Latest / Parsing the Truth: One Byte at a Time / Casey Anthony: John Bradley Testimony Shockers

Transcript

Casey Anthony: John Bradley Testimony Shockers · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiners Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these bad ass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that filled today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty to cracking the complexities of
0:29
iPhone forensics, Stacy's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Hello everybody, and welcome to
0:53
another episode of Parsing the Truth One Bite at a time.
0:57
I'm your Co host, Stacey Eldridge.
0:59
And as always, Becky Passmore is right here with me.
1:02
And tonight we've got something spicy for you.
1:05
And when this is as we continue to do our deep dive into the
1:10
Casey Anthony trial. We've got a guest with us
1:13
tonight. Who is it, Becky?
1:15
Tonight we've got John Bradley and we are very excited about
1:18
that. So remember, the state called
1:21
him to provide expert testimony for the prosecution, and he was
1:26
a developer of cash back, and it made sense that he would be
1:29
called to testify about it as well.
1:31
But then, in a bizarre twist, the state had Mr. Bradley read
1:36
into the record Internet history from cash back report that
1:41
Stinger actually generated. John, thanks for being here with
1:44
us. Now we've got lots of questions
1:46
were and we're interested in getting answers in order to
1:50
clear up all those rumors and we want to Get the facts out there.
1:54
And I know you asked us why we were talking about this case 14
1:59
years after the trial. And I shared with you that Becky
2:01
and I firmly believe that this case rocked digital forensics
2:05
because what happened between the use of two different tools?
2:09
Great. Well, first of all, thank you
2:11
very much for having on your show.
2:12
No problem answering any questions.
2:14
It's something I remember passionate about forensics.
2:18
So, you know, happy to answer these questions and put some
2:21
light on stuff that might have been otherwise in the shadows
2:24
all this time. Now we are obviously going to
2:28
put our little statement out there.
2:30
We are not here to judge guilt or innocence, but to highlight
2:33
the critical role of process, methodology and expert
2:36
testimony. And we appreciate you being on
2:39
the show to provide that guidance.
2:41
And we don't know if it's possible, but during this
2:44
episode, we want to try to figure out the root cause of the
2:49
differences between the two tools and this whole 84
2:53
chloroform hits versus the one hit.
2:55
John, for the listeners who may not even be familiar, let's just
3:00
briefly describe your background and how you became involved in
3:04
the Casey Anthony investigation. By way of background, I was a
3:07
former law enforcement officer in Canada in a large regional
3:10
police force. I was selected to formulate,
3:13
develop and lead our Tech crime unit for over 6-7 years.
3:17
I became an expert witness, testified in all the judge and
3:19
jury trials here in Canada at different state levels, and
3:23
obviously the Casey Anthony trial.
3:24
I've been programming as a seat as a forensic software developer
3:28
for over 32 years. I've developed a number of
3:30
products and in this case here, back in the day when Internet
3:33
browser history and cache for Google Chrome and Firefox and
3:37
Opera was kind of a very new thing.
3:39
There were no tools available to decode these things.
3:43
And we had the the products like N case and X ways out there, but
3:47
no finite tools to actually I get under the hood and decipher
3:51
it. Speaking of cash back, what
3:54
capabilities did your software provide at the time?
3:57
And then how did the investigators go about using it
4:00
in the Casey Anthony case? A good questions to start with
4:04
the product was designed of an idea I had.
4:06
I was working a homicide case in Canada.
4:09
To make it simple, 2 suspects Co queues were seen at a robbery at
4:15
a local shopping mall and the security guard was new one of
4:18
the accused Because of that interaction.
4:21
They they called an acquaintance, a female on the
4:24
phone and both parties were on their own computers back in the
4:28
day looking to figure out where he lived.
4:30
Now back then we had Internet Explorer and the data recovered
4:34
from all the people's computers. The suspect, the victim we
4:38
recovered I recovered deleted remnants of web pages.
4:42
Now what was the significant was in Canada we have this thing
4:45
called Canada 411 like the Yellow Pages and it lists names
4:50
and addresses and on the third page of results that I carved
4:53
out manually, I could see the address.
4:57
But what the problem was, is this was going to go before a
5:00
judge and jury and trying to take this gooligop and give it
5:04
to an investigator and say look, look, look, this is the stuff.
5:08
All they see is texts. But you know, that web page
5:11
that, wow, I know what that is, required some manual
5:15
intervention. Now back then there were some
5:18
teachings from end case. Back then it was guided software
5:22
how to decode Internet Explorer. So I took it upon myself to try
5:27
to do the same thing manually, but it was so tedious and
5:30
there's so many other web pages. So I decided to write some code
5:33
and what became was this product called Cash Back.
5:36
And so an investigator could introduce web pages, including
5:40
the index files for the browser, and it would forensically and
5:44
properly vet, authenticate and rebuild it offline and present a
5:49
pretty page. And in that case, there was a
5:51
slam dunk at trial. So cash back became this web
5:55
browser web page rebuilding tool.
5:58
And so that's its main functionality at the time before
6:01
the Casey Anthony trial was to basically rebuild pages that had
6:05
been previously visited. Yes, and examined, you know,
6:08
your bookmarks, your inner history timeline analysis.
6:12
So it's very, very typical of today's tools that have a, you
6:16
know, user interface that has grid you.
6:18
Can cache it did all of all of the sort of Internet history
6:22
things that we would expect. Like you said, the browser
6:25
history bookmarks. Did you take the MORC database
6:31
back with you after you left the Orange County Sheriff's Office
6:36
to to analyze it? So in order for me to answer
6:38
that, I have to give you a small preface to how I became
6:42
involved. I set up with the US Secret
6:44
Service Electronic Crimes Task Force, a three or four day
6:48
course on, you know, browser artifacts investigations using
6:52
our tool. This was at the state Florida
6:54
University and the membership, the, the students were all law
6:58
enforcement. And that's where I met Officer
7:01
Kevin Stanger from Orange County.
