Tampering with Evidence

To secure a conviction the state must generally prove three distinct elements which are the act of alteration or concealment and the knowledge of a proceeding and the specific intent to obstruct. The act itself can be surprisingly minor.

We litigate the scope of what constitutes evidence. Prosecutors often overreach by charging tampering with evidence for the deletion of personal data that has no bearing on the investigation. We argue that if the destroyed material was not relevant to the proceeding its destruction cannot logically be an attempt to impair that proceeding. We also challenge the timing. If the investigation had not yet begun and was not reasonably foreseeable the destruction of documents is generally lawful. We build a timeline defense to show that the client acted before any duty to preserve evidence attached.

In the modern era most tampering charges involve digital artifacts rather than physical objects. The deletion of emails or the wiping of a smartphone or the use of ephemeral messaging apps like Signal can be construed as tampering with evidence.

We employ digital forensic experts to recover the deleted data and to analyze the metadata of the deletion. Often we find that the deletion was automated by the device settings rather than manually executed by the user. We argue that the passive loss of data through auto-delete functions does not constitute the active actus reus required for a criminal conviction. We also defend the use of encryption and privacy tools. We assert that protecting personal privacy is a fundamental right and that using secure communication channels is not evidence of a guilty mind or an intent to obstruct justice.

Enacted in the wake of the Enron scandal the Sarbanes-Oxley Act expanded the definition of obstruction of justice under 18 U.S.C. Section 1519. This statute criminalizes the destruction or alteration of records with the intent to impede any investigation within the jurisdiction of a federal agency.

The danger of this statute lies in its anticipatory nature. We defend against Section 1519 charges by challenging the contemplation element. We argue that the client could not have reasonably anticipated a federal investigation at the time of the alleged destruction. If the client was dealing with a routine internal audit or a civil dispute we argue that they lacked the specific intent to obstruct a federal inquiry. We urge the court to interpret the statute narrowly to prevent the criminalization of ordinary corporate document management.

State laws regarding tampering with evidence are often tied more strictly to official proceedings. In many states the prosecution must prove that the defendant believed an official proceeding was pending or about to be instituted.

We exploit the ambiguity of about to be instituted. We argue that a mere suspicion of police involvement is not enough. If a client flushed drugs down the toilet before the police knocked on the door or announced their presence we argue that the proceeding had not yet commenced. We focus on the exact moment of the police interaction to sever the link between the act of the defendant and the official investigation. We aim to reduce felony tampering charges to misdemeanor obstruction charges or to secure a complete dismissal based on the lack of a qualifying proceeding.

The classic example of tampering involves shredding documents or destroying physical items. This can range from a street-level suspect swallowing a baggie of narcotics to a corporate officer ordering the shredding of incriminating memos.

We defend these cases by attacking the materiality of the destroyed items. If the government cannot prove what was destroyed they often cannot prove that it was evidence of a crime. We argue that the prosecution is engaging in speculation. Without the physical object the government often struggles to prove that the item was illicit contraband or a relevant document. We emphasize the burden of proof. We argue that the destruction of an unknown item is not proof of tampering with evidence because the jury cannot determine if the item had any evidentiary value.

Tampering also extends to testimonial evidence. Attempting to influence a witness to withhold information or to lie to investigators is charged as witness tampering. This often overlaps with tampering with evidence.

We scrutinize the communications between the defendant and the potential witnesses. We distinguish between coaching a witness to lie and preparing a witness to testify truthfully. We argue that advising a witness of their right to assert the Fifth Amendment or their right to decline a police interview is lawful legal advice and not tampering. We protect the First Amendment rights of our clients to discuss the case with associates provided they do not use threats or corrupt persuasion to alter the testimony.

Corporations and individuals delete data every day to free up storage space and to protect privacy. This is a routine business practice. We argue that the deletion in question was part of an automated retention policy.

We produce the written document retention policies of the company. If the policy mandates the deletion of emails after ninety days and the emails were deleted on day ninety-one we argue that the client was following compliance protocols not obstructing justice. We use IT experts to testify that the deletion was indiscriminate and systematic rather than a targeted purge of incriminating files. By normalizing the destruction we negate the criminal intent.

If the client did not know about the investigation they cannot be guilty of tampering. We construct a detailed timeline of when the client became aware of the government interest.

We argue that any actions taken prior to the receipt of a subpoena or a target letter were taken in good faith. We challenge the government theory of constructive knowledge. Just because rumors of an investigation were circulating in the industry does not mean the specific defendant knew they were a target. We demand proof of actual knowledge. If the government cannot prove the client knew the authorities were watching we move for acquittal on the tampering with evidence charges.

Internal investigations are a danger zone for tampering allegations. When a company investigates itself employees often panic and delete files to hide policy violations that are not necessarily criminal.

We represent employees in these internal probes. We advise them on their rights and obligations to preserve data. If an employee deleted files to hide a workplace affair or a violation of HR policy we argue that their intent was to avoid embarrassment not to obstruct a federal crime. We distinguish between the intent to deceive an employer and the intent to impede a government investigation. This distinction can be the difference between a firing and a federal indictment.

There is a critical difference between civil spoliation and criminal tampering with evidence. In a civil lawsuit the destruction of evidence might lead to monetary sanctions or an adverse jury instruction. In a criminal case it leads to prison.

We argue that the conduct of the client should be handled as a civil discovery dispute rather than a criminal offense. If the destruction was negligent or reckless it might be spoliation but it is not criminal tampering which requires a specific corrupt intent. We fight to keep the dispute in the civil arena. We argue that the aggressive use of criminal statutes to punish civil discovery failures is an abuse of prosecutorial discretion and a violation of due process.