Wrap: FBI expert stands by phone analysis as defence seeks Schembri evidence
Jurors hear of reconstructed phone, disputed emails and requests for Schembri's call profiles on Day 10
An FBI cellular analysis expert told jurors on Saturday he remained confident investigators had correctly identified the phones used to detonate the bomb that killed Daphne Caruana Galizia, as the defence sought access to a wider range of phone extractions and emails linked to the murder probe.
The tenth day of Yorgen Fenech's trial by jury focused largely on technical and digital evidence, with jurors hearing from US Federal Bureau of Investigation expert Richard Fenner and court-appointed IT expert Martin Bajada.
Fenner, who travelled to Malta to testify, described the analysis that led investigators to identify the mobile phones believed to have been used in the assassination.
He told jurors that investigators isolated a suspicious phone number after examining activity around the Bidnija murder scene between 2.58pm and 3.16pm on October 16, 2017. Of the 53 numbers connected to the relevant mobile phone mast during that period, one immediately stood out because it was no longer active days later.
The phone had connected to the network only three times throughout the year, including on the day of the murder. Fenner also testified that Vodafone decoded the message "REL1=on", describing it as a typical command used to trigger an explosive device.
Summing up his findings, the FBI expert said he was confident investigators had correctly identified the two numbers used to detonate the bomb, as well as three other phones believed to have been linked.
The hearing then shifted to Martin Bajada, the court-appointed IT expert who led the painstaking recovery of digital evidence from Caruana Galizia's accounts after her mobile phone was destroyed in the explosion.
Bajada explained that the phone recovered from the crime scene was a "total loss", making a conventional extraction impossible.
Instead, investigators reconstructed the device using the journalist's SIM card and an identical handset, allowing them to recover data from her Google, Facebook and WhatsApp accounts. Some WhatsApp conversations, however, had been permanently lost because they had never been backed up to the cloud.
The expert stressed the sensitivity of the material recovered, telling jurors that the extracted data revealed the identities of many confidential sources who had provided information to Caruana Galizia during her work as a journalist.
Europol was also provided with a copy of the recovered data. Their subsequent report was almost a "mirror image" of the report carried out by Bajada and his team.
Much of the afternoon was dominated by legal arguments over how that material should be presented to jurors.
The defence insisted that if the prosecution intended to rely on emails recovered from Caruana Galizia's account, the jury should be shown the original, unredacted versions rather than copies with information removed to protect journalistic sources.
Defence lawyer Giannella De Marco also pressed the court to exhibit a series of forensic phone extractions and call profiles relating to former prime minister's chief of staff Keith Schembri, former police commissioner Lawrence Cutajar, Melvin Theuma, Office of the Prime Minister security official Kenneth Camilleri, businessman Johann Cremona and Edwin Brincat, known as il-Ġojja.
The requests formed part of the defence's continuing effort to broaden scrutiny of the investigation beyond Fenech, a strategy that has featured prominently throughout Keith Arnaud's cross-examination over recent days.
Fenech, 44, denies commissioning the October 2017 assassination of Caruana Galizia, who was killed by a car bomb outside her Bidnija home.
Prosecutors allege he paid €150,000 through middleman Melvin Theuma to arrange the murder. Five other men have already been convicted over the assassination, either for carrying out the killing or supplying the bomb.
The trial continues on Monday.
Live blog
Case adjourned until Monday
5.45pm And as the defence lawyers demand more phone extractions, the judge calls it a day. Before the case is adjourned, Judge Grima urges lawyers to show up with prepared questions and points out that the IT expert cannot be expected to be drawing up new reports.
We will upload a recap of what happened today shortly, and we will be back in court with our live reporting on Monday.
How many times were Schembri and Cardona mentioned?
5.30pm De Marco asks court IT expert Martin Bajada whether, using the extracted emails from Caruana Galizia's account, he could determine how many times Keith Schembri and Chris Cardona are mentioned.
De Marco says she is referring to the digital search function, arguing it should be possible to establish how many emails mention the two men.
Bajada replies that he has no objection to carrying out such a search if directed by the court, but stresses it is not something that can be done at the click of a button.
The defence lawyer replies: "If he wants, we can find them ourselves, and then on Monday we put them on screen."
A parallel leaks investigation
5.15pm: Just to put things in context: Keith Schembri is facing separate charges in the leaks case in connection with the assassination of Daphne Caruana Galizia.
A five-year magisterial inquiry into leaks of sensitive information eventually found enough evidence to charge the former chief of staff with perjury and breaches of the Official Secrets Act. Schembri denies wrongdoing.
More phone extractions requested
5.10pm The defence lawyer continues asking the court to exhibit phone extractions and call profiles relating to several figures connected to the investigation.
