Latest / Parsing the Truth: One Byte at a Time / Part 2: Printed Emails Aren't Digital Evidence

Transcript

Part 2: Printed Emails Aren't Digital Evidence · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiners Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these badass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that filled today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty to cracking the complexities of
0:29
iPhone forensics, Stacy's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Welcome back to Parsing the
0:53
Truth One bite at a time. I'm Stacey Eldridge and with me,
0:56
as always, is my Co host Becky Passmore.
0:59
We're diving into digital evidence that cracks cases wide
1:03
open. This is true crime with a focus
1:05
on the facts and the artifacts. Becky, what are we doing
1:09
tonight? Well, tonight we have another
1:11
special guest we're very excited about, Lauren Hillary.
1:14
And she was the attorney that represented the printed emails
1:20
in last episode. So we're very excited about
1:22
Heaven Lauren on our podcast tonight to talk more through the
1:26
trial and all the things that happened during the trial.
1:32
So welcome. Yeah.
1:33
Hi. So whether you're a digital
1:35
forensic examiner or an attorney, we hope you'll find
1:38
this case as fascinating as we have and we can't wait to dig in
1:42
deeper with Lauren. So Lauren, for our listeners,
1:46
can you briefly introduce yourself and give us a little
1:48
bit about your professional background?
1:50
Yes. My name is Lauren Hillary.
1:52
I grew up in Mississippi. I graduated from the University
1:56
of Mississippi School of Law in 2009.
1:59
I practiced civil litigation for 10 years out of law school.
2:03
So that probably had a lot more to do with electronic discovery,
2:07
digital evidence, probably a lot more than criminal law.
2:09
But in 2020, I switched to criminal law, became a public
2:14
defender in Hinds County, Mississippi, which is in
2:17
Jackson. And that sort of changed my
2:19
career and my life way for the better.
2:22
And so since then I have been a public defender in Jackson in
2:26
Harrison County, which is the Gulfport in Biloxi, Ms. And I
2:29
also was a federal public defender for a time.
2:32
And so that's that's sort of a over cap of my professional
2:34
life. I am currently not practicing
2:36
law at all because in January I moved to New Zealand.
2:41
So cool. Yes, very excited to be here and
2:45
I, I will actually start school at the end of this month.
2:49
In order to get my legal qualifications in New Zealand, I
2:51
have to take a couple of law school courses and sit for an
2:54
exam meant for foreign lawyers. So fingers crossed by the end of
2:58
the year I will be qualified as a New Zealand lawyer and
3:01
hopefully continue to practice criminal law here as well.
3:03
Amazing. Very cool.
3:05
All right. So can you now share a brief
3:08
overview of the case and where we spoke about the printed
3:13
emails last week if you just give your overview of this case?
3:17
My client, his name is Jeremy, he was charged with I think 13
3:21
or 14 different criminal counts, essentially accused of sexually
3:26
molesting his stepdaughter. And a lot of, in a lot of these
3:29
cases, it's a he said, she said. And so the thing that made this
3:33
case a bit different was the e-mail.
3:36
Yeah. And the I typically call her a
3:40
complaining witness, don't want to use the term victim because
3:44
that's a bit pejorative from the defense side.
3:46
But so when she and her mother went to the police, they brought
3:50
or they actually forwarded the detective these emails.
3:53
And they were Twitter notification emails.
3:56
So if somebody sends you a direct message on Twitter, on
4:00
Facebook, probably on any of these other platforms, in
4:02
addition to getting the message on that particular platform,
4:06
it'll typically send you a notification to whatever account
4:09
you have registered. And so these emails would come
4:12
from notify at Twitter.com and it would say, you know, this
4:17
person's Twitter handle has sent you a direct message.
4:20
And in the body of the e-mail, it would have a brief, like an
4:23
excerpt of the content of the message.
4:25
And so that's what they brought to the police station.
4:28
It was about 60 pages. I don't remember the exact
4:31
number of the actual messages, but that's all they were
4:34
notification emails from Twitter saying my client's Twitter
4:38
handle has sent you a direct message and they spend a time
4:42
period from about May of 2022 until February of 2023.
4:47
And at the time they went to the police station, this is June of
4:50
2020. Three, OK.
4:51
And so as digital forensic examiners, we are, you know,
4:55
emails that's that's part of our bread and butter.
4:57
And so we're really concerned with the emails.
5:00
And so we'd like you to really kind of tell us why these emails
5:03
were so important in the case. So if you can kind of walk
5:06
through the emails from your perspective, the clients
5:11
attorney in this case, that would be fascinating.
5:13
These, the emails were going to be used by the state at a future
5:16
trial to say this is corroboration, This is some
5:19
independent evidence that this abuse actually happened.
5:22
And the content of the emails themselves were not explicit.
5:26
You know, there was nothing sexual about them necessarily,
5:29
except there was some innuendo. There were things like wear that
5:33
dress or come give me a hug, you know, and some of them were
5:36
sent, according to the timestamp of the emails, at 2:00 or 3:00
5:40
in the morning. So should these emails come in,
5:43
it's, it's a good thing for the state to then hang their hat on
5:46
and say, even if you're not sure about what she said, you have
5:49
these emails that you can hang your hat on.
5:51
That's hard evidence. Did this actually happen?
5:54
And so when I got the case, I said, OK, this is the biggest
5:56
problem. And then I start thinking about,
5:58
OK, how are we going to attack this piece of evidence?
6:00
Because the ultimate goal from my my side would be we got to
6:04
keep these out of trial. The jury can't, absolutely
6:06
cannot, see these. Right.
6:07
And it was all just printed emails, right.
6:10
Did you like as it time went on, did you ever get any electronic
6:14
versions of the emails or what did you get besides 60 printed
6:18
pages from from the first get? Go with the police.
6:21
Right. So I got at the 60 printed pages
6:23
and these are PDFs not even in their native format.
6:27
They're like, you know, when we get discovered, we get a 300
6:31
page PDF that's all just been scanned, mish masked together.
