Data on Yorgen Fenech’s phone was extracted by a Europol expert in late October of this year and the process took around three days to complete, a court heard on Wednesday.
The phone – a black iPhone – was seized as part of the Daphne Caruana Galizia murder investigation in November 2019 after Fenech was arrested on suspicion of having masterminded the murder.
It was taken to Europol headquarters at The Hague, Netherlands for data extraction and analysis, as forensic experts from the EU law enforcement agency were unable to run those processes with equipment they had with them when the flew to Malta following Fenech’s arrest.
Europol experts had previously testified that they extracted around four terabytes worth of data from a range of devices seized as part of the murder probe into Fenech, who is pleading not guilty to murder charges.
On Wednesday, a court heard the cross-examination of two of those experts.
Giuseppe Totaro testified that:
- Fenech’s phone was left in an unsealed bag while it was being worked on, as best practice was for phones to be kept switched on and in aeroplane mode when extracting data.
- The task was reassigned to him from a colleague, Yulia Toma, in October, after an "issue" arose with her appointment.
- He could not say whether Toma had worked on the phone before it reached him.
Konstantinos Petrou testified that:
- Europol Malta did not have access to extracted data
- Europol's involvement was requested by Malta and green-lit on November 21, 2019
- He finished work on exhibits assigned to him on November 24, 2020
- Europol colleague Sami Armoyne served as a liaison with Maltese police
After almost six hours of testimony, magistrate Rachel Montebello adjourned the case to January 12, 2021.
A request made by Yorgen Fenech's lawyers for bail was rejected, with the court saying nothing substantial had changed since Fenech's most recent request for bail, made in September.
Investigations in the case were ongoing and the possibility of tampering with evidence was a "concrete risk," the magistrate said.
Yorgen Fenech (centre) enters court accompanied by two of his lawyers, Marion Camilleri and Gianluca Caruana Curran. Photo: Mark Zammit CordinaAs it happened
Live blog ends
3.57pm A long day of testimony in court is over, and that brings this live blog to an end too. We will have a summary of the today's testimonies available at the top of this article shortly.
Thank you for having joined us.
Fenech denied bail
3.53pm Defence lawyers ask about their most recent bail request for Fenech, and are told that the decree was delivered in chambers. It appears a problem with the court's notification system meant parties were not notified.
Fenech's bail request was denied.
Case adjourned to January 12
3.50pm Prosecutors and defence discuss how to communicate future court dates and the magistrate adjourns the case to January 12, 2021.
Magistrate calls it a day
3.46pm Magistrate Montebello calls a halt to proceedings for the day, and Petrou stands down from the witness stand.
It’s been a gruelling court session for everyone involved. Many have been in the courtroom since 10am.
Talking to Arnaud
3.43pm Zahra asks the witness about his contact with superintendent Keith Arnaud.
Petrou says he first spoke to Arnaud about this case since he was appointed to it in 2019 this past Monday.
Questions from the prosecution
3.39pm Inspector Kurt Zahra says he has three brief questions for the witness.
Lawyer Charles Mercieca objects. Cross-examination is still ongoing, he says.
The magistrate overrules that objection, though. Zahra can ask his questions, provided they concern things Petrou has testified about.
Who has access to data?
3.32pm Petrou is asked who has access to data stored on Europol’s network. He says different teams have access to different data.
He is asked whether the team working on this case has access to all data concerning items seized from Portomaso and Fenech’s boat. Petrou says he will have to check. His colleague Yulia has access, he says in reply to a question.
Data is accessed through a password-protected login and Europol Malta does not have access.
“They have separate networks,” he explains. “My team is isolated.”
Confused witness
3.27pm Defence lawyer Marion Camilleri has a point she’d like to raise, about recordings of Melvin Theuma.
Magistrate Montebello says that concerns a separate inquiry [being led by magistrate Gabriella Vella], but the defence team argue that it’s a matter for the murder inquiry [led by magistrate Neville Camilleri].
Assistant attorney general Philip Galea Farrugia says he cannot recall whether the witness testified in proceedings concerning the three alleged hitmen.
Petrou tells the court he’s rather confused with all this jumping back and forth between 2017, 2018 and 2019.
Question and answer
3.17pm Petrou says exhibits were sealed in bags.
