Trap (9781476793177)

by Tanenbaum, Robert K.

  “Yes, I thought he was lying. He lied a lot.”

  “Yes, he lied a lot, on that we agree. Thank you, Mrs. Burns, no further questions.”

  Rainsford looked over at Karp. “We’re closing in on the lunch hour. Do you have any questions for redirect?”

  “No, your honor, no redirect.”

  24

  “MR. NEWBURY, IS IT POSSIBLE to determine the exact computer that is used to send an email?” Karp asked his question standing in the well of the courtroom with his arms crossed, looking up at his longtime friend and colleague, Assistant District Attorney Vincent Newbury.

  Dressed immaculately, as always, in a dark blue Brooks Brothers suit, light blue button-down shirt, and a bright red silk tie with a diamond stickpin, Newbury was clearly enjoying his role as an expert witness for the People. The lines around his eyes and mouth had not eroded his boyish good looks, though the WASPy blond hair was thinning and there were hints of gray throughout. But his mind and wit were as razor sharp as they had been when he and Karp were both rookies finding their way around the New York DAO.

  Although he was in the same generation as Karp, Newbury gravitated toward the modern technology of the younger generation. The chief of the DAO’s White Collar Crimes Bureau, he’d always been a meticulous prosecutor known for assembling the most intricate cases in such a way that a jury could easily see the big picture when he laid it out piece by piece. But he’d really found his niche when personal computers became a tool for prosecutorial investigations. As he’d explained to the jurors a few minutes earlier, he’d assembled quite a team—he called it the DAO Geek Squad—of forensic computer experts, accountants, and tech-savvy detectives. “Among our caseload are a lot of identity theft cases, and cases in which computers are used in the commission of crimes or to investigate and prosecute such crimes.”

  “Yes,” Newbury answered. “Although there are some caveats and exceptions, the basic answer is that we can identify a specific computer as the sender or receiver of an email message, even if the message itself no longer exists.”

  “Without losing us in the internet jungle,” Karp continued, “could you give the jurors a basic computer course?”

  “I’ll try,” Newbury replied before turning to look at the jurors like a professor preparing to lecture a class of freshman students. “I’m going to explain this as simply as I can, not because you’re unintelligent—indeed, some of you may know more than I do—but just so we’re all clear on the basics. You may have heard that computers using the internet have ‘IP addresses,’ or more specifically Internet Protocol addresses. An IP address is a number assigned to each device, such as a computer, printer, iPad or iPhone, that is part of a computer network. That number is the ‘address,’ sort of like 100 Centre Street is the address for this building. We good so far?”

  Newbury looked from face to face, all of whom nodded. “Good. Now I won’t bore you with all of the details—though it really is quite fascinating how the internet works—but essentially when someone sends or receives an email part of the information included in that email, though usually hidden from view, is the IP address where the message originated, and the IP address to which it was sent. Sometimes a message sent from one IP address may actually pass through other IP addresses before reaching the final destination, sort of an internet Pony Express, changing riders at each station along the way, but it can still be traced back to the originating device.”

  “And to reiterate, this IP address is specific to a device, such as a particular computer?” Karp asked.

  “It can be, and most often is,” Newbury said. “But say there is a large company office that has a number of computers all using the same network, they may have the same ‘external’ IP address, but they will also have an internal IP address for each computer that a message can also be traced back to.”

  As Newbury was talking, Karp glanced over at the defendant Olivia Stone. Her expression was one of mild boredom. He knew she was aware of it when he now turned to look directly at her instead of Newbury to ask his next question, though she kept her eyes on the jurors.

  “Is it possible to use this to trace an IP address to a specific computer even if the emails have been erased, as well as the internet history, and the computer then ‘wiped’ to further expunge the record?”

  Stone furrowed her brow, and her already pale complexion blanched further still. Her eyes fixated on Karp, she leaned over and said something to Mendelbaum, who shook his head.

  “It’s more difficult, but there are a few tricks of the trade that make it possible, especially if the effort to remove the information was incomplete,” Newbury replied. “We’ve all heard that nothing ever really disappears from the internet, and for the most part that’s true. But the majority of casual computer users, even those who consider themselves to be security conscious and have all the latest removal apps, believe that by taking these steps, they can permanently remove information from their computers. However, if you know what you’re doing and where to look, even some of these more sophisticated efforts to eliminate the information don’t remove it all.”

  “So can you retrieve emails that have been deleted?”

  “Usually not the email itself, though sometimes if we get to them right away before they’ve been permanently deleted and are cached somewhere,” Newbury said. “But unless the user is really sophisticated and understands how it all works—and is worried about someone equally sophisticated—we can tell when and where an email was sent and where it was received.”

  Karp noticed that Stone’s face had grown whiter still when he asked, “What is browsing history?”

  “Browsing history on the web is a list of web pages the computer user has visited recently as well as such things as the page title and the date and time of the visit,” Newbury said. “For instance, if someone searched the web for information on the New York County District Attorney’s Office, they’d find a webpage—manhattanda.org—and that would be recorded by their web browser software as part of their browsing history. It makes it easier to locate the page again the next time, and is mostly for the benefit of repeat visitors.”

