Forensics

by Val McDermid

  The Richard III Society assembled a team to investigate the remains. Scientists began analysing DNA samples, and scanning the skull in three dimensions. They sent the digital skull to Caroline Wilkinson, who set to work on making the king’s face, avoiding looking at existing portraits of him so as not to contaminate the scientific process. She and her team modelled the muscles and skin using stereolithography, a computer process whereby a moving laser beam builds up a structure, layer by layer, from a liquid polymer that hardens on contact with laser light.

  When the DNA results came back, and matched with a descendant of the king, Caroline finally compared her model to portraits. It was strikingly similar, with its arched nose and prominent chin. ‘It doesn’t look like the face of a tyrant,’ said Philippa Langley of the Richard III Society. ‘I’m sorry but it doesn’t. He’s very handsome. It’s like you could just talk to him, have a conversation with him right now.’

  Caroline is proud of her work on Richard III. ‘Our facial reconstruction methods have been blind tested many times using living subjects and we know that approximately 70 per cent of the facial surface has less than 2 mm of error,’ she reveals. To reach that level of accuracy Caroline stands on the shoulders of all the face makers that have come before her, from Giulio Zumbo to Wilhelm His and Richard Neave. But it’s her own artistic obsession with observation that has helped her to do it so effectively. She describes herself as ‘really annoying to go out with because if I’m watching a film I spend all my time going, “Oh, look at his ears, look at his nose, what a great nose,” and everyone’s going, “Shut up! Just watch the film.” When I’m on the train I quite often get my phone out and take sneaky pictures. I get my iPad out, pretend I’m reading something and take a picture, I’m terrible.

  ‘I also collect photographic portrait books wherever I travel overseas, which I do mainly for my archaeological work. The places I visit have books of photos that you can’t get on the internet. So if I go to Egypt I’ll try to buy a book of pictures of Egyptian faces, and so on. So now I’ve got this great database of faces that we can use to inform what we do.’

  And it’s that access to such a vast range of faces from all over the world that makes our present-day forensic artists more useful artist-anatomists than Leonardo da Vinci could ever be. It’s the application of science to the world of artistic representation that makes it possible for the dead to tell yet another chapter of their story to us.

  TEN

  DIGITAL

  FORENSICS

  ‘The advent of the internet has complicated mystery plotting because so much more information is available to both the sleuth and the reader. The reader is not likely to remain long interested in a detective who is too dumb to take the obvious first step in any research – going on line for related information.’

  Jeffrey Barlow, Berglund Center for Internet Studies

  Angus Marshall and his wife are forensic scientists. People at dinner parties assume they spend all day in the morgue dissecting bodies. Shirley Marshall soon disappoints them when she explains that her DNA work is almost entirely lab-based. Angus lets them down still further: ‘The only times I cut up anything fleshy is making dinner, or working on my car, and the second one’s an accident.’

  At school Angus joined the radio club to get his hands on electronics. One day a maths teacher brought a microcomputer in to show the class. ‘It led to the establishment of the computer club and that’s been my downfall. I haven’t seen daylight properly since about 1983.’

  After graduating, Angus began work as a computer scientist. At the University of Hull he was stationed at the Centre for Internet Computing, whose name made it simply irresistible to hackers. One even managed to wipe out the internet connection for the whole of the university’s main campus. Angus set about tracking the hacker, and managed to trace his IP address all the way back to his street address in Amsterdam. These seem humble enough beginnings, but Angus was proud of the results of his dogged research and submitted a report of the investigation to the British Forensic Science Society. So when a far more serious and disturbing case arose, they knew who to call.

  Thirty-one-year-old Jane Longhurst lived in Brighton, where she worked as a special needs teacher. She wore her chestnut hair neatly down to her shoulders. Everyone knew her as gentle and bubbly, especially her friends in the local orchestra, where she played the viola. Early on the morning of Friday 14 March 2003, Jane kissed her boyfriend Malcolm goodbye as usual.