6:34
And so the emails are a part of that case file, which is kind of
6:38
fun by me because the poorer quality that the evidence is,
6:42
the more arguments I have to attack it.
6:44
Does that make sense? Is that why it's always
6:46
horrible? I was like, I can barely read
6:48
this stuff, what is going on? Yeah, because this in my mind,
6:53
this is the worst piece of evidence to get me.
6:55
I guess I don't want it to be any better.
6:58
Does that make sense? Like my, my job is not to go out
7:01
and find, you know, the truth. I've got to represent my client.
7:04
And and if I dig and say I want these in whatever format,
7:08
electronic, you know where you can get more information, that's
7:11
probably not going to be helpful, right?
7:13
Typically, OK, because you know, I don't know Becky and I kind of
7:17
talked about this for like why weren't they demanding the
7:20
electronic else? Didn't really want to, and that
7:24
probably sounds like a very cynical point of view, but it's
7:27
kind of. You know, what we call it on our
7:30
show when we talk about these kinds of things is we call it
7:33
the defense strategies, because when it comes to attorneys, you
7:39
are representing the state or you're representing a client and
7:44
you have strategies that work for your client or the state.
7:48
So I mean, that makes perfect sense.
7:51
You don't want anything else that you'd have to dig a little
7:54
deeper into. Yeah.
7:55
Yeah. And although the state has a
7:57
little bit of a different obligation because they aren't
8:02
only allowed to get things that are helpful to the prosecution,
8:05
they also have to get things that are helpful to the defense.
8:07
There's, you know, there's some constitutional rights involved
8:09
there. But for us, we don't have any of
8:11
those kind of obligations because our duty is solely to
8:14
the client and what's in his best interest.
8:17
Yeah. So I think that's sometimes why
8:19
criminal defense lawyers get a little bit of a bad name,
8:22
because our duty is a bit different.
8:24
And it's not to go out there and find the truth because
8:27
sometimes, a lot of times the truth is not helpful to my
8:30
client, right? So I sort of sat on the issue
8:34
with the e-mail. I didn't want any more
8:36
information. I didn't want them to go get a
8:38
better coffee because what they did do during their
8:41
investigation, so they get these PDF or these emails from the
8:45
complainant and her mom, they issued a search warrant to
8:48
Twitter for my client's Twitter handle.
8:50
And they got, you know, 600 pages of response.
8:53
It was really difficult to read, but it was there from Twitter
8:57
certified by their records custodian saying, OK, here's all
9:00
the information on the subscribers.
9:02
So they were able to definitively say, OK, this is
9:05
Jeremy's Twitter account because this is his e-mail and IP
9:08
addresses that it was accessed from, all that kind of stuff.
9:10
Then when you get to the DMS, there was not a single DM
9:14
between Jeremy and the girl, OK. So to me that's like, OK, they
9:18
tried to investigate, they didn't find anything.
9:21
Best case scenario right here, I don't want to dig any further.
9:24
And so I sort of sat on it, waited till a couple weeks
9:27
before trial and filed a motion to exclude these based on
9:31
authentication. Authentication from a lawyer's
9:34
perspective just means there has to be a witness to introduce the
9:37
document that says this is what it appears to be.
9:41
So for a photograph, you have somebody that says, yes, this
9:44
photograph a fairly and accurately depicts the scene of
9:48
the crime as it was at that time.
9:50
So it's not usually a difficult burden, but you have to have
9:53
somebody to say this is real, this is accurate, this is what
9:56
it looked like. This is what it This is an
9:59
e-mail that I received. But this is that kind of the
10:03
role of the records custodian and and maybe explain like kind
10:08
of what that looks like for just people who maybe haven't seen
10:11
that come back. Yes, yes.
10:14
And a lot of times we have certified records for these
10:16
kinds of things. You send a search warrant off to
10:19
Facebook or to Google, they send you something back saying these,
10:23
this is what we have as far as photographs or posts or
10:25
messages. And I'm going to sign this
10:27
affidavit saying this is true and accurate.
10:30
This is real. This is a real document from
10:32
Facebook. And this is, you know, it's
10:34
authentic. But we didn't have that with
10:36
these e-mail because Twitter didn't have any of these direct
10:40
messages. And so that was kind of my first
10:42
line of attack just on a basic authentication.
10:45
And there's a couple, there are a couple of, I guess, cases in
10:49
Mississippi dealing with electronic or social media type
10:53
evidence. So there's one line of cases
10:56
that says, you know, if it's a social media post that purports
11:00
to be, you know, it's got your picture and your name and it
11:02
says something really incriminating.
11:04
In order for that to become admissible, you've got to have
11:07
something else to say that that person actually wrote it, right?
11:11
Because anybody can make a fake just.
11:13
Have a screenshot of it that's printed out on a piece of paper?
11:17
Is that what that means? That's what that means.
11:20
You have to have something else, whether it's, you know, they had
11:24
their phone during this time period or you saw them or, you
11:28
know, an IP address, you've got to have something else other
11:30
than just, hey, this is what it looks like.
11:32
And so that was one line of argument, but I thought this was
11:36
a little bit different because we don't have direct messages,
11:39
we have e-mail notifications. So I guess nobody testified to
11:44
this. But when a direct message is
11:46
sent on Twitter, Twitter then turns that direct message into a
11:50
notification e-mail through some sort of computer process, right?
11:54
Right. And there's another line of
11:57
mystery case law that says when you are dealing with computer
12:00
generated evidence, you have to have somebody from that company,
12:04
that provider to come in and say this is done in a reliable way.
12:08
The big case, which was actually from our jurisdiction on this
12:11
issue, it was like a failure to register.
12:14
You know, people with that are sex offenders are not allowed to
12:16
be in so much of a distance of a church or a playground or
12:20
whatever. And so to prove that he was
12:22
living or whatever, that he was too close, they just introduced
12:26
a Google Map screenshot and said, look, it's too close, it's
12:30
not 1500 feet or whatever. And, and the appeals court
12:35
reversed and said in order to introduce that Google Map
12:39
measurement, you have to have somebody there for Google to say
12:42
this is reliable, this is accurate.
