Cops still epic fail at computer forensics: Casey Anthony case evidence missed

[CountDeMoney]

Shocking, but then, not so shocking.

Cops, prosecutors botched Casey Anthony evidence
Computer search for 'foolproof suffocation' never found

ORLANDO, Fla. -

For weeks, Casey Anthony sat at her murder trial with her defense team anxiously waiting for prosecutors to drop a bombshell: computer evidence, the state would argue, showing Anthony researched how to kill with poison and suffocation on the same afternoon her daughter, Caylee, was killed by poison and suffocation.

But the bombshell never exploded.

"We were waiting for the state to bring it up," defense attorney Jose Baez told Local 6. "And when they didn't, we were kind of shocked."

Baez first revealed the evidence in his book, "Presumed Guilty," but blamed Anthony's father, George Anthony, for the computer activity. Baez suggested George Anthony was considering suicide after Caylee accidentally drowned in the family swimming pool.

But a Local 6 investigation has uncovered evidence indicating it was most likely Casey doing the search.

And, in a stunning lapse, prosecutors -- relying on woefully incomplete information from the Orange County Sheriff's Office -- never even saw the potentially damning computer browser evidence, until Local 6 revealed it to them last week.

How damning is it?

Consider what they appear to show happening online the afternoon of Monday, June 16, 2008, the day Caylee died:

   At 2:49 p.m., after George Anthony said he had left for work and while Casey Anthony's cellphone is pinging a tower nearest the home, the Anthony family's desktop computer is activated by someone using a password-protected account Casey Anthony used;
    At 2:51 p.m., on a browser primarily Casey Anthony used, a Google search for the term "fool-proof suffocation," misspelling the last word as "suffication";
    Five seconds later, the user clicks on an article that criticizes pro-suicide websites that include advice on "foolproof" ways to die. "Poison yourself and then follow it up with suffocation" by placing "a plastic bag over the head," the writer quotes others as advising;
    At 2:52 p.m., the browser records activity on MySpace, a website Casey Anthony used frequently and George Anthony did not.

"I really believed that (prosecutors) were going to sandbag us with it," said Baez.

After all, poison, suffocation and plastic bags were exactly what the state claimed Casey Anthony used to murder Caylee and dispose of her body; poisoning her with chloroform, suffocating her with duct tape, then placing her body in two plastic bags.

After Local 6 described the findings to him last week, trial prosecutor Jeff Ashton said, "It's just a shame we didn't have it. This certainly would have put the accidental death claim in serious question."

Ashton retired after the trial, wrote a book on the case and, in January, will become state attorney, unseating his former boss in this year's election.

Who's to blame

With an army of investigators and prosecutors spending three years, hundreds of thousands of dollars and untold man hours on the most notorious, high-profile murder case in Florida history, the blame for overlooking key evidence could be placed at many feet.

"I don't think it's appropriate for me to say this person messed up, that person messed up or we messed up," said Ashton.

The Orange County Sheriff's Office, which possessed the evidence but failed to extract it and turn it over to prosecutors, now realizes what it missed.

"There was an oversight," said sheriff's Capt. Angelo Nieves, confirming that the agency tried and failed to extract information that would have revealed the entire Internet browsing history for that day. "This has been a learning experience for investigators as well."

Both Ashton and the lead prosecutor, Linda Drane Burdick, noted that prosecutors asked the Sheriff's Office to produce an Internet history of the computer for June 16, 2008.

But the request came relatively late, less than two months before trial, after prosecutors learned from defense witnesses that Casey Anthony was going to claim she was awakened that morning by her frantic father looking for a missing Caylee.

In an April 5, 2011, email to sheriff's computer examiner Sandra Osborne, Burdick wrote, "I believe, based on your reports, that we can disprove" Casey Anthony's claim that she was awakened by her father when Caylee disappeared. They could do that, Burdick wrote, "by demonstrating (if possible) what was actually happening (I guess that means user activity and Internet history) on the computer during the time frame."

In response, lead sheriff's Investigator Yuri Melich sent Burdick a spreadsheet that, our investigation found, contained less than 2 percent of the computer's Internet activity that day.

Melich and Osborne relied on Internet data from the computer's Internet Explorer browser – one Casey Anthony apparently stopped using months earlier. Since March, she preferred the computer's Mozilla Firefox browser, as investigators already knew.

The spreadsheet sent to Burdick included 17 vague entries from the Internet Explorer browser history on June 16, 2008, and failed to list 1,247 entries recorded on the Mozilla Firefox browser that day -- including the search for "foolproof suffocation."

