by Val McDermid
In 2008, at the age of sixty-three, McAfee headed south from California to Belize, where he hoped to use the jungle flora to develop new antibiotics that would, in his words, ‘interrupt bacteria’s ability to communicate’. In 2012 police raided his research facility, claiming it was a methamphetamine factory. All charges were subsequently dropped.
John McAfee surrounded by the media after his detainment by Guatemalan police
McAfee’s house in Belize
But the relationship between McAfee and his American expat neighbour, Gregory Faull, soured beyond repair. Faull, the owner of an Orlando sports bar, particularly hated McAfee’s dogs. He sent a complaint to the local authorities, part of which read: ‘These animals get loose and run as a pack. Three residents have been bitten and three tourists have been attacked.’ McAfee later found four of his eleven dogs poisoned and had to shoot them to put them out of their misery.
On 11 November 2012 a housekeeper discovered Faull on his patio, lying face up with a bullet in his head. When police came to question McAfee, he hid from them under a box. Then he went on the run, disguised as a ragged salesman. However, he continued to update his blog and give online interviews. ‘I have modified my appearance in a radical fashion,’ he wrote; ‘I’ll probably look like a murderer, unfortunately.’ When he made his way illegally over the border into Guatemala, the editor-in-chief of Vice magazine decided to follow his life on the run, and brought a photographer with him.
On 3 December the Vice website posted a photograph of McAfee in front of palm trees, underneath the smug caption: ‘WE ARE WITH JOHN MCAFEE RIGHT NOW, SUCKERS.’ But it also contained metadata which held clues to McAfee’s exact longitude and latitude. Realising this, the photographer then posted on Facebook that he had manipulated the metadata. But that was a lie and soon the Guatemalan police tracked down and detained McAfee. He then faked a heart attack in order to buy his lawyer time. Together they blocked the Guatemalan authorities’ attempt to deport McAfee back to Belize. He was sent to Miami, instead, where he was released. He then travelled to Montreal, Canada. Belize police still describe McAfee as ‘a person of interest’ in the murder of Gregory Faull, but not a prime suspect.
McAfee is now back in Silicon Valley, where he has been developing a $100 gadget called a D-Central that connects with your computer, smartphone or tablet and, McAfee promises, makes you invisible on the net. ‘If you cannot see it, you cannot hack it, you cannot look at it, you cannot spy on anything happening inside it.’ The idea is attractive to people in the light of the Edward Snowden leaks, and perhaps even more attractive to McAfee himself, given his own unhappy experience of overexposed data.
The D-Central is an extreme device for keeping private communications private, a manoeuvre that tech-savvy criminals and law-abiders alike are keener than ever to make. ‘Certainly, younger generations are very careful about their footprints,’ says Angus. ‘I’ve spoken to a number of them over the years and they are fully aware of how much snooping goes on and how much of their personal data is being exploited. A lot of them have a simple solution to making sure people can’t get at their data; they lie, they create fake accounts and leave fake footprints.’ Some do this to stop potential employers seeing photos of them topless and drunk; others because they don’t like the idea of government officials poring over their data; still others because they want to keep their criminal behaviour under the radar.
Angus is unhappy with the snooping activities of the National Security Agency (NSA) in the United States; in particular, he is unhappy with the notion of providing public security through imperilling individual privacy. ‘We used to think Eastern Europe was bad. Our allies are getting even worse.’ When an agency like the NSA snoops on websites like Google Mail or Facebook they use an automated program to look for trigger words. If you were to send an email to your lover saying, ‘You’re the bomb,’ Angus reckons, ‘they’d have a look at it, probably have a laugh, save it for the Christmas party but not much more than that. But if you start talking about building nuclear warheads, they’d look at you in great detail.’ Of course many of the most serious criminals steer clear of providers like Gmail and Facebook.
