State v. Cooper
Annotate this Case
Download PDF
NO. COA12-926 NORTH CAROLINA COURT OF APPEALS Filed: 3 September 2013 STATE OF NORTH CAROLINA v. Wake County No. 08 CRS 22922 BRADLEY GRAHAM COOPER Appeal by Defendant from judgment entered 5 May 2011 by Judge Paul G. Gessner in Superior Court, Wake County. Heard in the Court of Appeals 9 April 2013. Attorney General Roy Cooper, by Assistant Attorney General Daniel P. O'Brien and Assistant Attorney General LaToya B. Powell, for the State. Glover & Petersen, P.A., by Ann B. Petersen, for DefendantAppellant. McGEE, Judge. Bradley Graham Cooper (Defendant) and Nancy Lynn Rentz Cooper (Ms. Cooper) were married in October 2000, and they moved to Cary from Canada in January 2001. (the daughters). (Cisco). Defendant worked They had two daughters for Cisco Systems, Inc. By 2008, Defendant's marriage to Ms. Cooper was in difficulty and, by April 2008, Ms. Cooper had hired a family law attorney and planned to move out of the marital home. Defendant -2and Ms. Cooper were still living in the marital home in July 2008, though they were leading mostly separate lives and were sleeping in separate bedrooms. Defendant and Ms. Cooper attended a party at a neighbor's house on the evening of 11 July 2008. There was testimony that Defendant and Ms. Cooper argued at the party. Defendant left the party that evening, around 8:00 p.m., to put the daughters to bed. Ms. Cooper left the party a little after midnight, on 12 July 2008. Sometime during the morning of 12 July 2008, Ms. Cooper disappeared. Defendant subsequently gave the following account of events to investigators about the morning of 12 July 2008: one of the daughters awoke between 4:00 a.m. and 4:30 a.m., and had difficulty getting back to sleep. but there was none at the house. The daughter wanted milk, Defendant went to a Harris- Teeter at about 6:30 a.m. to buy milk, and then returned home. Ms. Cooper was doing laundry, but had run out of detergent. Defendant returned to the Harris-Teeter to buy detergent and, while on his way there, received a call from Ms. Cooper asking him to get some "green juice." Receipts and surveillance video from the Harris-Teeter confirm that Defendant bought milk at 6:25 a.m., left the store, then returned and bought detergent and juice at 6:44 a.m. After Defendant bought the detergent and -3juice, he returned home. to Defendant, running. when Ms. who was At about 7:00 a.m., Ms. Cooper called upstairs, and told him she was going Defendant remained at home with the daughters and, Cooper did not return from her run when expected, Defendant called a friend and cancelled a tennis date he had planned. house Defendant stated he did laundry and cleaned around the and, in the early afternoon, drove around with his daughters, looking for Ms. Cooper. Evidence at trial tended to show that police began questioning Defendant that same day, and asked if they could take photographs of the couple's house. and police photographed every room. Defendant consented, Defendant provided police with a pair of Ms. Cooper's running shoes in order to give a police tracking dog Ms. Cooper's scent. However, the dog could not pick up a trail. Police returned to the house the next morning, 13 July 2008, and questioned Defendant further. Police questioned Defendant more that day and the following day, 14 July 2008. Cary Police Detective George Daniels (Detective Daniels) asked Defendant for permission to look through Defendant's car and Ms. Cooper's car, and Defendant consented. At approximately 7:00 p.m. on 14 July 2008, a body was found just off Fielding Drive, which was a short drive from -4Defendant's and Ms. Cooper's house. Detective Daniels went to Defendant's house at approximately 10:00 p.m. on 14 July 2008, and informed Defendant that a woman's body had been found on Fielding Drive. At that time, identification of the body had not been determined. However, on 15 July 2008, the body was affirmatively identified from dental records as being that of Ms. Cooper. strangulation. specificity. some time The cause of death was determined to be The time of death could not be determined with However, it was determined that Ms. Cooper died in the twelve-hour period between shortly after midnight on 12 July when she was last seen at the party and approximately noon that same day. Around 5:20 p.m. on 15 July, Defendant vacated his house in order to preserve the house as a possible crime scene. One of Defendant's laptops (the laptop) was left in Defendant's house and was connected to the internet for approximately twenty-seven hours on 15 and 16 July, after Defendant had vacated the house. Cary police, pursuant to a warrant, searched both Defendant's house and his car on 16 July 2008. Police also seized the laptop, along with another computer, and various other computerrelated components. Defendant October 2008. was indicted for Ms. Cooper's murder Trial began on 28 February 2011. on 27 There was -5testimony concerning the strained relationship between Defendant and Ms. Cooper, Defendant, However, both the and suspicious behavior and Ms. before sole direct after evidence on Cooper's linking the part of disappearance. Defendant to the murder was obtained from the laptop that had been left on and connected to the internet after Defendant vacated his house. The State presented expert testimony from FBI Special Agent Greg Johnson (Special Agent Johnson) and Durham Police Detective Chris Chappell (Detective Chappell), both of whom testified as forensic computer analysts. Chappell were forensic Response Team (CART). Special Agent Johnson and Detective examiners of the forensic components. process CART Analysis CART extracts "evidence off of seized digital media" such as computer hard drives. the Computer then involves checks taking for any The first part of inventory portable of media the in or attached to the computer, opens up the case of the CPU and removes the hard drive(s). carefully so as not to CART handles all seized material compromise or contaminate the data. According to Special Agent Johnson's testimony, the integrity of the hard drive is protected by making a "forensic image" of the drive, which is "a copy that we make of the hard drive. It's a bit-per-bit copy, which gets every piece of . . . information off of the hard drive and puts it into what we call forensic -6image." Examination then occurs of a different hard drive containing the forensic image, not the original hard drive. The forensic image requires some type of specialized software to read and "interpret those files that it creates." Members of the CART team performed these forensic retrieval and information processing techniques on the hard drive from the laptop. The CART team used software called Forensic Tool Kit, or FTK, to process that hard drive. FTK and similar programs index files retrieved from the hard drive, allowing for specific searches for particular data to be performed. then created based upon the particular An FTK report was search parameters utilized. One of the sub-sets of files collected in the FTK report Defendant's for laptop was temporary internet history files for dates close in time to Ms. Cooper's murder. Special Agent Johnson and Detective Chappell testified that the temporary internet files recovered from the laptop indicated someone conducted a Google Map search on the laptop at approximately 1:15 p.m. on 11 July, the day before Ms. Cooper was murdered. They concluded that this search was done by someone using the laptop while it was at the Cisco office where Defendant worked. The State's experts testified that the Google Map search was initiated by someone who entered the zip code associated with Defendant's house, and then moved the map and -7zoomed in on the exact spot on Fielding Drive where Ms. Cooper's body was found. Defendant presented evidence at trial. Defendant called Jay Ward (Ward) to testify concerning the incriminating Google Map files recovered from the laptop. than fifteen computer years network in the security. Ward had worked for more computer When field, Defendant specializing called Ward, in the State objected, challenging Ward's credentials to testify as an expert concerning the relevant Google Map files. The State focused on Ward's lack of training and experience as a forensic computer analyst. The trial court agreed with the State and, on 19 April 2011, ruled that Ward could not testify specifically about the Google Map files. give could general be testimony altered or concerning planted the on a Ward was allowed to ease with which files computer that, like Defendant's, had been left connected to the internet. Defendant argued, since the trial court did not find the methods by which Ward obtained his data to be reliable, that Ward be allowed to testify based upon the data produced by the State's forensic analysts. The trial court denied Defendant's request. Ward testified on voir dire that had he been allowed to, he would have offered his opinion that the incriminating Google Map files had been planted on Defendant's computer, and he would have -8further testified to the specific aspects of the files that had led him to this conclusion. Following the trial court's ruling, Defendant immediately sought a forensic computer analyst that he could call to testify concerning the Google Map files. Defendant located a forensic computer analyst, Giovanni Masucci (Masucci), on 20 April 2011. As the court session began on 21 April 2011, Defendant gave notice of Masucci as Defendant's replacement expert. Masucci had examined the data produced by the State's forensic computer analysts, and produced a report. that the data results obtained by CART. obtained Masucci's report indicated by Ward matched the results Masucci's conclusion was the same as Ward's: that the Google Map files had "been placed on the hard drive [and] could activity." 