Europol experts extracted four terabytes of data from devices seized in connection with Daphne Caruana Galizia murder suspect Yorgen Fenech, a court heard on Monday.
Experts from the EU law enforcement agency have spent months extracting and analysing data from the devices as part of what was dubbed 'Operation Blue Elephant'.
Fenech stands accused of complicity in the journalist's murder and is pleading not guilty.
On Monday, the court heard testimony of three data extraction experts at Europol. The court heard that:
- Europol experts were handed electronic ‘exhibits’ (from devices such as phones to SIM cards) seized from Fenech’s office, home and boat.
- Around 4 terabytes of data was extracted in total and Europol experts prepared three separate copies of the data to present to Maltese courts.
- A team of three men spent between November 20 and November 23, 2019 in Malta, working to extract data from the exhibits. They operated from a private office at Floriana police headquarters, using equipment they brought with them from overseas, and had the only key to the room.
- Two iPhones and two SIM cards needed additional work to extract data from and experts took these to The Hague with them. Devices which experts extracted data from while in Malta were not taken.
- Police seized 21 exhibits – all SIM cards – from Yorgen Fenech’s boat, Gio.
- Police found a Wifi security camera disguised as an air freshener in Fenech’s home, but there was no micro SD card in the camera, which therefore contained no data.
- A separate Europol team was tasked with analysing the extracted data.
Fenech's defence team insisted with the court that their copy of the data had to be made from Europol's original image, and could not be a copy of a copy.
As all sides argued about that request, the magistrate ruled that she would keep hold of all the data until copies were available for all parties.
The case continues on Wednesday, December 2 at 10am, when Fenech's defence team will continue to cross-examine witnesses.
As it happened
Case deferred to Wednesday
5.55pm The court calls it a day and defers the case to Wednesday at 10am, when the defence will continue cross-examining witnesses.
Yorgen Fenech is escorted through a back door and people begin to make their way out of the courtroom.
Banning publication of irrelevant data
5.50pm Charles Mercieca tells the court that given that the data concerns their client's private life and family, data not related to the charges he faces should be banned from publication.
The magistrate agrees and says that while testimony given in public may be published, the court has imposed a ban on the sharing of the data. Any breach of this order will be deemed as contempt of court and prosecuted as a criminal offence, she says.
Handing over a third copy
5.48pm Europol experts, who have been waiting patiently as lawyers and the court discussed the matter in Maltese, are asked to hand over the third copy of the data which they have with them.
They oblige, and hand it over to the magistrate.
The magistrate will hold on to all the data while the court-appointed expert prepares copies. When those copies are ready, each party will receive its data - with the defence promised one of the original copies.
Resolution, or not
5.38pm Magistrate Montebello seems to like this idea: she decrees that one of Europol’s copies is to be given to the defence team. Europol will present magistrate Neville Camilleri’s copy on Wednesday. And IT expert Alvin Cardona will prepare copies for parte civile lawyers.
“Your request has been met” the magistrate tells the defence...
... but there's another hitch.
Jason Azzopardi says the defence should get their copy of the data at the same time that other parties receive one. One party should not receive a copy before another, he argues.
Arnaud's compromise suggestion
5.34pm Keith Arnaud comes up with another suggestion: one of the two copies presented today can be given to the defence team. The other copy will be given to a local court-appointed expert, to make a copy for the parte civile team.
"Police can wait until January if necessary. We already have this data," he says.
'Why insist on Europol?'
5.27pm Jason Azzopardi insists there are IT experts in Malta who have the know-how to copy the data over and could have it done in days.
"Why insist on Europol and the delays that implies?" he asks.
'I'm not sure it can be done by Wednesday'
5.23pm The court asks the experts for another copy of the data.
"It's almost 4 terabytes of data," Petrou says, as he explains that they don't have the appropriate equipment with them in Malta.
"I'm not sure it can be finalised by Wednesday. We have another copy for another court [magistrate Neville Camilleri, who is leading the inquiry into Caruana Galizia's murder]."
Aranud asks whether they could submit that copy to this court instead.
Jason Azzopardi says all parties should receive a copy at the same time.
"Then you'll have to wait," the magistrate tells him.