The mistake meant prosecutors went to trial unaware of 98.7 percent of the browser history records created that day.

Even the scant data the Sheriff's Office did manage to find showed computer activity inconsistent with the claim that Casey Anthony was awakened that morning to learn her daughter was missing and then drowned.

In his powerful opening statement, Baez described the resulting scene between father and daughter, after Caylee's wet, limp body was recovered.

"He immediately began to yell at (Casey). Look what you've done! Your mother will never forgive you and you will go to jail for child neglect for the rest of your fricking life."

So, the jury was told, George Anthony disposed of the body and both he and Casey re-launched their lives in a secretly shared compact of denial and deceit.

"This is strange," Baez told jurors. "This is bizarre. This is the life of Casey Anthony."

No, prosecutors countered, this was about the murder of Caylee Anthony – one accomplished, they claimed, with poison, suffocation and plastic bags.

Had Casey Anthony testified, as Burdick said she expected she would, prosecutors wanted to use the browser information to impeach her. But Casey Anthony never took the stand and the state did not elicit from any other witness even the skeletal browser evidence it did have.

Melich's spreadsheet does show activity from Casey Anthony's password-protected account beginning at 7:52 a.m., indicating that she was on MySpace and researching sexy costumes for "shot girls" to wear at her then-boyfriend's nightclub events.

But none of the 1,247 overlooked Firefox browser actions that day -- including the potentially incriminating search that afternoon -- appear in the easily extractable Explorer browser files that Melich relied upon for his timeline.

Investigators knew Casey Anthony preferred the family computer's Mozilla Firefox browser, but they previously had trouble decoding it, sheriff's officials said.

In 2008, in a deleted section of Firefox browser records, they found searches from March 2008 for "how to make chloroform," "neck breaking," "death" and other terms after they requested that Osborn search the hard drive for the word "chloroform." That request came after the Sheriff's Office found traces of chloroform in the trunk where, they claimed, Casey Anthony hid her daughter's body.

But when Melich assembled his 114-line spreadsheet in 2011, he transferred data from the Internet Explorer browser that Casey Anthony rarely, if ever, used after March 6, 2008.

Melich and Osborne declined comment, and the then-head of the computer crimes section, Sgt. Kevin Stenger, has retired and could not be reached for comment.

But in a Sept. 6, 2012, email exchange with a Phoenix attorney who obtained the browser histories in August through a public records request, Osborne offered this explanation for the oversight: "I have a very good reason why (the foolproof suffocation search) wasn't brought up during trial. I was never asked to conduct a search for 'suffocation' and the word does not appear in the Internet artifacts we prepared for trial, unfortunately."

In a statement to Local 6 on Monday, the Sheriff's Office stood by Osborne and echoed her defense: "The Firefox record which contains the Google search for 'suffication' was neither extracted nor examined. A search for the keyword 'suffocation' was never requested from any OCSO investigator or the prosecutor's office at any time during the investigation; therefore, this Internet record was inadvertently not discovered by Detective Osborne. ... The agency has confidence in her knowledge and expertise in this very complicated field of computer forensics."
When it comes to blame, the prosecution notes it requested the information from the Sheriff's Office; the Sheriff's Office states it was never asked to search for "suffocation."

But both agree on this point: No one can say for certain whether the jury would have reached a different verdict if the evidence had not been overlooked.

Bringing the evidence to light

Repeated requests by Local 6 beginning in 2009 for a copy of the hard drive that contained the Internet histories were denied by the state attorney's office, which claimed -- correctly, it turned out -- it did not have the data in its possession.

Sheriff's computer investigators copied the entire hard drive from the Anthony's HP desktop computer after seizing it in July 2008 and gave prosecutors vague analysis of its activity and fragments of a minuscule amount of the vast information on them. The sheriff turned over the original hard drive to the Baez team in 2008 after it had been copied, Baez said.

After Baez revealed the "foolproof suffocation" search in his book, Phoenix attorney Isabel Humphrey requested and received a copy of the browsers' histories from the Sheriff's Office.

Baez's theory that George Anthony did the search while contemplating suicide "was as crazy as the nanny story," Humphrey told Local 6, referring to Casey Anthony's original claim that a babysitter had kidnapped Caylee.

She obtained the data in August and turned it over to John Goetz, a retired engineer and computer expert in Connecticut. The pair had become acquainted online while following and discussing the case through the amateur sleuthing web community, Webslueths.

Using free software available on the Internet since 2004, Goetz said it took him less than two hours to extract more than 35,000 records detailing the computer's online activities from 2004 until it was seized in July 2008.

