Latest / Parsing the Truth: One Byte at a Time / Mushroom Murders Part 4

Transcript

Mushroom Murders Part 4 · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiners Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these badass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that filled today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty to cracking the complexities of
0:29
iPhone forensics, Stacy's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Welcome back to Parsing the
0:53
Truth One Bite at a Time where we discussed the facts and what
0:57
they mean in today's digital investigations.
0:59
I'm your host Stacey Eldridge and as always I'm joined by my
1:04
Co host Becky Passmore. This week we're headed back to
1:07
Australia to continue our discussion on the Mushroom
1:11
Murders, the Aaron Patterson case.
1:13
That's right, Stacey. And we have a special guest with
1:16
us tonight. We have Doctor Matthew Sorrell
1:20
with us and he provided the expert testimony on the cellular
1:24
location data in this case. So thanks for being with us
1:28
tonight. OK, my pleasure.
1:30
Well, I don't know whether I'm going to speak with an
1:32
Australian accent or an American accent.
1:34
I did my PhD at George Mason, so we'll see how we go.
1:38
So if my accent slips, you'll know what's going on.
1:40
So Doctor Sorrell, other than that little tidbit you already
1:43
gave us about George Mason, can you tell us a little bit about
1:46
your background and what you've done, and then what you
1:50
testified about in this case as an expert witness?
1:53
My background is that I actually studied electronics engineering
1:57
as distinct from a computer science or informatics type of
1:59
background. That was back in the 90s.
2:02
I worked in defence. I came over to the States, did
2:04
my PhD in information technology, statistical signal
2:07
processing, really in that defence context that George
2:10
Mason came back to Australia and jumped into the
2:13
telecommunications sector. This was 1998 and ended up doing
2:17
a lot of consulting with Australian telcos, with a lot of
2:20
Asia Pacific telcos, particularly at that commercial
2:23
level. I ended up doing Vodafone
2:25
Australia's internal training and applying that electronics
2:29
engineering and radio systems engineering background.
2:32
I then joined faculty here at the University of Adelaide
2:36
teaching telecommunications engineering. 2005 it was 2005,
2:41
might have been 2006. I was approached by a defense
2:45
barrister here about some digital photographs from these
2:49
newfangled digital cameras that we didn't really know much about
2:52
and realized there was a gap in knowledge.
2:54
That started my interest in what I'm going to call digital
2:58
forensic science as opposed to digital forensic analysis.
3:01
And the distinction I make here is that the artifacts that we
3:04
find in the digital domain are more than just logs on a
3:08
computer. And there's a lot of research
3:10
effort into access and acquisition.
3:12
There's a lot of research effort and standard operating procedure
3:16
about preservation of evidence. There's not a lot about what
3:19
does this artifact that has come from a sensor which is then
3:24
being measured, interpreted, summarized, measured again,
3:29
interpreted, summarized and exported.
3:31
What does that tell us about the real world?
3:34
And that applies to cameras, it applies to radio signals, it
3:37
applies to accelerometers and step counts and and and so on.
3:42
So over the last 10 years in particular, that has really
3:46
accelerated. SA police here brought me in for
3:49
the Myrna Nielsen murder where she was wearing an original
3:53
generation Apple Watch. And this was the first time that
3:57
we're aware of globally where we have a homicide victim wearing a
4:01
watch which captured all of the movements of her fatal assault.
4:05
And so that was really critical. But now I want to look at it.
4:08
Before, none of the tool vendors were examining the health
4:11
database at that point. And it was nearly a year later.
4:14
I presented that at an international conference.
4:16
A couple of the vendors were present and they updated their
4:18
tool the next week. So that was nice to have that
4:21
impact. SA Police then realized that I
4:23
actually knew something about telecommunication networks and
4:26
the cellular networks here in Australia.
4:28
And so I started that started to snowball.
4:30
That was also appointed as the scientific advisor to a European
4:33
project called 4 Mobile. So that looked at mobile phones
4:37
from crime scene to courtroom building, European standards and
4:40
training for European law enforcement.
4:42
So I have a bit of a wide geographic spread with with the
4:46
work that I do and it's now resulted in my spare time in
4:50
well over 400 cases and increasingly focused on cellular
4:55
network records. And the reason that cellular
4:57
pops up here in Australia is because we have three different
5:00
telcos. If the court wants to hear about
5:03
Optus records, they could talk to Optus.
5:05
If they want to compare Telstra, Optus and Vodafone records side
5:08
by side, Telstra engineer is not going to be able to speak to
5:11
Optus even if they know all about it.
5:12
And so I come in very much as the expert that can cross
5:16
translate the subtle differences between these networks and, and
5:20
cross compare and then also be able to integrate things like
5:24
and time, time based evidence of a syllable device, whether it's
5:30
a wearable, whether it's a phone, tablet, EPS and be able
5:33
to cross relate those because I have that expertise, including
5:37
academic publications to be able to say, OK, this relates to
5:40
that. This relates to that.
5:41
We can actually see that one of the main skills that I find you
5:44
need in court is not just having the deep technical knowledge,
5:48
but also having the ability to teach and be able to explain.
5:54
Strangely, I find being in the courtroom is, is a comfort zone
5:58
because I have a class of 12 and two teaching assistants at the
6:02
front guiding, guiding the class right.
6:05
And I can just geek out. But I've got to make sure that
6:08
what I talk about is accurate within the bounds of evidence,
6:12
objective. And you know, my audience is the
6:14
jury. It's not, it's not the book
6:18
authors and the, and the journos sitting in the courtroom.
6:21
And that comes across sometimes in the Erin Patterson trial
6:25
because I'm not talking to you. I'm talking to you over there.
