DUI

Dec 05, 2007

Progress Report of the DUI Committee on Source Codes Used in Breath Testing

The DUI Committee this past year has directed its activities toward obtaining the source code for the Intoxilyzer 8000, breath alcohol testing device manufactured by CMI, Inc. of Owensboro, Kentucky. It is the exclusive evidentiary breath alcohol testing device approved by DPS and ADHS for use in Arizona. There have been several facets of our activities: 1) Meetings and discussions which often developed into "brain storming sessions," 2) Litigation in court cases, 3) Collaboration with groups throughout the State and with groups in other states, 4) Research and achievement in understanding the technical and legal aspects of the governmental use of microprocessors and computer programming.

This work has become more important as government relies on computer programs to investigate and analyze crime, and to even decide if a crime has been committed. In few aspects of the law is this more apparent than in DUI law enforcement. An example is the recent article that appeared in TheDefender, "Let Justice Be Done Through the Heavens May Fall", Fall 2007, pp 18-21, about the impact of recent legislation to immunize CMI's computer source code from court ordered production. The State Legislature had passed ARS 28-1321.C which allowed the introduction into evidence of breath alcohol readings in DUI related cases, which would include aggravated assaults, and manslaughter cases, when the manufacturer refused to disclose the source code.

The source code has been described as the human readable version of a software program used to direct the microprocessor to carry out its intended functions. This consists of statements created by a programmer with a text editor or a visual programming tool. A compiler translates the source code into machine-readable code. The machine code is in the computer chips of the instrument. The software directs the instrument how to convert a human breath specimen into a three digit decimal reading with the safeguards that are to help prevent erroneous readings. It is those readings that are used in evidence often without further foundation other than the immediate before and after calibration tests on the only DPS/ADHS approved breath testing device, i.e. CMI's Intoxilyzer 8000. The source code determines how the instrument is programmed to reach its evidentiary conclusions.

Members of the Committee, in co-operation with the Committee, sought production of the source code from the State and CMI in pre-trial discovery consistent with legal actions for production brought in other States. The State opposed production of the source code for various reasons-they said it has no evidentiary value, it was not relevant, there was no showing of errors in breath alcohol test readings, the calibration tests are sufficient quality control to assure accuracy, and CMI would not surrender access to its source code as a trade secret to defense attorneys and their experts for examination. The State maintained it had no access to the source code which was in the exclusive possession of CMI in Kentucky.

At first the Defense agreed that the manufacturer controlled its source code but the State should have access since as a law enforcement agency it uses the instrument and the source code in court to convict citizens of crimes. Therefore the State and CMI are working in concert to convict people of crimes. Under due process standards, Defense experts are entitled to examine the source code. In the Phoenix Municipal Court case of State v. Mason, et. al., a Municipal Court Judge agreed with the Defense and ordered production of the source code as relevant discovery for pretrial discovery purposes for the Intoxilzyer 8000 and the Intoxilyzer 5000. CMI through the Office of the City Prosecutor refused to comply with the Court Order and would not disclose the source code for examination. It must be understood that the Defense had available for evaluation an electrical/software engineer, Lonnie Dworkin, of CompuFor to analyze the source code in the electronic format with the assistance of forensic scientists, Mark Stoltman and Chester Flaxmayer in order to verify its contents.

The Court then entered an Order of Suppression of the breath alcohol test readings that the State sought to introduce into evidence in the three consolidated Mason cases. The State dismissed and appealed to the Superior Court. Meanwhile in Superior Court, in State v. Krahn, an aggravated DUI case, the Judge Pro Tem after hearing evidence of potential reliability problems with the Intoxilyzer 5000EN, entered an Order of Production which was refused by CMI. The Court then declined to enter an Order of Suppression, largely because of protections afforded the State and CMI in ARS § 28-1321.C. However, it did enter an Order that he would allow a Willett's Instruction to the Jury about CMI's recalcitrant refusal to allow court ordered examination of the source code based upon proposed courtroom testimony of Mr. Dworkin and Mr. Stoltman. A Petition for Special Action was sought to challenge the constitutionality and applicability of ARS § 28-1321.C, but jurisdiction was denied.

