United States v. Morgan
United States v. Morgan
Opinion of the Court
Before the Court is defendant's motion in limine to exclude the government's proposed cellular analysis testimony.
BACKGROUND
On March 23, 2017, the government filed an expert disclosure letter indicating that it intended to call FBI Special Agent Kevin Horan as an expert in the analysis of cellular telephone records. (ECF No. 39.) The type of cellphone-data analysis used in this case involves a method called drive testing. The government seeks to admit the expert testimony of Special Agent Kevin Horan of the FBI's Cellular Analysis Survey Team ("CAST") concerning (1) counts dealing with defendant's alleged kidnapping, transportation of a minor with intent to engage in criminal sexual activity, and attempted production of child pornography and (2) counts dealing with defendant's failure to register as a sex offender. (Government's Opp. to Def.'s Mot. in Limine, ECF No. 48, ("Gov. Opp.") at 1-2.) As to the substantive counts, Agent Horan's testimony will analyze the cell-site information and data obtained from defendant's cellphone and the alleged victim's cellphone as it relates to the time frame of the offenses alleged to have occurred on May 22-23, 2016. (Id. at 2.) As to the registration counts, Agent Horan's testimony will analyze the cell-site information and data obtained from defendant's cellphone records during a time period between 2015 and 2016. (Id. )
On April 3, 2017, defendant moved to exclude the government's proposed cellular analysis testimony on the grounds that Agent Horan's opinions (1) depend on unreliable methodologies, Fed. R. Evid. 702, and (2) otherwise pose a danger of unfair prejudice that substantially outweighs the proposed testimony's probative value, Fed. R. Evid. 403. (Def.'s Mot. in Limine, ECF No. 44, ("Def.'s Mot.") at 1.) After initial briefing and a Daubert hearing that took place over three days, the Court allowed the parties to submit post-hearing briefing. Defendant filed his post-hearing brief on January 13, 2018, and the government filed their response on February 26, 2018. The Court is now in a position to rule on defendant's motion in limine.
ANALYSIS
I. LEGAL STANDARD
Federal Rule of Evidence 702 governs the admissibility of expert testimony in federal courts and provides that a witness may offer expert opinion testimony if:
(a) the expert's scientific, technical, or other specialized knowledge will help the trier of fact to understand the evidence or to determine a fact in issue; (b) the testimony is based upon sufficient facts or data; (c) the testimony is the product of reliable principles and methods; and (d) the expert has reliably applied the principles and methods to the facts of the case.
Fed. R. Evid. 702. The Supreme Court has explained that trial judges must "ensure that any and all scientific testimony or evidence admitted is not only relevant, but reliable." Daubert v. Merrell Dow Pharm., Inc. ,
An opinion exhibits reliability if the expert is qualified to offer the opinion and the opinion has an acceptable basis in the knowledge and experience of the expert's discipline. See Daubert ,
A relevant opinion will help the trier of fact understand evidence or determine disputed facts. See Daubert ,
II. AGENT HORAN'S QUALIFICATIONS
At the first day of the Daubert hearing, the Court qualified Agent Horan as an expert in historical cell-site analysis and drive test analysis without objection from defendant. (Tr. of Daubert Hr'g (Day 1), Aug. 22, 2017, ECF No. 74 ("8/22/2017 Tr.") at 10-11.) However, it is necessary to briefly review Agent Horan's qualifications given the lack of independent scientific analysis on the use of cell-site data for law enforcement purposes.
Kevin Horan is a FBI special agent who has been a member of the FBI's CAST unit since its inception in 2007. (Id. at 4.) Agent Horan was using cellphone records in criminal investigations prior to joining CAST, but when CAST was formed in 2007, there were few, if any, subject matter experts in the field of cellular analysis for criminal investigations. (See id. at 4.)
Agent Horan underwent specialized training upon joining CAST, which includes: (1) education on radiofrequency theory and analysis; (2) instruction from major cell service providers and their radiofrequency engineers on network maintenance and operation; (3) education and applied training on the use of drive test gear and scanning gear; and (4) a concluding series of practical exercises on use of historical cell records. (Id. at 5-7.) Initial CAST training ends with a drive test evaluation, moot court session, and final exam. (Id. at 7.) In addition, CAST members have a yearly retraining course that includes instruction on any relevant updates and a recertification in an agent's current drive test equipment or a certification in new drive test equipment. (Id. ; Tr. of Daubert Hr'g (Day 2), August 29, 2017, ECF No. 73 ("8/29/2017 Tr.") at 34-35.)
