop computer and a large hunting knife with dried blood under the handle. A DNA analysis later matched the blood to Smith’s, court records allege.
With Pazos’ consent, a detective examined the soles of his shoes. The officer recognized the tread pattern as similar to the ones found at the homicide scene. Pazos was arrested, taken into custody and later charged with Smith’s murder.
A search of an outdoor encampment behind the Burlington U-Haul outlet on Riverside Avenue turned up more evidence believed to belong to Pazos. There, police recovered a stun gun, a piece of rope that “appeared to be identical” to the kind used to bind the victim’s hands and silver duct tape whose pattern seemed to match that of the tape used on Smith’s fingers.
On November 9, Pazos pleaded “not guilty” to four charges, including first-degree murder and kidnapping. He hasn’t been tried yet and is considered innocent until proven guilty.
The speedy arrest of a suspect, by a homicide unit that gets less than one murder case each year, is a testament to the detectives’ old-fashioned police work. That said, when the case goes to trial next year, a major component will most likely be evidence recovered not at the crime scene itself but through a digital forensic examination of the laptop computer found in Pazos’ possession.
This isn’t the first homicide in which Vermont police have used digital clues to bolster their case, but it reflects a growing trend. Many of the high-profile criminal investigations Vermont has seen in recent years — including those of the murders of Brooke Bennett and Michelle Gardner-Quinn — turned on key evidence unearthed through digital forensic work done on home computers, laptops, cellphones and other personal-computing devices. As the technology used to collect such evidence advances, some commentators worry that it comes at a price — our privacy.
What did digital forensic examiners find in the Smith case? According to court records, the recovered laptop contained a four-page PDF document created on October 7 and titled “A Long-Term Survival Guide — How to Make Rope Restraints.” It featured instructions, along with color photos, of how to make a modified Prusik knot.
Forensic examiners also discovered that on October 15, presumably one day after Smith was killed, the laptop was used to access an unsecured Wi-Fi network in Burlington and conduct Google searches on such phrases as “police blotter,” “Burlington Vermont crime rates,” “Smith” and “weather Vermont Middlebury.”
On October 17, the police affidavit indicates, the laptop was used to access the website Anonymouse.org, which lets users conduct Internet searches without revealing their identities. Through it, someone searched the obituaries and “cops and courts” sections of the Burlington Free Press website. Allegedly, the laptop was then used to Google “Kathleen Smith, Vermont” and “Kathleen Smith, Howard Center, Vermont.”
“I believe that it is important to note,” writes Burlington Detective Paul Petralia in his affidavit, “that Pazos was searching the Burlington Free Press for obituaries and conducting anonymous Google searches for Smith between October 15 and 17, 2010, which is prior to the discovery of Smith’s body on October 18, 2010.”
Digital sleuthing is being used to solve more crimes than just kidnappings and murders. A relatively new — to Vermont, anyway — computer technology known as the automatic license-plate reader, or LPR, is now assisting police around the state in searching thousands of license plates per hour on Vermont roads.
LPRs can be used to identify drivers who are runaways, have outstanding warrants, are driving under suspended or revoked licenses, or recently fled the scene of an accident or crime. Most recently, LPR devices were used by St. Albans police to nab a suspect believed to be responsible for a series of armed bank robberies in Franklin County in late 2009. That case is pending.
Yet, despite these and other successes, the use of digital crime-fighting tools inevitably raises questions about citizens’ privacy and Fourth Amendment rights. Groups such as the American Civil Liberties Union and the Electronic Frontier Foundation have expressed growing concern that these and other technologies, such as GPS locators surreptitiously affixed to citizens’ vehicles, are moving us toward a total-surveillance society. In such a society, they warn, our every movement can be cataloged and stored indefinitely, often without a judge’s oversight or prior consent. Moreover, most of these technologies are being developed and brought to market faster than state or federal laws can be adopted to govern their use.