Experts brought back to court
5.19pm Prosecutors look for a compromise solution. They suggest giving Europol experts a hard drive and asking them to make a copy while they are in Malta.
Fenech’s defence team says no. They want a copy directly from Europol.
“Are the experts still outside?” the magistrate asks.
They are, and they are summoned back in.
A copy of a copy
5.14pm The prosecution and defence discuss the best way of making copies of data presented.
The court says it will appoint an expert to make a copy of the copies.
But the defence team say they would like a copy directly from Europol's network storage.
They say they want it from the original source.
Defence suspends cross-examinations
5.11pm Fenech's defence team informs the court that it is suspending cross-examinations. They will continue on Wednesday.
Petrou steps off the stand.
Other devices
5.06pm Mercieca asks for information about specific devices, but is stopped by the magistrate.
The witness is not in a position to testify about other devices, she tells the lawyer.
Mercieca asks the witness for details about the devices he and his team used used to extract data. The witness mentions FTK Imager - a piece of software he mentioned earlier in his testimony.
A long case
5.02pm Petrou is asked how long he has been on this case.
He says 2017. "It's a long, long case," he says.
Mercieca asks Petrou whether he leads his team. Petrou says he does not.
“We work as a team. We work long hours. We see only each other from morning to night.”
Mercieca: So you and your colleagues have done extractions related to this case since 2017?
Petrou: Also other colleagues.
Petrou is asked for names, and lists around nine people.
Second Europol team
4.59pm Mercieca asks the witness about another Europol team, of data analysts, who worked on this case.
Petrou tells him that he does not know them all – “there are many people at Europol” – and that he does not remember their names.
“We had one room and they were working in another,” Petrou says.
Chain of custody
4.55pm Mercieca asks Petrou about his team and team leader and then asks the witness about a colleague named “Geert”.
Petrou says he knows the name but not the man’s surname. “Probably a colleague from explosives,” he says. “Exhibits were received from Maltese forensics by my colleague Sami. Sami delivered them to me”.
Petrou says Sami gave him four evidence bags of exhibits.
'Only for the court'
4.48pm Mercieca: Who else did you make copies of your report for?
Petrou: Only for the court.
Mercieca cross-examines Petrou
4.42pm Lawyer Charles Mercieca asks the first of the three witnesses, Petrou, to clarify how data was copied from devices.
The witness obliges and says data was first copied to network storage and then over to hard drives from there.
Mercieca: Who requested the two copies [of data]?
Petrou: "Maltese police, Mr Keith".
Mercieca: "Was it the only time [Keith] Arnaud contacted you about this investigation?"
Petrou: "What do you mean? We’ve been working on this for years."
Mercieca tells the court that Petrou was "looking at Arnaud before replying".
Cross-examination begins
4.40pm The recess is over and the court is back in session.
Defence lawyers will now cross-examine the three Europol witnesses.
While you wait...
4.29pm ... have a read of what businessman Silvio Debono said about Daphne Caruana Galizia and the 19 libel suits he filed against her, during his testimony in a public inquiry on Monday.
10-minute break
4.17pm Torres is done testifying – the defence can now cross-examine the day’s three witnesses.
Fenech’s lawyers ask the court for a brief, 10-minute recess before they do so, and say it will be difficult for them to wrap things up today.
“We’ve only just received these documents,” lawyer Charles Mercieca tells the court.
The magistrate agrees to the brief break and asks the witness to wait outside.
Monaco Telecom nano-SIM
4.08pm Jason Azzopardi asks the witness about a detail in his report concerning devices seized from Fenech’s cabin cruiser.
One of the SIM cards was a Monaco Telecom nano-SIM, smaller than the others. What is the use of such a SIM, the lawyer asks.
Charles Mercieca objects: the witness’ job was to extract data, not to offer opinions, he says.
Torres says the nano-SIM was new and confirms it had no signs of use.
A security camera without a memory card
4.03pm Torres’ third report concerns just one device – a Wifi security camera that contained no micro SD card and therefore had no data which experts could acquire.
21 seizures from Gio
4pm Torres runs through a list of 21 exhibits seized from Fenech’s boat, Gio. They are listed in the second report Torres has given the court.