Mercieca: How do you know?
Petrou: Excuse me? It’s stated in the report. Items were seized from Portomaso business tower.
Mercieca: How do you know?
Petrou: It’s stated on exhibit forms.
Mercieca: Could you tell us what other devices you examined between 2017 and 2019?
Petrou: You should have it in my reports.
No recollection of Theuma data
3.12pm Mercieca asks Petrou whether he extracted data concerning [middleman] Melvin Theuma.
He says he does not recall.
Heading to Malta
3.09pm Petrou says that his colleague Sami told him, verbally and around two or three weeks ago, that they were to present exhibits in a Maltese court.
He says he finished his report on November 24, 2020, after he was told that he had to come to Malta.
Petrou is asked about his colleague Yulia [who handed over responsibility for extracting data from Fenech’s phone to Tataro].
He says that she is a seconding expert who works under the same leader but performs more logistical tasks to him.
“We have not worked together on this case,” he says.
Meanwhile, lawyer Gianluca Caruana Curran goes over to his client, pen and paper in hand.
Magistrate irked
3.04pm Mercieca presses Petrou about other reports which he drafted concerning the Caruana Galizia case.
The magistrate reminds the lawyer that the witness is not here to testify about other cases.
Mercieca argues that the defence did not know that Europol were coming – and that remark irritates the magistrate, who tells him that the claim is an “insult”.
“We thought they would be able to answer questions about everything,” Mercieca replies.
SIENA messages
2.59pm Mercieca says that there seem to have been a “considerable” number of SIENA messages.
Petrou says he does not know about that and is only aware of messages which concern him.
Any such messages are noted in his report, he tells the court.
Petrou's exhibits
2.52pm Charles Mercieca asks the witness about other exhibits he handled in relation with "this case".
[Petrou has also analysed exhibits related to the case against the three alleged hitmen in the murder].
The witness says he can speak about exhibits related to this case, not others.
Magistrate Montebello intervenes: the witness cannot be expected to testify about other exhibits he worked on previously in other cases, she tells the defence team.
2.49pm Petrou says he has been in Malta four times in total since 2017. He recalls coming to Malta in 2018 to deliver exhibits to the court.
The witness is asked about extractions. He says, as his colleagues have done, that some happened in Malta and others at The Hague. In some cases, extractions were done twice.
Liaising with Maltese authorities
2.39pm Petrou says that his colleague Sami Armoyneserved as a liaison with Maltese police.
He says that requests by his team went to Harmoinen.
Petrou confirms that he reported to inquiring magistrate Neville Camilleri last year, and that this time round all three experts travelled to Malta this past Sunday.
Arriving to Malta
2.35pm Petrou says the operation to Malta was confirmed on November 21, 2019. He is not sure whether the message is still saved within the SIENA system.
“It could be,” he says.
Petrou came to Malta on November 20. He explains that he was told to go to Malta before the arrangement was formally green-lit the day after he arrived here.
Petrou says he arrived late in the evening that day and was not present for site searches, although his colleague Sami was.
He packed equipment – computers, hard drives, USB sticks – with him, he says in response to questioning.
Malta's request for Europol help
2.28pm Petrou provides a bit more of his professional background – he worked with Greek police before joining Europol and is a senior specialist, investigator and examiner for digital exhibits – and then turns to the case at hand.
He says Europol’s weapons and explosives division had received a request for support, via SIENA message, from Malta’s Europol forensic unit.
Petrou on the witness stand
2.22pm Konstantinos Petrou takes the witness stand, report in hand. He is greeted by magistrate Montebello.
Petrou tells the court that he has been in law enforcement ever since graduating from high school, in 1996.
Totaro ends testimony
2.20pm Totaro is finally done testifying. He leaves the courtroom, to be replaced by his colleague Petrou.
Serial number error 'not a typo', says Mercieca
2.11pm Mercieca alleges that the mistake with the serial numbers was not a typo or slip or the pen.
“This was a conscious decision, taken internally,” he says.
Fenech’s defence team want the hard drives incorrectly mentioned in the report to be presented to court.
“What became of those hard drives?” Mercieca asks.
Totaro says that the full copy of the data is only available on the hard drives presented in court, but that he will find the drives mistakenly mentioned in the report and present them the next time he is in Malta.