22 April not have been the result of normal internet Masucci's curriculum vitae was sent to the State on 2011, and Masucci's report was sent the next day. Court was not in session on these days. Court resumed on 25 April 2011, and Defendant attempted to call Masucci. not on the The State objected on the basis that Masucci was list of experts Defendant provided to the State before trial, nor had the State been provided with Masucci's report prior to trial, and these failures constituted discovery rules violations. The trial court again agreed with the State, -9and ruled that Defendant had violated the discovery statutes by failing to notify the State that he was planning to call Masucci, and by failing to provide Masucci's curriculum vitae and report prior to the beginning of the trial. As a sanction for the discovery violations found by the trial court, the trial court ruled that Masucci could not testify. Pursuant to North Carolina Rule of Evidence 403, the trial court also ruled that allowing Masucci to testify would prejudice the State, and that this prejudice would substantially outweigh any probative value of Masucci's testimony. Defendant was prohibited from calling any witness to testify that the actual Google map files relied upon by the State to connect Defendant to the site where Ms. Cooper's body was found were corrupt or had been tampered with in any manner. The jury returned murder on 5 May 2011. a verdict I. brings guilty of first-degree Defendant was sentenced to life in prison without the possibility of parole. Defendant of forward Defendant appeals. Issues three arguments on appeal: (1) whether the trial court erred in precluding the testimony of Masucci as a sanction for discovery rules violations, (2) whether the trial court erred in limiting Ward's testimony and preventing Ward from testifying that, in his opinion, the Google -10Map files had been planted on the laptop and, (3) whether the trial court certain erred in discovery. denying We Defendant's address motion Defendant's to second compel argument first. II. Ward's Testimony In Defendant's second argument, he contends that "the trial court's ruling that . . . Ward was not qualified to give expert testimony about tampering on [Defendant's] computer was an abuse of discretion and deprived Defendant . . . of his state and federal constitutional due process right to present a defense." We agree. It is well settled that "appellate courts must 'avoid constitutional questions, even if properly presented, where a case may be resolved on other grounds.'" James v. Bartlett, 359 N.C. 260, 266, 607 S.E.2d 638, 642 (2005) (citation omitted). Generally, witness the decision testimony is of a trial reviewed for court an to abuse exclude of expert discretion. Howerton v. Arai Helmet, Ltd., 358 N.C. 440, 458, 597 S.E.2d 674, 686 (2004) (citation omitted). rights are not discretion.'" to be granted or However, "'[c]onstitutional withheld in the court's State v. Vereen, 312 N.C. 499, 508, 324 S.E.2d 250, 256 (1985) (citations omitted). The question presented here is one of law rather than discretion, for "(t)he right to -11. . . face one's accusers and witnesses with other testimony (is) guaranteed by the Sixth Amendment to the Federal Constitution which is made applicable to the States by the Fourteenth Amendment, and by Article I, Sections 19 and 23 of the Constitution of North Carolina." State v. Brower, 289 N.C. 644, 660, 224 S.E.2d 551, 562 (1976) (citation omitted); see also, State v. Mason, 295 N.C. 584, 589, 248 S.E.2d 241, 245 (1978); State v. Farrell, 223 N.C. 321, 32627, 26 S.E.2d 322, 325 (1943); State v. Banks, 210 N.C. App. 30, 47, 706 S.E.2d 807, 820 (2011) (citation omitted). We note that the motions to continue. present cases cited witness constitutes distinguish between the of a concern denials of However, if the denial of a right to a denial above defendant's error, constitutional right to we are unable significance present a witness of to the through denial of a continuance, and the denial of a defendant's right to present evidence. a witness through a misapplication of a rule of See Fry v. Pliler, 551 U.S. 112, 121-22, 168 L. Ed. 2d 16, 23-4 (2007); Holmes v. South Carolina, 547 U.S. 319, 32431, 164 L. Ed. 2d 503, 508-13 (2006); Montana v. Egelhoff, 518 U.S. 37, 52-53, 135 L. Ed. 2d 361, 373-74 (1996) (plurality opinion); Green v. Georgia, 442 U.S. 95, 99, 60 L. Ed. 2d 738, 742 (1979); Chambers v. Mississippi, 410 U.S. 284, 298-303, 35 L. Ed. 2d 297, 310-13 (1973). Of course, there can only be a -12constitutional violation invalid reason. if the evidence is excluded for an Holmes, 547 U.S. at 324-31, 164 L. Ed. 2d at 508-13. Accuracy in criminal proceedings is a particularly compelling public policy concern: The private interest in the accuracy of a criminal proceeding that places an individual's life or liberty at risk is almost uniquely compelling. Indeed, the host of safeguards fashioned by this Court over the years to diminish the risk of erroneous conviction stands as a testament to that concern. The interest of the individual in the outcome of the State's effort to overcome the presumption of innocence is obvious and weighs heavily in our analysis. Ake v. Oklahoma, 470 U.S. 68, 78, 84 L. Ed. 2d 53, 63 (1985). The United States Supreme Court has stated that a defendant on trial has a greater interest in presenting expert testimony in his favor than the State has in preventing such testimony: The State's interest in prevailing at trial - unlike that of a private litigant is necessarily tempered by its interest in the fair and accurate adjudication of criminal cases. Thus, also unlike a private litigant, a State may not legitimately assert an interest in maintenance of a strategic advantage over the defense, if the result of that advantage is to cast a pall on the accuracy of the verdict obtained. We therefore conclude that the governmental interest in denying [the defendant] the assistance of [an expert witness] is not substantial, in light of the compelling interest of both the State and the -13individual in accurate dispositions. Ake, 470 U.S. at 79, 84 L. Ed. 2d at 63-64. Nonetheless, trial courts are granted substantial freedom to regulate conduct and evidence at trial: We acknowledge also our traditional reluctance to impose constitutional constraints on ordinary evidentiary rulings by state trial courts. In any given criminal case the trial judge is called upon to make dozens, sometimes hundreds, of decisions concerning the admissibility of evidence. As we reaffirmed earlier this Term, the Constitution leaves to the judges who must make these decisions "wide latitude" to exclude evidence that is "repetitive . . ., only marginally relevant" or poses an undue risk of "harassment, prejudice, (or) confusion of the issues." Moreover, we have never questioned the power of States to exclude evidence through the application of evidentiary rules that themselves serve the interests of fairness and reliability even if the defendant would prefer to see that evidence admitted. Crane v. Kentucky, 476 U.S. 683, 689-90, 90 L. Ed. 2d 636, 644 (1986) (citations omitted). Court discussed the impact In Crane, the United States Supreme on a defendant's trial of the exclusion of evidence favorable to the defendant bearing on a central issue in the trial: [W]ithout "signal(ing) any diminution in the respect traditionally accorded to the States in the establishment and implementation of their own criminal trial rules and procedures," we have little trouble concluding on the facts of this case that the blanket exclusion of the proffered -14testimony about the petitioner's confession fair trial. circumstances of deprived him of a Whether rooted directly in the Due Process Clause of the Fourteenth Amendment, or in the Compulsory Process or Confrontation Clauses of the Sixth Amendment, the Constitution guarantees criminal defendants "a meaningful opportunity to present a complete defense." We break no new ground in observing that an essential component of procedural fairness is an opportunity to be heard. That opportunity would be an empty one if the State were permitted to exclude competent, reliable evidence bearing on the credibility of a confession when such evidence is central to the defendant's claim of innocence. In the absence of any valid state justification, exclusion of this kind of exculpatory evidence deprives a defendant of the basic right to have the prosecutor's case encounter and "survive the crucible of meaningful adversarial testing." Id. at 690, 90 L. Ed. 2d at 645 (citations omitted). Though the above they citations involve constitutional questions, also inform our analysis of whether there was an abuse of discretion in preventing Ward from giving his opinion that the Google Map files from Defendant's laptop had been tampered with. Rule 702 A. The admissibility of expert testimony is controlled by Rule 702 of the North Carolina Rules of Evidence:1 1 Rule 702 was amended by S.L. 2011-283, § 1.3. However, these changes only apply to actions commenced on or after 1 October -15"If scientific, technical or other specialized knowledge will assist the trier of fact to understand the evidence or to determine a fact in issue, a witness qualified as an expert by knowledge, skill, experience, training, or education may testify thereto in the form of an opinion." N.C. Gen. Stat. § 8C 1, Rule 702(a) (2004). "It is well-established that trial courts must decide preliminary questions concerning . . . the admissibility of expert testimony." Howerton v. Arai Helmet, Ltd., 358 N.C. 440, 458, 597 S.E.2d 674, 686 (2004). . . . . Howerton sets forth a three-step test for determining the admissibility of expert testimony: "(1) Is the expert's proffered method of proof sufficiently reliable as an area for expert testimony? (2) Is the witness testifying at trial qualified as an expert in that area of testimony? (3) Is the expert's testimony relevant?" . . . . "'The essential question in determining the admissibility of opinion evidence is whether the witness, through study and experience, has acquired such skill that he is better qualified than the jury to form an opinion as to the subject matter to which his testimony applies.'" Miller v. Forsyth Mem'l Hosp., Inc., 173 N.C. App. 385, 389, 618 S.E.2d 838, 841-42, on reh'g, 174 N.C. App. 619, 625 S.E.2d 115 (2005) (some citations omitted). "[W]e discern no qualitative difference based training between and those credentials acquired through on practical Howerton, 358 N.C. at 462, 597 S.E.2d at 688. 