Agent Horan performs between 20-30 drive tests a year, and also teaches classes on drive testing and historical cell records analysis. (8/22/2017 Tr. at 9.) He has a valid certification to use his current drive test equipment. (Id. at 22.) Agent Horan has been certified as an expert in court on cellphone analysis at least 76 times, and "in the last several years, almost every one of [his] cases involved [a] drive test." (Id. at 10.)
III. RELIABILITY
At issue here is the reliability of drive testing, which "is a method used by wireless telephone companies and radio frequency engineers to determine the coverage range of a cell tower for the purpose of determining the health of the telephone company's wireless network." Larry Daniel, Cell Phone Location Evidence for Legal Professionals: Understanding Cell *479Phone Location Evidence from the Warrant to the Courtroom 69 (2017). Providers did not design drive testing methods for establishing a permanent footprint of a tower's coverage area, nor did they design drive testing to establish a cellphone's exact location when it communicates with a tower. Id. In its current form, drive testing cannot determine the exact "location of a cell phone or set[ ] exact boundaries for where a cell phone must be to connect to a particular cell tower." Id. at 70. As with all tests involving human inputs, "drive testing results can be skewed by the method used by the person doing the testing. It can also be skewed by whether or not the person doing the testing has the drive testing equipment calibrated by a qualified calibration engineer. Generally, calibration happens once a year." Id.
Drive testing cannot perfectly replicate how a cellphone would interact with a network on a past date. See id. at 77. Drive testing "is a test to determine if at the time of the drive test and in the location of the drive testing equipment, a phone can make an outgoing call and the phone can 'hear' a signal from a cell tower." Id. at 71. As evidence, results from a drive test can show
that a cell phone could be at a particular place and would prefer the cell site and sector that was recorded in the historical call detail records. Or the drive test results are used to create a map showing the limits of where a cell phone could be and connect to a cell tower or sector.
Id. at 76; (see also 8/22/2017 Tr. at 11-12 (describing how cellphones communicate with towers).) In other words, drive test results cannot "provide an exact location." (8/22/2017 Tr. at 14; see also id. at 61-62.)
As a point of comparison, generating data from drive testing operates on many of the same principles as historical cell-site analysis. Compare Daniel, supra , at 29-40, 49-68, with id. at 69-78. "Historical cell-site analysis can show with sufficient reliability that a phone was in a general area, especially in a well-populated one. It shows the cell sites with which the person's cell phone connected, and the science is well understood." United States v. Hill ,
However, this Court does not accept drive testing as reliable simply because of its similarities to historical cell-site analysis. To analyze drive testing's reliability, the Court must examine whether the government has adequately addressed potential sources of error in drive testing methodology generally, and any sources of error in the application of the drive test to the data analyzed in this case. See, e.g., United States v. Cervantes , No. 12-cr-00792,
A. Drive Testing Methodology
1. Cell Site Locations
Before conducting a drive test, an agent must know the cell-site locations he is targeting.
*480CAST inputs cell sites in existence during the time an analyzed incident occurred into mapping software using latitudinal and longitudinal coordinates of cell sites provided by service providers, also known as the provider's tower lists. (Gov. Hr'g Ex. 4 at 2; 8/22/2017 Tr. at 24.) Before performing a drive test, an agent will cross-check a provider's tower list closest to the time the incident occurred with the provider's most current tower list at the time of the drive test to see if any changes have occurred to the tower or the cellular network. (8/22/2017 Tr. at 24.)
Agent Horan testified that he contacted the providers themselves to ask if any significant changes had occurred to the network. (Id. at 26, 36; see also id. at 24-25 (explaining factors that affect a tower's cellular footprint).) Agent Horan found that there were no changes to the towers that would have affected the drive test data's comparative value. (Id. at 36-37, 70-71; 8/29/2017 Tr. at 54-57, 60, 63.)