12:44
A computer generated it, but we do it this way.
12:48
And that makes it something you can rely on because.
12:50
Interesting, interesting. So I guess I have another Segway
12:53
question about like, yeah, OK, so the Google you just can't
12:57
print it and prove distance. So you either go to Google or
13:00
how else would you prove distance?
13:02
Can you say I I drove it with my car?
13:04
I had a yardstick. Yes, easy peasy.
13:07
Keep it simple. OK, see, we're out here thinking
13:10
all the different technical ways we could do this, and you're
13:13
like, just just get a ruler. Yeah, there was another case
13:18
about some kind of GPS data, like maybe it was a stolen car
13:22
and the company had had some GPS thing installed and they wanted
13:26
to just offer that on its face without saying, you know, how is
13:29
this GPS data created? Is this legit?
13:33
Can it be hacked? Can it be tampered with, you
13:34
know, all those kind of things. And so those were sort of our
13:38
main lines of attack because in my mind, these are not messages.
13:41
These are computer generated e-mail created by Twitter sent
13:45
to her. So I don't really, you know,
13:48
without Twitter in my mind, we couldn't we couldn't get there.
13:52
Yeah. So no, go ahead.
13:56
And so it evolved. Of course, once I filed a
13:58
motion, the state then tries to fix the problem, which is
14:02
another strategy reason why we kind of wait until it's getting
14:04
closer to time. And so I found a motion saying
14:07
these are not authentic. We don't have anything from
14:09
Twitter. And then I got within a couple
14:12
of days, I got what they called a Discord journal.
14:15
Do you guys know what Discord? Yeah, I had no idea.
14:19
I. Had to go to some of the young
14:21
guys in our office. I was supposed to say it's
14:22
young, it's a lot younger generation using Discord.
14:26
Absolutely right. And so.
14:29
She, in preparing to tell her mom about this alleged abuse,
14:33
she created a Discord chat or channel or something that was
14:38
private to her, but she inserted a lot of these e-mail
14:42
screenshots and then had like commentary below them.
14:45
So they were calling it like an electronic journal.
14:47
And so that was the next iteration of what I got, which
14:51
to me was even more inadmissible because it had screenshots of
14:54
the messages, commentary, which is clearly hearsay, any of that
14:58
kind of stuff. But the judge did not go for
15:00
that that and then said there the second or third iteration,
15:03
they had the complaining witness just come into the DA's office,
15:07
log into her Google account and press correct on all all the
15:11
emails from Twitter or with this particular handle.
15:15
And so at that point it got worse.
15:16
It went from 60 pages of emails to about 300 pages of emails and
15:21
some of which were a lot more damaging.
15:24
Some said, are you horny? Are you up?
15:27
You know, things that really could not be explained
15:30
whatsoever, right. But the thing that made it even
15:33
more interesting and probably more interesting for y'all.
15:35
So when I get that 300 pages, man, this is what I was afraid
15:39
would happen. It's gotten worse.
15:40
But I compared the 60 pages that we got from the police and the
15:43
300 pages from Google. And they're, you know, there's a
15:46
lot more from the, the version that she printed out in the DA's
15:50
office, but they, they were all appeared to be the same, except
15:54
in five of the emails, the time stamps were just a little bit
15:58
different. Actually went back and looked at
16:00
my notes so I could give you all sorts of specifics.
16:02
I know you all listen to this. Yeah, there was one on the the
16:06
version from the police, it was sent at 12 O 3:00 AM.
16:09
On the Google documents, it was sent at 2:53 AM.
16:13
So. It's not even like a time zone,
16:16
no. No, no, no.
16:18
Totally different times 37 versus 13101140 versus, you
16:24
know, 4, 4 minutes after midnight.
16:25
And so I flagged these and was like, look, and, and by this
16:28
point, this is a hearing. I think we had the initial
16:31
hearing on a Wednesday. The judge recessed it, called us
16:33
back in on Friday. And so it's on Friday before
16:36
trial is supposed to start on Monday.
16:38
And I'm saying, look, these, these don't even have the same
16:41
time. They're a couple minutes apart,
16:43
17 minutes apart. This is how we know they're not
16:46
authentic because an e-mail time, whether you print it out,
16:51
you know, in 2023 or printed out now, they should even say,
16:54
right, if it's from your Gmail account.
16:56
Yeah, nobody could explain it. So I felt like I was this close
16:58
to getting them excluded and then the state move were
17:01
continuous, she said. Well, and then so did they ask
17:04
for that continuance because we know that the state had, was it
17:08
just like an IT guy or was it like somebody like with our
17:11
credentials that came in and talked about it at?
17:14
Least somebody with good credentials.
17:15
So the state has continuance and said, look, what we want to do
17:19
is go straight to Google, issue a search warrant to them, get
17:23
those certified documents back from Google instead of, you
17:26
know, printing out from her account or whatever.
17:28
But OK, I'm still over here saying I don't care what Google
17:31
has to say. I care.
17:32
I know what Twitter has to say, right?
17:34
Whatever. Motion granted, defense
17:36
objections overruled. OK, case gets continued.
17:39
For them to go and get these records from Google, they go and
17:42
get the certified records from Google within like 2 days.
17:45
So they clearly could have done this, you know, in 2023 and here
17:49
we are in March of 2025, right. But the the time stamp
17:54
differences were the same. The Google certified documents
17:57
did not explain or make up or you know, in fact.
18:02
So the Google certified records, once I figured out how to plug
18:05
it into this program, I don't even remember what kind of
18:08
program it was. Y'all probably did this, but it
18:10
gave me a ton of data, which is the thing I was afraid of in the
18:13
beginning. But yeah, one of the things that
18:15
it included was time the e-mail was sent and time the e-mail was
18:19
received. OK, right.