2011. formal, academic experience." In Howerton, our -16Supreme Court expressly rejected the adoption of the federal standard for assessing the foundational reliability of expert testimony as set forth in Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579, 125 L. Ed. 2d 469 (1993). Howerton, 358 N.C. at 469, 597 S.E.2d at 693. In rejecting the Daubert approach, our Supreme Court stated: One of the most troublesome aspects of the Daubert "gatekeeping" approach is that it places trial courts in the onerous and impractical position of passing judgment on the substantive merits of the scientific or technical theories undergirding an expert's opinion. We have great confidence in the skillfulness of the trial courts of this State. However, we are unwilling to impose upon them an obligation to expend the human resources required to delve into complex scientific and technical issues at the level of understanding necessary to generate with any meaningfulness the conclusions required under Daubert. Id. at 464-65, 597 S.E.2d at 690. "'[F]ew judges possess the academic credentials or the necessary experience and training in scientific disciplines to separate competently high quality, intricate scientific research from research that is flawed[.]'" Id. at 466, 597 S.E.2d at 691 (citation omitted). Our Supreme Court cited a critic of Daubert, who opined that the "postDaubert era can fairly be described as the period of 'strict scrutiny' of science by non-scientifically trained judges[,]" Id. at 466, 597 S.E.2d at 691 (citation omitted); see also id. -17at 460-61, 597 S.E.2d at 687-88. Carolina approach is decidedly "[A]pplication of the North less mechanistic and rigorous than the 'exacting standards of reliability' demanded by the federal approach." Id. at 464, 597 S.E.2d at 690. cross-examination, presentation of contrary "'[V]igorous evidence, and careful instruction on the burden of proof are the traditional and appropriate evidence.'" means of attacking shaky but admissible Id. at 461, 597 S.E.2d at 688 (citation omitted); see also, Crocker v. Roethling, 363 N.C. 140, 675 S.E.2d 625 (2009). The United States Supreme Court has also stated that the right of a defendant to present witnesses in the defendant's defense is fundamental: Few rights are more fundamental than that of an accused to present witnesses in his own defense[.] Indeed, this right is an essential attribute of the adversary system itself. "We have elected to employ an adversary system of criminal justice in which the parties contest all issues before a court of law. The need to develop all relevant facts in the adversary system is both fundamental and comprehensive. The ends of criminal justice would be defeated if judgments were to be founded on a partial or speculative presentation of the facts. The very integrity of the judicial system and public confidence in -18the system depend on full disclosure of all the facts, within the framework of the rules of evidence. . . ." The right to compel a witness' presence in the courtroom could not protect the integrity of the adversary process if it did not embrace the right to have the witness' testimony heard by the trier of fact. The right to offer testimony is thus grounded in the Sixth Amendment even though it is not expressly described in so many words: "The right to offer the testimony of witnesses . . . is in plain terms the right to present a defense, the right to present the defendant's version of the facts as well as the prosecution's to the jury so it may decide where the truth lies. Just as an accused has the right to confront the prosecution's witnesses for the purpose of challenging their testimony, he has the right to present his own witnesses to establish a defense. This right is a fundamental element of due process of law." Taylor v. Illinois, 484 U.S. 400, 408-09, 98 L. Ed. 2d 798, 810 (1988) (citations omitted); see also Rock v. Arkansas, 483 U.S. 44, 54-55, 97 L. Ed. 2d 37, 48-9 (1987). With these principles in mind, we must evaluate evidence regarding Ward's experience and credentials to determine if the trial court erred in excluding Ward's opinion testimony that the Google Map files located on the laptop had been tampered with. B. -19After the State concluded presentation of its evidence, it moved in limine to exclude Ward from testifying. Defendant objected: [Defendant's counsel]: And, Your Honor, we -- we would certainly object at this time to a motion in limine, given the fact that the State has had Mr. Ward on the witness list as a potential expert for quite some time now, with no -- no notice as to the concept that they were going to be moving in limine to exclude his testimony. If that was the route that they were seeking to take, that should have occurred at a more appropriate time. I certainly understand, if he wants to take Mr. Ward on voir dire, that that is appropriate. The trial court denied Defendant's objection, and Ward testified on voir dire as indicated below. Ward testified on voir dire that his interest in computers began in 1982, administrator by and a that he was Research first Triangle hired Park as a company network called Persimmon Information Technologies in approximately June 1997. This job included "ensuring that all of the firewall rules were correct[,]" which broadly meant keeping "unintended people out" of the computer computers. system, which consisted of a few hundred Most of the security issues Ward addressed during this time were "intrusion attempts from the internet." In order to determine where those intrusions came from, Ward examined log -20files and the timestamps on the log files to "create a time line to find out exactly what's going on." In November Healthcare senior in Charlotte firewall consisted of 1998, Ward as began its "senior administrator[.]" reviewing computer working The log for Carolinas security analyst, bulk Ward's files, of because on projects to insure the safe movement work "[t]hat's where you find most of the activity on the network." worked or of Ward private medical data between the member practices and institutions of Carolinas Healthcare. Identifying "intrusion" into the system was one of Ward's job duties. Ward was working with thousands of systems, and described some of his duties and concerns as follows: Well, it's -- it's not just [knowing] computer operating systems as required. It's a -- a plethora of things, from understanding the communications path of how packets move across the internet, so there's a networking aspect to it. There's also a -- a component for the system -- the actual host or the actual server, what's going on, understanding how the various ports that are open on a machine might be used either for good or maliciously, which kind of goes into the field of understanding how viruses work, or Trojans work and the types of things that they are trying to attempt to access on a computer. Also, too, how things are written to logs in the event for logons, for processes that are actually functioning or being triggered on the machine, and if any of the -- the files have been changed. -21So, and -- and towards that vein, one of the things that we would -- we would typically use, but you don't find it much any more, is a program called Tripwire. And Tripwire is used for integrity of files. So basically you run a script against all of your files once you have a production-ready level server, and it will actually do hashes of all of the files on the system, put them off to a side and then, in the event that any of those files change, you -- you then have a - a potential way to go back and say, okay, this file was changed; we need to reinstall the correct version in the event of any sort of penetration. In 1999, Ward began working for First Citizens Bank as a senior security engineer. Ward testified that his two biggest projects at First Citizens were ensuring "the security of the internet pipe," and developing "the ability for First Citizens to take [its] online banking platforms, move them from the third party and move them in-house, so that we had complete control over them." Part of this involved "architecting the security infrastructure," and "ensuring that security, not only at the perimeter place, via but firewalls also that and host protect services between for five detection detection or was in intrusion Ward estimated that his computer First and intrusion intrusion prevention was in place." security via Citizens seven bank billion were dollars helping in to assets. Ward's work at First Citizens included both the network system -22as a whole and individual computer work station security. Ward testified: As . . . part and parcel of reviewing the logs well, you'll often see things [in the files] that are just that don't look right or track patterns don't look right[.]