Defense attorneys filed a consolidated motion for production of the source code in Phoenix Municipal Court with nine cases. There the Defense sought an interview with a CMI technician who had adjusted or "verified" the radio frequency interference (RFI) settings for available Phoenix Police Department Intox 8000s at the Department of Public Safety (DPS) Crime Lab. The court ruled that the information sought was relevant to the issues of the case, including the source code motion, and ordered the interview or depositions telephonically. CMI refused to comply with the court's order, not even allowing interviews with its electrical technicians who travel to Arizona to work on the crime lab's instruments, and complete Phoenix Crime Lab forms. In that case, State v. Goodman, et. al., the Judge suppressed all the breath alcohol test readings as a remedy since she could not enforce an order for production interstate. The State dismissed and appealed, oral argument has yet to be scheduled. Since then two other Phoenix City Courts have made similar rulings.

Not all rulings on the source code were so favorable. A Phoenix Municipal Court Judge denied the source code production in State v. Mathes and Arthur, with the Intox 8000, essentially since the State did not have access to the source code. A similar denial was reached in the Phoenix City Court case of State v. Schlendorf. All three cases are pending trial. A similar result was reached before the Presiding Criminal Court Judge in a manslaughter case, State v. McGraw with a DPS/Sheriff's Office case. There, the Court ruled that the State did not have access since the source code was in the possession and control of CMI. The State, the Court said, had no control over CMI's source code. The Judge also doubted the relevancy of the source code since the Defendant had other means of challenging breath alcohol test results. McGraw is pending but will likely be resolved with a favorable plea agreement. These cases did not result in special actions being filed.

One case, State v. Smith in Phoenix Municipal Court, resulted in the denial of the source code production motion, but the case went to trial over the State's and CMI's refusal to produce the source code with Mr. Dworkin and Mr. Stoltman testifying as experts under the guidance of a Committee member, the late Curtis Rau. Attorney Robert Jarvis was lead counsel. It was an extreme DUI with an alleged second offense. The jury found the Defendant not-guilty on all counts, choosing not to believe in the Intoxilyzer's programming.
While these cases were pending there were three significant developments that would shatter the State's arguments. In Minnesota, the Supreme Court entered an order in Underdahl v. Commissioner of Public Safety, affirming the production of the source code from CMI for the Intox 5000EN. Thereafter, a source within DPS disclosed to another attorney a contract dated September 10, 2004, between the State and CMI, whereby the State of Arizona owns the Intellectual Property, any trade secrets, the software, and the computer programming, of the Intoxilyzer 8000. There was no retention of rights to the source code for CMI. Because of the similarity of the contract to the one in Minnesota, and because the contract was contrary to the announced positions taken by the State in the lower court appeal in State v. Mason, et. al., the City Prosecutor dismissed its appeals. The suppression orders remain in effect. Motions for further production of undisclosed Brady documentation were filed in State v. Krahn. After hearing oral argument, the Court entered an order on November 13, 2007:

. . . The Court held an evidentiary hearing in which uncontroverted evidence was shown that various readings on Intoxilyzer machines can produce erroneous results, which could be explained by simple production of the operating or source code. The Court ruled that the source code should be produced, yet the State has yet to comply. Initially, the State argued that it was unable to comply because it did not possess the information, and did not have access to it.

Now, the Court finds otherwise. A contractual relationship between the manufacturer and the State of Arizona apparently does exist, granting all property rights to the State. As such, the State is required to produce the materials requested in the Defense motion for production, which is hereby signed this date, November 13, 2007. The Court, in doing so, finds that protecting the Constitutional Rights of a defendant far outweighs any legal standing the State assets with regard to contract law and property rights. The State has denied the existence of a contract, denied a connection with the manufacturer, and denies that the information is within their control. The Court has been presented with evidence to the contrary on all counts, which entitles the Defendant to relief as requested, as well as other sanctions and orders in the future, as may become necessary for the proper prosecution and defense of this case. (Emphasis added.)

The court in Krahn entered an Order for the issuance of 12 subpoenas and subpoenas duces tecum. The State has now made a plea offer which the Defendant accepts, and the case is being settled without further orders from the court or discovery being undertaken by the Defense. Since the entry of the Krahn Order, two Phoenix Municipal Court Judges have entered Orders that the State owns the source code, and that it must be produced. Motions for Reconsideration have been filed in Mathes, Arthur, and Schlendorf. Another Phoenix City Court case, State v. Purk was dismissed by the State after the source code motion was filed and the contract was publicized.