7:03
And by way of introduction, I said, why is everyone here?
7:05
What do you want to get out of the course?
7:06
And this is where he said, well, I'm trying to decipher Firefox 2
7:13
United history. I said, oh, that's interesting.
7:15
Now, back in the day, Firefox 2 was a googly gob, you know,
7:19
massive text and numbers. And it was actually later
7:23
determined it was called Mork, like a Mork database structure.
7:26
Now, at the time I said, no, I haven't heard of it.
7:29
Do you have the data? He said, yeah.
7:30
He said it hasn't gone to trial, but in the USI understand
7:33
information, evidence is presented to the public.
7:36
So I said, OK, well, I'm only here for three days, right?
7:38
And I and I, when I'm done teaching, I code right up until
7:42
it's time to go to bed. And I said, look, I'm here for
7:45
three days. I said I have my tools.
7:47
I said I'll take a crack at it. So after the third day, I
7:50
deciphered this spaghetti and I used end case to authenticate
7:55
the results. Okay, now I said on the third
7:57
day, in fact, I remember it clearly.
8:00
I was running to the airport and I had enough time to upload the
8:03
results. I told Kevin or Officer Stanger,
8:06
I said here are the preliminary results.
8:09
I said you need to validate it because I don't know with facts
8:13
and issues of your case, where she went, what, whatever.
8:16
So that was how it all started. And then when it comes to the
8:20
what happened, it's very simple and no one really stopped it.
8:24
Want to understand? So from parsing it's very
8:27
simple. You take a flat file and
8:29
everything runs from left to right and there's some
8:31
delineators and a new record starts with a square bracket and
8:36
ends with a square bracket and in between all that are
8:40
parentheses with coordinates. But it's like 84 comma 284 is a
8:46
why they used 8480580687. It's like ABCD 84 represents OK.
8:52
What's going to come after the comma is the number of times
8:55
this URL was visited and A bracket 85 comma, something in
9:00
text is the URL. So 85 means URL.
9:03
Now in the parsing is very simple.
9:05
Look for a square bracket. Look for all the stuff in the
9:07
middle. Have we found a square bracket?
9:09
No, keep going, keep going. Spark was created by a couple of
9:12
guys in the garage. It was undocumented.
9:15
This technology was back in the day and set it in a garage.
9:19
Now, I'll tell you right now, the only two forensic outfits on
9:22
the planet at the time we're talking like 14 years ago was
9:26
net analysis Digital Detective, right in the UK, Yeah.
9:30
And my company cyclist. Now, I'll tell you right now,
9:34
even Jad in an Internet evidence fighter couldn't parse Firefox.
9:38
It was that new. So I did a pretty good job
9:41
cracking in three days and say, here you go.
9:43
But I relied on the experience and the training and knowledge
9:47
of Mr. Stanger to exercise the fundamental basics of feting
9:51
validation. And this, this, I clamped this
9:54
seat for discussion later on in our our interview.
9:57
What gets discovered is that the code in its first draft, which I
10:01
had plenty of correspondence with Mr. Stanger.
10:04
Does it work? Does it work?
10:05
Have you vetted it? Have you tested it?
10:06
Have you tested it? For months?
10:08
I held his hand and we went back and forth.
10:10
Yes, yes, yes, it's perfect, right.
10:12
But what happened was the code was looking for the square
10:14
bracket, kept going, kept going. It's looking for that 84, which
10:18
is the visit count. And then finally way down below,
10:22
it finds the visit count square bracket close.
10:25
And that's how it finished the record.
10:26
But here's the catch. Back then I think the
10:29
predecessor to Facebook was. I think it was info pages or
10:33
info space was the. Myspace.
10:35
Yes, yeah, Myspace, Myspace. So this is where it starts here,
10:40
ends here. And what was the URL is actually
10:43
my It was chloroform up here, but it kept going to find the
10:47
8484 was associated to Myspace. And so it was a very simple
10:51
logic error in coding. But here's the thing, the
10:54
programmers that created the thing came out and announced
10:58
after trial that an 84. If it's missing, it's implied
11:04
that there's a visit count of 1. Again, this was an undocumented
11:08
data format. So what was happening is but,
11:11
and it makes sense and I'll tell you right now from a logical
11:14
engineering, you know, practical development perspective, you're
11:18
working with what you see and what you see is 8480480484.
11:22
So one would without documentation include that 84 is
11:25
a requirement, especially a visit count.
11:27
So you can see how logically is it.
11:28
Well, don't stop yet until we find the 84.
11:31
So that's basically what happened.
11:32
So we might have lost a whole bunch of records in between.
11:34
Hence this is what happened when I took the stand.
11:38
They had produced a report with this anomaly unbeknownst, hence
11:42
there's these sudden gaps and all of a sudden he was here or
11:45
she was here. And then all of a sudden she
11:46
jumped to this page and jumped to this and all I could do was
11:50
just read what I saw because I was unprepared.
11:52
They didn't tell me I was going to be reading someone else's
11:55
report. In fact, that report should have
11:57
been vetted. I think we're kind of getting
11:59
into my my next question. As you mentioned it, you're just
12:01
reading stuff on the stand and, and I really noticed that.
12:04
But so before you get on the stand, obviously they've
12:07
contacted you. So you can you share what you
12:10
remember about being asked to come and testify and the Casey
12:14
Anthony and you know, what did you think you were going to
12:17
testify about? So I remember it very clearly.