SIM card detached
2.02pm Arnaud asks Totaro about his colleague Yulia, who he received Fenech’s phone from. Totaro says she is a colleague who is a specialist working at European cybercrime.
Arnaud hands the witness the evidence bag containing the phone. He notes that the exhibit also contains a SIM card. How were the exhibits when they were placed in the safe?
Totaro: The same as now, with the SIM card detached. The SIM was stuck to the back of the phone after being examined separately. The SIM was separate from the phone when I received it from Yulia.
Long slog
1.56pm It’s been a long slog for Totaro – he’s spent almost three hours on the witness stand, answering questions. But it’s not over yet for the forensic expert.
Prosecutor Keith Arnaud has some questions to ask.
Colleagues in Malta
1.53pm Totaro is asked who else from Europol travelled to Malta for this case in 2019.
He mentions his colleagues Torres and Sami, and says there was also another analyst from Europol who he did not interact with.
He says he cannot recall anyone else.
Mercieca says he will ask further questions of Totaro to a later stage.
Handling the phone
1.49pm Mercieca asks Totaro whether he handled Fenech’s phone at all before October 26 [when he was assigned the task of acquiring and extracting data on it].
Totaro says no.
[Reminder: last August, Fenech's wife had testified that she had found a missed call from her husband's phone number. The call was made on August 28 at 2.30pm. When she called back, the phone was not in a position to respond.]
Hard drives brought to court
1.43pm The hard drives requested by the magistrate have been brought to the courtroom, in two boxes.
Totaro confirms they are the hard drives mentioned in the report. It seems one of the serial numbers listed for one of the copies does not match.
Sitting paused
1.22pm Mercieca tells the court that they will suspend further cross-examination of Totaro for now and will continue once they’ve had a look at the data.
Arnaud says the prosecution would like the witness to clear up the mistake. The magistrate suspends the sitting until the hard drives are brought to court.
Totaro is asked to wait in the courtroom and not speak to anyone.
Sets of data
1.12pm Mercieca refers Totaro to a report and asks him to confirm that data sets presented to the court are the same as those referred to in the report. Totaro confirms that.
[Data retrieved from Fenech’s phone was stored in three sets of data, with two hard drives per set, and it appears there’s some misunderstanding about the numbering of exhibits].
Reports presented
1.02pm Mercieca asks the witness about a specific report, but inspector Kurt Zahra immediately springs up to object.
Zahra says the witness has not prepared that report and cannot answer questions about it.
Superintedent Keith Arnaud says that report was prepared by another of the experts, Torres.
Wrapping up work on the phone
12.57pm Mercieca again asks the witness about anyone else who might have worked on the phone.
Totaro reiterates that Sami Armoynehanded it to Yulia, who gave it to him.
“So those two could tell you what they did,” he says.
Totaro says he wrapped up the extraction and acquisition process on the phone on October 27 [2020].
The phone was then placed in a safe and he received it again before leaving for Malta.
Members of the digital forensics lab have access to the safe, he says in reply to a question by Mercieca.
The phone was placed in the safe in a bag which Totaro himself sealed, "when I finished examination on October 27/28 or 29," he says. "I don't remember the exact date".
It was sealed in a new bag just before it was brought to Malta.
A good look at the phone
12.53pm Defence lawyers hand the bagged exhibits back to the magistrate.
Totaro is asked to confirm that the phone is the same one he was assigned.
He looks at the bag, its code and the black phone inside, and confirms that it is.
Chain of custody
12.51pm Mercieca presses the witness for information which could indicate whether his colleague Yulia (or anyone else) also worked on the phone.
Totaro says that there is a delivery paper which moves from person to person together with the exhibit, but that he is not aware of any “log” or “digital stamp” [which Mercieca asked about].
Exhibits are always held at Europol and cannot leave HQ, he adds.
Phone analysed at Europol HQ
12.44pm Totaro says he received instructions about the phone on the morning of October 26 [2020] and received the device from Yulia at 4pm that day, at Europol offices.
The instruction from his head of unit was to take charge of the exhibit.
“You are now in charge. Take care of the examination of this exhibit,” he recalls his boss saying.
Totaro says his boss spoke to him verbally and also sent an email. Mercieca asks for that email to be presented.