  When he came back that evening to find her gone, Malcolm quickly became concerned. Jane was dependable. She let people know what her plans were so they wouldn’t worry. At midnight he was so disturbed by her absence that he phoned 999. The police initially treated Jane’s disappearance as an ordinary missing person case, but after five days they changed it to a major murder investigation. Jane’s bank said that none of her accounts had been touched since Friday. And her network provider could tell that her phone was turned off because it hadn’t once communicated with any of their transmitters.

  After a month of searching, involving seventy police officers and numerous newspaper appeals, Jane’s body was found on 19 April. She had been dumped in a wooded nature reserve in West Sussex, and set ablaze. A passer-by who saw the flames had called the fire brigade. The fireman who found the body noticed a pair of nylon tights dug deep into Jane’s neck. CSIs scouring the area found a match and an empty petrol canister.

  Jane had to be identified from her dental records. When they examined her body, the two pathologists noted that the tights were pulled so tightly around Jane’s neck that they had broken the skin and caused bleeding. A few days later, the police arrested Graham Coutts, a door-to-door salesman of cleaning products, and charged him with Jane’s murder. He was the guitar-playing boyfriend of Jane’s best friend, and had known Jane for five years.

  When Coutts was confronted with the pathologists’ reports and the trace evidence, he said nothing at first. But eventually he admitted to killing Jane. He had arranged to take her swimming at the local leisure centre, he told police, but instead took her back to his flat for a cup of tea. There he wrapped the tights around Jane’s neck in a consensual act of erotic asphyxia, gradually tightening the ligature as he masturbated. Once he had reached orgasm he looked at her body and noticed ‘to my horror’ that it was lifeless. He then put her body into a cardboard box, and moved it into his garden shed.

  Eleven days after Jane’s disappearance, the police visited Coutts. They were trying to question everyone she knew, hunting for clues. He decided at that point that he had to move her body to a room at a nearby Big Yellow Storage facility, for which he paid for an ‘all hours’ key. Over the next three weeks he visited Jane’s body nine times. When the stench of decomposition grew too strong, he moved her again, on 17 April, to the nature reserve, where he set fire to her remains.

  When they investigated the storage unit the police found Jane’s mobile phone, purse, jacket and swimming costume, and a shirt belonging to Coutts with her blood on it. They also found a condom containing his semen, and with her DNA on the outside. They searched his flat and took away two computers. Together with the Police Computer Crime Unit, Angus Marshall went to work on them, fighting against his own emotional reaction to the hideous things Coutts was charged with.

  In court the defence argued that Coutts was guilty only of manslaughter, and called forensic pathologist Dick Shepherd (see pp.77–86) to the stand. He testified that in acts of erotic asphyxia it is possible for someone to die quickly, within a second or two, as a result of the inhibition of the vagus cranial nerve. The pathologist for the prosecution, Vesna Djurovic, denied this possibility, arguing instead that it takes two to three minutes for a person to die of strangulation – plenty of time for Coutts to know exactly what he was doing.

  One of Coutts’s ex-girlfriends testified that he had partially strangled her on many occasions during their five-year relationship. Two of Jane’s ex-boyfriends gave accounts of ordinary sex liv
es with her. When cross-examined by the prosecutor, Coutts admitted that he had a fetish for women’s necks, and that this was the first time he and Jane had engaged in a sexual act.

  For Angus the case was proving very difficult, both emotionally and professionally. He was propelled ‘from a relatively trivial hacking incident into a very nasty murder. I will never forget that case.’ It was career-changing. It also gave him a chance to see the kinds of things people thought they could do with impunity, and then to try and unpick that impunity. There were lessons aplenty for him: ‘I was cross-examined by the two barristers. They were having problems with the concepts and weren’t asking the questions in the right way. So the judge stepped in because he understood the technical issues far better than they did.’

