How Metadata from Facebook, Cell Phone Photos, and Cell Towers led to the Exoneration of Derrick Bunkley

Editor’s note:  Derrick Bunkley was represented on appeal by SADO Assistant Defender Doug Baker. In this article, Doug takes the reader through the arrest, the trial, and the appellate investigation that eventually led to a stipulation by the prosecution to vacate Derrick’s convictions and to dismiss the charges. There are a lot of good lessons here, for both trial and appellate counsel, when confronted with a case where technological data could prove a client’s true whereabouts

On May 3, 2014, twenty-two-year-old Derrick Bunkley was visiting his mother and two young brothers at his mother’s apartment in Detroit.  Beginning at 11:40 p.m., and for the next few minutes, he used his smart phone to take pictures of his brothers and himself, and then to post three of those pictures to Facebook.  He was still at his mother’s apartment when, a little after 1:00 in the morning, he received a phone call telling him his father had just been shot.  He rushed to the hospital.

By coincidence, an hour or so earlier a woman had arrived at the same hospital, also with gunshot wounds.  She’d told the police that she’d been accosted by two black men in their twenties, both wielding guns and wearing black clothes.  She had a gun, too, and so what started as a robbery turned into a shootout.  She thought she wounded at least one of the would-be robbers.

Police officers who’d interviewed this woman were at the hospital when Derrick’s father arrived.  Derrick’s dad was not in his twenties; he was 48 years old and looked every bit of it.  Nevertheless, the officers thought he might be one of the woman’s assailants.  And because Derrick soon arrived to visit him and was in his twenties and wearing black clothes, they suspected him, too.

They showed the woman photo arrays.  She apparently did not pick out Derrick’s dad—he was arrested but never charged.  She did, though, point to Derrick’s photo and say that she was 100% sure Derrick was one of the two gunmen.

The police arrested Derrick and asked him where he’d been at 11:45 pm on May 3, the approximate time of the shooting.  Derrick told them he’d been at his mother’s apartment, and added, “Please check my Facebook page.  I was on Facebook.”

Derrick gave the police his password, and the detective in charge of the investigation tried to check the Facebook page.  But she couldn’t make the password work and so dropped that part of her investigation until the first day of trial, when Derrick’s mom brought Derrick’s phone to court.  She and the detective looked at the phone together, and viewed one of the photos Derrick had posted to Facebook.  They both noticed it was time-stamped not at 11:40 p.m. on May 3 but an hour later, 12:40 a.m. on May 4.  The detective gave the phone back to Derrick’s mom and went upstairs to make a copy.  There, she accessed Derrick’s Facebook page on an office computer and saw that the time-stamp for the same picture now read 11:40 p.m. on May 3.

When the detective took the witness stand she testified about the apparent discrepancy, added that a Facebook time stamp can easily be edited, and pointed out that Derrick’s mom had the phone and the opportunity to make the change.

Trial counsel did not forensically examine the phone, subpoena the phone records, or consider calling Derrick’s dad as a witness.  Instead, he relied solely on Derrick’s mom to present Derrick’s alibi defense.  But with her uncorroborated account undercut by the detective’s suggestion of fabrication, the jury predictably rejected Derrick’s alibi and convicted him of the charged offenses: assault with intent to murder and three gun crimes.  Judge Vonda Evans sentenced him to serve a total of 17 to 32 years in prison.

Derrick appealed and SADO was appointed to represent him.  I was assigned the case and enlisted SADO investigator Linda Borus to help with the investigation.  Also providing invaluable assistance was Eric Buchanan, our programmer, who helped us gather and review the technical evidence.

Facebook Time Stamp

The first puzzle we tried to solve was the time-stamp discrepancy.  Derrick told us he’d set his  phone an hour ahead, to the Atlantic time zone, as a way of helping him to get places on time.  And when we got the phone, we could see that the photos on the camera roll bore time stamps an hour later than the photos were actually taken.  We therefore theorized (though we could never actually prove) that the time-stamped photo that the detective and Derrick’s mom viewed in the courtroom was from the camera roll, not the Facebook page.

It turned out that in light of what else we discovered, we didn’t need to explain the time discrepancy.  Eric studied Facebook and learned that, as the detective testified, it was indeed possible to edit a Facebook time-stamp.  However, when the stamp is changed, a clock icon is created, and if you hover over or click that icon the actual date and time of the posting is revealed.

Original Facebook post (above)

Facebook post after time and date alteration (above)

Facebook created this feature to allow users to organize their photos and events chronologically rather than when they were uploaded, allowing users to change the time of old high school, college, or wedding photos, etc., to the true dates they were taken instead of the dates they were uploaded. In Derrick’s case, the expert was correct--it is possible to change the time of a post; however, what the expert failed to mention is that you cannot conceal the time change. Because no such icon appeared on Derrick’s page, we knew that the 11:40 p.m. time-stamp had not been altered. 

Facebook also provides the ability to download a history report for any account that one has credentials to log into.  Eric downloaded Derrick’s Facebook history report, which was very comprehensive. Beyond all photos and posts shared on his wall by him and his friends, it included a wealth of other information including a log of every device that accessed his account, the IP address of those devices, and their browser/model information. From the Facebook history report, Eric was able to see that the only device accessing his account during the time of the crime was his cell phone. Eric was also able to connect the IP address used to upload photos with the IP address from the log of connected devices, which again matched his cell phone, proving with certainty that the photos of Derrick at his mother’s house were uploaded at the time of the crime using Derrick’s phone.