6:28
I'm talking to the talking to the jury.
6:30
They're the ones that need to understand the evidence in front
6:32
of them. Yeah, because there were some
6:33
comments like, oh, this could be a long 1 today because we're
6:36
learning the whole existence of how cellular networks came to be
6:40
in mobile base stations and, and everything.
6:43
So it's it seemed like some of those comments were coming from
6:45
those in the peanut gallery who thought they already knew
6:48
everything about this, that and the other.
6:50
Yeah. So I mean, cellular networks are
6:51
interesting, though silly. The records are interesting
6:53
because they're quite easy to read, but they're quite
6:56
difficult to read accurately. They're even more difficult to
6:59
be confident you're reading them accurately.
7:01
And having the confidence and expertise to be able to defend
7:05
your interpretation in the court is another game entirely.
7:08
And so that that's really where this comes from.
7:11
Yeah. And I think every examiner needs
7:13
to have their line of how far they will go with those records.
7:18
I look at them, I go with a teeny bit in with them and and
7:21
then that's about about it. Like I don't even pretend to do
7:23
anything like what you do with them.
7:25
Yeah. Well, and The funny thing is
7:26
this, that if you're looking, for example, at, I say, a text
7:29
message database out of an iPhone, then yeah, you could
7:32
read these text messages and you can read whether they were who
7:36
they were sent from, who they were sent to.
7:38
You can work out whether it's in a deleted partition of the the
7:41
SQL database, but when was it sent, when was it delivered to
7:46
the phone, and when was it read? Well, three different.
7:49
Things. All three different things.
7:50
Yeah. And indeed, was it read right.
7:52
And so we had a, we've had a long time throwing back to the
7:56
Merna Nilsen case. One of the things that happened
7:58
there was that the main suspect had shifted the clock in her
8:00
phone by 8 days just forward into the and got worse.
8:05
It got worse because it crossed over the daylight savings
8:07
timeline boundary and we and we had cross contaminated records
8:12
through iCloud. So yeah, so it wasn't, it was
8:16
you're looking at this export out of a tool.
8:19
And I won't mention celebrate if you don't, but they had
8:22
everything listed by time stamp rather than by index.
8:25
And they ended up being on the critical day.
8:28
She'd fix the clock up manually, but it was 4 1/2 minutes ahead.
8:32
And so there's this conversation that makes no sense because the
8:35
suspect and her husband are speaking where she's answering
8:38
questions before they're being asked.
8:40
And it was only when you go into the database, because it wasn't
8:42
that experience then you realize, hang on.
8:45
And then and then change it. Yeah, yeah, yeah.
8:47
Well, well. That kind of thing, yeah.
8:49
But yeah, so I have. How you do?
8:51
Yeah. Well, I mean, so, you know, I
8:53
have a lot of experience across a diverse range of cases, but
8:55
also across a diverse range of technologies.
8:58
So I'm brought in sometimes during an early investigation
9:03
phase where where police are stuck more frequently at a, at a
9:09
point where there's a brief goes to the court and the prosecutors
9:13
recognize that there's a gap in interpretation and they need an
9:16
expert to well, peer review, pull it apart and be able to
9:20
explain the evidence in court at a level that's defensible.
9:24
And so that's that's my most frequent role and I will always
9:27
find. The prosecutors are hiring you
9:29
more often. I mean, that's kind of where
9:30
it's coming from. It's not like the local PD.
9:33
Yeah, so the local PD pay the bill.
9:36
Or do they do it because the prosecution said you need to do
9:39
this? Yeah, that happens too, right?
9:40
So that's but but it's but it's where I mean, I'll get brought
9:43
in with the evidence. It's very old, very new, very
9:46
complex or very high profile. And so I don't do volume crime.
9:51
You know, the most the most common thing that happens here
9:53
is that, you know, we have all these time zones across the
9:56
country as you do in the States. I live in 1/2 hour time zone,
9:59
which means that I'm fairly acutely aware of the subtleties
10:04
of time zone changes. But these things catch you out
10:07
all the time. And one of our one of our
10:10
networks operates everything on Australian Eastern Standard Time
10:13
because they made a decision in 1992 and now they're stuck with
10:17
it. Yeah.
10:17
And that catches out investigators all the time.
10:21
Yeah. So understanding those
10:22
subtleties and being able to confidently explain this means
10:25
this this means that is really critical.
10:27
I do get brought in by the defense.
10:29
Probably 1/4 of my case is now a defense.
10:31
You don't see anywhere near that many because most of the time
10:35
the message back to the defense is, well, this is how Scrooge
10:38
you are and you don't want to report from me.
10:41
But when it's not, when there is a significant error or a
10:45
significant alternative or a significant alibi, evidence that
10:49
needs to be properly pushed through.
10:52
So you know, I work, I work on both sides, independent as you
10:55
need to be as a subject matter. So we lost Becky in post
10:59
production even though she was there with us live during the
11:02
recording. We lost her asking the
11:04
questions. So I'm going to jump in and ask
11:07
all the questions that Becky asked Doctor Sorrell live.
11:11
Becky's question to Doctor Sorrell was you testified in the
11:14
Mushroom Murders case, the Aaron Patterson's case.
11:18
Could you share with us your involvement in the case, such as
11:22
when did you get hired? What evidence were you asked to
11:25
examine? Did they provide you with any
11:27
information about those I naturalist website visits?
11:31
And finally, what did they want you to determine?
11:39
I didn't deal with the the web browsing history.
11:43
I wasn't needed. There was, you know, there's a
11:45
perfectly good cyber team at Victoria Police that does that.
11:48
My role was around the cellular network records rather than the
11:53
web, web browser history and and so on.