. . . And in so doing, I would often find potential - or intrusion attempts that were basically knocking on the door on the outside of the firewall. Ward was also responsible for investigating suspicious activity of employees, including investigating employees' internet histories. Ward testified that he used specialized software programs, such as EnCase and FTK, to assist in sorting through file data, but that there were limitations in using the software alone: I think that Agent Johnson or any other FBI worth their salt will tell you that it's not just tools that are important, but what you look at and understanding how -- how things look in any sort of log files and to give you, not necessarily a hunch, but things that don't look right, based upon experience of having done it for so long. So typically -- typically, whenever you see something like an internet port scan or something like that, they're automated tools -- right? -- that anybody can run. Just click a little button and it will go out and it will look for the -- the low-hanging fruit, if you will. Seeing those types of things in logs is generally a good first indication that something is amiss, or that someone is doing recognizance work against your network. -23Q. Now, . . . when looking for people's internet activity or towards a potential theft, did the time of the conduct ever become an issue in your investigations? A. It did. . . . . . . . . Q. When performing that task and attempting to evaluate the time of activity, would you rely solely on a tool like EnCase or FTK? A. Absolutely not. Q. And why not? A. Well, there's -there's several reasons. Don't get me wrong, those types of tools are great for things that may have happened on an individual machine; however, there are some shortcomings of any software program. They're in general only as good as the people that -- that write them or the -the specs that people have asked them to write them to. It wouldn't necessarily capture all of the information that may have been traversing the network. Additionally, as I say, the reports that are generated from these types of forensic tools are generally -- are generally good, as -as an overall statement, in providing you with vast amounts of information. And -and, specifically in this case, I think that there were 170 something thousand files to look through, which is -- which is fine; however, trying to pinpoint something in those files and knowing exactly -- or being able to research and find out what the individual files are becomes a little more problematic. And these tools don't necessarily go to that level, so it's -- it's based upon experience -24in having gone through some of these types of things before that -- it's important to look into the actual files, especially within a specific time frame that the alleged activity was supposed to have occurred. Q. Are you familiar with the terms "file name attributes" and "system information attributes"? A. I am. Q. And are you aware if the tools EnCase and FTK are even capable of evaluating file name attribute? A. They are not. Not only that, but FTK is actually not capable of noticing any file modifications or signature modifications on a file. So, if you were to change like a -a file extension, or something like that, it's not going to pick that up. Ward began working as an "information architect" for Cisco Systems in 2002. security Ward testified that he had many duties at Cisco, and described one such duty as follows: I was on the team for the implementation for Cisco's public key infrastructure. Now, I realize you might not know what that means, so suffice it to say that it -- it involves a -- a high understanding of cryptography, of encryption and decryption as it pertains to certificates. So -- and -- and I'll give you a really good example. A certificate that, when you go to a website and you go to a secure website and it brings up the certificate, you've probably never looked at it; most people don't. But those types of things have a -- a trust chain, so -- and they're all mathematically linked by virtue -25of a public key infrastructure. In approximately 2005, then known as "@stake." hacking company[.]" Ward began working for Symantec, Ward described Symantec as a "white hat Symantec was hired by Fortune 500, Fortune 1000 companies, municipalities, governments, states to do penetration testing exercises. And that could be from the mobility side, which would be wireless, from web application, from external network penetration, to internal network penetration, to check for vulnerabilities internally, as social engineering, and obviously pretending to be someone that you're not in order to infiltrate some place else. Ward's job was "[k]eeping people out of assets that they are not supposed to be in." Ward "hundreds" of these tests. testified that he had conducted Ward further testified that part of his job was looking at the file logs on particular computers to determine if there had been an intrusion and, if so, "what had happened." Part of this process was using forensic tools, including FTK, EnCase, and others. In 2007, Ward left Symantec to form his own computer system security company, WireGhost Security, Inc. (WireGhost), a Raleigh-based computer network security company. At the time of trial, Ward was still the owner of WireGhost. Ward described his business as: assessments, . . . host "Penetration hardening, testing, understanding the risk internals -26of computers." When asked on voir dire if his business was to protect computers "from somebody getting into" the computers, he answered in the affirmative. Ward testified that he was a Certified Information Systems Security Professional, a Cisco-certified network professional, and also had multiple firewall certifications. Ward was a member of InfraGard, "the public and private joint partnership between security professionals and . . . the Federal Bureau of Investigation[,]" and served as its vice-president from 2003 to 2005. Ward had also published multiple articles in the field of data security. On cross-examination, Ward testified that his resume did not include anything specifically concerning "forensic examinations of computers" and that his expertise was primarily "in the field of network security[.]" Ward testified that he had only done two forensic examinations, involving approximately nine computers. Ward testified that he did not hold a certification for the EnCase software he used to conduct the forensic examinations in those two instances. Ward: "And then you're asked to investigate The State asked forensically investigate the computers in this case; is that accurate?" Ward responded: "I was asked to look at the analysis as provided by the FBI for this case." When asked if he was an expert in -27forensics, Ward replied: "No, sir. analyze the data." The following But you don't have to be to colloquy occurred between Defendant's attorney and Ward: Q. [Y]ou've spoken about specifically doing forensics on machines. A. Correct. Q. The remainder of your job as a . . . senior security analyst for the last 18 years, has that involved researching specific incidents on machines, finding out the cause, and looking into exactly what happened at set instances in time? A. Yes, sir. . . . . Q. When you say that you'd only done [two computer forensic analyses] . . . you're not including in that all of the separate instances as a security analyst . . . where you've looked at individual work stations to evaluate whether there was tampering present on those work stations[.] A. Ward [C]orrect. then testified that the number of individual work stations he had evaluated in his career "to determine whether or not there testified was that tampering" it was was "in "standard the hundreds." operating Ward procedure" also to investigate the internet history of computers he examined to determine, as Defendant's attorney put it, "what happened at what time[.]" Ward testified that normally, "every single time -28I'm asked to look at a computer[,]" one of the places he [would] check was "the temporary internet files." Q. And what was it that you were asked to verify in this particular case? A. That occurred. tampering possibly could have Q. With what type of files? A. With Google Map files. Q. And are those temporary internet files? A. Indeed they are, sir. Q. And that's the type of exam you've done hundreds of times? A. Yes. While admitting that he was not formally trained or certified on any forensic tools, Ward testified that he did not think that was important because "the only thing I was trying to do [was] [replicate] what the FBI had done so that I was looking at . . . the same type of . . . data." Ward testified that when he conducted those tests and extracted that data, the defense had not yet been provided with the data recovered by the FBI using FTK or any other forensic tools. Ward testified that, later, after comparing what he retrieved with what was retrieved by the FBI, he would know if the data he obtained matched the FBI data. given On 18 April 2011, Ward was asked when he was "first opportunity to even look at the FBI's version of the -29master file tables?" Ward responded: "It was late last week when they gave -- gave us a copy of the CD-Rom." There was testimony by the State's witnesses suggesting that the Google Map file data recovered by Ward was substantially similar to that recovered by the FBI. C. Following voir dire, Defendant's counsel argued that Ward should be qualified as an expert because his "knowledge, skill, experience, rather files than training, the recovered jury, from [and] to