2. Call Detail Records
Prior to drive testing a CAST agent also performs an analysis on the target cellphones' call detail records ("CDRs"). (Gov. Hr'g Ex. 4 at 2.) CDRs document a cellphone's interaction with the cell provider's network. (Id. ; see also 8/22/2017 Tr. at 11-12 (describing how cellphones communicate with towers).) CDRs "record basically everything that occurs on the phone over a period of time. So that is all the voice call activity, the text messages, as well as the ... data sessions." (8/22/2017 Tr. at 13.) CDRs also document a cellphone's interaction with a cell tower and its corresponding cell site, also known as a cell sector, which provides evidence on what cell sites could have serviced a cellphone at a particular time. (Gov. Hr'g Ex. 4 at 2; 8/22/2017 Tr. at 13; see also 8/29/2017 Tr. at 23-26 (explaining CDRS in this case); 8/22/2017 Tr. at 34-35, 58 (explaining differences between T-Mobile's and Sprint's CDRs).) CAST analyzes CDRs in conjunction with a list of cell-site locations to generate an estimated location of a cellphone when it initiated contact with a cellular network. (Gov. Hr'g Ex. 4 at 2.) When a CAST agent performs a drive test, he will put the CDRs into the software used for drive testing so as to better locate the area where he should perform the drive test. (8/22/2017 Tr. at 23.)
CAST analyzed records for the alleged victim's T-Mobile cellphone and the defendant's Sprint cellphone, (collectively "target cellphones"). (Gov. Hr'g Ex. 4 at 2.) During the alleged incident, calls incoming and outgoing to the target cellphones had durations ranging from one to 97 seconds. (8/29/2017 Tr. at 26.)
3. The Drive Test
The CAST team employs a piece of survey equipment known as a Gladiator Autonomous Receiver ("GAR") to survey networks in investigated areas. (Gov. Hr'g Ex. 4 at 2; 8/22/2017 Tr. at 18.) The GAR is a mobile computing system that scans the area driven by an agent, collecting the possible coverage area of towers that an agent specifically noted in the system beforehand as well as surrounding towers' coverage areas. (Gov. Hr'g Ex. 4 at 2; 8/22/2017 Tr. at 18, 21-22.) The GAR measures each tower's signal strength as the agent performs the drive test. (Gov. Hr'g Ex. 4 at 2; 8/22/2017 Tr. at 18-19, 23-24.)
To measure signal strength, the GAR collects information on radiofrequency signals. Radiofrequency signals are measured on a range going from 0 to negative numbers, with a signal of negative one representing a stronger signal than -100. (8/22/2017 Tr. at 41-42.) CAST's software ("ESPA") cutoffs measurement of a tower's possible coverage area at a signal strength of -17, although no specific literature that Agent Horan was aware of supported *481the use of a -17 cutoff. (8/29/2017 Tr. at 30-31.) In Agent Horan's experience, however, a phone would normally connect to another tower once a particular tower's signal strength dropped below -17, (8/22/2017 Tr. at 47, 49-50; 8/29/2017 Tr. at 31), and the -17 cutoff represents an industry standard used by radiofrequency engineers working for providers. (8/29/2017 Tr. at 32-35.)
To collect this information about towers' radiofrequencies, an agent drives an expanded area surrounding the investigated area, trying to capture as many towers as possible that might have a coverage area overlapping with the investigated area. (Id. at 31-32, 39-40.) In rural environments an agent may drive as much as seven square miles to capture towers that have coverage areas in an investigated area, but in urban areas an agent may only drive within one or two square miles because towers are closer together and have smaller coverage areas. (Id. at 49-50.) The data from the GAR goes into a software program in CAST's server for later analysis. (Id. at 64); see also Daniel, supra , at 70 (describing how radiofrequency engineers perform a drive test).
On November 28, 2016 and December 1, 2016, Agent Horan used the GAR to conduct a drive test of the T-Mobile and Sprint networks in the areas of the alleged sexual assault, and other pertinent locations, analyzing the towers which appeared in the CDRs during the relevant time frame. (Gov. Hr'g Ex. 4 at 2; 8/22/2017 Tr. at 35-36.) On both days Agent Horan began his drive during the day and drove into the evening hours. (8/29/2017 Tr. at 50.)