"Once you have converted the Internet history records, it really doesn't take more than 15 to 20 minutes to look through the entire Internet history for June 16," said Humphrey. "And I would think if there was one day you would pick to look at, that would be the day."

Goetz and Humphrey homed in on June 16, 2008, and quickly discovered the misspelled search for "fool-proof suffication."

"It shows you a state of mind that was present on the actual afternoon it appears the child had died," Humphrey said. "So I think it would be important regardless of who it was making the searches, but in this case it's certainly important that it appears to be Casey Anthony herself."

What they found astounded them and left at least one crucial question unanswered: How could prosecutors have not used this at trial?

Searching for that answer, they turned the browser history files over to Local 6.

After authenticating the records and interviewing defense, prosecution and Sheriff's Office sources, it became clear: two citizen-investigators accomplished in less than three hours what an army of Orange County investigators and prosecutors failed to do in three years: uncover in detail what Casey Anthony was doing online the day Caylee died.

Of course, unbeknownst to investigators and prosecutors, it was also uncovered many months earlier by someone else: Jose Baez.

[CountDeMoney]

The rest.

The defense: George did it

"I don't understand how no one ever knew about this evidence," Baez told Local 6. "We were keeping it close to the vest and ready to counterpunch in the trial, and it never came out."

The defense's still-cocked counterpunch: George Anthony did it.

After Baez's computer expert found the June 16 search for "foolproof suffocation" (Baez said he cannot reveal exactly when that was), Baez said he suspected the state knew about it, too, and was going to surprise the defense with it at trial.

In his revealing book, "Presumed Guilty," Baez accused investigators of "pulling a fast one" by concealing the vast majority of the June 16 computer history from the defense. Mostly vague references to that day's activity and some images were included in the documents turned over to the defense by the state in the discovery process.

What our reporting confirmed happened never occurred to Baez: that, in this small but crucial area, the investigation was so lacking it failed to discover the search.

But if they had, Baez said, he was ready.

"It turned out to be a huge bombshell that we thought would be the knockout blow in this case," Baez said, anticipating the defense would knock out the state by arguing the search showed George Anthony contemplating suicide, not Casey Anthony researching how to kill.

"It appears suicide had long been on George's mind," Baez wrote in "Presumed Guilty," noting George Anthony attempted suicide in January 2009.

Asked by Local 6 if the foolproof suffocation search and visit to the site discussing ways to kill showed consciousness of guilt, Baez said, "To me, it tells me someone's feeling very guilty of something and is considering suicide. To be considering suicide the day Caylee died was huge for us."

Asked if that meant he believed whoever did that search was responsible for Caylee's death, Baez said, "I think 'responsible' is too strong a word."

His book explores various scenarios, all pointing to George Anthony.

But, in doing so, Baez relies on several assumptions that are refuted by evidence developed and confirmed by Humphrey, Goetz and Local 6.

The defense's flawed timeline

As part of the book's "concrete proof" it was George Anthony and not Casey Anthony doing the foolproof suffocation search that afternoon, Baez notes correctly it was immediately preceded by a login to an AOL Instant Messenger account.

"Right after someone logged in to instant messenger," Baez writes in his book, "the first search was to Google" for foolproof suffocation.

That much is confirmed by the evidence. But then Baez errs in writing, "George had an AOL Instant Messenger account. Casey didn't."

In fact, Baez now concedes, Casey Anthony did have such an account, known as AIM.

And Goetz recovered encrypted data showing it was Casey's Anthony's AIM account screen name – casey o marie – and not George Anthony's that logged in just before the foolproof suffocation search.

The same AIM account was used to chat on the computer at 7:56 a.m., and was logged in at the outset of other Casey-related Mozilla Firefox browsing session on that day and several others.

That June 16 AIM chat was clearly between Casey Anthony (casey o marie) and a friend known on AIM as WitePlayboi.

"So what r u up 2," WitePlayboi asked at 8:01 that fateful morning.

"Not a whole lot. Checking up on all the MySpace/Facebook hoopla," casey o marie replies 30 seconds later.

Baez said he has corrected the error in subsequent editions of the book.

But, he insists, there is still plenty of evidence that it was George Anthony doing the search that afternoon.

To support that theory, though, he has to discredit the times logged in the browser's software.

Baez claims the "foolproof suffocation" search occurred at 1:51 p.m., not 2:51 p.m., and that the times on the browser history extracted from the sheriff's copy of the hard drive failed to take into account the beginning of daylight saving time in March 2008.

A 2:51 p.m. search time makes it difficult for Baez to argue George Anthony was responsible because George Anthony claimed he left the house around 2:30 for a work shift that began at 3 p.m.