11:56
But did they give you any information like?
11:58
I'll, I'll, I'll come to that. Right.
12:01
All right. So the I Naturalist website is
12:03
not something I found out about until much later.
12:05
I was initially given 4 1/2 years of call data records and
12:09
I'll come into a bit of detail there.
12:12
That's quite a long time. And the question broadly
12:15
speaking, the question that was posed to me was on which days
12:18
did she visit Altrim? Now Altrim is not even a town.
12:23
It's a farm district with a post code and there is a cluster of
12:27
houses at the top of the hill, but they don't form a town.
12:30
It's just a post code and there's a number of cell towers
12:33
that point in that direction. And just to complicate things,
12:37
it's undulating hills and a high elevation spot where the main
12:41
antenna is. And it's not that far away from
12:44
where she lives. It's about 25 minutes drive in
12:48
the fullness of time, but about 20, about 30 kilometers, about
12:52
20 miles away. And because it's a rural area,
12:55
there's not many base stations in between.
12:57
So we have on the one hand this question of when did she visit
13:00
Outram over the last 4 1/2 years and it was as blind as that
13:06
initially. So I have these call data
13:08
records and we're looking for when did she visit?
13:11
And then the follow up was we also have these signaling
13:14
records, which I'll also explain at the moment.
13:17
So I then had these signaling records to then Barrow down on
13:20
particular dates. So in addition to just having
13:23
that level of detail, I also didn't have any why, why am I
13:27
doing this? And it's really important that
13:30
you you go into this actually quite blind.
13:32
If you want to be objective and you have to look at this data,
13:34
you've got to actually look at it as objectively as you can.
13:37
So those sort of questions do at least form a perception of bias.
13:42
So you've got to be really careful.
13:43
So the other thing that I had to do was switch off the news,
13:46
switch off the podcasts. This case, the public attention
13:50
to this case was completely insane, unlike anything I've
13:53
ever seen before. And you know, we have, we have
13:56
3, we have really 7 victims. We have 3 deaths.
13:59
We have an attempted murder. We've got a husband who's been
14:02
poisoned 3 times apparently prior to these murders.
14:06
And of course her children who are now the victims of these
14:09
circumstances. I mean, it's just an absolutely
14:11
horrific crime. And as much as you stay
14:15
lighthearted in the court, you know, it's it's a defense around
14:18
the fact that actually what you're dealing with is really
14:20
horrific. And so that'll come across, I
14:22
think, in how I speak today because I don't want to think
14:25
too much about the actual crime. So 4 1/2 years.
14:27
And really the question was broke down to, is this an area
14:30
that she visits often? Is this an area that's familiar
14:33
to her? Does she go walk a dog there?
14:35
Right. That sort of situation, what we
14:39
had to do as a consequence was was say, OK, well here's here's
14:42
this post code area here are these 3-4 base stations have
14:46
antennas pointing into that direction.
14:48
And they're not far from where she lives in Leongatha and she
14:51
used to live in Korumburra, which is about 15 minutes away
14:56
as well. And we're looking for patterns
14:58
of behavior. Did she visit the Outrun area?
15:01
And the Outrun base station shows up all the time, but on
15:07
her way somewhere else. It's the sort of base station
15:10
that you see. OK, it's, it's, I can see that
15:12
you're on your way West and down to the coast.
15:15
I can see you're on the way north and into Melbourne City.
15:18
But there were a number of these where she came in and, and went
15:23
out and we were able to show a small number where she
15:28
apparently could have been visiting out from.
15:31
And one of them was the 22nd of May, but we, and we flagged it,
15:35
but we still weren't confident that she'd actually gone to a
15:38
place in, in out from and then come home again, because it
15:42
looked like she could very well have simply been on a journey
15:45
around based on their call records.
15:47
So let's, let's talk about call records now.
15:49
So for your lay listeners, the ones that aren't forensic
15:51
examiners, you've, you've seen your, you've seen your, your
15:54
billing record, your phone bill from your, from your provider.
15:58
And I should point out in Australia, well in the US your
16:03
cellular phone has a area code that is local to where you live,
16:08
right? In Australia, it's not the case.
16:10
We have a cellular numbering system beginning 04 and they're
16:14
national by design. So it's quite, you know, you can
16:17
very easily distinguish a cellular number from a fixed
16:21
line number just just from the phone number.
16:23
That would be so helpful to me sometimes man.
16:26
Yeah, yeah. Well, you know, I, I can, I can
16:29
give you an entire treatise on, on the history of cellular
16:32
networks if you like, but let's not do that today.
16:35
Podcast. Entire write an entire series
16:39
about it. So we can see that we have three
16:42
national networks by by design. They have their own number and
16:45
code. We have mobile number
16:46
portability, which means that you can take a Vodafone number
16:49
and you can port it to Telstra, Optus.
16:51
We have virtual network operators, but they all sit on
16:53
one of these three networks. So if you look at your billing
16:57
record, you can see the calls that you make.
16:59
You can't see the calls that came into you.
17:01
Unlike the US, you don't pay for your incoming calls.
17:04
I don't know if that's still the case, but it certainly was when
17:06
I lived there. And you, so you see outgoing
17:08
text messages, you see outgoing calls, and you see the data
17:12
connections you made. And it will give you an
17:14
approximate, oh, you were in this town when you made that
17:17
call. The records the police get that
17:20
sit behind that don't come from the billing system.
17:22
They come from a network database that contains, for
17:26
example, for the telephone call, a party, B party, first cell,
17:30
last cell, and that cell ID is not just the base station, but
17:34
it's the base station and the particular transceiver.