education" make better determinations Defendant's hard drive. qualified concerning him, the Defendant's counsel argued: I believe that [Ward] qualifies in every possible respect as an expert, that the data extraction itself is actually irrelevant to this testimony, as the the exact same conclusions that Mr. Ward draws from his own data, can be drawn simply from the FBI's data. As we have heard from testimony, Officer Chappell testified that the MFT [(master file table)] that we have provided was substantially similar to the one that they had provided. And, in fact, went on to compare the error rates in timestamps between the two, but never actually attacked the validity of the data that we had provided in our own MFT, and had an opportunity to do that. Now, I I don't think there is any question but that Mr. Ward is the appropriate and qualified witness. -30The State examiner," attacked highlighting Ward's Ward's experience testimony as that a he "forensic was not certified on the forensic tools he used to extract his data, that he had not performed many forensic examinations in the past, that he had never testified as an expert, that there was no way for the State to replicate the tests Ward performed, and that Ward testified that he did not consider himself an "expert" in forensic computer analysis. if the State did not Defendant's counsel argued that, trust Ward's techniques extraction, Ward could testify using the FBI data: [Defendant's counsel]: We could switch out all of the data that [the State's] talking about, and Mr. Ward can give the exact same opinion based on the data that the FBI has provided. Since whether or not Mr. Ward recalls, or whether or not [the State] is going to state it, the data's the same with the exception of the last -- with the exception of millionths of a second. They have the same number of invalid timestamps. We can simply accept that data, if [the State] has some question as to the extraction techniques. But moreover, what [the State] is not addressing is that there is a hierarchy of expertise in computers, and there are people that are able to do lower-level tasks, such as working with programs, pushing buttons, making things like forensic tool kit churn out a result. And, as you go up the hierarchy, the people who are at the pinnacle are actually those who are capable of network and system administration, and who are capable of detecting that kind of for data -31intrusion and tampering. That is actually the same kind of training that Special Agent Johnson had, with respect to intrusion. We go to Officer Chappell, on the other hand, he had looked at, I believe, five computers prior to this case. So the idea that [the State] is attempting to impeach Mr. Ward's capabilities, I -given his wealth of experience, and specifically his wealth of experience in identifying tampering, is absurd. And I believe that this is entirely within the jury's province. The trial concerning the court FBI asked data Defendant would be "as security professional Ward's testimony forensic a Defendant's counsel answered, "No, sir. computer if examiner." That's his opinion as a that tampering occurred. Determination as to whether something has been penetrated, and as to whether something has been tampered with, is directly within the province of a computer security professional, and that is exactly what Mr. Ward is." The trial court ruled that Ward could testify as "an expert witness in the field of network security and vulnerability assessment[,]" but not as an expert "forensic examiner[.]" The trial the court was troubled that there were "a number of reports and tests that that being specifically the Helix test that's not in [Ward's] report, and that he was supervised and told what to do by someone else [when using some of the forensic software]." -32When asked by Defendant's counsel if the trial court's ruling prevented Ward from testifying about the FBI data, the trial court stated, "he is not qualified to interpret their data because that data was admitted as a forensic analysis or analyst data, and testify that's as a that would forensic basically analyst, and . . . testifying from it." by be allowing taking him their to data The trial court stated that its ruling was based primarily on State v. Ward, 364 N.C. 133, 694 S.E.2d 738 (2010). The trial court then also excluded Ward's testimony, based upon Rule 403 of the North Carolina Rules of Evidence, ruling that the probative value of the evidence to Defendant was substantially outweighed by the prejudicial effect of that evidence to the State. D. Even if we assume, without deciding, that the trial court did not err in excluding Ward from testifying as an expert in forensic computer analysis, the trial court did err in limiting Ward's testimony in such a manner that prevented him from testifying concerning data retrieved from the laptop, including the Google Map files. The bulk of the voir dire, and the arguments by the State in favor experience of in excluding forensic Ward's data testimony, retrieval. centered on According Ward's to the -33testimony of Special Agent Johnson and Detective Chappell, forensic data retrieval included: securing and removing a hard drive, protecting the hard drive from further alteration, creating forensic copies of the hard drive to use for analysis, and then using specialized software to retrieve and catalog digital data from the forensic copy of the hard drive. The State did not seriously challenge Ward's ability to understand and interpret the actual data retrieved, and the voir dire testimony indicated that Ward had been examining precisely the kind of files at issue temporary internet files on a regular basis throughout his long career as a digital data security professional. It is not necessary that an expert be experienced with the identical subject matter at issue or be a specialist, licensed, or even engaged in a specific profession. It is enough that the expert witness "because of his expertise is in a better position to have an opinion on the subject than is the trier of fact." State v. Morgan, 359 N.C. 131, 160, 604 S.E.2d 886, 904 (2004) (citation omitted). According to his voir dire testimony, Ward was engaged in a specific profession in the type of analysis in which the defense wanted him to testify, and was experienced with the identical subject matter temporary internet files -34at issue. Ward was certainly "in a better position to have an opinion on the subject than [wa]s the trier of fact." The trial court apparently believed that, Id. because the digital data was recovered using forensic tools and methods, only an expert forensic computer analyst was qualified interpret and form opinions based on the data recovered. to The evidence on voir dire does not support this understanding of the nature of Ward's expertise. Assuming arguendo that the data Ward recovered from the forensic copy of the hard drive was suspect, neither the State nor Defendant argued that the data recovered by the State's experts was flawed just that there was disagreement Nothing in concerning evidence the supports interpretation a finding that of that Ward was qualified to testify using the data recovered by the Ward, "acquired based experience," upon expertise through data. not State. practical Howerton, 358 N.C. at 462, 597 S.E.2d at 688, was certainly "better qualified than the jury to form an opinion as to the subject matter to which his testimony applie[d]." Miller, 173 N.C. App. at 389, 618 S.E.2d at 841-42; see also, generally, State v. Ward, 364 N.C. 133, 694 S.E.2d 738 (2010); Crocker v. Roethling, 363 N.C. 140, 675 S.E.2d 625 (2009). We cannot find sufficient evidence in the record to support the trial court's exclusion of Ward's testimony, as indicated -35above, for any of the three prongs of the Howerton analysis. Howerton, 358 N.C. at 458, 597 S.E.2d at 686. The Google Map files recovered from Defendant's laptop were perhaps the most important pieces of evidence admitted in this trial. We hold that the trial court abused its discretion in excluding Ward from testifying, relying on the State's own evidence, to his opinion that the Google Map files recovered from Defendant's laptop had been tampered with. Assuming discretion arguendo in the disallowing trial court Ward from did not giving abuse his its opinion concerning the Google Map files, James, 359 N.C. at 266, 607 S.E.2d at 642, we hold that the trial court erred in violation of the constitutions of the United States and North Carolina. Farrell, 223 N.C. at 326-27, 26 S.E.2d at 325. Rule 403 The trial court also excluded Ward's testimony pursuant to Rule 403 of the North Carolina Rules of Evidence. states: "Although relevant, evidence may be Rule 403 excluded if its probative value is substantially outweighed by the danger of unfair prejudice, confusion of the issues, or misleading the jury, or by considerations of undue delay, waste of time, or needless presentation Rule 403 (2011). of cumulative evidence." N.C.R. Evid. "Whether or not to exclude evidence under Rule -36403 of the discretion Rules of the of Evidence trial court is a and matter its within decision the will sound not be disturbed on appeal absent a showing of an abuse of discretion." State v. McCray, 342 N.C. 123, 131, 463 S.E.2d 176, 181 (1995) (citation omitted). However, [t]he question presented here is one of law rather than discretion, for "(t)he right to . . . face one's accusers and witnesses with other testimony (is) guaranteed by the Sixth Amendment to the Federal Constitution which is made applicable to the States by the Fourteenth Amendment, and by Article I, Sections 19 and 23 of the Constitution of North Carolina." Brower, 289 N.C. at 660, 224 