As Allen Gilbert, executive director of the ACLU of Vermont, puts it, “The Fourth Amendment is really a core right that cannot be pushed aside by technology. It has to be respected.”
Jonathan Rajewski is a professor at Champlain College and a digital forensics examiner with the Vermont Internet Crimes Against Children Task Force, a statewide investigative unit based at the Burlington Police Department. In the last few years, Champlain College has been working closely with law-enforcement agencies across Vermont to assist in their digital crime solving. It wasn’t until recently that officers graduating from Vermont’s police academy received any training in investigating computer and Internet crimes.
Champlain College’s new administrative facility, which is under construction on Lakeside Avenue in the South End, will help do just that. Eventually, it will include space to house the Champlain College Center for Digital Investigation, a new digital forensics lab for conducting training and research of both students and police officers. The center is funded, in part, by a $500,000 federal grant from the U.S. Department of Justice.
Rajewski, a civilian, is one of only about a dozen digital forensics experts assisting Vermont law-enforcement agencies. He’s worked on several homicides in recent years, including that of Gardner-Quinn, the 21-year-old University of Vermont student who was abducted, sexually assaulted and murdered in October 2006.
A major break in that case came when police identified their suspect, Brian Rooney, through a call Gardner-Quinn made from his cellphone shortly before she was abducted. In May 2008, Rooney was found guilty of aggravated murder. His case is now under appeal.
More recently, Rajewski worked on the murder investigation of Michael Jacques of East Randolph. Jacques, 44, is on trial for allegedly kidnapping, drugging, raping and murdering his 12-year-old niece, Brooke Bennett of Braintree, in late June 2008.
Jacques is being tried in federal court — and hence faces the death penalty if convicted — because of his alleged use of electronic communications, specifically emails and social-network postings on Bennett’s Myspace page, which are governed by interstate-communications laws.
Much of the case prosecutors have built against Jacques relies on digital forensic evidence recovered from his computer hard drive. That evidence includes emails concerning Jacques’ alleged sexual exploitation and assault of Bennett, details about her abduction, and his alleged planting of evidence to conceal his involvement in the crimes.
This week, a federal judge in Burlington will hold two days of hearings to consider a motion by Jacques’ defense team to suppress new email evidence showing that, prosecutors claim, he tried to make it appear as though he’d been framed by an out-of-state sexual-predator ring.
Rajewski is under a judicial gag order and cannot yet discuss the specifics of that case. Speaking generically about the role of digital forensics in Vermont investigations, he says it’s rare for a major homicide case to hinge entirely on computer evidence. Nevertheless, Rajewski says he’s seeing more and more crimes involving personal computers, as well as data stored on servers elsewhere.
“If you think about crime today, there’s almost always a digital component, whether it’s a cellphone, email account, a laptop,” Rajewski says. “There’s always some type of digital trail.”
And, like more traditional types of evidence, such as fingerprints, murder weapons and DNA samples, digital evidence must be collected in a “forensically verifiable manner” so it’s not damaged or tainted in the process. As Rajewski explains, examiners use so-called “write-blocker” technology that allows them to access the contents of hard drives without altering the original data, such as the last time a user logged on to a social-networking or instant-messaging account.
“It’s the same as finding a bloody knife on the ground,” he says. “Do you pick it up, wipe it off and put it in your pocket? Or do you properly collect it with gloves and put it in an evidence bag? It’s the same concept.”
Police and civilian investigators face huge technological challenges: Any device that can process, transmit or store digital data may contain potentially probative information. Yet new hardware and software are continually being released, often with proprietary technology inside.
For example, Rajewski points out that Apple’s new iPad has no USB port for uploading or downloading data. This makes it more difficult for digital investigators to extract information without disrupting the forensic evidence.
“It’s a constant struggle to keep up with the technology, because the bad guys are using that technology,” Rajewski says. “It’s always a spy-versus-spy scenario.”