18:21
And on these 5 emails that were messed up, it showed that they
18:25
were sent before or they were received before they were sent.
18:29
Yeah, OK, I don't have a clue what this means.
18:32
I know that I'm going to use it though to say these can.
18:35
This is not good evidence, right?
18:37
Right. And so the judge had set another
18:41
hearing on the e-mail in advance of the second trial date.
18:45
So we can have this hashed out, be ready for trial.
18:48
And it's at that hearing without any kind of notice that the
18:51
state says, hey, we have an expert now to testify about
18:55
these emails and the Google response.
18:57
And he, he has a legit expert, I would say he works for the state
19:01
attorney general's office. He testifies in federal court.
19:04
I know him. Everybody knows him.
19:06
He's OK. He's typically involved in
19:09
pornography cases, OK, He makes the copies of the computers and
19:14
does all that stuff in those, kind of.
19:15
Cases. OK, OK, so he is definitely a
19:18
digital forensic examiner, does the cases of things.
19:21
I don't know why I was thinking it was just you help this dude
19:25
quick. Can you come to court and talk
19:27
about these emails? Well, I think they called him to
19:30
try and explain the time differences because the judge
19:33
seems seems she didn't rule on anything at this point, but she
19:36
seemed troubled by the discrepancy.
19:38
Yeah. And so, but when he can't, I
19:41
don't know why they called him when he came to testified
19:43
because he basically said I can't explain it.
19:46
Yeah. And I wrote down versus quote.
19:48
I wrote it down. Computers sometimes have things
19:53
wrong. Well, have things.
19:54
Wrong. I think we brought that up.
19:56
I was like, computer makes mistake.
19:58
Computers sometimes make mistakes.
20:00
I think is what we said lot, you know, on our last episode.
20:03
Yeah. Because he made, he gave all
20:05
this preamble testimony about all these time zones.
20:08
It can be different because sometimes daylight 10 minutes,
20:10
sometimes not. And I was like, I don't care
20:12
about 10 time zones. We're talking about 17 minutes,
20:14
2 minutes, 7 minutes. You know that's not a time zone
20:17
issue, that is. I wonder if they even had him
20:21
and look at anything or they're just like just come on and and
20:24
talk about emails. Well, that's what I kind of
20:27
pitched a fit because they did not give me any notice that
20:29
there was going to be right expert.
20:30
You know, I think I'm entitled to a little bit of time to get
20:33
prepared to cross any expert because I don't know anything
20:37
about computers. And so now you have to think,
20:40
really think on your feet, especially since you're not, you
20:44
know, you say you're not tech savvy, but I don't know.
20:46
I think you're doing good with these emails myself.
20:49
Yeah, I do too. Well, the judge, actually, she
20:51
recessed the hearing again. OK.
20:54
Gave me gave me two days to prepare for the cross.
20:56
And then that period of time I called him up and was like,
20:58
what's going on with this? You know?
21:00
Yeah. Tell me what you know, because
21:02
people like you guys, you're not on anybody's side.
21:04
I've always found computer people to be very fair, and they
21:08
will tell you exactly what it is.
21:10
Hey, you're dead. You know, you may have an
21:12
argument here, you know, anything in between.
21:15
And he was like, look, they just asked me to look at this.
21:17
Google, the electronic data from Google.
21:20
I don't really have an explanation for why the times
21:23
are different, but this does appear to be emails that Google
21:27
received from the e-mail address notify at Twitter.com.
21:31
And that's all he was really able to say.
21:33
So in my cross that I had two days to prepare for, I really
21:36
got to make a lot of hay about, you know, Google can't
21:40
authenticate Twitter. You can't say how these emails
21:43
are created. You know, if you send Adm, is a
21:46
notification e-mail sent immediately?
21:49
Is there a time lag? How is that created?
21:51
What's the error rate? You know, what is what?
21:54
How often are these e-mail messages sent when there is no
21:57
message? I mean, there's just, there's a
21:59
million different things you can say that he can't answer
22:02
anything to because he doesn't have any.
22:03
Yeah, to do Twitter, and neither did Google.
22:06
But alas, the e-mail still came in.
22:08
Gosh, wow, all that work and they still came in.
22:12
Got it. Yeah, yeah, Cuz Becky and I were
22:15
thinking once you have all the electronic versions, then we can
22:18
examine the headers and see like all the different hops that they
22:22
went through. Did they did they really come
22:24
from Twitter or does it just look like they came from?
22:28
Twitter automated message that you know is delayed, Yeah.
22:34
All he was able to really say was it appears to have come from
22:38
a valid Twitter e-mail. That's sort of the most
22:41
definitive opinion that he was able to.
22:43
Yeah, yeah, so. But you know, he also said
22:46
computers sometimes that do stuff wrong or get stuff wrong.
22:50
Computers sometimes have things wrong.
22:53
I should, I should put that like in a in a little plaque
22:55
underneath the the not guilty part in this case for sure.
22:58
There you go. Maybe then, a great motto for
23:01
us, but for you for sure. Yeah, yeah, yeah.
23:05
But you know, there are a lot of things that could have been
23:08
done. I'm still, I'm not surprised,
23:10
but I think a better investigation when they got that
23:13
response back from Twitter, I feel like they should have gone
23:16
back and said, yeah, maybe do we need to change the language in
23:20
our search for it? Do we need to change the dates?
23:22
What else can we do to make sure that we are have the best chance
23:26
of finding this stuff? Because some of these messages
23:29
were from a couple months before, I find it hard to
23:31
believe that they wouldn't still be there if they were real,
23:35
right? And so the state made lots of
23:39
arguments about what, you know, they don't keep direct messages
23:43
or if a case is involved in, you know, a crime or an account is
23:48
involved in a crime dealing with children, they'll close the
23:51
account. But there was never anybody
23:53
there from Twitter to say, you know, the account was closed for
23:56
this reason or here's our retention policy.
23:59
There was there was nothing like that presented.