12:20
It was 2011 because the trial was in June and I was contacted
12:27
a few months probably like January, February of somewhere
12:30
around there. And I remember Kevin called me
12:32
on the phone and he says, hey, it looks like it's going to
12:34
trial. You're going to be famous.
12:36
I go, oh, I don't want to be famous, but what, what are you
12:40
talking about? Well, we want you to testify.
12:42
Well, why do I need to testify? Right?
12:44
Like it's not like you call Bill Gates to testify, but Windows or
12:48
you call any other, you know, CEO of US, whatever.
12:53
It just didn't make sense to me, especially being in Canada.
12:56
And I also was Privy to the facts and the issue and the
12:59
nuances. And I didn't use net analysis as
13:02
a digital detective. I didn't do anything.
13:04
But he convinced me again, through the prosecutor as well
13:09
that it would, it would add more clout or certainty, I guess, to
13:15
the delivery of the evidence given my, you know, history as a
13:19
police officer testifying as an expert and also being the
13:22
developer. So any questions regarding the
13:25
validity of the data, so to speak, I understood.
13:27
So that's what was sold to me. And so that's the only reason
13:29
why I agreed to it. So did anybody from the
13:34
prosecution's office, from the state contact you to trial prep
13:38
or tell you anything? Or is this mostly coordinated
13:41
through Sergeant Stinger? Yes, is the answer.
13:45
He was the female prosecutor. She was the main prosecutor.
13:48
And she explained to me that I was simply going to answer some
13:52
questions, mostly about how did I meet Officer Stinger, when did
13:56
I write this code? What does it do?
13:58
And I was expecting to be nuts and bolts under the hood, you
14:02
know, breaking down the, you know, bring it up on the on the
14:04
big screen. This is a square bracket.
14:06
I was thinking to get very, very technical.
14:09
I was wasn't expecting and I nor was it even suggested that I was
14:12
going to read a report, let alone one that was not vetted.
14:15
Because if anyone had to take a lead and this I'll just say this
14:18
now to plant the seed because it is the crux of this whole
14:22
conundrum. There was a high degree it was
14:25
gross incompetence by the investigator because anyone with
14:29
this level of criticality on evidence on a homicide based on
14:34
Internet history and you have two products that had different
14:38
results, it would be incumbent upon you to validate, ask
14:43
questions, get back to me. Hey, you know, I got this
14:45
conflict and that was not done. It was evident the day I saw Mr.
14:50
testify and I was at home watching it.
14:53
And so I was assured from 2009 December all the way up until
14:59
the time I got there. Yeah, validated, all looks good.
15:03
So back to the day where he introduced himself.
15:05
I said, so my first question before I go trying to write some
15:08
new code for something that at that time I really didn't have
15:11
any interest in Firefox too, it was so new.
15:14
I asked, did you try net analysis?
15:16
And he said, yeah. I said, well, what happened?
15:19
He says, well, he couldn't handle the time zones properly,
15:22
the time, because I guess the Internet history crossed
15:25
daylight savings in the spring on March of 2008 or 2009,
15:29
something like that, right? And my tool did that right.
15:32
We took that into account. So I took that as meaning we
15:35
tried, it didn't work. We were looking for another
15:38
tool. And the whole time up until
15:40
trial, I had completely, 100% believed that cash back was the
15:45
only two home report created. So it was a shocker to me to see
15:49
Kevin Stenger take the stand and Jose Baez walked up to him and
15:52
said, here's a cash back report. Turn to page.
15:55
So and so can you read that out? And this was the 84 times.
15:58
And then he goes back, he gets the net analysis report.
16:02
He says, what is this this net analysis report?
16:04
Both were created by him. And he said, what's read that
16:07
line? A Myspace visit count 1.
16:10
And I remember Jose Bias asked him.
16:13
He says they're different, quote UN quote.
16:16
And I was waiting for Kevin Stinger as an expert.
16:18
This is where I get incensed, right?
16:19
As an expert, who's taking the stand?
16:21
If I know and if I've made mistake or I know there's a
16:24
conflict in my evidence or whatever, I know it's my duty.
16:29
You know, it's morally it's, you know, it's incumbent upon me to
16:32
explain to the jury, look, I know there's a discrepancy, but
16:34
it can be explained. And here's why, right?
16:36
That's right. And so his answer to the
16:39
question, you know, they're different.
16:40
And his response was, yes, they are.
16:43
Right, I remember that it was just.
16:45
Yeah, it was so still flat. Flat and short, Yep, they are
16:48
different. And I was, I was waiting for the
16:51
butt. And, and what, what shocked me
16:54
is Mr. Stanger has been in the industry many, many years.
16:58
He was due to retire and he is a trainer with IASIS.
17:01
So he's got the credentials, he's got the clout.
17:04
He knows what he should be doing.
17:06
And I was shocked as an expert witness and a police officer,
17:10
especially knowing the severity of the data.
17:12
He didn't want to face the music and say, look, I gave you 2
17:16
reports. I know they're different.
17:17
He should have said I produced 2 reports, two different, but
17:21
there's a discrepancy with cash back and here's why.
17:23
And I know what the problem is. You can trust this and you can
17:25
trust that. It also would have been
17:28
acceptable to say they are different and I don't know why.
17:34
Yeah, so here's the here's where the kicker comes in.
17:37
Kevin left the stand and I called him on his cell phone.
17:39
He wasn't even 5 minutes out of the courtroom.
17:41
He was in the parking lot. And I said, oh, that was
17:43
interesting. He goes, yeah.