  “Can this web browsing history be removed from a computer?”

  “Well, it can be deleted and then purged from easy discovery if the user wants, and there are a number of programs that can be downloaded to carry it a step further,” Newbury said. “But once again, unless the user knows all of the different places and ways that computers store information, it can often be retrieved by someone with the expertise.”

  Karp moved over to the jury box and leaned against the rail. “Moving from the theoretical to the practical matters involved in this case, were you and your ‘Geek Squad’ asked to examine three computers?”

  “Yes, we were.”

  “Would you identify for the jurors each computer you were asked to examine?”

  “A Toshiba laptop belonging to Yusef Salaam,” Newbury replied. “And two Hewlett-Packard desktop computers taken from the work offices of Thomas Monroe and Olivia Stone.”

  Karp noticed that Stone suddenly turned to her attorney and said something. Mendelbaum scrambled to his feet. “Your honor, may we approach the bench before this line of questioning goes any further?”

  Rainsford nodded. “By all means.”

  Reaching the sidebar with Karp, Mendelbaum immediately voiced his objection. “My understanding, and granted I am an old man so all of this boggles my mind, is that given the lead-up to where we’re at with this witness now is that the People will claim to have information related to these IP addresses that will connect my client to either of these gentlemen named.”

  “That’s exactly what we’re going to do,” Karp replied. “And then some.”

  “Your point, Mr. Mendelbaum?” Rainsford interjected.

  “We have no record of this information from the prosecution regarding these IP addresses or Google histories . . .”

  “Browsing histories,” Karp corrected.

/>   “Yes, of course, browsing histories. So I’m objecting on the grounds that this is new information that should have been turned over to us. And since it wasn’t, this line of questioning should be prohibited.”

  The judge turned to Karp. “And how do you plead to this accusation of withholding new information?”

  “Not guilty, your honor,” Karp replied. “The defense was given as much access to the computers as they requested, and they did have them examined by their own forensic computer experts. We didn’t allow them out of the DA’s office with the computers, and they had to work in the presence of Mr. Newbury and his associates, but they were given the opportunity to see everything our people saw.”

  Rainsford turned back to Mendelbaum. “Did you have someone examine the computers?”

  “Yes, your honor, and the report I received was that there were no emails indicating any connection between these parties or incriminating browsing history. They did see some photographs on Mr. Salaam’s computer that taken out of context might appear to be questionable, but I didn’t hear anything about IP addresses or locating hidden material. And if the DA found such information, we should have been informed.”

  Rainsford looked disapprovingly and shook his head at Mendelbaum. “You know better, counselor. This isn’t information that the prosecution was hiding from the defense, even if your experts didn’t find it. In this case, both parties had access to the computers. I’m going to allow Mr. Karp to pursue this line of questioning. However, if you care to have your expert look at the machines again, I’m sure Mr. Karp will make them available to you.”

  Mendelbaum sighed. “I’ll reserve my right to do that until after I’ve heard Mr. Newbury’s testimony. I tell you what, though; I miss the days of typewriters and telephones you dial.”

  “Well, Mr. Mendelbaum, evidently computers do have some virtues,” the judge replied.

  Returning to his seat, Mendelbaum quickly conferred with Stone over the results of the conference with the judge. Karp was gratified to see her face tighten and fists clench; the chess pieces were moving exactly as he intended.

  “Mr. Newbury, would you please give the jurors a synopsis of what the examination of the three computers revealed, such as it pertains to this case?”

  “I can do that,” Newbury said, and faced the jurors. “We’ll begin with our examination of the laptop belonging to Yusef Salaam, also known as Henry Burns. Some of the information was easy to obtain as there’d been no attempt to delete or encrypt the material. That includes approximately twenty-five photographs we believed were of interest to the Rose Lubinsky homicide in New York County, as well as the attempted murder charge for the subsequent events outside the Jay Street Bar in Brooklyn.”

  As Newbury spoke, Karp walked over to the prosecution desk, where he retrieved the photographs he’d shown Burns. “Mr. Newbury, I’m handing you five photographs marked People’s Exhibit 30 A through E. Were these among the photographs you just described as having been found on Salaam’s laptop computer?”

  Newbury quickly glanced through the photos and then looked up. “Yes.”

  “Would you please briefly describe the content of the photographs and what they represent?”

  “Yes, these are photographs taken by an iPhone belonging to Mr. Salaam . . .”

  “Excuse me for interrupting . . . how do you know that they were taken by that particular device?”

  Newbury smiled. “Remember how I said IP addresses are assigned to different devices so that when something—such as a photograph—is sent from them to another device, we can trace the origination? Such devices also include iPhones. This particular iPhone and corresponding IP address belonged to Mr. Salaam and was found on his body following his death.”

  “Thank you. Please continue with your description of the photographs,” Karp said.

  “Of course. All of the photographs in People’s Exhibit 30 A through E depict fires engulfing three buildings and two vehicles. With the aid of the New York police and fire department arson investigators we were able to determine that at least four of the photographs, and probably all five, depict acts of arson, and in one case, homicide.”