Some of them also know that if they use the web on their smartphones or tablets via applications like the Facebook app, they will leave a trace that Angus can pick up. ‘But if it’s on a web browser on a mobile device then there is no trace. So we have to ask Facebook Inc., who do give us something. Twitter give us practically nothing.’
The big Californian corporations are trying to get everyone to put their personal data in ‘the cloud’, which ironically means a remote storage facility in the United States. The cloud keeps personal data up-to-date across all of a user’s digital devices, thereby making it easier for the corporations to mine and exploit. Paradoxically, the more accessible the data is for users and corporations, the more hidden it is from people like Angus.
The future, says Angus, ‘is online and it’s cloud. Devices are pushing more and more of their data up into the cloud so that it is accessible to them everywhere. So we find it harder to get material off the devices, because it’s not actually on them. We have to identify firstly if we can technically extract the data from the cloud and, secondly, if we can we get legal authority to do it.’ Crossing international borders is just as difficult for a detective now as it was before cloud computing, but the need is far greater.
Angus recalls a recent case when a judge wrote to a social media company asking them two questions about the reliability of their user data logging. ‘We got back a very simple response from that company’s lawyers. It said firstly, “You have written to the wrong office. Don’t write to us in America, write to us in Dublin.” And secondly, “Under the terms of the treaty that exists between the United Kingdom and the United States, we don’t have to answer your questions.”’
Cloud computing presents other difficulties for the forensic expert. Software like Dropbox, which keeps files synced across devices, enables users to overwrite and change files on one device from another device anywhere else in the world. Angus calls this a ‘massive benefit to the end user but, from an investigative point of view, if somebody has made a change on their computer in their house on this side of the country, and their laptop in the other house on the other side of the country is still switched on, Dropbox changes the content on the laptop, meaning I cannot tell which house you were in.’
If done deliberately, this kind of behaviour is known as ‘anti-forensics’, and it can take dozens of forms. A simple example is an organised criminal who buys a pay-as-you-go phone a couple of days before committing a crime, and then throws it away immediately after the crime. There are all sorts of more complicated anti-forensic techniques. Some programs allow users to change the metadata in files, so that they can make a file look as if it was created in 1912 and last accessed in 2050. Others make files look to forensic programs as if they were another kind of file altogether. Thus, an expert could be tricked into thinking that an image file of a child being abused was an mp3 music file. Seeing through these ruses comes down to the ingenuity and experience of the forensic digital analysts. Just as a psychological profiler needs to empathise with a criminal in order to understand their motives and predict their actions, so a digital analyst has to be at the cutting edge of developments in the field, in order to work out exactly what tech-savvy criminals are up to.
Sometimes the experts dabble in anti-forensics themselves. Angus explain, ‘I have colleagues who travel the world and they don’t take any technology with them. They buy a new laptop and a new mobile phone in whatever country they are visiting and they trash it and leave it there.’ They do this because airport staff in some countries routinely make sure that people aren’t smuggling out the truth about what’s happening in their country, or bringing in pornography or bomb-making instructions. They simply need access for a remarkably short time. ‘All airport staff have to do is pull you off into the room where the member of staff with the rubber
gloves can keep you busy for half an hour or so,’ says Angus. And that’s long enough for them to copy an entire hard drive.
In the case of cyber crimes like hacking, forensic digital analysts sometimes have to play catch-up with the criminals. The old adage holds true: When the forensic scientist takes a step, the criminal counters with a step of their own. Fingerprinting made burglars put gloves on. CCTV made kids pull their hoods up. So sometimes old technologies can be the best anti-forensic tools. Analogue cameras don’t embed metadata into their photographs. Old-style bulletin boards can be set up in cyberspace and used completely under the radar. ‘They are really easy to set up,’ Angus reveals. ‘The old software’s still out there. The hardware is readily available now. It doesn’t take a lot and, to be honest, you can hang one on the end of a pay-as-you-go mobile phone, which is almost untraceable.’