Totaro says that while he occasionally works from home due to the COVID-19 pandemic, all work on the phone was done at Europol headquarters.
He spent around three days working on the phone, he adds.
Keeping phones charged
12.39pm Totaro explains that it is best practice to keep phone exhibits charged and switched on.
He says that he only knows of a single image made of the phone – the one he made himself.
He does not know whether Yulia made an image herself, as he did not ask and it was not relevant.
Flight mode, switched on
12.34pm Totaro is asked when he first opened Fenech’s phone.
“On the same day I received it,” he replies. “First I made sure the phone was isolated. It was in flight mode and switched on,” he adds.
Totaro says he was assigned the task by the head of Europol’s digital forensics lab.
Mercieca asks whether that was the first time work had been done on the phone.
Totaro reiterates that he received the phone from his colleague Yulia and was asked to do all the work on the phone. He says he cannot answer for Yulia's work.
Evidence bags brought to court
12.29pm The evidence bags which lawyer Charles Mercieca asked to be presented has been brought to court.
The bags are small, transparent bags with a coloured strip along the top of them. The exhibits are inside them.
They're handed to the defence team, who handle them at a table as the magistrate and prosecution watch closely.
Receiving and analysing the phones
12.25pm The phones were seized on November 20, 2019, Totaro says.
He is asked who seized them, and he says that he does not know.
“They were delivered to me by Yulia," Totaro says.
Totaro is asked whether the "most advanced technology" was used to examine the phones. He says Europol uses advanced equipment, for all phases of the examination.
Totaro is asked about software and equipment used, and cites FTK Imager.
"There are many, many others and no main ones," he says.
Arnaud objects - he says the question is not relevant. The magistrate disagrees.
Yorgen Fenech's phone
12.20pm Totaro is asked about exhibits which he worked on at The Hague.
He says he received exhibits there from a female colleague, Yulia Toma, on October 26, 2020, as there was an issue with her being assigned the role.
Mercieca reveals that this particular exhibit is Yorgen Fenech’s phone.
Totaro says his colleague was working on that exhibit, but something came up and he was asked to take over her work.
Totaro says he received two separate iPhones, both with their SIM cards detached, from his colleague.
Fetching an evidence bag
12.15pm Totaro is asked about the original packaging used for the exhibits. He says the bags were given to him by his colleague Sam and that he opened bags containing the exhibits which he processed.
Lawyer Charles Mercieca asks for one of the evidence bags to be physically presented in court.
“Just one would be enough,” he says.
The magistrate instructs a court deputy to fetch one of the bags. Mercieca continues with his questioning in the meantime.
After the analysis
12.10pm Exhibits were not photographed again after acquisition and extraction, he confirms under questioning.
Totaro says the exhibits he was responsible were resealed in their original packages and signed, inside the same room where the Europol team worked. Petrou and Torres were also present.
Some of the exhibits were resealed on November 22 [2019] while others were sealed at Europol.
Mercieca: Was Yorgen Fenech present??
Totaro: No, because it was only me and my colleagues in the room.
Mercieca: Who told you what to examine in Malta or The Hague?
Totaro: I decided, according to what I could do in Malta. Certain devices were
locked, so data could not be accessed. Other equipment was needed to extract that data, which I did not have in Malta.
Software used
12.04pm Totaro confirms that he used a software tool called UFED Physical Analyzer as part of the process.
Defining terminology
12.02pm Mercieca asks about the technical jargon used by the experts.
“Acquisition” is the forensic act of acquiring data inside a device, prior to its extraction.
“Extraction” is the process of extracting data from PDFs, recordings, messages and so on.
They’re two phases of the same forensic process, Totaro explains, and he performed both in this case.
Take a seat
11.59am Totaro asks for a seat – he’s recently had surgery, he explains. A chair is brought in and the witness can get some respite.
Further validation
11.56am Mercieca latches onto a disclaimer in the report, which states that there is a possibility of data having not been extracted.
Totaro says that’s a boilerplate disclaimer that applies to every digital forensic examination.
The report states that further validation may be carried out if the work done is validly challenged.
Totaro says there have been no requests for further validation work.
Testing equipment
11.52am Mercieca asks who tested the forensic equipment which the experts used.
Totaro says the equipment was tested in The Hague by himself.
Mercieca: When?