4. Data Processing After the Drive Test
After the drive test, the agent who performed the drive test runs data collected by his GAR through a post-processing program, the ESPA, which depicts the breadth of each sector and illustrates towers of interest ("the draft analysis"). (8/22/2017 Tr. at 28; 8/29/2017 Tr. at 16, 65; Gov. Hr'g Ex. 4 at 2.)
A second agent who did not perform the drive test analyzes the draft analysis and checks for any errors made on the part of the initial inputting agent or possible errors in the software's generated data ("the peer review process"). (8/22/2017 Tr. at 29, 32; 8/29/2017 Tr. at 14-16); see also Daniel, *482supra , at 74-76 (outlining how cell providers analyze drive test results). The agent conducting the peer review process has all the drive test data and any other information the initial agent had, including CDRs. (8/29/2017 Tr. at 15.) This agent also cross-checks the data by referencing different software programs and other collections of data. (Id. at 16, 33-34.) The peer review process does not include another drive test or a physical check of the area where the first agent performed the drive test unless the peer review process uncovers irreconcilable problems with the generated data and the review. (Id. at 16-17.)
During Agent Horan's draft analysis he input a wrong code, but the peer review process corrected the error. (Id. at 14-17, 38.) No other errors were uncovered in the peer review process that could have generated irreconcilable problems.
5. Final Data Output
The drive test combined with the CDRs will generate a map of all towers' (1) total coverage areas or their "possible signal" and also (2) dominant coverage areas or "dominant signal." (8/22/2017 Tr. at 19, 28, 41, 51-52, 57, 92, 96-97; 8/29/2017 Tr. at 18; see also 8/22/2017 Tr. at 11-12 (describing how cellphones communicate with towers) ); Daniel, supra , at 73-74 (describing data that a drive test collects). The dominant signal comes from the tower that provides the strongest signal to the cellphone when that phone initially tries to connect to a network. (8/22/2017 Tr. at 92-93, 95); see also Daniel, supra , at 74. Manufacturers design cellphones to constantly measure signal strength for the duration of a call or data session, and a cellphone selects the dominant, or strongest signal, as a user moves. (8/29/2017 Tr. at 27-29.) Radiofrequency engineers refer to this phenomenon as the "neighbor list"-an internal list of surrounding towers' signal strength that a cellphone constantly measures. (Id. at 28-29); see also Daniel, supra , at 74. A neighbor list ensures that a cellphone connects to the dominant signal instead of connecting to a tower that is farther away, but may still have a total coverage area reaching a user's location. (8/29/2017 Tr. at 29.) Only a drive test can measure the dominant signal; without a drive test the most CAST members can do is measure a tower's possible signal area represented by a wedge that shows the direction that a tower's signal pushes out towards. (Id. at 35-36.)
By comparing CDRs to the output from a drive test, CAST agents aim to approximate a cellphone user's possible, not exact, location when he initiated a call. (8/22/2017 Tr. at 55, 65, 79; 8/29/2017 Tr. at 42.) As Agent Horan explained, "[t]he way I would testify, Your Honor, is that based upon what we have in the records and what the drive tests revealed to us, that [the cellphone] could be anywhere within what's illustrated here in the [mapped] footprint." (8/22/2017 Tr. at 79.) Based on the drive test data, Agent Horan cannot speculate where the target cellphones were exactly located at any particular time, but he can say that the target cellphones were most likely in certain coverage areas during the time the calls were initiated and testify that the target cellphones appeared to move between calls. (8/29/2017 Tr. at 44-45, 47.)
