IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF MARYLAND
UNITED STATES OF AMERICA
v.
HAROLD T. MARTIN, III

*
*
*
*
*

Criminal No. RDB-17-069

MOTION FOR DISCOVERY PURSUANT TO SECTION 4
OF THE CLASSIFIED INFORMATION PROCEDURES ACT
Defendant Harold T. Martin, III, through counsel, writes pursuant to Section 4 of the
Classified Information Procedures Act (“CIPA”), 18 U.S.C. App. III, to renew his request for a
Court Order requiring the government to produce: (1) mirror images of the devices used to create
the “Library,” an electronic database created by the National Security Agency (“NSA”) which
contains some information from certain electronic storage devices seized from Mr. Martin’s
residence; and (2) mirror images of the computers containing operating systems seized from Mr.
Martin’s residence (collectively, “mirror images”). 1
INTRODUCTION
The defense renews our request for mirror images because, despite the government’s
assurances to the contrary, we have determined that the Library does not contain the functional
equivalent or near equivalent of mirror images of the electronic devices. See Ex. 1 (Affidavit of
Larry Daniel). As a result, it is impossible for us to independently review the government’s
electronic evidence or test the government’s computer forensic analysis, which is set forth in two
expert reports authored by the NSA. See Ex. 1B (Feb. 28, 2018 Report); Ex. 1C (Oct. 9, 2018
Report) (filed separately via CISO).

1

A “mirror image” is an exact copy of a computer hard drive or external hard drive without
any data removed, missing, altered, or added.
1

 At the August 17, 2018 hearing, the Court ordered that we have meaningful access to the
electronic discovery. After much on-the-record discussion, it was understood that the electronic
Library made available to us at the NSA would afford us meaningful access to the electronic
discovery such that we could test the government’s expert analysis and conduct our own
independent analysis. As it turns out, we are unable to do either. Simply put, we are unable to test
or rebut the government’s evidence.
Without mirror images or their functional equivalent, we are forced to accept the
government’s expert forensic reports at face value. This is problematic because the forensic
reports will be a centerpiece of the government’s case at trial. Adding further concern is the
government’s stated intent to provide rolling supplements to the expert reports. As it currently
stands, the defense will not know the entire substance of the reports until mere weeks, or perhaps
days, before trial. Indeed, the government recently supplemented its 16-page February 28, 2018,
forensic report with a 104-page forensic report provided on October 9, 2018—nearly two months
after the August 17, 2018, expert disclosure deadline set forth in the Court’s July 3, 2018,
scheduling Order. The government’s rolling expert report disclosures, combined with its failure
to provide the defense with the functional equivalent of mirror images, runs afoul of the Court’s
August 17, 2018, Order, the scheduling Order, Federal Rule of Criminal Procedure 16, due
process, and the repeated, on-the-record assurances of the government that it will provide the
defense with meaningful access to the electronic discovery in this case.
Nearly a year after we first raised this issue with Judge Garbis, and more than two years
after Mr. Martin was arrested, we still have not been given the discovery we need to test and rebut
the government’s computer forensic analysis. The government, meanwhile, has spent two years
conducting its forensic analysis and is poised to continue updating its expert reports until the eve

2

 of trial. The government’s inadequate expert disclosures make it impossible for us to effectively
prepare Mr. Martin’s defense and place the trial schedule at risk. The Court should order the
government to comply with its August 17, 2018, ruling by providing mirror images for the
defense’s review in a secure government facility. The Court should also bar the government from
producing any additional expert discovery or relying on any computer forensics analysis that it has
not already disclosed in the reports dated February 28, 2018, and October 9, 2018.
BACKGROUND
On August 17, 2018, the Court presided over a hearing to determine the scope of the
defense’s access to electronic files allegedly seized from Mr. Martin. The Court agreed that the
electronic files are relevant and helpful to Mr. Martin’s defense and that the defense must have
meaningful access to them. The sole question was whether the government’s proposed protocol
for the defense’s examination of the electronic files ensured meaningful access. See Ex. 2
(Protocol for Defense Examination of Electronic Data Seized from the Defendant).
At the hearing, the Court stated repeatedly its intent to provide the defense with access to
the functional equivalent of mirror images, so that we may conduct an independent forensic
examination of the electronic files. See Aug. 17, 2018, Hr’g Tr. at 74:1 (“[M]irror images are
going to be produced for you.”); id. at 80:25-81:2 (“[T]he Government is providing access to
images of the digital media within the library. I interpreted that to be essentially mirror images.”);
id. at 83:19-20 (“So you have access to the mirror image . . . .”). The government, over and again,
assured the Court that its proposed protocol ensured defense access to the functional equivalent of
mirror images. See, e.g., id. at 82:14-17 (“What they’re instead getting is all of the data that is on
that device is put into the system that they will be given, and they’ll be able to see all of things
we’ve talked about, except for the content of the files . . . .”). According to the government, under