Totaro: I don’t recall the exact date, but equipment is tested before use. The tests show if the equipment can be used. Tests are done according to best practices, we don’t use [equipment] without testing.
The witness explains hash values, which are used to demonstrate that data has not been tampered with. He says hash values were calculated where possible. In some cases, it was not possible to do so.
Who seized the exhibits?
11.45am Mercieca asks who seized the exhibits.
Totaro says he cannot say, as he received them from his Europol colleague, Sami H.
He says he photographed the exhibits and physically examined them at a locked room he and his colleagues used which was given to them by the Malta Security Services.
Totaro says he was with Torres and Petrou throughout this time and that the procedure was not filmed.
Mercieca: "Was Mr [Yorgen] Fenech present?"
Totaro: No.
Mercieca asks the court for permission to remove his own mask. The court allows him to do so.
'Excuse my pronunciation'
11.42am Totaro reads from one of the messages. It’s about “explosions at Bidnija road”.
“Excuse my pronunciation,” the Italian Europol expert tells the court.
Mercieca asks Totaro to remove his mask, to allow him to be better understood.
The magistrate tells the lawyer that’s not his decision to make.
Totaro keeps his mask on.
ABCs
11.39am Mercieca asks the witness about the various requests listed in the report and rattles off a series of codes for each message.
The messages are all requests for particular tasks to be carried out, together with descriptions of the work that is required.
A jumble of numbers and letters echo across the courtroom as Mercieca and the witness refer to message codes.
Details about SIENA messages
11.34am Totaro says the first SIENA message related to this report was sent on November 21, 2019.
He’s not sure about the date of the second message, but says it reported background information, a description of the explosion that killed Caruana Galizia and details about Fenech’s luxury boat, the Gio.
Police search Fenech's boat the Gio on November 20, 2019, hours after his arrest. Photo: Jonathan BorgSIENA messaging
11.29am Totaro mentions SIENA messages, prompting Mercieca to ask him to explain that.
[SIENA, or Secure Information Exchange Network Application, is an information exchange platform used by Europol, Interpol, OLAF and other agencies as well as
EU member states to securely transmit sensitive data].
Totaro says not all police officers have access to the system and that he has access to one part of it, on account of his role at Europol.
Which magistrate?
11.24am Charles Mercieca wants to know more about the magistrate who appointed the team. Was it a male or female?
“Male,” Totaro says.
Mercieca: Who told you to report to that magistrate?
Totaro: My colleagues and I went to court to exhibit the exhibits.
Mercieca: Did you do so spontaneously?
Totaro: Petrou told us to go to court.
Totaro says they only went to the magistrate once. He kept the data with him on hard drives until delivering the exhibits, he adds.
Extraction was ongoing until last week
11.20am Totaro says he is still involved in this case. Mercieca asks when he finished extracting data.
"The last exhibit was finalised on November 26, 2020," he says. "The report was finalised one day later."
Working on the case
11.17am Charles Mercieca refers to a report Totaro filed as part of this case.
He asks the witness who nominated the four members of Totaro’s team. Totaro says he does not recall who it was, but that he knows he was asked to come to Malta on November 20 [of 2019].
Totaro is asked who he liases with in relation to this case. He says that it’s with the digital forensics team in The Hague [where Europol is headquartered].
Mercieca: And in Malta?
Totaro: I speak to my colleague Sami H. [we did not catch the surname], who in turn liases with Maltese police.
The witness says he works with the other two witnesses, Petrou and Torres. Mercieca mentions another name. Totaro says he knows him as a former Europol employee but does not know whether he’s involved in this case.
Giuseppe Totaro testifies
11.11am Totaro tells the court that he has a PhD in computer science and digital forensics and is a certified examiner. He worked at NASA in the US and also served as chief technology officer of an Italian law enforcement. [His LinkedIn profile lists that job as being with Italy’s Justice Ministry].
Totaro says he joined Europol in 2018 and was assigned to this case in 2019.
First witness takes the stand
11.06am After a bit of back-and-forth between the magistrate and lawyer Jason Azzopardi over the timing of when copies of the data will be available, the first witness is summoned.
It's Giuseppe Totaro.
Discussions over data
11am Lawyers and the court discuss the various copies of the data - they spent a good chunk of time on Monday trying to agree on how to share copies made by Europol.
