Electronic Bread Crumbs in Investiga*ons - Digital Detec*ves: On the Trail of - Presented by
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
Digital
Detec*ves:
On
the
Trail
of
Electronic
Bread
Crumbs
in
Investiga*ons
Presented
by
Sharon
D.
Nelson,
Esq.,
and
John
W.
Simek
Intermountain
eDiscovery
2012
The craigslist killer
Murder
Bondage
Robbery
betrayal
Suicide
2012
• Boston
Police
turned
over
their
files
to
The
Phoenix
• Story
published
in
April
2012
The perfect blend • TradiHonal forensics • Digital forensics (and never forget paper)
Regular
DetecHves
and
Digital
DetecHves
The VicHm – Julissa Brisman -‐ 25 • Parents thought she worked in a tanning salon in Boston • In reality, a masseuse who adverHsed in Craigslist • Alcoholic • Bi-‐polar depression • Arrested for theS mulHple Hmes
Her Journey • AUended AA meeHngs • Near compleHon of a degree in the City College of New York • Wanted to be a counselor
April 14, 2009 • 6th and last client at 10 p.m. “Andy M” • Boston MarrioU Copley Plaza, 20th floor • Partner Beth Salomonis in Denver posted ad • “great company in addiHon to a great touch” • Clients would call Beth from hotel to get room # -‐ safety precauHon
The Crime • Julissa’s client entered the lobby at 9:50 • Tall, blond, black leather jacket, cap • TexHng • Called Beth, got room # • He leS at 10:06
Julissa’s murder • She opens door • He pulls out a 9mm Luger pistol inside room • Begins to bind her with Flexicuffs • She fights back • He hits her with gun and then fires three Hmes
Three
bullets
• One
lodged
in
her
hip
• One
through
a
lung
• One
through
her
heart
• Killed
her
instantly
• She
fell
face
first
in
doorway,
halfway
out
the
door
The body is discovered • Jane Greenberg and son Leo heard screams down the hall • Saw body • Thought it was a sulking child • Another young woman realized it was a body • Security called, no pulse, a lot of blood, dialed 911, believed she had been stabbed
Homicide detecHves Robert Kenney, James Freeman and Daniel Duff
IniHal invesHgaHon • Duff and Freeman arrive a liUle before 10:30 • Media cameras already there • Kenney went to hospital • Julissa pronounced dead at 10:36 • 20th floor quiet, officers and security guards
DetecHves did walk-‐through of room
Pulled surveillance footage
4 Homicide DetecHves, District Four • Previous Thursday • Responded to a call across at the street at the WesHn Copley Place • Trisha Leffler, a masseuse who adverHsed on Craigslist, Hed up with flexicuffs and robbed at gunpoint
Video
surveillance
• Privacy
implicaHons
• How
oSen
are
you
on
camera?
• Stores,
hotels,
businesses
• Private
homes
–
outside
and
inside
• How
these
systems
work
• Archives
Closed circuit TV in England • London – external surveillance on almost all streets – 10,500 cameras sending footage to a central locaHon • More per person than any other country • Parabolic microphones – on or off?
London subways • Another 6,000 cameras • 2005 – footage helped catch suicide bombers who killed 55
In the U.S. • # of private and public cameras unknown • Privacy advocates concerned • MSNBC reported in 2011 that 30 million cameras have been installed in the U.S. since 2001
Sharon’s quote • “Whatever privacy we have is because of the sheer volume of electronic data – if you come to the aUenHon of the government, from that moment on, you have no privacy.”
Adding it up • Gun • Flexicuffs • Duct tape WITH fingerprint – not in database • Videos showed guy • Next stop Craigslist • Found Julissa’s ad
Julissa’s phone had no PIN • Marriot secured at 3:10 a.m. • Hadn’t used her own name at hotel but had her ID • Tried to go there – she had moved • Found “Mom lisHng” in phone and dialed (feared media would get there first)
Smartphones • Explosive growth in evidence • Texts, e-‐mails, photos • Dates and Hmes • Cell phone triangulaHon • Does it maUer if phone has a PIN or lock code? • GPS data • Expansion card • Deleted data
Cellular TriangulaHon
April 15th • Beth called detecHves • She had called security when Julissa failed to check in • Revealed 10 p.m. appointment with “Andy M” • Andy’s phone number • His e-‐mail: amdpm@live.com • Forensics would have taken MUCH longer
Cell phones • Two different cell phones used to correspond with vicHms, both disposable • Pre-‐paid and untraceable • Could he have used real cell phone? • FBI there on unrelated maUer • Pulled cell phone info for 15 minutes before and aSer crime at cell towers near the incidents
April 16 • Phones used in overlapping areas of Boston • One bought in South Boston • Subpoenaed MicrosoS re: e-‐mail address • Had been set up moments before murderer answered Julissa’s e-‐mail – and never used again • IP address where e-‐mail created in Quincy – Comcast now subpoenaed
April 17th • AUack in Warwick RI • Cynthia Melton, exoHc dancer • AdverHsed on Craigslist • Holiday Inn Express • Gun, flexicuff – phone rang • With no answer, husband knocked on door • Suspect fled, on camera, texHng
April 18 • Comcast said it would need two weeks to respond without emergency order • DA’s office supplied order • 10:30 p.m. info came in • Philip Markoff, 8 Highpoint Circle, Quincy, MA
ISPs
and
Telecoms
• The
Stored
CommunicaHons
Act
• What
you
can
get
and
what
you
can’t
– Civil
– Criminal
• Process
to
get
informaHon
• Logs
• RetenHon
period
varies
April
19
• Internet
research
• 23,
BU
medical
student
• Facebook
• Engaged
to
Megan
McAllister
Facebook • Provided detecHves with a printed copy of everything on Markoff’s FB account • All posts, photos, etc. • Private informaHon of all of his friends provided to detecHves, who provided it to The Phoenix. They redacted. • Privacy implicaHons?