3

 the proposed protocol, the defense would have access through the Library to “all of the data and
all of the data about that data.” Id. at 83. The only thing the Library would not contain, the
government explained, is the actual content of the files, and the defense could request particular
files or seek Court intervention to obtain them. Id.
Based on the government’s representations, the Court granted the government’s motion
pursuant to CIPA section 4, as modified by its protocol for the defense’s examination of electronic
files. The Court acknowledged that, after traveling to the NSA to see the Library, the defense
“may not be satisfied” and, if so, could seek Court intervention under CIPA Section 4. Id. at 59;
see also id. at 63:12-13 (“The first step is for [the defense] to go out there [to the NSA] and start.”).
Finally, the Court set a deadline of September 25, 2018, for the government to produce any
classified materials, other than the twenty charged documents, which it intends to introduce at trial.
See id. at 65:2-4 (“We are not going to have rolling document production, and we’re not going to
have supplementation.”); id. at 72:17-19 (“We are not having rolling discovery. We are not having
rolling documents, and people are going to have to do their homework early here. That’s all there
is to it.”).
ARGUMENT
Upon the defense’s review of the Library with our cleared computer forensics expert, Larry
Daniel, 2 we have determined that, despite the government’s previous representations at the August
17 hearing, we have not been provided mirror images or the functional equivalent or near
equivalent of mirror images.

Because of this, we are unable to independently review the

government’s evidence, and we cannot test the government’s expert forensic reports. Moreover,
the government’s stated intent to provide rolling updates to the forensic reports have raised

2

Mr. Daniel’s CV is attached as Exhibit 1A.
4

 additional concerns. The government is not complying with the Court’s scheduling Order or its
clear intent to avoid “rolling document production.” The Court should order the government to
promptly produce mirror images for the defense’s review in a secured government space and bar
the government from producing or relying on any additional expert discovery.
I.

A Trip to the NSA with Our Expert Revealed the Library’s
Insufficiency.

The defense only discovered the issues with the Library after traveling to the NSA with
Mr. Daniel. As explained by Mr. Daniel, upon familiarizing himself with the Library (referred to
as the “Repository” in his affidavit), he determined that the Library is “the government’s work
product.” Ex. 1 at ¶ 5. In Mr. Daniel’s words: “[T]he Repository is the summary of the
government’s forensic analysis. The Repository does not allow me to review the actual evidence.
It only allows me to review the government’s summary of the evidence.” Id. Because of this, Mr.
Daniel is in the impossible position of trying to test the government’s evidence using the
government’s work product. See id. at ¶¶ 5-6, 14. He cannot perform independent forensic
analysis or test the government’s expert reports.
II.

Like the Government’s Experts, Our Expert Needs Access to Mirror
Images.

To conduct his own analysis, Mr. Daniel needs mirror images. Access to mirror images of
the 24 digital storage devices—which are the subject of the government’s expert reports—would
enable Mr. Daniel to attempt to recreate the NSA’s work and, therefore, test the conclusions in its
expert reports. See id. at ¶¶ 11-12. The NSA has mirror images of the devices and, in fact, relied
on mirror images of the devices in creating the Library. The government’s experts apparently
relied on mirror images in drafting its forensic reports. See, e.g., Ex. 1C at 24, 52, 70, 73, & 91.

5

 Providing copies of the mirror images for the defense’s review, in a suitable governmentcontrolled space, is only fair and would not be logistically difficult.
III.

Under the Current State of Affairs, the Defense Does Not Have Access
to Critical Evidence.
A. We Cannot Visualize the Contents of Storage Devices Where
the Charged Documents Were Allegedly Found.

