The Malta Independent 19 April 2024, Friday
View E-Paper

Four terabytes of data presented in Fenech compilation of evidence, but kept under wraps for today

Monday, 30 November 2020, 12:52 Last update: about 4 years ago

Four terabytes of data were extracted from electronic devices belonging to Yorgen Fenech by Europol experts, the court heard today.

The data was extracted from mobile phones, laptops, SIM cards and other devices lifted from the Portomaso business tower and Fenech's yacht, the Gio.

During the nearly five-hour sitting the court heard how one of the devices analysed by the experts was a wifi camera disguised as an air freshener, which had no data on it. Investigators also found new SIM cards belonging to Monaco Telecom.

One SIM card was a nano-SIM and had no signs of use.

Three Europol experts - Konstantinos Petru, a Spaniard by the name of Israel Bordillo Torres, and an Italian named Giuseppe Totaro - testified in the compilation of evidence against Fenech, who stands accused of masterminding the murder of journalist Daphne Caruana Galizia.

Two of the phones found and two SIM cards were taken to Europol's headquarters in the Hague in Belgium for analysis.  Totaro said that he had received both of these in October 2020, while other devices were left in Malta.

They presented hard drives and reports with their findings and testified about the work they did to extract the information, an operation code named Blue Elephant.

However, the content of the data remained under wraps for today.

The court heard how Europol experts were divided into two teams - one carrying out the data extraction, and another analysing the content.

The team worked at the Malta Security Service premises, in a locked room, they keys of which only they had. They worked using portable Europol equipment we brought with us from The Hague.

A court-appointed expert will be making copies of the four terabytes of data presented in court, with these copies then being presented to the defence and to the parte-civile.

The court ruled that the parties cannot publish any parts of the data and warned it would be a prosecutable offence if they shared the contents with third parties.

During the previous sitting, the chief investigator in the Caruana Galizia murder case, Superintendent Keith Arnaud, had testified behind closed doors in relation to a pardon request by Fenech.

A number of testimonies have been heard in the compilation of evidence against Fenech, which has now been ongoing for just over a year, with more and more details pertaining to the case emerging as the weeks go by.

The evidence against Fenech primarily rests on the testimony of Melvin Theuma, the middleman in the murder. Theuma, who had secretly recorded various conversations between himself, Fenech and others, was given a presidential pardon to tell all last year.

Theuma attempted to commit suicide last summer and has yet to testify since, with The Malta Independent reporting earlier in November that he had still not fully recovered.

Magistrate Rachel Montebello is hearing the compilation of evidence against Fenech.

The defence lawyers are Marion Camilleri, Gianluca Caruana Curran and Charles Mercieca.

The prosecution is being led by Superintendent Keith Arnaud and Inspector Kurt Zahra, assisted by the Attorney General.

Lawyers Jason Azzopardi and Therese Comodini Cachia are appearing parte civile for the Caruana Galizia family.

The case continues on Wednesday at 10am 

Follow proceedings live, below:

17:55 That's it for today. Thank you for following.

17:55 The case continues on Wednesday at 10am.

17:54 The court says it prohibits the parties from publishing any of the contents of the hard drives, aside from the information which emerges in open court. It also prohibits the parties from giving this information to third parties unless required by a criminal investigation. Failure to do so would be a prosecutable offence, the magistrate decrees.

17:51 Mercieca says that in view of the fact that the data could contain information unrelated to the charges and about the private life of Fenech he is asking for a ban on the publication of the data. "Without doubt," says the court, adding it was going to order it anyway.

17:42 The Europol experts are called back in to exhibit their third copy.

17:41 As the debate continues on what to do with copies of the hard drives, the magistrate appears frustrated: "These are problems created all the time, for everything... The court tries to accommodate everyone but there are limits."

17:38 Court expert Alvin Cardona is appointed to make copies of the drives and exhibit them later.

17:36 A further copy will be made and be given to the inquiring magistrate at a later date.

17:34 The court orders that the third copy of the Europol exhibits handed in today be handed to the defence. This was meant to be given to the inquiring magistrate.

