Digital and records evidence: subpoenas, court orders and warrants

The phone number on the cigarette listing was the thread that tied the Northgate case together. Erin Bose, the analyst who found the listing, could see the number but not who it belonged to. To find out, and to find out where that phone had been on the night of the robbery, Ferreira needed records held by a telecommunications company, and the law sets out exactly how police may obtain them. Desjardins tells the class that digital and records evidence now appears in almost every serious investigation, and that the rules for getting it are among the most technical in criminal procedure. 'You do not need to memorize every section number,' he says. 'You need to know what kind of information you are asking for, what level of grounds the law requires for it, and what document authorizes you to get it.'

Kinds of digital and records evidence

Records evidence is information held by someone other than the suspect: a phone company, an internet service provider, a bank, a social media platform, a retailer, a transit authority, a hotel. Digital evidence is information stored on devices, including phones, computers, cameras, vehicles and smart home devices, or in online accounts. Both can be divided by how private the information is, which largely determines what legal authority is needed. Subscriber information identifies who holds an account: name, address, phone number. Transmission data, sometimes called metadata, describes communications without revealing their content: which number called which, when, for how long, and which cell tower or internet address was used. Location data shows where a device was. Content is the communication itself: the words of a text message, an email, a photo. As a general rule, the more revealing the information, the higher the grounds and the stronger the authorization required.

Subpoenas, court orders and preservation

The federal Stored Communications Act, 18 USC 2701 and following, governs how police obtain records from phone companies and online service providers. Basic subscriber information can be obtained with a subpoena. Other non-content records, such as call logs, require a court order under section 2703(d), which a judge issues if the government offers specific and articulable facts showing reasonable grounds to believe the records are relevant and material to an ongoing investigation. The content of communications requires a warrant. In Carpenter v. United States (2018), the Supreme Court held that obtaining seven days or more of historical cell site location records is a search requiring a warrant, and many departments, including Port Ardent, now obtain a warrant for any historical location data. Under section 2703(f), police can send a preservation letter requiring the company to preserve records for 90 days, renewable for another 90, while they obtain legal process.

On February 12, Ferreira sent the carrier a preservation letter for the listing number's records, then served a subpoena for its subscriber information. The carrier responded on February 16. When the DNA hit arrived on February 18, she applied for a search warrant for the phone's historical cell site location records for the evening of February 7, describing the robbery, the listing and the hit, and a judge issued it the same day. The subscriber was a prepaid account in the name 'C. Marsh' at an address on Elm Street. Desjardins notes that the subscriber name alone did not prove who used the phone, but combined with the DNA hit two days later, the vehicle registration and the address, it gave strong grounds for the arrest.

Location records and their limits

Historical cell site records show which cell tower and which sector of the tower a phone connected to when it made or received calls, texts or data sessions. They place the phone within the area served by that sector, which in a city may be a few hundred meters across and in rural areas several kilometers. They do not show the phone's exact position, and a phone may connect to a tower other than the nearest one when the network is busy. Experts called to explain cell site evidence in court should describe these limits. Other location sources, such as location history stored by phone operating systems or apps, can be more precise but raise additional privacy concerns and require their own legal authority.

# Records produced for the listing number, evening of February 7
# (time, tower-sector, type). Find records within 15 minutes of the robbery.
records = [
    ("21:12", "B-1", "data"),
    ("21:31", "B-1", "text"),
    ("21:40", "A-2", "data"),
    ("21:46", "A-2", "data"),
    ("21:53", "A-3", "text"),
    ("22:04", "B-1", "call"),
    ("22:15", "B-1", "data"),
]
robbery = 21 * 60 + 48
def mins(t):
    h, m = map(int, t.split(":")); return h * 60 + m
near = [r for r in records if abs(mins(r[0]) - robbery) <= 15]
for r in near:
    print(r)
print("records in window:", len(near), "of", len(records))
print("sectors in window:", sorted(set(r[1] for r in near)))