Cell Phone Photos

More importantly, by examining the phone itself, we learned that Derrick took the photo just moments before he posted it to Facebook. On appeal, the prosecution argued that even if the posts were uploaded during the crime, it was possible for Derrick to post older photos of himself to Facebook right before or after committing the crime. So we needed to prove that the photos were taken at the same time the crime occurred. The directory date and times of the photos showed that they were saved to the card right around the time of the crime—11:40 p.m. The photos’ metadata, capture date, and times were also consistent with the time of the crime. The photos’ metadata also showed the make and model of the device that took the photos, which matched the cell phone’s make and model. We then contacted private investigator Larry Dalman, who did a formal forensic examination of the phone and confirmed Eric’s findings.

The prosecutor’s office also had an expert review the phone information. Their report revealed that for each photo in question, there were multiple files containing each photo’s information and each of these files contained conflicting metadata. After receiving a copy of their report, Eric confirmed these additional files were cached files—or other files created by the phone’s operating system—and not physical image files created by his phone’s camera. All of the original photos in question had file dates, times, and metadata consistent with Derrick’s alibi. The prosecution’s expert confirmed these findings.

Cell Phone Towers

We also sought (and after a long delay) obtained phone records for Derrick and his dad.  Eric was able to take the data contained within those records and calculate the location of the cell towers both phones were accessing before and after the crime, as well as the location of all the other cell towers in the area.  The data consisted of two files for each phone. The first file contained the phone’s call activity. The second file contained information for every cell tower located in Michigan for the carrier’s network.  Eric first searched through the file containing Derrick’s cell activity and found a range of events that began roughly an hour before the crime occurred and lasted a few hours. During this time range, the phone only connected to a few cell towers. To locate these towers, Eric used the file containing the cell tower data and found they were all within a few blocks of Derrick’s mother’s house, and miles from the crime scene. Eric did the same for the cell phone data of Derrick’s dad. Using this information, Eric created maps that pinpointed the location of the crime, Derrick’s mother’s house, and nearby cell towers, highlighting the towers accessed by Derrick’s and his dad’s phone. The maps showed that at the time of the crime, both Derrick’s and his dad’s phones were in use far from the crime scene, accessing the cell towers closest to where they said they were.

Litigation

Again, it took a long time to gather and analyze this information.  In the meantime, we had to meet the Court of Appeals’ deadline for filing a remand motion.  While we continued to investigate our primary theory for appeal (that trial counsel was ineffective for failing to investigate and present evidence that would have confirmed Derrick’s alibi), I filed a motion seeking remand on our backup theory (that counsel was ineffective for failing to investigate and present evidence of an alibi for Derrick’s dad, the man the prosecution claimed was Derrick’s accomplice).  We had other information to show where Derrick’s dad was at the time of the crime, including his affidavit and ambulance records showing where he’d been picked up.

By the time we were ready to file a supplement to our original motion, the Court had already denied remand.  We scrambled and put together a motion for reconsideration as well as one I styled a “motion to add ground for remand,” which detailed our primary ineffectiveness claim.  The Court now granted both motions and remanded for a Ginther hearing [People v. Ginther, 390 Mich.436 (1973)].

We never actually had to present any evidence at a hearing, though, because the prosecution eventually agreed to the relief we sought.  That happened after Linda, Eric, and I met with Wayne County appellate prosecutors Deborah Blair and Jason Williams.  We agreed to provide them with Derrick’s phone and the information we’d gathered with the understanding that, if our information checked out, they’d concede the need for retrial.

It took a couple of months of back and forth, but on Wednesday, February 17, nine days before the hearing was scheduled to begin, Deborah Blair called to say that the prosecution would not only agree to retrial but also to dismiss the charges.

The race was then on to get Derrick out of prison.  This turned out to be an intricate process that required coordination with the appellate prosecutor, the judge’s clerk (to put the case on the docket a week earlier than planned), the judge herself, the Court of Appeals district clerk (to expedite dismissal of the appeal once our motion for retrial was granted, so that the judge would have jurisdiction to consider the trial prosecutor’s motion to dismiss), the trial prosecutor (who agreed to seek dismissal), and Kim Thelan of the MDOC’s Time Computation Unit, who let me know what she needed in order to release Derrick and who then oversaw that process on the MDOC side.  One important lesson: if you want the MDOC to release your client, a form order dismissing the charges isn’t enough—it must also include the phrase “defendant to be released forthwith,” or words to that effect.

A little after 2:00 p.m. on February 19, the day charges were dismissed, Eric and I drove to the G. Robert Cotton Correctional Facility in Jackson.  A couple of hours later we were on way back to Detroit with a passenger: Derrick Bunkley.

For an appellate lawyer, it doesn’t get much better.

by:  Doug Baker
with assistance from Eric Buchanan

Doug Baker has been an Assistant Defender at the State Appellate Defender Office for the past 19 years. He regularly teaches the Criminal Appellate Practice Clinic at Wayne State University Law School. He is more fully introduced in this month’s “Spotlight” feature. Eric Buchanan is a Programmer at the State Appellate Defender Office. Prior to joining SADO, he worked in programming, engineering, and robot design. He is currently working on developing a new order system for MAACS.