  Unfortunately, the judge asked Angus one question about the use of cookies – the little bits of data stored on your computer that communicate with the websites you revisit. It spooked the jury. ‘They started passing notes to the judge, wanting to know how they could protect themselves and hide their online activities from spouses and other family members.’ Once the judge had restored order, Angus proceeded to give his evidence.

  He had found more than 800 pornographic images on Coutts’s two computers, of which 699 were of strangled, suffocated or hanged women. One showed a Father Christmas strangling a girl. As well as finding the images, Angus had pieced together a timeline of Coutts’s online activity. He had been visiting violent pornography websites, such as ‘Necrobabes’, ‘Deathbyasphyxia’ and ‘Hangingbitches’. The frequency of his visits had increased in the weeks before Jane’s death, when he also paid for memberships of websites such as ‘Club Dead’ and ‘Brutal Love’. His visits and downloads reached their peak during the day before Jane’s death, and the two days before her body was found in flames.

  Graham Coutts was convicted of murder and sentenced to life in prison. Angus recalls the judge commenting on the importance of ‘the evidence from his computer showing his normal patterns of activity and the total disappearance of that pattern on the day of the murder’. Since the case, Angus has made pulling together timeline evidence a priority.

  Violent criminals often leave digital traces of the twisted paths down which their minds go. Does the internet spur them along those paths? At any one time there are roughly 100,000 ‘snuff’ sites on the web, disseminating images and video of killings, cannibalism, necrophilia and rape. The UK and US governments have taken steps towards combating these kinds of sites – though both more tentatively than Iceland’s, which has attempted a complete ban on online porn.

  However vigilant the authorities are, the problem remains that when a site is shut down it usually opens up again under a different domain name almost immediately. Getting to the root of the issue, and going after the producers of violent pornography, needs a level of organisation and international co-operation which has so far not been met. There are people who argue that sites peddling violent pornography only exist because there is an appetite for them. The relationship between the sites and the appetite still needs research and clarification, but to call it anything less than reciprocal seems deluded. Whether these internet images cause extreme behaviour or merely mirror what already exists, there is no doubt that violent sex offenders use them to fan the flames of their own fantasies.

  On the evening of 26 May 2013, 23-year-old Jamie Reynolds sent a short text message: ‘I’m excited. Don’t be late.’ He had asked 17-year-old Georgia Williams, the daughter of a police detective, to come over to his home in Wellington, Shropshire, to model some clothes for a photography project. Reynolds didn’t tell Georgia that he’d been planning the project for months.

  When she arrived he gave her high heels, a leather jacket and leather shorts to put on. He took some photos and asked her to stand on a red recycling box on the landing. Round her neck he placed a noose, which he attached to the loft hatch above. He took a photo. At this point, according to police who saw it later, Georgia looked ‘happy’ and ‘compliant’. Then Reynolds kicked the box from beneath her. A bruise found in the small of her back suggested to a pathologist that he had applied downward pressure with his knee to speed up her suffocation. He then sexually violated her body.

  When police examined Reynolds’ computer they found dozens of composite images. He had taken the heads of innocent girls on Facebook and put them on to bodies engaged in hardcore pornography. They found 72 violently pornographic videos, almost 17,000 images and 40 fantasy stories written by Reynolds, one of which was called ‘Georgia Williams in Surprise’. Reynolds had taken photos of his victim before, during and after the attack. The prosecuting lawyer asked for the material not to be shown in open court and only to be viewed by the judge because of its severely distressing nature. Reynolds was given a whole-of-life jail sentence for an act which Georgia’s father called ‘horrific and beyond comprehension’.

  The global expansion of personal computer and smartphone ownership has made it much easier for people like Graham Coutts and Jamie Reynolds to indulge their perverted fantasies. But the majority of people use the internet to do relatively innocuous things (even if the jury’s reaction to Angus’s explanation of cookies at the Coutts trial might suggest otherwise). Criminals, too, use the internet to do ordinary things. They write emails to family and shop with online retailers. But when they step down illegal paths, they leave a footprint that forensic digital analysts like Angus can decipher more clearly than many of them realise.