Sgt. Andy Frisbie agrees. A Burlington police officer who coordinates the investigative unit of the Vermont Internet Crimes Against Children Task Force, Frisbie says similar challenges are presented by the hundreds of thousands of new smartphone applications, or “apps,” that hit the market each year. He points out that Vermont forensics experts simply don’t have the time or resources to stay on top of all those developments and must learn as they go.
“We’ve always been up against the complexities of digital investigations,” says Frisbie, an eight-year BPD veteran who entered police work from a career in information technology. “It’s not just cops that have learning curves, but prosecutors, judges and defense lawyers. Collectively, we’re seeing an increase in knowledge and awareness, but we still have a very long way to go.”
Frisbie, who worked on both the Gardner-Quinn and Smith homicides, says that digital investigations sometimes can be “tedious and complex,” in part because there are so few standards governing how long data are stored or retained.
Consider, for example, the investigative challenge of determining whether a suspect logged on to a specific Wi-Fi network.
“Businesses will put up an open Wi-Fi, and they don’t maintain it, and it sits open for years,” Frisbie says. “Sometimes they don’t even remember the password to log in to look at their logs.”
Likewise, each cellphone company in Vermont has its own policies regarding its retention of customers’ content, such as text messages. “One company, in particular, doesn’t retain anything longer than 180 days,” Frisbie says. He won’t specify which one.
What’s the significance of 180 days? Michele Martinez Campbell is a visiting professor at the Vermont Law School, and an expert in wiretaps and electronic surveillance. She explains that, under the Stored Communications Act, electronic communications stored for 180 days or less, including emails and text messages, must be obtained with a search warrant. After 180 days, a simple subpoena or court order may suffice.
“Law enforcement needs to be able to enforce based on how crimes are being committed,” she says. “But, obviously, that also raises civil-liberties issues, in the same way that any search procedure would.”
It’s worth noting that the Stored Communications Act is part of a larger federal law, the Electronic Communications Privacy Act, that was passed by Congress in 1986, when virtually none of the technology in widespread public use today even existed.
“The courts,” Martinez Campbell adds, “haven’t come to terms yet with all the ways people are communicating.”
Not all digital crime fighting in Vermont involves the Internet. One of the older investigative tools used by police — license-plate registrations — recently got a 21st-century upgrade, and it’s revolutionizing the way police do their jobs.
At least a half-dozen law-enforcement agencies — including the Vermont State Police and departments in Hartford, Newport, Rutland, St. Albans and Shelburne — now have cruisers equipped with mobile license-plate readers.
LPR technology, which has been used overseas for almost a decade, arrived in Vermont last year. A spokesperson with ELSAG North America, the company that manufactures the “Mobile Plate Hunter-900,” which Vermont police use exclusively, explains how it works:
Two digital cameras, mounted on the light bar of a patrol car, constantly scan the road and photograph the plates of every vehicle, parked or moving at speeds of up to 120 mph, that passes in front of or behind the cruiser. Optical character-recognition software, which can read as many as 1800 plates per minute, searches a police database for vehicles that are wanted, stolen or otherwise of interest. When it gets a hit, it alerts the officer. LPR units, which have an accuracy rate of at least 95 percent, cost about $20,000 apiece.
St. Albans Police Chief Gary Taylor credits LPRs with helping his department apprehend a suspect in five bank robberies that occurred in Franklin County between September 27 and January 29, 2010, all of which are believed to have been committed by the same person.
Taylor cannot comment on the specifics of that pending criminal case. However, a police affidavit filed in U.S. District Court in Burlington confirms that at least two LPRs — one mounted on a St. Albans police car and another on a state police cruiser — were used to apprehend the suspect, 24-year-old Chad Lussier of Richford.
Court records allege that when responding to a November 13, 2009, armed robbery at the TD Bank in Enosburg Falls, the St. Albans cruiser photographed Lussier’s plate using its LPR device. The affidavit further indicates that the cruiser’s LPR records were then downloaded into a Vermont State Police database and compared with LPR records saved from other police cars that had responded to the three earlier robberies.