Six were "fully acquired" through a PIN code. Others were PIN code protected. Six were brand new cards with no information and seven were just packs, without any card inside.
Five devices contained no data
3.55pm Five of the devices seized from level 3, Portomaso tower had no data, Torres says.
Devices received in a sealed box
3.52pm Torres provides a more thorough overview of exhibits handed to Europol.
He says they were given a sealed box containing a computer, two phones, USB devices and 17 DVDs. There was also a Bluetooth device used to connect a keyboard and mouse to a PC.
One of the phones - an iPhone - was in "system restore status" and was essentially like new.
The 17 DVDs were unused and empty.
Reiteration
3.50pm Torres reiterates what his colleagues testified – that the three of them were in Malta between November 20 and 23, 2019, and that during that time they worked from an office given to them by the MSS, using equipment they had flown over with them.
The devices analysed were given to them by a colleague, who received them from the Maltese police, Torres says.
Three reports presented
3.45pm Torres presents three separate reports to the court. As happened with previous witnesses, the court orders more copies of each of them.
Third witness testifies
3.43pm Totaro is done testifying, and the third Europol expert - Israel Bordillo Torres - is called to the stand.
Torres says he has been working at Europol since 2017 and was appointed a court expert in 2019.
A camera disguised as an air freshener
3.40pm Lawyer Jason Azzopardi asks the witness about one of the devices found inside the residence: a Wifi camera disguised as an air freshener.
No data was found on the camera.
'Where did you work from?'
3.37pm Arnaud: So back in November 2019, where did you work from?
Totaro: We worked at the Malta Security Service premises, in a locked room with my two colleagues. We had the room’s key and we worked using portable Europol equipment we brought with us from The Hague.
Police headquarters in Floriana. Photo: Jonathan Borg'Where are the devices now?'
3.29pm Arnaud asks where the devices Totaro analysed are.
The witness says the two iPhones and SIM cards which were analysed at The Hague are "here with me".
He clarifies that he received both in October 2020. Other devices had been left in Malta.
The SIM cards were kept detached at all times, Totaro says.
Device handover
3.25pm The witness confirms to Arnaud that he was not present onsite himself and that the devices were given to him by a colleague. He also presents papers documenting that handover process.
The paperwork includes mention of a device received at Europol headquarters on October 26, 2020 at 4pm.
Devices seized from residence
3.22pm Totaro now moves on to the second report he is presenting in court.
This report refers to exhibits found at a ‘residence’ [presumably Fenech’s home].
Totaro says he received five sealed evidence bags in total.
Phone reached Totaro in October
3.19pm Answering questions by Arnaud, Totaro says he received a phone on October 26, 2020. It was given to him by a colleague at Europol and was held at Europol’s digital forensics lab before that.
Phones and SIM cards taken to the Hague
3.13pm Totaro goes through his report, one page at a time.
He tells the court that three of the exhibits were given to the court in sealed bags. The two phones and two SIM cards were taken to [Europol HQ] in the Hague.
Totaro gives the court the unique numerical identifier, known as the IMEI, of each of the phones.
Two iPhones, two SIM cards
3.11pm Totaro says he handled two iPhones and two SIM cards.
Like his colleague Petrou, he arrived in Malta on November 20 and left on November 23.
Report focuses on Yorgen Fenech's luxury boat
3.06pm Totaro says one of the reports documents exhibits from Yorgen Fenech's cabin cruiser, Gio. [Fenech was arrested aboard the boat as he exited Portomaso marina]. There were seven exhibits in all, he says.
That report is 10 pages long, the witness says.
Totaro tells the court that he did not collect the exhibits first-hand. He received them from a Europol colleague.
Yorgen Fenech's cabin cruiser, Gio, at the Portomaso marina. Photo: Jonathan BorgGiuseppe Totaro testifies
3.03pm Giuseppe Totaro tells the court that he has been with Europol since 2018, where he works as a forensic lab specialist.
Totaro tells the court that he has two reports, and two copies of each report. The magistrate orders more copies to be made.
Defence prepares its questioning
3pm Defence lawyer Charles Mercieca says he has questions to ask all three experts jointly, as well as questions for each witness separately.
After some discussion, the court allows Petrou to step off the stand and summons his colleague, Giuseppe Totaro.