24:01
And if the state had been focused on this or the investor
24:04
to Gator had been focused on this, talk to somebody like you
24:07
guys, they probably could have shored up that stuff back in
24:11
2023 when they got case instead of trying to fumble around in
24:15
March of 2025 when it's about to go try.
24:17
Well, and that's the thing you have to do it soonish.
24:21
I mean, everything only lives for so long online.
24:25
And I think everything's getting a shorter and shorter retention
24:29
period for a wide variety of reasons.
24:32
But I've also had cases, you know, dealing with stuff with
24:37
Fox and these automated alerts going to Nichnic and stuff like
24:41
that. And there's no real times.
24:43
And, you know, you asked all these people and we're we know a
24:46
lot of people and we're part of, you know, listservs and stuff.
24:49
And you and you ask like, well, when do they really send this
24:53
out? And they're like, nobody knows.
24:55
Like, you know, and because I guess nobody's gotten like
24:59
somebody from Twitter or somebody from box on the stand
25:03
to explain what the heck is really happening on their
25:07
servers, you know, And so everybody just takes some of
25:10
these time stamps as the end all be all.
25:13
But you're like, come on, like how quickly is all this stuff
25:17
moving? You know, especially with some
25:18
of the this C Sam stuff, like really like they just, it, it
25:23
comes on and they're like Bing, Bing, Bing.
25:25
Like is it really that instantaneous?
25:27
And, and I know like LinkedIn, right?
25:30
Like sometimes I get a notification of a direct message
25:33
4 hours later. And then I swear sometimes it's
25:35
like a day and a half later. So I don't, I don't know what's
25:38
driving it to tell me it via e-mail.
25:40
I have a message from somebody on LinkedIn.
25:43
Right, which is why, which is why you wouldn't rely on those
25:46
notifications, you wouldn't prosecute a child pornography
25:49
case based on the NICNIC tip. You actually have to go and get
25:52
the file or the message or the video.
25:55
Whatever. Yeah, get the evidence and they
25:58
just kind of skip that step. And I think part of it is
26:01
because of the nature of the case, right?
26:03
These cases are very, very difficult from the defense
26:07
perspective to win. They very, very rarely actually
26:10
go to trial. And in this case he was facing,
26:14
there were 13 counts of different varieties he was
26:17
facing. I counted up one time, multiple
26:20
life sentences. Wow.
26:22
And so for him to, to go to trial and put the state to their
26:25
proof took a lot of courage for him.
26:27
And it's not something that happens all the time.
26:29
So I think they just weren't, they weren't thinking about
26:32
what's going to happen 2 years from now when I have to answer
26:35
for this, right. But but in the meantime,
26:37
everybody stayed in jail from July of 2023 until April of
26:42
2025. Right.
26:44
Yeah, it's yeah. Almost two years and yeah,
26:48
waiting to to go to trial for something that he eventually was
26:53
found not guilty for. Right, right.
26:55
And one of the one of the accounts was a Child
26:57
Exploitation count, which was based on the emails themselves
27:01
that the allegation was that he was using the Twitter messages
27:04
to proposition her for sexual activity.
27:06
And so these weren't just, you know, corroboration for all of
27:09
the counts. There was one that was actually
27:12
based on the emails themselves. And we still didn't get that
27:15
sort of thorough investigation on the front.
27:16
End. Because again, it was not an
27:18
actual e-mail message from his e-mail account to her e-mail
27:21
account. It was just another Twitter DM
27:24
notification, right? Right.
27:26
Right. And that's all we ever had and
27:28
there wasn't much of an effort to find anything else.
27:30
So the state got a digital forensic examiner in this case
27:34
to speak on behalf of those, those those emails.
27:40
Did you acquire or get a digital forensic examiner to look into
27:46
it on your side or you just questioned the state's witness?
27:50
Yeah, just question the state's witness.
27:52
Like I said, my strategy from the beginning was just to wait
27:56
until a couple weeks from trial, move to exclude them and let's
27:59
see what happened. I can strongly consider just
28:01
waiting until trial and objecting as they tried to
28:04
introduce them. That's even a even riskier
28:07
decided against that. But no, and the state only got
28:11
the expert after you know, we've had multiple motion hearings on
28:15
these emails and I've brought out the time stamp issue, but
28:19
even they didn't get one to try and prove up on the front end.
28:23
It was only and and they did not call that expert at trial.
28:27
They only called him on the motion here to try and get the
28:29
emails in, you know, in a motion, a pretrial motion.
28:33
Okay, so it's just just to make sure that the when their
28:37
evidence got in, they used an expert for that purpose.
28:40
OK, got it. But then when we get to trial,
28:43
the only thing the jury heard was from the people involved in
28:46
the case and the police officer that said she gave me these
28:49
emails, right? Probably another mistake that
28:52
they made that I didn't fully understand, but they introduced
28:55
all three e-mail versions. So the 60 pages from the police,
28:59
300 pages that she printed out, and then the certified Google
29:03
records as well. And so I think it just made it
29:05
pretty confusing for them. Why do we have 3 versions of
29:08
these things? Why are they the same?
29:10
You know, nobody can really explain anything.
29:12
With those versions, the three different versions, other than
29:16
the time stamps, were there any other discrepancies that you
29:20
recognized? Other than there being more the
29:22
second time around, sure. Yes, there were a lot more the
29:25
second time, right? And some that were more
29:28
explicit, like I said. Yeah.
29:30
Were the more, do you recall if like the more explicit ones,
29:34
were they like older in time, more recent or they're just kind
29:38
of like sprinkled throughout? I could tell you I have a little
29:42
you want to take a little bit of.
29:43
Because, you know, we're just always sitting here trying to
29:45
figure out like what what the heck is going on, you know?
29:49
Yeah, because like they were, they were more recent them.
29:52
They said woman's more. I could never, never figure out
29:56
the real answer. Yeah, the the worst ones were
29:59
from January and February. Of 20 but still dates from
30:05
before she turned in that first batch at the police station.
