The Malta Independent 23 January 2021, Saturday

Europol experts cross-examined in Yorgen Fenech compilation of evidence

Wednesday, 2 December 2020, 10:17 Last update: about 3 months ago

Two Europol officials were cross-examined by Yorgen Fenech's defence team in a sitting that focussed on procedural measures adopted by the foreign experts in extracting data from electronic devices.

The cross-examination came two days after the Europol experts submitted in court hard drives containing four terabytes of data extracted from various electronic devices confiscated by the police in November 2019.


Fenech's compilation of evidence is expected to continue on 12 January. He stands accused of masterminding the murder of Daphne Caruana Galizia.

The data was extracted from mobile phones, laptops, SIM cards and other devices lifted from the Portomaso business tower and Fenech’s yacht, the Gio when he was arrested in November 2019. A team from Europol had come to Malta and granted sole access to a room at the Malta Security Service quarters from where they worked to extract data from the devices.

Today's cross-examination revealed nothing new and so far, the contents lifted from the devices remain under wraps with the court warning all parties not to share the information with third parties unrelated to the case.

The evidence against Fenech primarily rests on the testimony of Melvin Theuma, the middleman in the murder. Theuma, who had secretly recorded various conversations between himself, Fenech and others, was given a presidential pardon to tell all last year.

Magistrate Rachel Montebello is hearing the compilation of evidence against Fenech.

The defence lawyers are Marion Camilleri, Gianluca Caruana Curran and Charles Mercieca.

The prosecution is being led by Superintendent Keith Arnaud and Inspector Kurt Zahra, assisted by the Attorney General.


Lawyers Jason Azzopardi and Therese Comodini Cachia are appearing parte civile for the Caruana Galizia family.

You can follow proceedings live, below:

15:58 The next sitting is on 12 January at 10am.

15:54 A bail decree was not received by the parties, despite being in the system. Bail appears to have been rejected as the accused is still in custody.

15:48 The court and parties are thrashing out the next procedural steps.

15:47 "That's all," Zahra says.

15:47 The witness replies in the negative.

15:47 The witness is shown exhibit delivery papers. Were there other exhibits he gave to the inquiring magistrate?

15:46 Meanwhile, Inspector Zahra is to ask a few questions.

15:46 Mercieca says the witness' deposition is suspended to avoid a repeat of what happened with the Schembri testimony, where the defence says, it was deprived of an opportunity for cross-examination. The court upholds the request and allows the prosecution to continue its questioning next time.

15:38 Mercieca is arguing that the data is not isolated, while the witness is insisting it is.

15:37 Petrou: "It is password protected and protected by log-on credentials."

15:37 Mercieca: "How is access granted?"

15:37 Petrou: "I will check."

15:37 Mercieca: "Who has access to the data from your team with regards to this case?"

15:27 Mercieca asks the witness to prepare the SIENA messages and a list of all the exhibits he has worked on concerning the explosion in Bidnija for the next time he is summoned. Also, the list of magistrates he has spoken to about the case.

15:25 The court says that today's sitting was about a different task for which the witness was appointed, not the one two years before.

15:22 Mercieca says the defence is finding difficulty in accessing evidence submitted by Petrou in other parts of the investigation.

15:22 An issue on whether the questioning is relevant emerges. Lawyers Marion Camilleri and Gianluca Caruana Curran say the recordings of Melvin Theuma are an integral part of these proceedings. Magistrate Montebello says that for Melvin Theuma, the inquiry is separate and the process verbal is not part of these acts.

15:10 Petrou: "I don't recall. I can't remember."

15:10 Mercieca: "Did you extract any information from exhibits relating to Melvin Theuma?"

15:10 But the witness says he had not worked with her on this case.

15:09 Questions turn to Yulia. "She is a seconded national expert," Petrou says. "We are on the same level, under the team leader."

15:08 Lawyer Gianluca Caruana Curran sits down next to the accused and exchanges some words with him.

15:08 "Sami and I are in the same team. Normally, we don't send SIENA messages in the same team," Petrou says in response to a question as to why the information was transmitted verbally.

15:07 The Europol expert says he was told about the sitting about two weeks ago. The information was given verbally, he says.

15:06 The magistrate notes that the cross-examination is on the examination in chief.

15:06 The court has had enough of Mercieca, who says the defence didn't know if Europol was going to testify. "Come on, come on. This is an insult. The defence has known for a long time that the Europol experts were coming," says the magistrate. She stops him from trying to extract information from the witness.

15:05 Petrou: "I do not remember because I was not asked to prepare for this."

15:04 Mercieca: "Did you receive a SIENA message relating to the case in 2017?"