There have been other source code developments across the State. Attorney James Nesci in Tucson brought a consolidated source code production motion in the Municipal Court there, State v. Martinez, et. al. with mixed success. Production was ordered but since CMI allegedly had exclusive access and control of the source code, the Court made it clear it would not enforce the Order. With the later discovery of the government contract, Mr. Nesci has filed motions directed to Brady violations and has requested sanctions including reimbursement for the cost of his out of state expert witness, Thomas Workman. Working with him on that motion with other pending source code motions in the Tucson area have been Committee members, Stephen Barnard and Joe St. Louis. In northern Arizona, Committee member Dan Furlong had filed the first source code motion in Prescott Justice Court, in State v. Merryman, which was unsuccessful. However, since then, he has filed other source code production motions, and has been able to satisfactorily resolve those cases on other grounds.

As the third leg of the recent developments, CMI, which said it would never produce its source codes to the Intoxilyzers, announced it would provide a limited viewing of the source code at a price. It would require participants to sign a non-disclosure agreement, obtain a Court Order for Non-Disclosure and production pursuant to the terms of that agreement, and then they would be allowed to view the source code on paper in camera. Any disclosure of the source code would result in liability with the participants agreeing to the jurisdiction of the Kentucky courts. They would also need to agree that the source code was the property of CMI, and pay a fee for viewing, what is state property, of $2,000.

CMI's proposal does not meet constitutional or scientific acceptance. Members of the Committee working with attorney James Nesci, have proposed that the electronic version of the source code with the paper print out be disclosed for verification to the Defense experts at no charge, that they be allowed to examine it for flaws and defects, and if such flaws and defects are found, and are deemed sufficiently serious, that the Defendants be allowed to present that evidence in court to confront and impeach the State's evidence. Counsel have heard back from CMI which has rejected our proposals. They also reject a joint telephonic conference. A reply is being prepared which emphasizes the importance of verifying their source code electronically, and to use it in evidence if the code is flawed or has defects. If they cannot agree to verification and to its use in evidence, there would be nothing left to negotiate.

Meanwhile new source code production motions are being filed in other cases, while pending source code motions are stayed with a prospect of negotiated settlement with the State and CMI. If negotiations fail, or never seriously commence, then counsel will move for production of the source code from the State of Arizona. If it is not produced, the Defense will seek remedies against the State.

The article scheduled to appear in this Fall's Defender was written before it was discovered that the State had contracted with CMI and the State owns the source code, not CMI. A.R.S. § 28-1321.C was never intended to shield the State from court ordered production of its property when necessary to afford a Defendant due process of law and to confront and cross examine the State's witnesses and evidence. The contract presents an entirely new perspective on source code production, one not even arguably protected by the statute, since the legislature and the Governor did not know about the existence of the contract and that the State owned the source code, when it was enacted. Accordingly, members of the Committee will be submitting a revised article on the irrelevance of A.R.S. § 28-1323.C for publication in the next "Defender."

---

Notes:

1. State v. Mason, et. al., Phoenix Municipal Court, was brought by Committee Members W. Clifford Girard, Jr., Curtis Rau (deceased), Lisa Posada, in consultation with Kathryn Carey.

2. State v. Krahn, Maricopa County Superior Court, was brought by Committee Members W. Clifford Girard, Jr., Curtis Rau (dec.), and Lisa Posada.

3. State v. Goodman, et. al., Phoenix Municipal Court, was brought by Committee Members W. Clifford Girard, Jr., Curtis Rau (dec.), Lisa Posada, Kathryn Carey, and Matthew Schwartzstein, working with other attorneys.

4. State v. Martinez, et. al., Tucson Municipal Court, brought by James Nesci with the aid and assistance of Committee members Stephen Barnard and Joseph St. Louis.

5. State v. Merryman, Prescott Justice Court, brought by Committee members Dan Furlong and Curtis Rau (dec.) with the assistance of W. Clifford Girard, Jr.

6. State v. Smith, Phoenix Municipal Court, brought by Robert Jarvis and Committee member Curtis Rau (dec.).

7. State v. Purk, Phoenix Municipal Court, brought by Committee members W. Clifford Girard, Jr. and Lisa Posada.

8. There are no United States DOT, NHTSA, or ADHS/DPS standards for software development, quality control, and/or testing for breath alcohol measuring devices so that no manufacturer has regulatory software requirements to which it must conform or follow, as would be required by the DOD, FAA, and the FDA for products they regulate (That is why comparing flight software in airplanes is irrelevant.) The software development, design, quality control, and testing for breath alcohol testing would not pass the stringent requirements of the airline industry, the Department of Defense, or the Federal Food and Drug Administration. The source code used by the State is not available for peer review or an audit by a regulatory agency, nor within the scientific community.