She requests the call profiles for Melvin Theuma's phones. Court IT expert Martin Bajada says those form part of an earlier extraction already exhibited.
Asked by the judge whether he had worked on Theuma's phone, Bajada says he examined it as part of the investigation into alleged leaks from the murder inquiry.
De Marco then requests the extractions and call profiles for former police commissioner Lawrence Cutajar, whose devices were also seized and examined, as well as those relating to Edgar Brincat, also known as Il-Gojja, including extractions carried out during both the magisterial inquiry and the subsequent leaks investigation.
Phone records
4.55pm De Marco asks the court to exhibit a series of phone extractions and call profiles linked to the investigation.
She requests the 2018 and 2020 forensic extractions and call profiles for Keith Schembri's phones, as well as the phone records relating to Kenneth Camilleri and Johann Cremona.
She is told Cremona had five phone numbers - a landline and four mobiles.
Kenneth Camilleri is a former security official at the Office of the Prime Minister who worked closely with Keith Schembri.
Johann Cremona is a business associate of Yorgen Fenech who knew Melvin Theuma.
Defence seeks Schembri phone extraction
4.40pm Cross-examination of IT expert Martin Bajada starts.
Defence lawyer Giannella De Marco asks the court for the 2020 extraction of Keith Schembri's phones, carried out using updated forensic software, to be exhibited when Schembri testifies.
She tells the court that the material is contained on a pendrive and relates to two iPhones, referred to as KS1 and KS2.
The court hears that a forensic clone had been created from Schembri's phones and made available for various investigations.
Conditions for mail evidence
4.25pm Defence lawyer Giannella De Marco argues that the prosecution has had six years to locate the authors of the emails and have them testify to verify their contents.
The judge replies that the prosecution cannot simply "pinpoint" a handful of emails in isolation. She notes that Matthew Caruana Galizia is expected to testify later in the trial and the defence will be able to question him on the matter.
It is ultimately agreed that court IT expert Martin Bajada will return to the witness stand to confirm that the emails formed part of his original report.
The judge adds that if the prosecution ultimately fails to produce evidence verifying the emails, she will instruct the jury to disregard them.
The defence lawyers: Giannella de Marco, Gianluca Caruana Curran and Charles Mercieca.Wrangle over redacted emails
3.50pm Proceedings are temporarily focused on a legal argument over emails extracted from Caruana Galizia's account.
The defence argues that if the prosecution intends to refer jurors to those emails, they should be shown the original, unredacted versions, rather than copies with information removed to protect journalistic sources.
Defence lawyer Charles Mercieca argues that the unredacted emails constitute the actual evidence, while the redacted versions were produced only at the request of the family lawyers to avoid disclosing sources.
He also argues that, unless the authors of the emails testify to confirm their contents, the emails cannot be treated as proof of what they say, but merely as evidence that a communication took place at a particular date and time.
Data extraction
3.25pm Judge Grima is addressing the jury. She says that, following a request by the defence, she had ordered a more recent forensic extraction of the relevant device using updated technology.
The prosecution asks Martin Bajada whether a new extraction of Yorgen Fenech's phone had been carried out using more modern forensic software.
The judge intervenes, asking when the phone was last extracted.
Bajada says Europol extracted the data in 2020.
Back in hall
3pm We are back in Hall 22. The session is expected to resume shortly.
A break
1.05pm The jury is ordered out as the defence and prosecution argue over the prosecution’s line of questioning.
As things get heated, the judge orders a recess. “Stop arguing and have some respect,” she tells them before exiting the courtroom.
The court is adjourned until 2pm.
Improvements in extraction tech
12.50pm Bajada says extraction technology has come a long way since the start of this case. At the time, it was fairly novel to be able to extract WhatsApp and Signal data from a device. Nowadays, software can extract “everything”, he says.
He was asked to revisit data extraction several years into the case, he says, following software updates.
“It’s like advances in DNA technology that allow cases to be reopened. The same applies to IT,” he says.
Europol had a copy of Daphne's data
12.35pm Bajada and the rest of the team could see who was giving Daphne Caruana Galizia information. And some would not have been happy to have their identity revealed, he says.
He acknowledges the sensitivity of the information he was handling: “A lot of people were giving her (Daphne) information as an investigative journalist. It wasn’t prudent to reveal sources... I sought direction from the magistrate.”
Europol was also given a copy of Daphne’s data, he says.
Multiple inquiries
12.15pm Bajada’s testimony takes the jury across the breadth of his involvement in the various aspects of this case: the murder probe itself, of course, but also parallel probes into leaks of confidential information about and investigations into devices belonging to Keith Schembri and others.
He explains that when devices are seized, a copy of their contents is made, to preserve that data. Looking into that data comes later, and if approved by the courts.