15:03 The lawyer now asks about the SIENA messages. "I receive only the messages pertinent to my job," says the witness.

15:03 Petrou says that from 2019 he gave his report. Before that, he doesn't remember. The court points out that the man had not been asked to prepare for things which he didn't testify about himself. "If anything, summon the witness as a witness for the defence," the magistrate says.

15:01 Mercieca: "With regards to this case what other exhibits did you examine from 2017 today?"

15:00 Mercieca asks if the Europol team had presented anything before Magistrate Neville Camilleri, who is leading the inquiry into the murder of Daphne Caruana Galizia. "No," Petrou replies.

14:50 Petrou: "I am not aware if my colleagues reported to another court."

14:49 Mercieca: "Are you aware if your colleagues reported to another court?"

14:42 Petrou: "This one."

14:42 Mercieca: "How many courts did you report to?"

14:41 Petrou says that no one else from Europol arrived with him on the 29th.

14:40 Petrou: "To this court... If I'm not mistaken it was with Mr Camilleri."

14:40 Mercieca: "Who did you report to with regards to courts?"

14:37 Petrou says Sami and he joined Europol on the same day... Sami was nominated as single point of contact with the Maltese authorities.

14:36 Mercieca asks how he knew what to bring with him to Malta. "I've been doing this job for 17 years... I know what will be needed," he replies.

14:35 Before the SIENA message was received on 21 November, he was informed informally of the request for assistance. Petrou arrived on the 20th late in the evening in 2019. "I wasn't even present for the house searches, in fact," he says.

14:31 Witness doesn't know if the SIENA messages are still in the system. It is not his area of expertise.

14:28 AP weapons and explosives received the Maltese request for assistance. IT was later assigned to his team, he says.

14:27 He started working with Europol in 2013. Petrou is a senior specialist, forensic examiner and investigator. "My job is to perform forensic actions on digital exhibits," he says.

14:22 Petrou has been in law enforcement since 1996. He joined straight out of high school, he says.

14:21 Europol expert Constantinos Petrou is called to the stand next. He also testified in last Monday's sitting.

14:21 Totaro's cross-examination is over. He leaves the courtroom.

14:20 Totaro's deposition continues, with him confirming the corrections which he has just made. Mercieca's cross-examination of Totaro continues. He asks who provided the exhibits.

14:19 While the court is dictating a note to the registrar, Fenech stands up and huddles with his lawyers. "Don't forget," are his closing words.

14:19 The request is granted and Inspector Zahra takes over.

14:15 Arnaud asks for permission to leave the hall as he is required elsewhere. The defence pretends to object, in jest.

14:14 Arnaud suggests that the witness correct the report today and sign. Defence says he should present an updated report. Court says expediency requires otherwise. Mercieca insists that the mislabelling of the hard drive "doesn't appear to be a lapsus calami" but a conscious decision by the Europol team. The defence lawyer is requesting that the hard drives having the serial numbers indicated in the report are presented in court. Meanwhile, Totaro is correcting his report.

14:05 More document serial numbers and corresponding exhibits are read out.

14:04 Totaro: "When I finished the extraction. It is in the log of the hard drive."

14:03 Arnaud: "Do you know the date when you put the exhibit safe?"

14:03 Totaro: "In the same condition it is now. It was always separated from the iPhone."

14:03 Arnaud: "With regards to the exhibits, can you tell us the condition of the SIM card when it was received and when it was placed inside the safe at Europol?"

14:02 More questions about the chain of custody follow.

14:01 Arnaud: "The witness is the provider."

14:01 The court points out that the report also states that it cannot be used in judicial proceedings without the permission of the provider.

14:00 The prosecuting superintendent is asking about the code numbers on the report. "They are assigned to the SIENA report," Totaro says.

13:58 Arnaud asks some questions now.

13:58 Totaro: "No... to the best of my knowledge only I and the team members had access to this room. The exhibits stayed in the room."

13:57 Merceca: "Do you know the locality?"

13:57 He is asked about the room where he saw the evidence. "It is in the Malta Secret Services location," he replies.

13:57 Totaro mentions his team members again. "I don't remember any other interaction. I remember there was an analyst from Europol but I didn't interact with him."

13:56 Mercieca: "During your stay in Malta - two or three days - which other Europol members did you interact with?"

13:50 Totaro: "I arrived with Konstantinos. As far as I remember Sami was already in Malta. Yulia, I don't remember if she was already in Malta."

13:50 Mercieca: "Who else did you arrive with from your colleagues?"

13:49 Totaro: "With regard the exhibits in question, no. I had them after 26 October 2020."