Physical evidence is still absolutely crucial to solving the vast majority of crimes. ‘None of the cases that I’ve dealt with have been exclusively built on computer evidence,’ Angus admits. ‘The computer evidence is corroborating something else. It can be incredibly strong corroboration, but it’s rare that it’s the only evidence. So if we don’t find it, as I said before, absence of evidence doesn’t mean evidence of absence.’
ELEVEN
FORENSIC
PSYCHOLOGY
‘Every thief has a characteristic style or modus operandi which he rarely departs from; and which he is incapable of completely getting rid of; at times this is such a distinctive feature that even the novice can spot it without difficulty, but … only a practised, intelligent, and fervent observer is capable of distinguishing those traits, often delicate but identical, which characterise the theft, and drawing important conclusions from them.’
Hans Gross, Criminal Investigation: A Practical Textbook (1934)
There’s more to crime than breaking the law. Mostly, you have to want to do it. With very few exceptions, a criminal act cannot be punished without mens rea, that is to say, ‘criminal intent’. In other words, if a lawbreaker didn’t know what they were doing – because they are insane, say, or under the influence of mind-altering drugs – they will be given treatment rather than punishment for doing it.
Although it’s often at the heart of crime fiction and dramas, motive is usually the least pressing concern in a real murder investigation. Hard forensic evidence, means and opportunity are the focus of such inquiries. But sometimes motive can be useful in pointing investigators in the right direction to look for that solid evidence. Discovering that a missing child has made allegations of sexual abuse can turn a runaway inquiry into a far more serious operation, for example. And juries love motive because it helps them to make sense of events that are far outside their own experience of the world.
Motive-hunting is much more difficult when a criminal has victimised several people outside their immediate circle – so-called ‘stranger’ attacks. The motives of the serial killer may be amorphous, multi-stranded, developed over a lifetime, or in existence only for a nanosecond.
Psychologists generally agree that factors outside a killer’s control, such as their upbringing and heredity, can have a defining effect on the way they behave as adults. Researchers have pursued several theories in their attempts to explain why some of us grow up to be serial murderers. Sometimes the answers they discover are profoundly shocking.
American neuroscientist James Fallon studied the brains of several convicted serial killers and noticed that many showed lower than average levels of activity in the areas of the frontal lobe linked to empathy, morality and self-control. In an attempt to quantify the differences between them and the general population, Fallon laid the brain scans on his desk, and mixed them in with scans he’d taken of his own family members. The scan that shouted ‘Psychopath!’ loudest was his own. He thought about burying the troubling result, but decided instead to play the good scientist and investigate further, by testing his own DNA. The outcome was even more unsettling. ‘I had all these high-risk alleles for aggression, violence and low empathy.’
Seriously concerned by now, Fallon did some digging into his genealogy. In branches of his family tree he found seven alleged murderers, among them the source of the notorious rhyme:
Lizzie Borden took an ax,
Gave her mother forty whacks
When she saw what she had done
She gave her father forty-one.
Looking for answers to his own lack of criminality, Fallon decided he owed his non-violence to his mother’s love and thanked her from the bottom of his heart. In 2013 he wrote a book called The Psychopath Inside, in which he says: ‘It’s not a death sentence, the biology, but it will give you some high potential for these things. The genes load the gun and make someone vulnerable to becoming a psychopath.’
Like Fallon, the first scientists to get involved in criminal trials wanted to identify abnormal minds. Medically trained, they were interested in the mental capacities of offenders and in trying to diagnose ‘diseases of the mind’. When did an accused man have mens rea? When was he not responsible for his actions?
When the police came across bizarre crimes they couldn’t make sense of, they began to seek help from those psychiatrists and psychologists with experience of mentally ill patients. The assumption usually was that the perpetrators of these perverse crimes were ‘mad’. The guidelines for criminal insanity that are still a keystone test in many jurisdictions today were established in 1843 following the case of Daniel M’Naghten, who was acquitted of murder on the grounds of insanity after he shot dead the Prime Minister’s private secretary, Edward Drummond. The rules can be summed up thus: Did the defendant know what he was doing, and, if so, did he know that it was wrong?
