Casey Anthony Murder Trial: The Computer Evidence (Part 5)

In part 1, part 2, part 3, and part 4 of this series, I discussed some of the computer evidence introduced into the highly publicized trial where mother Casey Anthony has been accused of first degree murder for the death of her toddler, Caylee Anthony. In my previous articles I summarized the testimony of the three computer forensic experts that were used by the prosecution: Detective Osborne, Detective Sergeant Stenger, and Mr. John Bradley. I also provided some suggestions on how the evidence presented by the prosecution could have been presented in a more persuasive manner. I have also summarized the defense’s questioning of the computer evidence and discussed the headway it may have made against the prosecution’s arguments when three witnesses relevant to the computer evidence in this trial were recalled to the stand: Casey’s mother Cindy Anthony, Detective Osborne, and Detective Sergeant Stenger. Since then, three more witnesses were called and recalled to the stand for the prosecution’s rebuttal case: John Camperlengo from Gentiva (Cindy Anthony’s employer), Detective Sergeant Stenger, and Detective Osborne. Their testimony may have eliminated any headway the defense’s argument may have made with the jury when it was shown that Cindy Anthony may have lied about performing the suspicious searches she admitted to.

John Camperlengo is the Chief Compliance Officer and General Counsel for Gentiva, Cindy Anthony’s employer. Although not a technical computer forensic expert, Mr. Camperlengo is basically the “Custodian of Records” for Gentiva and was called by the prosecution for their rebuttal argument in order to counter Cindy Anthony’s claims that she was not at work during the key dates in March 2008 and she was actually performing the suspicious internet searches on the Anthony’s home computer system such as “chloroform”. As I have said in my past four articles, it is my opinion that the computer evidence is the only evidence I have seen that could clearly show premeditation of this crime should Casey Anthony be found guilty. Cindy Anthony’s testimony casted doubt on that important piece of evidence for the prosecution.

Mr. Camperlengo testified that not only was Cindy at work during the key times those searches were run, but she even worked overtime. When asked if Cindy could stay logged in and go home, Camperlengo said that the systems are set up in a way that they log the user out after 15 minutes of inactivity. I am not sure if he really meant “locked their workstation” in 15 minutes or Gentiva in fact truly logs users out of their computer after 15 minutes of inactivity. Logging a user completely off of their computer system after 15 minutes of inactivity seems very aggressive, especially since something like a phone call could keep you from touching your keyboard within 15 minutes. This is a common misconception by a layperson such as Camperlengo, who does not appear to be an IT professional. Locking a workstation and logging off a workstation are two different things, and would be reflected very differently depending on the types of logs he is referring to during his testimony. They are also very different things when you consider the case against Casey Anthony. You can lock a workstation but the user will still appear to be logged in within the log files. I have not reviewed the logs Mr. Camperlengo used, so it is pure speculation on my part as to what it was he was actually referring to. However, right or wrong, he stated in no uncertain terms that Cindy Anthony would be logged off her workstation within 15 minutes of activity and that is what the jury will consider. Based on that testimony it is highly likely Cindy Anthony was at work during the days in question.

Mr. Camperlengo also went on to state that during the time in question Cindy Anthony was not only logged in to her workstation, but she was updating patient information. Gentiva would be a company regulated by HIPAA, which would make sense for them to audit access and changes regarding patient information. It was unclear to me what system created the logs to which he referenced, and what they showed, exactly. Again, Mr. Camperlengo did not appear to be an IT professional and even admitted that he was a lawyer and therefore not as computer literate as an IT person in his explanation. I think because of this, the evidence was very vague and therefore the defense would have a tough time questioning its authenticity and/or relevance to the matter at hand. I also think that if you were to place an individual from Gentiva's IT department on the stand, he or she would give a slightly different answer than Mr. Camperlengo.  At the end of the day, in my opinion, the prosecution walked away as showing that Cindy Anthony’s testimony (that she had performed the suspicious searches) was most likely false.