13:48 Mercieca: "Did you, at any point before 26 October 2020, interact with the exhibit, being Fenech's mobile phone?"

13:47 The witness is shown two boxes containing hard drives. He looks at the hard drives and confirms that these are not the ones mentioned in the report. Set C 1 and 2 correspond to what is written in the report, he says.

13:47 The court session resumes and Magistrate Montebello emerges from her chambers

13:25 Mercieca informs the court that they would like to suspend the cross-examination until the hard drives are brought back and rechecked by the expert.

13:18 There appears to be a mistake on the nomenclature used for the data sets, which has led the defence to question the existence of the devices on which they are.

13:14 Mercieca says that his question relates to the actual hard drives.

13:12 Totaro: "Yes, I confirm."

13:12 Mercieca: "Do you confirm that set A and set B are the same, which you exhibited with your colleagues two days ago?"

13:07 Mercieca reforms his question. Does the witness confirm that he had exhibited certain, identified, exhibits? "It was getting lost in translation," says Mercieca.

13:05 An argument erupts between the defence and prosecution after Mercieca tells Inspector Kurt Zahra not to interfere (tindaħalx), when he objects to a question made to the witness.

13:01 Mercieca asks for a copy of a set of data relating to a table in the report. The witness says he had submitted it in his report two days ago.

13:01 Mercieca asks for a copy of a set of data relating to a table in the report. The witness says he had submitted it in his report two days ago.

12:58 Mercieca asks who could give a list of people who accessed the device. The witness says according to the delivery paper, his team leader Sami and the other analyst. "It was kept in the safe, which is accessible to the digital forensic unit team," he says, answering a question by Mercieca.

12:54 The bags are handed to the court registrar, who hands them to the expert witness. He confirms that the number of the evidence bag is correct.

12:53 Mercieca asks if he can open an evidence bag, making as if to open it. "Wait (stenna)," says Yorgen Fenech.

12:51 Totaro: "I can say that nobody accessed the phone after the 26 October."

12:51 Mercieca suggests that he could not tell the court how many people had accessed the phone.

12:47 Totaro says he had but the phone was worked on at the Europol HQ over the span of two or three days.

12:44 Mercieca: "Did you work from home during the pandemic?"

12:44 The witness says he hadn't spoken about the phone or the case directly.

12:43 Mercieca: "Did you exchange words with your colleague when she handed you the phone in the open evidence bag?"

12:42 The Europol expert says the phone was kept isolated in flight mode.

12:40 The phone was not allowed to be turned off after that and would be continuously charged, Totaro explains.

12:39 Mercieca asks if the expert could determine whether it was the first time the phone was worked on when he saw it the first time. Totaro says he was told that the expert he got it from was going to work on it. He was not aware of any previous operation on it. "My colleague can report on her activities on it... Best practises dictated that once a phone is copied, it must be kept on and charged after isolation," he says.

12:29 The defence continues to chip away, asking about the equipment and software. Superintendent Keith Arnaud objects, saying that these proceedings are not meant to be revealing Europol's operational capabilities. Meanwhile, the deputy registrar returns with the exhibited phones and hands them over to the defence.

12:24 Mercieca asks who else had worked on the phones besides him. Totaro names a colleague who handed them to him on 26 October. "These are two iPhones with the SIM detached, according to best practises in digital forensics," he says.

12:22 Mercieca is essentially challenging the chain of custody of the exhibits. He asks the court for the mobile phones and SIM cards exhibited by the witness last Monday. He continues his cross-examination on other topics while the court messenger brings the items to the courtroom.

12:13 Totaro says it was not possible to unlock some of the exhibits so he took the decision to bring the devices back to Europol where larger computers would be used to crack the device security.

12:03 The defence is asking about everything linked to the report, from evidence bag numbers to data acquisition to data hash values. It makes for dreary following.

12:02 The witness asks to be allowed to sit down because of pain. This is granted.

12:02 A hash value is a unique number used as an identifier for data.

12:01 He is being asked about data hash values.

12:00 The witness confirms that the procedure was not filmed.

12:00 Totaro: "In the room provided by the Maltese authorities."

11:59 Mercieca: "Where did you carry this out?"

11:59 Totaro: "Me."

11:59 Mercieca: "Who physically analysed them?"

11:58 Totaro: "I photographed them. Fenech was not present."

11:58 Mercieca: "Who photographed the exhibits? Was Fenech present?"

11:58 Totaro: "I can't say who sees then because I received it from my colleague Sam."

11:57 Mercieca: "Your report refers to exhibits seized in 2019. Who sees the exhibits?"