Gesng
Social
Media
Evidence
• Procedures
vary
• What
do
they
retain?
• Self
preservaHon
• Law
enforcement
access
• Private
sector
access
How to subpoena Facebook • hUp://www.facebook.com/ help/search/?q=subpoena • “Facebook urges parHes to resolve their discovery issues without involving Facebook” • Stored CommunicaHons Act, 18 U.S.C. § 2701 et seq prohibits disclosure of all but basic subscriber info
FB
and
user
have
access
to
same
data
• Unless
user
has
terminated
account,
unknown
how
long
data
retained
(was
90
days,
believed
to
be
less
now)
• You
must
serve
a
valid
California
or
Federal
subpoena
on
Facebook.
Out-‐
of-‐state
civil
subpoenas
must
be
domesHcated
in
California.
Facebook’s
registered
agent:
Custodian
of
Records,
Facebook,
Inc.
c/o
CorporaHon
Services
Company
2730
Gateway
Oaks
Drive
Suite100
Sacramento
CA
95833
What does it cost? • $500 for each account • $200 for expedited response • 30 days response Hme • Must include user consent form (on FB’s site)
For
the
rest
of
them
Just
Google
“civil
subpoena
and
(the
name
of
the
social
media
site)”
Finding
evidence
on
social
networking
sites
• In
the
old
days,
there
was
liUle
privacy
and
you
could
mine
at
will
• Today,
the
majority
of
people
understand
privacy
sesngs
• Always
check
–
many
are
sHll
“open”
• A
“friend”
might
always
provide
info
• DecepHon
is
obviously
unethical
(on
the
part
of
the
aUorney)
• If
someone
else
deceives
(without
your
involvement),
it
will
probably
come
in
Surveillance unit formed • When Markoff went to grocery store, finger-‐ printed everything he picked up • Asked for his cart when he leS • DetecHves afraid of “tunnel vision” • Had someone “poached” Markoff’s wireless?
Poached wireless • Happens more than you’d think • Unsecured • War driving • No logging enabled • CP
April 20 • 2 p.m., Markoff leS home with suitcase and Megan • Panic ensued • Meltons had not made clear ID • Pulled him over, seized vehicle and took him to police staHon • Said he was heading to Foxwoods casino
InterrogaHons • Markoff “played” detecHves • “Might have” walked through lobby • Finally invoked right to aUorney • Disastrous interview
Megan’s
InterrogaHon
• Convinced
she
knew
• Dumbfounded
by
her
• Wondered
if
should
be
scared
to
go
home
with
Markoff
• DetecHve
said
“Either
she’s
the
best
liar
in
the
world
or
she
doesn’t
know
what
Hme
it
is.”
What to do? • If Markoff asked for release, they would have to let him go • DetecHve Freeman in NYC with Trish Leffler • When she saw Markoff’s photo, teary and visibly shaken • “One million percent sure” that was her aUacker
Charges • Enough for armed robbery and kidnapping charges • Argument about murder charge • Advised Markoff he was under arrest at 4:13 • He did not ask what charges were
April 21 • Got search warrant for his apartment • Discouraged at first • Took out dryer – ammuniHon taped behind it • Gun in a hollowed out Gray’s Anatomy • Flipped over maUress – women’s underwear and one of the disposable phones • Holster, wire Hes, black leather jacket • Murder charge was brought
Following
months
• Gambling
problem
• Lost
more
than
$18,000
in
18
visits
• Julissa’s
blood
on
his
shoe,
inside
jacket
pocket
and
on
gun
• All
telephones
found
• Fingerprints
matched
all
3
crime
scenes
Arraignment – pled not guilty
Megan defended him at first
Megan
visited
him
in
jail
–
broke
their
engagement
Markoff • AUempted suicide 4 Hmes • Once aSer Megan’s visit • Finally taken off suicide watch • Trial slated for March 2011
Megan pocket
• August
14,
2010
–
would
have
been
1
year
anniversary
• Phil
Markoff
commiUed
suicide
• Homemade
scalpel
• Severed
mulHple
arteries
• Bag
over
head
• Toilet
paper
stuffed
in
throat
Ron
Markoff
on
FB
“Phil
Markoff
is
Innocent
UnHl
Proven
Guilty”
page
• “Phil,
I
will
always
love
you.”
Pivotal
clue
was
digital
• The
e-‐mail
address:
amdpm@live.com
A doctor Philip markoffYou can also read