30:08
Yeah, yeah. OK.
30:09
OK. Well, I sort of make sure like
30:11
it wasn't like these are coming in and he's he's in jail.
30:15
No, the time frame. The emails were from May of 2022
30:19
until the end of February 2023. The way she told her story, she
30:24
made-up all night compiling her evidence, which was these
30:27
emails. And I think that's when she
30:28
created the Discord electronic journal, showed her mom all of
30:33
that in April of 2023. They waited to go to the police
30:37
until June. And so, and it's in June where
30:39
they turned over the 60 pages. But yeah, they were.
30:42
They were out there the whole, you know, arguably out there the
30:45
whole time, even even the worst ones that I didn't know about
30:48
until way, way later. So if the state I had, because
30:52
you would have known that they were going to have the expert
30:56
who testified in the hearing, you would have gotten events
30:58
notice or you should have that he was going to testify during
31:00
the trial too. And so he was not on the list at
31:03
all for during the trial then? Nope.
31:04
I did not know he was involved in the case at all until we
31:07
were. I made argument because it was
31:09
my motion. So I made argument and when the
31:11
state got up to make their argument, they called him as
31:13
would. That's when I knew he was
31:15
involved in the case. In the middle of OK, I had seen
31:18
that in the audience. Like what are you doing here?
31:20
He didn't tell me. Surprise.
31:25
Surprise. Yeah, but but I think that's why
31:27
the judge gave me a couple of days to prepare for that cross.
31:30
But then, but then that was all he did.
31:32
He reviewed the Google search warrant response and said I
31:36
don't know why these are different and sort of went about
31:38
his merry way. They would have been a lot
31:40
better served if they got him involved.
31:42
The case on the front end I imagine he probably would have
31:45
dug up who knows what because they also had her phone and
31:49
Jeremy's phone. Oh yes, the phones, I almost
31:52
forgot. And there was not no messages,
31:56
no photos, no videos on either of these phones that were both,
32:01
you know, they say they were forensically examined by the
32:03
Sheriff's Office. Not but you know, I think they
32:06
plug it into Sellbrite and and do.
32:08
Yep. Yep.
32:08
So they were just like, click, click, nothing to see here.
32:12
But you know, Becky and I had been on the case.
32:14
We might have dug in a little deeper to see, you know what,
32:18
why where sort of situation because, you know, and Tellbrite
32:23
doesn't necessarily parse everything out.
32:26
There's still some manual work to be done.
32:29
Yeah. Of course, I know that from the
32:31
child pornography case in federal court.
32:34
You don't just put it in a computer program and say boop
32:36
boop boop. Where'd I?
32:38
Analyze it. If they analyze it a little bit
32:41
right, you get a little deeper. Correlate some events.
32:44
Yeah. And in fairness to the state's
32:46
expert, I think if he would have been involved in the case, we
32:48
may have at least had some answers about, you know, where
32:51
did this come from? You know, if they were
32:54
fabricated, there probably would have been some evidence
32:56
somewhere of that. If, you know, she also made
32:59
allegations that he had taken photos and videos of sexual
33:02
activity, You know, they didn't find me about on his phone.
33:04
Exactly that kind of stuff. And I find it hard to believe
33:08
that my client was sophisticated enough to delete this kind of
33:11
stuff, you know, out of people like y'all speech, right?
33:14
So maybe, maybe we would have more answers if you were
33:17
involved on what, what the real story is because people have
33:20
asked me about this a lot. Like what?
33:22
What do you think the real story is about the emails?
33:24
I don't have a clue. I don't understand.
33:26
I don't know. I don't know.
33:29
Well, yeah, because, you know, that's our question.
33:31
What is the real story? What really happened?
33:34
Why do those time stamps not match?
33:37
And then I guess another sort of what if question, Right.
33:40
So if they had called their expert back during the hearing,
33:45
do you think you are, excuse me, during the actual trial, do you
33:48
think you would have like tried to find an expert to counter it
33:51
or you're just going to try to cross him really hard and get
33:54
him to say that computers make mistakes again or whatever his
33:57
exact quote was? Yeah, I, I think I, I thought my
34:00
cross was him of him was effective because he was able to
34:03
say, I can't explain how Twitter does any of this.
34:07
You know he's not going to put himself out on a limb and try
34:09
and explain all the stuff that he's not there to specify about.
34:12
Yeah. But I think I just would have
34:14
rolled with him and made him, my witness said.
34:17
Look, I don't know. I don't have any messages to
34:20
review. I can't tell you whether there
34:23
was a message. I can't tell you how Twitter
34:25
sends this message when they send it.
34:28
What's the how accurate it is? You know, there was there was
34:31
just a time we could use to poke holes in this piece of paper.
34:35
Doesn't mean anything as far as evidence.
34:37
Goes So how do you think that impacts the jury when you have
34:41
an expert up on the stand and you can just get them to say
34:45
like no, no, no, when it's like in in your favor, like did you
34:50
do this and what about this? And they're like, I don't know
34:53
and all that sort of stuff. Like does it have a big impact
34:56
or if we said a bunch of great stuff or you know, the answer is
34:59
it depends probably, but kind of walk us through that I.
35:01
Think it has a big impact from from the defense side.
35:06
We don't. So in order for me to get an
35:08
expert, I have to go as a public defender.
35:10
I have to go to the court and ask for money to hire somebody
35:14
and I have to tell them why I need it.
35:16
And they're very strict on how much we could pay.
35:19
And you know, oh, they better be local or, you know, all that
35:23
kind of stuff. So we're already at a big
35:25
disadvantage as compared to the state who has all the resources,
35:29
all the people they can call on and nobody overseeing that.
35:33
Right. Yeah, yeah, that's what I kind
35:34
of say, Like I'm like the state has or the federal government,
35:38
whoever it is, has all the time, money and personnel in the world
35:42
to do this. And then like in cases I've been
35:44
on, I get 16 hours to figure it all out.