In its October 9 expert report, the NSA included many “visualizations” of where documents
were stored in particular devices. See Ex 1 at ¶ 11; see, e.g., Ex. 1C at 24, 52, 70, 73, & 91. These
are essentially screenshots of the file directories on Mr. Martin’s devices. We cannot see them or
recreate them under the government’s protocol. The Library that we have access to is a black
screen with a blinking cursor. We cannot see the file structure. The government can and has
produced compelling images of the file structure in its expert report.

These images or

visualizations are critical to the government’s case at trial, as it will presumably argue that Mr.
Martin knowingly possessed national defense information because his personal files (e.g., resume,
graduate thesis) were saved in close proximity to files containing alleged national defense
information. To bolster this argument, the government will show the jury the visualizations
contained in its October 9 expert report. With our access to digital files limited to the Library, we
have no ability to test whether the visualizations are correct or develop our own visualizations. As
Mr. Daniel explains, the “visualizations are not in the [Library], and it is not possible to create
those visualizations using the [Library].” Ex. 1 at ¶ 11. Mr. Daniel needs mirror images of the 24
digital storage devices referenced in the NSA’s forensic reports to create the visualizations.
B. The Defense Needs Mirror Images of Mr. Martin’s
Computers that Contain Operating Systems.
Mr. Daniel also needs mirror images of the computers containing operating systems seized
from Mr. Martin’s residence. These mirror images are “critical to [his] analysis,” because
6

 operating systems (such as Microsoft Windows for a PC) contain a “wealth of information about
files on connected storage devices.” Id. at ¶¶ 8-10. This critical information is not in the Library.
For example, operating systems such as Microsoft Windows store unique information about files,
including when the computer accessed a file, who accessed the file, when a storage device was
connected to the computer, and the program used to open and view the contents of the file. Id. at
¶ 9. All of this information is crucial to Mr. Martin’s defense, but none of it is in the Library. Id.
On a more technical level, we identified a number of computer artifacts at the August 17
hearing that we expected to see in the Library and that our expert needed access to for his
independent analysis. In particular, we read into the record that we needed operating system
registry, jump lists, user assist, unallocated space, memory or pagefile.sys, dump files, web history,
shell bags, prefetch, compound files, SQL databases, links data, data carving, events logs, volume
shadow copes, Microsoft Office document metadata, and meta carving. See Aug. 17, 2018, Hr’g
Tr. at 80:9-14. None of these computer artifacts, however, is in the Library. Ex. 1 at ¶¶ 8-10; see
also Ex. 3 (Sept. 5, 2018 Email from AUSA Myers).
IV.

The Defense’s Computer Expert Cannot Move Forward.

As it currently stands, Mr. Daniel cannot do any of the crucial tasks he has been retained
to do. Ex. 1 at ¶ 2. He cannot conduct his own independent forensic analysis. Id. He cannot test
the conclusions contained in the government’s expert reports.

Id.

Moreover, because the

government intends to continue supplementing its expert reports without limit, Mr. Daniel is not
even guaranteed sufficient time to test the expert reports and relay his findings to defense counsel
prior to trial. If the Court does not intervene, Mr. Martin will be forced to go to trial without a
complete understanding of the government’s evidence or the opportunity to test and rebut it. The
Court cannot tolerate such a result. The Court should order the immediate production of mirror

7

 images of the devices used to create the Library and mirror images of the computers containing
operating systems seized from Mr. Martin’s residence.
CONCLUSION
For the reasons stated above, the Court should order the government to immediately
produce (1) mirror images of the devices used to create the Library and (2) mirror images of the
computers containing operating systems seized from Mr. Martin’s residence. The Court should
also bar the government from producing or relying on any additional expert discovery.

Respectfully submitted,
/s/
____________________________________
JAMES WYDA, #25298
Federal Public Defender
DEBORAH L. BOARDMAN, #28655
First Assistant Federal Public Defender
SHARI SILVER DERROW, #19181
Assistant Federal Public Defender
Office of the Federal Public Defender
100 South Charles Street, Tower II, 9th Floor
Baltimore, Maryland 21201
Phone: 410-962-3962
Fax: 410-962-0872
Email: jim_wyda@fd.org
deborah_boardman@fd.org
shari_derrow@fd.org

8