6. Other Factors Affecting the Accuracy of the Drive Test
i. Distance Driven
The distance covered in a drive test can affect the accuracy of the results it produces. Agent Horan testified that a tower *483signal can reach at least four miles. (8/29/2017 Tr. at 48.) Gerald Grant, the expert proffered by the defense, testified that it was his opinion that "a drive test should be at least four miles out and cover as many roads as possible." (Tr. of Daubert Hr'g, Oct. 11, 2017 (Day 3), ECF No. 79 ("10/11/2017 Tr.") at 30-35.) Based on this opinion, Mr. Grant testified that Agent Horan did not drive far enough to produce an accurate drive test. (Id. at 30-31.) Agent Horan explained that he has never seen a signal go beyond four miles in an urban environment such as the one surveyed here. (8/29/2017 Tr. at 49-50; see also id. at 39.)
ii. Changes in Cellular Towers and Other Environmental Factors
To generate accurate data, an agent should check to ensure that no relevant tower has changed physically. For example, cell towers tilt downward toward the earth to target cellphone users so an adjustment in tilt can change a tower's coverage area. (8/22/2017 Tr. at 25; 8/29/2017 Tr. at 41; see also 8/22/2017 Tr. at 24-25 (explaining factors that affect a tower's cellular footprint).)
A tower's possible and dominant signal can also be affected by what those in the industry refer to as "noise." (8/22/2017 Tr. at 100-01; 8/29/2017 Tr. at 19, 22.) Noise primarily represents the number of cellphone users on a tower. (8/29/2017 Tr. at 19.) Noise increases as the number of users connecting with a tower increase. (Id. at 19-20.) Agent Horan analogized the effect noise has on a tower to the effect noise has in a crowded room. (Id. ) When a room is empty a person on the far side of the room might be able to have a conversation easily with the next entrant, but as more people enter the room and begin talking, the first two people will have to move closer together to maintain their conversation. (Id. at 20.) The same thing happens with a tower's dominant signal, as the noise level goes up a cellphone will have to move closer to the tower to connect. (8/22/2017 Tr. at 101-02; 8/29/2017 Tr. at 20, 22.)
However, providers do a relatively decent job of predicting the amount of noise a tower will have to handle, so barring an event which causes hundreds and hundreds of additional users to attempt a connection within a condensed area, a tower's dominant signal rarely contracts (a process also known as "cell breathing"). (8/22/2017 Tr. at 102-03; 8/29/2017 Tr. at 20-21.) If a cell breathing event did occur, radiofrequency engineers estimate that the shrinkage in coverage area would be around 1-5% of the coverage area's original footprint, which equates to a couple of blocks in a city environment. (8/29/2017 Tr. at 21-22.) Someone connecting in this decreased area may connect to an adjacent tower, which now provides the dominant signal. (8/22/2017 Tr. at 66-69; 8/29/2017 Tr. at 22.)
Geography and large artificial structures may also affect a tower's coverage area. (8/22/2017 Tr. at 26-27, 36-37, 52-54, 69-71.) For example, radiofrequency signals can bounce off water and produce a coverage area farther away from where the tower's signal would normally reach. (Id. at 52-54; 8/29/2017 Tr. at 29.) This can affect both a tower's possible signal area and dominant signal area. (8/29/2017 Tr. at 29-30; 8/22/2017 Tr. at 52-54.) If a neighbor list operates correctly it should prevent a phone from connecting to coverage-area anomalies caused by geographical factors. (8/29/2017 Tr. at 30.)
Agent Horan did not uncover any changes to the towers or the environment that would have affected the drive test data's comparative value. (8/22/2017 Tr. at 36-37, 70-71; 8/29/2017 Tr. at 54-57, 60, 63.) Nor has defendant brought any to the Court's attention.
*484B. Reliability of the Drive Test at Issue
Defendant's main objections to the reliability of Agent Horan's proposed testimony relate to the lack of independent scientific testing and publications on the use of drive testing as evidence. (See Def.'s Mot. at 6.) It is true that the use of drive testing in criminal trials is a relatively new development, and as such, has not been subject to extensive peer review and its error rate has not been fully tested. See Phillips v. State ,
However, the Daubert inquiry is flexible, and a Court should not automatically exclude evidence because it is too new, or of too limited outside interest, to generate extensive independent research or peer-reviewed publications. See Daubert ,
Law enforcement officials employ drive testing because they believe it to be a more accurate method than historical cell-site analysis at approximating a tower's coverage area. Courts routinely accept historical cell-site analysis as reliable, see, e.g., Hill ,
Defendant also objects that because Agent Horan "cannot explain how the data collected during a drive test is translated into the shaded areas on the drive test maps, SA Horan is not qualified as an expert to speak about the accuracy *485of those maps." (Post-Hr'g Br. in Supp. of Def.'s Mot. in Limine, ECF No. 80, ("Def.'s Post-Hr'g Br.") at 2.) However, this Court does not require an expert to have an in-depth knowledge of all the algorithms underlying their technological tools-such as hardware and software-to reliably testify about the outputs of those tools.