17:44
I said, I didn't know you produced 2 reports with an
17:48
analysis. He said, yeah, I figured, yeah,
17:51
he produced 2 reports. And I said, but did you know
17:55
that there was a discrepancy between the two?
17:57
He goes, yeah. I said, did you know that there
17:59
was a problem? He goes, yeah.
18:00
I said, well, how long did you know that?
18:02
I knew about it for a long, long time, which means months and
18:05
months and months. And I said to him, I was, I
18:08
didn't have, I couldn't answer, I couldn't say anything more.
18:11
I was, I was shocked. So about good 10 seconds I
18:14
finally said, Kevin, I said, why would you submit 2 reports that
18:18
were different and not at least offer an explanation as to why
18:22
they're different, especially if you knew they were different.
18:23
And his answer was very simple. He said, I just figured I'd let
18:26
them sort it out. Who them is, I don't know.
18:29
But you know, as a forensic expert, any forensics, any
18:33
expertise, you don't give it to a layperson and say you figured
18:36
it out. So this is the so that whole
18:39
thing that I just explained is what the media didn't want to
18:42
report. They didn't want to hear about
18:44
it. And any attempt to even suggest
18:46
something, the Orange County Police Department, the what he
18:50
called mediation liaison officer decided to post something
18:54
saying, well, Mr. Bradley's just more worried about
18:57
embarrassment, blah, blah, blah. This is because New York Times
19:00
called me want to do, you know, article.
19:03
And one thing I've learned very quickly, you're either part of
19:05
the conversation or you're not. And if you're not part of the
19:08
conversation, well, they can write whatever they want.
19:09
Absolutely. So I was shocked that George
19:12
County Sheriff's Department, the media latest officer decided to
19:15
throw me in the bus as well, right.
19:17
So basically I was lured down there to do someone else's dirty
19:22
work instead of testifying about really the substance.
19:26
The substantive part of it is very simple.
19:28
And so to that point, as soon as I heard him get off the stand, I
19:32
had that conversation. I was getting a hold of the
19:34
prosecutor. I was calling her.
19:36
I sent her an e-mail to her work e-mail for business e-mail.
19:40
And this is the other thing. Immediately liaison officer
19:42
said, well, according to the prosecutor, Mr. Bradley must
19:44
have sent it to her personal e-mail.
19:46
Well, I'll tell you this right now from the get go, she was
19:48
sending me e-mail correspondence from her personal and her work
19:52
e-mail the whole time. And given the climax and the
19:55
severity and going to final arguments and submission for the
19:59
jury and you have three or four days to do that, one would think
20:02
that you'd be on speed dial totally hovering over all your
20:05
communication channels in case something, right?
20:07
I said look, I'll come down there.
20:09
For free. Bono I I found as soon as I did
20:11
it, I went to my computer and within half an hour, not even
20:14
that, I found the problem and I fixed it.
20:16
This is the absurdity of how had Mr. Stinger even bothered to do
20:20
any vetting whatsoever, validation back in January or
20:23
January 2010, all of this could have been avoided.
20:26
And so no one wanted to, Everyone wanted to save face.
20:29
But I, I volunteered to go down there in my own time, fix the
20:31
problem because they had time. It was explained to me they had
20:34
time to call me back before the Tuesday morning and this was
20:37
like Friday. Plenty of time to get up there
20:39
and say, look like, and I have no problem taking ownership of a
20:42
mistake, right? It's a bug, right?
20:46
I didn't lie about the evidence. I was testifying about someone
20:49
else's inadequacies in their reporting or disclosure.
20:52
So anyway, that is what I've been wanting to tell all this
20:54
time. But the armchair critics
20:56
wouldn't want to hear it. Media sensationalizes it and
20:58
says, oh, 84 times, right? They don't want the true story.
21:01
They don't want to know that a forensic person should have done
21:04
what they should have done, and instead this became a debacle.
21:07
Were you told in advance that you would be testifying about
21:11
the 2 reports that Sergeant Stinger generated with cash
21:15
back? Were you ever told that?
21:16
I was told there was one report and for my knowledge it was the
21:20
complete chronological, every record report.
21:24
So everything that should have been in that database should
21:27
have been there. That was I was going to testify
21:29
about and going back to that conversation I had with with
21:33
Kevin outside the courtroom when he was out there that night.
21:36
In fact, on the news, all you do is with the channel the dork.
21:40
So these guys that were these garage guys that wrote the
21:43
morgue Davis. Well, we've resurrected the code
21:46
we've posted for the world to see.
21:48
The decompiler or the, you know, the parsing tool is called Dork.
21:53
Everyone can download it. So I downloaded it and I
21:55
validated against my, you know, revised code, right?
21:59
That same day. That was a Friday, so it's kind
22:01
of funny, right? And so it sounds like you
22:04
weren't supposed to testify about any report in detail.
22:08
It was more about the nuts and bolts of how your software
22:12
worked. And I remember watching you
22:14
testify when I watched the recording recently.
22:18
And they hand you this report and they asked you basically
22:21
what is this? And you say this appears to be a
22:24
cash back report. So my question is, did you view
22:28
the two cash back reports or any cash back reports generated by
22:32
Sergeant Stinger before you testified that you knew was
22:36
going to be an exhibit? SO2 parts to that answer #1 the
22:40
answer is no, I was not provided any report.
22:43
And #2 I'm a very, very highly technical, attentive and I, I
22:48
catch words. Prosecutors, you know, defense
22:51
lawyers will say something. I already know where they're
22:53
going with it. And so when I see that report,
22:55
my Spidey sense was going off already, so I'm not going to.
22:59
It's photocopied, right? Yeah.
23:02
The header looks like my report. Yeah, the format looks typically
23:06
that, but I'm not going to say it's the same.