35:48
Exactly. Like, oh, you can have $2000 for
35:51
this. Like, what is that going to get
35:52
me? Yeah.
35:54
And so in our world, a lot of times the best case scenario is
35:59
to take that state expert and make them our own or at least
36:02
score our points. And then in closing, we can
36:04
stand up and say, look, the state called this expert and
36:07
they put them up there and told you how great and smart they
36:09
were. And what did they say?
36:11
They're on our side. Right.
36:13
Yeah, yeah. Which we, you know, we've
36:15
learned through doing this podcast that defense has
36:21
utilized the state's expert witnesses, sometimes more
36:26
effectively than the state has in other trials and cases that
36:31
we've looked into. Yeah, I think that's true.
36:33
And it's easier to cross examine somebody then then direct
36:37
honestly because all we have to find is 1 little thing or you
36:41
know 11 point we can make and sort of turn it around.
36:44
I have been in cases where the state didn't call the crime lab
36:48
people and we call them Adna and a serologist, and I thought that
36:52
was really effective. Yeah.
36:55
Although the result of the case wasn't good, but to be able to
36:58
stand up and say this is a state employee, they work for the
37:01
crime lab and they didn't even want you to hear from them.
37:03
We had to bring them into the court, you know, that kind of
37:07
stuff. So we really take advantage of
37:08
that, especially including, you know, these are these are these
37:12
are these are cops and they we call them.
37:15
And I know we're getting off topic from the emails, but since
37:19
you, since we have you here, I want to ask you one more
37:21
question too from, from the lawyerly side of of things.
37:25
And so, you know, when I work for the defense and I get, you
37:27
know, I'm called on, on their direct and then the state or the
37:31
federal government comes back and does the cross and they're
37:34
they're like, did you do this? And did you do this?
37:36
And, and I'm like, no, no, but the reason the answer is it's
37:40
not my job. So my question is, do I, should
37:44
I be like that's not my job or put in the no, because sort of
37:51
situation and and obviously I have to say it nicely.
37:55
I can't be all, all whiny about it, but that's like my concern,
37:58
Like how do I respectfully say that's not my job, That's your
38:02
job. You guys should have done it
38:03
sort of situation. I know like my lawyer should
38:07
come back and and help me recover from that, but sometimes
38:10
they don't know because I didn't say no, because they're just
38:14
like let it slide in that we didn't do this, that or the
38:17
other because maybe they don't know what that means either.
38:19
Yes. Which definitely happens a lot.
38:22
Every lawyer's a little bit different, but I love when my
38:25
witness is on cross and talking as much as they possibly can.
38:28
Because the a perfect cross examination question should be a
38:32
yes or no, right? Right, we don't want you
38:35
talking, but I'm when I'm crossing somebody, I'm talking,
38:38
I'm testifying. So the more that you can say,
38:42
no, I didn't do that because I wasn't the case or because I was
38:45
only hired to do this one small thing.
38:47
I think that would be the government's job.
38:49
I think that's brilliant. I would love it.
38:52
Talk to your talks to the lawyer that's pertaining to on the
38:54
case. And sometimes people aren't, you
38:56
know, I can be a little more bombastic than some people can.
38:59
And it may depend on your jurisdiction as well.
39:01
Like in General Court, things are a ton more buttoned up and
39:04
she probably, you know, state court is a little more
39:07
freewheeling. But yeah, I think the more that
39:09
you can talk and explain exactly what you did and why, the
39:12
better. Yeah, well, that's certainly a
39:14
great tip. Minimally, ask your lawyer that
39:17
you're working with. What do you want me to say when
39:21
the answer is no, because it's not my job, How do you want me
39:24
to handle? That.
39:26
Yeah, yeah. But I like it when they're smart
39:29
ass a little bit, especially when you know they're likable
39:32
and the jury's kind of fighting with them.
39:34
You know, that was. Really good.
39:36
Yeah. And it kind of depends on like,
39:37
you know, the first couple of questions you're more
39:39
conservative, but then even if it's the opposite side,
39:42
generally you get some sort of rhythm going.
39:45
Now, it could be a very confrontational rhythm the the
39:48
whole entire time. But, you know, it can also be
39:51
that friendly, sort of. We're just up here doing our
39:54
jobs, you know? And in our own business, yeah.
39:58
But hope are you being crossed hostilely a lot.
40:00
That's kind of crazy for a forensic expert.
40:03
Well, like a lot that that's not how well I did have one where I
40:08
felt it was, it was very hostile.
40:11
And I did say one of my answers where I was like, he's like you
40:15
just said blah, blah, blah, blah, blah.
40:16
And I was like, no, I did not use any of those words.
40:20
I think I said I was politely. I said no, I do not believe I
40:23
used any of those words. And they was kind of like, well,
40:25
whatever you said, like. Which may or may not have been
40:30
on purpose because when we start talking about technical stuff,
40:34
lawyers kind of get lost in the weed.
40:36
Y'all know that, right? Yes, we don't know what we're
40:38
talking about. That's why we have you to sort
40:40
of explain it in terms that everybody can understand.
40:43
And sometimes the follow up questions don't make sense,
40:45
especially at all. Yeah, yeah.
40:48
But no, I would say my, that one was kind of 1.
40:51
And then the other stuff is, you know, it was a long time ago.
40:54
And I think the only strategy they had back then, because they
40:57
didn't have the knowledge of the technical and know what to ask
41:01
us was to be sort of like aggressive and, you know, da,
41:05
da, da. And then, you know, we calmly go
41:08
back no or yes. And you know, it's not the
41:10
answer they want because back then Becky and I first started
41:15
and we were both in the FBI, then the FBI case went to trial.
41:19
Totally had the advantage when it came to digital forensics in
41:23
my personal opinion. Absolutely.
41:26
So the most important question have you been bungee jumping yet
41:32
since you've moved to New Zealand?
41:34
Yeah. I have been bungee jumping in
41:36
New Zealand, but it was on our honeymoon.
