The USB Drive in the Locker
A Northern Kentucky hospital system retains your firm on a narcotics-diversion matter. On Tuesday at 6:40 a.m., the nurse manager uses a master key to open an absent nurse's locker and hands you a USB drive, a handwritten note, a partially used vial of hydromorphone, and two loose pills in a sandwich bag. You drop everything into your laptop bag, drive twenty-five minutes to your office, plug the USB into your own laptop to see what is on it, and photograph the items on your desk Wednesday afternoon. You keep them in an unlocked desk drawer because HR says to "hold them until we decide about police." Thursday, HR terminates the nurse and asks you to return the vial to the pharmacy and the USB to the manager. Friday, a county sheriff's detective calls and wants the items and your report. Hospital counsel has not been involved.
1. Identify the chain-of-custody failures and describe what the seizure should have looked like.
Read the worked answer
Almost every link is broken. The manager opening the locker is acceptable if the employer's policy permits it, but the search should be witnessed and documented. The items were then commingled loose in a laptop bag, and photographs were taken a day and a half later on a desk.
The correct sequence:
- Photograph the items in place, in the locker, before anything is moved.
- Item-number and describe each item on a seizure log, with two signatures.
- Package individually - paper envelope for the note, vial as-is, pills in a sealed container, USB in an antistatic sleeve - and seal with tamper-evident tape, initialed and dated across the seal.
- Log each transfer with date, time, from, to, and purpose.
- Store in a locked evidence locker, not a desk drawer.
- Examine no more than necessary.
The desktop photographs are nearly worthless as originals because there is no image of the items as found. The 48-hour gap in an unlocked drawer lets opposing counsel argue substitution or tampering. The rule to state on the stand: one continuous log, every transfer signed, secured storage, minimal handling.
2. Analyze the handling of the vial and pills on one hand and the USB drive on the other.
Read the worked answer
Two different bodies of law.
The vial and pills. These are a controlled substance. Holding them in a desk drawer is possession with no lawful basis once the employer has removed them from the locker. The correct move is either a documented handoff back to the employer's pharmacy or security, or prompt transfer to local police with a receipt - never into your bag or your car. If the employer wants an internal case first, the items go into a sealed, locked container with a custodial log and a defined retention date.
The USB drive. This is a digital-evidence problem. Image the drive before examination using a write-blocker, compute a cryptographic hash (SHA-256) of the original and the working copy, examine only the copy, and record the hashes in the report. Connecting it to your own laptop may have written access timestamps or registry entries, and it exposed your firm to malware.
Document precisely what you did to the drive, because the opposing expert will ask. The drive may also contain protected health information, which is a HIPAA issue for the hospital and an independent reason to keep the review narrowly scoped to the diversion question.
3. The detective wants the items on Friday. How do you document the transfer, and what will you be asked on the stand?
Read the worked answer
Do not hand over a bag.
Transfer protocol. Inventory each item against your log, note condition and any broken seals, photograph the sealed package, and execute a written receipt with the detective's name, agency, badge number, date and time; keep a copy. Record the drive's hash value on the receipt so the lab can confirm its image matches the original. If any item cannot be produced - the vial returned to pharmacy, for example - say so on the receipt rather than papering over it.
Expected testimony. Why the hospital had authority to search the locker (written policy, signed acknowledgment, manager's role); what you personally did with each item and when; what you did not do. Your weakest moment is the 48-hour gap, and the correct answer is to state plainly what happened rather than fill it with assumptions - a candid gap is survivable, an invented continuity is not.
If the matter is prosecuted criminally, the state will need both you and the nurse manager; prepare the manager separately, because she controls the search-policy testimony. In an administrative or licensure proceeding, your log and report may be the only evidence, which is why the contemporaneous record outranks your memory.