Lawyer Charles Mercieca tells the court that the defence has not had time to go through the data.
Court in session
10.55am Magistrate Rachel Montebello is presiding and the day's court session can begin.
Lawyer Charles Mercieca tells the court the defence will continue its cross-examination of the witnesses.
Yorgen Fenech in court
10.40am We're still waiting for the court session to begin. The man in the dock, Yorgen Fenech, has been escorted into the courtroom.
The Caruana Galizia family's other lawyer, Therese Comodini Cachia, has also joined proceedings. So too has Fenech's third lawyer, Marion Camilleri.
Space is at a premium today - hall 9 is not the largest room in the Valletta law courts, with just one bench of seating running along either of its sides and three benches in its middle.
Lawyers take their place
10.28am Back to this case: the various parties in the case against Yorgen Fenech are taking their seats.
Jason Azzopardi is representing the Caruana Galizia family.
We’ve spotted two of Yorgen Fenech’s three lawyers – Gianluca Caruana Curran and Charles Mercieca – so far.
Superintendent Keith Arnaud and assistant attorney general Philip Galea Farrugia are also present.
Caruana Galizia inquiry also under way
10.25am It’s worth noting that a public inquiry into Caruana Galizia’s murder is also in session as you read this: the three-judge panel is hearing the testimony of the secretary of the commission against corruption.
We’ll have a report about that hearing available later today.
Candles at a makeshift memorial for Caruana Galizia, outside the Valletta law courts. Photo: Jonathan BorgKiller gets 30 years
10.17am This case has yet to begin, so we cast our eyes to a different courtroom: Jelle Rijpma, 23, has been sentenced to 30 years in prison for the murder of his ex-girlfriend, Shannon Mak.
Mak was found with her throat slashed outside her Santa Venera apartment in August 2018.
Rijpma had initially denied the murder charges but changed his plea to guilty in October.
Who are the three experts?
10.12am The court heard the testimony of three data extraction experts who work with Europol.
All three were in Malta for three days between November 20 - the day Yorgen Fenech was arrested - and November 23, 2019, and assigned the task of extracting data from seized devices.
They are:
1. Konstantinos Petrou, a Greek forensic analysis expert who said he has been working on the Caruana Galizia case from its early days in 2017.
2. Giuseppe Totaro, an Italian forensic lab specialist who has been with Europol since 2018.
3. Israel Bordillo Torres. Torres started working with the agency in 2017 and is also a court-appointed expert.
Who are the main players?
10am Let's take a look at the key figures in this complex case.
Yorgen Fenech: a business tycoon and heir to a family fortune, and the man in the dock: Fenech is accused of complicity in Daphne Caruana Galizia's murder;
Melvin Theuma: a taxi driver who worked for Fenech and who has testified that he served as a middleman between Fenech and the alleged hitmen;
Vince Muscat, Alfred Degiorgio, George Degiorgio: the alleged hitmen;
Keith Arnaud, Kurt Zahra: the lead police investigators and prosecutors;
Keith Schembri: a childhood friend of Fenech's and the chief of staff to Joseph Muscat when he was prime minister;
Lawrence Cutajar: the former police commissioner;
Kenneth Camilleri: a member of Joseph Muscat's security detail;
Johann Cremona: a business associate of Yorgen Fenech's.
Edwin Brincat (Il-Ġojja): a friend of Lawrence Cutajar and Melvin Theuma;
Rachel Montebello: the presiding magistrate;
Gianluca Caruana Curran, Marion Camilleri, Charles Mercieca: Yorgen Fenech's legal team;
Jason Azzopardi, Therese Comodini Cachia: lawyers appearing for the Caruana Galizia family.
Philip Galea Farrugia, Nadia Attard: representing the attorney general's office and assisting the prosecution.
What happened last time round?
9.57am The court was last in session two days ago, when three Europol experts presented copies of data they extracted from electronic devices linked to Fenech, as well as various reports about that data.
Defence lawyers asked one of those experts some questions under cross-examination, but put off the rest of their questioning to Wednesday - today's session.
Welcome
9.55am Good morning and welcome to this live blog. We're at hall nine of the Valletta law courts, where the compilation of evidence against Yorgen Fenech is due to continue.