The Malta Independent 5 August 2021, Thursday

Caruana Galizia murder: Europol took a 'few months' to crack Yorgen Fenech's phone

Wednesday, 16 June 2021, 10:05 Last update: about 3 months ago

It took “a few months” to crack the code and be able to unlock Yorgen Fenech’s mobile phone, a Europol expert has testified.

The Spanish expert, who is seconded with Europol, said the unlocking process was autonomous and the system tries millions of password combinations.

“In the worst-case scenario, it can take up to 30 years… We succeeded after a few months,” she testified in court on Wednesday.

ADVERTISEMENT

She was cross-examined by Fenech’s defence lawyers as the compilation of evidence hearings continued in front of Magistrate Rachel Montebello.

She had been tasked by her superiors to carry out the initial extraction and unlocking process at Europol headquarters in The Hague, Netherlands, on Fenech’s mobile phone.

She also carried out the same process on a mobile phone belonging to a ‘captain’, believed to be the captain of Fenech’s yacht.

Fenech was arrested on the Gio in November 2019 just after the yacht departed Portomaso Marina.

The expert told the court the devices were kept in a Faraday room, which isolates them from radio frequencies. The Faraday room is accessible to several staff members at Europol, the witness said.

She explained that a forensic image is taken of a device, which is a bit by bit copy of the exhibit. This copy is used for analysis purposes, she added, so that the original exhibit can be preserved.

Asked by defence lawyer Charles Mercieca why the analysis is not done on the original device, the expert said it is best practice to work on the image. “It is to preserve the integrity of the device. That is why we were working on the forensic image,” she replied.

Earlier, the court heard the testimony of retired police officers who had been involved in Fenech’s arrest and on the day of the murder.

A former officer who formed part of the Drugs Squad testified that he had been assigned to arrest two men on board a vessel that had been stopped by the AFM at Portomaso Marina.

The witness said Fenech and the yacht captain were on board. Fenech was informed that he was arrested.

The officer testified that when he identified himself as part of the drugs squad, Fenech replied: “It’s better because we won’t take long.”

The police then told him he was being arrested in connection with the homicide of Daphne Caruana Galizia.

Background

Fenech is charged with masterminding the Daphne Caruana Galizia murder.

The evidence against Fenech primarily rests on the testimony of Melvin Theuma, the middleman in the murder. Theuma, who had secretly recorded various conversations between himself, Fenech and others, was given a presidential pardon in 2019 to tell all. 

Daphne Caruana Galizia, an investigative journalist, died in a car bomb explosion outside her home in Bidnija in October 2017. 

Theuma has testified that Fenech told him to make arrangements with the Degiorgio brothers to get rid of Caruana Galizia because of information she was going to publish about his uncle Ray. However, Theuma said that he later understood that the information was related to Fenech and not his uncle. Theuma told investigators he did not know what this information was. 

Theuma got in touch with Alfred Degiorgio and a price of €150,000 was agreed for Caruana Galizia's murder. Theuma gave the go-ahead for the murder after the 2017 general election result when Fenech told him to "get on with it". 

Alfred, his brother George, and their associate Vince Muscat were arrested in December 2017 and charged with carrying out the murder. 

In February this year, Muscat admitted guilt and was sentenced to 15 years in prison after a plea bargain agreement. Proceedings against the Degiorgio brothers are continuing. 

Magistrate Rachel Montebello is hearing the compilation of evidence against Fenech. 

The prosecution is being led by Superintendent Keith Arnaud and Inspector Kurt Zahra, assisted by the Attorney General. 

The defence lawyers are Marion Camilleri, Gianluca Caruana Curran and Charles Mercieca. 

Lawyers Jason Azzopardi and Therese Comodini Cachia are appearing parte civile for the Caruana Galizia family.

12:25 The next sitting is 27 July between 10:30am and 3pm.

12:25 The court tells the witness to provide a copy of the code of conduct. Arnaud asks the court to order the witness to write down the passcode to the devices, behind closed doors. The defence objects, but is overruled.

12:24 Mercieca says he has no further questions for the witness at this stage.

12:13 Mercieca accuses the witness of keeping the devices for 10 months when she was not authorised by a Maltese court. "You are not correct," says the witness, adding that she had been added to the list of experts some weeks after the first list was issued.

12:12 The Europol expert says she cannot just do this in the middle of a court sitting. She will be asked to provide her copy of the code of conduct in the next sitting.

12:12 Mercieca asks her for a copy of the code of conduct for Europol officers. She doesn't have one on her and so is shown Mercieca's copy. The code is in the public domain on the Europol website. The witness is asked to confirm that it is the code which binds seconded national experts.