17:32 The court notes that the prosecution request the appointment of an expert to make a copy of the data on the hard drives and the defence's objection to this request. The parte civile submits that it needn't be a Europol expert to make the copies but that a Maltese expert could do this in a couple of days without having to fly to The Hague and back with all the expenses and time this involves. The AG agrees. The court appears to have heard enough.

17:23 Azzopardi: "We don't need Europol to make a copy of a hard drive, a Maltese expert can be appointed to do this."

17:23 The experts have a spare copy to be exhibited in the inquiry, but this would still not be enough.

17:21 "It is four terabytes of data," says Petrou. "It could take till past Wednesday," he explains.

17:20 The court calls in the witnesses in again. It asks them to make another three copies of the information they exhibited today.

17:18 Arnaud suggests that the court could order the purchase of hard drives and the experts could work on them and provide copies tomorrow, to avoid delay.

17:17 The defence says that previous copies of data had been problematic.

17:16 Azzopardi: "Why is the defence playing for time?"

17:16 The defence are asking for copies of the extractions but insist the copies should not be "a copy of a copy". They want the extraction to happen afresh. "This will cause long delays," Deputy AG Philip Galea Farrugia says, arguing that the copies were made from data extracted. "The court can distribute copies of it at will," he says.

17:12 It's been a long few hours and everyone in the courtroom is hungry. The court tells Mercieca off for eating in court, saying "it's very bad manners".

17:12 Arnaud asks the court to appoint someone to make copies of the drives for the parties.

17:11 The cross-examination is suspended. At the suggestion of the defence the cross-examination will continue on Wednesday.

17:11 Mercieca asks the witness what software was used to create images of the devices and hard drives. "FTK imager and others," he replies.

17:06 He is asked about other devices involved in other cases. The court reforms the question but the witness says he had not been asked to prepare for this.

17:05 Petrou: "The documentation contains this information but I wasn't managing the case."

17:04 Mercieca: "Which ones took part in the investigation?"

17:03 Asked who is on the digital forensic team, the witness rattles off a list of names.

17:02 The lawyer probes the witness on whether he was the team leader, but the witness says he wasn't.

17:02 Petrou: "Yes."

17:01 Mercieca says that Europol's structure was "broadly teams that extract data and others that analyse it".

17:01 He offers to check his email to confirm the names of the people.

17:00 Petrou: "I don't remember how many, I'm sorry... They were working in another room."

16:59 Mercieca: "Do you remember how many they were?"

16:59 The expert says he cannot recall their names as he worked with them last year in Malta. "Europol is a big organisation. Our job was to extract data and their job was to analyse data," Petrou explains.

16:56 Mercieca: "Are you aware of any other Europol personnel who worked with you?"

16:55 Petrou says he had no contact with the person indicated by the lawyer, explaining that he got the exhibits from his team leader, a certain Sami.

16:54 Mercieca asks if a Gerth Duwee works with the team. Petrous says he is not familiar with the name. "He might be a colleague with AP weapons and explosives," he says.

16:53 The witness says he worked as part of a team with his team leader, who was not in Malta. He clarifies that his team is the other two experts and the team leader.

16:48 Petrous: "No. The only hard copy was made for the court. The other is at Europol."

16:48 Mercieca asks the witness whether he had passed on a copy of the report to anyone else.

16:47 Mercieca asks Petrous who asked him to extract the data. "Keith Arnaud," says the witness. Mercieca asks whether Petrous had spoken to Arnaud before. "We have been working on this case for several years," replies the witness.

16:46 Yorgen Fenech says something to Mercieca.

16:46 The witnesses explain that they have a network storage system... The initial extraction was done individually and then placed on the network. From there it went to the hard drives.

16:43 Defence lawyer Charles Mercieca asks the experts whether the information they testified about is contained in these hard drives.

16:42 The court is back in session. The three experts are called back into the courtroom for cross-examination.

16:36 The court has taken a short break.

16:18 Torres is presenting documents relating to the delivery of exhibits and the chain of custody. The court asks the witness to wait outside while the defence prepares its cross-examination.

16:14 Lawyer Charles Mercieca asks for more time before cross-examining the witnesses as he has not been given time to digest the reports that have been presented.

16:13 A nano-SIM card is intended to provide phone service, communication and data to a device, says the expert. The pack is the format in which a SIM card is sold. The cards were still new, confirms the expert.