580GB of data
2.58pm There was close to 580GB of data for him to examine, Petrou says.
Apart from the laptop, he mentions a phone containing a micro SD card and a Chromecast [a device used to easily connect a phone or PC to a TV screen].
'Operation Blue Elephant'
2.54pm The case was dubbed 'Operation Blue Elephant', Petrou reveals, in reply to questions by lawyer Jason Azzopardi.
Taking devices overseas
2.50pm Arnaud shows the witness some documents.
“Tell us what you know about them,” he instructs Petrou.
The documents describe exhibits given to the court the day before Europol experts left Malta, Petrou says.
Petrou explains: it was impossible to extract certain data in Malta, so the experts took those devices taken abroad with them. There was other data which they managed to extract in Malta. In those cases, Europol left the devices here and only took images of that data away with them.
Europol's room at police HQ
2.47pm Europol experts arrived in Malta on November 20, 2019 and left on November 23, Petrou says.
They worked from a room at police headquarters which was assigned to them, together with the room’s keys.
Exhibit no 1: a laptop
2.39pm The first exhibit was a laptop, Petrou says.
“Shall I continue with all [of them]?” he asks.
“No,” Arnaud replies.
Petrou says the first step was to make a forensic copy of all the data on the laptop. He would then work to extract data from that copy, "to avoid using the exhibit over and over again," he explains.
Petrou provides details about the software he used and tells the court that the data can be read using a free software tool called FTK Imager.
Four exhibits in total
2.32pm Petrou says exhibits – there were four in total - were seized on November 20, 2019 from the office of the Tumas Group chairman, a meeting room and secretary’s office. All were taken from Portomaso in St Julian’s.
A Europol colleague was present during the searches, Petrou says.
The witness says they were delivered to Europol the following day, November 21, at 8.40am.
Petrou also presents submission forms by Maltese authorities and proof that the exhibits were delivered to a Maltese court. That happened on November 22.
Making a copy
2.28pm Petrou's two colleagues wait outside the courtroom, as he answers questions about the report.
Fenech's lawyer Charles Mercieca again insists on getting a copy of the report. The magistrate asks for some patience.
"The court cannot step down and make a copy. It is waiting for a copy to be done," he is told.
Arnaud on report
2.25pm Arnaud tells the court that the hard drives contain the extracted data, while the report delves into the way experts extracted the data.
He tells the court that each of the Europol witnesses handled separate devices seized as part of the investigation.
Question for two colleagues
2.23pm Magistrate Montebello asks Petrou's two colleagues whether they swear that they extracted data to the best of their abilities. They do.
Defence wants a copy of the Europol report
2.21pm Yorgen Fenech's lawyer Charles Mercieca stands up and tells the court the defence would like a copy of the Europol report. The magistrate says they will get one.
Extracting the data
2.16pm Petrou says the experts stored data on hard drives and also made copies of it. He pulls out two hard drives, each containing identical data. He says he also has a copy for the magistrate.
Petrou says he and his two colleagues were responsible for making copies of the extracted data.
Petrou testifies
2.13pm Answering questions by superintendent Arnaud, Petrou tells the court that he was appointed as a forensic examiner in this case in November 2019. His job was to support Maltese authorities to analyse seized devices concerning Yorgen Fenech.
Petrou tells the court he is specialised in forensic analysis.
All the devices were in Malta and they were assigned to Europol in a locked room.
"Only we had access to that room," he says.
Who are the experts?
2.12pm The first is a Greek man named Konstantinos Petrou.
The second is a Spanish man, Israel Bordillo Torres. The third is an Italian, Giuseppe Totaro.
Petrou will be the first to testify.
Three experts worked on data
2.08pm Superintendent Arnaud tells the court that a Europol expert will be presenting a hard drive which contains data extracted from various devices.
Three data analysts worked together on extracting and analysing the data, he says, with others involved in drafting a report on it.
Three men enter the courtroom. Two of them have backpacks.
Court session begins
2.04pm Magistrate Rachel Montebello takes her place and Monday's court session can begin.
It's been a busy morning for the magistrate. She was hearing other cases in a different courtroom before this one.