17:37
So that gives you more particulars that we can dive
17:39
down to antenna direction. And then from there, if we want
17:42
it, we can get the technical details of antenna height, beam
17:45
widths, down tilt, so on. If we want to go that far.
17:49
It will then also give you attributions.
17:51
So telephone number, IMEI, which is the handset serial number,
17:55
the MZ which is the SIM card serial number.
17:58
In effect, it's not quite but good enough.
18:00
And if the other party is on the same network, you get the same
18:03
details for the other party. So Telstra called as Telstra
18:06
call, you'll see both parties, but you also get the
18:08
intermediate switch records. So you, you get not just the
18:13
record for your call, but you also get the data bearer set up.
18:16
You also get the, the gateway exchange details will show up in
18:20
those records. So then if the call diverts to
18:22
voicemail, you'll see that as well.
18:24
So one phone call may have one line, it may have 3 lines, it
18:28
may have 8 or 9 lines associated with that one call.
18:31
So as I say, easy to read, not so easy to read accurately.
18:35
It contains incoming and outgoing texts, incoming and
18:38
outgoing calls and call attempts.
18:40
O, if somebody tries to call you and your phone is off network,
18:45
we will see that call attempt. We also have data, data
18:47
sessions. So these days your phone is not
18:50
really a telephone. It's a complex handheld
18:52
computer. It still does plain old
18:54
telephone calls or at least pretends it does plain old
18:56
telephone calls. It's just another service.
18:58
And we see differences between when the network's using 2G or
19:01
3G technology where it's all very circuit centric versus 4G
19:05
and 5G technology where it's all very voice over IP.
19:08
They have different records as well.
19:10
But with data sessions, a data session on the Telstra network
19:13
can last anywhere from a second to 16,200 seconds, which is 4
19:17
1/2 hours. And I'll leave it for your
19:19
technical listeners to work out why 16,200 is a nice number, but
19:23
you've got a foreigner foreigner record potentially.
19:27
And here's the subtlety. Telstra reports one base station
19:31
for that, for that four and a half hour session.
19:33
And if you look at the way in which the the call records are
19:37
assembled, it's now a non atomic system.
19:41
So back in the day, a telephone call on the cellular system was
19:45
an atomic record. In other words, it had in one
19:48
place 1 anchor place, start time, end time, A party, B party
19:52
first cell, every cell, last cell, that entire encapsulated
19:56
record goes off to the billing system and the billing system
19:59
will drag out of that first cell, last cell.
20:01
It's pretty accurate these days. A data session is now handled at
20:05
the edge of the network. And so you've got these
20:08
fractional call records, non atomic broken up.
20:11
And so I start a data session at one site.
20:14
I've got a, I've got a session ID, the start time, I've got a
20:19
start cell. And then as you move and you
20:22
move a lot because your data session is really greedy for
20:25
connection. 2G data connection is we'll hand over when we have
20:29
to 4G5G data connection. We've got 4 GS relevant here.
20:33
We move when we want a better signal, which is all the time
20:36
because we're greedy for data. And so you get lots and lots and
20:39
lots of fractional records and the billing system can't cope
20:41
with that. So it gets mediated down to I
20:44
need a start time, I need an end time, I need a data volume and I
20:47
need a location. All of that information is
20:50
contained in the final record. Telstra particularly describes
20:54
the final record and says, right, that's enough to create a
20:56
billing record, which is great because you now got end time and
21:01
last location. The last location is not
21:04
necessarily at the end time, particularly in the country.
21:07
You can start a data session, do some web browsing and set it
21:12
aside. And the network doesn't close
21:14
down the data session. It leaves it leaves it alive for
21:18
three, four, 4 1/2 hours and there's no data being
21:20
transferred. You've got no other, no other
21:23
function on your phone is calling for a data connection.
21:25
And then 4 1/2 hours later the network says I don't need that
21:28
anymore, I'm going to shut it down.
21:29
So you've got a mismatch between time and place and that's that's
21:33
a problem. So this is a well known problem
21:37
now. Yeah, I don't know that I've
21:39
ever heard that mentioned in the United States, but this is this
21:43
specifically is not my wheelhouse, so I don't.
21:44
Follow. Yeah, no, it's.
21:46
Very interesting. Yeah.
21:47
I mean, you think about it, your billing system basically is
21:50
designed for the network operator to make money, right?
21:54
So it just needs enough information for authentication
21:57
and non repudiation, right? So we're now putting this to a
22:01
secondary purpose. So, yeah, so the consequence of
22:04
this is that when we were looking at these 4 1/2 years of
22:07
call data records, right, we get a very sparse view of the
22:13
movement behavior of that phone. If you're only making 20 phone
22:16
calls a day because actually a lot and you've got a data
22:19
session starting every two hours or so.
22:22
And if you're at home, your data session doesn't need to change
22:25
because Wi-Fi is going to dominate your cellular
22:27
connection over your cellular connection.
22:29
You don't get a really clean high resolution picture of the
22:33
movement behaviour of the phone. So the alternative records that
22:36
we have in Australia are what are called event based
22:38
monitoring and what this is effectively every time you
22:44
change the characteristics of your connection that generates a
22:47
signalling event and we capture those.
22:50
And the ones that are reported in an evidentiary manner are
22:56
those that the telcos are sufficiently comfortable with as
23:00
being reliable that they'll report them because there's a
23:04
danger that you'll get a cellular signalling record that
23:08
comes from a core part of the network that you want to remove
23:11
from that consideration. We still get them, but the
23:15
result of that is that if you are in the city, we may have 4
23:19
or 5 or 10 signalling events per minute as you walk down the
23:24
street. If you're in the country and
23:26
your phone is sitting on the bedside table and you don't have
23:30
Wi-Fi, we may get a an EBM record every 30-40 minutes, but
23:34
we can at least be satisfied that the phone's stationary.