S.E.2d at 562 (citations omitted). The probative value of the testimony excluded was not "outweighed by the danger of unfair prejudice, confusion of the issues, or misleading the jury, or by considerations of undue delay, waste of time, or needless presentation of cumulative evidence." N.C.R. Evid. Rule 403. We hold that the exclusion of Ward's testimony constituted an abuse of discretion pursuant to general Rule 403 analysis. Prejudice The sole physical evidence linking Defendant to Ms. Cooper's murder was the alleged Google Map search, conducted on Defendant's laptop, of the exact area where Ms. Cooper's body was discovered. Absent this evidence, the evidence connecting -37Defendant to this crime was primarily potential opportunity, and testimony of suspicious behavior. motive, We hold, whether the error was constitutional or not, that erroneously preventing Defendant challenging from arguably the presenting strongest expert piece of testimony, the State's evidence, constituted reversible error and requires a new trial, because "there is a reasonable possibility that, had the error in question not been committed, a different result would have been reached at the trial out of which the appeal arises." N.C. Gen. Stat. § 15A-1443(a) (2011); see also Taylor, 484 U.S. at 409, 98 L. Ed. 2d at 810-11; State v. Moore, 321 N.C. 327, 34447, 364 S.E.2d 648, 656-58 (1988). Assuming constitutional analysis applies, we also hold that the State has failed to show that the error was "harmless beyond a reasonable doubt." N.C.G.S. § 15A-1443(b). III. In Defendant's first argument, he contends that the trial court erred in precluding the testimony of Masucci, a forensic computer analyst, violations[.]" 'as a sanction for purported discovery We agree. In light of our holding above, and because this issue is not likely argument. to recur, However, we are resolution not of required this to issue address presents this an -38alternate basis for granting a new trial. Therefore, in an abundance of caution, we address it. The State did not indicate before trial that it intended to challenge Ward. Defendant called Ward, intending for Ward to testify, based upon his analysis of the data recovered from Defendant's laptop, that the Google Map files had been tampered with. the The State successfully moved to exclude this testimony on basis analysis. that Ward Defendant was not quickly an expert located in computer Masucci, an forensic expert in computer forensic analysis, to provide the testimony Ward was prevented from giving. The State then moved to exclude Masucci as a sanction for violation of discovery rules. Based upon the facts in this case, Defendant was required under N.C. Gen. Stat. § 15A-905 (2011) to: Give notice to the State of any expert witnesses that the defendant reasonably expects to call as a witness at trial. Each such witness shall prepare, and the defendant shall furnish to the State, a report of the results of the examinations or tests conducted by the expert. The defendant shall also furnish to the State the expert's curriculum vitae, the expert's opinion, and the underlying basis for that opinion. The defendant shall give the notice and furnish the materials required by this subdivision within a reasonable time prior to trial, as specified by the court. Generally, "[w]hether a party has complied with discovery and what sanctions, if any, should be imposed are questions -39addressed to the sound discretion of the trial court." State v. Tucker, 329 N.C. 709, 716, 407 S.E.2d 805, 810 (1991) (citation omitted). A trial court may grant a continuance or recess, prohibit the party from introducing evidence not disclosed, or impose orders. other sanctions for failure to comply with discovery N.C. Gen. Stat. § 15A 910(a)(2) (2011). However, the "Sixth Amendment [of the United States Constitution] 'guarantees a defendant's right to confront those "who bear testimony" against him.' Melendez Diaz, 557 U.S. at ___, 174 L. Ed. 2d at 321 (quoting Crawford, 541 U.S. at 51, 124 S.Ct. 1354, 158 L. Ed. 2d at 193)." State v. Galindo, 200 N.C. App. 410, 413, 683 S.E.2d 785, 787 (2009). The Sixth Amendment also guarantees a defendant's right to present a defense: "Just as an accused has the right to confront the prosecution's witnesses for the purpose of challenging their testimony, he has the right to present his own witnesses to establish a defense. This right is a fundamental element of due process of law." Washington v. Texas, 388 U.S. 14, 19, 18 L. Ed. 2d 1019, 1023 (1967). The United States Supreme Court addressed the issue of whether the refusal to allow an undisclosed witness to testify violated the petitioner's constitutional right to obtain the testimony of favorable witnesses in Taylor v. Illinois, 484 U.S. 400, 98 L.Ed.2d 798. In Taylor, the United States Supreme Court stated that "'criminal defendants have -40the right to the government's assistance in compelling the attendance of favorable witnesses at trial and the right to put before a jury evidence that might influence the determination of guilt.'" "Few rights are more fundamental than that of an accused to present witnesses in his own defense. Indeed, this right is an essential attribute of the adversary system itself." State v. Gillespie, 180 N.C. App. 514, 519, 638 S.E.2d 481, 485 (2006) review allowed, writ allowed, 361 N.C. 362, 646 S.E.2d 369 (2007), and adopted as modified, 362 N.C. 150, 655 S.E.2d 355 (2008). The United States Supreme Court has stated that rules of evidence do not abridge an accused's right to present a defense so long as they are not 'arbitrary' or 'disproportionate to the purposes they are designed to serve.' Moreover, we have found the exclusion of evidence to be unconstitutionally arbitrary or disproportionate only where it has infringed upon a weighty interest of the accused. United States v. Scheffer, 523 U.S. 303, 308, 140 L. Ed. 2d 413, 418-19 (1998) (citations omitted). constitutional witness right testimony if to present that Therefore, a defendant has a otherwise testimony significant factor' in the defense." is admissible "'likely to expert be a Tucker, 329 N.C. at 718- 19, 407 S.E.2d at 811 (citations omitted). -41In the present case, the only evidence presented by the State directly linking Defendant to the murder was the evidence of the Google Map search pinpointing the location where Cooper's body was found. presentation of "significant factor" barred presenting from that Evidence evidence in would Defendant's any challenging have clearly defense. evidence from the his State's been Defendant own Ms. a was witnesses concerning the Google Map files recovered from the laptop. The right of the defendant to present evidence "stands on no lesser footing than the other Sixth Amendment rights that we have previously held applicable to the States." We cannot accept the State's argument that this constitutional right may never be offended by the imposition of a discovery sanction that entirely excludes the testimony of a material defense witness. Taylor, 484 U.S. at 409, 98 L. Ed. 2d at 810-11 (citations omitted). We assume, arguendo, N.C.G.S. § 15A-905. that Defendant technically violated Though exclusion of Masucci's testimony may not have been arbitrary, we hold that it was disproportionate to the purposes serve. indigent this state's discovery rules were intended to Our Supreme Court found that denial of funds to an defendant to obtain an expert witness unconstitutional for the following reasons: In the present case, defendant demonstrated that the determination of his guilt or was -42innocence would hinge largely on the unrebutted testimony of the state's fingerprint expert. Defendant requested a fingerprint expert not to engage in some amorphous fishing expedition . . . but to enable him, and ultimately perhaps the jury, to assess more accurately the one item of hard evidence implicating him in the crimes charged. Under these circumstances, denying defendant the assistance of a fingerprint expert denied him "an adequate opportunity to present his claims fairly within the adversary system." State v. Moore, 321 N.C. 327, 347, 364 S.E.2d 648, 656 (1988) (citation omitted). All else being equal, the prejudice to a defendant is the same whether he is prevented from presenting expert testimony due to indigence, or as a sanction for discovery rules violations. The United States Supreme Court determined in Taylor that: A trial judge may certainly insist on an explanation for a party's failure to comply with a request to identify his or her witnesses in advance of trial. If that explanation reveals that the omission was willful and motivated by a desire to obtain a tactical advantage that would minimize the effectiveness of cross-examination and the ability to adduce rebuttal evidence, it would be entirely consistent with the purposes of the Compulsory Process Clause simply to exclude the witness' testimony. Cf. United States v. Nobles, 422 U.S. 225, 45 L. Ed. 2d 141 (1975). Taylor, 484 U.S. at 415, 98 L. Ed. 2d at 814 (footnote omitted). However, the Court's later holding in Michigan v. Lucas stated: We did not hold in Taylor that preclusion is -43permissible every time a discovery rule is violated. Rather, we acknowledged that alternative sanctions would be "adequate and appropriate in most cases." We stated explicitly, however, that there could be circumstances in which preclusion was justified because a less severe penalty "would perpetuate rather than limit the prejudice to the State and the harm to the adversary process." Taylor, we concluded, was such a case. The trial court found that Taylor's discovery violation amounted to "willful misconduct" and was designed to obtain "a tactical