('21:40', 'A-2', 'data')
('21:46', 'A-2', 'data')
('21:53', 'A-3', 'text')
records in window: 3 of 7
sectors in window: ['A-2', 'A-3']

Three records fall within fifteen minutes of the robbery. Two, at 21:40 and 21:46, connect to sector 2 of tower A, the sector that serves Northgate Convenience; the third, at 21:53, connects to sector 3 of the same tower, which covers Pine Street to the west, the direction the hatchback drove. Records before and after connect to tower B, sector 1, which serves the area around Marsh's apartment. Desjardins asks what the records do not show. Linh Tran answers that they show where the phone was, not who was carrying it, and that they are consistent with the phone being at the store, not proof that it was inside. Ferreira's report described them in exactly those terms.

Seizing and searching devices

Phones and computers seized from a suspect hold enormous amounts of personal information, and courts in both countries treat searching them as highly intrusive. Under Riley v. California (2014), police generally need a warrant to search the digital contents of a phone seized during an arrest. The usual practice is to seize the device, protect it from remote wiping by placing it in a signal-blocking bag or airplane mode, record its condition, whether it was on or off, locked or unlocked, and any visible notifications, and then apply for a warrant that describes what may be searched for.

The search itself is carried out by trained digital forensic examiners using specialized tools that extract data without changing it, verified with hash values. Examiners should search only within the scope of the warrant, such as messages, photos and location data for a defined period, and record their methods. If they find evidence of a different crime outside the warrant's scope, they should stop and seek further authorization. When Marsh was arrested, his phone was seized, placed in a signal-blocking bag at 2:14 p.m. and logged into property at 3:30 p.m. A warrant issued on February 23 authorized a search for messages, photos, listings and location data from January 15 to February 20. The examiner found photographs of six sealed cigarette cartons on a bed, taken at 10:41 p.m. on February 7, and messages arranging their sale on February 10.

Financial and business records

Stolen property and money leave records. Bank records can show deposits after a robbery; payment app records can show the sale of stolen goods; store loyalty records can show who bought an item; pawn and second-hand dealer records, which many municipalities require dealers to keep and share with police, can show who sold property. Each requires the appropriate legal authority, and the request should be specific: the accounts, the time period and the kinds of records needed. Overbroad requests take longer, produce more irrelevant private information, and are more likely to be challenged. Ferreira obtained a search warrant for records of the payment app the buyer of the cigarettes had used, limited to transactions between the two accounts from February 9 to February 12. The records showed a payment of 180 dollars to Marsh's account on February 10.

Providers outside the country and other digital sources

Many online services store their data outside the country where the crime happened, and a court order issued locally may not reach them. American police can serve legal process on providers based in the United States wherever the data is stored, under the CLOUD Act of 2018, but data held by foreign providers usually requires a mutual legal assistance request through the Department of Justice, which can take months. Investigators should consult a prosecutor or the service's technical crime unit early when data is held abroad, and should send preservation requests at once, because the legal process may take far longer than the provider keeps its records.

Digital evidence is no longer limited to phones and computers. Modern vehicles record location, speed, door openings and paired phones in their infotainment and telematics systems. Smart doorbells, home assistants, fitness trackers and connected cars store data in the cloud as well as on the device. Ride-share and delivery apps record trips and drop-offs. Each source can corroborate or contradict an account, and each raises the same questions: who holds the data, how long they keep it, what legal authority is needed to obtain it, and how it can be copied without changing it. In the Northgate case, Marsh's hatchback was too old to have a telematics system, but the review noted that in a newer vehicle the car itself might have recorded its trip along Pine Street.

Investigators should also think about what digital evidence might show in favor of a suspect. Location data that places a phone far from the scene, a time-stamped message sent from home, or a streaming record showing a game being played at the time of the crime can support an alibi. Marsh told Ferreira he had been playing video games at home all evening. The gaming platform's records, obtained later with the appropriate authority, showed no activity on his account between 9:15 p.m. and 10:30 p.m. on February 7. Had they shown him online, that would have been important evidence for the defense, and it would have been disclosed in the same way.