12:04 She says her superiors had told her to stop working on the devices because she was not mentioned in a Maltese court decree, authorising the experts to analyse them.

12:03 The sitting's allotted time has run out, but Mercieca hasn't finished his cross-examination. The lawyers and court discuss the issue. The sitting continues.

11:54 The expert explains that after the unlocking and before the extraction, the phones were always in the Faraday room. Up to that point she managed to perform the partial and SIM card extractions.

11:53 The Europol expert had been asked to stop at a point during the extraction and hand over to another colleague, the lawyer says. He is referring to what Toma had testified in a previous sitting.

11:52 The expert: "I told it to my line manager."

11:52 Mercieca: "When you got the code, who did you tell?"

11:52 Mercieca asks her to give him the password used on the phone. The court says this will not be published. "I can write it if you like, but I will not say it," she says. Mercieca says it is enough for him to hear that she obtained it herself.

11:51 The Europol expert says that after the phone was unlocked, she tried to make the full extractions of the data.

11:50 Mercieca says that it is not possible for her to confirm that aside from the moments when she was inside the Faraday room, the phone was not moved.

11:40 Mercieca asks how the exhibits were moved. She says that the items were placed in an exhibit bag.

11:38 The exhibits were handed to her colleague Giuseppe Totaro in her office, in the same way she had received them. The Faraday room was three floors away, explains the witness.

11:38 The Europol expert says that she checked the exhibits every day. "When I am available, I go and check my exhibits. The unlocking process needs to be observed every day because it could stop for unknown reasons," she explains.

11:34 "It is not possible to be in the Faraday room for more than 24 hours," she says.

11:34 The lawyer asks about an illegible part of the notes, but she says it refers to a forensic tool and so she cannot tell the court this. The lawyer attempts to get her to explain how the unblocking process works, but is rebuffed by the witness, who explains that she cannot do this.

11:33 Mercieca asks about some details which she had written in shorthand, in Greek. They deal with the time taken to carry out extraction - 50min, she says. This dealt with preliminary stages, not the entire process, she elaborates.

11:23 Mercieca asks if her previous stay in Malta could have helped her identify devices as ‘businessman' and ‘captain'. "No, they are not connected," she replies.

11:22 The Europol expert is brought back inside the courtroom. "I think it was not related," she says.

11:22 Deputy AG Philip Galea Farrugia says the question is far too open. The lawyers talk over each other. The matter is finally settled and she will only be asked whether the reason for her previous visit was related to the murder of Daphne Caruana Galizia.

11:21 The defence says it needs to establish the reason why the witness came to Malta and whether it was to do with the case.

11:20 Arnaud stands up to protest. The court says it will not allow the question. The witness is sent out until this is thrashed out. "Don't put words into the mouth of the witness," says the court.

11:20 The expert explains that she had come to Malta previously on another case and thought they were similar. Mercieca asks her what the previous case was. "Was it to do with Caruana Galizia?"

11:19 Mercieca moves on, asking her about her notes which stated 'same case as my previous case'.

11:19 The expert labelled the exhibits as ‘businessman' and ‘captain'. The court asks if apart from her colleague, someone else had spoken to her about the phone. She says she cannot recall where she got the information from. She also cannot recall why she labelled them that way.

11:05 The forensic tools used by the lab are made by companies, points out Mercieca, which were not part of Europol.

11:03 The unlocking process is an autonomous process, which tries millions of password combinations, Toma says. "In the worst-case scenario, it can take up to 30 years," she adds. They succeeded after a few months.

11:01 She was alone when the unlocking process was started. Nobody assisted her, she says. She was in the Faraday room.

10:59 Mercieca presses her on the dates. She says that she keeps notes of the examinations she performs and asks permission to check them. Permission is granted. Toma says she started at 11:30pm and finished at 3am the next day. Starting at 4am on the other one, she continued till lunchtime the day after receiving the items. The witness presents a copy of her personal notes after making sure that the software tools used are not revealed in them.

10:53 The partial extraction was successful and data was extracted from the phone, the expert explains. She had started working on the phone as soon as she received the exhibits at 11:30pm. The unlocking process began immediately after the partial extraction.

10:52 Asked if this timing is normal, she says it was because a colleague of hers was travelling from Malta to The Hague at that time.

10:52 She says that she received the item in her office in an evidence bag. Toma says that if the best practices are followed it will not affect the integrity of the phone. When she received the phone, she didn't know if it was in flight mode or not. Her colleague had handed it over to her at 11:30pm.