Silvio Debono.Silvio Debono's testimony
1.56pm A quick glance to hall 22, where Silvio Debono is testifying in the Caruana Galizia public inquiry.
The businessman has testified that:
- he generally donated €5,000 to the Labour Party and between €6,000 and €8,000 to the Nationalist Party every year.
- he had hired Daphne Caruana Galizia as a consultant back in 2012.
- he was willing to "reach a compromise" with the Caruana Galizia family over the 19 libel cases he filed against her.
Debono's testimony is ongoing.
In deep conversation
1.42pm The hearing has yet to begin. Yorgen Fenech confers with his defence team as they wait for proceedings to get under way.
Meanwhile, superintendent Keith Arnaud and inspector Kurt Zahra have taken their place at the prosecution's desk, alongside Philip Galea Farrugia.
Who's in court?
1.30pm The doors to hall 22 have now been opened, and the courtroom begins to fill up.
Yorgen Fenech is present, surrounded by five armed guards. His lawyers are here too, as are some of his family members.
Lawyer Jason Azzopardi is here, representing the Caruana Galizia family. His colleague Therese Comodini Cachia is not: she is in hall 20, representing the family in today's public inquiry session.
Assistant attorney general Philip Galea Farrugia walks in and takes his place at the prosecution's desk.
Daphne Caruana Galizia's husband, Peter, and one of her sons, Paul, are in court.
Peter Caruana Galizia and his son Paul attend a rally in October 2019 marking two years since Daphne's murder. Photo: Matthew MirabelliMeanwhile, elsewhere in the law courts...
1.25pm ... business tycoon Silvio Debono, of DB Group fame, is testifying in a public inquiry into Daphne Caruana Galizia's murder.
Debono is notorious for having filed 19 separate libel suits against the journalist in March 2017 after she alleged that the tycoon's business group had been handed public land at a price below market value.
We will have a full report of proceedings in the inquiry once that's over.
What to expect today
1.20pm It is the first time Europol analysts will be testifying in this case.
That means they will first have to present the data and will then most likely have to answer any questions lawyers might have about procedural issues about it - such as how the devices were seized and what processes they used to analyse the data.
Who are the main players?
1.10pm
Yorgen Fenech: a business tycoon and heir to a family fortune, and the man in the dock: Fenech is accused of complicity in Daphne Caruana Galizia's murder;
Melvin Theuma: a taxi driver who worked for Fenech and who has testified that he served as a middleman between Fenech and the alleged hitmen;
Vince Muscat, Alfred Degiorgio, George Degiorgio: the alleged hitmen;
Keith Arnaud, Kurt Zahra: the lead police investigators and prosecutors;
Keith Schembri: a childhood friend of Fenech's and the chief of staff to Joseph Muscat when he was prime minister;
Lawrence Cutajar: the former police commissioner;
Kenneth Camilleri: a member of Joseph Muscat's security detail;
Johann Cremona: a business associate of Yorgen Fenech's.
Edwin Brincat (Il-Ġojja): a friend of Lawrence Cutajar and Melvin Theuma;
Rachel Montebello: the presiding magistrate;
Gianluca Caruana Curran, Marion Camilleri, Charles Mercieca: Yorgen Fenech's legal team;
Jason Azzopardi, Therese Comodini Cachia: lawyers appearing for the Caruana Galizia family.
Philip Galea Farrugia, Nadia Attard: representing the attorney general's office and assisting the prosecution.
Change of scene
1.05pm The case was set to be heard in hall 9 of the Valletta law courts - Yorgen Fenech had even been whisked into the room under tight security - but there's been a change of plans.
The case will now be held upstairs, in hall 22. The hall is still closed for the time being.
Police escort Yorgen Fenech to court on Monday. Photo: Chris Sant FournierOpen court
1pm Last week, the court heard testimony from inspector Keith Arnaud, who testified about an interrogation of Fenech which took place late last year.
We do not know what Arnaud said, though, as the court ruled that Arnaud should testify about the interrogation behind closed doors. Will today's session be public?
Welcome
12.55pm Good afternoon and welcome to this live blog. It's a big day in the compilation of evidence against Yorgen Fenech: after months of work, Europol analysts are ready to testify about emails, photos, text messages and other data they found on devices linked to the murder suspect.