Sometimes, the criminal acts seem to leave little room for doubt. In 1929, Peter Kürten, also known as ‘the Vampire of Düsseldorf’, hammered, stabbed and strangled to death at least nine German children. While Kürten awaited his execution, Karl Berg, an eminent psychologist, won his confidence and got him to talk openly about his crimes. ‘The sexual urge was strongly developed in me,’ Kürten said, ‘particularly in the last years, and it was stimulated even more by the crimes themselves. For that reason I was always driven to find a new victim. Sometimes even when I seized my victim’s throat, I had an orgasm; sometimes not, but then the orgasm came as I stabbed the victim. It was not my intention to get satisfaction by normal sexual intercourse, but by killing.’ Kürten’s weapon of choice was a pair of scissors. The sight of blood became ever more necessary for him to achieve orgasm. He even asked Berg hopefully if he’d be able to hear the blood gushing from his torso for a moment after the guillotine had sliced through his neck.
Peter Kürten, the ‘Vampire of Dusseldorf’
Police searching the Pappendell Farm, Dusseldorf, for the bodies of Kürten’s victims
Possibly the most shocking thing for the people of Düsseldorf was that the ‘vampire’ who had terrorised their city did not look like a madman. ‘He was slim and, comparatively, a good-looking man, with thick yellow hair always neatly parted, clever-looking blue eyes,’ it was reported. When he arrived in court on the first day of his trial he was ‘[d]ressed in an immaculate suit … with the look of a prim and proper businessman’. Nothing in Kürten’s appearance or demeanour betrayed his nightmarish childhood of violence, marital rape and incest. Yet he appeared completely detached from reality in his extensive interviews with Berg, and at other points in his life. If he had not been like this, he would never have been able to befriend so many victims. So, although his crimes seemed to indicate madness, the man was less easy to draw a neat box around.
Despite the impossibility of narrowly defining one singular criminal mind in the way that Cesare Lombroso had tried to in the nineteenth century, by the time of Peter Kürten criminalists such as Hans Gross understood that there were a variety of criminal minds which could be partially read by the light of crime scene clues. The everyday behaviour of a serial offender tends
to be in some way consistent with their criminal behaviour. For example, if a sexual murderer has had a partner before, they will usually have abused them (as Kürten had his wife). Forensic psychologists use this ‘consistency principle’ to build up profiles of serial offenders, which can help police focus their investigations.
Very probably the first ‘offender profile’ was written in 1888 in the midst of a slew of murders in Whitechapel, east London. At 3.40 in the morning on Friday, 31 August, a cartman was walking down Buck’s Row when through the murk he made out a woman lying prone on the pavement, her skirt pulled up over her stomach. The cartman approached and found her hand cold to the touch. The only streetlamp was at the other end of the row, and the cartman couldn’t be sure if she was drunk or dead. He pulled her skirt down to cover her modesty and went in search of a policeman.
Beat officer John Neil arrived at the scene to find blood seeping from the woman’s throat. It had been slashed from ear to ear, ferociously enough to sever the spinal cord. When the woman was brought into a ‘deadhouse’, Inspector John Spratling lifted up her clothes: her intestines were sticking out through a slit in her abdomen that went all the way to the breastbone. A reporter in Reynolds’ Newspaper wrote: ‘She was ripped open just as you see a dead calf at the butcher’s.’ The pathologist found two stabs to the woman’s genitals and felt that the murderer ‘must have had some rough anatomical knowledge, for he had attacked all the vital parts’. She was soon identified as Mary Ann Nichols, a 43-year-old prostitute. Most of her worldly possessions she had with her – a white handkerchief, a comb and a piece of mirror.