  “Were any of these cases resolved with the apprehension and conviction of the perpetrator?”

  “Four of the cases remain open,” Newbury said, “the fifth, the homicide, is what we’re currently here to determine.”

  “Were these photographs Mr. Salaam could have picked up from media through the internet and downloaded onto this iPhone and later transferred to his computer?”

  “No, we were able to determine that he, or whoever had possession of his iPhone, took the photographs.”

  “Mr. Newbury, would you please describe the contents of the photograph marked as People’s Exhibit 30-E.”

  “The photograph shows a vehicle—actually a 2012 Ford Taurus—engulfed in flames. You can see two people lying on the sidewalk near the front passenger side of the car. And you can also see what appears to be someone in the backseat.”

  “Were you able to determine what this photograph represents?” Karp asked as he walked over to the diagram depicting the street crime scene People’s 1 in evidence.

  “Yes, it was taken from across the street . . .”

  “I’m sorry, just a moment, Mr. Newbury,” Karp said, and looked at Rainsford. “With the court’s permission, may the witness be allowed to approach People’s Exhibit 1, the diagram?”

  “Granted.”

  “Thank you. Mr. Newbury, would you please come here and mark on this diagram of the crime scene the location of the photographer and direction of the camera when this photograph was taken?”

  Newbury did as asked. “Here is the approximate place he stood and was facing this direction toward where the circle marked ‘Lubinsky car’ is on this diagram.” He then returned to the witness stand.

  “Were you able to identify the people you described as lying on the sidewalk, as well as the person we can see in the backseat of the car?”

  “Yes, the two victims on the sidewalk are Rose Lubinsky and Alejandro Garcia. It is my understanding that Mr. Garcia had just pulled her from the car. The victim in the backseat was a young woman named Mary Calebras.”

  Karp walked over and accepted the photographs from Newbury, which he then passed to the jurors. As they were looking at the exhibits, he returned to the prosecution table and picked up two more photographs that he handed to Newbury. “Mr. Newbury, I’m handing you two more photographs. Can you identify them?”

  “Yes, these were also found on Mr. Salaam’s computer,” Newbury said. “The first is a photograph of Rose Lubinsky taken from approximately thirty feet away. She appears to be speaking at a rally or meeting. The second is of a young man we were able to identify as Micah Gallo. It appears to have been taken outside an apartment building from across the street.”

  “Mr. Newbury, was there anything else of interest in regard to this case on Mr. Salaam’s computer?”

  “Yes. We had to dig deeper as much of what I’m about to discuss had been deleted, and in some cases attempts to wipe the memory from the computer’s hard drive were made. There was one other item he’d made no attempt to remove but is indicative of Mr. Salaam’s character. He was what those who engage in social media outlets refer to as a ‘troll.’ He’d create false identities, including using photographs of other people he found on the internet, and would then engage other people, such as on Facebook, for the sole purpose of antagonizing and disrupting the lives of these people. He would make harmful remarks and sow dissension and then leave the conversation.”

  “What else?”

  “We were able to discover several items from his deleted browsing history that was relevant to this case. This included looking up bomb-making instructions on the internet, including the use of C-4 explosives.”

  “Was any research reflected on the computer regarding the method of detonating bombs?”

  “Yes. He investigated several possibilities, such as us
ing cell phones,” Newbury said, looking down at his notepad. “He downloaded one title, ‘A Quick Guide to Detonation Using the Vibrating Function on a Cell Phone.’ The internet is full of such useful information.”

  “Please continue,” Karp said.

  “We also determined that Mr. Salaam used his computer to locate the Seahorse Motel in Atlantic City, as well as bus schedules and pricing for that destination.”

  Karp glanced over at Stone, who was bent over her legal pad writing, as her face turned bright red. “What else?”

  “Quite a bit,” Newbury said, looking at the jurors. “This goes back to our little chat regarding IP addresses and emails.” He looked down at his notebook. “Mr. Salaam’s laptop had an IP provider number of 172.16.254.”

  “And how does that pertain to this case?”

  “Well, over the past two years or so, but particularly in the time directly preceding and following the murder of Mrs. Lubinsky, he received a number of emails from IP address 184.12.321.”

  “And the significance of that?”

  “That is the IP address for the computer removed from the office of former district attorney Olivia Stone.”

  Up to that point, most of the media and others in the gallery had been following the discussion about computers and IP addresses with scrunched-up faces and looks of bewilderment. But suddenly, accompanied by a rising tide of murmurs and dropped jaws, it became clear where Karp was leading the witness, and he could tell it had for the jurors as well. Stone stopped writing and simply sat staring down at her legal pad.

  “I want to be clear about something,” Karp said. “Were you able to read the content of these emails?”

  Newbury shook his head. “No, they’d been deleted and then wiped from the computer’s memory.”

  “But you are able to determine that emails had been sent and received?”

  Newbury nodded. “Yes,” he said. “The hidden ‘details’ that accompany any email also include the date and time of the transmission and reception. That’s how we were able to determine what I just said about the time directly preceding and subsequent to these attacks, including one sent a few minutes before the explosion of Mrs. Lubinsky’s vehicle that caused the death of three people.”