11:57 Mercieca is chided by the court for not wearing his mask.

11:56 The reply is incomprehensible without having the report in front of you.

11:56 A second and third request are also mentioned in the report. Mercieca asks from whom these requests cam from. He refers to the message in the requests.

11:55 Totaro: "It came from the Maltese police Europol Unit."

11:54 The report mentions a request. "Who did it come from?" Mercieca asks.

11:54 Mercieca asks about the second SIENA message but the witness doesn't recall when it was received. It had information and referred to the first message, Totaro says. "It basically said what was reported in the report," he adds.

11:53 Totaro: "I have access. I don't know who else has access to this message."

11:53 The message was referring to SIENA messages on the background section of his report. It was sent on 21 November 2019. Mercieca asks who had access to it.

11:52 Totaro: "I saw this message."

11:52 Mercieca: "Did you see it?"

11:52 Weapons and explosives and digital forensics received the message in question, the witness continues.

11:50 Mercieca asks if law enforcement has access. The witness explains that not all law enforcement because access is based on the role.

11:50 Mercieca asks who has access to the system. "Do I have access? No," Totaro says, adding that his access is through his role at Europol.

11:48 Mercieca asks where the data was held. "The extraction of the data was done on hard drives I had with me," the witness replies. He explains that a SIENA message is a secure information exchange between Europol and member states.

11:48 Totaro: "I remember that Konstantinos Petrou told us to go to the court... I only met the magistrate once, when I delivered the exhibits not the report."

11:47 Mercieca: "Who told you to report to this magistrate?"

11:47 Totaro: "The only contact was when we delivered the exhibits, before leaving Malta in 2019. It was a male magistrate that I delivered the report to but I didn't remember his name."

11:46 Mercieca: "When you were in Malta did you have any contact with the magistrate who nominated you?"

11:45 Totaro: "The last one was 26 November 2020, to finalise the report. So, the report was finalised on 27 November 2020."

11:45 Mercieca: "When was the last extraction?"

11:45 Totaro: "Yes."

11:44 "Let's talk about the extractions in your reports," begins Mercieca. "You finalised the report after the extractions were carried out, correct?"

11:44 Torri is a former Europol employee. Totaro says he wasn't involved in the case.

11:44 Mercieca asks whether a Marco Torri was in the team. "No," the witness replies.

11:43 Totaro says he liaised with Sammy Hermona who liaised with the Maltese police. In Malta, he worked with Petro and Torres.

11:42 "The office is in The Hague," points out Mercieca. "Who did you liaise with in Malta?"

11:42 Totaro: "I don't recall the name. I just reported the nomination... I'm nominated to examine the exhibits that I received for this case 1292035461. It is related to the explosion mentioned in [the report]..."

11:41 The lawyer notes that on page 3 of the report it is indicated that he was nominated with the rest of the team by the inquiring magistrate.

11:40 Totaro: "It's when I finished compiling the report."

11:39 Lawyer Charles Mercieca refers to Totaro's report, asking what the date on the cover refers to.

11:39 He is asked about his time in America. Totaro says he worked with NASA, the American space agency. He's been with Europol since 2018 and started on the Yorgen Fenech case in November 2019.

11:38 Europol expert Giuseppe Totaro is called to the stand. He is one of the Europol experts who testified in the last sitting. Totaro is asked about his background. He has a PhD in Computer Science and several masters in digital forensics plus a host of other certifications. He was a chief technology officer in the Italian police.

11:37 The court insists that the copies must be handed out in open court and not collected from the magistrate's chambers as suggested by Jason Azzopardi. The acts must be sent to the AG today, the magistrate says. "Nothing and nobody is going to change the procedure before this court. If need be we will wait till February," she says.

11:36 There appears to have been a misunderstanding on the copies and who and when they are to be given out.

11:02 Lawyer Charles Mercieca says the defence didn't yet have the opportunity to see the content of the hard drives given to them by the experts. "We would like to have another opportunity to cross examine the experts as it is humanly impossible," he says.

11:02 A knock on the door and the courtroom stands to attention. Magistrate Rachel Montebello emerges.

10:39 Yorgen Fenech has just entered the courtroom. He sits and converses with his lawyers as we wait for the magistrate to emerge from chambers.

10:19 In the last sitting on Monday, the court heard the testimony of three Europol experts, who also submitted hard drives with all the data extracted from Fenech's electronic devices. The acts of the case now contain 4 terabytes of data.

10:11 The lawyers and police investigators are already in Magistrate Rachel Montebello's courtroom. The court is currently tackling its scheduled cases first before the compilation of evidence begins.

10:09 Good morning.

  • don't miss