16:09 Azzopardi asks the expert to explain what a nano-SIM card is used in. Defence lawyer Charles Mercieca objects but the court rules that the witness is qualified to answer the question.

16:08 Lawyer Jason Azzopardi begins his questioning. He asks about the devices listed. He asks the expert his opinion on two SIM cards of Monaco Telecom and three SIM card packs of Monaco Telecom. The expert says they are SIM cards for ISP and service provider services for the phone.

16:04 The last report is regarding a single device seized at Portomaso. This was a Wifi camera which had one MicroSD slot but no card was placed inside.

15:58 The expert says he examined 21 devices that were recovered from the yacht Gio.

15:53 Torres says the iPhone was in a "system restored status" and didn't contain any personal information. No extraction was made of this device, he explains.

15:52 Torres is speaking about the devices he analysed: a PC, an iPhone, three USB devices and an envelope containing 17 DVDs.

15:50 He confirms the security setup and the locked room in which the devices were kept. "We only worked in this room. The exhibits I was working on were only in this room after being delivered by my colleague," Torres says.

15:46 The next witness Israel Torres takes the stand. He was appointed as court expert in this case in 2019. His task was to support the Maltese authorities in the extraction of data from Yorgen Fenech's devices.

15:41 The court has ordered a ban on the address mentioned previously from where devices were elevated at the request of the defence.

15:39 Azzopardi: "One of the items recovered was a Wifi Air Freshener camera DVR. Am I to understand it was a spy camera?"

15:37 Lawyer Jason Azzopardi asks the expert about the devices found in a residence.

15:22 The going is tedious. Lots of document identifiers and numbers are being exchanged.

15:18 Arnaud asks for the IMEI numbers of the phones. They are read out in court.

15:13 He will exhibit two iPhones and 2 SIM cards which he examined.

15:09 Totaro starts to go through the report, page by page.

15:08 Totaro says he arrived in Malta on 20 November 2019, and received the devices the next day. The other senior Europol officer was on site when the devices were seized, he adds.

15:08 The questioning is taking some time due to the language barrier.

15:06 The report he presents, documents the process he carried out with regards to the exhibits recovered from the cabin cruiser Ghio, which belongs to the accused.

15:05 The second Europol expert, Giuseppe Totaro takes the stand. He's a specialist forensic examiner at the digital forensics lab at Europol.

15:01 Lawyer Charles Mercieca says the defence wants to cross examine the three experts together first, and so will cross examine Petrou individually later.

15:00 Azzopardi asks who assigned the Blue Elephant terminology to the operation. "We assigned it in the lab," Petrou says.

14:59 A microSD card and a Chromecast player were also examined by the experts, it emerges.

14:59 Azzopardi asks what type of data was extracted. Witness says he wasn't analysing the data.

14:54 Petrou says that over 580Gb of data were examined.

14:54 Jason Azzopardi, for the parte civile, stands to ask questions to Petrou. He asks him what Operation Blue Elephant was about. The name was assigned by AP Weapons and Explosives group, says the witness.

14:51 His colleagues will be presenting some other exhibits, digital copies of which had been examined abroad, Petrou says.

14:48 Petrou says he arrived in Malta on 20 November and left on the 23rd. He had carried out his work at "police premises". The room allocated to them was locked and only they had the key, he says.

14:47 The witness is Konstantinos Petrou, an official from Europol. He is one of three experts testifying about the data analysis they performed on devices confiscated by the police from Yorgen Fenech.

14:46 A digital video recorder was also among the devices examined. More software is required to see it. The report submitted by the Europol expert also contains recommendations. It is not clear what the recommendations refer to without seeing the report.

14:45 The witness is now explaining the methodology used to extract the data. The exhibits include a laptop. He asks whether he is supposed to read the list of all the devices examined, but is told this is not necessary. Specific software is needed to see the drive images, he says. The software is freeware.

14:32 Petru says he examined exhibits taken from the director's room and other offices at level 21. The four exhibits he examined had been handed to him when he arrived in Malta, he says. He also exhibits the submission forms which had been presented with the exhibits.

14:30 Arnaud asks Petru to guide them through his report. Mercieca says he expects a copy first. The court says it is waiting for its messenger to make copies. "As you can see the court isn't very well equipped in this case," the magistrate says.