advantage." Based on these findings, we determined that, "[r]egardless of whether prejudice to the prosecution could have been avoided" by a lesser penalty, "the severest sanction [wa]s appropriate." Michigan v. Lucas, 500 U.S. 145, 152, 114 L. Ed. 2d 205, 214 (1991) (citations omitted). The First Circuit has presented the rationale of Taylor in a way we find instructive: Although the Taylor Court declined to cast a mechanical standard to govern all possible cases, it established that, as a general matter, the trial judge (in deciding which sanction to impose) must weigh the defendant's right to compulsory process against the countervailing public interests: (1) the integrity of the adversary process, (2) the interest in the fair and efficient administration of justice, and (3) the potential prejudice to the truth-determining function of the trial process. The judge should also factor into the mix the nature of the explanation given for the party's failure seasonably to abide by the discovery request, the willfulness vel non of the violation, the relative simplicity of compliance, and whether or not some unfair tactical advantage has been sought. -44Chappee v. Vose, 843 F.2d 25, 29 (1st Cir. 1988) (citations omitted). Defendant, in failing State, was clearly not trial court made no after the provide earlier of willful misconduct, had no to the The and the Defendant only sought out another expert, State was successful in moving Ward's testimony in the middle of the trial. Defendant notice seeking any tactical advantage. finding record divulges none. Masucci, to way to present vital to limit At that point, expert testimony and comply with N.C.G.S. § 15A-905(c)(2). In light of the lack of willful misconduct on the part of Defendant, the rational reason presented for failing to inform the State before trial that Defendant would be calling Masucci, the role of the State in having this situation arise after the trial had involved, commenced, the the importance fundamental to the nature defense of of the the rights testimony excluded, and the minimal prejudice to the State had the trial court imposed a lesser sanction such as continuance or recess, we hold that imposing the harsh sanction of excluding Masucci from testifying constituted an abuse of discretion. arguendo, there was excluding Masucci's no abuse testimony of as discretion, a sanction Assuming, we for hold a that discovery -45rules violation violated Defendant's rights under the constitutions of the United States and North Carolina. Pursuant to either standard, we hold that the error was of such magnitude, in light of the earlier exclusion of Ward's relevant testimony, that it requires Defendant be granted a new trial. IV. Denial of Motion for Discovery In Defendant's third argument, he contends the trial court erred in denying his motions for discovery of certain evidence contained in the files of some of the State's witnesses. "Questions concerning discovery must be resolved by reference to statutes and due process principles, as no right to pretrial discovery existed at common law." 38 N.C. App. 244, 254, 248 S.E.2d 72, State v. McDougald, 81 (1978) (citations omitted); see also, State v. Cunningham, 108 N.C. App. 185, 19596, 423 S.E.2d 802, 808-09 (1992). examination, predicated minimizes on the incomplete, fabricated testimony." risk "Discovery, like cross- that a misleading, or judgment even will be deliberately Taylor, 484 U.S. at 411-12, 98 L. Ed. 2d at 812. N.C. Gen. Stat. § 15A-903 controls discovery required to be provided by the State. N.C.G.S. § 15A-903 has been amended -46twice since Defendant was indicted in this matter. The version of N.C.G.S. § 15A-903 relevant to this appeal stated: (a) Upon motion of the defendant, the court must order the State to: (1) Make available to the defendant the complete files of all law enforcement and prosecutorial agencies involved in the investigation of the crimes committed or the prosecution of the defendant. The term "file" includes the defendant's statements, the codefendants' statements, witness statements, investigating officers' notes, results of tests and examinations, or any other matter or evidence obtained during the investigation of the offenses alleged to have been committed by the defendant. The term "prosecutorial agency" includes any public or private entity that obtains information on behalf of a law enforcement agency or prosecutor in connection with the investigation of the crimes committed or the prosecution of the defendant. . . . . The defendant shall have the right to inspect and copy or photograph any materials contained therein and, under appropriate safeguards, to inspect, examine, and test any physical evidence or sample contained therein. N.C. Gen. Stat. § 15A-903 (2009). Certain materials are specifically excluded disclosure requirement of N.C.G.S. § 15A-903: (a) The State is not required to disclose written materials drafted by the prosecuting attorney or the prosecuting attorney's legal staff for their own use at trial, including witness examinations, voir dire questions, opening statements, and closing arguments. Disclosure is also not required of legal research or of records, correspondence, from the -47reports, memoranda, or trial preparation interview notes prepared by the prosecuting attorney or by members of the prosecuting attorney's legal staff to the extent they contain the opinions, theories, strategies, or conclusions of the prosecuting attorney or the prosecuting attorney's legal staff. N.C. Gen. Stat. § 15A-904 (2009). However, N.C. Gen. Stat. § 15A 903 provides that criminal defendants have broad pretrial access to discovery of materials obtained or prepared for the prosecution for use in its case in chief, including "not only conclusory laboratory reports, but also any tests performed or procedures utilized by chemists to reach such conclusions." This is due to "the extraordinarily high probative value generally assigned by jurors to expert testimony . . ." State v. Llamas Hernandez, 189 N.C. App. 640, 652 53, 659 S.E.2d 79, 86 87 (2008) (Steelman, J., dissenting), reversed per curiam for the reasons stated in the dissent, 363 N.C. 8, 673 S.E.2d 658 (2009) (citations omitted). As stated by the United States Supreme Court: Cross-examination is the principal means by which the believability of a witness and the truth of his testimony are tested. Subject always to the broad discretion of a trial judge to preclude repetitive and unduly harassing interrogation, the cross-examiner is not only permitted to delve into the witness' story to test the witness' perceptions and memory, but the crossexaminer has traditionally been allowed to impeach, i.e., discredit, the witness. -48Davis v. Alaska, 415 U.S. 308, 316, 39 L. Ed. 2d 347, 353 (1974) (citations omitted). Defendant discovery policies of, and examination of in this case "FBI CART procedures digital moved the trial court to compel (Computer Analysis Response for viewing, extraction or examination or data;" the "[m]echanism of Team) extraction to include hardware and software used;" "underlying and resultant data along with examiners' or technicians' bench notes whether handwritten, dictated or printed as well as accompanying sketches, printed screenshots, data whether printed or handwritten, photographs or video;" "complete details as to the examiner's examination of each of the files that were modified after they were taken into exclusive law enforcement custody to determine what was modified;" and other potential information or opinion concerning the laptop in the records of CART personnel. that there The State filed a motion in opposition, arguing exists "a law enforcement sensitive qualified evidentiary privilege" which should act to prevent discovery of these items, "because such disclosure could lead to the development of countermeasures to FBI investigative techniques. Such countermeasures could defeat law enforcement's ability to obtain forensic data in criminal cases." The State also argues that this information was protected as "work product." -49The trial court denied Defendant's motion discovery by order entered 4 October 2010. to compel The trial court found as fact "[t]hat the FBI's Standard Operating Procedures and policies are the same techniques and tools that are used in counterterrorism and counterintelligence investigations[.]" The trial court concluded that "under the provisions of N.C. Gen. Stat. § 15A-903, Procedure 16, patterned the after disclosure of Federal the Rule of Criminal information sought by . . . Defendant would be contrary to the public interest in the effective functioning of law enforcement[,]" and that "under the provisions of N.C. Gen. Stat. § 15A-908[,]" disclosure of the information would result in "substantial risk" of harm to "any person, including the citizens of this State, of physical harm." The trial court did not deny Defendant's motion based upon "work product" privilege. N.C. Gen. Stat. § 15A-908(a) states in relevant part: Upon written motion of a party and a finding of good cause, which may include, but is not limited to a finding that there is a substantial risk to any person of physical harm, . . . the court may at any time order that discovery or inspection be denied, restricted, or deferred, or may make other appropriate orders. N.C. Gen. Stat. § 15A-908 (2011). We have no way to evaluate the trial court's order denying discovery of the requested FBI's standard operating procedures and policies as there is nothing -50in the record indicating what these procedures and policies are or how making them discoverable would ability to conduct future investigations. compromise the FBI's The trial court could have conducted an