23:37
If you go to the front of the house versus the back of the
23:39
house, then you might get a different cell connection,
23:41
particularly if you're actively using data on your phone when
23:44
you are driving in the country. An interesting thing happens
23:48
because now if you, if your phone's just in the car, right,
23:52
we will see, OK, you've connected here and then I can
23:54
see you've connected there and I can see you've connected there
23:56
because we're a little bit greedy as you do things.
23:58
But if you're using Google Maps or Waze, I think is what you
24:02
tend to use in the States, your phone's back into greedy mode
24:04
and it's constantly looking for a great connection.
24:07
And if you're in a hilly area, you generally see the most
24:10
nearby base stations with the antennas pointing in the right
24:12
direction, and you can track that through.
24:14
And then occasionally you'll get a base station that's 15 miles
24:17
away. What's going on?
24:19
So the second part of what we do is we have high resolution Lidar
24:25
mapping of the terrain of this area.
24:28
And we do a simple line of sight map because these days we've got
24:34
quite amazing processing technology with GPUs that we can
24:37
do this in pretty much real time.
24:39
And we can see that, OK, if you are on this road, these two, but
24:43
these two nearby base stations maybe 3-4 miles away would cover
24:46
this area, but for the fact that you're in the valley.
24:49
But that base station over there, that one that's 15 miles
24:51
away, that's looking straight down the valley.
24:54
And so that's going to be preferred as you pass through
24:56
this zone. And so now you can see that the
24:59
car is in motion even that statically and in isolation
25:02
isn't enough to say, OK, you're on that road, but you can, you
25:06
can. Then when you animate that
25:07
through with those cellular connections, you can actually
25:10
see, OK, these connections make sense if you're on this road.
25:14
And that's really important. So we came down to the 22nd of
25:17
mine and said, OK, there appears to be something going on here,
25:20
but I can't really give it confidently.
25:23
I can't eliminate the possibility that it could just
25:25
be that she happens to have driven the different direction,
25:29
this line of sight. It can kind of work.
25:31
But when we looked at the cellular signaling connections,
25:34
it became really clear that her phone was moving because there's
25:39
signals bouncing all over the place and from sometimes close,
25:42
sometimes far away. And then her phone sat connected
25:47
to the right sector of the Out from Bay station for at least 15
25:50
minutes and then it returned to Leon Gasser.
25:54
So we looked at that and then a little while later, but I was
25:58
also asked to look at another town called Locke.
26:00
Now Locke. Now, I didn't know why I didn't
26:03
care why, but I'm not not really interested in why you're
26:06
interested. Locke, as it turns out, sits on
26:09
the main highway between Lee and Gather and Melbourne City.
26:15
So you you can't go into the city without passing through
26:18
lock unless you try very hard to avoid it.
26:20
So in this case, again, it's a town.
26:22
We weren't given a particular location.
26:24
There are a couple of base stations that cover into the
26:27
Township, but it's much easier to distinguish a passing through
26:30
versus a visit because passing through will show you, OK,
26:34
you've left it, Gather you've connected to lock and then
26:37
you've connected these base stations that take you into into
26:39
Melbourne and vice versa. But we could see these visits in
26:44
and out time to time. So far so good.
26:46
Separately, I looked at some SIM SIM swapping over, etcetera.
26:51
And I think we'll come to that a little bit later on.
26:52
That was a different question that came up and there were some
26:55
other specific dates that then came up as well.
26:58
Now the 22nd of May ended up, let me start with let's go 28th
27:02
of April. First of all, 28th of April, we
27:04
could see a visit to Locke Township.
27:06
Now, I don't know, and I can't say precisely how long she was
27:10
there for, but the records support that she could have been
27:13
there for half an hour. And the reason that I say that
27:16
is because once the phone is stationary, I don't get constant
27:19
changes to the signaling record. I don't know if she went there
27:21
for a coffee. I don't know whether she went
27:23
there to browse a bookshop. I don't know whether she went to
27:25
the local recreation park to find the oak tree to pick the
27:28
death cat, my friend. And even if she went there, I
27:31
don't know if she found any. Right.
27:32
Yeah. And then on the 22nd of May,
27:35
what we have are records that show that she left home of a 24
27:39
minute drive ended up in log then about I forget however many
27:46
minutes there now and then drove home again and then stayed home
27:50
for about 35 minutes and then drove out to Altrim and then
27:54
came home again. Now as far as my evidence is
27:56
concerned, that's it right. What I didn't know was that on
28:00
the 21st of May had been a posting on the I Naturalist
28:03
website that that death cat mushrooms had been sighted at
28:09
this particular location of this particular Rd. in Outer.
28:13
So that was kind of interesting. The other thing is that with
28:16
Locke, on the 28th of April she visited Locke and then in the
28:21
afternoon she bought a food dehydrator.
28:24
That's kind of interesting. What will the jury infer from
28:28
that information? Well, it's spelled, it's spelled
28:31
out to the jury, these connections.
28:33
But remember, I'm just part of the picture.
28:35
I'm not the investigator. I'm not the one that's
28:37
synthesizing all this knowledge. I'm bringing in a certain part
28:40
of the knowledge. Part of the part of the reason
28:43
why we went through 4 1/2 years is that we were also asked to
28:46
look at specific date ranges as well, which I now know
28:50
correspond to other events which appeared to be when Simon, her
28:54
husband, had been poisoned. Now, I didn't have any of that
28:57
information, but there wasn't a really strong correlation
29:01
between those poisoning events and the visits to these
29:05
locations. And indeed, the evidence isn't
29:07
clear that he was poisoned. Well, it looks like he was
29:10
poisoned, but probably wasn't death camp, right?