The database comparison turned up another hit for the same vehicle: a 1997 blue Saturn registered to Lussier. The description and license plate matched a visual identification made by a witness to the last robbery. This and other evidence has been used to charge Lussier in connection with all five robberies.
Taylor points out that police aren’t just using LPRs to apprehend felons. His officers use them daily to scan the roads for invalid inspection stickers, expired plates, and wanted or stolen vehicles.
They’re also used for what Taylor calls “geo-fencing.” All schools and playgrounds are plotted into the LPR system using GPS, or global positioning system, coordinates. The LPRs hunt for registered sex offenders within 500 yards of a school or playground and alert officers if one shows up.
St. Albans has just two police cars equipped with LPRs, but they’re deployed on every shift with the most active patrol officers. Within the first six months of their use, arrests for DUS, or driving under suspension, jumped 47 percent, Taylor reports. Moreover, the officers using the LPRs are now responsible for 67 percent of all arrests made by the entire patrol division.
“I think they’ve proven their effectiveness,” Taylor asserts. “At a time when we can no longer afford to expand police departments, we have to use tools that make us more efficient and effective.”
Thus far, LPR technology is “still in its infancy” in Vermont, according to Michael Macarilla, who commands the Vermont State Police technology-services office. Currently, the state cops have just two LPRs. Like those used by other law-enforcement agencies in the state, they were paid for through federal grants.
Macarilla explains that all LPRs used in Vermont work off the same database, which the VSP maintains. He says the data are retained for no more than four years, which is consistent with the time in-car police videos are saved. Some exceptions are made for data involving major felonies, such as child kidnappings, aggravated sexual assault and murder, which are kept for seven years or until the case is solved.
For his part, Taylor says that an alert by the LPR doesn’t automatically constitute “probable cause” for an officer to stop a motorist. In many cases, the officer still has to have reasonable suspicion. Finally, he asserts that LPRs can’t do anything that a police officer can’t do already — they just do it much, much faster.
Vermont Law School’s Martinez Campbell, a former federal prosecutor, agrees. Though she’s not familiar with LPR technology per se, she says that, as with other aspects of the law, the dividing line between what police can and cannot do isn’t necessarily drawn by the technology itself but by the public’s recognition that they will have less privacy in public places.
“The police have very limited ability to go view you in your home or monitor your private conversations or emails without a warrant,” she says. “But if you’re talking about what you do in the public domain, that’s simply not a problem from the constitutional perspective.”
But civil-liberties advocates, such as ACLU-VT’s Gilbert, disagree. He contends that a technology that gathers and indefinitely stores data allowing police to reconstruct citizens’ movements, regardless of whether they’ve committed an offense, represents a fundamental shift in our values.
“Freedom of movement is one of our core rights,” Gilbert asserts. “I don’t think we all recognize how this technology is making changes in our attitudes about privacy and freedom of association.”
Gilbert emphasizes that the ACLU doesn’t object to the use of high-tech investigative tools to solve crimes when there’s a known suspect and oversight by a judge who issues a search warrant.
But he points out that there’s been no public debate in Vermont about how long LPR data are stored, who has access to the information or how it can be used. Other states have used LPRs for parking enforcement, collection of unpaid property taxes, monitoring of known or suspected gang members and drug houses, and even car repossession.
In fact, the October 2010 issue of Police magazine features an article on LPRs that suggests the technology can help police raise money by renting out their services to homeowner associations.
And, as Crain’s Chicago Business reported in April, Chicago Mayor Richard M. Daley has proposed installing a system of 200 fixed LPR units along interstate highways between his city and Mexico, at a cost of nearly $10 million. Ostensibly, the units would hunt for drug traffickers, gun smugglers and money launderers. But they could also be used to look for other persons of interest to state and federal authorities.
“The question is, who will have access to these records and under what circumstances?” Gilbert asks. “It’s the dragnet approach of making everyone a suspect that is fundamentally un-American.”