23:07
That's why I said it appears to be.
23:10
Right. But the time did you think
23:13
testifying about reports that someone else generated with your
23:18
tool was unusual or typical? Had you ever done that before?
23:24
So I'd never done that before. And to me, you know, running a
23:29
forensic lab and, and being involved with prosecutors and in
23:33
the backroom talking about evidence and testifying how
23:36
we're going to present this, That is never something that has
23:39
ever come up. It would be, you know, you could
23:41
take the issue of computer forensics and let's go to
23:44
biological forensics fingerprinting, for instance,
23:46
right? You could draw some type of
23:48
comparison, like you got the expert who does the
23:51
fingerprinting, you know, got the power and all that.
23:53
But no, someone comes in and says, well, no one's going to
23:56
come in and talk about someone else's report.
23:59
It's the person who did it, the person who handled the evidence,
24:02
not some guy after. The fact that it's just, it's
24:05
nonsensical is what it is. A follow up question, and it's
24:09
always so weird when you're on the stand.
24:11
Did you feel like you just had to keep answering the questions?
24:15
There was no way to say I can't do this.
24:18
I can't read this. A lot of thoughts go through my
24:22
heart well and quickly. I'll I'll say this from my own
24:25
experience. I'm not sure what I would have
24:27
done in your shoes. Yeah, so given the fact that I
24:32
had 6,000,000 viewers watching me and, you know, given a
24:35
report, I kept my cool and I, I, I don't really sweat it.
24:40
I just approach it. You'll take a breath, read it
24:42
and I don't have to watch the videos.
24:44
I remember because my style is very simple.
24:47
I'll read the report and I'll say lying, blah blah, blah,
24:50
says. And then I remember her asking
24:52
questions along the lines. So from there they went to the
24:55
next line layer and I was asked to kind of hypothesize why or
24:59
how we went from row 10 to row 11.
25:03
And I found it noticeably odd. And all I could do again in that
25:08
moment, absent of any other information to say that this has
25:14
been doctored or limited filtered is what it was or
25:18
incomplete. Absent of that information, I'm
25:21
assuming Kevin Stinger did his job and he vetted and this is a
25:25
bonafide report. So, and this is what the
25:28
armchair critics out there in cyberspace forensic space,
25:31
you're all critical. You know, how could he possibly
25:33
go to a pop up window and stuff like that?
25:35
I was hypothesizing on the moment because I had all this
25:39
belief that what I had was a pristine, properly vetted,
25:43
validated report. So I have to figure out how
25:46
could it be possible? Thinking on the quick, how did I
25:48
go from this URL to this URL? Is this a pop up?
25:51
Is this a JavaScript? What's the why is there, you
25:54
know, page four O 4? I don't know, but I tried my
25:57
best to surmise but my words were carefully selected.
26:01
I didn't say this is what happened.
26:03
I said it's likely or it I didn't say it's likely.
26:06
It's possible that I will never use a committed word like it did
26:10
happen. They did this because I know I'm
26:12
dealing with questionable material, let alone a printed
26:16
report, you know, photocopy. Yeah.
26:19
And you know, you had a really long, long testimony.
26:22
You got called back the next day and most of it you were just
26:26
reading stuff into the record off of the report.
26:30
And the defense, Mr. Baez, didn't do hardly any objecting
26:34
while you were reading. Right.
26:35
And you know, knowing how lawyers think and and you know
26:38
how you just basically said, well, he knew what I only we all
26:43
figured out half the fact that you know, and I'm explaining to
26:46
you now because up until now, maybe it didn't make sense to
26:48
most people that, you know, maybe he figured out because,
26:52
you know, he's not obliged to disclose his experts, right.
26:55
So he could have very well had the answers I've given you
26:58
today. He could have really known that
27:00
way back then. Go, we're just going to keep
27:02
give them some more slacks and more lying.
27:04
Just let them hang themselves. And that's pretty much what the
27:06
prosecution did. See, the prosecution relied on
27:09
evidence and this is a problem in a lot of legal processes,
27:12
right? You have a prosecutor and then
27:15
you have the people who find the evidence and the people who
27:17
prosecute present the evidence. If there there's a, we've got to
27:21
be a trust there and there's a total disconnect there.
27:24
So, you know, he gave them a plate of goods and all the
27:28
prosecutors do is rely on the fact that they are pristine and
27:30
correct and true, right? And so This is why he probably
27:35
knew, I don't doubt it for a minute that he probably knew
27:37
what we know now, just to a varying degree at least, at
27:41
least knowing that the report was skewed because he did know
27:44
that the net analysis report had one.
27:46
And so they probably did their own research.
27:48
Again, having 18 months to investigate this discrepancy was
27:55
well to his advantage. Sorry, if the single lead
27:58
investigator is keeping a lid on this discrepancy right up until
28:02
trial, until doesn't even disclose it, then this is where
28:06
it all fell apart. Because if you're not going to
28:08
admit that there's a problem, you're not going to admit that
28:10
you know there's a problem, and you're not going to investigate
28:13
or fix it or disclose it or try to at least make sense of it to
28:17
the jury. Explain it.
28:19
Then he was probably just laughing the whole time and just
28:22
waiting for the prosecution to finish their whole reading the
28:26
report. And that'll tell you.
28:26
That was the longest, I think it was 4 hours that one day just
28:30
reading a report. In the in a future episode, we
28:33
are going to have the defense digital forensics expert come on
28:37
and talk about his role and what he did.
28:39
And so I don't want to misspeak now, but he does talk about like
28:43
some of the work he did with the MORC database.
28:45
So everybody will get insight to that in a future.