In addition, a detailed comparison of the browser times to independent evidence -- some direct, some circumstantial -- corroborates the contention that the search occurred at 2:51 p.m. and not 1:51 p.m., as Baez claims.

Consider:

    When Osborn first seized the computer and started it on July, 18, 2008 at 12:13 p.m., she testified, the computer's time was "right on the money."
    On June 16, at 11:27 a.m., the browser logged a photo accessed through Facebook, then a visit to the Photobucket photo sharing site. Eighteen seconds after the photo was accessed in Facebook it was uploaded to Casey's Photobucket account, according to Photobucket records subpoenaed by the Sheriff's Office in 2008.

If the browser time were incorrect as Baez claims, Photobucket's records would have placed that activity at 10:27 a.m. (Melich's spreadsheet prepared for the prosecution inaccurately states the photo – showing the inside of a lounge where Casey's boyfriend held weekly nightclub events -- was uploaded at 9:27 a.m., failing to note Photobucket's record was based on Mountain Time.)

    Cellphone call and text records also align with the times of computer activity logged by the browser, but only if one accepts the later 2:51 p.m. time for the foolproof suffocation search.

Most strikingly, the browsing session that included that search logs its last activity, involving MySpace, at 2:52 and 55 seconds. Cellphone records show Casey Anthony answered a call from former boyfriend Jesse Grund that was logged at 2:52:53.

They spoke for nearly 12 minutes, the call ending at the 3:04:06 -- the exact second the cell records show a call from George Anthony to Casey Anthony's cell, indicating she disconnected with Grund to take a 26-second call from her father.

In his book, Baez said the call at 3:04 p.m. is "exactly when (George) would have arrived at work." Records also show George used his cell to call his house landline at 3:02 p.m., indicating he was not home at the time.

It was during that 3:04 p.m. call, Baez writes, that Casey Anthony claims her father told her, "I took care of everything," meaning he disposed of the body and warned her not to tell her mother, Cindy Anthony, about Caylee's death.

Thirty minutes later, Casey Anthony called her then-boyfriend, Tony Lazzaro.

Baez suspected the state did not want to introduce at trial cell and computer records because they refuted something George Anthony had insisted on all along: that he is certain Casey Anthony and Caylee left the house at 12:50 that afternoon.

As Local 6 first revealed in 2009, Casey's cellphone indicated it was at or near the house that entire day, until she headed toward Lazzaro's apartment at 4:11 p.m.

And the newly uncovered browser histories further indicate Casey Anthony was at the house past 12:50 that afternoon. Her password-protected computer account activates the browser at 1:39 p.m., revealing activity associated with her AIM account and MySpace and Facebook. The last browser activity during that session is at 1:42 p.m.; two minutes later, Casey Anthony calls her friend, Amy Huizenga, and they talk until 2:21 p.m.

Twenty-eight minutes later, browser histories show, Casey Anthony's account on the computer is back online just before the search for foolproof suffocation.

Later, in testimony, neither Huizenga nor Grund recalled anything unusual about Casey's tone during those phone calls.

Questions remain

None of this, of course, is proof that Casey Anthony killed Caylee. A jury has found her not guilty and the Constitution generally precludes her from being tried again for the same crime.

While the state now says it would have argued the search showed her interest in killing with poison, suffocation and plastic bags, the defense would have countered the computer user was researching suicide and, as Baez wrote, George Anthony "was the only one out there trying to kill himself."

The timeline could support one of any number of other possibilities, including one Baez did not raise, but could have used to his advantage: that Caylee did, in fact, die in an accidental drowning and George and Casey Anthony agreed they would conceal the death. But, after George Anthony left to dispose of the body and go to work, Casey Anthony went online to consider suicide that afternoon.

Still, why she would search for "foolproof suffocation" and not, say, "how to commit suicide," is another unanswerable question – and one of many.

Baez concedes the records are open to interpretation, and notes browser data alone cannot conclusively prove who was using a computer at any given time. And, he stressed, several of his experts independently confirmed the search in question occurred an hour earlier than the records provided to Local 6.

While he argued in his book someone "signed on to" George's AIM account that afternoon, the records show it was Casey Anthony's account. Informed of that, Baez now notes the login may have been automatic whenever someone started a browser. Even so, browser records indicate Casey's password-protected account is the only one that generated a login to her AIM account, as it did just before the foolproof suffocation search.

George Anthony's attorney, Mark Lippman, said he would relay a request to George Anthony for comment on what happened that afternoon, but neither has responded.