  Today’s torrent of personal devices began as a trickle. In the early 1980s forensic digital analysts mostly helped police investigate copyright infringement – such as kids copying games for their Atari game consoles – and fraudulent business activities. Hard drive storage capacities were so small back then that an expert could often browse through all the files on a drive until he found what he needed to secure a conviction. ‘Computers were relatively dumb devices at first,’ says Angus. ‘The complexities, the interactions that we see today, just weren’t there.’

  Up until the mid 1990s computers connected using the dial-up ‘bulletin board system’, which was a precursor to the world wide web. People used bulletin boards to talk to other geeks about technical problems they were having, or to get help with completing a game they were playing. There were a few renegades exploring the possibilities of using their new-found powers for evil, but most people were just excited by the possibilities. To be involved, you needed a fair amount of technical expertise and you often had to build quite a lot of the kit yourself.

  But computing power continued to grow exponentially. When Microsoft launched Windows 95, they opened up the world wide web to ordinary people. At this point the police started to take digital forensics seriously, realising, like Angus, that ‘criminals tend to be very good at adopting new technology’. In 2001 Home Secretary Jack Straw established the British National Hi-Tech Crime Unit. He said at the launch, ‘New technologies bring enormous benefits to the legitimate user, but also offer opportunities for criminals, from those involved in financial fraud to paedophiles.’ The National Hi-Tech Crime Unit took on new crimes that the digital revolution had made possible, like hacking, and old crimes which it had facilitated, like stalking.

  In 2006, the national unit was replaced by regional ones. Today at a crime scene the Senior Investigating Officer decides whether she needs someone from her force’s hi-tech crime unit to look at the digital material. ‘Just like with DNA,’ Angus explains, ‘when they’ve got eyewitness accounts, fingerprints and everything else, they often don’t need the expensive analysis. But for something like stalking or grooming, they have to go to hi-tech crime.’ When a unit doesn’t have the capacity or expertise to analyse digital evidence, the SIO will call in an independent like Angus. By that point ‘the routine work has often been done. Most of the time investigators want immediate answers to difficult problems, so I improvise and invent new techniques as I go along.’

  An example of this improvisational approach happened in a recen
t child abuse trial. The accused man – let’s call him David – was charged with multiple counts of paedophilia. His defence strategy was to discredit the key witness, his step-daughter ‘Sarah’. He claimed it wasn’t he who’d had sex with the 14-year-old, it was the boys she’d been having dirty chats with on Facebook. As evidence in support of his claim, David produced data from a ‘key logger’ which he’d installed on Sarah’s computer. A key logger is a hidden program which silently records the actions of the computer user. Every time Sarah typed something or clicked on something in her web browser, the key logger would capture a screenshot – a complete picture of everything on the screen. David had periodically downloaded these screenshots. Some of the ones he presented to the court showed an indecent Facebook chat session between Sarah and a teenaged friend of hers, ‘Fred’. But both teens vehemently denied that the chat had ever taken place.

  Angus more often examines the digital life of suspects than of alleged victims. But in this case the best way to corroborate or invalidate David’s testimony was to look at Sarah’s computer. On it he found no evidence of a chat with Fred, but that didn’t mean it hadn’t taken place. ‘As a general rule these days Facebook doesn’t leave traces behind on hard drives. Everything happens in the browser,’ Angus explains. While he did find a key logger installed on the computer, the screenshots of the alleged chat were not present. But that wasn’t evidence one way or another either, because key loggers usually delete screenshots once they’ve collected a certain number of them to prevent the hard drive from clogging up.

  However, Facebook itself keeps records of all chats even if users have deleted them, and Angus considered asking the company for the chat histories of Sarah and Fred. But that would have fallen very close to communications interception and covert surveillance, so he would have needed authority under the Regulation of Investigatory Powers Act (2000). Then Facebook Inc. would doubtless have taken their time. Angus would have had to wait six months or more for what he needed.