28:48
So to get some more insight to what we were just wondering with
28:51
you, what did the defense know coming into the trial?
28:55
Well, here's the thing, too. I mean, if you were to backtrack
28:58
and we'd go back in time to January 2010 and Mr. Stanger
29:03
said, hey, we got a problem, right?
29:04
Well, it'll be all hands on deck and we would probably know what
29:07
that defense expert probably knows, right?
29:10
But if you're not going to say anything, you're going to keep
29:12
it hidden, bury your head in the ground for 18 months, guess
29:15
what? That's a lot of time to do your
29:17
research. I wouldn't be be surprised
29:19
whatsoever this expert says everything that I told you was
29:24
exactly how he found it, and he probably found it so quickly
29:27
early on. This is probably for, if I could
29:30
speculate, I mean, it probably gave Mr. Baez some great
29:33
confidence going into this part of the the trial right knowing
29:38
what she knew. When you were meeting Sergeant
29:41
Stinger, he explained to you that he had tried net analysis,
29:45
but the problems were with the times.
29:48
Is that correct? Yes, and that was in December
29:51
2009. And the way I posed the
29:55
question, the way he answered the question gave me every
29:58
reason to believe that he dismissed the use of any reports
30:03
he could create because the times he made a big deal about
30:05
the times and I understand the times.
30:06
Why present a report if it's inaccurate, right?
30:09
Because he he delivered the answer exactly like that.
30:13
I would rather use your tool because it addresses this.
30:16
So I said well, I'll write the code and as far as I know, an
30:19
analysis was put on the back burner because it didn't handle
30:22
the time stamps. So the only next time out of 18
30:25
months that I ever heard anything about analysis was the
30:29
moment Jose Baez put a report on front of the podium in front of
30:34
Mr. Banger and said, and what is this, the net analysis report?
30:37
And I was shocked. My mouth was hanging open when I
30:40
saw I go, what? Since when was net analysis
30:42
used? You know?
30:44
And that was when Baez, the defense, called Stinger back to
30:47
the stand to be one of their witnesses to get evidence in.
30:52
He was trying to get that net analysis report in through
30:55
Stinger. He tried first with Osborne,
30:57
Detective Osborne, and failed. And then when he realized it
31:01
wasn't her report, but Sergeant Stinger's report, then he had
31:04
Stinger come to the stand and get the exhibit in that net
31:08
analysis report in through him. Yes, precisely.
31:11
And as we all saw it was the reports, they're different.
31:15
Yes, they are and a story. Thank you.
31:17
No more questions like where's the rest of it?
31:19
Where is the fundamental stand up and argue this case for for
31:23
the prosecution. Don't just bury your head in the
31:25
sand. I mean, you know the answer.
31:27
You know what's wrong. Tell the story.
31:29
So during your post testimony analysis you discovered
31:32
discrepancies in the number of searches related to chloroform.
31:36
So can you walk us through that discovery process?
31:39
Like what did you start looking at?
31:41
Well, the IT was actually quite simple.
31:44
The chats and the chat rooms and everything was lit up on fire
31:49
and the MORC database came to the forefront.
31:52
And as soon as I found out that 84 if it was missing was an
31:58
inferred visit count of 1. Seriously, that was just an if
32:02
and else statement in my code, like 3 or 4 lines of code top
32:06
said, if you don't see it, you found the square bracket that
32:09
says we're, we're done our record, don't worry about it.
32:12
Throw a one in there. And so and behold, as soon as I
32:14
did that, guess what? And this goes back to the
32:17
validation thing. Had Kevin Stanger done what he
32:20
should have done, he would have realized that the initial build
32:23
that I gave him to parse it had probably far.
32:26
In fact, there was now that I remember there were reportedly
32:28
far fewer records in the first cash back report, the net
32:33
analysis. And so when the dork tool came
32:36
out and I ran it, it said, OK, we have 5312 records.
32:43
It's made less hypothetical. Let's say the cash back was like
32:46
4100. Well, after fixing that simple
32:49
line of code, the report got bigger and it was an exact
32:53
match. So validate, that's how I
32:55
validate it, right? And I always, I threw it back.
32:58
I threw the the results of the dork into and case, and I threw
33:01
the results of my modified code into and case.
33:05
Did a timeline analysis and everything lined up in pairs,
33:08
cash back dork, cash back dork, that sort of thing.
33:11
So and that didn't take me more than a few minutes.
33:13
Just. It just goes to show you how
33:14
easy it can be to just simply validate something.
33:17
And you never would have known if it wouldn't have been such a
33:19
big deal on TV and everybody was talking about it, because the
33:23
Mozilla guys probably would have never released the specs and
33:27
they would never would have released the Dork tool because
33:29
they hadn't up until right then. Yep, and I'll tell you how how
33:32
how it happened for me. I I went back to the hotel room
33:35
and I turned on the TV and I remember just staying in the
33:38
hotel and watching TV and I forget.
33:39
I think the anchor on CNN at the time was Michelle something
33:42
whatever. And all our what I remember was
33:45
her taking a Bristol board, a white big badger, Barry, right,
33:48
84 times and holding it up. And I go, OK, I'm missing
33:52
something here. There's something about 84
33:53
times. And I knew when I saw 84 times
33:55
of chloroform in the courtroom and she had me, you know, the
33:58
prosecutor had me repeat myself. As soon as I said that out loud
34:02
in my head, I'm thinking there's something about that that just
34:06
doesn't feel right to me, right? How can you have a smoking gun
34:09
84 times? It doesn't happen that way,
34:12
right? I mean, you guys have done some
34:13
cases. I mean, how often do you expect,
34:16
you know, I'm going to go kill him with a knife?
34:18
And that's in my Internet history and you find the knife.