In our October interview, Baez at first agreed George Anthony was at work by 3, but -- after Local 6 challenged his timeline -- he noted last week his assumption was based on work schedules, not time-stamped cards, and on George Anthony's unverified testimony.

He also said his expert found some computer system files with times that support his contention the browser's reported times were off by an hour. But those records have not been released and, therefore, cannot be verified by Local 6.

So, 16 months after a verdict that shocked the nation, the case continues to leave heads shaking.

How could a massive investigation fail to uncover crucial evidence created during the most important hours of its most important day?

And why didn't prosecutors request the records sooner, making a more forceful, specific, wide-ranging demand for every byte of data on the computer browser, then followed up more vociferously, utilizing the vast array of experts and resources available to the sheriff's and state attorney's offices?

The incoming state attorney, Ashton, said he "can't think of a policy or procedure I could put in place to make sure this wouldn't happen again."

He repeatedly cited Burdick's asking the Sheriff's Office for June 16 browser data, saying, "It appears Linda's question covered the material."

But that request came less than two months before jury selection in a case that had consumed investigators and prosecutors for nearly three years by then.

The Sheriff's Office said its computer forensics section, where Osborne is still employed, "is walking away from it knowing there are things we can do better in the future."

The sheriff's computer examiners had other problems with evidence.

The times associated with the chloroform searches in March 2008 and produced by the Sheriff's Office were, indeed, off by an hour, because the software they used to extract it did not take into account the change to daylight saving time on March 9, 2008.

Also, in trial, the sheriff's independent computer consultant inaccurately testified the browser made 84 visits in March 2008 to a page that showed a recipe for making chloroform. The defense proved the software was flawed and there was only one visit – a major blow to a state case that rested on circumstantial and scientific evidence.

Still, the Sheriff's Office stands by its work.

"We have reviewed this incident and have confidence in (Osborne's) ability to provide current and future computer forensic analysis,' the sheriff's statement read. " We have reviewed our procedures and based on the needs of a future investigation, we will seek outside assistance and expertise as deemed appropriate on a case by case basis. "

For Humphrey and Goetz, who easily uncovered from afar what the Sheriff's Office and prosecutors were unable to find for years, the failure to do whatever was necessary to get to those browser records still leaves them astounded.

"I'm just really surprised by that," said Humphrey."I don't want to comment on their competence. I think the prosecutor and Sheriff's Office both had a huge job before them on this case and they both obviously worked very hard."

But, asked if she would have done more to make sure the state had the entire computer browsing history from that crucial day, Humphrey said, "Certainly, if I had been in the prosecutor's office, I would have."

[HVC]

It was a foregone conclusion that a pretty girl would get away with murder, all the rest is irrelevant.

[Razgovory]

She wasn't that pretty.

[OttoVonBismarck]

She wasn't that pretty.

How does she compare to the women you've stalked?

[Razgovory]

Badly.

[Drakken]

And another reason why double jeopardy, while necessary in our system, always leaves a bitter, bitter taste in our mouth.

Regardless of "who" did it, it's still unfathomable, however, that their teams of cyber-investigators were unable (or forgot) to do something as basic as to filter through Anthony's browsers history to pinpoint what she was surfing for before and at the time of the crime. Makes me think there are significant gaps in cyberinvestigation protocols in these police forces, and would make anyone question their credibility.

[Caliga]

What does Nancy Grace think about all of this?

[CountDeMoney]

Regardless of "who" did it, it's still unfathomable, however, that their teams of cyber-investigators were unable (or forgot) to do something as basic as to filter through Anthony's browsers history to pinpoint what she was surfing for before and at the time of the crime. Makes me think there are significant gaps in cyberinvestigation protocols in these police forces, and would make anyone question their credibility.

That's because the organizational mindthink of law enforcement lacks vision, always have and always will.  They don't go out and hire young cyber guys, number one because they can't afford them, and even if they could and find ones willing to do it, oh, no, no, no they have to be sworn personnel, have to be part of "the brotherhood".
So what do they do?  Do they hire competent civilians to manage this sort of thing?  No.  They send a sergeant or two to computer camp, until he gets promoted and moves on to something else, and they move up the next former corporal in charge of Quartermaster duties to send to computer camp.

Dude, I've seen it from the inside, and this shit didn't surprise me in the least.  LEOs will always be behind the curve when it comes to technology because of their own organizational dysfunctionalism.

[derspiess]

Related to this discussion, I read yesterday that William Hung of American Idol fame is currently working as a technical crime analyst in the LA County Sheriff's Department

I bet he'd have dug this up.