in camera review of the requested discovery, and sealed the portions withheld to include in the record on appeal for this Court to review. See State v. Vandiver, 321 N.C. 570, 571-72, 364 S.E.2d 373, 374 (1988). Even in the face of a compelling State interest in keeping records confidential, due process might compel discovery, depending on how material the records are to a defendant's defense. Pennsylvania v. Ritchie, 480 U.S. 39, 56-58, 94 L. Ed. 2d 40, 56-58 (1987); United States v. Nixon, 418 U.S. 683, 712, 41 L. Ed. 2d 1039, 1066 (1974) ("the allowance of the privilege to withhold evidence that is demonstrably relevant in a criminal trial would cut deeply into the guarantee of due process of law and gravely impair the basic function of the courts"). We hold that on these facts due process required that the trial court at least examine the records in camera to determine whether they should be provided to the defense. See Ritchie, 480 U.S. at 56-58, 94 L. Ed. 2d at 56-58. We do not question that N.C.G.S. § 15A-908 may serve to prevent discovery of certain otherwise discoverable materials, based upon the concerns argued in the present case. In this -51case, however, we find the blanket exclusion ordered by the trial court unsupported by the record we have before us. cross-examination of a key State's witness is When going to potentially be limited by exclusion of certain discovery in a first-degree murder trial, a more particularized and focused order is warranted. Furthermore, this determination cannot be made court if the evidence. trial does not evaluate the contested Finally, sufficient record of the excluded materials should be preserved for appellate review. See State v. Brown, 116 N.C. App. 445, 446-47, 448 S.E.2d 131, 132-33 (1994). As one example of the over-broad nature of the trial court's order, and the implementation of that order, Special Agent Johnson testified that the CART team conducted a test to try to replicate the data produced by the purported Google Map search conducted attempted to on obtain Defendant's information laptop. regarding When that the defense test, following exchange occurred: [MR. KURTZ Defendant's attorney]. And when you let go of the cursor at the end of the navigation, is that consistent with when the last accessed time occurs? [Special Agent Johnson]. Again, it's -it's my recollection on those tests that -to answer your question, no. It was the time that we clicked on the -- the left button to close the hand. That was when the file was downloaded and those were the -those were the consistent dates across the the -52board. So if -- if we - - if we had went back and used that icon again, that closed hand function, it did not update those dates -- or the times. They were all reflected of when they were first initiated. Q. Do you still have that test data? A. I'm sure we do. I -- I believe that was a large part of Officer Chappell's testimony. Q. Is there any -- is -- the test data that resulted from Officer Chappell and your testing, is that particular data in any way a jeopardy to national security if it was disclosed to us? MR. ZELLINGER: Your Honor, I'm going to object. This is far outside the scope of determining whether that computer is proper for an examination. And -- and we're also delving into a -- an issue of law here for the Court and not for Agent Johnson. MR. KURTZ: Well, Judge, there is potentially a piece of information that exists on Mr. Cooper's computer that could say definitely that this material was planted, absolutely definitive. I may be wrong. Special Agent Johnson's testing may indeed be that it all has the exact same millisecond all the way across. I don't think I'm wrong. Now, one way or the other, whether it's having a -- a test done on a Vista machine now and seeing what it -- what it actually shows or giving us access to the original test data, which I don't believe has any national security ramifications since it deals with a Google Map test. One way or the other, we should be entitled to this information as it could be tremendously exculpatory. THE COURT: Upon reconsidering this issue about this in-court test, pursuant to Rule -53403, I'm going to sustain the objection and exclude any testing in Court because of the differences in the equipment and the statements made by this witness that this is not the appropriate place to do it. We need to bring the jury back in. And regarding the national security issue, that is a matter that we have already ruled on. It is something I have already dealt with. MR. KURTZ: But, Your Honor, there is a witness on the stand that can answer specifically whether this is an issue of national security. And I'm not even going to be allowed to ask that question? THE COURT: I believe I've already determined, because of the rules of the -and the discovery process that you are not entitled to get those things. MR. KURTZ: So my understanding is, the -the rules and the discovery process, we're hiding behind national security on an issue where we could get a clear answer from a witness that this is not in fact a national security issue. And we're talking about a piece of information that could be exculpatory to Mr. Cooper. MR. ZELLINGER: Your Honor, first of all, the exculpatory information is already in the Defendant's possession. He has all the files. The fact that his expert is -- his alleged expert can't speak to that is what the issue is before the Court. But as to any exculpatory information, all that has been given to the Defendant. All those computer files have been given to the Defendant. So I -- I want to just take issue with that and I -- I just wanted to put that on the record, as to the rest regarding MR. KURTZ: inaccurate Your Honor, that -- that is an statement because we're not -54talking We're about data from this computer. . . . . MR. KURTZ: We're talking about data that Special Agent Johnson and Officer Chappell generated when they attempted to replicate the search. When they did -- when -replicated this search, they will have generated -- and in fact, we've got a screen shot that shows the first of the timestamps. There are additional timestamps that are off screen. Those additional timestamps would answer this question definitely. And there can be no national security issue here, given we're talking about Mr. Cooper's computer alone and the data that was generated during their testing. THE COURT: It's the methodology that they used, I think, that falls under the security issue, but MR. KURTZ: But if I could ask Special Agent Johnson if he has any national security concerns related to that methodology, we might be able to determine that this one particular test is a legitimate one to be disclosed, that it will not actually disclose the missile codes. MR. ZELLINGER: Your Honor, I'm looking at the -- the affidavit of the FBI agent who provided an affidavit to the Court on June 10th of 2010. And -- and that set out the FBI current policies and procedures for the viewing, extraction, and or examination of digital data, the FBI's policies on the analysis, or -- or how it was -- how it was examined, numerous other documents from FBI Special Agent Johnson pertaining to his examination of the computers in this case, including but not limited to, communications logs, examiner bench notes, and all other -55documents completed or compiled by Special Agent Johnson beyond the report of the examination. That's what we're seeking to protect here, because we don't want, pursuant to state case law, we -- the standard operating procedures of the FBI are protected throughout our nation. And we're not hiding behind anything. All that information's been given to the Defendant. Agent Johnson's given out more information in this case than he's ever given out in any other case. And as to the -- the specific material that the Defendant wants, he has these files. If -if their [sic] exculpatory, take them to an expert and find out how [they're] exculpatory. But the fact is that these files the Defendant has in his possession. Asking Agent Johnson on voir dire about national security just seems wildly inappropriate to me, and then he wants to know exactly how every part of every test that Agent Johnson does can affect national security and that people could be put in danger or child pornography could - could easily be deleted after this information comes out. And we're relitigating this issue again. MR. KURTZ: Your Honor, what Mr. Zellinger is saying is -- is flat out dishonest and is ascertainable by asking Special Agent Johnson if this is information that we ever got. He's saying we have these files; we don't have these files. These are not the files from Mr. Cooper's computer. These are the files from Special Agent Johnson and Chappell's tests. THE COURT: The objection is sustained. I'm not going to allow further questioning in this line or any in-court testing of that computer. We need to bring in the jury. It was error for the trial court to shut down this line of questioning without ascertaining how, or if, national security -56or some other legitimate interest outweighed the probative value of this information to Defendant. On remand, the trial court must degree determine with a reasonable of specificity how national security or some other legitimate interest would be compromised by discovery of particular data or materials, and memorialize its ruling in some appellate review. New trial. Judges GEER and DAVIS concur. form allowing for informed
Some case metadata and case summaries were written with the help of AI, which can produce inaccuracies. You should read the full case before relying on it for legal research purposes.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