9. The programming in the Intoxilyzer 5000s caused a problem that required disclosure of machine malfunction. On January 9, 2006, the City of Phoenix disclosed that there were problems with the software programming of its Intox 5000s after nine of those machines stopped working on January 1, 2006. The software in the instruments was programmed to create a life span of only 100 years, beginning from 1906. That date, chosen for unknown reasons, was six years before Arizona became a State. After the year 2000, or what was commonly referred to as Y2K, apparently no one at CMI noticed that such programming could be a problem prior to this failure. The 2006 failure has been dubbed Y2K6.

10. In a current version of Intox 8000 software, .46, a calibration reading of .110 (10% high) is deemed by the software to be invalid even though by State regulations it is acceptable. The source code will instruct the instrument to fail the calibration test as out of tolerance, and abort the test process when according to generally accepted practices and the rules and regulations of ADHS/DPS/PCL, that reading is considered to be within tolerance and within the calibration of a known standard.

11. The current version of the software, .46, fails duplicate breath subject test readings from the same subject that are exactly .02 apart. That is contrary to Arizona law and the connrules and regulations. The programming in the instrument will declare the breath alcohol test readings invalid, and instruct the instrument to take a third breath alcohol test from the same subject. The third test could be a disadvantage to the suspect by being out of tolerance, and could be a higher test than one of the other two test results.

12. There was previously in the Intox 8000 software a "blow at wrong time" program which was supposed to abort the test when a subject blew at the wrong time. The program required a revision because it aborted tests where the suspect had blown at the right time, so that valid tests had not been recorded, or valid tests could have been rejected as a refusal. This led to confusion in processing breath alcohol tests and resulted in unfair results and uneven treatment of suspects. While this problem was corrected, it is an example of unforeseen results that are only detected by trial and error, and are not commonly caught and corrected by calibration testing and SQAP tests.

13. The slope detector is a software algorithm that is a factor in determining if there is a valid breath sample for analysis. It had been changed by CMI in the Intox 8000 at the request of DPS because DPS deemed too many subject tests were being aborted due to "mouth alcohol," so with this software change there would be fewer mouth alcohol tests aborted, and possibly more "valid test" results with likely higher readings due to the presence of what could still be considered by some to be a mixture of mouth alcohol and "alveolar air."

14. Correcting errors in source codes can commonly cause a cascading effect by creating new errors in other parts of the code, so one correction attempt could cause unforeseen software errors elsewhere which may remain undetected. CMI has been continually updating/modifying its software versions to correct source code problems, sometimes by "patches" which are specific changes to a particular problem, i.e. the Y2K6 problem. This shows that the software had not been adequately vetted or reviewed prior to shipment.

15. The software programs in the Intoxilyzer control many material functions including, but not limited to, test sequences, tolerances, threshold limitations in the air blank function, the partition ratio of blood to breath, the slope detector for determining deep lung air, the calibration function, radio frequency interference program detection-allowances and alleged susceptibility, legal alcohol limitations, error messages, activation and termination codes, and other features.

16. It is generally accepted within the software industry that there are 23-25 errors of code per 1,000 written lines. The source code for the Intoxilzyer 8000 is said to have 80,000 lines of code. That means that there could be 2,000 errors, flaws, and defects.

17. The Phoenix Police Crime Lab sent to CMI one of its Intox 8000 instruments, 80-001023 to correct the .110 calibration error message in December, 2005. CMI kept the instrument one year and sent it back to Phoenix in December, 2006. They had not corrected the error, but in fact, had added other error messages in trying to correct that one, with .108 and .109 during calibration tests now being out of tolerance, and .106 and .107 being intermittently out of tolerance.

18. Breath alcohol testing as a technology was relegated to the biological sciences, designated as the "relevant scientific community," without regard to the physical sciences, which includes experts in engineering and software. The biological sciences, e.g. chemistry, did not understand the importance of software, and electrical/software engineers were considered irrelevant, except for those who worked for the manufacturers. That has changed.

19. The American way has always been to find out how things work, to fix problems if they exist, to not settle for what we are told or promised without a means of verification. We have reason to believe that there are problems with the source code, particularly since we have discovered problems that have not been corrected or when corrected those problems were unanticipated and the corrections delayed. CMI wants to deny verification, and to limit evidentiary use and access, by saying it is not part of the State apparatus so it can do what it wants and the State will continue using its instruments to obtain easy convictions.

View Archived DUI