Minnesota detectives crack the case with digital forensics

In the world of law enforcement, it's a game changer nearly as profound as the advent of DNA testing.

When two 13-year-old Andover girls went missing last week, the first place detectives looked was for the digital clues in their iPods and smartphones. It worked. The girls were soon found in the basement of a 23-year-old Burnsville man, Casey Lee Chinn, who is now charged with felony criminal sexual conduct, kidnapping and solicitation of a child.

Digital forensics — the examination of cellphones, tablets and personal electronics in criminal investigations — are dramatically changing the way cases are worked and solved. While technology has created new portals for predators searching for victims, it's also leaving telltale trails for police.

The number of smartphones, tablets and personal devices examined by the Anoka County Sheriff's Office has tripled in the past three years. In 2013, detectives searched 300 phones and devices in a wide array of cases. It's now often the first piece of evidence detectives seek out.

"That [missing girls] case was solved by a detective in the lab, not by any field work or eyewitness accounts. It was digital forensics," said Commander Paul Sommer. "It's become an investigation imperative. You try to find the personal electronics."

With 90 percent of American adults now carrying a cellphone — 58 percent with a smartphone, according to the Pew Research Center — the devices have become the one constant in many people's lives — in their pocket or purse all day, on their bedside table at night. It's the alarm clock, home phone line, camera, chat forum, e-mail and social media terminal. Police use that almost constant phone activity to verify a suspect's or witness' statement and provide a log of a person's movements and activities. Smartphones can even be an eyewitness, recording a crime in progress.

The Hennepin County Sheriff's Office crime lab analyzes thousands of phones and personal electronic devices each year for its own investigations as well as for other police agencies. It also contracts with an outside digital forensic expert to keep up with the constantly changing technology.

"Electronic devices are just a treasure trove of information," said Hennepin County Sheriff Rich Stanek. "The digital evidence is one of the first things we go to. They leave footprints all over the place: Who the girls were last talking with, who they were tweeting with. They offer up a lot of clues about what has been happening in these young girls' lives in the past few hours and days."

Ramsey County Sheriff Matt Bostrom said his investigators increasingly rely on digital evidence to break cases in addition to older investigative methods.

"It is one of the best advancements in the last decade in being able to quickly respond to crime," Bostrom said. "It has changed the way we are capable of responding to citizens that are in trouble."

With potential access to so much personal information, police also face a big responsibility to not misuse data or violate the privacy rights of innocent people, since lawmakers could still throttle back law enforcement's access to digital data.

The Anoka County Sheriff's Office has set up a digital forensics lab with computers and about eight tools that can download cellphone data, useful because the sheriff handles all death investigations in the county and most of the sex crimes.

This year the Sheriff's Office hired two new detectives, bringing the total to 17 to help handle the increased digital forensic caseload.

The office also is setting up the first mobile digital forensic lab in the state. It's still in the early stages but when it's outfitted, detectives can take the unit — an old ambulance donated by Allina Emergency Medical Services — to a crime scene or a missing person's home and quickly copy evidence from cellphones. Now detectives have to take phones back to the lab — something that witnesses can resist.

"You are going to have witnesses taking video. The Boston bombing is a prime example of that," said Anoka County detective Brian Hill.

Detectives want immediate access to that evidence, "but who wants to be without their phone for 24 hours?" Hill said.

And in cases of suspected online solicitation where a child is missing, it saves precious minutes by eliminating a drive back to the sheriff's department.

"There is a huge sense of urgency," Hill said.

Hill is one of five Anoka County detectives trained to download and search data from cellphones and devices. He traveled to Washington, D.C., this summer to testify before a subcommittee of Congress to discuss how cellphones and spyware are the newest ways domestic abusers terrorize their victims. But it also leaves a trail that police can use to help prosecute them.

Hill said about half his work time is now spent on digital forensics. That's a dramatic change from when he started with the sheriff's office in 2000.

When deputies are called to a crime scene, the first question is: "Where's the phone? Can we get access to the phone?" Hill explained. "Virtually every crime today involves technology and that is usually a cellphone."

Detectives often get witnesses, victims or suspects' consent to search a phone. Hill said he and his colleagues are cognizant of the personal nature of phones. He said he doesn't snoop through pictures, e-mails and other information unrelated to the case.

If necessary, detectives obtain a search warrant.

Hill said there are many ways smartphone data can corroborate or poke holes in a suspect's statement to police.

First, phones record a user's physical movements, which can help break a case.

"They track where you go. Smartphones are constantly reaching out to towers," Hill said.

Text messages, e-mails and even photos stored on smartphones can help detectives flesh out the truth especially if someone's statement doesn't add up. There have been cases where text messages have exonerated suspects.

"Text messages can tell a whole different story," Hill said.

A pause in phone use also can tell detectives something. Detectives look to see if someone shuts their smartphone off or even simply leaves it at home and fails to check e-mails and texts during the period when a crime was committed.

In the case of the missing Andover girls, parents reported their disappearance at 9:36 p.m. Monday. Detective Pat O'Hara searched one of the girl's iPods found in her room and discovered two weeks of sexually explicit texts with the final text "Be there" received at 8:31 p.m. Monday.

Police were searching the suspect's home by the next morning.

Shannon Prather • 612-673-4804