29:13
There are other there are other toxic plants around in this, so
29:16
they could have really been a different toxin in use.
29:19
We just don't know. Yeah, there's lots of stuff that
29:21
can kill you in Australia. Take your take your pick.
29:24
Well, and see, that's kind of the other thing.
29:26
I wondered, did they give you the like the four plus years of
29:29
records all at once? Because initially his poisoning
29:32
attempts, attempted murder attempts on this strange husband
29:35
were going to be part of one big case.
29:37
So it seems that they probably just said, Kerchunk, here you go
29:40
look at all this stuff. But then when they initially
29:42
asked you to do anything, it was just kind of at. 1.
29:45
Patient, then another other location.
29:47
Yes, I think, I mean the police already had some ideas about
29:51
particular dates they wanted to look at.
29:52
They'd already have a timeline, but they're now looking at,
29:55
well, it's this unusual behaviour.
29:57
So we're looking at a pattern of life type of behaviour here as
30:00
well. And of course, with that many
30:01
records, you have to triage that.
30:03
So you have to make some decisions about what's in and
30:05
what's out. And then we can go to specific
30:07
dates. And so we also had the signal at
30:09
the EBM records initially. So my analyst, she's a fabulous
30:13
telecommunications engineer, did the initial work only on the
30:17
call charge records. And I withheld the signaling
30:19
records from her. So I didn't want her to be
30:21
biased to particular dates based on those.
30:24
The signaling records are expensive, so you don't get them
30:26
for 4 1/2 years. You get them for targeted dates,
30:30
and if I'd given those to her, then that would have just
30:33
created at least a perception of bias.
30:35
So we had to be careful about that.
30:37
So that's why my evidence shifted from possible visit to,
30:40
yeah, this actually really does indicate a visit because it's
30:43
that two stage process. And that was important and the
30:46
defense picked up on it as they rightly should.
30:48
I have no issue at all with the, let's call it aggressiveness,
30:52
but it's not really the aggressiveness of the defense.
30:54
They are there to represent their client.
30:56
They're there to poke holes in the evidence.
30:59
They're there to highlight the the the gaps in the evidence.
31:02
And that's not necessarily a competence thing, but it's, you
31:04
know, this, this evidence isn't black and white.
31:06
It's, it's indicative of something.
31:08
It supports a proposition. There's no such thing really as
31:11
proof support for a particular proposition.
31:14
So they want to highlight that. So I have no issue at all with
31:17
the way in which the the defense pushed their particular line of
31:20
inquiry in the courtroom around that.
31:23
That's what they're there to do. But they're attacking in the
31:26
evidence and and that's. Copper, So I think that gives us
31:30
a lot of great background information on everything you
31:32
had to do to kind of dig in and start and where you ended up at
31:36
some of these cities. Now you hinted to earlier the
31:39
SIM card swapping. Can we move on to that?
31:42
Sure. So.
31:43
Yeah, Because I guess, you know, the question is did you know
31:47
about the SIM card swapping as you got these records?
31:50
Did they tell you anything about that?
31:52
Or all of a sudden and you were like, what the heck happened?
31:56
There's like no cellular records anymore.
31:58
Yeah, okay, so a couple of things with that.
32:00
So the first thing is the records I had were only for the
32:04
phone number that was definitively used by Aaron over
32:08
over the her years and that's a phone number ending in 7-8
32:12
three. I'm not going to give you the
32:13
full number obviously. And one of the questions was to
32:17
look at the the SIM and the handset, the IMEI over time.
32:22
So the call records give you that.
32:24
They give you the IMZI, which is the subscriber serial number.
32:27
It's linked to a SIM card. And I could see that she changed
32:30
her SIM card a couple of times during that period.
32:33
I now know why. One of those was when she and
32:36
Simon separated and she took control over her own account and
32:40
so she's swap the SIM out. It's not unusual to have an
32:44
occasional swapping of a SIM and keep the same number.
32:47
I had to do exactly this last week when one of our networks,
32:50
and I won't mention Optus, but realized that they can't that
32:54
that my SIM wasn't going to be able to call emergency numbers.
32:56
So they said you've got to go to a store and get a new SIM.
32:59
So there's reasons why that occurs.
33:01
The other thing is over 4 1/2 years, it's not unusual to swap
33:03
your handset out, right? And so we see that behave.
33:07
So I didn't flag any of this as unusual, suspicious because
33:11
there's plenty of innocent reasons why this happens.
33:14
You know, you, you drop your phone, you, it falls into the
33:18
toilet. See that happen, of course, and
33:20
you've got to you've got to go find an old phone and use that
33:23
for a few days while your phone gets repaired, that sort of
33:26
thing. So what I hadn't realized was
33:28
that the 5th of August I didn't know.
33:31
So staying out of the loop, 5th of August, police were at her
33:34
house conducting a search and interview and I've got the
33:38
records up in front of me. I'm not allowed to show you
33:39
these. The gist of this is in the
33:42
evidence so I can talk to it. She had a data connection on her
33:47
Samsung Galaxy phone that started at just after noon, and
33:52
it lasted for 8138 seconds, which takes us to around about
33:57
2:30 PM. But at 1:45 PM, she got a text
34:01
message came in from another Telstra customer.
34:04
So I've got a record of it. Yeah, but it wasn't delivered
34:07
until 1:44 AM, In other words, 12 hours later.
34:14
I was like much later. 12 hours later, when it was delivered,
34:18
the Army's changed. It's now in an older Nokia
34:21
branded smartphone. Okay, now I've seen that Nokia
34:25
phone before. It had been used a year or so
34:28
before for a few days. It looks like one of her phones
34:31
got damaged so she swapped it in, swapped it back out again.