41:38
I haven't. Been yet?
41:39
OK, you haven't, you haven't done it yet again.
41:42
And I know you mentioned that was a while ago, but do you
41:43
remember which bungees you did? Yes, yes, we did the Nevis
41:47
bungee in Queenstown. Yes, it's over a gorge.
41:51
It was insane, actually. I don't know if I could do it
41:54
anymore. I'm a lot more scared of height
41:55
that. Was that one?
41:57
Well, at least when I did, it was the highest Bungie in the
42:00
Southern hemisphere. Was it?
42:01
I don't know if he still is or not.
42:03
Is it 300 meters? No, it can't be 300 meters,
42:08
right? We got to, we got to Google
42:10
this. I got.
42:10
A picture on my wall. See 4 meters.
42:13
Yeah, yeah. That would have been huge, 300
42:16
meters up. Like 1000 feet.
42:18
But yeah, we, we did that one. My husband went first and he did
42:22
like a big swan dive off the platform.
42:25
Yeah. And the best I could do was just
42:27
to fall for it and bring my head off, yeah.
42:30
I'm not doing it. I'm not, no.
42:33
I don't know if I could do it again.
42:34
No. Did you do any other ones or
42:37
just just the Nevis? Just the Nevis.
42:39
Just the Nevis. OK, well, you know, there's
42:41
there's AI can't remember. You can bungee off of isn't
42:44
there the bridge you can bungee off of in Auckland, Yes.
42:48
I did not do that one. I just did the stuff in
42:51
Queenstown, or yeah. Queenstown, I think it's like,
42:54
yeah, where all the extreme sports are, yeah, but it's all
42:58
over New Zealand. We tried to go skydiving while
43:01
we were here, but it was, it was like bad weather and couldn't go
43:04
up. But I've been skydiving before
43:05
as well. But we'd like to do that kind of
43:09
stuff. Glow worm caves in New Zealand
43:11
and you can like rappel down into the caves and there's all
43:14
sorts of insane things you could do here.
43:16
OK, so you're a bit rappelling in the dark then in the glow
43:19
worm cave because I mean. Correct.
43:23
Wow, OK, I did not do that. I didn't know that.
43:25
I just wouldn't like floating down the raft on the raft down
43:28
the river. Yeah, there's like an extreme
43:32
version you could do, which we did.
43:34
I don't know if I could do that anymore.
43:36
Yeah. Well, Lauren, thank you so much
43:40
for joining us. We've really enjoyed, yes,
43:44
hearing your side, hearing your perspectives, because again, it
43:48
goes back to when, when we're speaking through the podcast, we
43:51
talked about the defense and the prosecution having their own
43:56
strategies. And just to know that these were
44:00
your strategies. This was what you were trying to
44:03
do by not allowing things to come in and why they were not
44:10
going to be effective, but they were actually effective with
44:13
with you in the end. So thank you for sharing that.
44:16
Do anything else to add, like why this case was particularly
44:21
significant or instructive from your perspective?
44:24
Know that it was particularly instructive.
44:26
It was a big one. It was the biggest win of my
44:28
career by far, I would say. I think I mentioned before these
44:32
cases are incredibly difficult to win because you do have a
44:36
young girl that gets up on the witness stand and says he did
44:39
all these awful things to me. And then you in this case, you
44:43
did have emails that said, are you horny, make a video, wear
44:47
that dress, you know, all this stuff.
44:50
And the jury actually followed the law and applied the burden
44:55
of proof and, and, and the presumption of innocence.
44:58
And that made me feel good. Yeah.
45:01
Not that I don't think anybody who stood there and said, oh, he
45:03
was totally innocent. I don't think I'm for sure that
45:06
nothing happened. I think they weren't sure that
45:09
anything did happen. And so they they reached the
45:12
only verdict that they could. And that does not always happen
45:15
in these cases in particular. And when we talked to, we did
45:20
talk to one of the jurors, I believe you come in afterwards
45:22
and particularly asked him about the emails, like, how did you
45:25
not convict on this exploitation count when you had emails that
45:29
said things that rang bell? And he said we just were never
45:32
sure that he actually sent any messages.
45:35
And so to have a jury of laypeople with those facts and
45:39
that evidence really like critically think about, you
45:42
know, did they really prove that he did anything was really
45:45
refreshing. Instead of saying if he's a
45:47
child molester, he should go to prison.
45:49
Gave me gave me some faith in the system.
45:51
And I can be pretty cynical. And then you probably left the
45:54
country. Yes, I did.
45:57
Go out on a high though. Yeah, yeah, this was not the
46:00
last. This was in this trial happened
46:02
I think in March or April of 2025.
46:05
I did try a couple after. OK, some good results, some bad.
46:09
Goes with the job, right? Yeah, yeah.
46:12
Always very proud to stand up and fight for indigent people,
46:17
marginalized people. And I'm just the kind of person
46:19
that doesn't like authority. And I love to stand up against
46:22
the government. It makes me feel very American
46:27
in doing so. I believe in the, you know, the
46:29
Bill of Rights in the Constitution.
46:31
And if, if we don't have people standing up for the defendant,
46:35
you know, where would we be? Right.
46:37
Exactly. That's part of our justice
46:38
system, right? Yeah.
46:40
Yeah. Well, thank you so much, Lauren.
46:42
We appreciate your time. Until stay.
46:45
Until next time, stay safe, stay sharp, and as always, keep
46:48
parsing the truth one bite at a time.
46:52
If you enjoyed this episode, make sure to follow us to get
46:56
notified the next time a new episode drops.
46:58
If you can do more, head on over to parsingthetruth.com and
47:03
donate by clicking on the donate button.
47:05
Parsing the Truth is a nonprofit organization and we are raising
47:09
money to send a new digital forensic examiner to I Asus
47:12
training next year in Orlando. Thanks.
47:19
Yeah, yeah, yeah, yeah. Yeah, yeah, yeah, yeah, yeah.