34:20
No, it's not like that at all. It's like 84 times.
34:23
And I said to myself, she's really hanging on to that
34:26
because I must. I think she had me repeat it two
34:28
or three times for the jury. You know, my Spidey sense were
34:31
tingling and I saw this and that's where, you know, I was
34:34
anxious and this was like a week before, I think it was a week
34:37
before Kevin Stinger got on the stand.
34:39
So for a whole week I had to listen to 84 * 84 times, but I
34:42
didn't have access to what he had the net analysis report.
34:46
John, when you discovered the air, you alerted the
34:48
prosecution. What went through your mind in
34:51
that moment, both ethically and professionally?
34:54
I didn't hesitate. It's one thing I've learned.
34:57
Your reputation is being honest, right?
35:00
I've never lied in the stand, never would.
35:02
And I didn't care how many people knew about it.
35:05
The right thing to do right was to come forward.
35:08
And I had no qualms, no hesitations.
35:11
I was speed dialing the prosecutor, emailing, and I
35:14
never stopped, right. And I didn't care what my family
35:17
would think. I wouldn't care what my peers
35:19
would think. I think you know what?
35:20
I got into policing to help people to, to find the truth.
35:24
And that evolved into being a software developer, writing
35:29
tools and solutions to help crime, right, to do that sort of
35:33
thing. And so if there's a mistake,
35:35
I'll own up to it and I don't need to pass the buck.
35:38
It's proofs right there. And what better way than to I've
35:41
always solved the problem. It's no different than insulting
35:44
someone and offering an apology. Absolutely right.
35:47
This was a gross error. Whether I thought it was fair
35:51
that I was the one taking the heat for it when it really for
35:55
all the reasons it could have been prevented.
35:57
That aside, I could have sat on it, but no, I could have said,
36:01
well, it's not my problem. You know what?
36:04
It is my problem because I know something that needs.
36:07
And that's the thing, you know, something that is critical.
36:10
And even though it's like, wow, it's Friday there.
36:13
You know, the deliberations on Tuesday, what could I possibly
36:16
do? Well, guess what, John?
36:18
You can take a plane, get down there tomorrow morning, show the
36:21
prosecutor and stay there and testify and clarify the problem,
36:26
right? And at minimum, she could have
36:28
relayed that to Officer Stanger, called him back to explain
36:31
something. And I think at that point in
36:34
time, I think there's two too much that would look bad because
36:39
then they have to say the prosecutor, all our evidence
36:40
about computer stuff, but we made a mistake and it's a big
36:43
mistake. You know, all the 84 times, it's
36:44
really only one time. So really, I could see the
36:47
conundrum for them is how do you back pedal from that when you
36:50
think you have a slam dunk and then all of a sudden, well, it's
36:52
not a slam dunk and then kind of blows that all out of the water,
36:56
right? You've been through a lot after
36:58
testifying, and how did this case affect you both personally
37:05
and professionally? Well, personally, I was angry.
37:09
And I was angry because I hold myself to a very high standard.
37:15
And I guess it was naive of me to believe that everyone in my
37:19
profession also holds themselves to the same standard.
37:23
And so I was very, very angry that this this was perpetrated
37:27
on me in a deliberate way to avoid someone else's mistake.
37:32
That's number one professionally, you know, all
37:35
these armchair critics out there, you know, they're
37:37
everywhere. They're on the list servers,
37:39
they're at the training events, you know, they're whispers in
37:42
the training rooms with other vendor tools, competing better
37:45
tools. And this gets back to me and
37:47
everyone's downplaying, well, don't buy that cash back or
37:50
don't use this or, you know, John Bradley did this.
37:52
But but you know, so that went on and on and on and on.
37:54
So it hurt the business. And really, I think that kind of
37:57
it, it slowed me down for many, many months.
37:59
I had death threats. I was inundated with threats,
38:02
bombarded from people all over America, like just giving me
38:05
their Peace of Mind. I was thinking.
38:09
I didn't think that there's nothing.
38:11
I shrugged it off, but it's still a painful thing because I
38:15
wasn't only just getting it from just Americans, I get it from
38:19
Canadians. I was getting from people
38:21
overseas and I was getting comments from my peers in the
38:27
industry. There's a handful of people who
38:29
are the the people that like to have their voice heard on these
38:32
list servers all the time. They're the big voice, the big
38:34
bark, and they're the ones that came forward, you know, armchair
38:37
critics. Well, you know, I could have
38:38
read a report for four hours and I don't know why he's, you know,
38:42
why, why he was called down. I could, you know, I could have
38:46
gone down there. This is what this went on for a
38:48
long time. And one of the first things I
38:50
did a year later was change the name because Jose Baez made a
38:53
smart ass remark as he was walking away from me in the line
38:57
of question. And he says, talk to Kevin
38:59
Stinger, right? He was walking away from Kevin
39:01
Stinger and he says, did you spend a lot of money on cash
39:04
back? And he says, well, no, not
39:06
really. He says, well, maybe you can
39:07
still get your cash back, right? I didn't stay to the end.
39:13
Maybe that was not on the court TV recording.
39:16
So anyway, it was, it was bad humor.
39:19
You know, Jose Baez was respectable.
39:21
He offered me a public apology on Doctor Phil.
39:25
He obviously knew more information, as I'm sure will be
39:28
evidenced by your, your, your next guest.
39:31
So he came with more knowledge than what was known to the
39:35
public. And on the Doctor Phil show, he
39:37
offered me a public apology and I really appreciated that,
39:39
right? It was, it was a 2013 though,
39:42
and I got that apology. So I suffered a lot in between,
39:45
but I didn't let that hold me back.