14:29 The defence says that the questions will be about the extraction. Arnaud says the hard drives contain the raw data as it was saved, but the extraction would be explained through his examination in chief. The court wants the witnesses to testify together but Arnaud says that the experts examined different devices. The court says the questions will be heard after the examination in chief is finished.

14:23 Mercieca wants to cross-examine the witness but Arnaud says that the examination in chief is not finished yet.

14:23 The other two experts swear to the court that they performed the extraction to the best of their ability.

14:23 Each expert has prepared a report based on the exhibits they examined. Mercieca says the defence would like a copy of the report too. "No doubt," replies the magistrate.

14:22 The reason is that the police would make copies for the parties, Arnaud says. "We'll see about that," says the magistrate.

14:22 He says the hard drives contain the data extracted by him and his colleagues. It contains images of the data extracted. Lawyer Charles Mercieca asks if there is a copy for the defence. Arnaud says no and will explain why shortly, he adds.

14:21 Petru says he examined exhibits seized form Level 21 at Portomaso business tower from various offices there. He had been assigned a room in Malta to perform the extraction, to which only the experts had the key. The extractions have been stored on hard drives and copies of the data were brought by the experts. Asked where the hard drives were, he reaches into his satchel and brings out two boxes, containing the devices. A third copy was given to the inquiring magistrate, he adds.

14:14 They are administered the oath. Petru presents the report. He explains that he was appointed as a forensic examiner in order to support the Maltese authorities on exhibits seized from every property belonging to Fenech. He works with Europol as a senior specialist forensic examiner.

14:10 Amusingly, Greek witness Konstantinos Petrou is asked to write his name, father's name and place of birth to avoid having to dictate it to the court. He is the first Europol expert.  Israel Torres from Spain is the second, while Giuseppe Totaro from Italy is the third.

14:09 Magistrate Rachel Montebello enters the court, which is now in session. Arnaud tells the court that Europol experts will testify. He explains that three experts will testify to explain how the data was extracted and analysed, and about their report.

13:59 Lawyer Charles Mercieca paces back and forth as Yorgen Fenech and Gianluca Caruana Curran talk and look over their shoulders every few seconds. The court messenger wheels the acts of the case into the courtroom in a large suitcase.

13:49 Superintendent Keith Arnaud and Inspector Kurt Zahra enter the courtroom.

13:43 The courtroom is silent as we wait for Magistrate Rachel Montebello to emerge from chambers.

13:33 Deputy Attorney General Philip Galea Farrugia walks into the courtroom and joins lawyer Jason Azzopardi, who was previously speaking with Paul Caruana Galizia, on the bench used by the prosecution.

13:32 Fenech is led into the courtroom and takes his seat in the dock. He is discussing something with his lawyers Gianluca Caruana Curran and Charles Mercieca. The other defence lawyer, Marion Camilleri sits nearby, on the defence bench.

13:28 QUICK REMINDER: Yorgen Fenech is charged with masterminding the murder of Daphne Caruana Galizia. He was arrested and arraigned in November last year. The compilation of evidence against him is ongoing. Fenech is represented by lawyers Gianluca Caruana Curran, Charles Mercieca and Marion Camilleri. The prosecution is led by Superintendent Keith Arnaud and Deputy Attorney General Philip Galea Farrugia. Lawyers Jason Azzopardi and Therese Comodini Cachia are appearing as parte civile for the Caruana Galizia family. Magistrate Rachel Montebello is presiding.

13:23 The doors to Hall 22 have opened and people are settling in.

13:22 In today's sitting we are expecting experts from Europol to submit the data extracted from Yorgen Fenech's electronic devices. The data was extracted by Europol and analysed by Maltese police together with Europol officials.

13:17 We have changed courtroom. The activity has now shifted to the criminal court, Hall 22.

13:11 While we wait, you can get a quick refresher of the last sitting - where lead investigator Keith Arnaud mainly testified behind closed doors - here.

12:58 Another sitting is still underway and so he is led out again.

12:56 Yorgen Fenech is led into the courtroom flanked by three guards.

12:50 Good Afternoon and thank you for joining us.  The session is expected to begin at around 1pm. 

  • don't miss