34:34
So this is interesting because now it is a data session that
34:37
opened on her phone, but it then closed a couple of hours later.
34:41
It wasn't closed because the network and the phone talked to
34:44
each other and said we don't need this anymore.
34:45
Closed because the network said I haven't seen you so I'm just
34:48
going to shut you down. Shut it down.
34:51
Yeah, now if you switch off the Samsung phone, it will do the
34:54
handshaking that says I'm leaving now.
34:57
Yeah, and it will close the session, Yeah, if you go on a.
34:59
Slight graceful exit. Yeah, flight mode, graceful
35:02
exit. Flat battery, nice graceful
35:05
exit. There's just enough power there
35:07
to say I'm going. So yeah, you pull the SIM card
35:10
out or you pull the battery out, there's no graceful exit.
35:12
So that's. Kind of time out on the
35:15
provider's end. Yeah, yeah.
35:17
And we see this all the time. We had a case here which is a
35:21
homicide in the in the Victorian Alps where the suspect's name's
35:26
Greg Lynn. The the victim's phone connected
35:29
to the network for about 15 minutes in this remote area as
35:33
the phone was in a vehicle driving past one of the ski
35:36
resorts. But the data didn't time out
35:39
until an hour later because the network couldn't see it anymore.
35:43
There's a difference between the signalling records and the cool
35:46
data records. So what I've got here is that
35:48
sometime between midday and 1:45 PM, she's pulled the SIM card
35:52
out of this phone, certainly done that, probably pulled the
35:55
battery out as well. And we've got this text message
35:58
that doesn't get delivered to 12 hours.
36:00
We've got a few incoming voice calls that go straight to
36:03
voicemail. And then at 1:45 AM, her service
36:07
opens up, this time on a different handset, and that text
36:10
message gets delivered. So that's kind of interesting.
36:12
What I didn't know at the time, but I now know is that she
36:15
handed over a different Samsung Galaxy phone to police with a
36:19
different SIM card. Now what's in evidence is that
36:22
other SIM card had been used in the tablet.
36:25
Now it's really easy to tell why that is because we've got the
36:28
records for that other SIM card. You just look up the army, you
36:31
can cross reference the army. You can see what device it was
36:34
in. So I have these records of what
36:37
devices has her SIM card and her service has been used in over
36:40
time. But this was really unusual
36:41
behavior. We've never recovered the phone
36:44
that she was carrying up until the 5th of August, which don't
36:47
know where it is. Well, we have a fair idea where
36:49
it is, but we're not going to find it.
36:51
And that was her. So her primary phone with a SIM
36:55
ending in 7-8 three. That's the one where she just
37:00
yanked it out middle of the day while police are at her, at her
37:04
location and then. Hands over a different.
37:07
Phone a different phone with a different SIM card.
37:10
Yeah, and that other phone she'd reset multiple times, including
37:16
weird. Well, right, Like if you're
37:18
going to give over a different phone because she didn't give
37:20
over the phone she was using with that SIM card, right?
37:23
But she handed over the same make and model.
37:25
But it wasn't the same phone though it.
37:27
Wasn't the same phone. So I just don't understand like
37:29
why would you pull your SIM card out to just, I'm just talking
37:33
through it out loud. OK, but just give.
37:35
Over a different phone and. Yeah.
37:39
You know, yeah, instead of making your SIM.
37:40
Card and then but then she continued to use her old SIM
37:43
card in a different thing, right Yeah, yeah, that evidence
37:47
actually didn't come out in my in my evidence in chief.
37:51
Both sides forgot to raise it because it was the secondary
37:54
issue, but it came up during the evidence of the main informant.
37:57
So Detective Epinstall and so then we had a Vladi hearing
38:01
about that and I think it was decided that that evidence would
38:04
be given by even style. And I suspect that that was
38:07
agreed because had I given that evidence to the jury, it would
38:11
have hit with a much harder impact as the phone expert would
38:14
have been the same evidence that that that technical aspect of it
38:18
would would have had a had a had a greater psychological impact
38:24
for the for the jury. So I'm quite comfortable with
38:26
the idea that Epping stall gave that evidence.
38:28
He was also more across the other records.
38:31
Remember, I had quite a narrow perspective.
38:34
I didn't have the big picture. So, so that's that behavior,
38:38
though. I mean, we, we're all, you know,
38:39
as experts in this space, we go, it's, it's not unusual behavior,
38:43
but it's really, really, really suspicious and it's quite naive.
38:47
It's quite naive behavior about covering your tracks.
38:50
Look, it, it took a long time and it took my analyst to do to
38:54
do the work and it took my developer to write some scripts
38:57
to help her do the work. You know, it's quite bespoke
39:00
work there. I mean, had I done it by myself,
39:02
I'd probably be still here tearing my hair out.
39:04
So it required it required the team effort.
39:07
And what I really like about having young smart people
39:12
working with me is that they'll look at it a little bit
39:15
differently now. They'll find a different way of
39:17
saying things and they'll raise questions about this doesn't
39:20
look right, what's going on here?
39:21
So that was great. I mean, since after all, after I
39:25
gave my evidence, I then did look up where the addresses
39:28
were. I mean, I didn't know where the
39:29
mushroom fields were precisely until the day before my evidence
39:32
because one of the couple of the jury aids with the maps, which I
39:37
didn't have. So I was given those.
39:39
You're speaking to these. It's like OK.
39:42
Hope you know Australia well. Yeah, well, I, I know this area
39:46
well now, so I knew where we were, but I also didn't have a
39:48
home address until I looked about that.