39:46
I continued with doing my thing and evolve the software.
39:51
You know, Fast forward 14 years, we're developing new tools.
39:55
After all of that, did you see any changes in the way that the
40:00
outfall from the Case Anthony trial influenced York Company or
40:05
really just all of the digital forensic examiners in the field
40:09
regarding validation testing and the limitations?
40:14
Of forensic tools, yeah. The things I noticed was there's
40:17
a lot of talk, a lot of talk on the forums, people wanting to
40:20
weigh in and pick up and say, you know, we got to validate,
40:23
you know, just a reminder people.
40:24
So that was a good message, right?
40:26
That was a good message. Fact.
40:27
If I had to say, if I had to say Kevin Stinger was the start of
40:32
push button forensics back in the day because that's exactly
40:34
what happened. He pushed a button pre report,
40:36
just washed his hands of it. But in the 10 in 14 years since
40:40
then, I've seen a lot of push button.
40:42
It's out there for sure. I do see some good pushes and I
40:48
will name them because he's, I commend his work is Alexis like
40:53
Rigoni and he pushes validation and not relying on tools.
40:56
And I applaud him because it's a good message that needs to
41:00
continue. It might wear on some people,
41:02
but it needs to be out there. And when I present or I talk to
41:06
law enforcement or, you know, stakeholders, I talk about
41:09
governance and I've written governance policies and
41:11
procedures and overviewed and stuff.
41:14
And I under score highlight validation.
41:18
Like what are you doing to validate?
41:19
And it's insufficient to just run a report from this tool and
41:22
another tool. You know, when we all started,
41:25
and I know this includes everyone here, you got under the
41:29
foot, yes. And you know what, I'm sorry,
41:31
you need to learn what a bit and a byte is.
41:33
You need to know what bit wise and a hexadecimal means.
41:37
There's no getting around it. And so that's the message that I
41:41
continue to support and I applaud Alexis very much.
41:45
And you know, I've been in a class that Briggs was teaching
41:48
and he one of the things he says along those lines, he says you
41:52
are the tool. It's just not software.
41:54
You have to be your own tool in the toolbox to get things done.
41:59
And Becky and I both talk about it and to the classes we teach
42:03
and we talk about it on the on the podcast.
42:05
You just can't push buttons. You've got to dig deeper.
42:08
You've got to look at the actual data.
42:10
You know, case in point, you know, and I know if it's a weak
42:13
example is e-mail, you know, or browser history, right?
42:17
How did this end up in the history?
42:19
Well, he, he went to this, right?
42:21
He did it so right here. Well, no, right.
42:23
There's you know what, what's the, the state code, whatever.
42:26
How was that entered, right? Well, we all know there was
42:29
another recent case with a big hullabaloo about Internet
42:32
history. So I mean, see, Internet history
42:36
is still big in the news 14 years later, just like it was in
42:39
Casey Anthony case. The transparency of forensic
42:42
tools and expert test. Expert testimony in courtrooms.
42:47
Good question. So first of all, I can tell you
42:50
from both the pub, the police side and as a owner of a
42:54
software company, right? Tool providers don't want to
42:57
give you the secret sauce until you take the training.
43:00
And if you take the training, they'll only go so far as to
43:04
tell you how to decode Google Chrome index files, for
43:08
instance, right? So one of the things that I
43:12
think is incumbent upon the private sector to embrace as
43:16
well as to find a happy medium between giving police the
43:19
knowledge to do the vetting to become a better expert.
43:23
I think practitioners, but more so executives like the the
43:28
people who lead the units need to be held more accountable for
43:31
governance. Well, they need to be held
43:33
accountable. If they're not, no one's
43:34
checking their work and no one's saying, hey, John, you know, you
43:38
just pushed a button. What's this report?
43:39
Tell me about this report. You know, where's where's the
43:41
tool you need to have? Yeah.
43:43
And I think what you're Speaking of, part of it is that peer
43:46
review is what Becky and I call it.
43:48
And I know when we were in the FBI, I think wasn't it a minimum
43:51
of 50%? Was it 25% minimum?
43:55
Yeah, some offices could say we're going to 100% peer review
43:59
our cases, some offices, but I believe the minimum was 25%.
44:04
Hey, John, here we are. The last question for you, if
44:07
there's one message you'd want digital forensic examiners,
44:11
attorneys and the public to take away from your experience in the
44:15
Casey Anthony trial, what would it be?
44:18
And it's so easy for someone to read a headline the 1st 2 words
44:22
they go oh did you hear what happened?
44:24
You know, and, and I think the message I have is find your own
44:30
facts before you make any opinion or, you know,
44:35
conclusions about some fact. Find and challenge.
44:39
If someone says something, well, you know, so and so did so and
44:42
so. Well, where are your facts?
44:43
Cite the source. That's what I would say, yeah.
44:46
Yeah, I would agree with that. All right.
44:47
Well, John, we really appreciate you joining us on this podcast
44:51
episode and just bringing the truth out about what happened
44:55
and in your situation and during the Casey Anthony trial.
44:59
So truly appreciate you being a guest today and bringing that
45:03
truth out. So until next time, stay safe,
45:06
stay sharp, and as always, keep parsing the truth one bite at a
45:09
time. Thanks, Becky.
45:10
Thanks, Stacy. Thank you.
45:14
If you enjoyed this episode, make sure to follow us to get
45:17
notified the next time a new episode drops.
45:20
If you can do more, head on over to parsingthetruth.com and
45:24
donate by clicking on the donate button.
45:27
Parsing the Truth is a nonprofit organization and we are raising
45:30
money to send a new digital forensic examiner to I Asus
45:34
training next year in Orlando. Thanks.