10:50 The expert: "I received two exhibits. One was unsealed and one was not. The unsealed one was an iPhone XS Max A2101. The first thing I do is to physically examine the exhibits for external issues such as damage. The first exhibit was slightly damaged, locked with a 6-digit passcode and in flight mode. The second one was sealed and was in flight mode. The first item was switched on but locked."

10:43 Mercieca asks about the condition of the device when she received it.

10:41 "You need a badge to access the room," says the witness. "Around 10 people have a key card," she adds, when asked about it. She was not aware of any logging procedures regarding visits to the Faraday room.

10:40 Mercieca asks how many Faraday rooms Europol had, but is overruled on the objection of the prosecution.

10:39 The exhibit was examined in a Faraday room, which isolates the device from radio frequencies. It is in Europol HQ and is accessible to several staff members, the witness says.

10:37 Mercieca asks if she had a way of verifying if anyone had accessed the device before she worked on it. Toma says she did not.

10:37 The expert explains that it is best practice to work on the image. "It is to preserve the integrity of the device. That is why we were working on the forensic image," she says.

10:36 Mercieca: "Why not use the original device?"

10:35 The witness: "It is necessary because it is a bit by bit copy of the exhibit. Then when you want to analyse it you are not working on the original exhibit anymore, you are working on the image."

10:35 Mercieca asks why a forensic image is necessary.

10:34 Mercieca asks if she created a forensic image of the phone. She explains that it is called a "partial extraction". Toma says she did not make any analysis. "After the partial extraction, I proceeded to the unlocking process. IT is a multi-task process," she says.

10:33 She affirms this.

10:33 Mercieca: "In the last sitting you told us that you had been told to conduct an immediate forensic examination."

10:30 Mercieca asks her to confirm the contents and that she had presented it herself. Toma confirms the document is the same she had submitted.

10:28 Defence lawyer Charles Mercieca cross-examines. He shows her documentation which she had exhibited to the court.

10:27 She tells the court that she is a seconded national expert in the digital forensic lab.

10:26 Next up is the Europol expert who testified in a previous sitting.

10:23 Another sergeant, stationed at Mosta, takes her place on the stand to exhibit her report on the murder. She had gone to the scene of the murder and the report details all of what she had seen.

10:22 The police officer steps off the witness stand.

10:21 The Maya was the vessel on which George Degiorgio was on when he detonated the bomb that killed Caruana Galizia.

10:21 He also exhibits surveillance footage of the Maya entering the harbour and docking near the potato shed in Marsa. This was taken after the murder, in November. The witness had created a timeline of the Maya's movements with the photographs.

10:20 After the murder, part of his duties was the collection of CCTV from court experts. Some of them were from the Grand Harbour. Stills of vessels of interest were taken. He presents a 31-page report of still frames from the footage.

10:19 Another former officer, a sergeant takes the stand. He retired from the police force in 2019. At the time, he was a CID sergeant with Arnaud.

10:17 Lawyer Gianluca Caruana Curran cross-examines him. The witness says that Fenech did not have a bad attitude during the arrest and searches.

10:15 The officer had helped in the search of Fenech's boat and his residence at Portomaso.

10:15 Yorgen Fenech was informed that he was arrested. The officers told him they were from the drugs squad and Fenech had said "it's better because we won't take long". They then told him he was being arrested in connection with the homicide of Daphne Caruana Galizia.

10:13 Ex-PC Andre Grech formerly of the Drugs Squad testifies. He left in 2020. His involvement in the case was in the arrest of Fenech. Inspector Kevin Pulis had informed the arresting officers that there was a vessel in Portomaso that had been stopped by the AFM and that the officers had to go make arrests. Grech says that there were two men on the vessel, Yorgen Fenech and the skipper.

10:12 Superintendent Keith Arnaud says he has two former officers to testify and then a Europol expert for cross-examination. After that, he says Matthew Caruana Galizia will take the stand.

10:09 Magistrate Rachel Montebello enters the courtroom and the sitting begins.

10:08 Yorgen Fenech steps into the courtroom accompanied by prison guards. While we wait for the magistrate to emerge from chambers, Caruana Curran and Mercieca move over to sit next to Fenech.

10:05 So far there is no sign of Yorgen Fenech but prosecuting Superintendent Keith Arnaud is inside the courtroom as are Caruana Galizia family lawyer Jason Azzopardi and defence lawyers Gianluca Caruana Curran and Charles Mercieca.

  • don't miss