A brass band distraction
12.10pm For the second time in a week, a brass band playing on Republic Street is making it difficult for our court reporter to make out what is being said inside the courtroom.
Reminder: journalists are seated in the gallery of hall 22, up and away from the key protagonists, on wooden benches. Facilities - such as amplification - are threadbare.
Police commissioner's car checked
12.05pm Bajada also inspected then-police commissioner Lawrence Cutajar’s car at a magistrate’s orders. The order came after police and the inquiring magistrate got wind that information about the probe was being leaked.
Cutajar was suspected of secretly meeting Edwin Brincat il-Gojja. Bajada says he was asked to see if Cutajar’s car provided any GPS data to track its location. It did not, he tells the court.
Cardona and Degiorgio
12.02pm Bajada was also given a photo and asked to analyse it, geolocate it and identify the people it showed. The allegation was that the photo depicted former minister Chris Cardona with Alfred Degiogio, one of the Caruana Galizia hitmen.
Bajada said their work concluded that the photo was taken inside a Siġġiewi farmhouse at a party which Cardona had attended “for five minutes” and which Degiorgio attended. Bajada says he can’t recall much more about that.
Hard drive data extraction
11.58am Bajada also presented other reports related to the case: one focused on data extraction made of an external hard drive given to him, and another detailed the work the four-person team did on analysing the data.
Two of the four people on the team had at one stage resigned from that job, he says, for their own personal reasons.
Working to a deadline
11.51am Once they had access to data on her phone, the next job was to sift through it. Bajada was part of a four-person team given that task.
They split the work among themselves and met regularly with the inquiring magistrate, mindful of a data retention deadline they were working against.
What experts obtained from Daphne's phone
11.45am Bajada was with the inquiring magistrate when experts presented what was left of Daphne Caruana Galizia’s phone.
“It was immediately clear that no information could be extracted from this phone,” the witness testified. It was a “total loss”.
Because of that, the decision was taken to “clone” the phone. Bajada spoke to the mobile service provider, obtained the SIM card and an identical model phone.
He managed to create a replica and access Caruana Galizia’s Google and Facebook accounts. He also got access to her WhatsApp, though some of her chats were unretrievable because they had not been backed up to the cloud.
It was all relatively simple once he had a phone and her SIM card, he explains: there was no two-factor authentication to contend with.
What experts can extract from phones
11.35am Bajada, like the previous witness, provides testimony about various technical aspects related to mobile telephony.
He is asked what a burner phone is. The concept is buying a SIM card from a store or supermarket, making 30 calls (he uses the number by way of example) and then throwing it away. Burner phones are useful for criminal activities or people who don’t want to be traced, he adds.
Bajada explains that service providers hold call record data for a period of time, but they never hold the actual content of those calls or messages. For those, you need the actual device.
If an expert has the physical device, he or she can extract contact book names, SMS data, photos, recordings and so on, he explains in reply to questions.
IT expert testifies
11.15am The hearing resumes.
Court-appointed IT expert Martin Bajada takes the witness stand.
Cross-examination
10.40am Fenner faces cross-examination.The defence asks when the SIM cards were acquired. He says he does not know. They also ask the witness some specific questions about dates and times concerning the SIM cards.
The judge calls a recess until 11am.
An expert's confidence
9.55am Fenner summarises his conclusion: he felt comfortable in identifying two numbers that were used to detonate the bomb that killed Daphne Caruana Galizia and the three numbers suspected of being linked to the crime.
All three phones appeared to move in tandem towards the same areas, he says.
Questions about SIM cards
9.34am The prosecution peppers the expert witness with questions about the way in which cell towers work. Fenner says Vodafone was able to decode a message sent by the suspicious device: REL1=on. That was a typical prompt to detonate a bomb, he says.
He then goes into the specifics of activity involving the suspected SIMs.
Inactive number raises red flag
9.18am Fenner focused on connections made to a specific tower near the murder site between 2.58pm and 3.16pm. He identified 53 different phone numbers connected to it during that time.
By October 23, all but one of those phone numbers was still active. The inactive number became one of interest.
He took a closer look at that number: it had only been validated by a network three times: once in January, once in August, and a third time that day in October.
That was highly suspicious, he says.
FBI cellular expert
9.10am FBI expert Richard Fenner will be the day’s first witness. Fenner is an expert in cellular analysis. He's flown to Malta to testify in the case.
He recalls first meeting with Malta’s telecom providers to understand their networks and where cellular towers are located. Each cell tower is uniquely numbered and provides 360-degree coverage., he explains.
Welcome
8.40am Good morning and welcome to this live blog. We're bringing you regular updates from the Valletta law courts, where this hugely significant trial resumes today.
Today's hearing is due to begin at 9am