Forensic investigation increasingly requires the use of computer software or other technological devices for the extraction of data. While an investigator must have specialized knowledge in the use of the particular software or device, it is not required-nor is it practical-for an investigator to have expertise in or knowledge about the underlying programming, mathematical formulas, or other innerworkings of the software.
State v. Pratt ,
This Court concludes that drive testing can form the foundation for expert testimony if the expert acknowledges that drive testing only produces an approximation of a cellphone's location and the expert adequately accounts for elements that could affect the test's accuracy. See Frazier ,
IV. RELEVANCE AND RULE 403 CONSIDERATIONS
The Court also finds that Agent's Horan's testimony is relevant. Agent Horan's "testimony is based on a reliable methodology that has been reliably applied to the facts of this case." Jones ,
While defendant casts some of his objections as going to the issue of reliability, they more approximately go the issues of relevance and Rule 403 considerations. See United States v. Eady , No. 2:12-cr-00415-3,
The Court acknowledges, as the government has conceded, (1) that the generated coverage-area maps are not perfect, and (2) those maps cannot pinpoint defendant's exact location at any time. But relevancy and Rule 403 considerations do not require perfect expert opinions; "the judge is supposed to screen the jury from unreliable nonsense opinions, but not exclude opinions merely because they are impeachable." Alaska Rent-A-Car, Inc. v. Avis Budget Grp., Inc. ,
The Court finds that Agent Horan's testimony will not mislead the jury so long as he testifies only to defendant's and the alleged victim's possible location within a general area of coverage, as opposed to an exact location. See State v. Adams ,
CONCLUSION
For the reasons stated above, defendant's motion is denied. A separate Order, ECF No. 86, accompanies this Memorandum Opinion.
Two prior opinions of this Court describe the background and procedural history of this case in detail. United States v. Morgan ,
The alleged incident in this case occurred around midnight in May 2016. (8/29/2017 Tr. at 50.)
ESPA's algorithm is proprietary so CAST cannot evaluate the algorithm's accuracy outside of the quality checks that Gladiator performs on CAST's equipment. (8/29/2017 Tr. at 65-66.) Agent Horan was not aware of any studies evaluating the accuracy of Gladiator's equipment and software. (Id. at 67.)
Environmental factors include bodies of water, mountains, large hills, large trees, and substantial artificial structures such as skyscrapers, whereas weather, time of day, traffic, or smaller structures generally will not affect a drive test's accuracy. (8/22/2017 Tr. at 26-27, 36-37, 52-54, 69-71.)
During Agent Horan's tenure with CAST, he has never seen a second drive test occur for the same case. (8/29/2017 Tr. at 17.)
The Court also notes that no evidence in the record shows that Agent Horan performed his drive test differently from how radiofrequency engineers conduct drive tests-the professionals whom cellular companies depend on to reliably determine the coverage area of their own towers. Compare Part III.A, with Daniel, supra , at 70 (describing how radiofrequency engineers perform a drive test), and Am. Cellular Network Co., LLC v. Upper Dublin Twp. ,
The government also suggests that the lack of peer-reviewed articles on the subject of drive testing is due to the fact that drive testing technology has been relied upon, "tested and reviewed for decades in the multibillion dollar wireless communications industry." (Post-Hr'g Br. in Opp. to Def.'s Mot. in Limine, ECF No. 84, ("Gov.'s Post-Hr'g Br.") at 12.) Regardless of the reason for the lack of independent scientific review of drive testing, this Court finds that drive testing exhibits sufficient reliability to form the foundation of expert testimony.
Defendant's proposed experts agrees that the concept of drive testing can be used to represent a tower's coverage area or footprint, but "disagree[s] that it's an accurate representation of how big the dominant area is." (10/11/2017 Tr. at 48.)
Reference
- Full Case Name
- United States v. Charles MORGAN
- Cited By
- 4 cases
- Status
- Published