To further prove their point, the prosecution called two additional witnesses. The first witness was Detective Sergeant Stenger, who provided computer forensic testimony on two other occasions during the trial. I thought that Stenger’s testimony this time around was much more powerful and effective than the other times he testified simply because of the way he presented his argument. Stenger stated that when he searched the internet history for the Anthony’s home computer system for the other terms Cindy Anthony claimed to have searched for, such as “bamboo”, “hand sanitizer”, and “chlorophyll”, he did not find any matching activity. Stenger outlined several ways he searched the data, which included searching the Cacheback report and even pulling the strings from the raw internet history file and searching it in Microsoft Word. In each instance, he said, none of the keywords Cindy Anthony claimed to have searched for actually showed up in the internet activity. This is another piece of evidence that Cindy Anthony may not have been truthful in her testimony.

The defense’s cross examination of Stenger was so-so. Their only real point with Stenger was that his keyword search only finds instances within the domain names of the websites the user visited, and that may have a different name than the actual content the user viewed. They were correct, with this point, but because the defense attorney asked his questions in such a complicated manner, I’m not sure it overcame Stenger’s testimony that none of the keywords Cindy claimed to have searched showed up. In addition, the defense attorney asked Stenger to disregard the keywords he saw the user search for at Google when answering the question I mentioned above about the domains. If I was testifying in this case, and I can only speak theoretically as I have not reviewed the actual evidence, I would not have given the defense attorney that assumption to work with. Seeing the user search for those keywords at Google and then going to websites with similar domain names is much more compelling and demonstrates something more than a user randomly visiting a domain with an unrelated name and not knowing its contents.

Next up was Detective Osborne. She basically performed the same keyword exam as Stenger, except she examined the whole hard disk from the Anthony’s home computer instead of just the internet history file. Other than some irrelevant hits, Osborne testified that the same keywords were not found on the hard disk from the Anthony’s home computer system. Again, this was very straightforward testimony and it seems like it would be very difficult for the defense to overcome. In short, the prosecution called Cindy Anthony a liar and the defense would have a difficult time proving she was telling the truth, if she was telling the truth.

The cross examination of Detective Osborne was again, in my opinion, uneventful because the defense asked questions in a complicated manner rather than stating the same thought simply. The defense attorney asked Osborne if data on a computer that has been deleted could be overwritten with other data. Of course, Osborne’s answer was “Yes”. However, the defense attorney asked in such a convoluted manner that I am not sure the jury would have understood it. Osborne was clearly the one computer forensic expert of the three that appeared to be the least sure in her answers and the defense did not, in my opinion, press her hard enough to get the simple answers they needed in order to support their argument. It would have been better to ask Osborne the question “Isn’t it true that you may not see all the data that once existed on this computer?” and her answer would have been “Yes”. Then the defense attorney could have asked Osborne “If you were to run your keyword searches on the computer, you would not find any hits in data that once existed on the computer but was overwritten before you received this computer, correct?” and her answer would have been “Yes”. Then the defense attorney could have asked “And it is entirely possible that newer deleted data, such as a document containing these keywords, could have been overwritten before older deleted data and you would not have found it, correct?” and her answer would have been “Yes” again. The last question of “So, in short, you may have been unable to detect if material containing the keywords once existed on the computer, if it existed, correct?” and her answer would have again been “Yes”. Those questions, in my opinion, would have been much more effective in conveying his argument to the jury than the way he went about it. However, I’m not sure that argument actually proves anything against the prosecution’s argument because the prosecution demonstrated with the previous two witnesses that Cindy was most likely at work and not at home searching for “chloroform”, as her testimony stated.

Both sides have rested and they plan to give their closing arguments on July 3, 2011. Although no other computer forensic experts will testify, I hope to write a blog article after the jury returns their verdict. I also may be presenting an attorney CLE class on this subject which highlights the importance of using your expert witnesses effectively and persuasively when their testimony contains seemingly complicated subject matter, such as computer forensics. Stay tuned to the JDA website and blog for further updates!