39:50
It's it's really easy to find a home address.
39:52
It's very public, but I hadn't done that deliberately.
39:56
But once we did, we were then able to go, all right, if she
39:59
did leave from here to there, where could she have got 2 in
40:01
between? And we can actually map the
40:03
alternative routes she could have taken.
40:05
And then we can overlay the line of sight radio signals and go,
40:09
right, well, what fits those records?
40:10
And so we can see that going from home to out from, she had
40:13
three or four different routes she could take.
40:15
Only one fits. It still doesn't prove that she
40:17
went to out from. So I'm not going to put that in
40:19
front of a jury. And even if she did go there, it
40:21
doesn't prove that she went up this side Rd. doesn't prove that
40:24
she got out of the car. It doesn't prove that she found
40:26
death cat mushrooms there. So it's an interesting post hop
40:30
forensic exercise, but it's not evidence I've put in front of a
40:33
jury without comprehensively enumerating all the alternative
40:38
interpretations that you'd have to put there.
40:40
So it's just not something I'd be prepared to put in in front
40:43
of a trial at this point. What was your summary in like 2
40:47
to 3 sentences of what you told the jury was the significance of
40:51
the all of those records you analyzed?
40:53
OK, so it boiled down to this. On the 28th of April, there are
40:56
indications that she went to lock.
40:58
On the 22nd of May, there are indications that she went to
41:01
lock and that she went to Outram during that day.
41:04
And finally, there is a swift SIM change over into a different
41:08
phone on the 5th of August. That's what it really boiled
41:12
down to. But of course it took two days
41:13
to explain that because I've also got to give a four year
41:17
telecommunications engineering degree, crash course efficient
41:20
for the jury to understand what's what's going on.
41:23
One of the things I have to say, one of the things I really
41:25
admire about barristers and judges is their ability to get
41:29
their head around diverse, complex evidence.
41:32
And while it's frustrating to explain the same thing over and
41:36
over again, and you've got the same judge in full 5 different
41:40
cases and you think then you must be an embassy.
41:42
You don't need to know. You have to, you have to review,
41:45
you have to refresh as part of the evidence load.
41:47
Every jury is different. I'm not allowed to speak about
41:50
this jury specifically, but in general, I find that having an
41:53
attentive, an attentive jury, that's us, you know, making eye
41:57
contact, asking intelligent questions is a real bonus as
42:00
well. And this is, as I say, it's like
42:02
teaching a class. You've got to make sure that
42:03
you're speaking respectfully to that level and that they're able
42:07
to follow it. Yeah, I love that class analogy
42:09
and teaching analogy. I love that.
42:12
And now I'm going to ask you the final question of the day,
42:15
Doctor Sorrell. Do you still eat mini beef
42:17
wellingtons and mushrooms? I love mushrooms, absolutely
42:20
love mushrooms, and my local butcher actually does a mini
42:24
beef Wellington. So, yeah, occasionally my one of
42:26
my, my stepsons hates mushrooms, won't touch at all, ever has.
42:31
But so the, the, the individual serving beef wellingtons, yeah,
42:34
no, they're, they're a hit in my family, in the household.
42:36
Yeah, we absolutely eat them and we always have a bit of a
42:38
chuckle. And I was like but everything
42:39
else has mushrooms on it. What do I pick?
42:41
Yeah. So The funny thing is so in the
42:43
in the local community down in Morwell, which is where the
42:46
trial was held. So we're, we're out out of the
42:50
city of, you know, Melbourne, this population is very
42:54
urbanized, far more than the US. We're the same size as the
42:57
continental US, but we've got less than 1/10 of the
43:00
population. So we're very concentrated
43:03
Melbourne, Sydney, Adelaide, Brisbane, Perth, right.
43:07
So we're out in the country town that used to support coal mining
43:10
industry and dairy industry. There's a fabulous Chinese
43:14
restaurant. I have to give a shout out
43:15
because the menu I don't think has changed since 1976, just
43:18
fabulous. But they, they have, they have a
43:21
really interesting relationship with this trial because on the
43:25
one hand, it brought a lot of attention to the town and it
43:28
brought a lot of commerce, you know, all of the, all the eyes
43:31
on the place, but they don't want to talk about it.
43:33
They don't want to be remembered as being a place where this
43:35
horrific murder took place. So you've got that, that balance
43:39
happening, happening in this Township and, you know, full
43:42
respect to the local community and, and also, you know, for
43:44
supporting the family and, and Ian and his church in, in Lean
43:48
Gatha as well. Yeah, I mean, I, I think the
43:53
community will, will close ranks, I think around around the
43:56
local community, the victim's family as well now.
43:59
Becky and I would just like to thank Doctor Matthew Sorrell
44:03
again for visiting with us on this podcast episode where we
44:07
are kind of digging into the cellular data logs that were
44:13
part of the Aaron Patterson trial.
44:16
I found the whole conversation fascinating.
44:19
I myself learned a lot. I hope you learned a lot too.
44:23
And as always, we want to thank everybody for listening to the
44:27
podcast. As always, we truly appreciate
44:30
your support and spreading the word about the work we're trying
44:33
to do. Let's wrap up with until next
44:36
time, stay safe, stay sharp, and as always, keep parsing the
44:39
truth one bite at a time. If you enjoyed this episode,
44:47
make sure to follow us to get notified the next time a new
44:50
episode drops. If you can do more, head on over
44:54
to parsingthetruth.com and donate by clicking on the donate
44:58
button. Parsing the Truth is a nonprofit
45:00
organization and we are raising money to send a new digital
45:03
forensic examiner to I Asus training next year in Orlando.
45:08
Thanks.